Repository: omega8cc/boa Branch: 5.x-dev Commit: 0daf1f2a4803 Files: 616 Total size: 9.6 MB Directory structure: gitextract_47j2j2qw/ ├── .gitignore ├── ANNOUNCEMENT.md ├── BARRACUDA.sh.txt ├── BOA.sh.txt ├── CHANGELOG.txt ├── DIFFERENT30Y.md ├── DUALLICENSE.md ├── HTTP3.md ├── OCTOPUS.sh.txt ├── README.md ├── ROADMAP.md ├── aegir/ │ ├── conf/ │ │ ├── apparmor/ │ │ │ ├── opt.php56.bin.php │ │ │ ├── opt.php56.sbin.php-fpm │ │ │ ├── opt.php70.bin.php │ │ │ ├── opt.php70.sbin.php-fpm │ │ │ ├── opt.php71.bin.php │ │ │ ├── opt.php71.sbin.php-fpm │ │ │ ├── opt.php72.bin.php │ │ │ ├── opt.php72.sbin.php-fpm │ │ │ ├── opt.php73.bin.php │ │ │ ├── opt.php73.sbin.php-fpm │ │ │ ├── opt.php74.bin.php │ │ │ ├── opt.php74.sbin.php-fpm │ │ │ ├── opt.php80.bin.php │ │ │ ├── opt.php80.sbin.php-fpm │ │ │ ├── opt.php81.bin.php │ │ │ ├── opt.php81.sbin.php-fpm │ │ │ ├── opt.php82.bin.php │ │ │ ├── opt.php82.sbin.php-fpm │ │ │ ├── opt.php83.bin.php │ │ │ ├── opt.php83.sbin.php-fpm │ │ │ ├── opt.php84.bin.php │ │ │ ├── opt.php84.sbin.php-fpm │ │ │ ├── opt.php85.bin.php │ │ │ ├── opt.php85.sbin.php-fpm │ │ │ ├── sbin.dhclient │ │ │ ├── usr.bin.chromium │ │ │ ├── usr.bin.freshclam │ │ │ ├── usr.bin.man │ │ │ ├── usr.bin.mysecureshell │ │ │ ├── usr.bin.mysql │ │ │ ├── usr.bin.mysqld_safe │ │ │ ├── usr.bin.newrelic-daemon │ │ │ ├── usr.bin.node │ │ │ ├── usr.bin.redis-server │ │ │ ├── usr.bin.valkey-server │ │ │ ├── usr.local.bin.lshell │ │ │ ├── usr.local.bin.ssh │ │ │ ├── usr.local.bin.wkhtmltoimage │ │ │ ├── usr.local.bin.wkhtmltopdf │ │ │ ├── usr.local.sbin.pure-ftpd │ │ │ ├── usr.local.sbin.sshd │ │ │ ├── usr.sbin.clamd │ │ │ ├── usr.sbin.mysqld │ │ │ ├── usr.sbin.nginx │ │ │ ├── usr.sbin.rsyslogd │ │ │ └── usr.sbin.unbound │ │ ├── dns/ │ │ │ ├── unbound │ │ │ ├── unbound-helper │ │ │ └── unbound.conf │ │ ├── droplet/ │ │ │ └── droplet-agent │ │ ├── etc/ │ │ │ └── etc-ImageMagick-6-policy.xml │ │ ├── ftpd/ │ │ │ ├── ftpusers │ │ │ ├── pure-config.pl.txt │ │ │ └── pure-ftpd.conf │ │ ├── global/ │ │ │ ├── global-10.inc │ │ │ ├── global-11.inc │ │ │ ├── global-6.inc │ │ │ ├── global-7.inc │ │ │ ├── global-8.inc │ │ │ ├── global-9.inc │ │ │ ├── global-extra.inc │ │ │ ├── global-front-end.inc │ │ │ ├── global-if-redis.inc │ │ │ ├── global-if-valkey.inc │ │ │ ├── global-ini.inc │ │ │ ├── global-main.inc │ │ │ ├── global-mode.inc │ │ │ ├── global-newrelic.inc │ │ │ ├── global-redis.inc │ │ │ ├── global-settings.inc │ │ │ ├── global-valkey.inc │ │ │ ├── global.inc │ │ │ ├── override.global.inc │ │ │ └── settings.global.inc │ │ ├── ini/ │ │ │ ├── default.boa_platform_control.ini │ │ │ ├── default.boa_site_control.ini │ │ │ └── panels.ini │ │ ├── network/ │ │ │ └── networking │ │ ├── nginx/ │ │ │ ├── fastcgi_params.txt │ │ │ ├── mime.types │ │ │ ├── nginx │ │ │ ├── nginx-squeeze-init │ │ │ ├── nginx.conf │ │ │ ├── nginx_compact_include.conf │ │ │ ├── nginx_high_load_off.conf │ │ │ ├── nginx_speed_purge.conf │ │ │ ├── nginx_sql_adminer.conf │ │ │ ├── nginx_sql_buddy.conf │ │ │ ├── nginx_sql_cgp.conf │ │ │ ├── nginx_sql_chive.conf │ │ │ └── nginx_wild_ssl.conf │ │ ├── php/ │ │ │ ├── fpm-pool-common-legacy.conf │ │ │ ├── fpm-pool-common-modern.conf │ │ │ ├── fpm-pool-common.conf │ │ │ ├── fpm-pool-foo-multi.conf │ │ │ ├── fpm-pool-foo.conf │ │ │ ├── fpm56-pool-www.conf │ │ │ ├── fpm70-pool-www.conf │ │ │ ├── fpm71-pool-www.conf │ │ │ ├── fpm72-pool-www.conf │ │ │ ├── fpm73-pool-www.conf │ │ │ ├── fpm74-pool-www.conf │ │ │ ├── fpm80-pool-www.conf │ │ │ ├── fpm81-pool-www.conf │ │ │ ├── fpm82-pool-www.conf │ │ │ ├── fpm83-pool-www.conf │ │ │ ├── fpm84-pool-www.conf │ │ │ ├── fpm85-pool-www.conf │ │ │ ├── newrelic.ini │ │ │ ├── php56-cli.ini │ │ │ ├── php56-fpm │ │ │ ├── php56-fpm.conf │ │ │ ├── php56.ini │ │ │ ├── php70-cli.ini │ │ │ ├── php70-fpm │ │ │ ├── php70-fpm.conf │ │ │ ├── php70.ini │ │ │ ├── php71-cli.ini │ │ │ ├── php71-fpm │ │ │ ├── php71-fpm.conf │ │ │ ├── php71.ini │ │ │ ├── php72-cli.ini │ │ │ ├── php72-fpm │ │ │ ├── php72-fpm.conf │ │ │ ├── php72.ini │ │ │ ├── php73-cli.ini │ │ │ ├── php73-fpm │ │ │ ├── php73-fpm.conf │ │ │ ├── php73.ini │ │ │ ├── php74-cli.ini │ │ │ ├── php74-fpm │ │ │ ├── php74-fpm.conf │ │ │ ├── php74.ini │ │ │ ├── php80-cli.ini │ │ │ ├── php80-fpm │ │ │ ├── php80-fpm.conf │ │ │ ├── php80.ini │ │ │ ├── php81-cli.ini │ │ │ ├── php81-fpm │ │ │ ├── php81-fpm.conf │ │ │ ├── php81.ini │ │ │ ├── php82-cli.ini │ │ │ ├── php82-fpm │ │ │ ├── php82-fpm.conf │ │ │ ├── php82.ini │ │ │ ├── php83-cli.ini │ │ │ ├── php83-fpm │ │ │ ├── php83-fpm.conf │ │ │ ├── php83.ini │ │ │ ├── php84-cli.ini │ │ │ ├── php84-fpm │ │ │ ├── php84-fpm.conf │ │ │ ├── php84.ini │ │ │ ├── php85-cli.ini │ │ │ ├── php85-fpm │ │ │ ├── php85-fpm.conf │ │ │ └── php85.ini │ │ ├── redis/ │ │ │ ├── redis-server │ │ │ ├── redis.conf │ │ │ ├── redis4.conf │ │ │ ├── redis5.conf │ │ │ ├── redis6.conf │ │ │ └── redis7.conf │ │ ├── solr9/ │ │ │ ├── analysis-extras.mod │ │ │ ├── analytics.mod │ │ │ ├── clustering.mod │ │ │ ├── cross-dc.mod │ │ │ ├── extraction.mod │ │ │ ├── gcs-repository.mod │ │ │ ├── hadoop-auth.mod │ │ │ ├── hdfs.mod │ │ │ ├── jaegertracer-configurator.mod │ │ │ ├── jwt-auth.mod │ │ │ ├── langid.mod │ │ │ ├── llm.mod │ │ │ ├── ltr.mod │ │ │ ├── opentelemetry.mod │ │ │ ├── s3-repository.mod │ │ │ ├── scripting.mod │ │ │ └── sql.mod │ │ ├── tpl/ │ │ │ ├── migration.html │ │ │ ├── robots.txt │ │ │ ├── setupmail.txt │ │ │ ├── uc.html │ │ │ └── upgrademail.txt │ │ ├── valkey/ │ │ │ ├── valkey-server │ │ │ ├── valkey7.conf │ │ │ ├── valkey8.conf │ │ │ └── valkey9.conf │ │ ├── var/ │ │ │ ├── boa.bashrc.txt │ │ │ ├── clean-boa-env │ │ │ ├── crossdomain.xml │ │ │ ├── csf.conf │ │ │ ├── galera.cnf │ │ │ ├── get.htaccess.txt │ │ │ ├── logrotate.d.rsyslog.conf │ │ │ ├── my.cnf.txt │ │ │ ├── mysql │ │ │ ├── mysql-notices.conf │ │ │ ├── named.conf.options │ │ │ ├── rsyslog.conf │ │ │ ├── sftp_config │ │ │ ├── ssh_config │ │ │ ├── sshd_config │ │ │ └── sysctl.conf │ │ └── version/ │ │ ├── barracuda-release.txt │ │ ├── barracuda-version.txt │ │ ├── octopus-release.txt │ │ ├── octopus-version.txt │ │ ├── release.txt │ │ └── version.txt │ ├── helpers/ │ │ ├── Gemfile.txt │ │ ├── apt-list-debian.txt │ │ ├── apt.conf.noi.dist │ │ ├── apt.conf.noi.nrml │ │ ├── apt.conf.noninteractive │ │ ├── cf-simple-hook.sh │ │ ├── challenge-dns-email-hook.sh │ │ ├── dehydrated │ │ ├── dump_cdorked_config.c │ │ ├── fix-fstab-to-uuid.sh │ │ ├── hosting_cron.sql │ │ ├── le-hook.sh │ │ ├── make_client.php.txt │ │ ├── make_client_3.php.txt │ │ ├── make_home.php.txt │ │ ├── make_platform.php.txt │ │ ├── make_platform_3.php.txt │ │ ├── mysql_root_pass_reset.sh │ │ ├── mysqltuner5 │ │ ├── mysqltuner8 │ │ ├── rtoc.php.txt │ │ ├── spinner │ │ ├── systemtime │ │ └── websh.sh.txt │ ├── makefiles/ │ │ ├── civicrm-4.5-d6.make │ │ ├── civicrm-4.5-d7.make │ │ ├── civicrm-4.6-d6.make │ │ ├── civicrm-4.6-d7.make │ │ ├── civicrm-4.7-d6.make │ │ ├── civicrm-4.7-d7.make │ │ ├── civicrm-5.0-d6.make │ │ ├── civicrm-5.0-d7.make │ │ ├── civicrm-5.1-d7.make │ │ ├── civicrm-5.2-d7.make │ │ ├── civicrm-5.3-d7.make │ │ ├── civicrm-5.35-d7.make │ │ └── civicrm-5.9-d7.make │ ├── patches/ │ │ ├── 0001-Print-site_footer-if-defined.patch │ │ ├── 2106995-fatal-error-non-object-1.patch │ │ ├── 6-core/ │ │ │ ├── SA-CORE-2018-002-D6.patch │ │ │ ├── SA-CORE-2018-004-D6.patch │ │ │ └── patch_commit_7a847db99f80.patch │ │ ├── 7-core/ │ │ │ ├── 3143016-83-D7.patch │ │ │ ├── SA-CORE-2014-005-D7.patch │ │ │ ├── SA-CORE-2018-002-D7.patch │ │ │ ├── SA-CORE-2018-004-D7.patch │ │ │ ├── SA-CORE-2018-006-D7.patch │ │ │ ├── drupal-2656548-21-php7.patch │ │ │ └── patch_commit_b8a8a84ea9b3.patch │ │ ├── 8-core/ │ │ │ ├── 0001-Symlink-core-support-test.patch │ │ │ ├── SA-CORE-2018-002-D8.patch │ │ │ ├── SA-CORE-2018-004-D8.patch │ │ │ └── SA-CORE-2018-006-D8.patch │ │ ├── 992540-3-reset_flood_limit_on_password_reset-drush.patch │ │ ├── MailManagerReplacement.php.patch │ │ ├── PHP-5.6.31-OpenSSL-1.1.0-compatibility-20170801.patch │ │ ├── activity.patch │ │ ├── apps_msg.patch │ │ ├── bug62886.patch │ │ ├── civicrm.drush.inc.patch.txt │ │ ├── civicrm_engage.install │ │ ├── commerce_kickstart.patch │ │ ├── commons-1045778-fix-aegir-installs.patch │ │ ├── commons-1060250-aegir-infinite-loop.patch │ │ ├── commons_chicken_egg.patch │ │ ├── disable_SSLv2_for_openssl_1_0_0.patch │ │ ├── drupal-eleven-aegir-console-02.patch │ │ ├── drupal-eleven-aegir-core-01.patch │ │ ├── drupal-eleven-aegir-validator-03.patch │ │ ├── drupal-ten-aegir-console-02.patch │ │ ├── drupal-ten-aegir-core-01.patch │ │ ├── drush-remote_make_files.patch │ │ ├── drush_make-drush-4.x-fix-do7-compatibility.patch │ │ ├── drush_make.drush.inc.patch │ │ ├── features-1265168-19-roles.patch │ │ ├── field_info_collate_fields-1400256-25.patch │ │ ├── fpm_main.c.patch │ │ ├── freetype.patch │ │ ├── hosting_advanced_cron.patch │ │ ├── hosting_cron.module │ │ ├── hosting_cron_queue-reliability.patch │ │ ├── hosting_le_vhost.drush.inc │ │ ├── imagecache-1243258-5.patch │ │ ├── imagefield_crop.patch │ │ ├── julio_profile.patch │ │ ├── my_config.h.patch │ │ ├── mysql.provision.patch │ │ ├── nik.patch │ │ ├── object_conversion_menu_router_build-972536-1.patch │ │ ├── octopus_video.patch │ │ ├── og_update_6205_commons_fix.patch │ │ ├── openacademy-search-off.patch │ │ ├── openacademy.patch │ │ ├── openaid-tpl.patch │ │ ├── openenterprise.patch │ │ ├── openoutreach.patch │ │ ├── openpublic.patch │ │ ├── openscholar.profile.patch │ │ ├── openscholar_projects.profile.patch │ │ ├── panopoly-search-off.patch │ │ ├── panopoly-search-redis.patch │ │ ├── patch_commit_6fabd31b0f81.patch │ │ ├── patch_commit_fa47bad85589.patch │ │ ├── php-8.1-openssl3.patch │ │ ├── provision/ │ │ │ └── patch_commit_e4abc685f9b4.patch │ │ ├── provision_hosting_le.drush.inc │ │ ├── remove_usr1_usr2_fpm_unix.patch │ │ ├── restaurant_demo.patch │ │ ├── singular.mft.patch │ │ ├── singular.patch │ │ ├── skwashd.commons.patch │ │ ├── taxonomy-6.20.patch │ │ ├── taxonomy-6.26.patch │ │ ├── taxonomy-7.12.patch │ │ ├── taxonomy-7.7.patch │ │ ├── ubercart-1167276-reroll.patch │ │ ├── user.drush.inc.patch │ │ ├── videola.patch │ │ ├── views-853864_2.patch │ │ ├── views-exposed-sorts-2037469-1.patch │ │ ├── views-revert-broken-filter-or-groups-1766338-7.patch │ │ └── views-unpack_options-cache-6.2-51.patch │ ├── scripts/ │ │ ├── AegirSetupA.sh.txt │ │ ├── AegirSetupB.sh.txt │ │ ├── AegirSetupC.sh.txt │ │ ├── AegirSetupM.sh.txt │ │ ├── AegirUpgrade.sh.txt │ │ └── run-xdrago │ └── tools/ │ ├── BOND.sh.txt │ ├── backup/ │ │ └── run/ │ │ ├── create_config_readme.sh │ │ ├── create_credentials_templates.sh │ │ ├── create_cron_entries.sh │ │ ├── create_global_paths_config.sh │ │ ├── create_readme.sh │ │ ├── create_user_paths_config.sh │ │ ├── duplicity_backup.sh │ │ ├── duplicity_bundle_installer.sh │ │ └── install_dependencies.sh │ ├── bin/ │ │ ├── aptcleanup │ │ ├── aptfast │ │ ├── autobeowulf │ │ ├── autochimaera │ │ ├── autodaedalus │ │ ├── autoexcalibur │ │ ├── autoinit │ │ ├── automini │ │ ├── autosymlink │ │ ├── autoupboa │ │ ├── backboa │ │ ├── backchain │ │ ├── barracuda │ │ ├── boa │ │ ├── cluster │ │ ├── codebasecheck │ │ ├── copydbackup │ │ ├── dcysetup │ │ ├── dhcpfix │ │ ├── duobackboa │ │ ├── fancynow │ │ ├── ffdevuan │ │ ├── ffmirror │ │ ├── fix-drupal-platform-ownership.sh │ │ ├── fix-drupal-platform-permissions.sh │ │ ├── fix-drupal-site-ownership.sh │ │ ├── fix-drupal-site-permissions.sh │ │ ├── fixmounts │ │ ├── fixrepo │ │ ├── killer │ │ ├── loadguard │ │ ├── lock-local-drush-permissions.sh │ │ ├── lock.inc │ │ ├── memorytuner │ │ ├── mergecsf │ │ ├── multiback │ │ ├── mybackup │ │ ├── mycnfup │ │ ├── octopus │ │ ├── perftest │ │ ├── proxysql_galera_checker │ │ ├── proxysql_node_monitor │ │ ├── randpass │ │ ├── renameaegirhost │ │ ├── screenfetch │ │ ├── setprio │ │ ├── showdepend │ │ ├── smtpgapps │ │ ├── sqlclean │ │ ├── sqlmagic │ │ ├── syncpass │ │ ├── synproxy │ │ ├── synproxy_hook_fix │ │ ├── synproxy_monitor │ │ ├── synproxy_reassert │ │ ├── synproxy_rollback │ │ ├── synproxy_snapshot │ │ ├── synproxy_status │ │ ├── thinkdifferent │ │ ├── updatesymlinks │ │ ├── verifyvhostsdns │ │ ├── vhostcheck │ │ ├── vmnetfix │ │ ├── weblogx │ │ ├── webserver │ │ ├── websh │ │ ├── xboa │ │ └── xcopy │ ├── host/ │ │ ├── host-fire.sh │ │ └── host-water.sh │ └── system/ │ ├── checksql.pl │ ├── clear.sh │ ├── conf/ │ │ ├── SA-CORE-2014-005-D7.patch │ │ ├── control-readme.txt │ │ ├── https_proxy_le.conf │ │ ├── lshell.conf │ │ ├── pln_proxy.conf │ │ ├── proxy.conf │ │ ├── solr/ │ │ │ ├── apachesolr/ │ │ │ │ ├── solr4_drupal6/ │ │ │ │ │ ├── elevate.xml │ │ │ │ │ ├── mapping-ISOLatin1Accent.txt │ │ │ │ │ ├── protwords.txt │ │ │ │ │ ├── schema.xml │ │ │ │ │ ├── schema_extra_fields.xml │ │ │ │ │ ├── schema_extra_types.xml │ │ │ │ │ ├── solrconfig.xml │ │ │ │ │ ├── solrconfig_extra.xml │ │ │ │ │ ├── solrcore.properties │ │ │ │ │ ├── stopwords.txt │ │ │ │ │ └── synonyms.txt │ │ │ │ ├── solr4_drupal7/ │ │ │ │ │ ├── elevate.xml │ │ │ │ │ ├── mapping-ISOLatin1Accent.txt │ │ │ │ │ ├── protwords.txt │ │ │ │ │ ├── schema.xml │ │ │ │ │ ├── schema_extra_fields.xml │ │ │ │ │ ├── schema_extra_types.xml │ │ │ │ │ ├── solrconfig.xml │ │ │ │ │ ├── solrconfig_extra.xml │ │ │ │ │ ├── solrcore.properties │ │ │ │ │ ├── stopwords.txt │ │ │ │ │ └── synonyms.txt │ │ │ │ └── solr7_drupal7/ │ │ │ │ ├── elevate.xml │ │ │ │ ├── mapping-ISOLatin1Accent.txt │ │ │ │ ├── protwords.txt │ │ │ │ ├── schema.xml │ │ │ │ ├── schema_extra_fields.xml │ │ │ │ ├── schema_extra_types.xml │ │ │ │ ├── solrconfig.xml │ │ │ │ ├── solrconfig_extra.xml │ │ │ │ ├── solrcore.properties │ │ │ │ ├── stopwords.txt │ │ │ │ └── synonyms.txt │ │ │ └── search_api_solr/ │ │ │ ├── solr4_drupal7/ │ │ │ │ ├── elevate.xml │ │ │ │ ├── mapping-ISOLatin1Accent.txt │ │ │ │ ├── protwords.txt │ │ │ │ ├── schema.xml │ │ │ │ ├── schema_extra_fields.xml │ │ │ │ ├── schema_extra_types.xml │ │ │ │ ├── solrconfig.xml │ │ │ │ ├── solrconfig_extra.xml │ │ │ │ ├── solrcore.properties │ │ │ │ ├── stopwords.txt │ │ │ │ └── synonyms.txt │ │ │ ├── solr7_drupal10/ │ │ │ │ ├── elevate.xml │ │ │ │ ├── schema.xml │ │ │ │ ├── solrconfig.xml │ │ │ │ └── solrcore.properties │ │ │ ├── solr7_drupal7/ │ │ │ │ ├── elevate.xml │ │ │ │ ├── mapping-ISOLatin1Accent.txt │ │ │ │ ├── protwords.txt │ │ │ │ ├── schema.xml │ │ │ │ ├── schema_extra_fields.xml │ │ │ │ ├── schema_extra_types.xml │ │ │ │ ├── solrconfig.xml │ │ │ │ ├── solrconfig_extra.xml │ │ │ │ ├── solrcore.properties │ │ │ │ ├── stopwords.txt │ │ │ │ └── synonyms.txt │ │ │ ├── solr7_drupal8/ │ │ │ │ ├── elevate.xml │ │ │ │ ├── schema.xml │ │ │ │ ├── solrconfig.xml │ │ │ │ └── solrcore.properties │ │ │ ├── solr7_drupal9/ │ │ │ │ ├── elevate.xml │ │ │ │ ├── schema.xml │ │ │ │ ├── solrconfig.xml │ │ │ │ └── solrcore.properties │ │ │ └── solr9_drupal10/ │ │ │ ├── elevate.xml │ │ │ ├── schema.xml │ │ │ ├── solrconfig.xml │ │ │ └── solrcore.properties │ │ └── ssl_proxy.conf │ ├── cron/ │ │ └── crontabs/ │ │ └── root │ ├── daily.sh │ ├── graceful.sh │ ├── guest-fire.sh │ ├── guest-water.sh │ ├── ip_access.sh │ ├── log/ │ │ └── EMPTY.txt │ ├── manage_ltd_users.sh │ ├── manage_solr_config.sh │ ├── minute.sh │ ├── monitor/ │ │ └── check/ │ │ ├── escapecheck.pl │ │ ├── escapecheck.sh │ │ ├── hackcheck.pl │ │ ├── hackcheck.sh │ │ ├── hackftp.pl │ │ ├── hackftp.sh │ │ ├── java.sh │ │ ├── mysql.sh │ │ ├── nginx.sh │ │ ├── nginx_guard.sh │ │ ├── php.sh │ │ ├── redis.sh │ │ ├── scan_nginx.sh │ │ ├── segfault_alert.pl │ │ ├── sqlcheck.pl │ │ ├── system.sh │ │ ├── unbound.sh │ │ └── valkey.sh │ ├── move_sql.sh │ ├── mysql_backup.sh │ ├── mysql_cleanup.sh │ ├── mysql_cluster_backup.sh │ ├── mysql_repair.sh │ ├── proc_num_ctrl.pl │ ├── purge_binlogs.sh │ ├── runner.sh │ ├── second.sh │ └── usage.sh ├── docs/ │ ├── BACKUPS.md │ ├── BACKUP_REGIONS.md │ ├── BACKUP_RETENTION.md │ ├── BACKUP_ROOT.md │ ├── BACKUP_USER.md │ ├── BLOWFISH.md │ ├── BRANCHES.md │ ├── BUILDTESTS.md │ ├── CAVEATS.md │ ├── CLUSTER.md │ ├── COMPOSER.md │ ├── CONTRIBUTING.md │ ├── DEVELOPMENT.md │ ├── DISK_RESIZE.md │ ├── DRUPALGEDDON.md │ ├── DRUSH-CLI.md │ ├── FAQ.md │ ├── FASTTRACK.md │ ├── FIXME.md │ ├── GEM.md │ ├── INSTALL.md │ ├── IPv6.md │ ├── MAJORUPGRADE.md │ ├── MIGRATE.md │ ├── MODULES.md │ ├── MYQUICK.md │ ├── NEWRELIC.md │ ├── NOTES.md │ ├── PHP-FPM.md │ ├── PLATFORMS.md │ ├── PROVIDES.md │ ├── REMOTE.md │ ├── REWRITES.md │ ├── SECURITY.md │ ├── SELFUPGRADE.md │ ├── SKYNET.md │ ├── SMTP_SSL_DEBUG.md │ ├── SOLR.md │ ├── SOLR_OPTIMIZE.md │ ├── SSL.md │ ├── UPGRADE.md │ ├── cnf/ │ │ ├── barracuda.cnf │ │ └── octopus.cnf │ ├── ctrl/ │ │ ├── platform.ctrl │ │ ├── site.ctrl │ │ └── system.ctrl │ └── ini/ │ ├── platform/ │ │ └── INI.md │ └── site/ │ └── INI.md ├── lib/ │ ├── functions/ │ │ ├── dns.sh.inc │ │ ├── firewall.sh.inc │ │ ├── helper.sh.inc │ │ ├── hotfix.sh.inc │ │ ├── master.sh.inc │ │ ├── nginx.sh.inc │ │ ├── php.sh.inc │ │ ├── redis.sh.inc │ │ ├── satellite.sh.inc │ │ ├── solr.sh.inc │ │ ├── sql.sh.inc │ │ ├── system.sh.inc │ │ ├── valkey.sh.inc │ │ └── xtra.sh.inc │ └── settings/ │ ├── barracuda.sh.cnf │ └── octopus.sh.cnf └── releases/ ├── BOA-5.6.0-PRO.md ├── BOA-5.7.11-PRO.md ├── BOA-5.8.5-PRO.md └── BOA-5.9.1-PRO.md ================================================ FILE CONTENTS ================================================ ================================================ FILE: .gitignore ================================================ # Ignore paths from OS X .DS_Store ================================================ FILE: ANNOUNCEMENT.md ================================================ # The Future of Ægir 3 is Bryght! *Announcement from Omega8.cc* Omega8.cc is now the lead developer team for Ægir 3 running on BOA (Barracuda-Octopus-Ægir stack). We want to thank all past contributors who brought Ægir to life – your work makes today’s progress possible. Because of you, there is still a Bryght Future for Ægir. Ægir-Sector ## What to Expect - **Active maintenance and development**: Ægir 3 on BOA is alive and under active development. [See Adam’s comments here](https://www.drupal.org/project/hostmaster/issues/3517915). - **Migration made easier**: We are working to make it simple to migrate entire legacy Ægir instances (Apache or Nginx) into self-hosted BOA as Octopus Ægir. - **Standalone Ægir with BOA features**: We are doing our best to enable many BOA-derived features within Ægir standalone, so users can pick their flavour without adopting the full BOA stack. - **Modern compatibility**: The BOA-based fork already supports **Drupal 11** and **PHP 8.4**, using vanilla **Drush 13** for site installs and updates while still relying on forked and improved **Drush 8** for daily operations. ## Development & Community Development of BOA stack components continues here on GitHub: 👉 https://github.com/omega8cc/boa At the same time, we continue to leverage the Drupal.org issue queues so **the community effort continues there** too, and all BOA improvements can be systematically **backported**. Ægir is still very much alive, and together we can keep its **Bryght** Future shining! ================================================ FILE: BARRACUDA.sh.txt ================================================ #!/bin/bash ###----------------------------------------### ### ### Barracuda Ægir Installer ### ### Copyright (C) 2009-2026 Omega8.cc ### noc@omega8.cc www.omega8.cc ### ### This program is free software. You can ### redistribute it and/or modify it under ### the terms of the GNU GPL as published by ### the Free Software Foundation, version 2 ### or later. ### ### This program is distributed in the hope ### that it will be useful, but WITHOUT ANY ### WARRANTY; without even the implied ### warranty of MERCHANTABILITY or FITNESS ### FOR A PARTICULAR PURPOSE. See the GNU GPL ### for more details. ### ### You should have received a copy of the ### GNU GPL along with this program. ### If not, see http://www.gnu.org/licenses/ ### ### Code: https://github.com/omega8cc/boa ### ###----------------------------------------### export PATH=/usr/local/bin:/usr/local/sbin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin:/usr/libexec export SHELL=/bin/bash ### ### Software versions ### _ADMINER_VRN=4.8.1 _BZR_VRN=2.6.0 _CGP_VRN=master-22-07-2020 _CHIVE_VRN=1.3 _COMPOSER_VRN=2.8.2 _CSF_VRN=15.00 _CURL_VRN=8.20.0 _DB_SRC=repo.percona.com ### ### _DRUSH_ELEVEN_VRN=11.6.0.9 _DRUSH_TEN_VRN=10.6.2.9 _DRUSH_EIGHT_VRN=8.5.0.5 _DRUSH_EIGHT_TEST_VRN=8.5.0-force ### ### _GEOS_VRN=3.7.1 _GIT_VRN=2.51.0 _GOACCESS_VRN=1.9.4 _ICU_LEGACY_VRN=52_2 _ICU_MODERN_VRN=73-1 _IMAGE_MAGICK_VRN=7.1.1-7 _IMAGICK_OLD_VRN=3.1.2 _IMAGICK_VRN=3.8.1 _IONCUBE_VRN=15.0.0 _JETTY_7_VRN=7.6.17.v20150415 _JETTY_8_VRN=8.1.17.v20150415 _JETTY_9_VRN=9.2.16.v20160414 _JSMIN_PHP_LEGACY_VRN=2.0.1 _JSMIN_PHP_MODERN_VRN=3.1.0 _LIB_TIDY_VRN=5.2.0 _LIB_YAML_VRN=0.2.5 _LOGJ4_VRN=1.2.17 _LSHELL_VRN=0.10 _MAILPARSE_VRN=2.1.6 _NEW_RELIC_VRN=12.6.0.34 _NODE_VRN=v22.21.0 _MONGO_VRN=1.6.14 _MONGODB_VRN=1.2.5 _MSS_VRN=master-29-06-2024 _MYQUICK_VRN_ONE=0.19.3-3 _MYQUICK_VRN_TWO=0.21.3-2 _MYSQLTUNER_VRN=1.9.4 _NGINX_VRN=1.29.8 _OPENSSH_VRN=10.3p1 _OPENSSL_LEGACY_VRN=1.0.2u _OPENSSL_EOL_VRN=1.1.1w _OPENSSL_MODERN_VRN=3.5.6 _PERCONA_5_7_VRN=5.7 _PERCONA_8_0_VRN=8.0 _PERCONA_8_4_VRN=8.4 _PHP56_API=20131226 _PHP56_VRN=5.6.40 _PHP70_API=20151012 _PHP70_VRN=7.0.33 _PHP71_API=20160303 _PHP71_VRN=7.1.33 _PHP72_API=20170718 _PHP72_VRN=7.2.34 _PHP73_API=20180731 _PHP73_VRN=7.3.33 _PHP74_API=20190902 _PHP74_VRN=7.4.33 _PHP80_API=20200930 _PHP80_VRN=8.0.30 _PHP81_API=20210902 _PHP81_VRN=8.1.34 _PHP82_API=20220829 _PHP82_VRN=8.2.31 _PHP83_API=20230831 _PHP83_VRN=8.3.31 _PHP84_API=20240924 _PHP84_VRN=8.4.21 _PHP85_API=20250925 _PHP85_VRN=8.5.6 _PHP_APCU=5.1.27 _PHP_IGBINARY_EIGHT_FIVE=3.2.17 _PHP_IGBINARY_THREE=3.2.16 _PHP_IGBINARY_TWO=2.0.8 _PHP_MCRYPT=1.0.9 _PHPREDIS_SIX_LATEST_VRN=6.3.0 _PHPREDIS_SIX_MODERN_VRN=6.3.0 _PHPREDIS_SIX_LEGACY_VRN=6.0.2 _PHPREDIS_FIVE_VRN=5.3.7 _PHPREDIS_FOUR_VRN=4.3.0 _PHPREDIS_THREE_VRN=3.1.6 _PURE_FTPD_VRN=1.0.52 _PXC_VRN=1.4.16 _VALKEY_NINE_VRN=9.0.3 _VALKEY_EIGHT_VRN=8.1.4 _VALKEY_SEVEN_VRN=7.2.11 _REDIS_FOUR_VRN=4.0.14 _REDIS_FIVE_VRN=5.0.9 _REDIS_SIX_VRN=6.2.7 _REDIS_SEVEN_VRN=7.0.15 _RUBY_VRN=3.3.4 _SLF4J_VRN=1.7.21 _SOLR_1_VRN=1.4.1 _SOLR_3_VRN=3.6.2 _SOLR_4_VRN=4.9.1 _SOLR_7_VRN=7.7.3 _SOLR_9_VRN=9.8.1 _TWIGC_VRN=1.24.0 _UNBOUND_VRN=1.24.2 _UPROGRESS_LEGACY_VRN=1.0.3.1 _UPROGRESS_SEVEN_VRN=2.0.1.6 _UPROGRESS_EIGHT_VRN=2.0.2 _VNSTAT_VRN=2.13 _WKHTMLTOX_VRN=12.6-1 _YAML_PHP_LEGACY_VRN=1.3.2 _YAML_PHP_SEVENO_VRN=2.1.0 _YAML_PHP_MODERN_VRN=2.2.5 _ZLIB_VRN=1.3.1 ### ### Default variables ### _CUSTOM_NAME="nginx" _DRUSH_VERSION="${_DRUSH_EIGHT_VRN}" _DRUSH_VERSION_TEST="${_DRUSH_EIGHT_TEST_VRN}" _FORCE_REDIS_RESTART=NO _LOC_OS_CODE="" _PURGE_ALL_THISHTIP=NO export _SMALLCORE7_V=7.105.1 export _DRUPAL7="drupal-${_SMALLCORE7_V}" _SPINNER=NO _THIS_DB_PORT=3306 if [ -n "${STY+x}" ]; then _SPINNER=NO fi ### ### Helper variables ### _aptLiSys="/etc/apt/sources.list" _barCnf="/root/.barracuda.cnf" _bldPth="/opt/tmp/boa" _crlGet="-L --max-redirs 3 -k -s --retry 9 --retry-delay 9 -A iCab" _wgetGet="--max-redirect=3 --no-check-certificate -q --tries=9 --wait=9 --user-agent='iCab'" _aptAllow="--allow-unauthenticated" _aptYesUnth="-y ${_aptAllow}" _filIncB="barracuda.sh.cnf" _gitHub="https://github.com/omega8cc" _gitLab="https://gitlab.com/omega8cc" _libFnc="${_bldPth}/lib/functions" _locCnf="${_bldPth}/aegir/conf" _mtrInc="/var/aegir/config/includes" _mtrNgx="/var/aegir/config/server_master/nginx" _mtrTpl="/var/aegir/.drush/sys/provision/http/Provision/Config/Nginx" _pthLog="/var/log/boa" _vBs="/var/backups" ### ### SA variables ### _saCoreN="SA-CORE-2014-005" _saCoreS="${_saCoreN}-D7" _saIncDb="includes/database/database.inc" _saPatch="/var/xdrago/conf/${_saCoreS}.patch" ### ### Avoid too many questions ### export DEBIAN_FRONTEND=noninteractive export APT_LISTCHANGES_FRONTEND=none if [ -z "${TERM+x}" ]; then export TERM=vt100 fi ### ### Clean pid files on exit ### _clean_pid_exit() { if [ -n "${1}" ]; then echo "REASON ${1} on $(date)" >> /root/.barracuda.sh.exit.exceptions.log [ -e "/opt/tmp/boa" ] && rm -rf /opt/tmp/* fi [ -e "/run/boa_wait.pid" ] && rm -f /run/boa_wait.pid [ -e "/run/boa_run.pid" ] && rm -f /run/boa_run.pid service cron start &> /dev/null _CNT=$(pgrep -fc 'tee -a /var/backups/barracuda-') if (( _CNT > 1 )); then pkill -f 'tee -a /var/backups/barracuda-' fi exit 1 } ### ### Panic on missing include ### _panic_exit() { echo echo " EXIT: Required lib file not available?" echo " EXIT: $1" echo " EXIT: Cannot continue" echo " EXIT: Bye (0)" echo _clean_pid_exit _panic_exit_a } ### ### Include default settings and basic functions ### [ -r "${_vBs}/${_filIncB}" ] || _panic_exit "${_vBs}/${_filIncB}" source "${_vBs}/${_filIncB}" ### ### Download helpers and libs ### if [ "${_OS_CODE}" = "excalibur" ]; then _DB_SERVER=Percona else _DB_SERVER=Percona fi if [ "$(boa info | grep -c ${_DB_SERVER})" -lt 3 ] || [ ! -e "/usr/sbin/csf" ]; then if [ ! -e "/opt/tmp/boa/aegir/helpers/apt.conf.noi.nrml" ] \ || [ ! -e "/opt/tmp/boa/aegir/helpers/apt.conf.noi.dist" ]; then _download_helpers_libs fi else _download_helpers_libs fi ### ### Include shared functions ### _FL="helper dns system sql valkey redis nginx php solr master xtra firewall hotfix" for f in ${_FL}; do [ -r "${_libFnc}/${f}.sh.inc" ] || _panic_exit "${f}" source "${_libFnc}/${f}.sh.inc" done ### ### Make sure we are running as root ### _if_running_as_root_barracuda ### ### Welcome msg ### echo " " _msg "Skynet Agent v.${_X_VERSION} on $(dmidecode -s system-manufacturer 2>&1) welcomes you aboard!" echo " " sleep 3 ### ### Early procedures ### _normalize_ip_name_variables _mode_detection _check_exception_mycnf _virt_detection _os_detection _os_detection_minimal _if_rebuild_src_on_major_os_upgrade _if_long_generate_on_major_os_upgrade ### ### Quick php-idle ON/OFF procedure only ### _if_php_idle_on_off ### ### Packages install/update on init ### _sources_list_update _basic_packages_install_on_init _more_packages_install_on_init _run_aptitude_full_upgrade ### ### Misc checks ### _check_boa_php_compatibility _check_boa_version if [ "${_CHECKS_REMOTE_REPOS}" = "YES" ]; then _check_github_for_aegir_head_mode _check_db_src _check_git_repos fi _check_ip_hostname _check_prepare_dirs_permissions ### ### Turn Off AppArmor temporarily while running barracuda ### if [ "${_OS_CODE}" = "stretch" ] || [ "${_OS_CODE}" = "jessie" ]; then [ ! -e "/root/.turn_off_apparmor_in_octopus.cnf" ] && touch /root/.turn_off_apparmor_in_octopus.cnf else _turn_off_apparmor_temporarily fi ### ### Optional major system upgrades ### _early_sys_ctrl_mark _if_post_major_os_upgrade _if_major_os_upgrade _normal_sys_ctrl_mark ### ### Upgrade only Ægir Master Instance (obsolete mode) ### if [ "${_ALLOW_HEAVY_REBUILDS}" = "YES" ]; then _if_upgrade_only_aegir_master fi ### ### System packages install and update ### _sys_packages_update _if_proxysql_update _sys_packages_install _java_check_fix _locales_check_fix ### ### Do not allow strong passwords until locales work properly ### if [ "${_LOCALE_TEST}" = "BROKEN" ]; then _STRONG_PASSWORDS=NO fi ### ### Install key packages first ### _run_aptitude_full_upgrade _run_aptitude_deps_install _kill_nash ### ### OpenSSL modern and legacy support ### _LC_SSL_CTRL="/root/.install.legacy.openssl.cnf" _MD_SSL_CTRL="/root/.install.modern.openssl.cnf" if [ "${_STATUS}" = "INIT" ] || [ ! -x "/usr/local/ssl/bin/openssl" ]; then if [ -e "${_MD_SSL_CTRL}" ]; then chattr -i ${_MD_SSL_CTRL} rm -f ${_MD_SSL_CTRL} fi touch ${_LC_SSL_CTRL} _if_ssl_install_src _sync_system_ssl_certs _ssl_paths_sync _ssl_crypto_lib_fix _curl_install_src fi if [ -x "/usr/local/ssl/bin/openssl" ]; then [ -e "${_LC_SSL_CTRL}" ] && rm -f ${_LC_SSL_CTRL} fi if [ "${_STATUS}" = "INIT" ] || [ ! -x "/usr/local/ssl3/bin/openssl" ]; then if [ ! -e "${_LC_SSL_CTRL}" ]; then if [ ! -e "${_MD_SSL_CTRL}" ]; then touch ${_MD_SSL_CTRL} chattr +i ${_MD_SSL_CTRL} fi fi elif [ "${_STATUS}" = "UPGRADE" ]; then if [ ! -e "/opt/php73/bin/php" ] \ && [ ! -e "/opt/php72/bin/php" ] \ && [ ! -e "/opt/php71/bin/php" ] \ && [ ! -e "/opt/php70/bin/php" ] \ && [ ! -e "/opt/php56/bin/php" ]; then if [ ! -e "${_MD_SSL_CTRL}" ] \ && [ ! -e "${_LC_SSL_CTRL}" ]; then touch ${_MD_SSL_CTRL} chattr +i ${_MD_SSL_CTRL} fi fi if [ ! -x "/usr/local/ssl/bin/openssl" ] \ && [ -e "${_LC_SSL_CTRL}" ]; then if [ -e "${_MD_SSL_CTRL}" ]; then chattr -i ${_MD_SSL_CTRL} rm -f ${_MD_SSL_CTRL} fi fi fi if [ -x "/usr/local/ssl/bin/openssl" ] \ && [ -x "/usr/local/ssl3/bin/openssl" ]; then if [ ! -e "${_MD_SSL_CTRL}" ]; then touch ${_MD_SSL_CTRL} chattr +i ${_MD_SSL_CTRL} fi fi ### ### Install OpenSSL and cURL from sources ### if [ "${_ALLOW_HEAVY_REBUILDS}" = "YES" ] || [ ! -x "/usr/local/ssl3/bin/openssl" ]; then _if_ssl_install_src _sync_system_ssl_certs _ssl_paths_sync _ssl_crypto_lib_fix _curl_install_src fi ### ### Install OpenSSH from sources ### if [ "${_SSH_FROM_SOURCES}" = "YES" ] && [ "${_ALLOW_HEAVY_REBUILDS}" = "YES" ]; then if [ "${_STATUS}" = "INIT" ] || [ "${_STATUS}" = "UPGRADE" ]; then if [ "${_OS_DIST}" = "Debian" ] || [ "${_OS_DIST}" = "Devuan" ]; then _sshd_install_src _sshd_armour fi fi fi ### ### Install Percona server ### _db_server_install ### ### Finalize initial Percona server and tools setup ### _init_sql_root_credentials _sql_root_credentials_update _myquick_install_upgrade ### ### Install other services ### if [ "${_ALLOW_HEAVY_REBUILDS}" = "YES" ]; then _nginx_install_upgrade _nginx_initd_check _nginx_mime_check_fix if [ "${_VALKEY_MAJOR_RELEASE}" = "7" ] \ || [ "${_VALKEY_MAJOR_RELEASE}" = "8" ] \ || [ "${_VALKEY_MAJOR_RELEASE}" = "9" ]; then _valkey_install_upgrade else _redis_install_upgrade fi _lshell_install_upgrade _magick_install_upgrade _php_install_deps _php_libs_fix _php_if_versions_cleanup_cnf if [ "${_STATUS}" = "UPGRADE" ]; then _php_ioncube_check_if_update _php_check_if_rebuild _mytop_install fi _php_install_upgrade _php_config_check_update _php_upgrade_all _if_install_php_newrelic _newrelic_check_fix fi _smtp_check _xdrago_install_upgrade _if_drupal_patches_update _mc_panels_ini_update ### ### Download system-wide Drush versions ### _drush_system_install_update ### ### Install or upgrade Ægir Master Instance ### if [ "${_ALLOW_HEAVY_REBUILDS}" = "YES" ]; then _aegir_master_install_upgrade _aegir_bin_extra_check_fix _nginx_wildcard_ssl_install _nginx_config_update_fix _aegir_master_display_login_link fi ### ### Install or upgrade DNS cache server ### if [ "${_STATUS}" = "UPGRADE" ]; then _dns_unbound_install_upgrade fi ### ### Install or upgrade csf/lfd monitoring ### if [ "${_STATUS}" = "UPGRADE" ]; then _csf_lfd_install_upgrade fi ### ### Optional add-on services ### if [ "${_STATUS}" = "INIT" ] || [ "${_STATUS}" = "UPGRADE" ]; then if [ "${_ALLOW_HEAVY_REBUILDS}" = "YES" ]; then _if_install_ftpd _if_install_vnstat _if_install_wkhtmltox _if_install_chromium _if_install_git_src _if_install_ffmpeg _if_install_bzr [ ! -e "/root/.deny.java.cnf" ] && _if_install_upgrade_solr _if_install_adminer _if_install_chive _if_install_sqlbuddy _if_install_collectd _if_install_webmin _if_install_bind _if_install_ruby _if_install_node _sftp_ftps_modern_fix fi fi ### ### Update rsyslog configuration ### _rsyslog_config_update ### ### Install or uninstall AppArmor after barracuda install and upgrade ### if [ -e "/root/.keep_apparmor_on.cnf" ] && [ ! -e "/root/.deny.apparmor.cnf" ]; then [ ! -e "/root/.allow.apparmor.cnf" ] && touch /root/.allow.apparmor.cnf if [ ! -e "/root/.run-to-excalibur.cnf" ] \ && [ ! -e "/root/.run-to-daedalus.cnf" ] \ && [ ! -e "/root/.run-to-chimaera.cnf" ] \ && [ ! -e "/root/.run-to-beowulf.cnf" ]; then if [ "${_OS_CODE}" != "stretch" ] && [ "${_OS_CODE}" != "jessie" ]; then _if_install_apparmor fi fi else [ -e "/root/.allow.apparmor.cnf" ] && rm -f /root/.allow.apparmor.cnf [ ! -e "/root/.deny.apparmor.cnf" ] && touch /root/.deny.apparmor.cnf if [ "${_OS_CODE}" != "stretch" ] && [ "${_OS_CODE}" != "jessie" ]; then _if_remove_apparmor fi fi ### ### Update barracuda log, tools and system settings ### _pam_umask_check_fix _pam_many_check_fix _avatars_check_fix _sysctl_update _initd_update _apticron_update _barracuda_log_update _find_server_city ### ### Complete system checks and cleanup ### _complete exit 0 ###----------------------------------------### ### ### Barracuda Ægir Installer ### Copyright (C) 2009-2026 Omega8.cc ### noc@omega8.cc www.omega8.cc ### ###----------------------------------------### ================================================ FILE: BOA.sh.txt ================================================ #!/bin/bash ###----------------------------------------### ### ### BOA Meta Installer ### ### Copyright (C) 2009-2026 Omega8.cc ### noc@omega8.cc www.omega8.cc ### ### This program is free software. You can ### redistribute it and/or modify it under ### the terms of the GNU GPL as published by ### the Free Software Foundation, version 2 ### or later. ### ### This program is distributed in the hope ### that it will be useful, but WITHOUT ANY ### WARRANTY; without even the implied ### warranty of MERCHANTABILITY or FITNESS ### FOR A PARTICULAR PURPOSE. See the GNU GPL ### for more details. ### ### You should have received a copy of the ### GNU GPL along with this program. ### If not, see http://www.gnu.org/licenses/ ### ### Code: https://github.com/omega8cc/boa ### ###----------------------------------------### ###----------------------------------------### ### How To: run it with bash, not with sh ### ###----------------------------------------### ### ### $ wget -qO- http://files.aegir.cc/BOA.sh.txt | bash ### ###----------------------------------------### ### DON'T EDIT ANYTHING BELOW THIS LINE ### ###----------------------------------------### export HOME=/root export SHELL=/bin/bash export PATH=/usr/local/bin:/usr/local/sbin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin:/usr/libexec export _tRee=dev export _xSrl=591devT01 export _rLsn="BOA-5.9.1" export _bTs=591v02 ### ### Avoid too many questions ### export DEBIAN_FRONTEND=noninteractive export APT_LISTCHANGES_FRONTEND=none if [ -z "${TERM+x}" ]; then export TERM=vt100 fi _NOW=$(date +%y%m%d-%H%M%S) export _NOW=${_NOW//[^0-9-]/} _TODAY=$(date +%y%m%d) export _TODAY=${_TODAY//[^0-9]/} # _barCnf="/root/.barracuda.cnf" _crlGet="-L --max-redirs 3 -k -s --retry 9 --retry-delay 9 -A iCab" _wgetGet="--max-redirect=3 --no-check-certificate -q --tries=9 --wait=9 --user-agent='iCab'" _aptAllow="--allow-unauthenticated" _aptYesUnth="-y ${_aptAllow}" _optBin="/opt/local/bin" _usrBin="/usr/local/bin" _xpthLog="/var/xdrago/log" _pthLog="/var/log/boa" _tBn="tools/bin" _vBs="/var/backups" _boaToolsPid="${_pthLog}/updateBOAtools.${_bTs}.ctrl.${_tRee}.${_xSrl}.pid" _INITINS="/usr/bin/apt-get ${_aptAllow} -y install" # if [ ! -e "${_pthLog}/.migrated.txt" ] && [ -d "${_xpthLog}" ]; then mkdir -p "${_pthLog}" cp -a ${_xpthLog}/*.pid ${_pthLog}/ cp -a ${_xpthLog}/.*pid ${_pthLog}/ cp -a ${_xpthLog}/*.log ${_pthLog}/ cp -a ${_xpthLog}/*.txt ${_pthLog}/ cp -a ${_xpthLog}/usage ${_pthLog}/ cp -a ${_xpthLog}/daily ${_pthLog}/ cp -a ${_xpthLog}/core ${_pthLog}/ cp -a ${_xpthLog}/le ${_pthLog}/ touch "${_pthLog}/.migrated.txt" fi [ ! -d "${_pthLog}/usage" ] && mkdir -p "${_pthLog}/usage" [ ! -d "${_pthLog}/daily" ] && mkdir -p "${_pthLog}/daily" [ ! -d "${_pthLog}/core" ] && mkdir -p "${_pthLog}/core" [ ! -d "${_pthLog}/le" ] && mkdir -p "${_pthLog}/le" # _eldirF="0001-Print-site_footer-if-defined.patch" _eldirP="/var/xdrago/conf/${_eldirF}" # _tenCorePatchFname="drupal-ten-aegir-core-01.patch" _tenCorePatchPath="/data/conf/patches/${_tenCorePatchFname}" # _tenConsolePatchFname="drupal-ten-aegir-console-02.patch" _tenConsolePatchPath="/data/conf/patches/${_tenConsolePatchFname}" # _elevenCorePatchFname="drupal-eleven-aegir-core-01.patch" _elevenCorePatchPath="/data/conf/patches/${_elevenCorePatchFname}" # _elevenConsolePatchFname="drupal-eleven-aegir-console-02.patch" _elevenConsolePatchPath="/data/conf/patches/${_elevenConsolePatchFname}" # _elevenValidatorPatchFname="drupal-eleven-aegir-validator-03.patch" _elevenValidatorPatchPath="/data/conf/patches/${_elevenValidatorPatchFname}" # _provLeInc="provision_hosting_le.drush.inc" _provLeIncFull="/var/xdrago/conf/${_provLeInc}" # _hoLeInc="hosting_le_vhost.drush.inc" _hoLeIncFull="/var/xdrago/conf/${_hoLeInc}" # _dehydName="dehydrated" _dehydSrcPath="/var/xdrago/conf/${_dehydName}" _legacyLeSh="/var/xdrago/conf/letsencrypt.sh" _DEBUG_MODE=$([ -e "/root/.debug-barracuda-installer.cnf" ] && echo "YES" || echo "NO") _os_detection_minimal() { _APT_UPDATE="apt-get update" _OS_CODE=$(lsb_release -ar 2>/dev/null | grep -i codename | cut -s -f2) _OS_LIST="excalibur daedalus chimaera beowulf buster bullseye bookworm trixie" for e in ${_OS_LIST}; do if [ "${e}" = "${_OS_CODE}" ]; then _APT_UPDATE="apt-get update --allow-releaseinfo-change" fi done } _apt_clean_update() { ${_APT_UPDATE} -qq 2>/dev/null _CALLER_SCRIPT="$(basename "${BASH_SOURCE[-1]}")" _CALLER_SCRIPT="${_CALLER_SCRIPT//[^a-zA-Z0-9._-]/_}" date +%s > "/run/_latest_apt_clean_update.${_CALLER_SCRIPT}.pid" } _if_hosted_sys() { _hName="$(cat /etc/hostname 2>/dev/null | tr -d '\n' || hostname -f 2>/dev/null)" if [ -e "/root/.host8.cnf" ] \ || [[ "${_hName}" =~ ".aegir.cc"($) ]]; then _hostedSys=YES else _hostedSys=NO fi } # # Find server city. _find_server_city() { if [ -e "/root/.found_correct_city.cnf" ]; then _LOC_CITY=$(cat /root/.found_correct_city.cnf 2>/dev/null | tr -d '\n') else if [ -e "/root/.found_correct_ipv4.cnf" ]; then _LOC_IP=$(cat /root/.found_correct_ipv4.cnf 2>/dev/null | tr -d '\n') _LOC_CITY=$(curl ${_crlGet} ipinfo.io/${_LOC_IP}/city 2>&1) _LOC_CITY=$(echo -n ${_LOC_CITY} | tr -d "\n" 2>&1) fi if [ ! -z "${_LOC_CITY}" ]; then _LOC_CITY=$(echo "${_LOC_CITY}" | tr ' ' '+' 2>&1) echo ${_LOC_CITY} > /root/.found_correct_city.cnf fi fi } # # Find correct IP. _find_correct_ip() { if [ -e "/root/.found_correct_ipv4.cnf" ]; then _LOC_IP=$(cat /root/.found_correct_ipv4.cnf 2>/dev/null | tr -d '\n') else _LOC_IP=$(curl ${_crlGet} https://api.ipify.org | sed 's/[^0-9\.]//g') if [ -z "${_LOC_IP}" ]; then _LOC_IP=$(curl ${_crlGet} http://ipv4.icanhazip.com | sed 's/[^0-9\.]//g') fi if [ ! -z "${_LOC_IP}" ]; then echo ${_LOC_IP} > /root/.found_correct_ipv4.cnf fi fi if [ -n "${_LOC_IP}" ] && grep -qE "${_LOC_IP}\s" /etc/hosts; then cp -af /etc/hosts /etc/.was.hosts sed -i "s/^${_LOC_IP}.*//g" /etc/hosts [ -x "/etc/init.d/unbound" ] && [ ! -e "/usr/etc/unbound/unbound.conf.d" ] && mkdir -p /usr/etc/unbound/unbound.conf.d [ -x "/etc/init.d/unbound" ] && service unbound restart &> /dev/null fi } _fix_dns_settings() { [ ! -d "${_vBs}" ] && mkdir -p ${_vBs} rm -f ${_vBs}/resolv.conf.tmp if ! grep -q "nameserver 127.0.0.1" /etc/resolv.conf; then if [ -x "/usr/sbin/unbound" ] && [ -e "/run/unbound/unbound.pid" ]; then _FORCE_RESOLV_UPDATE=YES else _FORCE_RESOLV_UPDATE=NO fi fi if ! grep -q "BOA-DNS-Config" /etc/resolv.conf || [ "${_FORCE_RESOLV_UPDATE}" = "YES" ]; then echo "### BOA-DNS-Config ###" > ${_vBs}/resolv.conf.tmp if [ -x "/usr/sbin/unbound" ] && [ -e "/run/unbound/unbound.pid" ]; then echo "nameserver 127.0.0.1" >> ${_vBs}/resolv.conf.tmp fi echo "nameserver 1.1.1.1" >> ${_vBs}/resolv.conf.tmp echo "nameserver 8.8.8.8" >> ${_vBs}/resolv.conf.tmp echo "nameserver 9.9.9.9" >> ${_vBs}/resolv.conf.tmp fi if [ -e "${_vBs}/resolv.conf.tmp" ]; then chattr -i /etc/resolv.conf rm -f /etc/resolv.conf cp -a ${_vBs}/resolv.conf.tmp /etc/resolv.conf chmod 0644 /etc/resolv.conf chattr +i /etc/resolv.conf cp -a ${_vBs}/resolv.conf.tmp ${_vBs}/resolv.conf.vanilla fi if [ -x "/usr/sbin/unbound-control" ] \ && [ -e "/etc/resolvconf/run/interface/lo.unbound" ]; then unbound-control reload &> /dev/null fi } _check_dns_settings() { _EHU=NO if ! grep -q "127.0.0.1 localhost" /etc/hosts; then sed -i "s/^127.0.0.1.*//g" /etc/hosts echo "" >> /etc/hosts echo "127.0.0.1 localhost" >> /etc/hosts _EHU=YES fi if grep -q "files.aegir.cc" /etc/hosts; then sed -i "s/.*files.aegir.cc.*//g" /etc/hosts _EHU=YES fi if grep -q "github" /etc/hosts; then sed -i "s/.*github.*//g" /etc/hosts _EHU=YES fi if [ "${_EHU}" = "YES" ]; then echo >>/etc/hosts sed -i "/^$/d" /etc/hosts fi if [ -L "/etc/resolv.conf" ]; then _fix_dns_settings return 1 # Exit the function but continue the script fi if [ -e "/root/.use.default.nameservers.cnf" ]; then if [ -e "/root/.use.local.nameservers.cnf" ]; then rm -f /root/.use.local.nameservers.cnf fi _USE_DEFAULT_DNS=YES if ! grep -q "BOA-DNS-Config" /etc/resolv.conf; then _fix_dns_settings return 1 # Exit the function but continue the script fi fi if [ -e "/root/.use.local.nameservers.cnf" ]; then _USE_PROVIDER_DNS=YES else _REMOTE_DNS_TEST=$(host files.aegir.cc 1.1.1.1 -w 10 2>&1) if ! grep -q "BOA-DNS-Config" /etc/resolv.conf; then _fix_dns_settings return 1 # Exit the function but continue the script fi fi if [[ "${_REMOTE_DNS_TEST}" =~ "no servers could be reached" ]] \ || [[ "${_REMOTE_DNS_TEST}" =~ "Host files.aegir.cc not found" ]] \ || [ "${_USE_PROVIDER_DNS}" = "YES" ]; then _fix_dns_settings fi } _find_fast_mirror_early() { _isNetc="$(which netcat)" if [ ! -x "${_isNetc}" ] || [ -z "${_isNetc}" ]; then if [ ! -e "/etc/apt/apt.conf.d/00sandboxoff" ] \ && [ -e "/etc/apt/apt.conf.d" ]; then echo "APT::Sandbox::User \"root\";" > /etc/apt/apt.conf.d/00sandboxoff fi _apt_clean_update apt-get install netcat-traditional ${_aptYesUnth} &> /dev/null fi _ffMirr=/opt/local/bin/ffmirror if [ -x "${_ffMirr}" ]; then _ffList="/var/backups/boa-mirrors-2025-01.txt" [ -d "/var/backups" ] || mkdir -p /var/backups if [ ! -e "${_ffList}" ]; then echo "eu.files.aegir.cc" > ${_ffList} echo "us.files.aegir.cc" >> ${_ffList} echo "ao.files.aegir.cc" >> ${_ffList} fi if [ -e "${_ffList}" ]; then _BROKEN_FFMIRR_TEST=$(grep "stuff" ${_ffMirr} 2>&1) if [[ "${_BROKEN_FFMIRR_TEST}" =~ "stuff" ]]; then _CHECK_MIRROR=$(bash ${_ffMirr} < ${_ffList} 2>&1) _CHECK_MIRROR=$(bash ${_ffMirr} < ${_ffList} 2>&1) _USE_MIR="${_CHECK_MIRROR}" [[ "${_USE_MIR}" =~ "printf" ]] && _USE_MIR="files.aegir.cc" else _USE_MIR="files.aegir.cc" fi else _USE_MIR="files.aegir.cc" fi else _USE_MIR="files.aegir.cc" fi _urlDev="http://${_USE_MIR}/dev" _urlHmr="http://${_USE_MIR}/versions/${_tRee}/boa/aegir" } _extract_archive() { if [ ! -z "$1" ]; then case $1 in *.tar.bz2) tar xjf $1 ;; *.tar.gz) tar xzf $1 ;; *.tar.xz) tar xvf $1 ;; *.bz2) bunzip2 $1 ;; *.rar) unrar x $1 ;; *.gz) gunzip -q $1 ;; *.tar) tar xf $1 ;; *.tbz2) tar xjf $1 ;; *.tgz) tar xzf $1 ;; *.zip) unzip -qq $1 ;; *.Z) uncompress $1 ;; *.7z) 7z x $1 ;; *) echo "'$1' cannot be extracted via >extract<" ;; esac rm -f $1 fi } # # Download and extract from dev/contrib mirror. _get_dev_contrib() { if [ ! -z "$1" ]; then _max_attempts=10 _attempt_num=1 _success=0 while [ ${_attempt_num} -le ${_max_attempts} ]; do [ "${_DEBUG_MODE}" = "YES" ] && echo "DNLD: Attempt ${_attempt_num} of ${_max_attempts}: Downloading $1..." if curl ${_crlGet} "${_urlDev}/${_tRee}/contrib/$1" -o "$1"; then _success=1 break else [ "${_DEBUG_MODE}" = "YES" ] && echo "DNLD: Attempt ${_attempt_num} failed." _attempt_num=$((_attempt_num+1)) if [ "${_attempt_num}" -le "${_max_attempts}" ]; then [ "${_DEBUG_MODE}" = "YES" ] && echo "DNLD: Retrying in 9 seconds..." sleep 9 fi fi done if [ "${_success}" -eq 1 ]; then _extract_archive "$1" else echo "OOPS: Failed to download ${_urlDev}/${_tRee}/contrib/$1 after ${_max_attempts} attempts" return 1 # Exit the function but continue the script fi fi } # # Download and extract archive from dev/src mirror. _get_dev_src() { if [ ! -z "$1" ]; then _max_attempts=10 _attempt_num=1 _success=0 while [ ${_attempt_num} -le ${_max_attempts} ]; do [ "${_DEBUG_MODE}" = "YES" ] && echo "DNLD: Attempt ${_attempt_num} of ${_max_attempts}: Downloading $1..." if curl ${_crlGet} "${_urlDev}/src/$1" -o "$1"; then _success=1 break else [ "${_DEBUG_MODE}" = "YES" ] && echo "DNLD: Attempt ${_attempt_num} failed." _attempt_num=$((_attempt_num+1)) if [ "${_attempt_num}" -le "${_max_attempts}" ]; then [ "${_DEBUG_MODE}" = "YES" ] && echo "DNLD: Retrying in 9 seconds..." sleep 9 fi fi done if [ "${_success}" -eq 1 ]; then _extract_archive "$1" else echo "OOPS: Failed to download ${_urlDev}/src/$1 after ${_max_attempts} attempts" return 1 # Exit the function but continue the script fi fi } _if_clean_boa_env() { if [ ! -x "/etc/init.d/clean-boa-env" ]; then curl ${_crlGet} "${_urlHmr}/conf/var/clean-boa-env" -o /etc/init.d/clean-boa-env if [ -e "/etc/init.d/clean-boa-env" ]; then chmod 700 /etc/init.d/clean-boa-env chown root:root /etc/init.d/clean-boa-env update-rc.d clean-boa-env defaults &> /dev/null fi fi } ### ### Function to verify BOA keys ### _verify_boa_keys() { if [ -e "/root/.dev.server.cnf" ]; then echo "PROC: _verify_boa_keys in BOA.sh.txt" fi if [ "${_tRee}" = "pro" ] || [ "${_tRee}" = "dev" ]; then _if_hosted_sys _allw=NO _urlEnc="http://${_USE_MIR}/enc/2024" _encName=$(echo ${_hName} \ | openssl md5 \ | awk '{ print $2}' \ | tr -d "\n" 2>&1) if [[ "${_hName}" =~ ".aegir.cc"($) ]] \ || [[ "${_hName}" =~ ".o8.io"($) ]] \ || [[ "${_hName}" =~ ".boa.io"($) ]]; then _allw=YES fi mkdir -p /var/opt rm -f /var/opt/_encN* curl ${_crlGet} "${_urlEnc}/${_encName}" -o /var/opt/_encN.${_encName}.tmp wait echo "${_hName}.${_encName}" > /var/opt/_encN_local.${_encName}.tmp wait if [ -e "/var/opt/_encN.${_encName}.tmp" ] && [ -e "/var/opt/_encN_local.${_encName}.tmp" ]; then _diffTestIf=$(diff -w -B /var/opt/_encN.${_encName}.tmp /var/opt/_encN_local.${_encName}.tmp 2>&1) if [ ! -z "${_diffTestIf}" ] && [ "${_allw}" = "NO" ]; then echo echo "Your system requires valid license for access to ${_rLsn}-${_tRee}" echo "Please visit https://omega8.cc/licenses to purchase your own" echo if [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "/var/aegir/key/barracuda_key.txt" ]; then mkdir -p /var/aegir/key cat /var/opt/_encN_local.${_encName}.tmp > /var/aegir/key/barracuda_key.txt fi rm -f /var/opt/_encN* exit 0 else if [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "/var/aegir/key/barracuda_key.txt" ]; then mkdir -p /var/aegir/key cat /var/opt/_encN_local.${_encName}.tmp > /var/aegir/key/barracuda_key.txt fi fi else echo echo "Your system requires valid license to use this BOA version (${_tRee})" echo "Unfortunately it was not possible to verify your system status" echo "Please contact our support but visit https://omega8.cc/licenses first" echo exit 0 fi fi } _locales_check_fix_early() { _isLoc="$(which locale)" if [ ! -x "${_isLoc}" ] || [ -z "${_isLoc}" ]; then apt-get update -qq &> /dev/null ${_INITINS} locales locales-all &> /dev/null fi _LOC_TEST=$(locale 2>&1) if [[ "${_LOC_TEST}" =~ LANG=.*UTF-8 ]]; then _LOCALE_TEST=OK fi if [[ "${_LOC_TEST}" =~ "Cannot" ]]; then _LOCALE_TEST=BROKEN fi if [ "${_LOCALE_TEST}" = "BROKEN" ]; then _LOCALE_GEN_TEST=$(grep -v "^#" /etc/locale.gen 2>&1) if [[ ! "${_LOCALE_GEN_TEST}" =~ "en_US.UTF-8 UTF-8" ]]; then echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen fi sed -i "/^$/d" /etc/locale.gen locale-gen &> /dev/null locale-gen en_US.UTF-8 &> /dev/null # Explicitly enforce all locale settings update-locale \ LANG=en_US.UTF-8 \ LC_CTYPE=en_US.UTF-8 \ LC_COLLATE=POSIX \ LC_NUMERIC=POSIX \ LC_TIME=en_US.UTF-8 \ LC_MONETARY=en_US.UTF-8 \ LC_MESSAGES=en_US.UTF-8 \ LC_PAPER=en_US.UTF-8 \ LC_NAME=en_US.UTF-8 \ LC_ADDRESS=en_US.UTF-8 \ LC_TELEPHONE=en_US.UTF-8 \ LC_MEASUREMENT=en_US.UTF-8 \ LC_IDENTIFICATION=en_US.UTF-8 \ LC_ALL= &> /dev/null # Define all locale settings on the fly to prevent unnecessary # warnings during installation of packages. export LANG=en_US.UTF-8 &> /dev/null export LC_CTYPE=en_US.UTF-8 &> /dev/null export LC_COLLATE=POSIX &> /dev/null export LC_NUMERIC=POSIX &> /dev/null export LC_TIME=en_US.UTF-8 &> /dev/null export LC_MONETARY=en_US.UTF-8 &> /dev/null export LC_MESSAGES=en_US.UTF-8 &> /dev/null export LC_PAPER=en_US.UTF-8 &> /dev/null export LC_NAME=en_US.UTF-8 &> /dev/null export LC_ADDRESS=en_US.UTF-8 &> /dev/null export LC_TELEPHONE=en_US.UTF-8 &> /dev/null export LC_MEASUREMENT=en_US.UTF-8 &> /dev/null export LC_IDENTIFICATION=en_US.UTF-8 &> /dev/null export LC_ALL= &> /dev/null else _LOCALE_GEN_TEST=$(grep -v "^#" /etc/locale.gen 2>&1) if [[ ! "${_LOCALE_GEN_TEST}" =~ "en_US.UTF-8 UTF-8" ]]; then echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen fi sed -i "/^$/d" /etc/locale.gen locale-gen &> /dev/null locale-gen en_US.UTF-8 &> /dev/null # Explicitly enforce locale settings required for consistency update-locale \ LANG=en_US.UTF-8 \ LC_CTYPE=en_US.UTF-8 \ LC_COLLATE=POSIX \ LC_NUMERIC=POSIX \ LC_ALL= &> /dev/null # Define locale settings required for consistency also on the fly export LC_COLLATE=POSIX &> /dev/null export LC_NUMERIC=POSIX &> /dev/null export LC_ALL= &> /dev/null fi _LOCALES_BASHRC_TEST=$(grep LC_COLLATE /root/.bashrc 2>&1) if [[ ! "${_LOCALES_BASHRC_TEST}" =~ "LC_COLLATE" ]]; then printf "\n" >> /root/.bashrc echo "export LANG=en_US.UTF-8" >> /root/.bashrc echo "export LC_CTYPE=en_US.UTF-8" >> /root/.bashrc echo "export LC_COLLATE=POSIX" >> /root/.bashrc echo "export LC_NUMERIC=POSIX" >> /root/.bashrc echo "export LC_TIME=en_US.UTF-8" >> /root/.bashrc echo "export LC_MONETARY=en_US.UTF-8" >> /root/.bashrc echo "export LC_MESSAGES=en_US.UTF-8" >> /root/.bashrc echo "export LC_PAPER=en_US.UTF-8" >> /root/.bashrc echo "export LC_NAME=en_US.UTF-8" >> /root/.bashrc echo "export LC_ADDRESS=en_US.UTF-8" >> /root/.bashrc echo "export LC_TELEPHONE=en_US.UTF-8" >> /root/.bashrc echo "export LC_MEASUREMENT=en_US.UTF-8" >> /root/.bashrc echo "export LC_IDENTIFICATION=en_US.UTF-8" >> /root/.bashrc echo "export LC_ALL=" >> /root/.bashrc printf "\n" >> /root/.bashrc fi } _if_fix_iptables_symlinks() { ### ### Fix for iptables paths backward compatibility ### if [ -x "/sbin/iptables" ] && [ ! -e "/usr/sbin/iptables" ]; then ln -sfn /sbin/iptables /usr/sbin/iptables fi if [ -x "/usr/sbin/iptables" ] && [ ! -e "/sbin/iptables" ]; then ln -sfn /usr/sbin/iptables /sbin/iptables fi if [ -x "/sbin/iptables-save" ] && [ ! -e "/usr/sbin/iptables-save" ]; then ln -sfn /sbin/iptables-save /usr/sbin/iptables-save fi if [ -x "/usr/sbin/iptables-save" ] && [ ! -e "/sbin/iptables-save" ]; then ln -sfn /usr/sbin/iptables-save /sbin/iptables-save fi if [ -x "/sbin/iptables-restore" ] && [ ! -e "/usr/sbin/iptables-restore" ]; then ln -sfn /sbin/iptables-restore /usr/sbin/iptables-restore fi if [ -x "/usr/sbin/iptables-restore" ] && [ ! -e "/sbin/iptables-restore" ]; then ln -sfn /usr/sbin/iptables-restore /sbin/iptables-restore fi if [ -x "/sbin/ip6tables" ] && [ ! -e "/usr/sbin/ip6tables" ]; then ln -sfn /sbin/ip6tables /usr/sbin/ip6tables fi if [ -x "/usr/sbin/ip6tables" ] && [ ! -e "/sbin/ip6tables" ]; then ln -sfn /usr/sbin/ip6tables /sbin/ip6tables fi if [ -x "/sbin/ip6tables-save" ] && [ ! -e "/usr/sbin/ip6tables-save" ]; then ln -sfn /sbin/ip6tables-save /usr/sbin/ip6tables-save fi if [ -x "/usr/sbin/ip6tables-save" ] && [ ! -e "/sbin/ip6tables-save" ]; then ln -sfn /usr/sbin/ip6tables-save /sbin/ip6tables-save fi if [ -x "/sbin/ip6tables-restore" ] && [ ! -e "/usr/sbin/ip6tables-restore" ]; then ln -sfn /sbin/ip6tables-restore /usr/sbin/ip6tables-restore fi if [ -x "/usr/sbin/ip6tables-restore" ] && [ ! -e "/sbin/ip6tables-restore" ]; then ln -sfn /usr/sbin/ip6tables-restore /sbin/ip6tables-restore fi ### ### Fix for iptables paths backward compatibility ### } ### ### Prefer Devuan APT sources ### _prefer_devuan_repositories() { # Prefer Devuan; force base-files from Devuan (handles lower version vs Debian). mkdir -p /etc/apt/preferences.d cat >/etc/apt/preferences.d/99-prefer-devuan <<'EOF' Package: * Pin: release o=Devuan Pin-Priority: 700 Package: base-files Pin: release o=Devuan Pin-Priority: 1001 EOF _apt_clean_update } ### ### Display not supported VM or bare metal info ### _not_supported_virt() { echo echo "=== OOPS! ===" echo echo "You are running not supported virtualization system:" echo " $1" echo echo "If you wish to try BOA on this system anyway," echo "please create an empty control file:" echo " /root/.allow.any.virt.cnf" echo echo "Please be aware that it may not work at all," echo "or you can experience errors breaking BOA." echo echo "WARNING! BOA IS NOT DESIGNED TO RUN DIRECTLY ON A BARE METAL." echo "WARNING! IT IS VERY DANGEROUS AND THUS EXTREMELY BAD IDEA!" echo "WARNING! You are free to experiment but don't expect *ANY* support." echo echo "BOA is known to work well on:" echo echo " * Linux Containers (LXC)" echo " * Linux KVM guest" echo " * Microsoft Hyper-V" echo " * OpenVZ Containers" echo " * Parallels guest" echo " * Red Hat KVM guest" echo " * VirtualBox guest" echo " * VMware ESXi guest (but excluding vCloud Air)" echo " * VServer guest" echo " * Xen guest fully virtualized (HVM)" echo " * Xen guest" echo " * Xen paravirtualized guest domain" echo echo "Bye" echo exit 1 } # --- internal: print message only in debug mode _msg() { if [ "${_DEBUG_MODE}" = "YES" ]; then echo "[virt-what-fix] $*" fi } # --- internal: run virt-what under strace and parse the helper's exec path _discover_with_strace() { local _path_found="" if ! command -v strace >/dev/null 2>&1; then _msg "strace not available, skipping strace-based discovery" echo "" return 0 fi # Temporarily extend PATH so virt-what can exec the helper for strace to see. PATH="${PATH}:${_CANDIDATE_PATHS}" strace -f -qq -e trace=execve -o "${_TRACE}" virt-what >/dev/null 2>&1 # mawk-safe parsing: pull the first quoted arg from execve("…") and check suffix if [ -s "${_TRACE}" ]; then _path_found=$( awk -v n="${_HELPER_NAME}" ' /execve\("/ { # Find start of execve(" then extract up to next quote i = index($0, "execve(\"") if (i) { s = substr($0, i + 8) # after execve(" j = index(s, "\"") if (j) { p = substr(s, 1, j - 1) # the path inside quotes if (p ~ ("/" n "$")) { print p; exit } } } } ' "${_TRACE}" ) fi rm -f "${_TRACE}" if [ -n "${_path_found}" ] && [ -x "${_path_found}" ]; then _msg "strace discovered helper at: ${_path_found}" echo "${_path_found}" return 0 fi _msg "strace discovery failed" echo "" return 0 } # --- internal: dpkg-based discovery (Debian/Devuan) _discover_with_dpkg() { local _p="" if command -v dpkg >/dev/null 2>&1; then _p=$(dpkg -L virt-what 2>/dev/null | grep -E "/${_HELPER_NAME}$" | head -n1) if [ -n "${_p}" ] && [ -x "${_p}" ]; then _msg "dpkg discovered helper at: ${_p}" echo "${_p}" return 0 fi fi echo "" return 0 } # --- internal: filesystem search fallback (bounded) _discover_with_find() { local _p="" # Keep it bounded to /usr to stay fast/noisy-free. _p=$(find /usr -maxdepth 4 -type f -name "${_HELPER_NAME}" 2>/dev/null | head -n1) if [ -n "${_p}" ] && [ -x "${_p}" ]; then _msg "find discovered helper at: ${_p}" echo "${_p}" return 0 fi echo "" return 0 } # --- main: ensure symlink _ensure_virt_what_helper_symlink() { # If the symlink already exists and is working, nothing to do. if [ -L "${_SYMLINK}" ] && [ -x "${_SYMLINK}" ] && [ -e "$(readlink -f "${_SYMLINK}")" ]; then _msg "Symlink already present and valid: ${_SYMLINK} -> $(readlink -f "${_SYMLINK}")" return 0 fi local _helper_path="" _helper_path="$(_discover_with_strace)" if [ -z "${_helper_path}" ]; then _helper_path="$(_discover_with_dpkg)" fi if [ -z "${_helper_path}" ]; then _helper_path="$(_discover_with_find)" fi if [ -z "${_helper_path}" ]; then echo "ERROR: Could not locate ${_HELPER_NAME} anywhere under /usr." 1>&2 return 1 fi # Safety: if a non-symlink file already exists at the target, back it up once. if [ -e "${_SYMLINK}" ] && [ ! -L "${_SYMLINK}" ]; then _msg "Backing up existing non-symlink at ${_SYMLINK} to ${_SYMLINK}.orig" mv -f "${_SYMLINK}" "${_SYMLINK}.orig" fi ln -sfn "${_helper_path}" "${_SYMLINK}" if [ -x "${_SYMLINK}" ]; then _msg "Symlink created: ${_SYMLINK} -> ${_helper_path}" return 0 else echo "ERROR: Failed to create working symlink ${_SYMLINK} -> ${_helper_path}" 1>&2 return 2 fi } ### ### Fix VM system detection ### _fix_virt_what() { _VIRT_TEST="$(which virt-what)" if [ -n "${_VIRT_TEST}" ] && [ -x "${_VIRT_TEST}" ]; then _SHELL_TEST_A=$(grep -I -o "\#\!.*/usr/bin/sh" ${_VIRT_TEST} 2>&1) _SHELL_TEST_B=$(grep -I -o "\#\!.*/bin/sh" ${_VIRT_TEST} 2>&1) if [[ "${_SHELL_TEST_A}" =~ "/usr/bin/sh" ]]; then sed -i "s/\/usr\/bin\/sh/\/bin\/dash/g" ${_VIRT_TEST} fi if [[ "${_SHELL_TEST_B}" =~ "/bin/sh" ]]; then sed -i "s/\/bin\/sh/\/bin\/dash/g" ${_VIRT_TEST} fi _HELPER_NAME="virt-what-cpuid-helper" _SYMLINK="/usr/sbin/${_HELPER_NAME}" _TRACE="/tmp/virtwhat.$$.strace" # Extra dirs we temporarily expose to PATH so virt-what can exec the helper for strace discovery _CANDIDATE_PATHS="/usr/libexec:/usr/lib/x86_64-linux-gnu:/usr/lib64/virt-what:/usr/lib/virt-what" if [ ! -e "${_SYMLINK}" ]; then echo "INFO: virt-what tool requires small update, fixing..." if ! command -v strace &> /dev/null; then _apt_clean_update apt-get install strace ${_aptYesUnth} fi _ensure_virt_what_helper_symlink fi fi } ### ### Fix or install VM system detection ### _fix_or_install_virt_what() { _VIRT_TEST="$(which virt-what)" if [ -n "${_VIRT_TEST}" ] && [ -x "${_VIRT_TEST}" ]; then _fix_virt_what else echo "INFO: installing required virt-what tool ..." if [ ! -e "/etc/apt/apt.conf.d/00sandboxoff" ] \ && [ -e "/etc/apt/apt.conf.d" ]; then echo "APT::Sandbox::User \"root\";" > /etc/apt/apt.conf.d/00sandboxoff fi _apt_clean_update apt-get install virt-what ${_aptYesUnth} wait _fix_virt_what fi } _check_virt() { _fix_or_install_virt_what _VIRT_TOOL="$(which virt-what)" if [ -x "${_VIRT_TOOL}" ]; then _VIRT_TEST=$(virt-what) _VIRT_TEST=$(echo -n ${_VIRT_TEST} | fmt -su -w 2500 2>&1) if [[ "${_VIRT_TEST}" =~ "program not found" ]]; then echo "ERROR: virt-what says: ${_VIRT_TEST}" echo "ERROR: virt-what detection fails for unknown reason" fi if [ ! -e "/root/.allow.any.virt.cnf" ]; then if [ -e "/proc/self/status" ]; then _VS_GUEST_TEST=$(grep -E "VxID:[[:space:]]*[0-9]{2,}$" /proc/self/status 2> /dev/null) _VS_HOST_TEST=$(grep -E "VxID:[[:space:]]*0$" /proc/self/status 2> /dev/null) fi if [ ! -z "${_VS_HOST_TEST}" ] || [ ! -z "${_VS_GUEST_TEST}" ]; then if [ -z "${_VS_HOST_TEST}" ] && [ ! -z "${_VS_GUEST_TEST}" ]; then _VIRT_IS="Linux VServer guest" else if [ ! -z "${_VS_HOST_TEST}" ]; then _not_supported_virt "Linux VServer host" else _not_supported_virt "unknown / not a virtual machine" fi fi else if [ -z "${_VIRT_TEST}" ] || [ "${_VIRT_TEST}" = "0" ]; then _not_supported_virt "unknown / not a virtual machine" elif [[ "${_VIRT_TEST}" =~ "xen-dom0" ]]; then _not_supported_virt "Xen privileged domain" elif [[ "${_VIRT_TEST}" =~ "linux_vserver-host" ]]; then _not_supported_virt "Linux VServer host" else if [[ "${_VIRT_TEST}" =~ "xen xen-hvm" ]]; then _VIRT_TEST="xen-hvm" elif [[ "${_VIRT_TEST}" =~ "xen xen-domU" ]]; then _VIRT_TEST="xen-domU" elif [[ "${_VIRT_TEST}" =~ "virtualbox kvm" ]]; then _VIRT_TEST="virtualbox" elif [[ "${_VIRT_TEST}" =~ "hyperv qemu" ]]; then _VIRT_TEST="hyperv" elif [[ "${_VIRT_TEST}" =~ "kvm aws" ]]; then _VIRT_TEST="kvm" elif [[ "${_VIRT_TEST}" =~ "redhat kvm" ]]; then _VIRT_TEST="redhat-kvm" elif [[ "${_VIRT_TEST}" =~ "openvz lxc" ]]; then _VIRT_TEST="openvz" fi case "${_VIRT_TEST}" in hyperv) _VIRT_IS="Microsoft Hyper-V" ;; kvm) _VIRT_IS="Linux KVM guest" ;; lxc) _VIRT_IS="Linux Containers (LXC)" ;; openvz) _VIRT_IS="OpenVZ Containers" ;; parallels) _VIRT_IS="Parallels guest" ;; redhat-kvm) _VIRT_IS="Red Hat KVM guest" ;; virtualbox) _VIRT_IS="VirtualBox guest" ;; vmware) _VIRT_IS="VMware ESXi guest" ;; xen-domU) _VIRT_IS="Xen paravirtualized guest domain" ;; xen-hvm) _VIRT_IS="Xen guest fully virtualized (HVM)" ;; xen) _VIRT_IS="Xen guest" ;; *) _not_supported_virt "${_VIRT_TEST}" ;; esac fi fi else if [ -z "${_VIRT_TEST}" ] || [ "${_VIRT_TEST}" = "0" ]; then _VIRT_TEST="unknown / not a virtual machine" fi fi fi } ### ### Make local OpenSSL new/legacy ssl/certs symlinked to system ssl/certs ### _fix_sync_system_ssl_certs() { if [ -e "/etc/ssl/certs/ca-certificates.crt" ] \ && [ ! -e "/usr/local/ssl3/.old-certs" ] \ && [ -d "/usr/local/ssl3/certs" ] \ && [ ! -L "/usr/local/ssl3/certs" ]; then mv -f /usr/local/ssl3/certs /usr/local/ssl3/.old-certs ln -sfn /etc/ssl/certs /usr/local/ssl3/certs fi if [ -e "/etc/ssl/certs/ca-certificates.crt" ] \ && [ ! -e "/usr/local/ssl/.old-certs" ] \ && [ -d "/usr/local/ssl/certs" ] \ && [ ! -L "/usr/local/ssl/certs" ]; then mv -f /usr/local/ssl/certs /usr/local/ssl/.old-certs ln -sfn /etc/ssl/certs /usr/local/ssl/certs fi } _update_agents() { _if_hosted_sys if [ "${_hostedSys}" = "YES" ]; then if [ ! -e "/root/.extended.firewall.exceptions.cnf" ]; then echo host8 > /root/.extended.firewall.exceptions.cnf fi fi if [ "${_VMFAMILY}" = "HOSTED" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ -d "/data/u" ] \ && [ -e "/var/xdrago" ]; then [ ! -e "/root/.fast.cron.cnf" ] && echo ON > /root/.fast.cron.cnf _PrTestPower=$(grep "POWER" /root/.*.octopus.cnf 2>&1) _PrTestPhantom=$(grep "PHANTOM" /root/.*.octopus.cnf 2>&1) _PrTestCluster=$(grep "CLUSTER" /root/.*.octopus.cnf 2>&1) _PrTestUltra=$(grep "ULTRA" /root/.*.octopus.cnf 2>&1) _PrTestMonster=$(grep "MONSTER" /root/.*.octopus.cnf 2>&1) _InTest=$(ls /data/disk/*/static/control/cli.info | wc -l 2>&1) _SQL_PSWD=$(cat /root/.my.pass.txt 2>/dev/null | tr -d '\n') if [ "${_InTest}" -lt 9 ] \ && [[ ! "${_PrTestPower}" =~ "POWER" ]] \ && [[ ! "${_PrTestPhantom}" =~ "PHANTOM" ]] \ && [[ ! "${_PrTestCluster}" =~ "CLUSTER" ]] \ && [[ ! "${_PrTestUltra}" =~ "ULTRA" ]] \ && [[ ! "${_PrTestMonster}" =~ "MONSTER" ]]; then [ ! -e "/root/.fast.cron.cnf" ] && echo ${_InTest} > /root/.fast.cron.cnf [ -e "/root/.hr.monitor.cnf" ] && rm -f /root/.hr.monitor.cnf [ -e "/root/.slow.cron.cnf" ] && [ ! -e "/root/.slow.cron.cnf.protected" ] && rm -f /root/.slow.cron.cnf [ -e "/root/.tg.cnf" ] && rm -f /root/.tg.cnf mysql -u root -e "SET GLOBAL max_connect_errors = 555;" mysql -u root -e "SET GLOBAL max_connections = 111;" mysql -u root -e "SET GLOBAL max_user_connections = 111;" mysql -u root -e "SET GLOBAL group_concat_max_len = 10000;" fi if [ "${_InTest}" -ge 9 ] && [ "${_InTest}" -le 50 ]; then [ ! -e "/root/.fast.cron.cnf" ] && echo ${_InTest} > /root/.fast.cron.cnf [ -e "/root/.hr.monitor.cnf" ] && rm -f /root/.hr.monitor.cnf [ -e "/root/.slow.cron.cnf" ] && [ ! -e "/root/.slow.cron.cnf.protected" ] && rm -f /root/.slow.cron.cnf [ -e "/root/.tg.cnf" ] && rm -f /root/.tg.cnf mysql -u root -e "SET GLOBAL max_connect_errors = 777;" mysql -u root -e "SET GLOBAL max_connections = 555;" mysql -u root -e "SET GLOBAL max_user_connections = 111;" mysql -u root -e "SET GLOBAL group_concat_max_len = 10000;" fi if [ "${_InTest}" -gt 50 ]; then [ -e "/root/.fast.cron.cnf" ] && rm -f /root/.fast.cron.cnf [ ! -e "/root/.tg.cnf" ] && echo ${_InTest} > /root/.tg.cnf [ ! -e "/root/.hr.monitor.cnf" ] && echo ${_InTest} > /root/.hr.monitor.cnf [ ! -e "/root/.slow.cron.cnf" ] && echo ${_InTest} > /root/.slow.cron.cnf mysql -u root -e "SET GLOBAL max_connect_errors = 999;" mysql -u root -e "SET GLOBAL max_connections = 777;" mysql -u root -e "SET GLOBAL max_user_connections = 111;" mysql -u root -e "SET GLOBAL group_concat_max_len = 10000;" fi if [[ "${_PrTestPower}" =~ "POWER" ]]; then [ ! -e "/root/.tg.cnf" ] && echo ${_InTest} > /root/.tg.cnf [ ! -e "/root/.fast.cron.cnf" ] && echo ${_InTest} > /root/.fast.cron.cnf [ -e "/root/.hr.monitor.cnf" ] && rm -f /root/.hr.monitor.cnf [ -e "/root/.slow.cron.cnf" ] && [ ! -e "/root/.slow.cron.cnf.protected" ] && rm -f /root/.slow.cron.cnf mysql -u root -e "SET GLOBAL max_connect_errors = 555;" mysql -u root -e "SET GLOBAL max_connections = 333;" mysql -u root -e "SET GLOBAL max_user_connections = 111;" mysql -u root -e "SET GLOBAL group_concat_max_len = 10000;" fi if [[ "${_PrTestPhantom}" =~ "PHANTOM" ]]; then [ ! -e "/root/.tg.cnf" ] && echo ${_InTest} > /root/.tg.cnf [ ! -e "/root/.fast.cron.cnf" ] && echo ${_InTest} > /root/.fast.cron.cnf [ -e "/root/.hr.monitor.cnf" ] && rm -f /root/.hr.monitor.cnf [ -e "/root/.slow.cron.cnf" ] && [ ! -e "/root/.slow.cron.cnf.protected" ] && rm -f /root/.slow.cron.cnf mysql -u root -e "SET GLOBAL max_connect_errors = 777;" mysql -u root -e "SET GLOBAL max_connections = 555;" mysql -u root -e "SET GLOBAL max_user_connections = 333;" mysql -u root -e "SET GLOBAL group_concat_max_len = 10000;" fi if [[ "${_PrTestCluster}" =~ "CLUSTER" ]]; then [ ! -e "/root/.tg.cnf" ] && echo ${_InTest} > /root/.tg.cnf [ ! -e "/root/.fast.cron.cnf" ] && echo ${_InTest} > /root/.fast.cron.cnf [ -e "/root/.hr.monitor.cnf" ] && rm -f /root/.hr.monitor.cnf [ -e "/root/.slow.cron.cnf" ] && [ ! -e "/root/.slow.cron.cnf.protected" ] && rm -f /root/.slow.cron.cnf mysql -u root -e "SET GLOBAL max_connect_errors = 999;" mysql -u root -e "SET GLOBAL max_connections = 777;" mysql -u root -e "SET GLOBAL max_user_connections = 555;" mysql -u root -e "SET GLOBAL group_concat_max_len = 10000;" fi mysql -u root -e "SET GLOBAL optimizer_switch='derived_merge=off';" mysql -u root -e "SET GLOBAL sort_buffer_size = 262144;" if [ -e "/root/.tg.cnf" ]; then if [ ! -e "/root/.fixed_fpm_workers.cnf" ]; then sed -i "s/^_PHP_FPM_WORKERS=.*/_PHP_FPM_WORKERS=100/g" ${_barCnf} touch /root/.fixed_fpm_workers.cnf fi fi if [ ! -e "/root/.high_traffic.cnf" ]; then echo ${_InTest} > /root/.high_traffic.cnf echo ${_InTest} > /root/.no.swap.clear.cnf fi [ -e "/root/.randomize_duplicity_full_backup_day.cnf" ] && rm -f /root/.randomize_duplicity_full_backup_day.cnf [ -e "/root/.skip_duplicity_monthly_cleanup.cnf" ] && rm -f /root/.skip_duplicity_monthly_cleanup.cnf [ -e "/root/.my.batch_innodb.cnf" ] && rm -f /root/.my.batch_innodb.cnf [ -e "/root/.batch_innodb.cnf" ] && rm -f /root/.batch_innodb.cnf [ -e "/root/.force.drupalgeddon.cnf" ] && rm -f /root/.force.drupalgeddon.cnf [ -e "/root/.skip_cleanup.cnf" ] && rm -f /root/.skip_cleanup.cnf [ -e "/root/.giant_traffic.cnf" ] && rm -f /root/.giant_traffic.cnf [ -e "/root/.default.cnf" ] && rm -f /root/.default.cnf [ -e "/root/.debug.cnf" ] && rm -f /root/.debug.cnf if [ -e "/data/conf/override.global.inc" ] \ && [ ! -e "/data/conf/.prev6.override.global.inc.off" ]; then mv -f /data/conf/override.global.inc /data/conf/.prev6.override.global.inc.off fi # if [ ! -e "/data/conf/override.global.inc" ]; then # echo " /data/conf/override.global.inc.tmp # echo "" >> /data/conf/override.global.inc.tmp # echo "\$use_valkey = TRUE;" >> /data/conf/override.global.inc.tmp # chmod 644 /data/conf/override.global.inc.tmp # mv -f /data/conf/override.global.inc.tmp /data/conf/override.global.inc # fi fi if [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ]; then _pthCtrl="/root/.remote_backups/ctrl" if [ "${_tRee}" = "pro" ] || [ "${_tRee}" = "dev" ]; then [ ! -e "${_pthCtrl}" ] && mkdir -p ${_pthCtrl} [ ! -e "/root/.remote_backups/run" ] && mkdir -p /root/.remote_backups/run else rm -rf /root/.remote_backups fi [ ! -e "/var/xdrago/monitor/check" ] && mkdir -p /var/xdrago/monitor/check [ ! -e "/var/xdrago/monitor/log" ] && mkdir -p /var/xdrago/monitor/log if [ ! -e "${_pthLog}/.force.f89.${_tRee}.${_xSrl}.ctrl" ]; then rm -f ${_pthLog}/*.ctrl.*.pid touch ${_pthLog}/.force.f89.${_tRee}.${_xSrl}.ctrl fi [ ! -e "/var/xdrago/checksql.pl" ] && rm -f ${_pthLog}/checksql.pl.ctrl.*.pid [ ! -e "/var/xdrago/clear.sh" ] && rm -f ${_pthLog}/clear.sh.ctrl.*.pid [ ! -e "/var/xdrago/daily.sh" ] && rm -f ${_pthLog}/daily.sh.ctrl.*.pid [ ! -e "/var/xdrago/graceful.sh" ] && rm -f ${_pthLog}/graceful.sh.ctrl.*.pid [ ! -e "/var/xdrago/guest-fire.sh" ] && rm -f ${_pthLog}/guest-fire.sh.ctrl.*.pid [ ! -e "/var/xdrago/guest-water.sh" ] && rm -f ${_pthLog}/guest-water.sh.ctrl.*.pid [ ! -e "/var/xdrago/ip_access.sh" ] && rm -f ${_pthLog}/ip_access.sh.ctrl.*.pid [ ! -e "/var/xdrago/manage_ltd_users.sh" ] && rm -f ${_pthLog}/manage_ltd_users.sh.ctrl.*.pid [ ! -e "/var/xdrago/manage_solr_config.sh" ] && rm -f ${_pthLog}/manage_solr_config.sh.ctrl.*.pid [ ! -e "/var/xdrago/minute.sh" ] && rm -f ${_pthLog}/minute.sh.ctrl.*.pid [ ! -e "/var/xdrago/move_sql.sh" ] && rm -f ${_pthLog}/move_sql.sh.ctrl.*.pid [ ! -e "/var/xdrago/mysql_backup.sh" ] && rm -f ${_pthLog}/mysql_backup.sh.ctrl.*.pid [ ! -e "/var/xdrago/mysql_cleanup.sh" ] && rm -f ${_pthLog}/mysql_cleanup.sh.ctrl.*.pid [ ! -e "/var/xdrago/mysql_cluster_backup.sh" ] && rm -f ${_pthLog}/mysql_cluster_backup.sh.ctrl.*.pid [ ! -e "/var/xdrago/mysql_repair.sh" ] && rm -f ${_pthLog}/mysql_repair.sh.ctrl.*.pid [ ! -e "/var/xdrago/proc_num_ctrl.pl" ] && rm -f ${_pthLog}/proc_num_ctrl.pl.ctrl.*.pid [ ! -e "/var/xdrago/purge_binlogs.sh" ] && rm -f ${_pthLog}/purge_binlogs.sh.ctrl.*.pid [ ! -e "/var/xdrago/runner.sh" ] && rm -f ${_pthLog}/runner.sh.ctrl.*.pid [ ! -e "/var/xdrago/second.sh" ] && rm -f ${_pthLog}/second.sh.ctrl.*.pid [ ! -e "/var/xdrago/usage.sh" ] && rm -f ${_pthLog}/usage.sh.ctrl.*.pid [ ! -e "/var/xdrago/monitor/check/java.sh" ] && rm -f ${_pthLog}/java.sh.ctrl.*.pid [ ! -e "/var/xdrago/monitor/check/mysql.sh" ] && rm -f ${_pthLog}/mysql.sh.ctrl.*.pid [ ! -e "/var/xdrago/monitor/check/nginx.sh" ] && rm -f ${_pthLog}/nginx.sh.ctrl.*.pid [ ! -e "/var/xdrago/monitor/check/php.sh" ] && rm -f ${_pthLog}/php.sh.ctrl.*.pid [ ! -e "/var/xdrago/monitor/check/valkey.sh" ] && rm -f ${_pthLog}/valkey.sh.ctrl.*.pid [ ! -e "/var/xdrago/monitor/check/redis.sh" ] && rm -f ${_pthLog}/redis.sh.ctrl.*.pid [ ! -e "/var/xdrago/monitor/check/scan_nginx.sh" ] && rm -f ${_pthLog}/scan_nginx.sh.ctrl.*.pid [ ! -e "/var/xdrago/monitor/check/system.sh" ] && rm -f ${_pthLog}/system.sh.ctrl.*.pid [ ! -e "/var/xdrago/monitor/check/unbound.sh" ] && rm -f ${_pthLog}/unbound.sh.ctrl.*.pid [ ! -e "/var/xdrago/monitor/check/escapecheck.sh" ] && rm -f ${_pthLog}/escapecheck.sh.ctrl.*.pid [ ! -e "/var/xdrago/monitor/check/hackcheck.sh" ] && rm -f ${_pthLog}/hackcheck.sh.ctrl.*.pid [ ! -e "/var/xdrago/monitor/check/hackftp.sh" ] && rm -f ${_pthLog}/hackftp.sh.ctrl.*.pid [ ! -e "/var/xdrago/monitor/check/segfault_alert.pl" ] && rm -f ${_pthLog}/segfault_alert.pl.ctrl.*.pid [ ! -e "/var/xdrago/monitor/check/sqlcheck.pl" ] && rm -f ${_pthLog}/sqlcheck.pl.ctrl.*.pid [ -e "/var/xdrago/proc_num_ctrl.cgi" ] && rm -f /var/xdrago/proc_num_ctrl.cgi [ -e "/var/xdrago/checksql.cgi" ] && rm -f /var/xdrago/checksql.cgi [ -e "/var/xdrago/mysql_hourly.sh" ] && rm -f /var/xdrago/mysql_hourly.sh [ -e "/var/xdrago/monitor/check/sqlcheck" ] && rm -f ${_pthLog}/*.ctrl.*.pid [ -e "/var/xdrago/monitor/check/sqlcheck" ] && rm -f /var/xdrago/monitor/check/* [ -e "/var/xdrago/monitor/hackcheck.archive.log" ] && rm -f /var/xdrago/monitor/.scan_nginx_arch* [ -e "/var/xdrago/monitor/hackcheck.archive.log" ] && mv -f /var/xdrago/monitor/*.log /var/xdrago/monitor/log/ fi if [ -e "/root/.remote_backups/schedule/backup_schedule.txt" ] \ && [ -d "/var/aegir/drush" ]; then if grep -q "Out of memory: Killed process.*duplicity" /var/log/iptables.log; then if [ ! -e "/root/.remote_backups/schedule/backup_schedule.txt-off" ]; then cp -a /root/.remote_backups/schedule/backup_schedule.txt /root/.remote_backups/schedule/backup_schedule.txt-off echo "# Backup schedule (service user) OFF" > /root/.remote_backups/schedule/backup_schedule.txt chattr +i /root/.remote_backups/schedule/backup_schedule.txt fi else if [ -e "/root/.remote_backups/schedule/backup_schedule.txt-off" ]; then chattr -i /root/.remote_backups/schedule/backup_schedule.txt rm -f /root/.remote_backups/schedule/backup_schedule.txt mv /root/.remote_backups/schedule/backup_schedule.txt-off /root/.remote_backups/schedule/backup_schedule.txt fi fi if [ "$(pgrep -fc duplicity)" -gt 0 ] \ && [ "$(pgrep -fc dcysetup)" -lt 1 ] \ && [ "$(pgrep -fc mybackup)" -lt 1 ] \ && [ "$(pgrep -fc multiback)" -lt 1 ]; then pkill -9 -f duplicity rm -rf /tmp/duplicity* rm -rf /root/.cache/duplicity/*/duplicity-*tempdir rm -f /root/.cache/duplicity/*/lockfile echo "$(date) Orphaned duplicity processes killed" >> /var/log/duplicity-cleanup.log fi fi if ! grep -q "OFF" ${_optBin}/lock.inc; then rm -f ${_pthLog}/lock.inc.sh.ctrl.* fi if [ ! -e "${_optBin}/lock.inc" ] \ || [ ! -e "${_pthLog}/lock.inc.sh.ctrl.f98.${_tRee}.${_xSrl}.pid" ]; then _CNT=$(pgrep -fc foobar) if (( _CNT > 0 )); then echo "The foobar is running!" else if [ -e "${_optBin}/lock.inc" ]; then mv -f ${_optBin}/lock.inc ${_optBin}/lock.inc.old fi curl ${_crlGet} "${_urlHmr}/tools/bin/lock.inc" -o ${_optBin}/lock.inc if [ -e "${_optBin}/lock.inc" ]; then chmod 700 ${_optBin}/lock.inc chown root:root ${_optBin}/lock.inc touch ${_pthLog}/lock.inc.sh.ctrl.f98.${_tRee}.${_xSrl}.pid else if [ -e "${_optBin}/lock.inc.old" ]; then mv -f ${_optBin}/lock.inc.old ${_optBin}/lock.inc fi fi fi fi if [ ! -e "${_optBin}/vmnetfix" ] \ || [ ! -e "${_pthLog}/vmnetfix.sh.ctrl.f89.${_tRee}.${_xSrl}.pid" ]; then _CNT=$(pgrep -fc vmnetfix) if (( _CNT > 0 )); then echo "The vmnetfix is running!" else if [ ! -e "/etc/init.d/networking" ]; then mkdir -p /etc/init.d curl ${_crlGet} "${_urlHmr}/conf/network/networking" -o /etc/init.d/networking chmod 0755 /etc/init.d/networking chown root:root /etc/init.d/networking update-rc.d networking defaults >/dev/null 2>&1 || true fi if [ -e "${_optBin}/vmnetfix" ]; then mv -f ${_optBin}/vmnetfix ${_optBin}/vmnetfix.old fi curl ${_crlGet} "${_urlHmr}/tools/bin/vmnetfix" -o ${_optBin}/vmnetfix if [ -e "${_optBin}/vmnetfix" ]; then chmod 700 ${_optBin}/vmnetfix chown root:root ${_optBin}/vmnetfix touch ${_pthLog}/vmnetfix.sh.ctrl.f89.${_tRee}.${_xSrl}.pid else if [ -e "${_optBin}/vmnetfix.old" ]; then mv -f ${_optBin}/vmnetfix.old ${_optBin}/vmnetfix fi fi fi fi if [ ! -e "${_optBin}/screenfetch" ] \ || [ ! -e "${_pthLog}/screenfetch.sh.ctrl.f99.${_tRee}.${_xSrl}.pid" ]; then _CNT=$(pgrep -fc screenfetch) if (( _CNT > 0 )); then echo "The screenfetch is running!" else if [ -e "${_optBin}/screenfetch" ]; then mv -f ${_optBin}/screenfetch ${_optBin}/screenfetch.old fi curl ${_crlGet} "${_urlHmr}/tools/bin/screenfetch" -o ${_optBin}/screenfetch if [ -e "${_optBin}/screenfetch" ]; then chmod 700 ${_optBin}/screenfetch chown root:root ${_optBin}/screenfetch touch ${_pthLog}/screenfetch.sh.ctrl.f99.${_tRee}.${_xSrl}.pid else if [ -e "${_optBin}/screenfetch.old" ]; then mv -f ${_optBin}/screenfetch.old ${_optBin}/screenfetch fi fi fi fi if [ ! -e "${_optBin}/fixrepo" ] \ || [ ! -e "${_pthLog}/fixrepo.sh.ctrl.f99.${_tRee}.${_xSrl}.pid" ]; then _CNT=$(pgrep -fc fixrepo) if (( _CNT > 0 )); then echo "The fixrepo is running!" else if [ -e "${_optBin}/fixrepo" ]; then mv -f ${_optBin}/fixrepo ${_optBin}/fixrepo.old fi curl ${_crlGet} "${_urlHmr}/tools/bin/fixrepo" -o ${_optBin}/fixrepo if [ -e "${_optBin}/fixrepo" ]; then chmod 700 ${_optBin}/fixrepo chown root:root ${_optBin}/fixrepo touch ${_pthLog}/fixrepo.sh.ctrl.f99.${_tRee}.${_xSrl}.pid else if [ -e "${_optBin}/fixrepo.old" ]; then mv -f ${_optBin}/fixrepo.old ${_optBin}/fixrepo fi fi fi fi if [ ! -e "${_optBin}/renameaegirhost" ] \ || [ ! -e "${_pthLog}/renameaegirhost.sh.ctrl.f99.${_tRee}.${_xSrl}.pid" ]; then _CNT=$(pgrep -fc renameaegirhost) if (( _CNT > 0 )); then echo "The renameaegirhost is running!" else if [ -e "${_optBin}/renameaegirhost" ]; then mv -f ${_optBin}/renameaegirhost ${_optBin}/renameaegirhost.old fi curl ${_crlGet} "${_urlHmr}/tools/bin/renameaegirhost" -o ${_optBin}/renameaegirhost if [ -e "${_optBin}/renameaegirhost" ]; then chmod 700 ${_optBin}/renameaegirhost chown root:root ${_optBin}/renameaegirhost touch ${_pthLog}/renameaegirhost.sh.ctrl.f99.${_tRee}.${_xSrl}.pid else if [ -e "${_optBin}/renameaegirhost.old" ]; then mv -f ${_optBin}/renameaegirhost.old ${_optBin}/renameaegirhost fi fi fi fi if [ ! -e "${_optBin}/autosymlink" ] \ || [ ! -e "${_pthLog}/autosymlink.sh.ctrl.f93.${_tRee}.${_xSrl}.pid" ]; then _CNT=$(pgrep -fc autosymlink) if (( _CNT > 0 )); then echo "The autosymlink is running!" else if [ -e "${_optBin}/autosymlink" ]; then mv -f ${_optBin}/autosymlink ${_optBin}/autosymlink.old fi curl ${_crlGet} "${_urlHmr}/tools/bin/autosymlink" -o ${_optBin}/autosymlink if [ -e "${_optBin}/autosymlink" ]; then chmod 700 ${_optBin}/autosymlink chown root:root ${_optBin}/autosymlink touch ${_pthLog}/autosymlink.sh.ctrl.f93.${_tRee}.${_xSrl}.pid else if [ -e "${_optBin}/autosymlink.old" ]; then mv -f ${_optBin}/autosymlink.old ${_optBin}/autosymlink fi fi fi fi if [ ! -e "${_optBin}/updatesymlinks" ] \ || [ ! -e "${_pthLog}/updatesymlinks.sh.ctrl.f99.${_tRee}.${_xSrl}.pid" ]; then _CNT=$(pgrep -fc updatesymlinks) if (( _CNT > 0 )); then echo "The updatesymlinks is running!" else if [ -e "${_optBin}/updatesymlinks" ]; then mv -f ${_optBin}/updatesymlinks ${_optBin}/updatesymlinks.old fi curl ${_crlGet} "${_urlHmr}/tools/bin/updatesymlinks" -o ${_optBin}/updatesymlinks if [ -e "${_optBin}/updatesymlinks" ]; then chmod 700 ${_optBin}/updatesymlinks chown root:root ${_optBin}/updatesymlinks touch ${_pthLog}/updatesymlinks.sh.ctrl.f99.${_tRee}.${_xSrl}.pid else if [ -e "${_optBin}/updatesymlinks.old" ]; then mv -f ${_optBin}/updatesymlinks.old ${_optBin}/updatesymlinks fi fi fi fi if [ ! -e "${_optBin}/aptcleanup" ] \ || [ ! -e "${_pthLog}/aptcleanup.sh.ctrl.f97.${_tRee}.${_xSrl}.pid" ]; then _CNT=$(pgrep -fc aptcleanup) if (( _CNT > 0 )); then echo "The aptcleanup is running!" else if [ -e "${_optBin}/aptcleanup" ]; then mv -f ${_optBin}/aptcleanup ${_optBin}/aptcleanup.old fi curl ${_crlGet} "${_urlHmr}/tools/bin/aptcleanup" -o ${_optBin}/aptcleanup if [ -e "${_optBin}/aptcleanup" ]; then chmod 700 ${_optBin}/aptcleanup chown root:root ${_optBin}/aptcleanup touch ${_pthLog}/aptcleanup.sh.ctrl.f97.${_tRee}.${_xSrl}.pid else if [ -e "${_optBin}/aptcleanup.old" ]; then mv -f ${_optBin}/aptcleanup.old ${_optBin}/aptcleanup fi fi fi fi if [ ! -e "${_optBin}/loadguard" ] \ || [ ! -e "${_pthLog}/loadguard.sh.ctrl.f99.${_tRee}.${_xSrl}.pid" ]; then _CNT=$(pgrep -fc xloadguard) if (( _CNT > 0 )); then echo "The xloadguard is running!" else if [ -e "${_optBin}/loadguard" ]; then mv -f ${_optBin}/loadguard ${_optBin}/loadguard.old fi curl ${_crlGet} "${_urlHmr}/tools/bin/loadguard" -o ${_optBin}/loadguard if [ -e "${_optBin}/loadguard" ]; then chmod 700 ${_optBin}/loadguard chown root:root ${_optBin}/loadguard touch ${_pthLog}/loadguard.sh.ctrl.f99.${_tRee}.${_xSrl}.pid else if [ -e "${_optBin}/loadguard.old" ]; then mv -f ${_optBin}/loadguard.old ${_optBin}/loadguard fi fi fi fi if [ ! -e "${_optBin}/ffmirror" ] \ || [ ! -e "${_pthLog}/ffmirror.sh.ctrl.f99.${_tRee}.${_xSrl}.pid" ]; then _CNT=$(pgrep -fc xffmirror) if (( _CNT > 0 )); then echo "The xffmirror is running!" else if [ -e "${_optBin}/ffmirror" ]; then mv -f ${_optBin}/ffmirror ${_optBin}/ffmirror.old fi curl ${_crlGet} "${_urlHmr}/tools/bin/ffmirror" -o ${_optBin}/ffmirror if [ -e "${_optBin}/ffmirror" ]; then chmod 700 ${_optBin}/ffmirror chown root:root ${_optBin}/ffmirror touch ${_pthLog}/ffmirror.sh.ctrl.f99.${_tRee}.${_xSrl}.pid else if [ -e "${_optBin}/ffmirror.old" ]; then mv -f ${_optBin}/ffmirror.old ${_optBin}/ffmirror fi fi fi fi if [ ! -e "${_optBin}/ffdevuan" ] \ || [ ! -e "${_pthLog}/ffdevuan.sh.ctrl.f95.${_tRee}.${_xSrl}.pid" ]; then _CNT=$(pgrep -fc xffdevuan) if (( _CNT > 0 )); then echo "The xffdevuan is running!" else if [ -e "${_optBin}/ffdevuan" ]; then mv -f ${_optBin}/ffdevuan ${_optBin}/ffdevuan.old fi curl ${_crlGet} "${_urlHmr}/tools/bin/ffdevuan" -o ${_optBin}/ffdevuan if [ -e "${_optBin}/ffdevuan" ]; then chmod 700 ${_optBin}/ffdevuan chown root:root ${_optBin}/ffdevuan touch ${_pthLog}/ffdevuan.sh.ctrl.f95.${_tRee}.${_xSrl}.pid else if [ -e "${_optBin}/ffdevuan.old" ]; then mv -f ${_optBin}/ffdevuan.old ${_optBin}/ffdevuan fi fi fi fi if [ ! -e "${_optBin}/webserver" ] \ || [ ! -e "${_pthLog}/webserver.sh.ctrl.f99.${_tRee}.${_xSrl}.pid" ]; then _CNT=$(pgrep -fc xwebserver) if (( _CNT > 0 )); then echo "The xwebserver is running!" else if [ -e "${_optBin}/webserver" ]; then mv -f ${_optBin}/webserver ${_optBin}/webserver.old fi curl ${_crlGet} "${_urlHmr}/tools/bin/webserver" -o ${_optBin}/webserver if [ -e "${_optBin}/webserver" ]; then chmod 700 ${_optBin}/webserver chown root:root ${_optBin}/webserver touch ${_pthLog}/webserver.sh.ctrl.f99.${_tRee}.${_xSrl}.pid else if [ -e "${_optBin}/webserver.old" ]; then mv -f ${_optBin}/webserver.old ${_optBin}/webserver fi fi fi fi if [ ! -e "${_optBin}/xboa" ] \ || [ ! -e "${_pthLog}/xboa.sh.ctrl.f99.${_tRee}.${_xSrl}.pid" ]; then _CNT=$(pgrep -fc /local/bin/xboa) if (( _CNT > 0 )); then echo "The xboa is running!" else if [ -e "${_optBin}/xboa" ]; then mv -f ${_optBin}/xboa ${_optBin}/xboa.old fi curl ${_crlGet} "${_urlHmr}/tools/bin/xboa" -o ${_optBin}/xboa if [ -e "${_optBin}/xboa" ]; then chmod 700 ${_optBin}/xboa chown root:root ${_optBin}/xboa touch ${_pthLog}/xboa.sh.ctrl.f99.${_tRee}.${_xSrl}.pid else if [ -e "${_optBin}/xboa.old" ]; then mv -f ${_optBin}/xboa.old ${_optBin}/xboa fi fi fi fi if [ ! -e "${_optBin}/boa" ] \ || [ ! -e "${_pthLog}/boa.sh.ctrl.f89.${_tRee}.${_xSrl}.pid" ]; then _CNT=$(pgrep -fc /local/bin/boa) if (( _CNT > 0 )); then echo "The boa is running!" else if [ -e "${_optBin}/boa" ]; then mv -f ${_optBin}/boa ${_optBin}/boa.old fi curl ${_crlGet} "${_urlHmr}/tools/bin/boa" -o ${_optBin}/boa if [ -e "${_optBin}/boa" ]; then chmod 700 ${_optBin}/boa chown root:root ${_optBin}/boa touch ${_pthLog}/boa.sh.ctrl.f89.${_tRee}.${_xSrl}.pid else if [ -e "${_optBin}/boa.old" ]; then mv -f ${_optBin}/boa.old ${_optBin}/boa fi fi fi fi if [ ! -e "${_optBin}/barracuda" ] \ || [ ! -e "${_pthLog}/barracuda.sh.ctrl.f93.${_tRee}.${_xSrl}.pid" ]; then _CNT=$(pgrep -fc /local/bin/barracuda) if (( _CNT > 0 )); then echo "The barracuda is running!" else if [ -e "${_optBin}/barracuda" ]; then mv -f ${_optBin}/barracuda ${_optBin}/barracuda.old fi curl ${_crlGet} "${_urlHmr}/tools/bin/barracuda" -o ${_optBin}/barracuda if [ -e "${_optBin}/barracuda" ]; then chmod 700 ${_optBin}/barracuda chown root:root ${_optBin}/barracuda touch ${_pthLog}/barracuda.sh.ctrl.f93.${_tRee}.${_xSrl}.pid else if [ -e "${_optBin}/barracuda.old" ]; then mv -f ${_optBin}/barracuda.old ${_optBin}/barracuda fi fi fi fi if [ ! -e "${_optBin}/octopus" ] \ || [ ! -e "${_pthLog}/octopus.sh.ctrl.f89.${_tRee}.${_xSrl}.pid" ]; then _CNT=$(pgrep -fc /local/bin/octopus) if (( _CNT > 0 )); then echo "The octopus is running!" else if [ -e "${_optBin}/octopus" ]; then mv -f ${_optBin}/octopus ${_optBin}/octopus.old fi curl ${_crlGet} "${_urlHmr}/tools/bin/octopus" -o ${_optBin}/octopus if [ -e "${_optBin}/octopus" ]; then chmod 700 ${_optBin}/octopus chown root:root ${_optBin}/octopus touch ${_pthLog}/octopus.sh.ctrl.f89.${_tRee}.${_xSrl}.pid else if [ -e "${_optBin}/octopus.old" ]; then mv -f ${_optBin}/octopus.old ${_optBin}/octopus fi fi fi fi if [ ! -e "${_optBin}/perftest" ] \ || [ ! -L "${_usrBin}/perftest" ] \ || [ ! -e "${_pthLog}/perftest.sh.ctrl.f97.${_tRee}.${_xSrl}.pid" ]; then _CNT=$(pgrep -fc /local/bin/perftest) if (( _CNT > 0 )); then echo "The perftest is running!" else if [ -e "${_optBin}/perftest" ]; then mv -f ${_optBin}/perftest ${_optBin}/perftest.old fi curl ${_crlGet} "${_urlHmr}/tools/bin/perftest" -o ${_optBin}/perftest if [ -e "${_optBin}/perftest" ]; then chmod 700 ${_optBin}/perftest chown root:root ${_optBin}/perftest ln -sf ${_optBin}/perftest ${_usrBin}/perftest rm -f ${_pthLog}/perftest.sh.ctrl.* touch ${_pthLog}/perftest.sh.ctrl.f97.${_tRee}.${_xSrl}.pid else if [ -e "${_optBin}/perftest.old" ]; then mv -f ${_optBin}/perftest.old ${_optBin}/perftest fi fi fi fi if [ ! -e "${_optBin}/aptfast" ] \ || [ ! -e "${_pthLog}/aptfast.sh.ctrl.f98.${_tRee}.${_xSrl}.pid" ]; then _CNT=$(pgrep -fc /local/bin/aptfast) if (( _CNT > 0 )); then echo "The aptfast is running!" else if [ -e "${_optBin}/aptfast" ]; then mv -f ${_optBin}/aptfast ${_optBin}/aptfast.old fi curl ${_crlGet} "${_urlHmr}/tools/bin/aptfast" -o ${_optBin}/aptfast if [ -e "${_optBin}/aptfast" ]; then chmod 700 ${_optBin}/aptfast chown root:root ${_optBin}/aptfast touch ${_pthLog}/aptfast.sh.ctrl.f98.${_tRee}.${_xSrl}.pid else if [ -e "${_optBin}/aptfast.old" ]; then mv -f ${_optBin}/aptfast.old ${_optBin}/aptfast fi fi fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -d "/var/aegir/drush" ] \ && [ ! -e "${_pthLog}/backboa.sh.ctrl.f99.${_tRee}.${_xSrl}.pid" ]; then _CNT=$(pgrep -fc duplicity) if (( _CNT > 0 )); then echo "The duplicity backup is running!" else if [ -e "${_optBin}/backboa" ]; then mv -f ${_optBin}/backboa ${_optBin}/backboa.old fi curl ${_crlGet} "${_urlHmr}/tools/bin/backboa" -o ${_optBin}/backboa if [ -e "${_optBin}/backboa" ]; then chmod 700 ${_optBin}/backboa chown root:root ${_optBin}/backboa touch ${_pthLog}/backboa.sh.ctrl.f99.${_tRee}.${_xSrl}.pid else if [ -e "${_optBin}/backboa.old" ]; then mv -f ${_optBin}/backboa.old ${_optBin}/backboa fi fi fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -d "/var/aegir/drush" ] \ && [ ! -e "${_pthLog}/duobackboa.sh.ctrl.f99.${_tRee}.${_xSrl}.pid" ]; then _CNT=$(pgrep -fc duplicity) if (( _CNT > 0 )); then echo "The duplicity backup is running!" else if [ -e "${_optBin}/duobackboa" ]; then mv -f ${_optBin}/duobackboa ${_optBin}/duobackboa.old fi curl ${_crlGet} "${_urlHmr}/tools/bin/duobackboa" -o ${_optBin}/duobackboa if [ -e "${_optBin}/duobackboa" ]; then chmod 700 ${_optBin}/duobackboa chown root:root ${_optBin}/duobackboa touch ${_pthLog}/duobackboa.sh.ctrl.f99.${_tRee}.${_xSrl}.pid else if [ -e "${_optBin}/duobackboa.old" ]; then mv -f ${_optBin}/duobackboa.old ${_optBin}/duobackboa fi fi fi fi if [ -e "/root/.remote_backups/schedule/backup_schedule.txt" ]; then _BROKEN_UPDATE_TEST=$(grep "Under Construction" /root/.remote_backups/run/*.sh 2>&1) if [ ! -z "${_BROKEN_UPDATE_TEST}" ]; then rm -f ${_pthCtrl}/*.pid fi _BROKEN_UPDATE_TEST=$(grep "404 Not Found" /root/.remote_backups/run/*.sh 2>&1) if [ ! -z "${_BROKEN_UPDATE_TEST}" ]; then rm -f ${_pthCtrl}/*.pid fi fi if [ -e "/root/.remote_backups/schedule/backup_schedule.txt" ] \ && [ -d "/var/aegir/drush" ] \ && [ ! -e "${_pthCtrl}/dcysetup.sh.ctrl.f99.${_tRee}.${_xSrl}.pid" ]; then _CNT=$(pgrep -fc duplicity) if (( _CNT > 0 )); then echo "The duplicity backup is running!" else if [ -e "${_optBin}/dcysetup" ]; then mv -f ${_optBin}/dcysetup ${_optBin}/dcysetup.old fi curl ${_crlGet} "${_urlHmr}/tools/bin/dcysetup" -o ${_optBin}/dcysetup if [ -e "${_optBin}/dcysetup" ]; then chmod 700 ${_optBin}/dcysetup chown root:root ${_optBin}/dcysetup touch ${_pthCtrl}/dcysetup.sh.ctrl.f99.${_tRee}.${_xSrl}.pid else if [ -e "${_optBin}/dcysetup.old" ]; then mv -f ${_optBin}/dcysetup.old ${_optBin}/dcysetup fi fi fi fi if [ -e "/root/.remote_backups/schedule/backup_schedule.txt" ] \ && [ -d "/var/aegir/drush" ] \ && [ ! -e "${_pthCtrl}/multiback.sh.ctrl.f37.${_tRee}.${_xSrl}.pid" ]; then _CNT=$(pgrep -fc duplicity) if (( _CNT > 0 )); then echo "The duplicity backup is running!" else if [ -e "${_optBin}/multiback" ]; then mv -f ${_optBin}/multiback ${_optBin}/multiback.old fi curl ${_crlGet} "${_urlHmr}/tools/bin/multiback" -o ${_optBin}/multiback if [ -e "${_optBin}/multiback" ]; then chmod 700 ${_optBin}/multiback chown root:root ${_optBin}/multiback touch ${_pthCtrl}/multiback.sh.ctrl.f37.${_tRee}.${_xSrl}.pid else if [ -e "${_optBin}/multiback.old" ]; then mv -f ${_optBin}/multiback.old ${_optBin}/multiback fi fi fi fi if [ -e "/root/.remote_backups/schedule/backup_schedule.txt" ] \ && [ -d "/var/aegir/drush" ] \ && [ ! -e "${_pthCtrl}/mybackup.sh.ctrl.f37.${_tRee}.${_xSrl}.pid" ]; then _CNT=$(pgrep -fc duplicity) if (( _CNT > 0 )); then echo "The duplicity backup is running!" else if [ -e "${_optBin}/mybackup" ]; then mv -f ${_optBin}/mybackup ${_optBin}/mybackup.old fi curl ${_crlGet} "${_urlHmr}/tools/bin/mybackup" -o ${_optBin}/mybackup if [ -e "${_optBin}/mybackup" ]; then chmod 755 ${_optBin}/mybackup chown root:root ${_optBin}/mybackup touch ${_pthCtrl}/mybackup.sh.ctrl.f37.${_tRee}.${_xSrl}.pid else if [ -e "${_optBin}/mybackup.old" ]; then mv -f ${_optBin}/mybackup.old ${_optBin}/mybackup fi fi fi fi if [ -d "/root/.remote_backups/run" ] \ && [ -d "/var/aegir/drush" ] \ && [ ! -e "${_pthCtrl}/install_dependencies.sh.ctrl.f48.${_tRee}.${_xSrl}.pid" ]; then if [ -e "/root/.remote_backups/run/install_dependencies.sh" ]; then mv -f /root/.remote_backups/run/install_dependencies.sh /root/.remote_backups/run/install_dependencies.sh.old fi curl ${_crlGet} "${_urlHmr}/tools/backup/run/install_dependencies.sh" -o /root/.remote_backups/run/install_dependencies.sh if [ -e "/root/.remote_backups/run/install_dependencies.sh" ]; then chmod 700 /root/.remote_backups/run/install_dependencies.sh chown root:root /root/.remote_backups/run/install_dependencies.sh touch ${_pthCtrl}/install_dependencies.sh.ctrl.f48.${_tRee}.${_xSrl}.pid else if [ -e "/root/.remote_backups/run/install_dependencies.sh.old" ]; then mv -f /root/.remote_backups/run/install_dependencies.sh.old /root/.remote_backups/run/install_dependencies.sh fi fi fi if [ -d "/root/.remote_backups/run" ] \ && [ -d "/var/aegir/drush" ] \ && [ ! -e "${_pthCtrl}/create_credentials_templates.sh.ctrl.f48.${_tRee}.${_xSrl}.pid" ]; then rm -f /.backboa* if [ -e "/root/.remote_backups/run/create_credentials_templates.sh" ]; then mv -f /root/.remote_backups/run/create_credentials_templates.sh /root/.remote_backups/run/create_credentials_templates.sh.old fi curl ${_crlGet} "${_urlHmr}/tools/backup/run/create_credentials_templates.sh" -o /root/.remote_backups/run/create_credentials_templates.sh if [ -e "/root/.remote_backups/run/create_credentials_templates.sh" ]; then chmod 700 /root/.remote_backups/run/create_credentials_templates.sh chown root:root /root/.remote_backups/run/create_credentials_templates.sh touch ${_pthCtrl}/create_credentials_templates.sh.ctrl.f48.${_tRee}.${_xSrl}.pid else if [ -e "/root/.remote_backups/run/create_credentials_templates.sh.old" ]; then mv -f /root/.remote_backups/run/create_credentials_templates.sh.old /root/.remote_backups/run/create_credentials_templates.sh fi fi fi if [ -d "/root/.remote_backups/run" ] \ && [ -d "/var/aegir/drush" ] \ && [ ! -e "${_pthCtrl}/create_global_paths_config.sh.ctrl.f44.${_tRee}.${_xSrl}.pid" ]; then if [ -e "/root/.remote_backups/run/create_global_paths_config.sh" ]; then mv -f /root/.remote_backups/run/create_global_paths_config.sh /root/.remote_backups/run/create_global_paths_config.sh.old fi curl ${_crlGet} "${_urlHmr}/tools/backup/run/create_global_paths_config.sh" -o /root/.remote_backups/run/create_global_paths_config.sh if [ -e "/root/.remote_backups/run/create_global_paths_config.sh" ]; then chmod 700 /root/.remote_backups/run/create_global_paths_config.sh chown root:root /root/.remote_backups/run/create_global_paths_config.sh touch ${_pthCtrl}/create_global_paths_config.sh.ctrl.f44.${_tRee}.${_xSrl}.pid else if [ -e "/root/.remote_backups/run/create_global_paths_config.sh.old" ]; then mv -f /root/.remote_backups/run/create_global_paths_config.sh.old /root/.remote_backups/run/create_global_paths_config.sh fi fi fi if [ -d "/root/.remote_backups/run" ] \ && [ -d "/var/aegir/drush" ] \ && [ ! -e "${_pthCtrl}/create_user_paths_config.sh.ctrl.f48.${_tRee}.${_xSrl}.pid" ]; then rm -f /.backboa* if [ -e "/root/.remote_backups/run/create_user_paths_config.sh" ]; then mv -f /root/.remote_backups/run/create_user_paths_config.sh /root/.remote_backups/run/create_user_paths_config.sh.old fi curl ${_crlGet} "${_urlHmr}/tools/backup/run/create_user_paths_config.sh" -o /root/.remote_backups/run/create_user_paths_config.sh if [ -e "/root/.remote_backups/run/create_user_paths_config.sh" ]; then chmod 700 /root/.remote_backups/run/create_user_paths_config.sh chown root:root /root/.remote_backups/run/create_user_paths_config.sh touch ${_pthCtrl}/create_user_paths_config.sh.ctrl.f48.${_tRee}.${_xSrl}.pid else if [ -e "/root/.remote_backups/run/create_user_paths_config.sh.old" ]; then mv -f /root/.remote_backups/run/create_user_paths_config.sh.old /root/.remote_backups/run/create_user_paths_config.sh fi fi fi if [ -d "/root/.remote_backups/run" ] \ && [ -d "/var/aegir/drush" ] \ && [ ! -e "${_pthCtrl}/create_cron_entries.sh.ctrl.f48.${_tRee}.${_xSrl}.pid" ]; then if [ -e "/root/.remote_backups/run/create_cron_entries.sh" ]; then mv -f /root/.remote_backups/run/create_cron_entries.sh /root/.remote_backups/run/create_cron_entries.sh.old fi curl ${_crlGet} "${_urlHmr}/tools/backup/run/create_cron_entries.sh" -o /root/.remote_backups/run/create_cron_entries.sh if [ -e "/root/.remote_backups/run/create_cron_entries.sh" ]; then chmod 700 /root/.remote_backups/run/create_cron_entries.sh chown root:root /root/.remote_backups/run/create_cron_entries.sh touch ${_pthCtrl}/create_cron_entries.sh.ctrl.f48.${_tRee}.${_xSrl}.pid else if [ -e "/root/.remote_backups/run/create_cron_entries.sh.old" ]; then mv -f /root/.remote_backups/run/create_cron_entries.sh.old /root/.remote_backups/run/create_cron_entries.sh fi fi fi if [ -d "/root/.remote_backups/run" ] \ && [ -d "/var/aegir/drush" ] \ && [ ! -e "${_pthCtrl}/create_readme.sh.ctrl.f48.${_tRee}.${_xSrl}.pid" ]; then if [ -e "/root/.remote_backups/run/create_readme.sh" ]; then mv -f /root/.remote_backups/run/create_readme.sh /root/.remote_backups/run/create_readme.sh.old fi curl ${_crlGet} "${_urlHmr}/tools/backup/run/create_readme.sh" -o /root/.remote_backups/run/create_readme.sh if [ -e "/root/.remote_backups/run/create_readme.sh" ]; then chmod 700 /root/.remote_backups/run/create_readme.sh chown root:root /root/.remote_backups/run/create_readme.sh touch ${_pthCtrl}/create_readme.sh.ctrl.f48.${_tRee}.${_xSrl}.pid else if [ -e "/root/.remote_backups/run/create_readme.sh.old" ]; then mv -f /root/.remote_backups/run/create_readme.sh.old /root/.remote_backups/run/create_readme.sh fi fi fi if [ -d "/root/.remote_backups/run" ] \ && [ -d "/var/aegir/drush" ] \ && [ ! -e "${_pthCtrl}/create_config_readme.sh.ctrl.f48.${_tRee}.${_xSrl}.pid" ]; then if [ -e "/root/.remote_backups/run/create_config_readme.sh" ]; then mv -f /root/.remote_backups/run/create_config_readme.sh /root/.remote_backups/run/create_config_readme.sh.old fi curl ${_crlGet} "${_urlHmr}/tools/backup/run/create_config_readme.sh" -o /root/.remote_backups/run/create_config_readme.sh if [ -e "/root/.remote_backups/run/create_config_readme.sh" ]; then chmod 700 /root/.remote_backups/run/create_config_readme.sh chown root:root /root/.remote_backups/run/create_config_readme.sh touch ${_pthCtrl}/create_config_readme.sh.ctrl.f48.${_tRee}.${_xSrl}.pid else if [ -e "/root/.remote_backups/run/create_config_readme.sh.old" ]; then mv -f /root/.remote_backups/run/create_config_readme.sh.old /root/.remote_backups/run/create_config_readme.sh fi fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/scan_nginx.sh.ctrl.f81.${_tRee}.${_xSrl}.pid" ]; then mv -f /var/xdrago/monitor/check/scan_nginx.sh /var/xdrago/monitor/check/scan_nginx.sh.old curl ${_crlGet} "${_urlHmr}/tools/system/monitor/check/scan_nginx.sh" -o /var/xdrago/monitor/check/scan_nginx.sh if [ -e "/var/xdrago/monitor/check/scan_nginx.sh" ]; then chmod 700 /var/xdrago/monitor/check/scan_nginx.sh chown root:root /var/xdrago/monitor/check/scan_nginx.sh touch ${_pthLog}/scan_nginx.sh.ctrl.f81.${_tRee}.${_xSrl}.pid if [ ! -e "/var/xdrago/monitor/log/.scan_nginx_arch.${_xSrl}.pid" ]; then if [ -e "/var/xdrago/monitor/scan_nginx.archive.log" ]; then mv -f /var/xdrago/monitor/scan_nginx.archive.log /var/xdrago/monitor/log/.scan_nginx_legacy.archive.f81.${_tRee}.${_xSrl}.log fi if [ -e "/var/xdrago/monitor/log/scan_nginx.archive.log" ]; then mv -f /var/xdrago/monitor/log/scan_nginx.archive.log /var/xdrago/monitor/log/scan_nginx.archive.f81.${_tRee}.${_xSrl}.log fi rm -f /var/xdrago/monitor/log/.scan_nginx_arch*.pid touch /var/xdrago/monitor/log/.scan_nginx_arch.${_xSrl}.pid csf -df wait [ -e "/etc/csf/csfpost.d/synproxy.sh" ] && synproxy_reassert -p "443 80" --no-quic -q &> /dev/null fi if [ ! -e "/var/xdrago/monitor/log/.hackcheck.arch.${_xSrl}.pid" ]; then if [ -e "/var/xdrago/monitor/hackcheck.archive.log" ]; then mv -f /var/xdrago/monitor/hackcheck.archive.log /var/xdrago/monitor/log/.scan_nginx_legacy.archive.f81.${_tRee}.${_xSrl}.log fi if [ -e "/var/xdrago/monitor/log/hackcheck.archive.log" ]; then mv -f /var/xdrago/monitor/log/hackcheck.archive.log /var/xdrago/monitor/log/hackcheck.archive.f81.${_tRee}.${_xSrl}.log fi rm -f /var/xdrago/monitor/log/.hackcheck.arch*.pid touch /var/xdrago/monitor/log/.hackcheck.arch.${_xSrl}.pid csf -df wait [ -e "/etc/csf/csfpost.d/synproxy.sh" ] && synproxy_reassert -p "443 80" --no-quic -q &> /dev/null fi else mv -f /var/xdrago/monitor/check/scan_nginx.sh.old /var/xdrago/monitor/check/scan_nginx.sh fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/java.sh.ctrl.f90.${_tRee}.${_xSrl}.pid" ]; then mv -f /var/xdrago/monitor/check/java.sh /var/xdrago/monitor/check/java.sh.old curl ${_crlGet} "${_urlHmr}/tools/system/monitor/check/java.sh" -o /var/xdrago/monitor/check/java.sh if [ -e "/var/xdrago/monitor/check/java.sh" ]; then chmod 700 /var/xdrago/monitor/check/java.sh chown root:root /var/xdrago/monitor/check/java.sh touch ${_pthLog}/java.sh.ctrl.f90.${_tRee}.${_xSrl}.pid else mv -f /var/xdrago/monitor/check/java.sh.old /var/xdrago/monitor/check/java.sh fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/mysql.sh.ctrl.f82.${_tRee}.${_xSrl}.pid" ]; then mv -f /var/xdrago/monitor/check/mysql.sh /var/xdrago/monitor/check/mysql.sh.old curl ${_crlGet} "${_urlHmr}/tools/system/monitor/check/mysql.sh" -o /var/xdrago/monitor/check/mysql.sh if [ -e "/var/xdrago/monitor/check/mysql.sh" ]; then if [ -e "/root/.debug.cnf" ] && [ ! -e "/root/.default.cnf" ]; then _DO_NOTHING=YES else if [ -e "/root/.high_load.cnf" ] \ && [ ! -e "/root/.big_db.cnf" ] \ && [ ! -e "/root/.tg.cnf" ]; then sed -i "s/3600/300/g" /var/xdrago/monitor/check/mysql.sh elif [ -e "/root/.big_db.cnf" ] || [ -e "/root/.tg.cnf" ]; then _DO_NOTHING=YES else sed -i "s/3600/1800/g" /var/xdrago/monitor/check/mysql.sh fi fi chmod 700 /var/xdrago/monitor/check/mysql.sh chown root:root /var/xdrago/monitor/check/mysql.sh touch ${_pthLog}/mysql.sh.ctrl.f82.${_tRee}.${_xSrl}.pid else mv -f /var/xdrago/monitor/check/mysql.sh.old /var/xdrago/monitor/check/mysql.sh fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/nginx.sh.ctrl.f92.${_tRee}.${_xSrl}.pid" ]; then mv -f /var/xdrago/monitor/check/nginx.sh /var/xdrago/monitor/check/nginx.sh.old curl ${_crlGet} "${_urlHmr}/tools/system/monitor/check/nginx.sh" -o /var/xdrago/monitor/check/nginx.sh if [ -e "/var/xdrago/monitor/check/nginx.sh" ]; then chmod 700 /var/xdrago/monitor/check/nginx.sh chown root:root /var/xdrago/monitor/check/nginx.sh touch ${_pthLog}/nginx.sh.ctrl.f92.${_tRee}.${_xSrl}.pid else mv -f /var/xdrago/monitor/check/nginx.sh.old /var/xdrago/monitor/check/nginx.sh fi fi if [ ! -e "/var/xdrago/monitor/check/nginx_guard.sh" ]; then rm -f ${_pthLog}/nginx_guard.sh.ctrl.* fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/nginx_guard.sh.ctrl.f98.${_tRee}.${_xSrl}.pid" ]; then mv -f /var/xdrago/monitor/check/nginx_guard.sh /var/xdrago/monitor/check/nginx_guard.sh.old curl ${_crlGet} "${_urlHmr}/tools/system/monitor/check/nginx_guard.sh" -o /var/xdrago/monitor/check/nginx_guard.sh if [ -e "/var/xdrago/monitor/check/nginx_guard.sh" ]; then chmod 700 /var/xdrago/monitor/check/nginx_guard.sh chown root:root /var/xdrago/monitor/check/nginx_guard.sh touch ${_pthLog}/nginx_guard.sh.ctrl.f98.${_tRee}.${_xSrl}.pid else mv -f /var/xdrago/monitor/check/nginx_guard.sh.old /var/xdrago/monitor/check/nginx_guard.sh fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/php.sh.ctrl.f85.${_tRee}.${_xSrl}.pid" ]; then mv -f /var/xdrago/monitor/check/php.sh /var/xdrago/monitor/check/php.sh.old curl ${_crlGet} "${_urlHmr}/tools/system/monitor/check/php.sh" -o /var/xdrago/monitor/check/php.sh if [ -e "/var/xdrago/monitor/check/php.sh" ]; then chmod 700 /var/xdrago/monitor/check/php.sh chown root:root /var/xdrago/monitor/check/php.sh touch ${_pthLog}/php.sh.ctrl.f85.${_tRee}.${_xSrl}.pid else mv -f /var/xdrago/monitor/check/php.sh.old /var/xdrago/monitor/check/php.sh fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/valkey.sh.ctrl.f87.${_tRee}.${_xSrl}.pid" ]; then mv -f /var/xdrago/monitor/check/valkey.sh /var/xdrago/monitor/check/valkey.sh.old curl ${_crlGet} "${_urlHmr}/tools/system/monitor/check/valkey.sh" -o /var/xdrago/monitor/check/valkey.sh if [ -e "/var/xdrago/monitor/check/valkey.sh" ]; then chmod 700 /var/xdrago/monitor/check/valkey.sh chown root:root /var/xdrago/monitor/check/valkey.sh touch ${_pthLog}/valkey.sh.ctrl.f87.${_tRee}.${_xSrl}.pid else mv -f /var/xdrago/monitor/check/valkey.sh.old /var/xdrago/monitor/check/valkey.sh fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/redis.sh.ctrl.f90.${_tRee}.${_xSrl}.pid" ]; then mv -f /var/xdrago/monitor/check/redis.sh /var/xdrago/monitor/check/redis.sh.old curl ${_crlGet} "${_urlHmr}/tools/system/monitor/check/redis.sh" -o /var/xdrago/monitor/check/redis.sh if [ -e "/var/xdrago/monitor/check/redis.sh" ]; then chmod 700 /var/xdrago/monitor/check/redis.sh chown root:root /var/xdrago/monitor/check/redis.sh touch ${_pthLog}/redis.sh.ctrl.f90.${_tRee}.${_xSrl}.pid else mv -f /var/xdrago/monitor/check/redis.sh.old /var/xdrago/monitor/check/redis.sh fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/system.sh.ctrl.f83.${_tRee}.${_xSrl}.pid" ]; then mv -f /var/xdrago/monitor/check/system.sh /var/xdrago/monitor/check/system.sh.old curl ${_crlGet} "${_urlHmr}/tools/system/monitor/check/system.sh" -o /var/xdrago/monitor/check/system.sh if [ -e "/var/xdrago/monitor/check/system.sh" ]; then chmod 700 /var/xdrago/monitor/check/system.sh chown root:root /var/xdrago/monitor/check/system.sh touch ${_pthLog}/system.sh.ctrl.f83.${_tRee}.${_xSrl}.pid else mv -f /var/xdrago/monitor/check/system.sh.old /var/xdrago/monitor/check/system.sh fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/unbound.sh.ctrl.f86.${_tRee}.${_xSrl}.pid" ]; then mv -f /var/xdrago/monitor/check/unbound.sh /var/xdrago/monitor/check/unbound.sh.old curl ${_crlGet} "${_urlHmr}/tools/system/monitor/check/unbound.sh" -o /var/xdrago/monitor/check/unbound.sh if [ -e "/var/xdrago/monitor/check/unbound.sh" ]; then chmod 700 /var/xdrago/monitor/check/unbound.sh chown root:root /var/xdrago/monitor/check/unbound.sh touch ${_pthLog}/unbound.sh.ctrl.f86.${_tRee}.${_xSrl}.pid else mv -f /var/xdrago/monitor/check/unbound.sh.old /var/xdrago/monitor/check/unbound.sh fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/escapecheck.sh.ctrl.f99.${_tRee}.${_xSrl}.pid" ]; then mv -f /var/xdrago/monitor/check/escapecheck.sh /var/xdrago/monitor/check/escapecheck.sh.old curl ${_crlGet} "${_urlHmr}/tools/system/monitor/check/escapecheck.sh" -o /var/xdrago/monitor/check/escapecheck.sh if [ -e "/var/xdrago/monitor/check/escapecheck.sh" ]; then chmod 700 /var/xdrago/monitor/check/escapecheck.sh chown root:root /var/xdrago/monitor/check/escapecheck.sh touch ${_pthLog}/escapecheck.sh.ctrl.f99.${_tRee}.${_xSrl}.pid else mv -f /var/xdrago/monitor/check/escapecheck.sh.old /var/xdrago/monitor/check/escapecheck.sh fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/hackcheck.sh.ctrl.f95.${_tRee}.${_xSrl}.pid" ]; then mv -f /var/xdrago/monitor/check/hackcheck.sh /var/xdrago/monitor/check/hackcheck.sh.old curl ${_crlGet} "${_urlHmr}/tools/system/monitor/check/hackcheck.sh" -o /var/xdrago/monitor/check/hackcheck.sh if [ -e "/var/xdrago/monitor/check/hackcheck.sh" ]; then chmod 700 /var/xdrago/monitor/check/hackcheck.sh chown root:root /var/xdrago/monitor/check/hackcheck.sh touch ${_pthLog}/hackcheck.sh.ctrl.f95.${_tRee}.${_xSrl}.pid else mv -f /var/xdrago/monitor/check/hackcheck.sh.old /var/xdrago/monitor/check/hackcheck.sh fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/hackftp.sh.ctrl.f98.${_tRee}.${_xSrl}.pid" ]; then mv -f /var/xdrago/monitor/check/hackftp.sh /var/xdrago/monitor/check/hackftp.sh.old curl ${_crlGet} "${_urlHmr}/tools/system/monitor/check/hackftp.sh" -o /var/xdrago/monitor/check/hackftp.sh if [ -e "/var/xdrago/monitor/check/hackftp.sh" ]; then chmod 700 /var/xdrago/monitor/check/hackftp.sh chown root:root /var/xdrago/monitor/check/hackftp.sh touch ${_pthLog}/hackftp.sh.ctrl.f98.${_tRee}.${_xSrl}.pid else mv -f /var/xdrago/monitor/check/hackftp.sh.old /var/xdrago/monitor/check/hackftp.sh fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/segfault_alert.pl.ctrl.f94.${_tRee}.${_xSrl}.pid" ]; then mv -f /var/xdrago/monitor/check/segfault_alert.pl /var/xdrago/monitor/check/segfault_alert.pl.old curl ${_crlGet} "${_urlHmr}/tools/system/monitor/check/segfault_alert.pl" -o /var/xdrago/monitor/check/segfault_alert.pl if [ -e "/var/xdrago/monitor/check/segfault_alert.pl" ]; then chmod 700 /var/xdrago/monitor/check/segfault_alert.pl chown root:root /var/xdrago/monitor/check/segfault_alert.pl touch ${_pthLog}/segfault_alert.pl.ctrl.f94.${_tRee}.${_xSrl}.pid else mv -f /var/xdrago/monitor/check/segfault_alert.pl.old /var/xdrago/monitor/check/segfault_alert.pl fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/sqlcheck.pl.ctrl.f94.${_tRee}.${_xSrl}.pid" ]; then mv -f /var/xdrago/monitor/check/sqlcheck.pl /var/xdrago/monitor/check/sqlcheck.pl.old curl ${_crlGet} "${_urlHmr}/tools/system/monitor/check/sqlcheck.pl" -o /var/xdrago/monitor/check/sqlcheck.pl if [ -e "/var/xdrago/monitor/check/sqlcheck.pl" ]; then chmod 700 /var/xdrago/monitor/check/sqlcheck.pl chown root:root /var/xdrago/monitor/check/sqlcheck.pl touch ${_pthLog}/sqlcheck.pl.ctrl.f94.${_tRee}.${_xSrl}.pid else mv -f /var/xdrago/monitor/check/sqlcheck.pl.old /var/xdrago/monitor/check/sqlcheck.pl fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ ! -e "${_pthLog}/cv-phar-symlink.ctrl.${_tRee}.${_xSrl}.pid" ]; then if [ -x "/usr/local/bin/cv.phar" ] \ && [ -L "/usr/bin/cv" ]; then _CV_SYMLINK=$(readlink -n /usr/bin/cv 2>&1) _CV_SYMLINK=$(echo -n ${_CV_SYMLINK} | tr -d "\n" 2>&1) if [ "${_CV_SYMLINK}" != "/usr/local/bin/cv.phar" ]; then rm -f /usr/bin/cv ln -sfn /usr/local/bin/cv.phar /usr/bin/cv touch ${_pthLog}/cv-phar-symlink.ctrl.${_tRee}.${_xSrl}.pid fi fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ ! -e "${_pthLog}/drush8-classic-symlink.ctrl.${_tRee}.${_xSrl}.pid" ]; then if [ -x "/opt/tools/drush/8/drush/drush.php" ] \ && [ -L "/usr/bin/drush8" ]; then _DRUSH_SYMLINK=$(readlink -n /usr/bin/drush8 2>&1) _DRUSH_SYMLINK=$(echo -n ${_DRUSH_SYMLINK} | tr -d "\n" 2>&1) if [ "${_DRUSH_SYMLINK}" != "/opt/tools/drush/8/drush/drush.php" ]; then rm -f /usr/bin/drush8 rm -f /usr/bin/drush ln -sfn /opt/tools/drush/8/drush/drush.php /usr/bin/drush8 ln -sfn /opt/tools/drush/8/drush/drush.php /usr/bin/drush touch ${_pthLog}/drush8-classic-symlink.ctrl.${_tRee}.${_xSrl}.pid fi fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/clean-boa-env.ctrl.f97.${_tRee}.${_xSrl}.pid" ]; then mv -f /etc/init.d/clean-boa-env /var/xdrago/clean-boa-env.old curl ${_crlGet} "${_urlHmr}/conf/var/clean-boa-env" -o /etc/init.d/clean-boa-env if [ -e "/etc/init.d/clean-boa-env" ]; then chmod 700 /etc/init.d/clean-boa-env chown root:root /etc/init.d/clean-boa-env touch ${_pthLog}/clean-boa-env.ctrl.f97.${_tRee}.${_xSrl}.pid else mv -f /var/xdrago/clean-boa-env.old /etc/init.d/clean-boa-env fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/mysql_backup.sh.ctrl.f88.${_xSrl}.pid" ]; then _CNT=$(pgrep -fc mysql_backup.sh) if (( _CNT > 0 )); then echo "The mysql_backup.sh is running!" else mv -f /var/xdrago/mysql_backup.sh /var/xdrago/mysql_backup.sh.old curl ${_crlGet} "${_urlHmr}/tools/system/mysql_backup.sh" -o /var/xdrago/mysql_backup.sh if [ -e "/var/xdrago/mysql_backup.sh" ]; then chmod 700 /var/xdrago/mysql_backup.sh chown root:root /var/xdrago/mysql_backup.sh touch ${_pthLog}/mysql_backup.sh.ctrl.f88.${_xSrl}.pid else mv -f /var/xdrago/mysql_backup.sh.old /var/xdrago/mysql_backup.sh fi fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/unbound-helper.ctrl.f95.${_xSrl}.pid" ]; then mv -f /usr/libexec/unbound-helper /usr/libexec/unbound-helper.old curl ${_crlGet} "${_urlHmr}/conf/dns/unbound-helper" -o /usr/libexec/unbound-helper if [ -e "/usr/libexec/unbound-helper" ]; then chmod 755 /usr/libexec/unbound-helper chown root:root /usr/libexec/unbound-helper touch ${_pthLog}/unbound-helper.ctrl.f95.${_xSrl}.pid else mv -f /usr/libexec/unbound-helper.old /usr/libexec/unbound-helper fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/mysql_cleanup.sh.ctrl.f92.${_xSrl}.pid" ]; then mv -f /var/xdrago/mysql_cleanup.sh /var/xdrago/mysql_cleanup.sh.old curl ${_crlGet} "${_urlHmr}/tools/system/mysql_cleanup.sh" -o /var/xdrago/mysql_cleanup.sh if [ -e "/var/xdrago/mysql_cleanup.sh" ]; then chmod 700 /var/xdrago/mysql_cleanup.sh chown root:root /var/xdrago/mysql_cleanup.sh touch ${_pthLog}/mysql_cleanup.sh.ctrl.f92.${_xSrl}.pid else mv -f /var/xdrago/mysql_cleanup.sh.old /var/xdrago/mysql_cleanup.sh fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/mysql_cluster_backup.sh.ctrl.f91.${_tRee}.${_xSrl}.pid" ]; then _CNT=$(pgrep -fc mysql_cluster_backup.sh) if (( _CNT > 0 )); then echo "The mysql_cluster_backup.sh is running!" else mv -f /var/xdrago/mysql_cluster_backup.sh /var/xdrago/mysql_cluster_backup.sh.old curl ${_crlGet} "${_urlHmr}/tools/system/mysql_cluster_backup.sh" -o /var/xdrago/mysql_cluster_backup.sh if [ -e "/var/xdrago/mysql_cluster_backup.sh" ]; then chmod 700 /var/xdrago/mysql_cluster_backup.sh chown root:root /var/xdrago/mysql_cluster_backup.sh touch ${_pthLog}/mysql_cluster_backup.sh.ctrl.f91.${_tRee}.${_xSrl}.pid else mv -f /var/xdrago/mysql_cluster_backup.sh.old /var/xdrago/mysql_cluster_backup.sh fi fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/runner.sh.ctrl.f86.${_tRee}.${_xSrl}.pid" ]; then mv -f /var/xdrago/runner.sh /var/xdrago/runner.sh.old curl ${_crlGet} "${_urlHmr}/tools/system/runner.sh" -o /var/xdrago/runner.sh if [ -e "/var/xdrago/runner.sh" ]; then chmod 700 /var/xdrago/runner.sh chown root:root /var/xdrago/runner.sh touch ${_pthLog}/runner.sh.ctrl.f86.${_tRee}.${_xSrl}.pid else mv -f /var/xdrago/runner.sh.old /var/xdrago/runner.sh fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/minute.sh.ctrl.f91.${_tRee}.${_xSrl}.pid" ]; then mv -f /var/xdrago/minute.sh /var/xdrago/minute.sh.old curl ${_crlGet} "${_urlHmr}/tools/system/minute.sh" -o /var/xdrago/minute.sh if [ -e "/var/xdrago/minute.sh" ]; then chmod 700 /var/xdrago/minute.sh chown root:root /var/xdrago/minute.sh touch ${_pthLog}/minute.sh.ctrl.f91.${_tRee}.${_xSrl}.pid else mv -f /var/xdrago/minute.sh.old /var/xdrago/minute.sh fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/second.sh.ctrl.f88.${_tRee}.${_xSrl}.pid" ]; then mv -f /var/xdrago/second.sh /var/xdrago/second.sh.old curl ${_crlGet} "${_urlHmr}/tools/system/second.sh" -o /var/xdrago/second.sh if [ -e "/var/xdrago/second.sh" ]; then chmod 700 /var/xdrago/second.sh chown root:root /var/xdrago/second.sh touch ${_pthLog}/second.sh.ctrl.f88.${_tRee}.${_xSrl}.pid else mv -f /var/xdrago/second.sh.old /var/xdrago/second.sh fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/ip_access.sh.ctrl.f93.${_tRee}.${_xSrl}.pid" ]; then mv -f /var/xdrago/ip_access.sh /var/xdrago/ip_access.sh.old curl ${_crlGet} "${_urlHmr}/tools/system/ip_access.sh" -o /var/xdrago/ip_access.sh if [ -e "/var/xdrago/ip_access.sh" ]; then chmod 700 /var/xdrago/ip_access.sh chown root:root /var/xdrago/ip_access.sh touch ${_pthLog}/ip_access.sh.ctrl.f93.${_tRee}.${_xSrl}.pid else mv -f /var/xdrago/ip_access.sh.old /var/xdrago/ip_access.sh fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/move_sql.sh.ctrl.f90.${_tRee}.${_xSrl}.pid" ]; then mv -f /var/xdrago/move_sql.sh /var/xdrago/move_sql.sh.old curl ${_crlGet} "${_urlHmr}/tools/system/move_sql.sh" -o /var/xdrago/move_sql.sh if [ -e "/var/xdrago/move_sql.sh" ]; then chmod 700 /var/xdrago/move_sql.sh chown root:root /var/xdrago/move_sql.sh touch ${_pthLog}/move_sql.sh.ctrl.f90.${_tRee}.${_xSrl}.pid else mv -f /var/xdrago/move_sql.sh.old /var/xdrago/move_sql.sh fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/mysql_repair.sh.ctrl.f95.${_tRee}.${_xSrl}.pid" ]; then mv -f /var/xdrago/mysql_repair.sh /var/xdrago/mysql_repair.sh.old curl ${_crlGet} "${_urlHmr}/tools/system/mysql_repair.sh" -o /var/xdrago/mysql_repair.sh if [ -e "/var/xdrago/mysql_repair.sh" ]; then chmod 700 /var/xdrago/mysql_repair.sh chown root:root /var/xdrago/mysql_repair.sh touch ${_pthLog}/mysql_repair.sh.ctrl.f95.${_tRee}.${_xSrl}.pid else mv -f /var/xdrago/mysql_repair.sh.old /var/xdrago/mysql_repair.sh fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/purge_binlogs.sh.ctrl.f93.${_tRee}.${_xSrl}.pid" ]; then mv -f /var/xdrago/purge_binlogs.sh /var/xdrago/purge_binlogs.sh.old curl ${_crlGet} "${_urlHmr}/tools/system/purge_binlogs.sh" -o /var/xdrago/purge_binlogs.sh if [ -e "/var/xdrago/purge_binlogs.sh" ]; then chmod 700 /var/xdrago/purge_binlogs.sh chown root:root /var/xdrago/purge_binlogs.sh touch ${_pthLog}/purge_binlogs.sh.ctrl.f93.${_tRee}.${_xSrl}.pid else mv -f /var/xdrago/purge_binlogs.sh.old /var/xdrago/purge_binlogs.sh fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/checksql.pl.ctrl.f95.${_tRee}.${_xSrl}.pid" ]; then mv -f /var/xdrago/checksql.pl /var/xdrago/checksql.pl.old curl ${_crlGet} "${_urlHmr}/tools/system/checksql.pl" -o /var/xdrago/checksql.pl if [ -e "/var/xdrago/checksql.pl" ]; then chmod 700 /var/xdrago/checksql.pl chown root:root /var/xdrago/checksql.pl touch ${_pthLog}/checksql.pl.ctrl.f95.${_tRee}.${_xSrl}.pid else mv -f /var/xdrago/checksql.pl.old /var/xdrago/checksql.pl fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/clear.sh.ctrl.f85.${_tRee}.${_xSrl}.pid" ]; then mv -f /var/xdrago/clear.sh /var/xdrago/clear.sh.old curl ${_crlGet} "${_urlHmr}/tools/system/clear.sh" -o /var/xdrago/clear.sh if [ -e "/var/xdrago/clear.sh" ]; then chmod 700 /var/xdrago/clear.sh chown root:root /var/xdrago/clear.sh touch ${_pthLog}/clear.sh.ctrl.f85.${_tRee}.${_xSrl}.pid else mv -f /var/xdrago/clear.sh.old /var/xdrago/clear.sh fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -d "/var/aegir/drush" ] \ && [ ! -e "${_pthLog}/autoupboa.ctrl.f76.${_tRee}.${_xSrl}.pid" ]; then _CNT=$(pgrep -fc autoupboa) if (( _CNT > 0 )); then echo "The autoupboa is running!" else if [ -e "${_optBin}/autoupboa" ]; then mv -f ${_optBin}/autoupboa ${_optBin}/autoupboa.old fi curl ${_crlGet} "${_urlHmr}/tools/bin/autoupboa" -o ${_optBin}/autoupboa if [ -e "${_optBin}/autoupboa" ]; then chmod 700 ${_optBin}/autoupboa chown root:root ${_optBin}/autoupboa touch ${_pthLog}/autoupboa.ctrl.f76.${_tRee}.${_xSrl}.pid else if [ -e "${_optBin}/autoupboa.old" ]; then mv -f ${_optBin}/autoupboa.old ${_optBin}/autoupboa fi fi fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -d "/var/aegir/drush" ] \ && [ ! -e "${_pthLog}/fixmounts.ctrl.f98.${_tRee}.${_xSrl}.pid" ]; then _CNT=$(pgrep -fc fixmounts) if (( _CNT > 0 )); then echo "The fixmounts is running!" else if [ -e "${_optBin}/fixmounts" ]; then mv -f ${_optBin}/fixmounts ${_optBin}/fixmounts.old fi curl ${_crlGet} "${_urlHmr}/tools/bin/fixmounts" -o ${_optBin}/fixmounts if [ -e "${_optBin}/fixmounts" ]; then chmod 700 ${_optBin}/fixmounts chown root:root ${_optBin}/fixmounts touch ${_pthLog}/fixmounts.ctrl.f98.${_tRee}.${_xSrl}.pid else if [ -e "${_optBin}/fixmounts.old" ]; then mv -f ${_optBin}/fixmounts.old ${_optBin}/fixmounts fi fi fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/daily.sh.ctrl.f73.${_tRee}.${_xSrl}.pid" ]; then mv -f /var/xdrago/daily.sh /var/xdrago/daily.sh.old curl ${_crlGet} "${_urlHmr}/tools/system/daily.sh" -o /var/xdrago/daily.sh if [ -e "/var/xdrago/daily.sh" ]; then chmod 700 /var/xdrago/daily.sh chown root:root /var/xdrago/daily.sh touch ${_pthLog}/daily.sh.ctrl.f73.${_tRee}.${_xSrl}.pid else mv -f /var/xdrago/daily.sh.old /var/xdrago/daily.sh fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/graceful.sh.ctrl.f86.${_tRee}.${_xSrl}.pid" ]; then mv -f /var/xdrago/graceful.sh /var/xdrago/graceful.sh.old curl ${_crlGet} "${_urlHmr}/tools/system/graceful.sh" -o /var/xdrago/graceful.sh if [ -e "/var/xdrago/graceful.sh" ]; then chmod 700 /var/xdrago/graceful.sh chown root:root /var/xdrago/graceful.sh touch ${_pthLog}/graceful.sh.ctrl.f86.${_tRee}.${_xSrl}.pid else mv -f /var/xdrago/graceful.sh.old /var/xdrago/graceful.sh fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/usage.sh.ctrl.f80.${_tRee}.${_xSrl}.pid" ]; then mv -f /var/xdrago/usage.sh /var/xdrago/usage.sh.old curl ${_crlGet} "${_urlHmr}/tools/system/usage.sh" -o /var/xdrago/usage.sh if [ -e "/var/xdrago/usage.sh" ]; then chmod 700 /var/xdrago/usage.sh chown root:root /var/xdrago/usage.sh touch ${_pthLog}/usage.sh.ctrl.f80.${_tRee}.${_xSrl}.pid else mv -f /var/xdrago/usage.sh.old /var/xdrago/usage.sh fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/manage_ltd_users.sh.ctrl.f67.${_tRee}.${_xSrl}.pid" ]; then mv -f /var/xdrago/manage_ltd_users.sh /var/xdrago/manage_ltd_users.sh.old curl ${_crlGet} "${_urlHmr}/tools/system/manage_ltd_users.sh" \ -o /var/xdrago/manage_ltd_users.sh if [ -e "/var/xdrago/manage_ltd_users.sh" ]; then chmod 700 /var/xdrago/manage_ltd_users.sh chown root:root /var/xdrago/manage_ltd_users.sh touch ${_pthLog}/manage_ltd_users.sh.ctrl.f67.${_tRee}.${_xSrl}.pid [ -e "/run/manage_ltd_users.pid" ] && rm -f /run/manage_ltd_users.pid [ -d "/var/backups/ltd/log" ] && rm -rf /var/backups/ltd/log mkdir -p /var/backups/ltd/{conf,log,old} else mv -f /var/xdrago/manage_ltd_users.sh.old /var/xdrago/manage_ltd_users.sh fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/manage_solr_config.sh.ctrl.f85.${_tRee}.${_xSrl}.pid" ]; then mv -f /var/xdrago/manage_solr_config.sh /var/xdrago/manage_solr_config.sh.old curl ${_crlGet} "${_urlHmr}/tools/system/manage_solr_config.sh" \ -o /var/xdrago/manage_solr_config.sh if [ -e "/var/xdrago/manage_solr_config.sh" ]; then chmod 700 /var/xdrago/manage_solr_config.sh chown root:root /var/xdrago/manage_solr_config.sh touch ${_pthLog}/manage_solr_config.sh.ctrl.f85.${_tRee}.${_xSrl}.pid rm -f /run/manage_solr_config.pid else mv -f /var/xdrago/manage_solr_config.sh.old /var/xdrago/manage_solr_config.sh fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/proc_num_ctrl.pl.ctrl.f83.${_tRee}.${_xSrl}.pid" ]; then mv -f /var/xdrago/proc_num_ctrl.pl /var/xdrago/proc_num_ctrl.pl.old curl ${_crlGet} "${_urlHmr}/tools/system/proc_num_ctrl.pl" \ -o /var/xdrago/proc_num_ctrl.pl if [ -e "/var/xdrago/proc_num_ctrl.pl" ]; then chmod 700 /var/xdrago/proc_num_ctrl.pl chown root:root /var/xdrago/proc_num_ctrl.pl touch ${_pthLog}/proc_num_ctrl.pl.ctrl.f83.${_tRee}.${_xSrl}.pid else mv -f /var/xdrago/proc_num_ctrl.pl.old /var/xdrago/proc_num_ctrl.pl fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/fast_shutdown.ctrl.${_tRee}.${_xSrl}.pid" ]; then sed -i "s/.*opcache.fast_shutdown.*//g" /opt/etc/fpm/fpm-pool-commo*.conf _PHP_V="85 84 83 82 81 80 74 73 72 71 70 56" for e in ${_PHP_V}; do if [ -e "/etc/init.d/php${e}-fpm" ] && [ -e "/opt/php${e}/bin/php" ]; then service "php${e}-fpm" reload &> /dev/null fi done _PHP_V="55 54 53" for e in ${_PHP_V}; do if [ -e "/etc/init.d/php${e}-fpm" ] && [ -e "/opt/php${e}/bin/php" ]; then service "php${e}-fpm" force-quit &> /dev/null fi done touch ${_pthLog}/fast_shutdown.ctrl.${_tRee}.${_xSrl}.pid fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ -x "/usr/sbin/csf" ] \ && [ -e "/etc/csf/csf.deny" ] \ && [ ! -e "${_pthLog}/guest-fire.sh.ctrl.f92.${_tRee}.${_xSrl}.pid" ]; then mv -f /var/xdrago/guest-fire.sh /var/xdrago/guest-fire.sh.old curl ${_crlGet} "${_urlHmr}/tools/system/guest-fire.sh" \ -o /var/xdrago/guest-fire.sh if [ -e "/var/xdrago/guest-fire.sh" ]; then chmod 700 /var/xdrago/guest-fire.sh chown root:root /var/xdrago/guest-fire.sh touch ${_pthLog}/guest-fire.sh.ctrl.f92.${_tRee}.${_xSrl}.pid else mv -f /var/xdrago/guest-fire.sh.old /var/xdrago/guest-fire.sh fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/xdrago" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ -x "/usr/sbin/csf" ] \ && [ -e "/etc/csf/csf.deny" ] \ && [ ! -e "${_pthLog}/guest-water.sh.ctrl.f89.${_tRee}.${_xSrl}.pid" ]; then mv -f /var/xdrago/guest-water.sh /var/xdrago/guest-water.sh.old curl ${_crlGet} "${_urlHmr}/tools/system/guest-water.sh" \ -o /var/xdrago/guest-water.sh if [ -e "/var/xdrago/guest-water.sh" ]; then chmod 700 /var/xdrago/guest-water.sh chown root:root /var/xdrago/guest-water.sh touch ${_pthLog}/guest-water.sh.ctrl.f89.${_tRee}.${_xSrl}.pid else mv -f /var/xdrago/guest-water.sh.old /var/xdrago/guest-water.sh fi fi if ! grep -q "whoami" /var/xdrago/conf/lshell.conf; then rm -f ${_pthLog}/lshell.ctrl.* fi if [ -x "/opt/tools/drush/8/drush/drush.php" ] \ && [ -e "/var/xdrago" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/lshell.ctrl.f91.${_tRee}.${_xSrl}.pid" ]; then if [ -z "${_CUSTOM_CONFIG_LSHELL}" ] \ || [ "${_CUSTOM_CONFIG_LSHELL}" = "NO" ]; then mv -f /var/xdrago/conf/lshell.conf /var/xdrago/conf/lshell.conf.old curl ${_crlGet} "${_urlHmr}/tools/system/conf/lshell.conf" \ -o /var/xdrago/conf/lshell.conf if [ -e "/var/xdrago/conf/lshell.conf" ]; then chmod 644 /var/xdrago/conf/lshell.conf chown root:root /var/xdrago/conf/lshell.conf touch ${_pthLog}/lshell.ctrl.f91.${_tRee}.${_xSrl}.pid else mv -f /var/xdrago/conf/lshell.conf.old /var/xdrago/conf/lshell.conf fi fi fi if [ -x "/opt/tools/drush/8/drush/drush.php" ] \ && [ -e "/var/xdrago" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ]; then _BROKEN_UPDATE_TEST=$(grep "Under Construction" /var/xdrago/conf/fpm-pool* 2>&1) if [ ! -z "${_BROKEN_UPDATE_TEST}" ]; then rm -f /var/xdrago/conf/fpm-pool* rm ${_pthLog}/multi.ctrl.* rm ${_pthLog}/legacy.ctrl.* rm ${_pthLog}/modern.ctrl.* rm ${_pthLog}/single.ctrl.* rm ${_pthLog}/common.ctrl.* fi _BROKEN_UPDATE_TEST=$(grep "404 Not Found" /var/xdrago/conf/fpm-pool* 2>&1) if [ ! -z "${_BROKEN_UPDATE_TEST}" ]; then rm -f /var/xdrago/conf/fpm-pool* rm ${_pthLog}/multi.ctrl.* rm ${_pthLog}/legacy.ctrl.* rm ${_pthLog}/modern.ctrl.* rm ${_pthLog}/single.ctrl.* rm ${_pthLog}/common.ctrl.* fi _BROKEN_UPDATE_TEST=$(grep "max_execution_time" /var/xdrago/conf/fpm-pool* 2>&1) if [ -z "${_BROKEN_UPDATE_TEST}" ]; then rm -f /var/xdrago/conf/fpm-pool* rm ${_pthLog}/multi.ctrl.* rm ${_pthLog}/legacy.ctrl.* rm ${_pthLog}/modern.ctrl.* rm ${_pthLog}/single.ctrl.* rm ${_pthLog}/common.ctrl.* fi _BROKEN_UPDATE_TEST=$(grep "max_accelerated_files" /var/xdrago/conf/fpm-pool* 2>&1) if [ ! -z "${_BROKEN_UPDATE_TEST}" ]; then rm -f /var/xdrago/conf/fpm-pool* rm ${_pthLog}/multi.ctrl.* rm ${_pthLog}/legacy.ctrl.* rm ${_pthLog}/modern.ctrl.* rm ${_pthLog}/single.ctrl.* rm ${_pthLog}/common.ctrl.* fi fi if [ -x "/opt/tools/drush/8/drush/drush.php" ] \ && [ -e "/var/xdrago" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/common.ctrl.${_tRee}.${_xSrl}.pid" ]; then mv -f /var/xdrago/conf/fpm-pool-common.conf /var/xdrago/conf/fpm-pool-common.conf.old curl ${_crlGet} "${_urlHmr}/conf/php/fpm-pool-common.conf" \ -o /var/xdrago/conf/fpm-pool-common.conf if [ -e "/var/xdrago/conf/fpm-pool-common.conf" ]; then sed -i "s/127.0.0.1/127.0.0.1,${_LOC_IP}/g" /var/xdrago/conf/fpm-pool-common.conf chmod 644 /var/xdrago/conf/fpm-pool-common.conf chown root:root /var/xdrago/conf/fpm-pool-common.conf touch ${_pthLog}/common.ctrl.${_tRee}.${_xSrl}.pid else mv -f /var/xdrago/conf/fpm-pool-common.conf.old /var/xdrago/conf/fpm-pool-common.conf fi fi if [ -x "/opt/tools/drush/8/drush/drush.php" ] \ && [ -e "/var/xdrago" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/legacy.ctrl.${_tRee}.${_xSrl}.pid" ]; then mv -f /var/xdrago/conf/fpm-pool-common-legacy.conf /var/xdrago/conf/fpm-pool-common-legacy.conf.old curl ${_crlGet} "${_urlHmr}/conf/php/fpm-pool-common-legacy.conf" \ -o /var/xdrago/conf/fpm-pool-common-legacy.conf if [ -e "/var/xdrago/conf/fpm-pool-common-legacy.conf" ]; then sed -i "s/127.0.0.1/127.0.0.1,${_LOC_IP}/g" /var/xdrago/conf/fpm-pool-common-legacy.conf chmod 644 /var/xdrago/conf/fpm-pool-common-legacy.conf chown root:root /var/xdrago/conf/fpm-pool-common-legacy.conf touch ${_pthLog}/legacy.ctrl.${_tRee}.${_xSrl}.pid else mv -f /var/xdrago/conf/fpm-pool-common-legacy.conf.old /var/xdrago/conf/fpm-pool-common-legacy.conf fi fi if [ -x "/opt/tools/drush/8/drush/drush.php" ] \ && [ -e "/var/xdrago" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/modern.ctrl.${_tRee}.${_xSrl}.pid" ]; then mv -f /var/xdrago/conf/fpm-pool-common-modern.conf /var/xdrago/conf/fpm-pool-common-modern.conf.old curl ${_crlGet} "${_urlHmr}/conf/php/fpm-pool-common-modern.conf" \ -o /var/xdrago/conf/fpm-pool-common-modern.conf if [ -e "/var/xdrago/conf/fpm-pool-common-modern.conf" ]; then sed -i "s/127.0.0.1/127.0.0.1,${_LOC_IP}/g" /var/xdrago/conf/fpm-pool-common-modern.conf chmod 644 /var/xdrago/conf/fpm-pool-common-modern.conf chown root:root /var/xdrago/conf/fpm-pool-common-modern.conf touch ${_pthLog}/modern.ctrl.${_tRee}.${_xSrl}.pid else mv -f /var/xdrago/conf/fpm-pool-common-modern.conf.old /var/xdrago/conf/fpm-pool-common-modern.conf fi fi if [ -x "/opt/tools/drush/8/drush/drush.php" ] \ && [ -e "/var/xdrago" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/multi.ctrl.${_tRee}.${_xSrl}.pid" ]; then mv -f /var/xdrago/conf/fpm-pool-foo-multi.conf /var/xdrago/conf/fpm-pool-foo-multi.conf.old curl ${_crlGet} "${_urlHmr}/conf/php/fpm-pool-foo-multi.conf" \ -o /var/xdrago/conf/fpm-pool-foo-multi.conf if [ -e "/var/xdrago/conf/fpm-pool-foo-multi.conf" ]; then chmod 644 /var/xdrago/conf/fpm-pool-foo-multi.conf chown root:root /var/xdrago/conf/fpm-pool-foo-multi.conf touch ${_pthLog}/multi.ctrl.${_tRee}.${_xSrl}.pid else mv -f /var/xdrago/conf/fpm-pool-foo-multi.conf.old /var/xdrago/conf/fpm-pool-foo-multi.conf fi fi if [ -e "/opt/tools/drush" ] \ && [ -e "/var/xdrago" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/single.ctrl.${_tRee}.${_xSrl}.pid" ]; then mv -f /var/xdrago/conf/fpm-pool-foo.conf /var/xdrago/conf/fpm-pool-foo.conf.old curl ${_crlGet} "${_urlHmr}/conf/php/fpm-pool-foo.conf" \ -o /var/xdrago/conf/fpm-pool-foo.conf if [ -e "/var/xdrago/conf/fpm-pool-foo.conf" ]; then chmod 644 /var/xdrago/conf/fpm-pool-foo.conf chown root:root /var/xdrago/conf/fpm-pool-foo.conf touch ${_pthLog}/single.ctrl.${_tRee}.${_xSrl}.pid else mv -f /var/xdrago/conf/fpm-pool-foo.conf.old /var/xdrago/conf/fpm-pool-foo.conf fi fi if [ -e "/etc/ImageMagick-6/policy.xml" ] \ && [ -e "/var/xdrago" ] \ && [ ! -e "${_pthLog}/policymap-hf-06.ctrl.${_tRee}.${_xSrl}.pid" ]; then _isCurlBin="$(which curl)" chmod 755 ${_isCurlBin} &> /dev/null chgrp root ${_isCurlBin} &> /dev/null cp -af /etc/ImageMagick-6/policy.xml /var/xdrago/conf/etc-ImageMagick-6-policy.xml.hf-06.old rm -f /var/xdrago/conf/etc-ImageMagick-6-policy.xml curl ${_crlGet} "${_urlHmr}/conf/etc/etc-ImageMagick-6-policy.xml" \ -o /var/xdrago/conf/etc-ImageMagick-6-policy.xml if [ -e "/var/xdrago/conf/etc-ImageMagick-6-policy.xml" ]; then cp -af /var/xdrago/conf/etc-ImageMagick-6-policy.xml /etc/ImageMagick-6/policy.xml chmod 644 /etc/ImageMagick-6/policy.xml chown root:root /etc/ImageMagick-6/policy.xml touch ${_pthLog}/policymap-hf-06.ctrl.${_tRee}.${_xSrl}.pid _PHP_V="85 84 83 82 81 80 74 73 72 71 70 56" for e in ${_PHP_V}; do if [ -e "/etc/init.d/php${e}-fpm" ]; then service "php${e}-fpm" reload &> /dev/null fi done else if [ -e "/var/xdrago/conf/etc-ImageMagick-6-policy.xml.hf-06.old" ]; then cp -af /var/xdrago/conf/etc-ImageMagick-6-policy.xml.hf-06.old /etc/ImageMagick-6/policy.xml fi fi fi if [ -e "/opt/tools/drush" ] \ && [ -e "/var/xdrago" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ -d "/data/u" ] \ && [ ! -e "${_pthLog}/dispatch.ctrl.${_tRee}.${_xSrl}.pid" ]; then sed -i "s/.*cache.*//g; s/.*cc drush.*//g; s/ *$//g; /^$/d" /data/disk/*/aegir.sh touch ${_pthLog}/dispatch.ctrl.${_tRee}.${_xSrl}.pid fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/xdrago/conf/control-readme.txt" ] \ && [ ! -e "${_pthLog}/control-readme.txt.ctrl.${_tRee}.${_xSrl}.pid" ]; then mv -f /var/xdrago/conf/control-readme.txt /var/xdrago/conf/control-readme.txt.old curl ${_crlGet} "${_urlHmr}/tools/system/conf/control-readme.txt" -o /var/xdrago/conf/control-readme.txt if [ -e "/var/xdrago/conf/control-readme.txt" ]; then chmod 644 /var/xdrago/conf/control-readme.txt chown root:root /var/xdrago/conf/control-readme.txt touch ${_pthLog}/control-readme.txt.ctrl.${_tRee}.${_xSrl}.pid else mv -f /var/xdrago/conf/control-readme.txt.old /var/xdrago/conf/control-readme.txt fi fi if [ -d "/data/u" ] \ && [ ! -e "${_pthLog}/hosting.cron.queue.ctrl.f96.${_tRee}.${_xSrl}.pid" ]; then _hQueueF="hosting_cron.module" _hQueueP="/var/xdrago/conf/${_hQueueF}" [ -e "${_hQueueP}" ] && _isPatchedTpl=$(grep "url_own" "${_hQueueP}") if [ ! -e "${_hQueueP}" ] || [[ ! "${_isPatchedTpl}" =~ "url_own" ]]; then curl ${_crlGet} "${_urlHmr}/patches/${_hQueueF}" -o ${_hQueueP} fi for _pthSysUsr in `find /data/disk/ -maxdepth 1 -mindepth 1 | sort`; do _tUsr= _tUsr=$(echo ${_pthSysUsr} | cut -d'/' -f4 | awk '{ print $1}' 2>&1) if [ -n "${_tUsr}" ] && [ "${_tUsr}" != "arch" ]; then if [ -e "${_pthSysUsr}/log/hosting_cron_use_backend.txt" ]; then rm -f ${_pthSysUsr}/log/hosting_cron_use_backend.txt fi _hmPlr=$(cat ${_pthSysUsr}/.drush/hostmaster.alias.drushrc.php \ | grep "root'" \ | cut -d: -f2 \ | awk '{ print $3}' \ | sed "s/[\,']//g" 2>&1) _hmDir="${_hmPlr}/profiles/hostmaster/modules/aegir/hosting" _hmQmd="${_hmDir}/cron/hosting_cron.module" if [ -e "${_hmDir}/cron/hosting_cron.module.orig" ]; then rm -f ${_hmDir}/cron/hosting_cron.module.orig fi if [ -e "${_hmDir}/cron/hosting_cron.module.rej" ]; then rm -f ${_hmDir}/cron/hosting_cron.module.rej fi if [ -e "${_hmQmd}" ] && [ -e "${_hQueueP}" ]; then _isPatched=$(grep "url_own" "${_hmQmd}") if [[ ! "${_isPatched}" =~ "url_own" ]]; then cp -a ${_hQueueP} ${_hmDir}/cron/ if [ -e "${_hmDir}/cron/${_hQueueF}" ]; then sed -i "s/127.0.0.1/${_LOC_IP}/g" "${_hmDir}/cron/${_hQueueF}" fi fi fi fi done touch ${_pthLog}/hosting.cron.queue.ctrl.f96.${_tRee}.${_xSrl}.pid fi if [ -d "/data/u" ] \ && [ ! -e "${_pthLog}/hosting.cron.ctrl.f99.${_tRee}.${_xSrl}.pid" ]; then for _pthSysUsr in `find /data/disk/ -maxdepth 1 -mindepth 1 | sort`; do _tUsr= _tUsr=$(echo ${_pthSysUsr} | cut -d'/' -f4 | awk '{ print $1}' 2>&1) if [ -n "${_tUsr}" ] && [ "${_tUsr}" != "arch" ]; then if [ -e "${_pthSysUsr}/log/hosting_cron_use_backend.txt" ]; then rm -f ${_pthSysUsr}/log/hosting_cron_use_backend.txt fi fi done touch ${_pthLog}/hosting.cron.ctrl.f99.${_tRee}.${_xSrl}.pid fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -d "/data/u" ] \ && [ -e "/usr/sbin/csf" ] \ && [ ! -e "${_pthLog}/fpm-cli.ctrl.${_tRee}.${_xSrl}.pid" ]; then _usrGroup=users [ -d "/var/backups/off-run/" ] && cp -a /var/backups/off-run/run* /var/xdrago/ &> /dev/null for _pthSysUsr in `find /data/disk/ -maxdepth 1 -mindepth 1 | sort`; do _tUsr= _tUsr=$(echo ${_pthSysUsr} | cut -d'/' -f4 | awk '{ print $1}' 2>&1) if [ "${_tUsr}" != "arch" ]; then if [ ! -e "${_pthSysUsr}/static/control/MyQuick.info" ] \ && [ ! -e "${_pthSysUsr}/static/control/MyClassic.info" ]; then echo ON > ${_pthSysUsr}/static/control/MyQuick.info fi if [ ! -e "${_pthSysUsr}/static/control/.disFastTrack.pid" ]; then rm -f ${_pthSysUsr}/static/control/FastTrack.info touch ${_pthSysUsr}/static/control/.disFastTrack.pid fi if [ ! -e "${_pthSysUsr}/static/control/FastTrack.info" ] \ && [ ! -e "${_pthSysUsr}/static/control/ClassicTrack.info" ]; then echo ON > ${_pthSysUsr}/static/control/ClassicTrack.info fi if [ -e "${_pthSysUsr}/static/control/fpm.info" ] \ && [ ! -e "${_pthSysUsr}/static/control/cli.info" ]; then cp ${_pthSysUsr}/static/control/fpm.info ${_pthSysUsr}/static/control/cli.info fi if [ -e "${_pthSysUsr}/log/CANCELLED" ] \ || [ -e "${_pthSysUsr}/log/proxied.pid" ] \ || [ ! -e "${_pthSysUsr}/static/control/cli.info" ]; then if [ -e "/var/xdrago/run-${_tUsr}" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ]; then [ -d "/var/backups/off-run" ] || mkdir -p /var/backups/off-run mv -f /var/xdrago/run-${_tUsr} /var/backups/off-run/ fi else _dscUsr="/data/disk/${_tUsr}" _ngxCnf="${_dscUsr}/config/includes/nginx_vhost_common.conf" _NGINX_CNF_TEST=$(grep "foobaroff" ${_ngxCnf} 2>&1) if [[ "${_NGINX_CNF_TEST}" =~ "foobaroff" ]]; then _DO_NOTHING=YES else sed -i "s/args.*q=/args ~* \"foobaroff=/g" ${_ngxCnf} fi for _version in 84 85 83 82 81 74 56; do if [ -x "/opt/php${_version}/bin/php" ]; then if [ "${_version}" = "74" ]; then _useCli="7.4" _useFpm="7.4" elif [ "${_version}" = "56" ]; then _useCli="5.6" _useFpm="5.6" else _useCli="8.${_version:1}" _useFpm="8.${_version:1}" fi break fi done if [ ! -e "${_dscUsr}/static/control/fpm.info" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ]; then if [ -n "${_useFpm}" ]; then echo ${_useFpm} > ${_dscUsr}/static/control/fpm.info chown ${_tUsr}.ftp:${_usrGroup} ${_dscUsr}/static/control/fpm.info chmod 0644 ${_dscUsr}/static/control/fpm.info fi fi if [ ! -e "${_dscUsr}/static/control/cli.info" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ]; then if [ -e "${_dscUsr}/static/control/fpm.info" ]; then cp -af ${_dscUsr}/static/control/fpm.info ${_dscUsr}/static/control/cli.info else if [ -n "${_useCli}" ]; then echo ${_useCli} > ${_dscUsr}/static/control/cli.info chown ${_tUsr}.ftp:${_usrGroup} ${_dscUsr}/static/control/cli.info chmod 0644 ${_dscUsr}/static/control/cli.info fi fi fi if [ ! -e "${_dscUsr}/static/control/.ctrl.${_tRee}.${_xSrl}.pid" ] \ && [ -e "/home/${_tUsr}.ftp/clients" ]; then mkdir -p ${_dscUsr}/static/control chmod 755 ${_dscUsr}/static/control if [ -e "/var/xdrago/conf/control-readme.txt" ]; then cp -af /var/xdrago/conf/control-readme.txt \ ${_dscUsr}/static/control/README.txt &> /dev/null chmod 0644 ${_dscUsr}/static/control/README.txt fi chown -R ${_tUsr}.ftp:${_usrGroup} ${_dscUsr}/static/control rm -f ${_dscUsr}/static/control/.ctrl.* echo OK > ${_dscUsr}/static/control/.ctrl.${_tRee}.${_xSrl}.pid fi fi fi done touch ${_pthLog}/fpm-cli.ctrl.${_tRee}.${_xSrl}.pid fi # Create the destination directory if it doesn't exist [ -d "/var/backups/off-run" ] || mkdir -p /var/backups/off-run if [ -e "/var/xdrago/monitor/check" ] \ && [ -d "/data/u" ] \ && [ -e "/usr/sbin/csf" ]; then # Loop through all files matching the pattern /var/xdrago/run-USER for _file in /var/xdrago/run-*; do # Skip iteration if no files match the pattern [ -e "${_file}" ] || continue # Extract the _USER from the filename _USER=${_file#/var/xdrago/run-} # Define the paths to check _USER_DIR="/data/disk/${_USER}" _CANCELLED_FILE="${_USER_DIR}/log/CANCELLED" _PROXIED_PID_FILE="${_USER_DIR}/log/proxied.pid" _CLI_INFO_FILE="${_USER_DIR}/static/control/cli.info" # Check the conditions if [ ! -d "${_USER_DIR}" ] || \ [ -f "${_CANCELLED_FILE}" ] || \ [ -f "${_PROXIED_PID_FILE}" ] || \ [ ! -f "${_CLI_INFO_FILE}" ]; then # Move the file if any condition is met mv -f "${_file}" /var/backups/off-run/ fi if grep -q "renice 0" "${_file}"; then sed -i "s/renice 0/renice 9/g" "${_file}" fi done fi if [ -x "/opt/tools/drush/8/drush/drush.php" ] \ && [ -e "${_provLeIncFull}" ] \ && [ -e "${_hoLeIncFull}" ] \ && [ -e "/var/xdrago" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ -d "/data/u" ] \ && [ ! -e "${_pthLog}/le_renewal_days_69.ctrl.${_tRee}.${_xSrl}.pid" ]; then _leBasePath="profiles/hostmaster/modules/aegir/hosting_le" _lePath="${_leBasePath}/drush/${_provLeInc}" _leVhPath="${_leBasePath}/hosting_le_vhost/drush/${_hoLeInc}" for _pthSysUsr in `find /data/disk/ -maxdepth 1 -mindepth 1 | sort`; do if [ -e "${_pthSysUsr}/config/server_master/nginx/vhost.d" ] \ && [ -e "${_pthSysUsr}/static/control/cli.info" ] \ && [ ! -e "${_pthSysUsr}/log/proxied.pid" ] \ && [ ! -e "${_pthSysUsr}/log/CANCELLED" ]; then _tUsr= _validReg= _validIPr= _tUsr=$(echo ${_pthSysUsr} | cut -d'/' -f4 | awk '{ print $1}' 2>&1) _dscUsr="/data/disk/${_tUsr}" _hmPf=$(cat ${_dscUsr}/.drush/hostmaster.alias.drushrc.php \ | grep "root'" \ | cut -d: -f2 \ | awk '{ print $3}' \ | sed "s/[\,']//g" 2>&1) _locFile="${_hmPf}/${_lePath}" if [ -e "${_locFile}" ] && [ -e "${_provLeIncFull}" ]; then cp -af ${_provLeIncFull} ${_locFile} chown ${_tUsr}:users ${_locFile} chmod 0644 ${_locFile} fi _locVhFile="${_hmPf}/${_leVhPath}" if [ -e "${_locVhFile}" ] && [ -e "${_hoLeIncFull}" ]; then cp -af ${_hoLeIncFull} ${_locVhFile} chown ${_tUsr}:users ${_locVhFile} chmod 0644 ${_locVhFile} fi _leRoot="${_dscUsr}/tools/le" _exeLe="${_leRoot}/dehydrated" _dehydFull="${_leRoot}/${_dehydName}" _legacyLeShFile="${_leRoot}/letsencrypt.sh" _lockLeFile="${_leRoot}/lock" _configIni="${_leRoot}/config" _acctsDir="${_leRoot}/accounts" _acctsDemoDir="${_leRoot}/accounts-demo" _demoPid="${_leRoot}/.ctrl/ssl-demo-mode.pid" _normalRegPid="${_leRoot}/.ctrl/normal-re6-register.pid" _forcedRegPid="${_leRoot}/.ctrl/forced-re6-register.pid" _onDemandRegPid="${_leRoot}/.ctrl/onDemand-register.pid" _validIdn=$(grep "letsencrypt" ${_acctsDir}/*/account_id.json 2>&1) _validReg=$(grep "valid" ${_acctsDir}/*/registration_info.json 2>&1) _validIPr=$(grep "${_LOC_IP}" ${_acctsDir}/*/registration_info.json 2>&1) _HOUR=$(date +%H 2>&1) _HOUR=${_HOUR//[^0-9-]/} if [ -e "${_dehydSrcPath}" ]; then cp -af ${_dehydSrcPath} ${_dehydFull} chown ${_tUsr}:users ${_dehydFull} chmod 0700 ${_dehydFull} fi if [ -e "${_dehydFull}" ] \ && [ ! -e "${_normalRegPid}" ]; then if [ "${_HOUR}" = "5" ] \ || [ "${_HOUR}" = "17" ] \ || [ -e "${_onDemandRegPid}" ]; then su -s /bin/bash - ${_tUsr} -c "bash ${_exeLe} --register --accept-terms" wait touch ${_normalRegPid} fi fi if [ -e "${_lockLeFile}" ]; then rm -f ${_lockLeFile} sleep 1 fi if [ -e "${_demoPid}" ]; then rm -f ${_demoPid} fi if [ "${_HOUR}" = "11" ] \ || [ "${_HOUR}" = "23" ] \ || [ -e "${_onDemandRegPid}" ]; then if [ -e "${_legacyLeShFile}" ] \ || [ -e "${_acctsDemoDir}" ] \ || [[ ! "${_validIdn}" =~ "letsencrypt" ]] \ || [[ ! "${_validReg}" =~ "valid" ]] \ || [[ ! "${_validIPr}" =~ "${_LOC_IP}" ]] \ || [ ! -e "${_forcedRegPid}" ]; then rm -f ${_legacyLeShFile} rm -rf ${_acctsDemoDir} rm -rf ${_acctsDir} rm -f ${_leRoot}/.ctrl/.forced* rm -f ${_leRoot}/.ctrl/.normal* rm -f ${_leRoot}/.ctrl/forced* rm -f ${_leRoot}/.ctrl/normal* if [ -e "${_exeLe}" ]; then su -s /bin/bash - ${_tUsr} -c "bash ${_exeLe} --register --accept-terms" wait touch ${_forcedRegPid} touch ${_normalRegPid} fi fi fi fi done touch ${_pthLog}/le_renewal_days_69.ctrl.${_tRee}.${_xSrl}.pid fi if ! grep -q "defunct" /opt/local/bin/websh; then rm -f ${_pthLog}/websh.ctrl.* fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_pthLog}/websh.ctrl.f72.${_tRee}.${_xSrl}.pid" ]; then mv -f /opt/local/bin/websh /var/xdrago/websh.sh.old curl ${_crlGet} "${_urlHmr}/helpers/websh.sh.txt" -o /opt/local/bin/websh if [ -e "/opt/local/bin/websh" ] \ && grep -i '_forward_to_dash' /opt/local/bin/websh &> /dev/null; then chmod 755 /opt/local/bin/websh chown root:root /opt/local/bin/websh [ -x "/bin/websh" ] && [ ! -L "/bin/websh" ] && ln -sfn /opt/local/bin/websh /bin/websh touch ${_pthLog}/websh.ctrl.f72.${_tRee}.${_xSrl}.pid else mv -f /var/xdrago/websh.sh.old /opt/local/bin/websh fi _WEB_SH="$(readlink -n /bin/sh)" if [ -x "/opt/local/bin/websh" ] \ && grep -i '_forward_to_dash' /opt/local/bin/websh &> /dev/null; then if [ "${_WEB_SH}" != "/opt/local/bin/websh" ]; then ln -sfn /opt/local/bin/websh /bin/sh if [ -e "/usr/bin/sh" ]; then ln -sfn /opt/local/bin/websh /usr/bin/sh fi [ -x "/bin/websh" ] && [ ! -L "/bin/websh" ] && ln -sfn /opt/local/bin/websh /bin/websh fi fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -x "/etc/cron.hourly/systemtime" ] \ && [ ! -e "${_pthLog}/systemtime.ctrl.f95.${_tRee}.${_xSrl}.pid" ]; then curl ${_crlGet} "${_urlHmr}/helpers/systemtime" -o /etc/cron.hourly/systemtime if [ -e "/etc/cron.hourly/systemtime" ]; then chmod 755 /etc/cron.hourly/systemtime chown root:root /etc/cron.hourly/systemtime service cron restart touch ${_pthLog}/systemtime.ctrl.f95.${_tRee}.${_xSrl}.pid fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -d "/var/aegir/drush" ] \ && [ ! -e "${_pthLog}/synproxy.ctrl.f93.${_tRee}.${_xSrl}.pid" ]; then _CNT=$(pgrep -fc synproxy_rollback) if (( _CNT > 0 )); then echo "The synproxy_rollback is running!" else if [ -e "${_optBin}/synproxy" ]; then mv -f ${_optBin}/synproxy ${_optBin}/synproxy.old fi curl ${_crlGet} "${_urlHmr}/tools/bin/synproxy" -o ${_optBin}/synproxy if [ -e "${_optBin}/synproxy" ]; then chmod 700 ${_optBin}/synproxy chown root:root ${_optBin}/synproxy touch ${_pthLog}/synproxy.ctrl.f93.${_tRee}.${_xSrl}.pid else if [ -e "${_optBin}/synproxy.old" ]; then mv -f ${_optBin}/synproxy.old ${_optBin}/synproxy fi fi fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -d "/var/aegir/drush" ] \ && [ ! -e "${_pthLog}/synproxy_rollback.ctrl.f94.${_tRee}.${_xSrl}.pid" ]; then _CNT=$(pgrep -fc synproxy_rollback) if (( _CNT > 0 )); then echo "The synproxy_rollback is running!" else if [ -e "${_optBin}/synproxy_rollback" ]; then mv -f ${_optBin}/synproxy_rollback ${_optBin}/synproxy_rollback.old fi curl ${_crlGet} "${_urlHmr}/tools/bin/synproxy_rollback" -o ${_optBin}/synproxy_rollback if [ -e "${_optBin}/synproxy_rollback" ]; then chmod 700 ${_optBin}/synproxy_rollback chown root:root ${_optBin}/synproxy_rollback touch ${_pthLog}/synproxy_rollback.ctrl.f94.${_tRee}.${_xSrl}.pid else if [ -e "${_optBin}/synproxy_rollback.old" ]; then mv -f ${_optBin}/synproxy_rollback.old ${_optBin}/synproxy_rollback fi fi fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -d "/var/aegir/drush" ] \ && [ ! -e "${_pthLog}/synproxy_reassert.ctrl.f88.${_tRee}.${_xSrl}.pid" ]; then _CNT=$(pgrep -fc synproxy_rollback) if (( _CNT > 0 )); then echo "The synproxy_rollback is running!" else if [ -e "${_optBin}/synproxy_reassert" ]; then mv -f ${_optBin}/synproxy_reassert ${_optBin}/synproxy_reassert.old fi curl ${_crlGet} "${_urlHmr}/tools/bin/synproxy_reassert" -o ${_optBin}/synproxy_reassert if [ -e "${_optBin}/synproxy_reassert" ]; then chmod 700 ${_optBin}/synproxy_reassert chown root:root ${_optBin}/synproxy_reassert touch ${_pthLog}/synproxy_reassert.ctrl.f88.${_tRee}.${_xSrl}.pid else if [ -e "${_optBin}/synproxy_reassert.old" ]; then mv -f ${_optBin}/synproxy_reassert.old ${_optBin}/synproxy_reassert fi fi fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -d "/var/aegir/drush" ] \ && [ ! -e "${_pthLog}/synproxy_hook_fix.ctrl.f99.${_tRee}.${_xSrl}.pid" ]; then _CNT=$(pgrep -fc synproxy_rollback) if (( _CNT > 0 )); then echo "The synproxy_rollback is running!" else if [ -e "${_optBin}/synproxy_hook_fix" ]; then mv -f ${_optBin}/synproxy_hook_fix ${_optBin}/synproxy_hook_fix.old fi curl ${_crlGet} "${_urlHmr}/tools/bin/synproxy_hook_fix" -o ${_optBin}/synproxy_hook_fix if [ -e "${_optBin}/synproxy_hook_fix" ]; then chmod 700 ${_optBin}/synproxy_hook_fix chown root:root ${_optBin}/synproxy_hook_fix touch ${_pthLog}/synproxy_hook_fix.ctrl.f99.${_tRee}.${_xSrl}.pid else if [ -e "${_optBin}/synproxy_hook_fix.old" ]; then mv -f ${_optBin}/synproxy_hook_fix.old ${_optBin}/synproxy_hook_fix fi fi fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -d "/var/aegir/drush" ] \ && [ ! -e "${_pthLog}/synproxy_snapshot.ctrl.f99.${_tRee}.${_xSrl}.pid" ]; then _CNT=$(pgrep -fc synproxy_rollback) if (( _CNT > 0 )); then echo "The synproxy_rollback is running!" else if [ -e "${_optBin}/synproxy_snapshot" ]; then mv -f ${_optBin}/synproxy_snapshot ${_optBin}/synproxy_snapshot.old fi curl ${_crlGet} "${_urlHmr}/tools/bin/synproxy_snapshot" -o ${_optBin}/synproxy_snapshot if [ -e "${_optBin}/synproxy_snapshot" ]; then chmod 700 ${_optBin}/synproxy_snapshot chown root:root ${_optBin}/synproxy_snapshot touch ${_pthLog}/synproxy_snapshot.ctrl.f99.${_tRee}.${_xSrl}.pid else if [ -e "${_optBin}/synproxy_snapshot.old" ]; then mv -f ${_optBin}/synproxy_snapshot.old ${_optBin}/synproxy_snapshot fi fi fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -d "/var/aegir/drush" ] \ && [ ! -e "${_pthLog}/synproxy_status.ctrl.f99.${_tRee}.${_xSrl}.pid" ]; then _CNT=$(pgrep -fc synproxy_rollback) if (( _CNT > 0 )); then echo "The synproxy_rollback is running!" else if [ -e "${_optBin}/synproxy_status" ]; then mv -f ${_optBin}/synproxy_status ${_optBin}/synproxy_status.old fi curl ${_crlGet} "${_urlHmr}/tools/bin/synproxy_status" -o ${_optBin}/synproxy_status if [ -e "${_optBin}/synproxy_status" ]; then chmod 700 ${_optBin}/synproxy_status chown root:root ${_optBin}/synproxy_status touch ${_pthLog}/synproxy_status.ctrl.f99.${_tRee}.${_xSrl}.pid else if [ -e "${_optBin}/synproxy_status.old" ]; then mv -f ${_optBin}/synproxy_status.old ${_optBin}/synproxy_status fi fi fi fi if [ -e "/var/xdrago/monitor/check" ] \ && [ -d "/var/aegir/drush" ] \ && [ ! -e "${_pthLog}/synproxy_monitor.ctrl.f98.${_tRee}.${_xSrl}.pid" ]; then _CNT=$(pgrep -fc synproxy_rollback) if (( _CNT > 0 )); then echo "The synproxy_rollback is running!" else if [ -e "${_optBin}/synproxy_monitor" ]; then mv -f ${_optBin}/synproxy_monitor ${_optBin}/synproxy_monitor.old fi curl ${_crlGet} "${_urlHmr}/tools/bin/synproxy_monitor" -o ${_optBin}/synproxy_monitor if [ -e "${_optBin}/synproxy_monitor" ]; then chmod 700 ${_optBin}/synproxy_monitor chown root:root ${_optBin}/synproxy_monitor touch ${_pthLog}/synproxy_monitor.ctrl.f98.${_tRee}.${_xSrl}.pid else if [ -e "${_optBin}/synproxy_monitor.old" ]; then mv -f ${_optBin}/synproxy_monitor.old ${_optBin}/synproxy_monitor fi fi fi fi _Dir="/data/all/000/modules" _REDIS_E_VERSION=8.x-1.11.2 if [ -e "/var/xdrago/manage_solr_config.sh" ]; then if [ ! -e "${_Dir}/redis_ten_eleven/ver-${_REDIS_E_VERSION}.${_xSrl}.info" ]; then mkdir -p ${_Dir} cd ${_Dir} rm -rf ${_Dir}/redis_ten_eleven _get_dev_contrib "redis_ten_eleven-${_REDIS_E_VERSION}.tar.gz" echo update > ${_Dir}/redis_ten_eleven/ver-${_REDIS_E_VERSION}.${_xSrl}.info find ${_Dir} -type d -exec chmod 0755 {} \; &> /dev/null find ${_Dir} -type f -exec chmod 0644 {} \; &> /dev/null touch ${_pthLog}/redis_ten_eleven.ctrl.${_xSrl}.log fi fi _Dir="/data/all/000/modules" _REDIS_T_VERSION=8.x-1.8.2 if [ -e "/var/xdrago/manage_solr_config.sh" ]; then if [ ! -e "${_Dir}/redis_nine_ten/ver-${_REDIS_T_VERSION}.${_xSrl}.info" ]; then mkdir -p ${_Dir} cd ${_Dir} rm -rf ${_Dir}/redis_nine_ten _get_dev_contrib "redis_nine_ten-${_REDIS_T_VERSION}.tar.gz" echo update > ${_Dir}/redis_nine_ten/ver-${_REDIS_T_VERSION}.${_xSrl}.info find ${_Dir} -type d -exec chmod 0755 {} \; &> /dev/null find ${_Dir} -type f -exec chmod 0644 {} \; &> /dev/null touch ${_pthLog}/redis_nine_ten.ctrl.${_xSrl}.log fi fi _Dir="/data/all/000/modules" _REDIS_C_VERSION=com-19-04-2021 if [ -e "/var/xdrago/manage_solr_config.sh" ]; then if [ ! -e "${_Dir}/redis_compr/ver-${_REDIS_C_VERSION}.${_xSrl}.info" ]; then mkdir -p ${_Dir} cd ${_Dir} rm -rf ${_Dir}/redis_compr _get_dev_contrib "redis_compr-${_REDIS_C_VERSION}.tar.gz" echo update > ${_Dir}/redis_compr/ver-${_REDIS_C_VERSION}.${_xSrl}.info find ${_Dir} -type d -exec chmod 0755 {} \; &> /dev/null find ${_Dir} -type f -exec chmod 0644 {} \; &> /dev/null touch ${_pthLog}/redis_compr.ctrl.${_xSrl}.log fi fi _Dir="/data/all/000/modules" _REDIS_L_VERSION=7.x-3.19.1 if [ -e "/var/xdrago/manage_solr_config.sh" ]; then if [ ! -e "${_Dir}/redis_edge/ver-${_REDIS_L_VERSION}.${_xSrl}.info" ]; then mkdir -p ${_Dir} cd ${_Dir} rm -rf ${_Dir}/redis_edge _get_dev_contrib "redis_edge-${_REDIS_L_VERSION}.tar.gz" echo update > ${_Dir}/redis_edge/ver-${_REDIS_L_VERSION}.${_xSrl}.info find ${_Dir} -type d -exec chmod 0755 {} \; &> /dev/null find ${_Dir} -type f -exec chmod 0644 {} \; &> /dev/null touch ${_pthLog}/redis_edge.ctrl.${_xSrl}.log fi fi _Dir="/data/all/000/modules" _REDIS_N_VERSION=com-19-04-2021 if [ -e "/var/xdrago/manage_solr_config.sh" ]; then if [ ! -e "${_Dir}/redis_eight/ver-${_REDIS_N_VERSION}.${_xSrl}.info" ]; then mkdir -p ${_Dir} cd ${_Dir} rm -rf ${_Dir}/redis_eight _get_dev_contrib "redis_eight-${_REDIS_N_VERSION}.tar.gz" echo update > ${_Dir}/redis_eight/ver-${_REDIS_N_VERSION}.${_xSrl}.info find ${_Dir} -type d -exec chmod 0755 {} \; &> /dev/null find ${_Dir} -type f -exec chmod 0644 {} \; &> /dev/null touch ${_pthLog}/redis_eight.ctrl.${_xSrl}.log fi fi } _fix_core_dgd() { # sed -i "s/^_PERMISSIONS_FIX=.*/_PERMISSIONS_FIX=YES/g" ${_barCnf} _saCoreS="${_saCoreN}-D7" _saIncDb="includes/database/database.inc" _saPatch="/var/xdrago/conf/${_saCoreS}.patch" _saQCoreN="${_saCoreN}" _saQCoreS="${_saQCoreN}-D8" _saQIncDb="core/includes/database.inc" _saQPatch="/var/xdrago/conf/${_saQCoreS}.patch" _saXCoreN="${_saCoreN}" _saXCoreS="${_saXCoreN}-D6" _saXIncDb="includes/database.inc" _saXPatch="/var/xdrago/conf/${_saXCoreS}.patch" _saBCoreP="${_saCoreN}-provision" _saBPatch="/var/xdrago/conf/${_saBCoreP}.patch" # SA-CORE D8 patch if [ -e "/var/xdrago" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_saQPatch}" ]; then mkdir -p /var/xdrago/conf curl ${_crlGet} "${_urlHmr}/patches/8-core/${_saQCoreS}.patch" -o ${_saQPatch} fi # SA-CORE D7 patch if [ -e "/var/xdrago" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_saPatch}" ]; then mkdir -p /var/xdrago/conf curl ${_crlGet} "${_urlHmr}/patches/7-core/${_saCoreS}.patch" -o ${_saPatch} fi # SA-CORE D6 patch # if [ -e "/var/xdrago" ] \ # && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ # && [ ! -e "${_saXPatch}" ]; then # mkdir -p /var/xdrago/conf # curl ${_crlGet} "${_urlHmr}/patches/6-core/${_saXCoreS}.patch" -o ${_saXPatch} # fi # SA-CORE for Octopus hostmaster platforms if [ -e "/var/xdrago" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ -d "/data/u" ] \ && [ -e "${_saPatch}" ]; then if [ -d "/data/all" ] \ && [ ! -e "${_pthLog}/hostmaster-octopus-${_saCoreN}-fixed-d7.log" ]; then for _File in `find /data/disk/*/aegir/distro/*/${_saIncDb} \ -maxdepth 0 -mindepth 0 | sort`; do _Core=$(echo ${_File} \ | sed 's/\/includes.*//g' \ | awk '{print $1}' 2> /dev/null) if [ -d "${_Core}" ] && [ ! -e "${_Core}/core" ]; then cd ${_Core} patch -p1 < ${_saPatch} &> /dev/null fi done touch ${_pthLog}/hostmaster-octopus-${_saCoreN}-fixed-d7.log fi cd fi # SA-CORE for Barracuda hostmaster platforms if [ -e "/var/xdrago" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ -e "${_saPatch}" ]; then if [ -d "/data/all" ] \ && [ ! -e "${_pthLog}/hostmaster-barracuda-${_saCoreN}-fixed-d7.log" ]; then for _File in `find /var/aegir/host_master/*/${_saIncDb} \ -maxdepth 0 -mindepth 0 | sort`; do _Core=$(echo ${_File} \ | sed 's/\/includes.*//g' \ | awk '{print $1}' 2> /dev/null) if [ -d "${_Core}" ] && [ ! -e "${_Core}/core" ]; then cd ${_Core} patch -p1 < ${_saPatch} &> /dev/null fi done for _File in `find /var/aegir/hostmaster*/${_saIncDb} \ -maxdepth 0 -mindepth 0 | sort`; do _Core=$(echo ${_File} \ | sed 's/\/includes.*//g' \ | awk '{print $1}' 2> /dev/null) if [ -d "${_Core}" ] && [ ! -e "${_Core}/core" ]; then cd ${_Core} patch -p1 < ${_saPatch} &> /dev/null fi done touch ${_pthLog}/hostmaster-barracuda-${_saCoreN}-fixed-d7.log fi cd fi # SA-CORE for built-in D7 platforms if [ -e "/var/xdrago" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ -e "${_saPatch}" ] \ && [ ! -e "${_pthLog}/${_saCoreN}-fixed-d7.log" ]; then if [ -d "/data/all/000/core" ]; then for _Core in `find /data/all/000/core/drupal-7* \ -maxdepth 0 -mindepth 0 | sort`; do cd ${_Core} patch -p1 < ${_saPatch} &> /dev/null done elif [ -d "/data/disk/all/000/core" ]; then for _Core in `find /data/disk/all/000/core/drupal-7* \ -maxdepth 0 -mindepth 0 | sort`; do cd ${_Core} patch -p1 < ${_saPatch} &> /dev/null done fi touch ${_pthLog}/${_saCoreN}-fixed-d7.log cd fi # SA-CORE for ancient D7 platforms if [ -e "/var/xdrago" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ -e "${_saPatch}" ]; then if [ -d "/data/all" ] \ && [ ! -e "${_pthLog}/legacy-${_saCoreN}-fixed-d7.log" ]; then for _File in `find /data/all/*/*/${_saIncDb} \ -maxdepth 0 -mindepth 0 | sort`; do _Core=$(echo ${_File} \ | sed 's/\/includes.*//g' \ | awk '{print $1}' 2> /dev/null) if [ -d "${_Core}" ] && [ ! -e "${_Core}/core" ]; then cd ${_Core} patch -p1 < ${_saPatch} &> /dev/null fi done touch ${_pthLog}/legacy-${_saCoreN}-fixed-d7.log elif [ -d "/data/disk/all" ] \ && [ ! -e "${_pthLog}/legacy-${_saCoreN}-fixed-d7eee.log" ]; then for _File in `find /data/disk/all/*/*/${_saIncDb} \ -maxdepth 0 -mindepth 0 | sort`; do _Core=$(echo ${_File} \ | sed 's/\/includes.*//g' \ | awk '{print $1}' 2> /dev/null) if [ -d "${_Core}" ] && [ ! -e "${_Core}/core" ]; then cd ${_Core} patch -p1 < ${_saPatch} &> /dev/null fi done touch ${_pthLog}/legacy-${_saCoreN}-fixed-d7eee.log fi cd fi # SA-CORE for custom D7 platforms if [ -e "/var/xdrago" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ -e "${_saPatch}" ]; then if [ -d "/data/u" ] \ && [ ! -e "${_pthLog}/batch-custom-${_saCoreN}-fixed-d7.log" ]; then for _File in `find /data/disk/*/static/*/${_saIncDb} \ -maxdepth 0 -mindepth 0 | sort`; do _Core=$(echo ${_File} \ | sed 's/\/includes.*//g' \ | awk '{print $1}' 2> /dev/null) if [ -d "${_Core}" ] \ && [ ! -e "${_Core}/core" ] \ && [ ! -e "${_Core}/profiles/${_saCoreS}-fix.info" ]; then cd ${_Core} patch -p1 < ${_saPatch} &> /dev/null echo fixed > ${_Core}/profiles/${_saCoreS}-fix.info fi done for _File in `find /data/disk/*/static/*/*/${_saIncDb} \ -maxdepth 0 -mindepth 0 | sort`; do _Core=$(echo ${_File} \ | sed 's/\/includes.*//g' \ | awk '{print $1}' 2> /dev/null) if [ -d "${_Core}" ] \ && [ ! -e "${_Core}/core" ] \ && [ ! -e "${_Core}/profiles/${_saCoreS}-fix.info" ]; then cd ${_Core} patch -p1 < ${_saPatch} &> /dev/null echo fixed > ${_Core}/profiles/${_saCoreS}-fix.info fi done for _File in `find /data/disk/*/static/*/*/*/${_saIncDb} \ -maxdepth 0 -mindepth 0 | sort`; do _Core=$(echo ${_File} \ | sed 's/\/includes.*//g' \ | awk '{print $1}' 2> /dev/null) if [ -d "${_Core}" ] \ && [ ! -e "${_Core}/core" ] \ && [ ! -e "${_Core}/profiles/${_saCoreS}-fix.info" ]; then cd ${_Core} patch -p1 < ${_saPatch} &> /dev/null echo fixed > ${_Core}/profiles/${_saCoreS}-fix.info fi done for _File in `find /data/disk/*/static/*/*/*/*/${_saIncDb} \ -maxdepth 0 -mindepth 0 | sort`; do _Core=$(echo ${_File} \ | sed 's/\/includes.*//g' \ | awk '{print $1}' 2> /dev/null) if [ -d "${_Core}" ] \ && [ ! -e "${_Core}/core" ] \ && [ ! -e "${_Core}/profiles/${_saCoreS}-fix.info" ]; then cd ${_Core} patch -p1 < ${_saPatch} &> /dev/null echo fixed > ${_Core}/profiles/${_saCoreS}-fix.info fi done for _File in `find /data/disk/*/static/*/*/*/*/*/${_saIncDb} \ -maxdepth 0 -mindepth 0 | sort`; do _Core=$(echo ${_File} \ | sed 's/\/includes.*//g' \ | awk '{print $1}' 2> /dev/null) if [ -d "${_Core}" ] \ && [ ! -e "${_Core}/core" ] \ && [ ! -e "${_Core}/profiles/${_saCoreS}-fix.info" ]; then cd ${_Core} patch -p1 < ${_saPatch} &> /dev/null echo fixed > ${_Core}/profiles/${_saCoreS}-fix.info fi done fi cd touch ${_pthLog}/batch-custom-${_saCoreN}-fixed-d7.log fi # SA-CORE for D8 platforms in ~/static if [ -e "/var/xdrago" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ -e "${_saQPatch}" ]; then if [ -d "/data/u" ] \ && [ ! -e "${_pthLog}/batch-custom-${_saQCoreN}-fixed-d8.log" ]; then for _File in `find /data/disk/*/static/*/${_saQIncDb} \ -maxdepth 0 -mindepth 0 | sort`; do _Core=$(echo ${_File} \ | sed 's/\/core.*//g' \ | awk '{print $1}' 2> /dev/null) if [ -d "${_Core}" ] \ && [ -e "${_Core}/core" ] \ && [ ! -e "${_Core}/profiles/${_saQCoreS}-fix.info" ]; then cd ${_Core} patch -p1 < ${_saQPatch} &> /dev/null echo fixed > ${_Core}/profiles/${_saQCoreS}-fix.info fi done for _File in `find /data/disk/*/static/*/*/${_saQIncDb} \ -maxdepth 0 -mindepth 0 | sort`; do _Core=$(echo ${_File} \ | sed 's/\/core.*//g' \ | awk '{print $1}' 2> /dev/null) if [ -d "${_Core}" ] \ && [ -e "${_Core}/core" ] \ && [ ! -e "${_Core}/profiles/${_saQCoreS}-fix.info" ]; then cd ${_Core} patch -p1 < ${_saQPatch} &> /dev/null echo fixed > ${_Core}/profiles/${_saQCoreS}-fix.info fi done for _File in `find /data/disk/*/static/*/*/*/${_saQIncDb} \ -maxdepth 0 -mindepth 0 | sort`; do _Core=$(echo ${_File} \ | sed 's/\/core.*//g' \ | awk '{print $1}' 2> /dev/null) if [ -d "${_Core}" ] \ && [ -e "${_Core}/core" ] \ && [ ! -e "${_Core}/profiles/${_saQCoreS}-fix.info" ]; then cd ${_Core} patch -p1 < ${_saQPatch} &> /dev/null echo fixed > ${_Core}/profiles/${_saQCoreS}-fix.info fi done for _File in `find /data/disk/*/static/*/*/*/*/${_saQIncDb} \ -maxdepth 0 -mindepth 0 | sort`; do _Core=$(echo ${_File} \ | sed 's/\/core.*//g' \ | awk '{print $1}' 2> /dev/null) if [ -d "${_Core}" ] \ && [ -e "${_Core}/core" ] \ && [ ! -e "${_Core}/profiles/${_saQCoreS}-fix.info" ]; then cd ${_Core} patch -p1 < ${_saQPatch} &> /dev/null echo fixed > ${_Core}/profiles/${_saQCoreS}-fix.info fi done for _File in `find /data/disk/*/static/*/*/*/*/*/${_saQIncDb} \ -maxdepth 0 -mindepth 0 | sort`; do _Core=$(echo ${_File} \ | sed 's/\/core.*//g' \ | awk '{print $1}' 2> /dev/null) if [ -d "${_Core}" ] \ && [ -e "${_Core}/core" ] \ && [ ! -e "${_Core}/profiles/${_saQCoreS}-fix.info" ]; then cd ${_Core} patch -p1 < ${_saQPatch} &> /dev/null echo fixed > ${_Core}/profiles/${_saQCoreS}-fix.info fi done fi cd touch ${_pthLog}/batch-custom-${_saQCoreN}-fixed-d8.log fi # SA-CORE for built-in D6 platforms if [ -e "/var/xdrago" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ -e "${_saXPatch}" ] \ && [ ! -e "${_pthLog}/${_saXCoreN}-finally-fixed-d6.log" ]; then if [ -d "/data/all/000/core" ]; then for _Core in `find /data/all/000/core/pressflow-6* \ -maxdepth 0 -mindepth 0 | sort`; do cd ${_Core} patch -p1 < ${_saXPatch} &> /dev/null done elif [ -d "/data/disk/all/000/core" ]; then for _Core in `find /data/disk/all/000/core/pressflow-6* \ -maxdepth 0 -mindepth 0 | sort`; do cd ${_Core} patch -p1 < ${_saXPatch} &> /dev/null done fi touch ${_pthLog}/${_saXCoreN}-finally-fixed-d6.log cd fi # SA-CORE for ancient D6 platforms if [ -e "/var/xdrago" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ -e "${_saXPatch}" ]; then if [ -d "/data/all" ] \ && [ ! -e "${_pthLog}/legacy-${_saXCoreN}-finally-fixed-d6.log" ]; then for _File in `find /data/all/*/*/${_saXIncDb} \ -maxdepth 0 -mindepth 0 | sort`; do _Core=$(echo ${_File} \ | sed 's/\/includes.*//g' \ | awk '{print $1}' 2> /dev/null) if [ -d "${_Core}" ] && [ ! -e "${_Core}/core" ]; then cd ${_Core} patch -p1 < ${_saXPatch} &> /dev/null fi done touch ${_pthLog}/legacy-${_saXCoreN}-finally-fixed-d6.log elif [ -d "/data/disk/all" ] \ && [ ! -e "${_pthLog}/legacy-${_saXCoreN}-finally-fixed-d6eee.log" ]; then for _File in `find /data/disk/all/*/*/${_saXIncDb} \ -maxdepth 0 -mindepth 0 | sort`; do _Core=$(echo ${_File} \ | sed 's/\/includes.*//g' \ | awk '{print $1}' 2> /dev/null) if [ -d "${_Core}" ] && [ ! -e "${_Core}/core" ]; then cd ${_Core} patch -p1 < ${_saXPatch} &> /dev/null fi done touch ${_pthLog}/legacy-${_saXCoreN}-finally-fixed-d6eee.log fi cd fi # SA-CORE for custom D6 platforms if [ -e "/var/xdrago" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ -e "${_saXPatch}" ]; then if [ -d "/data/u" ] \ && [ ! -e "${_pthLog}/batch-custom-${_saXCoreN}-finally-fixed-d6.log" ]; then for _File in `find /data/disk/*/static/*/${_saXIncDb} \ -maxdepth 0 -mindepth 0 | sort`; do _Core=$(echo ${_File} \ | sed 's/\/includes.*//g' \ | awk '{print $1}' 2> /dev/null) if [ -d "${_Core}" ] \ && [ ! -e "${_Core}/core" ] \ && [ ! -e "${_Core}/profiles/${_saXCoreS}-fix-finally.info" ]; then cd ${_Core} patch -p1 < ${_saXPatch} &> /dev/null echo fixed > ${_Core}/profiles/${_saXCoreS}-fix-finally.info fi done for _File in `find /data/disk/*/static/*/*/${_saXIncDb} \ -maxdepth 0 -mindepth 0 | sort`; do _Core=$(echo ${_File} \ | sed 's/\/includes.*//g' \ | awk '{print $1}' 2> /dev/null) if [ -d "${_Core}" ] \ && [ ! -e "${_Core}/core" ] \ && [ ! -e "${_Core}/profiles/${_saXCoreS}-fix-finally.info" ]; then cd ${_Core} patch -p1 < ${_saXPatch} &> /dev/null echo fixed > ${_Core}/profiles/${_saXCoreS}-fix-finally.info fi done for _File in `find /data/disk/*/static/*/*/*/${_saXIncDb} \ -maxdepth 0 -mindepth 0 | sort`; do _Core=$(echo ${_File} \ | sed 's/\/includes.*//g' \ | awk '{print $1}' 2> /dev/null) if [ -d "${_Core}" ] \ && [ ! -e "${_Core}/core" ] \ && [ ! -e "${_Core}/profiles/${_saXCoreS}-fix-finally.info" ]; then cd ${_Core} patch -p1 < ${_saXPatch} &> /dev/null echo fixed > ${_Core}/profiles/${_saXCoreS}-fix-finally.info fi done for _File in `find /data/disk/*/static/*/*/*/*/${_saXIncDb} \ -maxdepth 0 -mindepth 0 | sort`; do _Core=$(echo ${_File} \ | sed 's/\/includes.*//g' \ | awk '{print $1}' 2> /dev/null) if [ -d "${_Core}" ] \ && [ ! -e "${_Core}/core" ] \ && [ ! -e "${_Core}/profiles/${_saXCoreS}-fix-finally.info" ]; then cd ${_Core} patch -p1 < ${_saXPatch} &> /dev/null echo fixed > ${_Core}/profiles/${_saXCoreS}-fix-finally.info fi done for _File in `find /data/disk/*/static/*/*/*/*/*/${_saXIncDb} \ -maxdepth 0 -mindepth 0 | sort`; do _Core=$(echo ${_File} \ | sed 's/\/includes.*//g' \ | awk '{print $1}' 2> /dev/null) if [ -d "${_Core}" ] \ && [ ! -e "${_Core}/core" ] \ && [ ! -e "${_Core}/profiles/${_saXCoreS}-fix-finally.info" ]; then cd ${_Core} patch -p1 < ${_saXPatch} &> /dev/null echo fixed > ${_Core}/profiles/${_saXCoreS}-fix-finally.info fi done fi cd touch ${_pthLog}/batch-custom-${_saXCoreN}-finally-fixed-d6.log fi } _fix_ping_perms() { if [ -e "/bin/ping" ]; then _PING_TEST=$(ls -la /bin/ping | grep rwsr-xr-x 2>&1) if [ -z "${_PING_TEST}" ]; then chown root:root /bin/ping chmod 4755 /bin/ping fi fi } _fix_fpm_process_max() { if [ ! -e "${_pthLog}/process.max.ctrl.${_tRee}.${_xSrl}.pid" ]; then sed -i "s/process.max =.*/process.max = 0/g" /opt/php*/etc/php*-fpm.conf touch ${_pthLog}/process.max.ctrl.${_tRee}.${_xSrl}.pid fi } _fix_node_in_lshell_access() { if [ ! -e "${_pthLog}/node.lshell-fix-npx.ctrl.${_tRee}.${_xSrl}.pid" ] \ && [ -e "/etc/lshell.conf" ]; then _PrTestPhantom=$(grep "PHANTOM" /root/.*.octopus.cnf 2>&1) _PrTestCluster=$(grep "CLUSTER" /root/.*.octopus.cnf 2>&1) _PrTestUltra=$(grep "ULTRA" /root/.*.octopus.cnf 2>&1) _PrTestMonster=$(grep "MONSTER" /root/.*.octopus.cnf 2>&1) if [[ "${_PrTestPhantom}" =~ "PHANTOM" ]] \ || [[ "${_PrTestCluster}" =~ "CLUSTER" ]] \ || [[ "${_PrTestUltra}" =~ "ULTRA" ]] \ || [[ "${_PrTestMonster}" =~ "MONSTER" ]] \ || [ -e "/root/.allow.node.lshell.cnf" ]; then _ALLOW_NODE=YES else _ALLOW_NODE=NO sed -i \ -e "s/, 'node', 'npm', 'npx',/,/gi" \ -e "s/, 'scp',/,/gi" \ /etc/lshell.conf /var/xdrago/conf/lshell.conf fi touch ${_pthLog}/node.lshell-fix-npx.ctrl.${_tRee}.${_xSrl}.pid fi } _fix_php_in_lshell_access() { if [ ! -e "${_pthLog}/php.lshell-fix-php.ctrl.${_tRee}.${_xSrl}.pid" ] \ && [ -e "/etc/lshell.conf" ]; then _PrTestPhantom=$(grep "PHANTOM" /root/.*.octopus.cnf 2>&1) _PrTestCluster=$(grep "CLUSTER" /root/.*.octopus.cnf 2>&1) _PrTestUltra=$(grep "ULTRA" /root/.*.octopus.cnf 2>&1) _PrTestMonster=$(grep "MONSTER" /root/.*.octopus.cnf 2>&1) if [[ "${_PrTestPhantom}" =~ "PHANTOM" ]] \ || [[ "${_PrTestCluster}" =~ "CLUSTER" ]] \ || [[ "${_PrTestUltra}" =~ "ULTRA" ]] \ || [[ "${_PrTestMonster}" =~ "MONSTER" ]] \ || [ -e "/root/.allow.php.lshell.cnf" ]; then _ALLOW_PHP=YES else _ALLOW_PHP=NO sed -i \ -e "s/, 'php.*':.*php',/,/gi" \ -e "s/, '\/opt\/php.*',/,/gi" \ /etc/lshell.conf /var/xdrago/conf/lshell.conf fi touch ${_pthLog}/php.lshell-fix-php.ctrl.${_tRee}.${_xSrl}.pid fi } _if_fix_lshell() { if [ ! -e "/usr/local/etc/lshell.conf" ] \ && [ ! -L "/usr/local/etc/lshell.conf" ] \ && [ -e "/etc/lshell.conf" ]; then [ ! -d "/usr/local/etc" ] && mkdir -p /usr/local/etc ln -sfn /etc/lshell.conf /usr/local/etc/lshell.conf fi _LSHELL_VRN=0.10 _PATH_LSHELL="${_usrBin}/lshell" _LSHELL_CHK_VRN=0.10 _LSHELL_FORCE_REINSTALL=NO _isLshell="$(which lshell)" _LSHELL_ITD=$(${_isLshell} --version 2>&1 \ | tr -d "\n" \ | cut -d"-" -f2 \ | awk '{ print $1}' 2>&1) if [ -z "${_isLshell}" ] \ || [ -z "${_PATH_LSHELL}" ] \ || [ "${_LSHELL_ITD}" != "${_LSHELL_CHK_VRN}" ] \ || [[ "${_LSHELL_ITD}" =~ "Traceback" ]] \ || [[ "${_LSHELL_ITD}" =~ "bad interpreter" ]] \ || [[ "${_LSHELL_ITD}" =~ "ImportError" ]]; then _LSHELL_FORCE_REINSTALL=YES fi if [ "${_LSHELL_FORCE_REINSTALL}" = "YES" ]; then [ -f "/etc/lshell.conf" ] && cp -af /etc/lshell.conf /etc/lshell.conf-bak-${_LSHELL_VRN} _apt_clean_update apt-get install python3-pip ${_aptYesUnth} if [ -x "/usr/bin/pip3" ]; then _usePip=/usr/bin/pip3 elif [ -x "/usr/local/bin/pip3" ]; then _usePip=/usr/local/bin/pip3 fi _PIP_TEST=$(${_usePip} --version 2>&1) if [[ "${_PIP_TEST}" =~ "python 3.11" ]] \ || [[ "${_PIP_TEST}" =~ "python 3.12" ]] \ || [[ "${_PIP_TEST}" =~ "python 3.13" ]]; then ${_usePip} install --upgrade pip --root-user-action ignore else ${_usePip} install --upgrade pip fi cd /var/opt rm -rf lshell* _get_dev_src "lshell-${_LSHELL_VRN}.tar.gz" for _Files in `find /var/opt/lshell-${_LSHELL_VRN} -type f`; do sed -i "s/kicked/logged/g" ${_Files} &> /dev/null wait sed -i "s/Kicked/Logged/g" ${_Files} &> /dev/null wait done rm -rf /usr/local/lib/python*/site-packages/lshell* rm -rf /usr/local/lib/python*/dist-packages/lshell* cd /var/opt/lshell-${_LSHELL_VRN} _PIP_TEST=$(${_usePip} --version 2>&1) if [[ "${_PIP_TEST}" =~ "python 3.11" ]] \ || [[ "${_PIP_TEST}" =~ "python 3.12" ]] \ || [[ "${_PIP_TEST}" =~ "python 3.13" ]]; then ${_usePip} install . --break-system-packages --root-user-action ignore else ${_usePip} install . fi [ -f "/etc/lshell.conf-bak-${_LSHELL_VRN}" ] && cp -af /etc/lshell.conf-bak-${_LSHELL_VRN} /etc/lshell.conf rm -f /etc/logrotate.d/lshell addgroup --system lshellg &> /dev/null addgroup --system ltd-shell-more &> /dev/null mkdir -p /var/log/lsh chown :lshellg /var/log/lsh chmod 770 /var/log/lsh &> /dev/null # Kill all non-root logged-in users who | awk '$1 !~ /^root$/ { cmd = "pkill -KILL -u " $1; system(cmd) }' touch ${_pthLog}/lshell-fix-build-${_LSHELL_VRN}.log fi if [ -e "${_usrBin}/lshell" ]; then chown root:users ${_usrBin}/lshell chmod 750 ${_usrBin}/lshell if [ ! -L "/usr/bin/lshell" ]; then ln -sfn ${_usrBin}/lshell /usr/bin/lshell &> /dev/null fi fi } _fix_start_stop_ports_solr() { if [ -x "/etc/init.d/solr9" ] && [ -e "/etc/default/solr9.in.sh" ]; then _SOLR9_STOP_TEST=$(grep "STOP\.PORT=19099" /etc/default/solr9.in.sh 2>&1) _SOLR9_WAIT_TEST=$(grep "SOLR_START_WAIT=" /etc/default/solr9.in.sh 2>&1) if [ ! -e "/var/log/boa/solr9.in.004.fixed.pid" ] \ || [[ ! "${_SOLR9_STOP_TEST}" =~ "19099" ]] \ || [[ ! "${_SOLR9_WAIT_TEST}" =~ "10" ]]; then sed -i "s/^SOLR_STOP_PORT.*//g" /etc/default/solr9.in.sh sed -i "s/^SOLR_STOP_KEY.*//g" /etc/default/solr9.in.sh sed -i "s/.*mycustomkey9.*//g" /etc/default/solr9.in.sh sed -i "s/.*_WAIT.*//g" /etc/default/solr9.in.sh echo "SOLR_OPTS=\"\$SOLR_OPTS -DSTOP.PORT=19099 -DSTOP.KEY=mycustomkey9\"" >> /etc/default/solr9.in.sh echo "SOLR_START_WAIT=\"10\"" >> /etc/default/solr9.in.sh echo "SOLR_STOP_WAIT=\"10\"" >> /etc/default/solr9.in.sh echo "SOLR_WAIT_FOR_ZK=\"10\"" >> /etc/default/solr9.in.sh sed -i "/^$/d" /etc/default/solr9.in.sh echo "_restartSolr9 at $(date)" >> ${_pthLog}/_fix_start_stop_ports_solr.log touch /var/log/boa/solr9.in.004.fixed.pid service solr9 restart fi fi if [ -x "/etc/init.d/solr7" ] && [ -e "/etc/default/solr7.in.sh" ]; then _SOLR7_STOP_TEST=$(grep "STOP\.PORT=17077" /etc/default/solr7.in.sh 2>&1) _SOLR7_WAIT_TEST=$(grep "SOLR_START_WAIT=" /etc/default/solr7.in.sh 2>&1) if [ ! -e "/var/log/boa/solr7.in.004.fixed.pid" ] \ || [[ ! "${_SOLR7_STOP_TEST}" =~ "17077" ]] \ || [[ ! "${_SOLR7_WAIT_TEST}" =~ "10" ]]; then sed -i "s/^SOLR_STOP_PORT.*//g" /etc/default/solr7.in.sh sed -i "s/^SOLR_STOP_KEY.*//g" /etc/default/solr7.in.sh sed -i "s/.*mycustomkey7.*//g" /etc/default/solr7.in.sh sed -i "s/.*_WAIT.*//g" /etc/default/solr7.in.sh echo "SOLR_OPTS=\"\$SOLR_OPTS -DSTOP.PORT=17077 -DSTOP.KEY=mycustomkey7\"" >> /etc/default/solr7.in.sh echo "SOLR_START_WAIT=\"10\"" >> /etc/default/solr7.in.sh echo "SOLR_STOP_WAIT=\"10\"" >> /etc/default/solr7.in.sh echo "SOLR_WAIT_FOR_ZK=\"10\"" >> /etc/default/solr7.in.sh sed -i "/^$/d" /etc/default/solr7.in.sh echo "_restartSolr7 at $(date)" >> ${_pthLog}/_fix_start_stop_ports_solr.log touch /var/log/boa/solr7.in.004.fixed.pid service solr7 restart fi fi if [ -x "/etc/init.d/jetty9" ]; then _restartSolr4=FALSE _ctrl_jetty_nr=$(ls -la /tmp/jetty-0.0.0.0-8099-solr.war* | wc -l 2>&1) if [[ ! "${_ctrl_jetty_nr}" =~ "No such file" ]] && [ "${_ctrl_jetty_nr}" -gt 8 ]; then _restartSolr4=TRUE fi if [ "${_restartSolr4}" = "TRUE" ]; then if [ ! -x "/etc/init.d/jenkins" ] && [ ! -e "/var/lib/jenkins" ]; then find /tmp -mindepth 1 -user jetty9 -exec rm -rf {} + 2>/dev/null pkill -9 -f jetty9 echo "_restartSolr4 at $(date)" >> ${_pthLog}/_fix_start_stop_ports_solr.log fi fi fi } _fix_log4j_solr7() { _LOG4J_VRN=2.17.1 _DO_SOLR_RESTART= if [ -x "/etc/init.d/solr7" ] && [ -e "/etc/default/solr7.in.sh" ]; then if [ -e "/opt/solr-7.7.3" ] \ && [ ! -e "/opt/solr-7.7.3/server/lib/ext/log4j-core-${_LOG4J_VRN}.jar" ]; then cd /var/opt rm -rf apache-log4j* _get_dev_src "apache-log4j-${_LOG4J_VRN}-bin.tar.gz" if [ -e "/var/opt/apache-log4j-${_LOG4J_VRN}-bin/log4j-core-${_LOG4J_VRN}.jar" ]; then cd /var/opt/apache-log4j-${_LOG4J_VRN}-bin [ -d "/var/backups/log4j/solr-7.7.3" ] || mkdir -p /var/backups/log4j/solr-7.7.3 mv -f /opt/solr-7.7.3/server/lib/ext/log4j* /var/backups/log4j/solr-7.7.3/ rm -f /opt/solr-7.7.3/contrib/prometheus-exporter/lib/log4j* cp -af log4j-1.2-api-${_LOG4J_VRN}.jar /opt/solr-7.7.3/server/lib/ext/ cp -af log4j-core-${_LOG4J_VRN}.jar /opt/solr-7.7.3/server/lib/ext/ cp -af log4j-core-${_LOG4J_VRN}.jar /opt/solr-7.7.3/contrib/prometheus-exporter/lib/ cp -af log4j-slf4j-impl-${_LOG4J_VRN}.jar /opt/solr-7.7.3/server/lib/ext/ cp -af log4j-slf4j-impl-${_LOG4J_VRN}.jar /opt/solr-7.7.3/contrib/prometheus-exporter/lib/ cp -af log4j-api-${_LOG4J_VRN}.jar /opt/solr-7.7.3/server/lib/ext/ cp -af log4j-api-${_LOG4J_VRN}.jar /opt/solr-7.7.3/contrib/prometheus-exporter/lib/ chown root:root /opt/solr-7.7.3/server/lib/ext/log4j* chown root:root /opt/solr-7.7.3/contrib/prometheus-exporter/lib/log4j* _DO_SOLR_RESTART=YES fi fi if [ -e "/opt/solr-7.6.0" ] \ && [ ! -e "/opt/solr-7.6.0/server/lib/ext/log4j-core-${_LOG4J_VRN}.jar" ]; then cd /var/opt rm -rf apache-log4j* _get_dev_src "apache-log4j-${_LOG4J_VRN}-bin.tar.gz" if [ -e "/var/opt/apache-log4j-${_LOG4J_VRN}-bin/log4j-core-${_LOG4J_VRN}.jar" ]; then cd /var/opt/apache-log4j-${_LOG4J_VRN}-bin [ -d "/var/backups/log4j/solr-7.6.0" ] || mkdir -p /var/backups/log4j/solr-7.6.0 mv -f /opt/solr-7.6.0/server/lib/ext/log4j* /var/backups/log4j/solr-7.6.0/ rm -f /opt/solr-7.6.0/contrib/prometheus-exporter/lib/log4j* cp -af log4j-1.2-api-${_LOG4J_VRN}.jar /opt/solr-7.6.0/server/lib/ext/ cp -af log4j-core-${_LOG4J_VRN}.jar /opt/solr-7.6.0/server/lib/ext/ cp -af log4j-core-${_LOG4J_VRN}.jar /opt/solr-7.6.0/contrib/prometheus-exporter/lib/ cp -af log4j-slf4j-impl-${_LOG4J_VRN}.jar /opt/solr-7.6.0/server/lib/ext/ cp -af log4j-slf4j-impl-${_LOG4J_VRN}.jar /opt/solr-7.6.0/contrib/prometheus-exporter/lib/ cp -af log4j-api-${_LOG4J_VRN}.jar /opt/solr-7.6.0/server/lib/ext/ cp -af log4j-api-${_LOG4J_VRN}.jar /opt/solr-7.6.0/contrib/prometheus-exporter/lib/ chown root:root /opt/solr-7.6.0/server/lib/ext/log4j* chown root:root /opt/solr-7.6.0/contrib/prometheus-exporter/lib/log4j* _DO_SOLR_RESTART=YES fi fi _RESULT_LOG4J=$(grep "LOG4J_FORMAT_MSG_NO_LOOKUPS=true" /etc/default/solr7.in.sh 2>&1) if [[ ! "${_RESULT_LOG4J}" =~ "LOG4J" ]]; then echo "LOG4J_FORMAT_MSG_NO_LOOKUPS=true" >> /etc/default/solr7.in.sh fi if [[ ! "${_RESULT_LOG4J}" =~ "LOG4J" ]] || [ ! -z "${_DO_SOLR_RESTART}" ]; then #pkill -9 -f solr7 service solr7 restart &> /dev/null fi fi } _fix_authorized_keys() { if [ ! -e "${_pthLog}/_fix_authorized_keys.ctrl.${_tRee}.${_xSrl}.pid" ]; then chmod 0600 /home/*/.ssh/authorized_keys &> /dev/null chmod 0700 /home/*/.ssh &> /dev/null touch ${_pthLog}/_fix_authorized_keys.ctrl.${_tRee}.${_xSrl}.pid fi } _fix_aio() { _AIO_FIX=$(grep "fs.aio-max-nr" /etc/sysctl.conf 2>&1) if [ -z "${_AIO_FIX}" ]; then echo "fs.aio-max-nr = 1048576" >> /etc/sysctl.conf fi } _fix_console_print() { _PRK_FIX=$(grep "kernel.printk" /etc/sysctl.conf 2>&1) if [ -z "${_PRK_FIX}" ]; then echo "kernel.printk = 4 1 1 7" >> /etc/sysctl.conf fi } _fix_java_symlinks() { if [ "${_OS_CODE}" = "jessie" ] && [ -x "/usr/lib/jvm/java-7-openjdk/jre/bin/java" ]; then if [ ! -e "/usr/bin/java" ] || [ ! -e "/etc/alternatives/java" ]; then ln -sfn /usr/lib/jvm/java-7-openjdk/jre/bin/java /etc/alternatives/java ln -sfn /etc/alternatives/java /usr/bin/java echo fixed java symlinks for ${_OS_CODE} fi fi if [ "${_OS_CODE}" = "stretch" ] && [ -x "/usr/lib/jvm/java-8-openjdk/jre/bin/java" ]; then if [ ! -e "/usr/bin/java" ] || [ ! -e "/etc/alternatives/java" ]; then ln -sfn /usr/lib/jvm/java-8-openjdk/jre/bin/java /etc/alternatives/java ln -sfn /etc/alternatives/java /usr/bin/java echo fixed java symlinks for ${_OS_CODE} fi fi if [ "${_OS_CODE}" = "excalibur" ] \ || [ "${_OS_CODE}" = "daedalus" ] \ || [ "${_OS_CODE}" = "chimaera" ]; then if [ ! -e "/usr/lib/jvm/java-21-openjdk" ] \ && [ -d "/usr/lib/jvm/java-21-openjdk-amd64" ]; then ln -sfn /usr/lib/jvm/java-21-openjdk-amd64 /usr/lib/jvm/java-21-openjdk fi if [ ! -e "/usr/bin/java21" ] \ && [ -e "/usr/lib/jvm/java-21-openjdk-amd64/bin/java" ]; then ln -sfn /usr/lib/jvm/java-21-openjdk-amd64/bin/java /usr/bin/java21 fi if [ ! -e "/usr/lib/jvm/java-17-openjdk" ] \ && [ -d "/usr/lib/jvm/java-17-openjdk-amd64" ]; then ln -sfn /usr/lib/jvm/java-17-openjdk-amd64 /usr/lib/jvm/java-17-openjdk fi if [ ! -e "/usr/bin/java17" ] \ && [ -e "/usr/lib/jvm/java-17-openjdk-amd64/bin/java" ]; then ln -sfn /usr/lib/jvm/java-17-openjdk-amd64/bin/java /usr/bin/java17 fi if [ ! -e "/usr/lib/jvm/java-11-openjdk" ] \ && [ -d "/usr/lib/jvm/java-11-openjdk-amd64" ]; then ln -sfn /usr/lib/jvm/java-11-openjdk-amd64 /usr/lib/jvm/java-11-openjdk fi if [ ! -e "/usr/bin/java11" ] \ && [ -e "/usr/lib/jvm/java-11-openjdk-amd64/bin/java" ]; then ln -sfn /usr/lib/jvm/java-11-openjdk-amd64/bin/java /usr/bin/java11 fi if [ -x "/etc/init.d/jenkins" ] && [ -e "/var/lib/jenkins" ]; then _LOOK_LIKE_JENKINS=TRUE elif [ -e "/root/.look.like.jenkins.cnf" ]; then _LOOK_LIKE_JENKINS=TRUE else _LOOK_LIKE_JENKINS=FALSE fi if [ "${_LOOK_LIKE_JENKINS}" = "TRUE" ] \ || [ "${_OS_CODE}" = "daedalus" ] \ || [ "${_OS_CODE}" = "excalibur" ]; then if [ -x "/usr/lib/jvm/java-17-openjdk/bin/java" ] \ && [ ! -e "/var/log/boa/.fixed-java17-symlinks.log" ]; then if [ -e "/usr/lib/jvm/java-17-openjdk-amd64" ]; then rm -f /usr/lib/jvm/default-java ln -sfn /usr/lib/jvm/java-17-openjdk-amd64 /usr/lib/jvm/default-java fi ln -sfn /usr/lib/jvm/java-17-openjdk/bin/java /etc/alternatives/java ln -sfn /etc/alternatives/java /usr/bin/java touch /var/log/boa/.fixed-java17-symlinks.log echo "Fixed Java 17 symlinks for ${_OS_CODE}" fi if [ -x "/usr/lib/jvm/java-21-openjdk/bin/java" ] \ && [ ! -e "/var/log/boa/.fixed-java21-symlinks.log" ]; then if [ -e "/usr/lib/jvm/java-21-openjdk-amd64" ]; then rm -f /usr/lib/jvm/default-java ln -sfn /usr/lib/jvm/java-21-openjdk-amd64 /usr/lib/jvm/default-java fi ln -sfn /usr/lib/jvm/java-21-openjdk/bin/java /etc/alternatives/java ln -sfn /etc/alternatives/java /usr/bin/java touch /var/log/boa/.fixed-java21-symlinks.log echo "Fixed Java 21 symlinks for ${_OS_CODE}" fi else if [ -x "/usr/lib/jvm/java-11-openjdk/bin/java" ]; then if [ -e "/usr/lib/jvm/java-11-openjdk-amd64" ]; then rm -f /usr/lib/jvm/default-java ln -sfn /usr/lib/jvm/java-11-openjdk-amd64 /usr/lib/jvm/default-java fi if [ ! -e "/usr/bin/java" ] || [ ! -e "/etc/alternatives/java" ]; then ln -sfn /usr/lib/jvm/java-11-openjdk/bin/java /etc/alternatives/java ln -sfn /etc/alternatives/java /usr/bin/java echo "Fixed Java 11 symlinks for ${_OS_CODE}" fi fi fi else if [ -x "/usr/lib/jvm/java-11-openjdk/bin/java" ]; then if [ ! -e "/usr/bin/java" ] || [ ! -e "/etc/alternatives/java" ]; then ln -sfn /usr/lib/jvm/java-11-openjdk/bin/java /etc/alternatives/java ln -sfn /etc/alternatives/java /usr/bin/java echo "Fixed Java 11 symlinks for ${_OS_CODE}" fi fi fi } _fix_composer_version() { _COMPOSER_VRN=2.8.2 if [ -x "/usr/local/bin/composer" ]; then _COMPOSER_IS=$(composer --no-interaction --version 2>&1 \ | tr -d "\n" \ | cut -d" " -f35 \ | awk '{ print $1}' 2>&1) if [ "${_COMPOSER_IS}" != "${_COMPOSER_VRN}" ]; then composer self-update ${_COMPOSER_VRN} &> /dev/null fi fi } _fix_sftp_server() { if [ -e "/etc/ssh/sshd_config" ]; then _SFTP_UMASK_TEST=$(grep "sftp-server -u 0002" /etc/ssh/sshd_config 2>&1) if [[ ! "${_SFTP_UMASK_TEST}" =~ "sftp-server -u 0002" ]]; then sed -i "s/^Subsystem.*//g" /etc/ssh/sshd_config echo "Subsystem sftp /usr/lib/openssh/sftp-server -u 0002" >> /etc/ssh/sshd_config sed -i "/^$/d" /etc/ssh/sshd_config service ssh restart 2> /dev/null fi fi } _fix_wkhtml_perms() { _WKHTML_ARRAY="/usr/local/bin/wkhtmltopdf \ /usr/bin/wkhtmltopdf \ /usr/bin/wkhtmltopdf-0.12.4 \ /usr/local/bin/wkhtmltoimage \ /usr/bin/wkhtmltoimage \ /usr/bin/wkhtmltoimage-0.12.4" for _WKHTML_ITEM in ${_WKHTML_ARRAY}; do if [ -x "${_WKHTML_ITEM}" ]; then _PERM_TEST=$(ls -la ${_WKHTML_ITEM} | grep rwxr-xr-x 2>&1) if [ -z "${_PERM_TEST}" ]; then chgrp root ${_WKHTML_ITEM} &> /dev/null chmod 755 ${_WKHTML_ITEM} &> /dev/null fi fi done } _fix_wkhtml() { if [ -x "/usr/local/bin/wkhtmltopdf" ] \ && [ -L "/usr/bin/wkhtmltopdf" ]; then rm -f /usr/bin/wkhtmltopdf cp -af /usr/local/bin/wkhtmltopdf /usr/bin/wkhtmltopdf chgrp root /usr/bin/wkhtmltopdf &> /dev/null chmod 755 /usr/bin/wkhtmltopdf &> /dev/null fi if [ -x "/usr/local/bin/wkhtmltoimage" ] \ && [ -L "/usr/bin/wkhtmltoimage" ]; then rm -f /usr/bin/wkhtmltoimage cp -af /usr/local/bin/wkhtmltoimage /usr/bin/wkhtmltoimage chgrp root /usr/bin/wkhtmltoimage &> /dev/null chmod 755 /usr/bin/wkhtmltoimage &> /dev/null fi if [ -x "/usr/local/bin/wkhtmltopdf" ] \ && [ ! -e "/usr/bin/wkhtmltopdf" ]; then cp -af /usr/local/bin/wkhtmltopdf /usr/bin/wkhtmltopdf chgrp root /usr/bin/wkhtmltopdf &> /dev/null chmod 755 /usr/bin/wkhtmltopdf &> /dev/null fi if [ -x "/usr/local/bin/wkhtmltoimage" ] \ && [ ! -e "/usr/bin/wkhtmltoimage" ]; then cp -af /usr/local/bin/wkhtmltoimage /usr/bin/wkhtmltoimage chgrp root /usr/bin/wkhtmltoimage &> /dev/null chmod 755 /usr/bin/wkhtmltoimage &> /dev/null fi if [ ! -x "/usr/local/bin/wkhtmltopdf" ] \ && [ -x "/usr/bin/wkhtmltopdf" ]; then rm -f /usr/local/bin/wkhtmltopdf cp -af /usr/bin/wkhtmltopdf /usr/local/bin/wkhtmltopdf chgrp root /usr/local/bin/wkhtmltopdf &> /dev/null chmod 755 /usr/local/bin/wkhtmltopdf &> /dev/null fi if [ ! -x "/usr/local/bin/wkhtmltoimage" ] \ && [ -x "/usr/bin/wkhtmltoimage" ]; then rm -f /usr/local/bin/wkhtmltoimage cp -af /usr/bin/wkhtmltoimage /usr/local/bin/wkhtmltoimage chgrp root /usr/local/bin/wkhtmltoimage &> /dev/null chmod 755 /usr/local/bin/wkhtmltoimage &> /dev/null fi } _fix_eldir() { if [ -e "/var/xdrago" ] \ && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "${_eldirP}" ]; then mkdir -p /var/xdrago/conf curl ${_crlGet} "${_urlHmr}/patches/${_eldirF}" -o ${_eldirP} fi } _if_drupal_patches_update() { if [ -e "/var/xdrago" ]; then _BROKEN_UPDATE_TEST_A=$(grep "Under Construction" /data/conf/patches/* 2>&1) _BROKEN_UPDATE_TEST_B=$(grep "404 Not Found" /data/conf/patches/* 2>&1) if [ ! -z "${_BROKEN_UPDATE_TEST_A}" ] \ || [ ! -z "${_BROKEN_UPDATE_TEST_B}" ] \ || [ ! -e "/data/conf/patches/ctrl.f96.${_tRee}.${_xSrl}.pid" ]; then mkdir -p /data/conf/patches rm -f /data/conf/patches/* touch /data/conf/patches/ctrl.f96.${_tRee}.${_xSrl}.pid fi fi } _fix_drupal_core_ten() { if [ -e "/var/xdrago" ]; then if [ ! -e "${_tenCorePatchPath}" ]; then mkdir -p /data/conf/patches curl ${_crlGet} "${_urlHmr}/patches/${_tenCorePatchFname}" -o ${_tenCorePatchPath} fi if [ ! -e "${_tenConsolePatchPath}" ]; then mkdir -p /data/conf/patches curl ${_crlGet} "${_urlHmr}/patches/${_tenConsolePatchFname}" -o ${_tenConsolePatchPath} fi fi } _fix_drupal_core_eleven() { if [ -e "/var/xdrago" ]; then if [ ! -e "${_elevenCorePatchPath}" ]; then mkdir -p /data/conf/patches curl ${_crlGet} "${_urlHmr}/patches/${_elevenCorePatchFname}" -o ${_elevenCorePatchPath} fi if [ ! -e "${_elevenConsolePatchPath}" ]; then mkdir -p /data/conf/patches curl ${_crlGet} "${_urlHmr}/patches/${_elevenConsolePatchFname}" -o ${_elevenConsolePatchPath} fi if [ ! -e "${_elevenValidatorPatchPath}" ]; then mkdir -p /data/conf/patches curl ${_crlGet} "${_urlHmr}/patches/${_elevenValidatorPatchFname}" -o ${_elevenValidatorPatchPath} fi fi } _fix_pure_ftpd() { if [ -e "/usr/local/etc/pure-ftpd.conf" ]; then _PAM_AUTH=$(grep "^PAMAuthentication" /usr/local/etc/pure-ftpd.conf 2>&1) if [ ! -z "${_PAM_AUTH}" ]; then sed -i "s/^PAMAuthentication/# PAMAuthentication/g" /usr/local/etc/pure-ftpd.conf killall -9 pure-ftpd &> /dev/null fi fi } _fix_hosting_le() { if [ -d "/var/xdrago/conf" ]; then if [ ! -e "${_hoLeIncFull}.ctrl.${_tRee}.${_xSrl}.pid" ] \ || [ ! -e "${_pthLog}/dehydrated-up01.ctrl.${_tRee}.${_xSrl}.pid" ] \ || [ -e "/var/xdrago/${_provLeInc}" ] \ || [ -e "/var/xdrago/${_hoLeInc}" ] \ || [ -e "/var/xdrago/${_dehydName}" ] \ || [ -e "/root/${_provLeInc}" ] \ || [ -e "/root/hosting_le_vhost.drush.inc.ctrl.${_tRee}.${_xSrl}.pid" ] \ || [ -e "/root/${_hoLeInc}" ] \ || [ -e "${_legacyLeSh}" ] \ || [ ! -e "${_dehydSrcPath}" ] \ || [ ! -e "${_provLeIncFull}.ctrl.${_tRee}.${_xSrl}.pid" ]; then mkdir -p /var/xdrago/conf rm -f /var/xdrago/*.drush.inc* rm -f /root/*.drush.inc* rm -f ${_legacyLeSh} rm -f ${_dehydSrcPath}.ctrl.${_tRee}.${_xSrl}.pid rm -f ${_hoLeIncFull}.ctrl.${_tRee}.${_xSrl}.pid rm -f ${_provLeIncFull}.ctrl.${_tRee}.${_xSrl}.pid curl ${_crlGet} "${_urlHmr}/helpers/${_dehydName}" -o ${_dehydSrcPath}.ctrl.${_tRee}.${_xSrl}.pid cp -af ${_dehydSrcPath}.ctrl.${_tRee}.${_xSrl}.pid ${_dehydSrcPath} curl ${_crlGet} "${_urlHmr}/patches/${_hoLeInc}" -o ${_hoLeIncFull}.ctrl.${_tRee}.${_xSrl}.pid cp -af ${_hoLeIncFull}.ctrl.${_tRee}.${_xSrl}.pid ${_hoLeIncFull} curl ${_crlGet} "${_urlHmr}/patches/${_provLeInc}" -o ${_provLeIncFull}.ctrl.${_tRee}.${_xSrl}.pid if [ -e "${_provLeIncFull}.ctrl.${_tRee}.${_xSrl}.pid" ]; then cp -af ${_provLeIncFull}.ctrl.${_tRee}.${_xSrl}.pid ${_provLeIncFull} [ -e "${_provLeIncFull}" ] && touch ${_pthLog}/dehydrated-up01.ctrl.${_tRee}.${_xSrl}.pid fi fi fi } _fix_newrelic() { _PHP_EXT_DIR_84="/opt/php84/lib/php/extensions/no-debug-non-zts-20240924" _NR_SO="/usr/lib/newrelic-php5/agent/x64/newrelic-20240924.so" if [ -e "${_PHP_EXT_DIR_84}" ] \ && [ -e "${_NR_SO}" ] \ && [ ! -e "${_PHP_EXT_DIR_84}/newrelic.so" ]; then ln -sfn ${_NR_SO} ${_PHP_EXT_DIR_84}/newrelic.so service php84-fpm reload fi _PHP_EXT_DIR_74="/opt/php74/lib/php/extensions/no-debug-non-zts-20190902" _NR_SO="/usr/lib/newrelic-php5/agent/x64/newrelic-20190902.so" if [ -e "${_PHP_EXT_DIR_74}" ] \ && [ -e "${_NR_SO}" ] \ && [ ! -e "${_PHP_EXT_DIR_74}/newrelic.so" ]; then ln -sfn ${_NR_SO} ${_PHP_EXT_DIR_74}/newrelic.so service php74-fpm reload fi _PHP_EXT_DIR_71="/opt/php71/lib/php/extensions/no-debug-non-zts-20160303" _NR_SO="/usr/lib/newrelic-php5/agent/x64/newrelic-20160303.so" if [ -e "${_PHP_EXT_DIR_71}" ] \ && [ ! -e "${_NR_SO}" ] \ && [ -L "${_PHP_EXT_DIR_71}/newrelic.so" ]; then rm -f ${_PHP_EXT_DIR_71}/newrelic.so service php71-fpm reload fi _PHP_EXT_DIR_70="/opt/php70/lib/php/extensions/no-debug-non-zts-20151012" _NR_SO="/usr/lib/newrelic-php5/agent/x64/newrelic-20151012.so" if [ -e "${_PHP_EXT_DIR_70}" ] \ && [ ! -e "${_NR_SO}" ] \ && [ -L "${_PHP_EXT_DIR_70}/newrelic.so" ]; then rm -f ${_PHP_EXT_DIR_70}/newrelic.so service php70-fpm reload fi _PHP_EXT_DIR_56="/opt/php56/lib/php/extensions/no-debug-non-zts-20131226" _NR_SO="/usr/lib/newrelic-php5/agent/x64/newrelic-20131226.so" if [ -e "${_PHP_EXT_DIR_56}" ] \ && [ ! -e "${_NR_SO}" ] \ && [ -L "${_PHP_EXT_DIR_56}/newrelic.so" ]; then rm -f ${_PHP_EXT_DIR_56}/newrelic.so service php56-fpm reload fi } _fix_leftovers() { if [ -e "/data/disk/arch/static/control" ]; then rm -rf /data/disk/arch/static fi } _force_rebuild() { if [ ! -e "${_pthLog}/forced.rebuild.glibc.txt" ]; then echo "_GIT_FORCE_REINSTALL=YES" >> ${_barCnf} echo "_NGX_FORCE_REINSTALL=YES" >> ${_barCnf} echo "_PHP_FORCE_REINSTALL=YES" >> ${_barCnf} echo "_SSH_FORCE_REINSTALL=YES" >> ${_barCnf} echo "_SSL_FORCE_REINSTALL=YES" >> ${_barCnf} rm -f ${_pthLog}/pure-ftpd-build* rm -f ${_pthLog}/mss-build* rm -f ${_pthLog}/lshell-build* rm -f ${_pthLog}/redis-* rm -f ${_pthLog}/valkey-* touch ${_pthLog}/forced.rebuild.glibc.txt fi } # # Detect, remove, and report broken symlinks _check_and_remove_broken_symlinks() { local _dir=$1 # Find broken symlinks in the directory _broken_symlinks=$(find "${_dir}" -maxdepth 1 -type l ! -exec test -e {} \; -print) if [ -n "${_broken_symlinks}" ]; then if [ "${_DEBUG_MODE}" = "YES" ]; then echo "CLNP: Removing the following broken symlinks from ${_dir}:" echo "CLNP: ${_broken_symlinks}" fi for _symlink in ${_broken_symlinks}; do rm "${_symlink}" if [ "${_DEBUG_MODE}" = "YES" ]; then echo "CLNP: Removed broken symlink: ${_symlink}" fi done # Set the _ifAnySymlinksCleaned variable to true since we removed broken symlinks _ifAnySymlinksCleaned=YES else if [ "${_DEBUG_MODE}" = "YES" ]; then echo "CLNP: No broken symlinks found in ${_dir}" fi fi } # # Check and move disallowed versions _check_and_move() { local _dir=$1 # Determine the name of the backup subdirectory based on the source directory local _backup_dir="${_backLegBase}$(echo "${_dir}" | tr '/' '_')" # Find any libcurl.so files in the directory, excluding the allowed version and those without a complete version number _found_versions=$(find "${_dir}" -maxdepth 1 -type f -name "libcurl.so.*" ! -name "${_allowedFile}" | grep -E "libcurl\.so\.[0-9]+\.[0-9]+\.[0-9]+$") if [ -n "${_found_versions}" ]; then if [ "${_DEBUG_MODE}" = "YES" ]; then echo "CLNP: Moving the following disallowed versions from ${_dir} to ${_backup_dir}:" echo "CLNP: ${_found_versions}" fi # Create the backup directory if it doesn't exist mkdir -p "${_backup_dir}" # Move each found version to the backup directory for _file in ${_found_versions}; do mv -f "${_file}" "${_backup_dir}/" if [ "${_DEBUG_MODE}" = "YES" ]; then echo "CLNP: Moved ${_file} to ${_backup_dir}/" fi done # Set the _ifAnyFilesCleaned variable to true since we moved files _ifAnyFilesCleaned=YES else if [ "${_DEBUG_MODE}" = "YES" ]; then echo "CLNP: Only the allowed version (${_allowedFile}) is present in ${_dir}" fi fi } _if_reinstall_curl() { _CURL_VRN=8.20.0 _CURL_INSTALL_REQUIRED=NO if ! command -v lsb_release &> /dev/null; then apt-get update -qq &> /dev/null apt-get install lsb-release ${_aptYesUnth} -qq &> /dev/null fi _OS_CODE=$(lsb_release -ar 2>/dev/null | grep -i codename | cut -s -f2) [ "${_OS_CODE}" = "wheezy" ] && _CURL_VRN=7.50.1 [ "${_OS_CODE}" = "jessie" ] && _CURL_VRN=7.71.1 [ "${_OS_CODE}" = "stretch" ] && _CURL_VRN=8.2.1 if [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ "${_OS_CODE}" != "jessie" ] \ && [ "${_OS_CODE}" != "stretch" ]; then # Target version _allowedFile="libcurl.so.4.8.0" # Directories to check _dirsToClean=("/usr/lib" "/usr/local/lib" "/usr/lib/x86_64-linux-gnu") # Backup base directory _backLegBase="/var/backups/legacy-libcurl-boa-${_NOW}" # Variable to track if any files were moved _ifAnyFilesCleaned=NO # Variable to track if any broken symlinks were found and removed _ifAnySymlinksCleaned=NO # Iterate over the directories and apply the _check_and_move function for _dir in "${_dirsToClean[@]}"; do _check_and_move "${_dir}" done # Iterate over the directories and apply the _check_and_remove_broken_symlinks function for _dir in "${_dirsToClean[@]}"; do _check_and_remove_broken_symlinks "${_dir}" done # Export the _ifAnyFilesCleaned variable for later use export _ifAnyFilesCleaned # Export the _ifAnySymlinksCleaned variable for later use export _ifAnySymlinksCleaned fi if [ "${_ifAnySymlinksCleaned}" = "YES" ] \ || [ "${_ifAnyFilesCleaned}" = "YES" ]; then ldconfig 2> /dev/null _CURL_INSTALL_REQUIRED=YES _bkLibcurlPre="/var/backups/legacy-libcurl-pre-${_CURL_VRN}-${_NOW}" mkdir -p ${_bkLibcurlPre} mv -f /usr/lib/x86_64-linux-gnu/libcurl.so* ${_bkLibcurlPre}/ &> /dev/null mv -f /usr/lib/x86_64-linux-gnu/libcurl.la ${_bkLibcurlPre}/ &> /dev/null mv -f /usr/lib/x86_64-linux-gnu/libcurl.a ${_bkLibcurlPre}/ &> /dev/null fi _isCurl=$(curl --version 2>&1) if [[ ! "${_isCurl}" =~ "OpenSSL" ]] \ || [[ "${_isCurl}" =~ "libcurl.so.4" ]] \ || [ -z "${_isCurl}" ] \ || [ "${_ifAnySymlinksCleaned}" = "YES" ] \ || [ "${_ifAnyFilesCleaned}" = "YES" ] \ || [ "${_CURL_INSTALL_REQUIRED}" = "YES" ]; then if [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ]; then echo "OOPS: cURL is broken! Re-installing.." fi if [ ! -e "/etc/apt/apt.conf.d/00sandboxoff" ] \ && [ -e "/etc/apt/apt.conf.d" ]; then echo "APT::Sandbox::User \"root\";" > /etc/apt/apt.conf.d/00sandboxoff fi echo "curl install" | dpkg --set-selections 2> /dev/null _apt_clean_update # Check for libssl1.0-dev and remove conditionally if dpkg-query -W -f='${Status}' libssl1.0-dev 2>/dev/null | grep -q "install ok installed"; then apt-get remove libssl1.0-dev -y --purge --auto-remove -qq 2>/dev/null fi apt-get autoremove -y 2> /dev/null apt-get install libssl-dev ${_aptYesUnth} -qq 2> /dev/null apt-get build-dep curl ${_aptYesUnth} 2> /dev/null if [ ! -e "/var/aegir/.drush/hm.alias.drushrc.php" ]; then apt-get install curl --reinstall ${_aptYesUnth} -qq 2> /dev/null fi if [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ]; then echo "INFO: Installing curl from sources..." mkdir -p /var/opt rm -rf /var/opt/curl* cd /var/opt wget ${_wgetGet} http://files.aegir.cc/dev/src/curl-${_CURL_VRN}.tar.gz &> /dev/null tar -xzf curl-${_CURL_VRN}.tar.gz &> /dev/null if [ -e "/root/.install.modern.openssl.cnf" ] \ && [ -x "/usr/local/ssl3/bin/openssl" ]; then _SSL_BINARY=/usr/local/ssl3/bin/openssl else _SSL_BINARY=/usr/local/ssl/bin/openssl fi if [ -e "/usr/local/ssl3/lib64/libssl.so.3" ]; then _SSL_PATH="/usr/local/ssl3" _SSL_LIB_PATH="${_SSL_PATH}/lib64" else _SSL_PATH="/usr/local/ssl" _SSL_LIB_PATH="${_SSL_PATH}/lib" fi _PKG_CONFIG_PATH="${_SSL_LIB_PATH}/pkgconfig" if [ -e "${_PKG_CONFIG_PATH}" ] \ && [ -e "/var/opt/curl-${_CURL_VRN}" ]; then cd /var/opt/curl-${_CURL_VRN} LIBS="-ldl -lpthread" PKG_CONFIG_PATH="${_PKG_CONFIG_PATH}" ./configure \ --with-openssl \ --with-zlib=/usr \ --prefix=/usr/local &> /dev/null make -j $(nproc) --quiet &> /dev/null make --quiet install &> /dev/null ldconfig 2> /dev/null fi fi if [ -x "/usr/local/bin/curl" ] && [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ]; then _CURL_ITD=$(/usr/local/bin/curl --version 2>&1 \ | tr -d "\n" \ | cut -d" " -f2 \ | awk '{ print $1}' 2>&1) if [[ ! "${_CURL_ITD}" =~ OpenSSL ]]; then echo "ERRR: /usr/local/bin/curl is broken" echo "ERRR: Please install cURL and debug manually" else echo "GOOD: /usr/local/bin/curl works" echo "curl hold" | dpkg --set-selections &> /dev/null if [ -x "/usr/local/bin/curl" ]; then if [ -x "/usr/bin/curl" ] && [ ! -L "/usr/bin/curl" ]; then mv -f /usr/bin/curl /usr/bin/old-curl-$(date +%y%m%d-%H%M%S) fi ln -sfn /usr/local/bin/curl /usr/bin/curl fi if [ ! -e "${_SSL_PATH}/certs/ca-certificates.crt" ]; then cp -af /etc/ssl/certs/* ${_SSL_PATH}/certs/ &> /dev/null fi if [ -e "/usr/local/lib/libcurl.so.4.8.0" ]; then ln -sfn /usr/local/lib/libcurl.so.4.8.0 /usr/lib/libcurl.so ln -sfn /usr/local/lib/libcurl.so.4.8.0 /usr/lib/libcurl.so.4 ln -sfn /usr/local/lib/libcurl.so.4.8.0 /usr/lib/libcurl.so.4.8.0 ln -sfn /usr/local/lib/libcurl.so.4.8.0 /usr/lib/x86_64-linux-gnu/libcurl.so ln -sfn /usr/local/lib/libcurl.so.4.8.0 /usr/lib/x86_64-linux-gnu/libcurl.so.4 ln -sfn /usr/local/lib/libcurl.so.4.8.0 /usr/lib/x86_64-linux-gnu/libcurl.so.4.8.0 fi if [ -e "/usr/local/lib/libcurl.a" ]; then ln -sfn /usr/local/lib/libcurl.a /usr/lib/x86_64-linux-gnu/libcurl.a ln -sfn /usr/local/lib/libcurl.a /usr/lib/libcurl.a fi if [ -e "/usr/local/lib/libcurl.la" ]; then ln -sfn /usr/local/lib/libcurl.la /usr/lib/x86_64-linux-gnu/libcurl.la ln -sfn /usr/local/lib/libcurl.la /usr/lib/libcurl.la fi ldconfig 2> /dev/null if [ -e "/usr/local/include/curl/curl.h" ] \ && [ -e "/usr/local/include/curl/easy.h" ] \ && [ -d "/usr/include/x86_64-linux-gnu/curl" ] \ && [ ! -L "/usr/include/x86_64-linux-gnu/curl" ]; then _apt_clean_update if dpkg-query -W -f='${Status}' libcurl4-openssl-dev 2>/dev/null | grep -q "install ok installed"; then apt-get remove libcurl4-openssl-dev -y --purge --auto-remove -qq 2> /dev/null fi ln -sfn /usr/local/include/curl /usr/include/x86_64-linux-gnu/curl ldconfig 2> /dev/null fi fi fi fi } _if_boa_key_tools_update_allowed() { if [ -e "/root/.run-to-excalibur.cnf" ] \ || [ -e "/root/.run-to-daedalus.cnf" ] \ || [ -e "/root/.run-to-chimaera.cnf" ] \ || [ -e "/root/.run-to-beowulf.cnf" ]; then _BOA_KEY_TOOLS_UPDATE_ALLOWED=NO else _BOA_KEY_TOOLS_UPDATE_ALLOWED=YES fi } _update_boa_tools() { mkdir -p ${_usrBin} if [ -e "${_pthLog}" ] && [ ! -e "${_pthLog}/updateFx30.ctrl.${_tRee}.${_xSrl}.pid" ]; then _fxPp="fix-drupal-platform-permissions.sh" _fxSp="fix-drupal-site-permissions.sh" _fxPo="fix-drupal-platform-ownership.sh" _fxSo="fix-drupal-site-ownership.sh" _fxLo="lock-local-drush-permissions.sh" curl ${_crlGet} "${_urlHmr}/${_tBn}/${_fxPp}" -o ${_usrBin}/${_fxPp} curl ${_crlGet} "${_urlHmr}/${_tBn}/${_fxSp}" -o ${_usrBin}/${_fxSp} curl ${_crlGet} "${_urlHmr}/${_tBn}/${_fxPo}" -o ${_usrBin}/${_fxPo} curl ${_crlGet} "${_urlHmr}/${_tBn}/${_fxSo}" -o ${_usrBin}/${_fxSo} curl ${_crlGet} "${_urlHmr}/${_tBn}/${_fxLo}" -o ${_usrBin}/${_fxLo} chmod 700 ${_usrBin}/${_fxPp} chmod 700 ${_usrBin}/${_fxSp} chmod 700 ${_usrBin}/${_fxPo} chmod 700 ${_usrBin}/${_fxSo} chmod 700 ${_usrBin}/${_fxLo} touch ${_pthLog}/updateFx30.ctrl.${_tRee}.${_xSrl}.pid fi mkdir -p ${_optBin} _boaBins="aptcleanup \ aptfast \ autobeowulf \ autochimaera \ autodaedalus \ autoexcalibur \ autoinit \ automini \ autosymlink \ autoupboa \ backboa \ backchain \ barracuda \ boa \ codebasecheck \ copydbackup \ dcysetup \ dhcpfix \ duobackboa \ fancynow \ ffdevuan \ ffmirror \ fixmounts \ fixrepo \ killer \ loadguard \ lock.inc \ memorytuner \ mergecsf \ multiback \ mybackup \ mycnfup \ mysqltuner5 \ mysqltuner8 \ octopus \ perftest \ randpass \ renameaegirhost \ screenfetch \ setprio \ smtpgapps \ sqlclean \ sqlmagic \ syncpass \ synproxy \ synproxy_hook_fix \ synproxy_monitor \ synproxy_reassert \ synproxy_rollback \ synproxy_snapshot \ synproxy_status \ thinkdifferent \ updatesymlinks \ verifyvhostsdns \ vhostcheck \ vmnetfix \ weblogx \ webserver \ websh \ xboa \ xcopy" for _cbn in ${_boaBins}; do if [ -e "${_optBin}/${_cbn}" ]; then _CNT=$(pgrep -fc /local/bin/${_cbn}) if (( _CNT > 0 )); then echo "The ${_cbn} is running!" else _CNT=$(pgrep -fc /var/xdrago/daily.sh) if [ "${_cbn}" = "weblogx" ] && (( _CNT > 0 )); then echo "The ${_cbn} and daily.sh is running!" else rm -f ${_optBin}/${_cbn}.new if [ "${_cbn}" = "mysqltuner5" ] || [ "${_cbn}" = "mysqltuner8" ]; then curl ${_crlGet} "${_urlHmr}/helpers/${_cbn}" -o ${_optBin}/${_cbn}.new else curl ${_crlGet} "${_urlHmr}/${_tBn}/${_cbn}" -o ${_optBin}/${_cbn}.new fi mv -f ${_optBin}/${_cbn} ${_optBin}/${_cbn}.prev mv -f ${_optBin}/${_cbn}.new ${_optBin}/${_cbn} if [ -e "${_optBin}/${_cbn}" ]; then chmod 755 ${_optBin}/${_cbn} rm -f ${_optBin}/${_cbn}.prev else mv -f ${_optBin}/${_cbn}.prev ${_optBin}/${_cbn} fi fi fi else if [ "${_cbn}" = "mysqltuner5" ] || [ "${_cbn}" = "mysqltuner8" ]; then curl ${_crlGet} "${_urlHmr}/helpers/${_cbn}" -o ${_optBin}/${_cbn} else curl ${_crlGet} "${_urlHmr}/${_tBn}/${_cbn}" -o ${_optBin}/${_cbn} fi fi done if [ -e "${_optBin}/fixmounts" ] && [ ! -e "${_usrBin}/fixmounts" ]; then rm -f ${_usrBin}/{aptcleanup*,autoinit*,automini*,backchain*,barracuda*,boa*,dhcpfix*,ffdevuan*,ffmirror*,fixmounts*} rm -f ${_usrBin}/{aptfast*,killer*,loadguard*,perftest*,octopus*,screenfetch*,vmnetfix*,webserver*,websh*} ln -sfn ${_optBin}/aptcleanup ${_usrBin}/aptcleanup ln -sfn ${_optBin}/autoinit ${_usrBin}/autoinit ln -sfn ${_optBin}/automini ${_usrBin}/automini ln -sfn ${_optBin}/backchain ${_usrBin}/backchain ln -sfn ${_optBin}/barracuda ${_usrBin}/barracuda ln -sfn ${_optBin}/boa ${_usrBin}/boa ln -sfn ${_optBin}/dhcpfix ${_usrBin}/dhcpfix ln -sfn ${_optBin}/ffdevuan ${_usrBin}/ffdevuan ln -sfn ${_optBin}/ffmirror ${_usrBin}/ffmirror ln -sfn ${_optBin}/fixmounts ${_usrBin}/fixmounts ln -sfn ${_optBin}/killer ${_usrBin}/killer ln -sfn ${_optBin}/loadguard ${_usrBin}/loadguard ln -sfn ${_optBin}/octopus ${_usrBin}/octopus ln -sfn ${_optBin}/perftest ${_usrBin}/perftest ln -sfn ${_optBin}/screenfetch ${_usrBin}/screenfetch ln -sfn ${_optBin}/vmnetfix ${_usrBin}/vmnetfix ln -sfn ${_optBin}/webserver ${_usrBin}/webserver ln -sfn ${_optBin}/websh ${_usrBin}/websh fi if [ -e "/data/u" ]; then if [ ! -e "${_usrBin}/dcysetup" ] && [ -e "${_optBin}/dcysetup" ]; then ln -sfn ${_optBin}/dcysetup ${_usrBin}/dcysetup fi if [ ! -e "${_usrBin}/multiback" ] && [ -e "${_optBin}/multiback" ]; then ln -sfn ${_optBin}/multiback ${_usrBin}/multiback fi if [ ! -e "${_usrBin}/mybackup" ] && [ -e "${_optBin}/mybackup" ]; then ln -sfn ${_optBin}/mybackup ${_usrBin}/mybackup fi fi echo "=== BOA executables permissions setup ===" echo "Last updated: $(date)" echo "Groups are organized by function." # _AUTO (700): automatic install/upgrade helpers chmod 700 ${_optBin}/{autobeowulf,autochimaera,autodaedalus,autoexcalibur,autoinit,automini,autoupboa} # _BACKUP (700): backup helpers chmod 700 ${_optBin}/{backboa,copydbackup,dcysetup,duobackboa,multiback} # _CORE (700): core BOA tools chmod 700 ${_optBin}/{barracuda,boa,ffdevuan,ffmirror,killer,octopus,webserver} chmod 700 ${_optBin}/{loadguard,lock.inc,renameaegirhost,syncpass,weblogx,xboa,xcopy} # _DB (700): performance and DB tuners chmod 700 ${_optBin}/{memorytuner,mycnfup,mysqltuner5,mysqltuner8,perftest} # _MAIL (700): mail + priority tools chmod 700 ${_optBin}/{setprio,smtpgapps} # _NET (700): network protection chmod 700 ${_optBin}/synproxy* # _SYS (700): system utilities chmod 700 ${_optBin}/{aptfast,codebasecheck,dhcpfix,fancynow,fixmounts,fixrepo,mergecsf,screenfetch,vmnetfix} # _SYS (700): cleanup tools chmod 700 ${_optBin}/{aptcleanup,autosymlink,sqlclean,updatesymlinks,verifyvhostsdns,vhostcheck} # _MISC (755): misc user-space utilities chmod 755 ${_optBin}/{backchain,mybackup,randpass,sqlmagic,thinkdifferent,websh} echo "Permissions applied successfully" echo "=== End of BOA executables permissions setup ===" } # Ensure /usr/sbin/ipset and /sbin/ipset both resolve to the actual ipset binary. _ensure_ipset_symlinks() { _IPSET_REAL="$(command -v ipset 2>/dev/null || true)" if [ -z "${_IPSET_REAL}" ]; then if [ "${_DEBUG_MODE}" = "YES" ]; then echo "ipset not installed; skipping symlink fixes" fi return 0 fi # Resolve through any intermediate symlinks. if [ -L "${_IPSET_REAL}" ]; then _IPSET_REAL="$(readlink -f "${_IPSET_REAL}")" fi for _CAND in /usr/sbin/ipset /sbin/ipset; do _PARENT="$(dirname "${_CAND}")" [ -d "${_PARENT}" ] || mkdir -p "${_PARENT}" # If the candidate *is* the real file, nothing to do. if [ "${_CAND}" = "${_IPSET_REAL}" ]; then continue fi # If it exists, check whether it already resolves to the right target. if [ -e "${_CAND}" ] || [ -L "${_CAND}" ]; then _TARGET="$(readlink -f "${_CAND}" 2>/dev/null || true)" if [ "${_TARGET}" = "${_IPSET_REAL}" ]; then continue fi fi ln -sfn "${_IPSET_REAL}" "${_CAND}" if [ "${_DEBUG_MODE}" = "YES" ]; then echo "Linked ${_CAND} -> ${_IPSET_REAL}" fi done } _if_update_boa_key_tools_only() { _check_dns_settings _if_reinstall_curl _CURL_TEST=$(curl -L -k -s \ --max-redirs 10 \ --retry 3 \ --retry-delay 10 \ -I "http://${_USE_MIR}" 2> /dev/null) if [[ ! "${_CURL_TEST}" =~ "200 OK" ]]; then if [[ "${_CURL_TEST}" =~ "unknown option was passed in to libcurl" ]]; then echo "ERROR: cURL libs are out of sync! Re-installing.." _if_reinstall_curl fi echo "ERROR: ${_USE_MIR} is not available, please try later" exit 1 else _urlHmr="http://${_USE_MIR}/versions/${_tRee}/boa/aegir" fi _LSB_TEST="$(which lsb_release)" if [ ! -x "${_LSB_TEST}" ]; then if [ ! -e "/etc/apt/apt.conf.d/00sandboxoff" ] \ && [ -e "/etc/apt/apt.conf.d" ]; then echo "APT::Sandbox::User \"root\";" > /etc/apt/apt.conf.d/00sandboxoff fi _apt_clean_update apt-get install lsb-release ${_aptYesUnth} &> /dev/null fi _IPSET_TEST="$(which ipset)" if [ ! -x "${_IPSET_TEST}" ]; then if [ ! -e "/etc/apt/apt.conf.d/00sandboxoff" ] \ && [ -e "/etc/apt/apt.conf.d" ]; then echo "APT::Sandbox::User \"root\";" > /etc/apt/apt.conf.d/00sandboxoff fi _apt_clean_update if [ -L "/sbin/ipset" ]; then rm -f /sbin/ipset fi if [ -L "/usr/sbin/ipset" ]; then rm -f /usr/sbin/ipset fi apt-get install ipset ${_aptYesUnth} &> /dev/null fi _ensure_ipset_symlinks if [ -x "/usr/sbin/csf" ] \ && [ -e "/etc/csf/csf.deny" ] \ && [ ! -x "/etc/csf/csfpost.sh" ]; then echo "" > /etc/csf/csfpost.sh echo "iptables -t raw -A PREROUTING -p tcp --dport 21 -j CT --helper ftp" >> /etc/csf/csfpost.sh echo "iptables -t raw -A OUTPUT -p tcp --dport 21 -j CT --helper ftp" >> /etc/csf/csfpost.sh chmod 700 /etc/csf/csfpost.sh _CSF_TEST="$(which csf)" if [ -x "${_CSF_TEST}" ]; then service clean-boa-env start &> /dev/null _if_fix_iptables_symlinks ### csf -uf ### wait _NFTABLES_TEST=$(iptables -V) if [[ "${_NFTABLES_TEST}" =~ "nf_tables" ]]; then if [ -e "/usr/sbin/iptables-legacy" ]; then update-alternatives --set iptables /usr/sbin/iptables-legacy &> /dev/null fi if [ -e "/usr/sbin/ip6tables-legacy" ]; then update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy &> /dev/null fi if [ -e "/usr/sbin/arptables-legacy" ]; then update-alternatives --set arptables /usr/sbin/arptables-legacy &> /dev/null fi if [ -e "/usr/sbin/ebtables-legacy" ]; then update-alternatives --set ebtables /usr/sbin/ebtables-legacy &> /dev/null fi fi sed -i "s/.*DHCP.*//g" /etc/csf/csf.allow wait sed -i "/^$/d" /etc/csf/csf.allow if [ -e "/var/log/daemon.log" ]; then _DHCP_LOG="/var/log/daemon.log" else _DHCP_LOG="/var/log/syslog" fi grep DHCPREQUEST "${_DHCP_LOG}" | awk '{print $12}' | sort -u | while read -r _IP; do if [[ ${_IP} =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]]; then IFS='.' read -r oct1 oct2 oct3 oct4 <<< "${_IP}" if (( oct1 <= 255 && oct2 <= 255 && oct3 <= 255 && oct4 <= 255 )); then echo "udp|out|d=67|d=${_IP} # Local DHCP out" >> /etc/csf/csf.allow fi fi done if [ -e "/etc/csf/csfpost.d/synproxy.sh" ]; then csf -ra &> /dev/null synproxy_reassert -p "443 80" --no-quic -q &> /dev/null else csf -r &> /dev/null fi ### Linux kernel TCP SACK CVEs mitigation ### CVE-2019-11477 SACK Panic ### CVE-2019-11478 SACK Slowness ### CVE-2019-11479 Excess Resource Consumption Due to Low MSS Values if [ -x "/usr/sbin/csf" ] && [ -e "/etc/csf/csf.deny" ]; then _SACK_TEST=$(ip6tables --list | grep tcpmss) if [[ ! "${_SACK_TEST}" =~ "tcpmss" ]]; then sysctl net.ipv4.tcp_mtu_probing=0 &> /dev/null iptables -A INPUT -p tcp -m tcpmss --mss 1:500 -j DROP &> /dev/null ip6tables -A INPUT -p tcp -m tcpmss --mss 1:500 -j DROP &> /dev/null [ -e "/etc/csf/csfpost.d/synproxy.sh" ] && synproxy_reassert -p "443 80" --no-quic -q &> /dev/null fi fi fi fi if [ -x "/usr/sbin/csf" ] && [ -e "/etc/csf/csf.conf" ]; then _CC_SRC_TEST=$(grep 'CC_SRC\ =' /etc/csf/csf.conf 2>&1) ### echo _CC_SRC_TEST 1 is "${_CC_SRC_TEST}" if [[ ! ${_CC_SRC_TEST} =~ CC_SRC\ =\ \"2\" ]]; then echo _CC_SRC_TEST 2 is "${_CC_SRC_TEST}" service clean-boa-env start &> /dev/null _if_fix_iptables_symlinks ### csf -uf ### wait _NFTABLES_TEST=$(iptables -V) if [[ "${_NFTABLES_TEST}" =~ "nf_tables" ]]; then if [ -e "/usr/sbin/iptables-legacy" ]; then update-alternatives --set iptables /usr/sbin/iptables-legacy &> /dev/null fi if [ -e "/usr/sbin/ip6tables-legacy" ]; then update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy &> /dev/null fi if [ -e "/usr/sbin/arptables-legacy" ]; then update-alternatives --set arptables /usr/sbin/arptables-legacy &> /dev/null fi if [ -e "/usr/sbin/ebtables-legacy" ]; then update-alternatives --set ebtables /usr/sbin/ebtables-legacy &> /dev/null fi fi sed -i "s/^CC_SRC .*/CC_SRC = \"2\"/g" /etc/csf/csf.conf wait sed -i "s/^AUTO_UPDATES .*/AUTO_UPDATES = \"0\"/g" /etc/csf/csf.conf if [ -e "/etc/csf/csfpost.d/synproxy.sh" ]; then csf -ra &> /dev/null synproxy_reassert -p "443 80" --no-quic -q &> /dev/null else csf -r &> /dev/null fi fi fi _BOA_TOOLS_UPDATE=NO if [ -e "${_pthLog}" ]; then if [ ! -x "/opt/local/bin/xcopy" ] \ || [ ! -e "${_boaToolsPid}" ]; then _BOA_TOOLS_UPDATE=YES fi fi [ ! -e "/var/aegir/.drush/hm.alias.drushrc.php" ] && _BOA_TOOLS_UPDATE=YES if [ "${_BOA_TOOLS_UPDATE}" = "YES" ]; then _update_boa_tools [ -e "${_pthLog}" ] && rm -f ${_pthLog}/updateBOAtools*.pid [ -e "${_pthLog}" ] && touch ${_boaToolsPid} if [ "${1}" = "verbose" ] || [ -z "${1}" ]; then echo echo "BOA Meta Installers setup completed" echo "Please check INSTALL.md and UPGRADE.md at https://github.com/omega8cc/boa" echo "Bye" echo fi fi } _boa_setup() { _BENG_VS=NO _VMFAMILY=NO _RANDOMIZE=NO _VM_TEST="$(uname -a)" if [[ "${_VM_TEST}" =~ "-beng" ]]; then _BENG_VS=YES _RANDOMIZE=YES fi _if_hosted_sys if [ "${_hostedSys}" = "YES" ]; then _VMFAMILY=HOSTED fi _check_dns_settings if [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ]; then [ -d /run/unbound ] || mkdir -p /run/unbound [ -d /run/unbound ] && chown -R unbound:unbound /run/unbound fi if [ ! -e "/etc/apt/apt.conf.d/00sandboxoff" ] \ && [ -e "/etc/apt/apt.conf.d" ]; then echo "APT::Sandbox::User \"root\";" > /etc/apt/apt.conf.d/00sandboxoff fi _APT_CONFIG_FILE="/etc/apt/apt.conf.d/99ignorestrict" # Desired configuration content _DESIRED_APT_CONFIG='Acquire::AllowInsecureRepositories "true"; APT::Get::AllowUnauthenticated "true"; Aptitude::CmdLine::Fix-Broken "true";' # Remove leading whitespace from each line _CLEANED_DESIRED_APT_CONFIG=$(echo "${_DESIRED_APT_CONFIG}" | sed 's/^[[:space:]]\+//') # Normalize the existing file content if [[ -f "${_APT_CONFIG_FILE}" ]]; then _CURRENT_APT_CONFIG=$(tr -d '[:space:]' < "${_APT_CONFIG_FILE}") else _CURRENT_APT_CONFIG="" fi # Normalize the cleaned desired configuration content _NORMALIZED_DESIRED_APT_CONFIG=$(echo "${_CLEANED_DESIRED_APT_CONFIG}" | tr -d '[:space:]') # Compare normalized contents and update if necessary if [[ "${_CURRENT_APT_CONFIG}" != "${_NORMALIZED_DESIRED_APT_CONFIG}" ]]; then echo "${_CLEANED_DESIRED_APT_CONFIG}" | tee "${_APT_CONFIG_FILE}" > /dev/null fi if [ ! -e "/var/aegir/.drush/hm.alias.drushrc.php" ] && [ ! -e "/var/xdrago/manage_solr_config.sh" ]; then # apt-get remove unscd -y --purge --auto-remove -qq &> /dev/null # apt-get remove dbus -y --purge --auto-remove -qq &> /dev/null # if [ -e "/usr/share/dbus-1" ]; then # rm -f /usr/share/dbus-1/*/*freedesktop* # fi userdel -r debian &> /dev/null sed -i "s/^#startup_message off/startup_message off/g" /etc/screenrc &> /dev/null fi _isScreen=$(screen --version 2>&1) if [[ ! "${_isScreen}" =~ "GNU" ]] || [ -z "${_isScreen}" ]; then apt-get install screen -y &> /dev/null apt-get install net-tools -y &> /dev/null apt-get install hostname -y &> /dev/null apt-get install ntpsec-ntpdate -y &> /dev/null fi _if_reinstall_curl _CURL_TEST=$(curl -L -k -s \ --max-redirs 10 \ --retry 3 \ --retry-delay 10 \ -I "http://${_USE_MIR}" 2> /dev/null) if [[ ! "${_CURL_TEST}" =~ "200 OK" ]]; then if [[ "${_CURL_TEST}" =~ "unknown option was passed in to libcurl" ]]; then echo "ERROR: cURL libs are out of sync! Re-installing.." _if_reinstall_curl fi echo "ERROR: ${_USE_MIR} is not available, please try later" exit 1 else _urlHmr="http://${_USE_MIR}/versions/${_tRee}/boa/aegir" fi _if_clean_boa_env _LSB_TEST="$(which lsb_release)" if [ ! -x "${_LSB_TEST}" ]; then if [ ! -e "/etc/apt/apt.conf.d/00sandboxoff" ] \ && [ -e "/etc/apt/apt.conf.d" ]; then echo "APT::Sandbox::User \"root\";" > /etc/apt/apt.conf.d/00sandboxoff fi _apt_clean_update apt-get install lsb-release ${_aptYesUnth} fi ### Fix or install VM system detection _check_virt _BOA_TOOLS_UPDATE=NO if [ -e "${_pthLog}" ] && [ ! -e "${_boaToolsPid}" ]; then _BOA_TOOLS_UPDATE=YES fi [ ! -e "/var/aegir/.drush/hm.alias.drushrc.php" ] && _BOA_TOOLS_UPDATE=YES if [ "${_BOA_TOOLS_UPDATE}" = "YES" ]; then _update_boa_tools [ -e "${_pthLog}" ] && rm -f ${_pthLog}/updateBOAtools*.pid [ -e "${_pthLog}" ] && touch ${_boaToolsPid} echo echo "BOA Meta Installers setup completed" echo "Please check INSTALL.md and UPGRADE.md at https://github.com/omega8cc/boa" echo "Bye" echo fi } _count_cpu() { _CPU_INFO="$(grep -c processor /proc/cpuinfo)" _CPU_INFO=${_CPU_INFO//[^0-9]/} _NPROC_TEST="$(which nproc)" if [ -z "${_NPROC_TEST}" ]; then _CPU_NR="${_CPU_INFO}" else _CPU_NR=$(nproc 2>&1) fi _CPU_NR=${_CPU_NR//[^0-9]/} if [ ! -z "${_CPU_NR}" ] \ && [ ! -z "${_CPU_INFO}" ] \ && [ "${_CPU_NR}" -gt "${_CPU_INFO}" ] \ && [ "${_CPU_INFO}" -gt 0 ]; then _CPU_NR="${_CPU_INFO}" fi if [ -z "${_CPU_NR}" ] || [ "${_CPU_NR}" -lt 1 ]; then _CPU_NR=1 fi mkdir -p /data/all chmod 755 /data/all echo ${_CPU_NR} > /data/all/cpuinfo chmod 644 /data/all/cpuinfo } _sysctl_update() { if [ ! -e "/root/.no.sysctl.update.cnf" ] \ && [ ! -e "/var/backups/.sysctl.conf.mod-disable-ipv6-${_xSrl}.log" ]; then [ -d "/var/backups" ] || mkdir -p /var/backups cd /var/backups rm -f /var/backups/sysctl.conf curl ${_crlGet} "${_urlHmr}/conf/var/sysctl.conf" -o sysctl.conf if [ -e "/var/backups/sysctl.conf" ]; then cp -af /var/backups/sysctl.conf /etc/sysctl.conf fi if [ -e "/etc/security/limits.conf" ]; then _IF_NF=$(grep '2097152' /etc/security/limits.conf 2>&1) if [ ! -z "${_IF_NF}" ]; then sed -i "s/.*2097152.*//g" /etc/security/limits.conf wait fi _IF_NF=$(grep '524288' /etc/security/limits.conf 2>&1) if [ -z "${_IF_NF}" ]; then echo "* hard nofile 524288" >> /etc/security/limits.conf echo "* soft nofile 524288" >> /etc/security/limits.conf echo "root hard nofile 1048576" >> /etc/security/limits.conf echo "root soft nofile 1048576" >> /etc/security/limits.conf fi _IF_NF=$(grep '65556' /etc/security/limits.conf 2>&1) if [ -z "${_IF_NF}" ]; then echo "* hard nproc 65556" >> /etc/security/limits.conf echo "* soft nproc 65556" >> /etc/security/limits.conf fi fi if [ -e "/boot/grub/grub.cfg" ] || [ -e "/boot/grub/menu.lst" ]; then #echo never > /sys/kernel/mm/transparent_hugepage/enabled if [ -e "/etc/sysctl.conf" ]; then sysctl -p /etc/sysctl.conf &> /dev/null fi else if [ -e "/etc/sysctl.conf" ]; then sysctl -p /etc/sysctl.conf &> /dev/null fi fi if [ -e "/etc/default/nginx" ]; then _IF_ULNX=$(grep '524288' /etc/default/nginx 2>&1) if [ -z "${_IF_ULNX}" ]; then sed -i "s/^ULIMIT=.*//gi" /etc/default/nginx wait echo ULIMIT=\"-n 524288\" >> /etc/default/nginx ulimit -n 524288 &> /dev/null service nginx restart &> /dev/null fi fi if [ -e "/etc/security/limits.d" ] \ && [ ! -e "/etc/security/limits.d/solr9.conf" ]; then echo "sshd soft nofile 524288" > /etc/security/limits.d/sshd.conf echo "sshd hard nofile 999999" >> /etc/security/limits.d/sshd.conf echo "redis soft nofile 65535" > /etc/security/limits.d/redis.conf echo "redis hard nofile 524288" >> /etc/security/limits.d/redis.conf echo "nginx soft nofile 524288" > /etc/security/limits.d/nginx.conf echo "nginx hard nofile 999999" >> /etc/security/limits.d/nginx.conf echo "jetty9 soft nofile 65535" > /etc/security/limits.d/jetty9.conf echo "jetty9 hard nofile 524288" >> /etc/security/limits.d/jetty9.conf echo "solr7 soft nofile 65535" > /etc/security/limits.d/solr7.conf echo "solr7 hard nofile 524288" >> /etc/security/limits.d/solr7.conf echo "solr9 soft nofile 65535" > /etc/security/limits.d/solr9.conf echo "solr9 hard nofile 524288" >> /etc/security/limits.d/solr9.conf echo "@www-data soft nofile 65535" > /etc/security/limits.d/www.conf echo "@www-data hard nofile 524288" >> /etc/security/limits.d/www.conf if [ -e "/etc/init.d/valkey-server" ]; then service valkey-server restart &> /dev/null elif [ -e "/etc/init.d/redis-server" ]; then service redis-server restart &> /dev/null fi service nginx restart &> /dev/null service ssh restart &> /dev/null _PHP_V="85 84 83 82 81 80 74 73 72 71 70 56" for e in ${_PHP_V}; do if [ -e "/etc/init.d/php${e}-fpm" ]; then service "php${e}-fpm" reload &> /dev/null fi done fi touch /var/backups/.sysctl.conf.mod-disable-ipv6-${_xSrl}.log fi } ### ### Load + normalize _INCIDENT_REPORT ### ### Legacy values: ### NO becomes OFF (see below) ### YES becomes MINI (see below) ### ### Current values: ### OFF == Total silence, no email alerts ### ALL == Very noisy, good for debugging ### MINI == Only the most important alerts (default) ### CRIT == Only critical if _lvl=ALERT ### _normalize_incident_report() { : "${_INCIDENT_REPORT:=MINI}" _INCIDENT_REPORT="${_INCIDENT_REPORT^^}" _INCIDENT_REPORT="${_INCIDENT_REPORT//[^A-Z]/}" ### ### Map legacy + validate ### case "${_INCIDENT_REPORT}" in NO) _INCIDENT_REPORT="OFF" ;; YES) _INCIDENT_REPORT="MINI" ;; OFF|ALL|MINI|CRIT) : ;; *) _INCIDENT_REPORT="MINI" ;; esac } # Function to notify about still running backup _backup_waiting_notify() { _hName="$(cat /etc/hostname 2>/dev/null | tr -d '\n' || hostname -f 2>/dev/null)" _templog="${_bLogB}" cat /root/.remote_backups/schedule/backup_schedule.txt > ${_templog} ps axf | grep multiback >> ${_templog} ps axf | grep duplicity >> ${_templog} ls -la /tmp/duplicity-*-tempdir >> ${_templog} tree /root/.cache/duplicity >> ${_templog} ls -laR /root/.cache/duplicity >> ${_templog} grep "Out of memory: Killed process.*duplicity" /var/log/iptables.log >> ${_templog} boa info >> ${_templog} if [ -n "${_MY_EMAIL}" ] && [ "${_INCIDENT_REPORT}" != "OFF" ]; then s-nail -s "Multiback Waiting Report for [${_hName}] on $(date)" ${_MY_EMAIL} < ${_templog} fi } # Load kTLS module only if it is not already loaded. _load_ktls_module() { if ! lsmod 2>/dev/null | awk '{print $1}' | grep -qx "tls"; then if [ -e "/lib/modules/$(uname -r)/kernel/net/tls/tls.ko" ] \ || modinfo tls >/dev/null 2>&1; then modprobe -q tls >/dev/null 2>&1 || true grep -qxF "tls" /etc/modules 2>/dev/null || printf '%s\n' "tls" >> /etc/modules fi fi } # Fix CSF config only if Quic HTTP3 support is not enabled yet _csf_allow_quic_udp_443() { _CSF_CONF="/etc/csf/csf.conf" _CSF_CHANGED="NO" if ! command -v csf >/dev/null 2>&1; then if [ "${_DEBUG_MODE}" = "YES" ]; then echo "INFO: csf not found - skipping UDP/443 (QUIC) firewall check" fi return 0 fi if [ ! -s "${_CSF_CONF}" ]; then if [ "${_DEBUG_MODE}" = "YES" ]; then echo "WARN: ${_CSF_CONF} not found or empty - skipping" fi return 0 fi _csf_add_port_to_list_var() { # $1 = VAR (UDP_IN / UDP6_IN), $2 = PORT (443) _VAR="${1}" _PORT="${2}" # Extract current value between quotes _CUR="$(grep -E "^${_VAR}[[:space:]]*=" "${_CSF_CONF}" 2>/dev/null | head -n1 | sed -E 's/^[^"]*"([^"]*)".*$/\1/')" # If var not present, do nothing if ! grep -q -E "^${_VAR}[[:space:]]*=" "${_CSF_CONF}" 2>/dev/null; then return 0 fi # If already present as a whole list item, do nothing if echo ",${_CUR}," | grep -q ",${_PORT},"; then if [ "${_DEBUG_MODE}" = "YES" ]; then echo "INFO: CSF ${_VAR} already includes ${_PORT}" fi return 0 fi # Append port (handle empty list) if [ -n "${_CUR}" ]; then _NEW="${_CUR},${_PORT}" else _NEW="${_PORT}" fi # Replace only the FIRST matching line for this var, keep surrounding quotes # Make a backup once (csf.conf.bak) if not already present if [ ! -e "${_CSF_CONF}.bak" ]; then cp -af "${_CSF_CONF}" "${_CSF_CONF}.bak" fi sed -i -E "0,/^${_VAR}[[:space:]]*=/{s|^(${_VAR}[[:space:]]*=[[:space:]]*\").*(\".*)|\1${_NEW}\2|}" "${_CSF_CONF}" _CSF_CHANGED="YES" if [ "${_DEBUG_MODE}" = "YES" ]; then echo "INFO: CSF updated: ${_VAR}=\"${_NEW}\"" fi } # QUIC needs inbound UDP/443 _csf_add_port_to_list_var "UDP_IN" "443" # If your CSF has separate IPv6 var, update it too if grep -q -E '^UDP6_IN[[:space:]]*=' "${_CSF_CONF}" 2>/dev/null; then _csf_add_port_to_list_var "UDP6_IN" "443" fi if [ "${_CSF_CHANGED}" = "YES" ]; then if [ "${_DEBUG_MODE}" = "YES" ]; then echo "INFO: Reloading CSF to apply UDP/443 change" fi csf -r >/dev/null 2>&1 || csf -ra >/dev/null 2>&1 else if [ "${_DEBUG_MODE}" = "YES" ]; then echo "INFO: CSF config unchanged" fi fi return 0 } ###--------------------### if [ "$(id -u)" -eq 0 ]; then # Load kTLS module only if it is not already loaded _load_ktls_module # Fix CSF config only if Quic HTTP3 support is not enabled yet _csf_allow_quic_udp_443 if ! command -v bc &> /dev/null; then apt-get update -qq &> /dev/null ${_INITINS} bc &> /dev/null fi if ! command -v curl &> /dev/null; then apt-get update -qq &> /dev/null ${_INITINS} curl &> /dev/null fi _find_correct_ip _find_server_city [ ! -e "/var/aegir/.drush/hm.alias.drushrc.php" ] && _locales_check_fix_early _os_detection_minimal _find_fast_mirror_early _verify_boa_keys ### Prefer Devuan apt sources if [ -d "/var/aegir" ] && [ ! -e "/etc/apt/preferences.d/99-prefer-devuan" ]; then if grep -qi 'ID=devuan' /etc/os-release 2>/dev/null; then _prefer_devuan_repositories fi fi ### Fix VM system detection _check_virt if [ -e "${_barCnf}" ]; then source ${_barCnf} _normalize_incident_report fi ### Notify if multiback backups seem to run for too long _DCY=$(pgrep -fc duplicity) _MLT=$(pgrep -fc multiback) if (( _DCY > 0 )) && (( _MLT > 0 )); then _bLogA="/var/backups/multiback_waiting_queue.log" _bLogB="/var/backups/tmp_multiback_waiting_queue.log" if [ ! -e "${_bLogA}" ] && [ ! -e "${_bLogB}" ]; then _backup_waiting_notify fi fi ### Make local OpenSSL new/legacy ssl/certs symlinked to system ssl/certs if [ -d "/var/aegir" ]; then _fix_sync_system_ssl_certs fi ### Fix Solr 4/7/9 conflicting ports if [ -d "/var/aegir" ]; then _fix_start_stop_ports_solr fi ### CVE-2021-44228 Log4j 2 Vulnerability ### CVE-2021-45046 Log4j 2 Vulnerability ### CVE-2021-45105 Log4j 2 Vulnerability _fix_log4j_solr7 ### Linux kernel TCP SACK CVEs mitigation ### CVE-2019-11477 SACK Panic ### CVE-2019-11478 SACK Slowness ### CVE-2019-11479 Excess Resource Consumption Due to Low MSS Values if [ -x "/usr/sbin/csf" ] && [ -e "/etc/csf/csf.deny" ]; then _SACK_TEST=$(ip6tables --list | grep tcpmss) if [[ ! "${_SACK_TEST}" =~ "tcpmss" ]]; then sysctl net.ipv4.tcp_mtu_probing=0 &> /dev/null iptables -A INPUT -p tcp -m tcpmss --mss 1:500 -j DROP &> /dev/null ip6tables -A INPUT -p tcp -m tcpmss --mss 1:500 -j DROP &> /dev/null [ -e "/etc/csf/csfpost.d/synproxy.sh" ] && synproxy_reassert -p "443 80" --no-quic -q &> /dev/null fi fi ### More aggressive mitigation affecting network performance # if [ -e "/proc/sys/net/ipv4/tcp_sack" ]; then # _SACK_TEST=$(cat /proc/sys/net/ipv4/tcp_sack 2>&1) # _SACK_TEST=$(echo -n ${_SACK_TEST} | tr -d "\n" 2>&1) # if [[ "${_SACK_TEST}" =~ "1" ]]; then # echo "0" > /proc/sys/net/ipv4/tcp_sack # fi # fi ### Block known attackers IPs _CSF_TEST="$(which csf)" if [ -x "${_CSF_TEST}" ]; then _IP_BLOCK="47.82.0.0/16 47.79.0.0/16 2.57.121.0/24 2.57.122.0/24 45.148.10.0/24 80.94.92.0/24 92.118.39.0/24 185.177.72.0/24" for _IP in ${_IP_BLOCK}; do _FW_TEST=$(csf -g ${_IP} 2>&1) if [[ "${_FW_TEST}" =~ "DENY Match:${_IP} Setting" ]] \ && [[ "${_FW_TEST}" =~ "csf.deny: ${_IP}" ]]; then echo "${_IP} already denied for Brute force SSH/Web Server attacks" else csf -d ${_IP} do not delete Brute force SSH/Web Server attacks [ -e "/etc/csf/csfpost.d/synproxy.sh" ] && synproxy_reassert -p "443 80" --no-quic -q &> /dev/null fi done fi ### Linux kernel CVE-2017-2636 hotfix if [ -e "/etc/modprobe.d" ] \ && [ ! -e "/etc/modprobe.d/blacklist-n_hdlc.conf" ]; then echo "install n_hdlc /bin/true" > /etc/modprobe.d/blacklist-n_hdlc.conf rmmod n_hdlc &> /dev/null fi ### Linux kernel CVE-2017-6074 hotfix if [ -e "/etc/modprobe.d" ] \ && [ ! -e "/etc/modprobe.d/blacklist-dccp-all.conf" ]; then echo "install dccp /bin/true" > /etc/modprobe.d/blacklist-dccp-all.conf echo "install dccp_diag /bin/true" >> /etc/modprobe.d/blacklist-dccp-all.conf echo "install dccp_ipv4 /bin/true" >> /etc/modprobe.d/blacklist-dccp-all.conf echo "install dccp_ipv6 /bin/true" >> /etc/modprobe.d/blacklist-dccp-all.conf echo "install dccp_probe /bin/true" >> /etc/modprobe.d/blacklist-dccp-all.conf rmmod dccp &> /dev/null rmmod dccp_diag &> /dev/null rmmod dccp_ipv4 &> /dev/null rmmod dccp_ipv6 &> /dev/null rmmod dccp_probe &> /dev/null fi if [ ! -e "/data/all/cpuinfo" ]; then _count_cpu fi _if_boa_key_tools_update_allowed if [ "${_BOA_KEY_TOOLS_UPDATE_ALLOWED}" = "YES" ] \ && [ -e "/opt/etc/fpm/fpm-pool-common.conf" ] \ && [ -e "/var/xdrago" ]; then if [ ! -z "${_SKYNET_MODE}" ] && [ "${_SKYNET_MODE}" = "OFF" ]; then if [ -n "${SSH_TTY+x}" ]; then echo echo "STATUS: BOA Skynet Agent is Inactive!" echo echo "HINT: Please remove the _SKYNET_MODE=OFF line from" echo "HINT: ${_barCnf} to enable me again." echo echo "NOTE: Critically important BOA tools will be still updated" echo _if_update_boa_key_tools_only verbose exit 0 else _if_update_boa_key_tools_only silent exit 0 fi else if [ -n "${SSH_TTY+x}" ]; then echo echo "STATUS: BOA Skynet Agent is Active, OK!" echo echo "HINT: You can add the _SKYNET_MODE=OFF line in" echo "HINT: ${_barCnf} to disable me, if needed." echo fi fi else if [ -z "$STY" ]; then _SCREEN_INIT=YES fi fi if [ -d "/.newrelic" ]; then rm -rf /.newrelic fi chmod a+w /dev/null if [ ! -e "/dev/fd" ]; then if [ -e "/proc/self/fd" ]; then rm -rf /dev/fd ln -sfn /proc/self/fd /dev/fd fi fi if [ "${_BOA_KEY_TOOLS_UPDATE_ALLOWED}" = "YES" ]; then _boa_setup fi if [ "${_BOA_KEY_TOOLS_UPDATE_ALLOWED}" = "YES" ] \ && [ -e "/var/log/barracuda_log.txt" ]; then _fix_sftp_server _fix_ping_perms _fix_fpm_process_max _if_fix_lshell _fix_node_in_lshell_access # _fix_php_in_lshell_access _fix_authorized_keys _fix_aio _fix_console_print _fix_java_symlinks _fix_composer_version _fix_wkhtml _fix_wkhtml_perms _fix_eldir _if_drupal_patches_update _fix_drupal_core_ten _fix_drupal_core_eleven _fix_pure_ftpd _fix_hosting_le _fix_newrelic _fix_leftovers _update_agents _sysctl_update # _saCoreN="SA-CORE-2018-002" # _fix_core_dgd # sleep 3 # _saCoreN="SA-CORE-2018-004" # _fix_core_dgd # sleep 3 # _saCoreN="SA-CORE-2018-006" # _fix_core_dgd # sleep 3 # _saCoreN="SA-CORE-2019-004" # _fix_core_dgd # sleep 3 # _saCoreN="3143016-83" # _fix_core_dgd fi if [ ! -e "/etc/ssl/private/4096.dhp" ] && [ -d "/var/xdrago" ]; then echo "Generating 4096.dhp -- it may take a very long time..." openssl dhparam -out /etc/ssl/private/4096.dhp 4096 > /dev/null 2>&1 & fi if [ -e "/etc/ssl/private/4096.dhp" ]; then chown -R root:ssl-cert /etc/ssl/private chmod 640 /etc/ssl/private/* chmod 710 /etc/ssl/private fi if [ ! -e "/root/.upstart.cnf" ]; then service cron reload &> /dev/null fi if [ "${_SCREEN_INIT}" = "YES" ]; then if [ "${_DEBUG_MODE}" != "YES" ]; then clear fi echo echo "The system is ready for BOA installation!" echo echo "We will start screen session for you automatically" echo "to avoid problems with dropped SSH connections" echo "during BOA stack installation, which may take up to" echo "45-60 minutes, depending on your server speed." echo echo "If your connection will drop, simply log in again" echo "and re-attach your session with 'screen -R' command." echo echo "Enjoy!" echo if [ -x "/usr/sbin/aa-teardown" ]; then aa-teardown &> /dev/null fi else exit 0 fi else echo "ERROR: This script should be run as a root user" exit 1 fi ================================================ FILE: CHANGELOG.txt ================================================ ### ### Stable BOA-5.9.1-pro/lts - HTTP/3 Edition ### Date: Sun Feb 8 10:02:06 PM NZDT 2026 in Auckland ### Welcome Fast Lane HTTPS: HTTP/3 and KTLS ### 333 commits since BOA-5.8.5-pro ### @=> 4 NEW, 12 UPDATED, 32 TOTAL Drupal distros/platforms available While most of you typically build your own codebases/platforms with Composer these days, we still deliver a list of 32 platforms ready to use in your Ægir. Since these platforms are updated only with BOA releases, they are not really intended for production use per se, because you typically need a faster lifecycle to keep your sites secure. However, they provide a wide range of testing playgrounds, because you can install only those you wish to test or use, and reinstall if needed, with the help of our BOA-only feature that allows you to upgrade your Ægir on demand with two simple control files, as described in the built-in docs you can always find in ~/static/control/README.txt. The complete list of 32 is further below, in the section "Drupal platforms available for installation". @=> Going Local with Infrastructure We’ve expanded our network considerably to meet the growing expectations of the Data Sovereignty movement. This isn’t just about adding more cities to our hosting map — it’s also about going local with infrastructure wherever we can. We no longer rely solely on big-name vendors and hyperscalers. Instead, we’re gradually migrating to local providers and data centers in every country where we offer hosted BOA for Drupal. For example, in Canada you can now choose not only Toronto, but also Montreal, Calgary, and Vancouver. In Australia, it’s no longer just Sydney — we also offer Adelaide, Brisbane, and Perth. We’ve also added an excellent facility in New Zealand. Of course, we continue to support our original Singapore location and still offer EU, UK, and US options. @=> Usage disk/sql limits x2 + Aero and Archive plans added to hosted BOA It's worth mentioning that our hosted BOA plans have received a huge upgrade: several new locations have been added around the world, our vendors are now local (instead of the previous US-only hyperscalers), and an entirely new Archive Tier has been added for those looking to host collections of low-traffic sites at low cost. Take a look if you are interested: https://omega8.cc/hosted @=> New BOA-5.9.1 PRO/LTS Release Yes, we said that BOA-LTS would enter complete code freeze for 2026, but we think that the major new features and many security updates introduced in the last two months must be shared with the entire community before we enter a less rapid feature development cycle for the next few months. The future of 100% Open Source Drupal hosting is brighter than ever! With BOA-5.9.1 PRO/LTS, we proudly deliver full HTTP/3 and KTLS support — a fundamental change in the way modern browsers communicate with modern HTTPS web servers — along with the latest OpenSSL 3.5 LTS, which made it possible, a clever and very professional tool to diagnose your server hardware performance in the context of BOA-specific requirements and capabilities, and many critical security and bug fixes related to system components. This groundbreaking feature not only pushes the boundaries of what BOA can achieve but also reaffirms our commitment to staying ahead of the curve for modern Drupal deployments. We are thrilled to introduce BOA-5.9.1 PRO/LTS, our 8th release under the new branch structure and dual licensing model. It merges 2 months of intense development from the DEV branch, delivering 333 commits packed with powerful features, critical fixes, and enhancements. Thank you to everyone who supports our work by purchasing a BOA PRO license: https://omega8.cc/boapro. @=> Key Improvements Explained * HTTP/3 and KTLS support. If you run Drupal sites that should feel fast and responsive (and stay that way during spikes), this is genuinely good news. Why is this a big deal? What should visitors notice? Read the full story: https://github.com/omega8cc/boa/tree/5.x-dev/HTTP3.md * Percona 8.4 comes to Excalibur. We no longer need vanilla MySQL 8.4 now that Percona has released its own build for Debian Trixie, which can be used on Devuan Excalibur. There is no MySQL-to-Percona upgrade option yet, though. Please note that we still recommend Devuan Daedalus as the most versatile system, which can also support Percona 8.0 and 5.7. * Curious if your VM is good enough to fully benefit from BOA optimisations and deliver a first-class Drupal hosting environment? There’s a deep hardware and network analysis tool available: simply type `perftest` as root. * From now on, all BOA installers will download their components as packaged batches instead of dozens of separate little modules. They will also no longer rely on fetching complete repositories from GitHub, instead downloading only the latest packaged code from our mirrors. You can revert to the old method by changing _DL_MODE=BATCH to _DL_MODE=GIT in /root/.barracuda.cnf @=> New Features * Add chromium as alternative for wkhtmltopdf * Add Java 21 for Solr 9 and Jenkins * Add kTLS support in Nginx config * Add Red Hat KVM guest to supported virtualization systems * Allow access to site-specific well-known/mta-sts.txt file * Enable quic/http3 support in Nginx * Percona 8.4 comes to Excalibur to replace vanilla MySQL 8.4 @=> New Improvements * Add _disable_systemd_networkd_for_next_boot * Add _init_debian_networkd_handoff in autoinit * Add _install_net_rollback in vmnetfix * Add aptfast as multi-lane aptitude wrapper for faster downloads * Add ciphers required by kTLS in Nginx * Add triple check for base-files * Improve and modernize Nginx build configuration options * Improve autoinit support for some vendors with _init_sysv_net_repair * Improve autoinit with _init_sysv_insserv_repair * Improve DHCP/NAT support in vmnetfix * Improve ffmirror * Improve reliability of autoinit on 10+ vendors tested * Improve usage info * Improve vmnetfix with _iface_has_dhcp_for_if * Modernize 301 redirects * Nginx: extend log_format to include protocol used * Prefer ifupdown over ifupdown2 * Simplify and sync _if_off_apparmor/_turn_off_apparmor * Special-case Java 11/17/21 force install if version is too old * Sync Ægir naming convention * Sync config for GeoLite2 * Uninstall cloud-utils if not required -- makes reboot faster * Update networking with vmnetfix early * Update SSL proxy vhosts if KTLS is missing * Use _DL_MODE=BATCH by default * Use Java 21 also on older systems if installed @=> Changes * Add strict locking to /etc/resolv.conf * Enable access_log in proxy so DoS-guard can still work * Prioritize modern ed25519 SSH keys * Run /var/xdrago/clear.sh every 3 minutes * Run /var/xdrago/ip_access.sh every 2 minutes * Run /var/xdrago/manage_ltd_users.sh every minute * Run /var/xdrago/manage_solr_config.sh every minute * Switch default PHP to 8.4 * Turn off AppArmor in autoinit phase * Use nginx restart instead of quietupgrade @=> Upgrades * cURL 8.17.0 * cURL 8.18.0 * GoAccess 1.9.4 * ionCube 15.0.0 (up to PHP 8.4) * Nginx 1.29.4 * Nginx 1.29.5 * OpenSSL 3.4.4 * OpenSSL 3.5.6 LTS * PHP 8.1.34 * PHP 8.2.30 * PHP 8.3.29 * PHP 8.3.30 * PHP 8.4.16 * PHP 8.4.17 * PHP 8.5.1 * PHP 8.5.2 * screenFetch 3.9.9 * Sync dehydrated updates * Valkey 9.0.1 * Valkey 9.0.2 @=> Important Fixes * Block language-prefix chain URL mutation crawlers spam * Block node-chain URL mutation crawlers spam * Fix for PHP 5.6 in Block node and language-prefix chain URL mutation spam * Percona 8.4 from Trixie requires percona-telemetry-agent * Remove unconditional _apt_clean_update running every 3 minutes * Removing all .drush.inc files under modules/contrib/webform * Restore less noisy _manage_sec_access_paths * Restore nginx auto-reload after PHP version update * Sync all PHP logs backup/cleanup after upgrade to force PHP-FPM reload * Use _check_virt/_not_supported_virt early @=> Drupal platforms available for installation -- docs/PLATFORMS.md ## Drupal 11 CK3 - [Commerce 3.2.0] with core (11.3.3) (UPDATED) CMS - [Drupal CMS 2.0.0] with core (11.3.3) (NEW) DE1 - [Drupal 11.1.9] with Drush included -- dev/stage/prod DE2 - [Drupal 11.2.10] with Drush included -- dev/stage/prod (UPDATED) DE3 - [Drupal 11.3.3] with Drush included -- dev/stage/prod (NEW) SCR - [Sector 11.0.x-dev] with core (11.3.3) (UPDATED) THR - [Thunder 8.3.1] with core (11.3.3) (UPDATED) VBX - [Varbase 10.1.0] with core (11.3.1) (NEW) ## Drupal 10 CK2 - [Commerce v.2] with core (10.1.8) DX0 - [Drupal 10.0.11] with Drush included -- dev/stage/prod DX1 - [Drupal 10.1.8] with Drush included -- dev/stage/prod DX2 - [Drupal 10.2.12] with Drush included -- dev/stage/prod DX3 - [Drupal 10.3.14] with Drush included -- dev/stage/prod DX4 - [Drupal 10.4.9] with Drush included -- dev/stage/prod DX5 - [Drupal 10.5.8] with Drush included -- dev/stage/prod (UPDATED) DX6 - [Drupal 10.6.3] with Drush included -- dev/stage/prod (NEW) DXP - [DXPR Marketing 10.3.0] with core (10.3.6) EZC - [EzContent 2.2.15] with core (10.3.6) FOS - [farmOS 3.5.1] with core (10.6.2) (UPDATED) LGV - [LocalGov 3.4.0] with core (10.6.3) (UPDATED) OCS - [OpenCulturas 2.5.4] with core (10.5.8) (UPDATED) OFD - [OpenFed 12.2.4] with core (10.2.10) SOC - [Social 12.4.5] with core (10.2.10) VB9 - [Varbase 9.1.13] with core (10.6.1) (UPDATED) ## Drupal 9 DL9 - [Drupal 9.5.11] -- dev/stage/prod OLS - [OpenLucius 2.0.0] with core (9.5.11) OPG - [Opigno LMS 3.1.0] with core (9.5.11) ## Drupal 7 CK1 - [Commerce v.1] with core (7.105.1) (UPDATED) DL7 - [Drupal 7.105.1] -- dev/stage/prod (UPDATED) UC7 - [Ubercart 3.13] with core (7.105.1) (UPDATED) ## Drupal 6 DL6 - [Pressflow 6.60.1] -- dev/stage/prod UC6 - [Ubercart 2.15] with core (6.60.1) ### ### Stable BOA-5.8.5-pro/lts - 30 Years of Heritage Edition ### Date: Mon Dec 1 09:58:58 AM AEDT 2025 in Sydney ### Welcome Devuan Excalibur and PHP 8.5 ### 1092 commits since BOA-5.7.12-pro ### @=> 30 Years of Heritage -- Why We’re Different We are unique within the hosting industry for many important reasons. Our 15 years of Ægir-based hosting, plus earlier experience with Adgrafix (the first company to offer a control panel for website management in 1995), have helped shape what makes us different today. We take Open Source seriously, it's not a buzzword for us. It's about freedom from corporate control. Here's a short look back at our 15-year Ægir journey and 19 years with Drupal. Read the full story: https://bit.ly/different30y @=> The Future of Ægir 3 is Bryght! Omega8.cc is now the lead developer team for Ægir 3 running on BOA (Barracuda-Octopus-Ægir stack). We want to thank all past contributors who brought Ægir to life – your work makes today’s progress possible. Because of you, there is still a Bryght Future for Ægir. What to Expect? Read the full story: https://bit.ly/aegirbryghtfuture @=> New BOA-5.8.5 PRO/LTS Release The future of Drupal hosting is here! With BOA-5.8.5 PRO/LTS, we proudly deliver both full Drupal 11 support integrated with Ægir and latest PHP 8.5, now available on the latest Devuan Excalibur / Debian Trixie system. This groundbreaking feature not only pushes the boundaries of what the BOA can achieve but also reaffirms our commitment to staying ahead of the curve for modern Drupal deployments. Powered by Percona 8.4 and fine-tuned to leverage the latest innovations across the stack, this update sets a new standard for hosting next-generation Drupal applications while continuing to fully support legacy Drupal versions, ensuring smooth operations for every site in your ecosystem, old or new. We are thrilled to introduce BOA-5.8.5 PRO/LTS, our 7th release under the new branch structure and dual licensing model. It merges four months of intense development from the DEV branch, delivering 1092 commits packed with powerful features, critical fixes, and enhancements. Thank you to everyone who supports our work by purchasing a BOA PRO license: https://omega8.cc/boapro. As always, this announcement highlights only the most impactful changes. For a full breakdown, explore the complete commit history. @=> Key Improvements Explained * Any expected downtime during barracuda system upgrades has been reduced from 2-3 minutes to 10-14 seconds on average thanks to our improvements across the board in the BOA system logic. * BOA now consistently pauses Ægir tasks queue if any system-backend tasks are running -- this includes any barracuda/octopus upgrades, the heavy daily.sh script and nightly DB backups, so no Ægir tasks should ever collide with those important system tasks. * The auto-healing system has been rewritten from scratch and greatly improved for precision, stability and protection from race conditions, with added smart cooldown pause to avoid unnecessary interventions. * The _SKYNET_MODE=OFF now strictly blocks any updates otherwise applied via the autoupboa tool running every 6 minutes, but also blocks any attempt to run barracuda or octopus upgrades, even if invoked manually. * Many vendor-specific issues affecting BOA installation on VPS platforms have been addressed for both older and newer Devuan/Debian releases, especially for the autoinit procedure recommended as the first step. * We no longer hardcode Devuan's own APT sources lottery alias deb.devuan.org and instead test and pick reputable mirrors to use the fastest in the given server's location. * We limit the messaging noise generated by various parts of the new auto-healing system by switching the _INCIDENT_REPORT to NO by default, so only really critical incidents like service restarts caused by OOM (out of memory) incidents are still reported. * The legacy _XTRAS_LIST logic has been improved with changes documented. Now _XTRAS_LIST is by default EMPTY and extended only minimally depending on mode, so almost no BOA xtras are installed by default like before. * The _CUSTOM_CONFIG_CSF should protect only /etc/csf/csf.conf. Previously it blocked CSF/LFD upgrades completely while it should protect only the main config file. If the protected config file becomes incompatible as a result, it’s the system admin's responsibility to update it manually. * New control file /root/.dont.touch.permissions.cnf allows blocking any otherwise defined/run actions globally by taking precedence over any other settings in .barracuda.cnf and site/platform-level INI files. @=> New Features * Add _UPGRADE_MODE=FAST/FULL mode to speed up barracuda upgrades * Add /data/conf/sites-cron-off.ctrl to turn off all sites wget-cron * Add autosymlink tool to automate symlinking sites files directories * Add cooldown to max/critical load actions in auto-healing * Add dhcpfix tool used to fix vendor-specific forced-dns issues if needed * Add Droplet Agent to auto-healing * Add environment_indicator to Ægir hostmaster control panel * Add ffdevuan tool to update the list of reliable and fastest mirrors * Add instant SQL fallback for Valkey/Redis to global-valkey.inc * Add loadguard as future auto-healing orchestrator for testing * Add new dedicated tools: aptcleanup and vmnetfix in autoinit * Add support for python 3.13 * Add synproxy tool: SYNPROXY (TCP/443/80) + QUIC limiter (UDP/443) for CSF * Add system level /root/.dont.touch.permissions.cnf * Allow _LOCAL_DEVUAN_MIRROR but use _find_fast_devuan_mirror otherwise * Auto-enable/disable slow_query_log with /root/.mysqladmin.monitor.cnf * PHP 8.5 Support is ready * Protect from any autoupboa updates when _SKYNET_MODE=OFF * Protect from any barracuda updates when _SKYNET_MODE=OFF * Protect from any octopus updates when _SKYNET_MODE=OFF * Use MySQL 8.4 from Trixie on Excalibur until Percona releases own version @=> New Improvements * Add "How we build newer codebases for testing" in docs/BUILDTESTS.md * Add waiting before running octopus upgrade on init * Always check if /etc/hosts update is needed * Always use _spawn_detached procedure for Perl scripts * Always use nohup for detached Bash scripts * Build OpenSSL 3 w/o no-comp, no-hw * Check LE status and run another octopus upgrade if needed on boa install * Do not install Git from sources on BOA install * Do not send email on Spider Protection on/off * Enable APCu by default * Improve Ægir accelerated task queue * Make Solr/Java versions mapping strict * No automatic task queue on CI instance * Notify if multiback backups seem to run for too long * Pause Ægir queue when /run/boa_run.pid is present * Pause Ægir queue when daily.sh runs * Pause Ægir tasks queue during system DB backups * Prevent a flood of alerts on services up/down status if uptime < 15 min * Reload nginx if access log is missing or empty * Run _CHECK_MIRROR twice to prime DNS cache before the final speed test * Run _satellite_download_for_local_build only once on install * Run auto-healing only on fully installed system * Run improved scan_nginx.sh every 5 seconds * Save CPU cycles by disabling never used master Ægir cron/task queue * Sync /root/.allow.clamav.cnf and /root/.deny.clamav.cnf logic * Update APT sources on each upgrade * Update Devuan mirrors daily * Upgrade some held packages if needed and then rebuild from sources * Use _find_fast_devuan_mirror by default but static for archived beowulf * Use 180s opcache.revalidate_freq for heavy apps like CiviCRM * Use 60s opcache.revalidate_freq by default * Use Atomic lock/unlock to prevent TOCTOU race conditions globally * Use separate verbose logs for barracuda/octopus upgrade details and errors * Use special /var/log/boa/reset_no_new_password.pid to allow auto-healing @=> Changes * Add New Relic support for PHP 8.4 * Add Pinterest to $is_crawler list in Nginx configuration * Always log all barracuda/octopus upgrades, even self-upgrades * Debian Buster has been archived already * Display BOA Skynet Agent mesages only for logged in root * Do not automate /root/.force.reinstall.cnf * Don't invoke old proc_num_ctrl (replaced by new-generation auto-healing) * Don't run codebasecheck daily unless /root/.allow-codebasecheck.cnf exists * Drop legacy IMAP in PHP on Excalibur * Force _VALKEY_MAJOR_RELEASE=9 unless _CUSTOM_CONFIG_VALKEY=YES * Force slow Ægir tasks cron mode on VM with 4GB RAM or less * Move APCu config to parent INI * Move Zend OPcache config to parent INI * Remove 60s wait on boa reboot * Remove Percona 8.3 support * Restore the _SQLMONITOR feature * Turn _INCIDENT_REPORT globally off by default * Use _BINLOG_KEEP_HOURS 24 * Use Ægir install check for /var/aegir/.drush/hm.alias.drushrc.php * Use cache.backend.chainedfast for selected bins * Use slower _iteration in second.sh in auto-healing system @=> Upgrades * Commerce 3.2.0 with core 11.2.8 * CSF/LFD 15.00 * cURL 8.16.0 * Drupal 10.4.9 * Drupal 10.5.6 * Drupal 11.1.9 * Drupal 11.2.8 * Drupal 7.103.2 +Extra core * Drupal 7.105.1 +Extra core LTS * Drupal CMS 1.2.8 with core 11.2.8 * Duplicity 3.0.6 * farmOS 3.4.6 with core 10.4.9 * Git 2.51.0 * LocalGov 3.3.1 with core 10.5.6 * New Relic 12.2.0.27 * Nginx 1.29.1 * Nginx 1.29.3 * Node v22.20.0 * Node v22.21.0 * OpenCulturas 2.5.4 with core 10.5.6 * Openjdk 11.0.29 * OpenSSH 10.2p1 * OpenSSL 3.4.3 * PHP 8.3.24 * PHP 8.3.25 * PHP 8.3.26 * PHP 8.3.27 * PHP 8.3.28 * PHP 8.4.11 * PHP 8.4.12 * PHP 8.4.13 * PHP 8.4.14 * PHP 8.4.15 * PHP APCu 5.1.27 * PHP igbinary 3.2.16 * PHP igbinary 3.2.17 for 8.5 * PHP imagick 3.8.0 * PHP Yaml Pecl 2.2.5 * PHP_MCRYPT 1.0.9 for 7.3 and newer * PHPREDIS 6.3.0 * Pure-FTPd 1.0.52 * Python 3.13.9 for Duplicity * REDIS integration module 8.x-1.11.2 for Drupal 11.x * Sector 11.0.x-dev with core 11.2.8 * Thunder 8.2.6 with core 11.2.8 * Unbound 1.24.1 * Unbound 1.24.2 * Valkey 7.2.11 * Valkey 9.0.0 * Varbase 10.0.8 with core 10.5.6 * Varbase 9.1.12 with core 10.5.2 * vnStat 2.13 @=> Important Fixes * Add _fix_stop_solr to Fix Solr 7/9 conflicting ports * Add _if_drupal_patches_update — fixes #1892 * Allow cron web based requests even with HTTP Basic enabled in Ægir * Always call updatedb with -y in Ægir Provision backend * Always fix /etc/hosts before checking /etc/hostname * Auto-update hostname if doesn’t match /etc/hostname * Cron-only PHP entrypoint for Drupal 8+ w/ auth_basic turned off on the fly * Detect and fix broken downloads in /data/conf/patches/ — fixes #1906 * Do not add date stamps to scripts — fixes #1891 * Do not run duplicate unbound-control reload * Don't execute daily.sh until all installation procedures are finalized * Duplicity backups: replace --file-to-restore w/ --path-to-restore (#1901) * Fix access control for packages view in Ægir control panel * Fix broken _XTRAS_LIST logic and document changes * Hotfix for legacy vnStat installs — fixes #1908 * Improve _if_mydumper_is_locked procedure action/reporting in auto-healing * Improve _solr_health_check_fix to detect stale pid files * Install igbinary before redis extension to avoid redis ext build failure * Install key DNS tools early with autoinit * Java 17 should be set as default on Daedalus * Limited Shell wrapper for Drush improvements — fixes #1907 * Make local OpenSSL new/legacy ssl/certs symlinked to system ssl/certs * Remove duplicate unbound auto-healing * Remove Permissions-Policy headers from Nginx level * Remove server own IP from /etc/hosts if exists * Set /etc/hostname before barracuda install * Stop displaying useless expired one-time login link on boa install * The _CUSTOM_CONFIG_CSF should protect only /etc/csf/csf.conf * The maxmemory update for Valkey was missing — fixes #1893 * Update Nodejs/NPM install logic to always force upstream — fixes #1910 * Use drupal-ten-aegir-core-01.patch for Drupal 11.1.x * Use strict check for virt-what tool @=> Drupal platforms available for installation -- docs/PLATFORMS.md ## Drupal 11 CK3 - [Commerce 3.2.0] with core (11.2.8) (NEW) CMS - [Drupal CMS 1.2.8] with core (11.2.8) (NEW) DE1 - [Drupal 11.1.9] with Drush included -- dev/stage/prod (NEW) DE2 - [Drupal 11.2.8] with Drush included -- dev/stage/prod (NEW) SCR - [Sector 11.0.x-dev] with core (11.2.8) (NEW) THR - [Thunder 8.2.6] with core (11.2.8) (NEW) ## Drupal 10 CK2 - [Commerce v.2] with core (10.1.8) DX0 - [Drupal 10.0.11] with Drush included -- dev/stage/prod DX1 - [Drupal 10.1.8] with Drush included -- dev/stage/prod DX2 - [Drupal 10.2.12] with Drush included -- dev/stage/prod DX3 - [Drupal 10.3.14] with Drush included -- dev/stage/prod DX4 - [Drupal 10.4.9] with Drush included -- dev/stage/prod (NEW) DX5 - [Drupal 10.5.6] with Drush included -- dev/stage/prod (NEW) DXP - [DXPR Marketing 10.3.0] with core (10.3.6) EZC - [EzContent 2.2.15] with core (10.3.6) FOS - [farmOS 3.4.6] with core (10.4.9) (NEW) LGV - [LocalGov 3.3.1] with core (10.5.6) (NEW) OCS - [OpenCulturas 2.5.4] with core (10.5.6) (NEW) OFD - [OpenFed 12.2.4] with core (10.2.10) SOC - [Social 12.4.5] with core (10.2.10) VB9 - [Varbase 9.1.12] with core (10.5.2) (NEW) VBX - [Varbase 10.0.8] with core (10.5.6) (NEW) ## Drupal 9 DL9 - [Drupal 9.5.11] -- dev/stage/prod OLS - [OpenLucius 2.0.0] with core (9.5.11) OPG - [Opigno LMS 3.1.0] with core (9.5.11) ## Drupal 7 CK1 - [Commerce v.1] with core (7.105.1) (NEW) DL7 - [Drupal 7.105.1] -- dev/stage/prod (NEW) UC7 - [Ubercart 3.13] with core (7.105.1) (NEW) ## Drupal 6 DL6 - [Pressflow 6.60.1] -- dev/stage/prod UC6 - [Ubercart 2.15] with core (6.60.1) ### ### Stable BOA-5.7.12-pro - Full Edition ### Date: Tue Jul 29 08:44:02 AM AEST 2025 in Sydney ### @=> New BOA-5.7.12 PRO Release This maintenance release delivers critical hot-fixes and essential component upgrades to ensure maximum stability and compatibility across all environments. Immediate upgrade of both Barracuda and Octopus is strongly recommended to benefit from these fixes and avoid potential issues. @=> Important Fixes * Add _elevenValidatorPatch to fix Drupal 11 CMS distro fatal error * Fix typo in --with-avif for PHP 8.1+ — fixes #1881 * Removing all .drush.inc files only in Drupal 11 -- fixes #1885 and #5 @=> Changes * Back to non-phar drush8 to restore PHP-CLI live PHP switch capability @=> Upgrades * Drush 8.5.0.4 classic * Unbound 1.23.1 ### ### Stable BOA-5.7.11-pro - Full Edition ### Date: Fri Jul 25 06:53:03 PM BST 2025 in London ### Welcome Drupal 11—Ægir Mission Impossible—Again! ### @=> New BOA-5.7.11 PRO Release Drupal 11 with Ægir 3: They Said It Couldn’t Be Done — We Did It Anyway The future of Drupal hosting is here! With BOA-5.7.11 PRO, we proudly deliver what many thought impossible—full Drupal 11 support integrated with Ægir 3. This groundbreaking feature not only pushes the boundaries of what the BOA can achieve but also reaffirms our commitment to staying ahead of the curve for modern Drupal deployments. This release marks a major milestone: for the first time, BOA users can seamlessly install, manage, and scale Drupal 11 sites with all the automation, performance, and reliability you’ve come to expect. Powered by Percona 8 and fine-tuned to leverage the latest innovations across the stack, this update sets a new standard for hosting next-generation Drupal applications while continuing to fully support legacy Drupal versions, ensuring smooth operations for every site in your ecosystem, old or new. We are thrilled to introduce BOA-5.7.11 PRO, our 5th release under the new branch structure and dual licensing model. It merges seven months of intense development from the DEV branch, delivering over 340 commits packed with powerful features, critical fixes, and enhancements. Thank you to everyone who supports our work by purchasing a BOA PRO license: https://omega8.cc/boapro. As always, this announcement highlights only the most impactful changes. For a full breakdown, explore the complete commit history. @=> New Features * Drupal 11 support (requires Percona 8) * Install or update CiviCRM CLI Tool phar * MultiCore Apache Solr 9 support * Use Valkey and drop Redis support * Write usage reports also to ~/static/usage/ @=> Improvements * Add _mysql_high_load procedure * Add --with-avif to compatible PHP versions 8.1+ * Add check for downloaded dehydrated script integrity * Add fstab helper for Linode Volumes * Add mysql root password reset helper * Allow to force symlinks mode with empty /data/conf/force_symlinks.conf * Drupal 10+ core patches files are no longer added to codebase * Drupal 11 site installation details including admin pwd in the task log * Drupal 11 site is installed via site-platform-local Drush * Improve _PHP_CLI detection, also from static/control/cli.info * Improve permissions fix to include parent dir if app root != web root * Local Drush locking/unlocking no longer adds control files in codebase * Lock Local Drush and Symfony Console Input/Style in daily.sh * Lock/Unlock Local Drush is more reliable with both Provision and bash * More robust support for real IP detection behind vaious proxies * Symfony Console Input/Style locking more reliable with live diff/patch * Use faster SQL auto-healing for Too many connections * Use older CSF/LFD for legacy systems * Use queue.redis_reliable but only for core D8 to D10 @=> Changes * Always use system Drush 8 PHAR instead of Ægir local Drush * Install System Drush 8 as PHAR (self-contained) * Mark Apache Solr 4 with Jetty 9 as (deprecated) * Solr is no longer included via ALL keyword in the _XTRAS_LIST @=> Upgrades * CSF 14.24 * cURL 8.14.1 * dehydrated 0.7.3 * Drush 8.5.0.4 * MultiCore Apache Solr 9.8.1 * Nginx 1.29.0 * OpenSSH 10.0p2 * OpenSSL 3.4.2 * PHP 8.1.33 * PHP 8.2.29 * PHP 8.3.23 * PHP 8.4.10 * Valkey 7.2.10 @=> Important Fixes * Allow LE with HTTP Basic Auth fixed by Naurisr in #1790 * Remove too aggressive bots protection on /civicrm URLs @=> Drupal platforms available for installation -- docs/PLATFORMS.md ## Drupal 11 CK3 - [Commerce v.3] with core (11.2.2) DE2 - [Drupal 11.2.2] SCR - [Sector 11.0.x-dev] with core (11.2.0) THR - [Thunder 8.2.1] with core (11.2.2) ## Drupal 10 CK2 - [Commerce v.2] with core (10.1.8) DX0 - [Drupal 10.0.11] DX1 - [Drupal 10.1.8] DX2 - [Drupal 10.2.12] DX3 - [Drupal 10.3.14] DX4 - [Drupal 10.4.8] DX5 - [Drupal 10.5.1] DXP - [DXPR Marketing 10.3.0] with core (10.3.6) EZC - [EzContent 2.2.15] with core (10.3.6) FOS - [farmOS 3.3.1] with core (10.3.6) LGV - [LocalGov 3.1.3] with core (10.5.1) OCS - [OpenCulturas 2.2.1] with core (10.3.6) OFD - [OpenFed 12.2.4] with core (10.2.10) SOC - [Social 12.4.5] with core (10.2.10) VBX - [Varbase 10.0.6] with core (10.5.1) VB9 - [Varbase 9.1.10] with core (10.5.1) ## Drupal 9 DL9 - [Drupal 9.5.11] OLS - [OpenLucius 2.0.0] with core (9.5.11) OPG - [Opigno LMS 3.1.0] with core (9.5.11) ## Drupal 7 CK1 - [Commerce v.1] with core (7.103.1) DL7 - [Drupal 7.103.1] UC7 - [Ubercart 3.13] with core (7.103.1) ## Drupal 6 DL6 - [Pressflow 6.60.1] UC6 - [Ubercart 2.15] with core (6.60.1) ### ### Stable BOA-5.6.0-pro - Full Edition ### Date: Tue Dec 31 06:12:44 AM AEDT 2024 in Sydney ### Happy New Year! ### @=> New BOA-5.6.0 PRO Release – Happy New Year! We're thrilled to introduce BOA-5.6.0 PRO, our latest release and the fourth under our new branch structure and dual licensing model. This PRO release brings the project fully in sync with the DEV branch, which has been actively developed over the past two months, incorporating over 750 commits since BOA-5.5.0. We extend our heartfelt thanks to all of you who support our work by purchasing a BOA Pro license: https://omega8.cc/boapro. As always, this announcement covers only the most impactful new features, critical fixes, and enhancements. For a comprehensive list of all updates, please refer to the full commit history. @=> New Features * Active Sites Databases Backups are available in ~/static/files/dbackup/ * Add experimental support for Cloudflare R2 Object Storage * Add mergecsf tool to join and de-duplicate legacy csf configuration * Add perftest tool to test hardware performance within VM * Add php-cli access for [grp:ltd-shell-more] * Add smtpgapps tool to install and configure msmtp on Devuan * Add support for all AWS S3 regions, including dual-stack endpoints * Add support for php-rebuild or php-reinstall on barracuda upgrade * Add support for separate /root/.deny.solr7.cnf and /root/.deny.jetty9.cnf * Add verifyvhostsdns tool to check all vhosts for aliases with invalid DNS * New Relic Integration for Drupal with Drush Compatibility (8, 12, 13) * PHP 8.4 is fully supported and installed by default * Remote System Backups use `global`, `data` and optional `custom` buckets * Completely New Backups! There is too much to cover, so please refer to our extensive new documentation pages for all details. This new feature is exclusive to BOA PRO and will not be ported to LTS. New PRO Backups for BOA SysAdmin: https://github.com/omega8cc/boa/tree/5.x-pro/docs/BACKUP_ROOT.md New PRO Backups for Octopus Lshell User: https://github.com/omega8cc/boa/tree/5.x-pro/docs/BACKUP_USER.md New PRO Backups Retention Policy Configuration: https://github.com/omega8cc/boa/tree/5.x-pro/docs/BACKUP_RETENTION.md New PRO Backups Supported Regions and Bucket Creation Guidelines: https://github.com/omega8cc/boa/tree/5.x-pro/docs/BACKUP_REGIONS.md @=> Improvements * Add _backup_waiting_notify to make admin aware of the backup status * Add _csf_lfd_gateway_allow() * Add _linode_vm_postinstall() * Add _turn_off_apparmor unless /root/.keep_apparmor_on.cnf * Add /etc/cron.hourly/systemtime * Add auto-restore of backup_schedule * Add boa info to all backup reports * Add cleanup for /var/lib/redis/ on OOM incident * Add d7security_client-7.x-1.3 to o_contrib_seven and Hostmaster * Add early aa-teardown on init to make sure that AppArmor is turned off * Add function to auto-repair incomplete backup sets * Add local Ægir Third Party Libraries * Add more checks to make sure that OpenSSL is fully up to date * Add support for /root/.turn.off.auto.update.cnf * Add support for cloudflare-dns-ssl-py.info and cloudflare-dns-ssl-sh.info * Add wkhtmltox_0.12.6.1-3 for Daedalus * Ægir Hostmaster: Log wget cron runs * Ægir Provision: Install local Drush automatically on platform verify and unlock * Always run dist-upgrade twice -- helps with slow access to Devuan servers * Configure backups --concurrency dynamically * Disable _if_start_screen with noscreen in the args * Disable backup_schedule on systems with too low free RAM * Do not install CSF until BOA installation is complete on Linode * Do not install csf/lfd on Linode early * Do not reinstall Duplicity unless /root/.force.duplicity.reinstall.cnf exists * Drupal 7 now supports and expects Trusted Host Patterns * Improve all wget/curl downloads with proper re-try logic * Improve and simplify _switch_php() * Improve sysctl.conf template * Improve tools/le/hooks/cloudflare logic * Install or upgrade csf/lfd monitoring early * Install wkhtmltopdf from packages first to get all dependencies * Integrate original _SKYNET_MODE docs/history * More fixes in the vdrush wrapper to support Drush 13 * Move /data/disk/arch to global and /home to data backups * Move certain log scanners from the slow minute.sh to fast second.sh loop * Replace direct exec with _forward_to_shell in shell wrapper * Report also on newrelic-daemon and monagent versions in boa info * Run guest-water.sh right after CSF install or upgrade * Run orphaned duplicity processes cleanup separately * Sync _sql_busy_detection with max_connect_errors * Sync barracuda.cnf templates and docs * Sync sshd restart procedure across all scripts * Update barracuda config with missing vars if any * Update email template to remove confusing legacy details * Update xboa email templates * Use include/exclude instead of exclude/include logic * Use just one graceful csf restart on upgrade * Use newer, supported --copy-links option in Duplicity * Use noscreen in non-interactive scripts launched by parent scripts or cron * Waiting 8 minutes before attempting to run enforced post-install upgrade @=> Changes * Add docs/IPv6.md to explain why BOA disables IPv6 by default * Disable confusing hosting_client_send_welcome with non-working login link * Disable memory swap when running duplicity * Disable no longer supported GSSAPIAuthentication in SSH config * Disable performance_schema for Percona 5.7 but enable for 8.0+ * Disable ssl_stapling and fix http2 directive * Do not auto-re-enable swap * Enforce Composer 2.8.2 (because 2.8.3+ breaks previously working builds) * Force sysctl.conf.mod-disable-ipv6 * Introducing the New BOA Branching Scheme -- see docs/BRANCHES.md * Move /bin/websh to /opt/local/bin/websh * Newest Python should be installed only with barracuda or backup tools * Remove hosting_cron_use_backend.txt support * Remove no longer supported legacy _SCOUT_KEY * Remove no longer supported legacy HHVM * Set SOLR WAIT to 8s to speed up reboot and services restarts * The oldest NewRelic supported PHP version is 7.2 * Update and Sync nice/renice logic for scripts and services * Update boa-mirrors-2024-12.txt * Updates for lshell.conf template * Use gzip to compress classic myslqdump backups * Use zero tolerance mode for SSH/FTP failed login attempts * Use zstd to compress mydumper sql backups * We have now doubled the disk space in all our hosted plans @=> Upgrades * Composer 2.8.2 * cURL 8.11.1 * Drupal 7.103.1 * Drush 8.5.0.1 * Duplicity 3.0.3.2 * ionCube 14.0.0 (up to PHP 8.3) * New Relic 11.4.0.17 * Nginx 1.27.3 * OpenSSL 3.4.0 * PHP 8.1.31 * PHP 8.2.27 * PHP 8.3.15 * PHP 8.4.2 * PHP APCu 5.1.24 * PHP MCRYPT 1.0.7 * Unbound 1.23.1 * Use phpredis 4.3.0 with PHP 5.6 * Use phpredis 6.1.0 for 7.4 and newer @=> Important Fixes * Ægir Hostmaster: Improve hosting_cron_queue reliability * Ægir Hostmaster: Unset variables at the end of the loop * Ægir Provision: Add backup mode ctrl file cleanup on clone and migrate * Ægir Provision: Add more supported compression variants * Ægir Provision: Do not confuse PDO and MySQLi conventions * Ægir Provision: Fix Drush 13 support by invoking vendor/drush/drush/drush.php * Ægir Provision: Follow symlinks to include all files in custom backup task only * Ægir Provision: Improve function revoke() * Ægir Provision: Prioritize '.tar.zst' as provision_backup_suffix * Ægir Provision: Use supported localhost in can_grant_privileges() * Allow _php_if_versions_cleanup_cnf if Master Ægir was not upgraded yet * Barracuda downgrade protection should not rely on key/barracuda_key.txt * Constant E_STRICT is deprecated in PHP 8.4 * Disable shell wrapper on system stop/start early * Double check if /etc/init.d/nginx is really updated * Excessive email notifications due to DHCP error checks #1829 * Final fixes in shell wrapper make it rock solid again * Fix and sync all apt options * Fix autoinit conflicting functions * Fix for --enable-redis-lzf also in _php_extensions_update() * Fix for counting symlinked files in resources usage monitoring * Fix for duplicate http2 in all vhosts on upgrade * Fix for platforms deployed using Manage with Git method * Fix for SFTP chroot by using external mode in Subsystem sftp * Fix the bug in the shell wrapper when composer is both a command and argument * Fix the logic for Devuan base-files update for Daedalus * Fix the logic in _ifnames_grub_check_sync() * Improve the http2/ssl_stapling logic * Legacy MCRYPT can’t be used with PHP 8.4 * Make sure that both web and app root dirs are group writable * Make sure we add keys in a new line in xboa * More capabilities to satisfy complex composer tasks * Octopus downgrade protection should not rely on tools/key/octopus_key.txt * Patch hosting_cron.module automatically to make web cron 100% reliable * Remove duplicate ssl directives in all vhosts templates * Sync include/openssl extended check for latest version * Sync max allowed PHP-FPM versions running (11) * Sync maxBooleanClauses for new Solr cores to 4096 * Sync PHP 8.3 precedence -- it's still default version * Use dash by default and limit the use of _forward_to_shell ### ### Stable BOA-5.5.0-pro - Full Edition ### Date: Sat 26 Oct 2024 09:49:51 AM PDT in Santa Clara ### @=> New BOA-5.5.0 PRO Release – Thank You for Your Support! We're thrilled to introduce BOA-5.5.0 PRO, our latest release and the third under our new branch structure and dual licensing model. This PRO release brings the project fully in sync with the DEV branch, which has been actively developed over the past several months, incorporating nearly 400 commits since BOA-5.4.0. BOA-5.5.0 PRO also comes equipped with 26 Ægir-ready platforms, supporting either Drupal core alone or various popular Drupal distributions—seven of which are new! These platforms include options like Commerce, DXPR Marketing, EzContent, farmOS, LocalGov, OpenCulturas, OpenFed, OpenLucius, Opigno LMS, Sector, Social, Thunder, Ubercart, and Varbase. We extend our heartfelt thanks to all of you who support our work by purchasing a BOA Pro license: https://omega8.cc/boapro. As always, this announcement covers only the most impactful new features, critical fixes, and enhancements. For a comprehensive list of all updates, please refer to the full commit history. @=> New Features * Added codebasecheck tool for codebase compatibility check with Percona 8.0 * Added Drush 13 support by invoking vendor/drush/drush/drush.php directly * Added dedicated memorytuner (for testing for now) * Added mysqltuner5 and mysqltuner8 * Added bash version scan_nginx.sh -- the Nginx DoS Guard * Added support for more granular load limits like 1.2 2.5 3. * Added support for non-standard /hdd mount point * Added support for /mnt/ paths in Drush * Added sqlclean and vhostcheck tools for root * SQL Adminer access moved to Octopus Ægir HTTPS vhost URL at /sqladmin * Added incident_email_report() feature to all monitor/check/ scripts * Allow SSH based access authorization to SQL Adminer at new /sqladmin/ URL * Added incident detection and email reporting for LE certs renewal failures * Added screen auto-start in boa, barracuda and octopus * Added support for Percona 8.4 LTS (for testing only, you should use 8.0) * Added support for Percona 8.3 (for testing only, you should use 8.0) * Added support for Percona 8.0 (production ready) @=> Improvements * Added _redis_cold_restart to mysql restart in the monitor/check/ scripts * Rewrite the code used to install many new Drupal distros in Octopus * Added Troubleshooting Docs in docs/FIXME.md (more entries soon) * Faster _sql_busy_detection() in the monitor/check/ scripts * Added _mysql_downgrade_protection() to avoid downgrade from Percona 8.0 * Many improvements in the Nginx DoS Guard in the monitor/check/ scripts * Do not use fast firewall block unless /root/.instant.csf.block.cnf * Pause some new monitors sub-tasks during BOA upgrades and backups * Use underscore as prefix for all functions and camelCase vars * Block only relevant ports using the monitor/check/ scripts * Added docs on _NGINX_DOS_ variables * Added doc on PHP versions management — fixes #1807 * Added separate docs/PHP-FPM.md and docs/DRUSH-CLI.md * Added docs on Importance of Keeping SKYNET Enabled in BOA * Added _CPU_TASK_RATIO to the CPU logic in auto-healing scripts * Display currently used GRUB config in boa info * Make the not_supported_virt() BOLD ENOUGH in boa info * Added WARNING if /root/.allow.any.virt.cnf exists in boa info * Display _DSK Usage for relevant partitions only in boa info * Improved _XSY System Uptime/Load/Kernel/Disk/Memory Report in boa info * Added Lshell version to boa info * Always attach basic boa info report to barracuda upgrade log/email * Improve check_php_rebuild() and add separate check_php_ssl_version() * Explained _INCIDENT_EMAIL_REPORT variable * Explained _SQL_MAX_TTL variable * Explained _SQL_LOW_MAX_TTL variable * Split big minute.sh into smaller auto-healing scripts * Added procedure to fix empty or missing .dhp files * Improved /root/.dont.use.fancy.bash.login.cnf logic * Improved the octopus upgrade email tpl * Added Key Services Uptime Report to boa info * Pretty large defunct code cleanup @=> Changes * Install python3-full packages * Duplicity: Remove Python 2 support and require OpenSSL 3 * Remove restrictions for opcache_compile_file (Grav CMS support) * Removed legacy manage_ip_auth_access() for SQL Adminer access * PHP 8.3 is the new default version * Prefer system default Python3 for Lshell and src build for Duplicity * Always run ifnames_grub_check_sync in DEMO mode unless ctrl file exists * Remove chrony if preinstalled * PHP 8.1 is the max version supported on Stretch and Jessie * New Relic removed support for legacy PHP 7.0 and 7.1 * Run _update_boa_tools only when new serial or pid key is detected * Redis extension 8.x-1.8.2 (with not needed db schema update reverted) * Disabled backboa install in auto mode * Allow all 7.x PHP versions on legacy (Debian) systems * Amazon EC2 No Longer Supported (system crashes, doesn't support Devuan) * Use legacy PHP 7.x by default on legacy Debian systems @=> Upgrades * Lshell 0.10 * Composer 2.8.1 * Unbound 1.21.1 * OpenSSL 3.3.2 * PHP 8.3.13 * PHP 8.2.25 * PHP 8.1.30 * OpenSSH 9.9p1 * Python 3.12.5 (for Duplicity) * cURL 8.10.1 * Nginx 1.27.2 * ionCube 13.3.1 (also for PHP 8.3) * MyQuick 0.16.7-3 * CSF 14.21 * Duplicity 3.0.2 @=> Important Fixes * Fix PATH in the websh wrapper (fixes git and OpenSSL issues) * Fix for _PHP_FPM_TIMEOUT logic * Remove apt-listchanges on Debian (for legacy systems with broken debconf) * Improve _if_fix_python() procedure logic * Fix the logic for _update_boa_tools on init * Do not remove usage.sh — fixes #1824 * Add cleanup for exclude.tag (could result with no files on clone) * Do not restart sshd every minute * Do not reload nginx every few minutes by default * cURL version upgrade should happen only with barracuda upgrade * Fix for too broad cleanup in /var/xdrago/log/ * Ignore all dynamic requests related to css/js while they are generated * Do not log redirects (Nginx) * Inconsistent checks for SSL version in check_php_rebuild — fixes #1815 * Use _CURL_VRN=7.50.1 for Wheezy compatibility * Use separate log for mysql notices — fixes #1805 * Add built-in /run/unbound setup — fixes #1804 * Percona 5.7 still depends on legacy packages naming — fixes #1808 * Compatibility with legacy Python 3.5 @=> Drupal platforms available for installation -- docs/PLATFORMS.md * Commerce Kickstart 2.77 (7.101.1) * Commerce Base 2.40 (10.1.8) * Commerce Kickstart 3.0.0 (10.3.6) * DXPR Marketing 10.3.0 (10.3.6) * EzContent 2.2.15 (10.3.6) * farmOS 3.3.1 (10.3.6) * LocalGov 3.0.11 (10.3.6) * OpenCulturas 2.2.1 (10.3.6) * OpenFed 12.2.4 (10.2.10) * OpenLucius 2.0.0 (9.5.11) * Opigno LMS 3.1.0 (9.5.11) * Sector 10.0.0-rc5 (10.2.10) * Social 12.4.5 (10.2.10) * Thunder 7.3.7 (10.3.6) * Ubercart 2.15 (6.60.1) * Ubercart 3.13 (7.101.1) * Varbase 9.1.6 (10.3.6) * Varbase 10.0.2 (10.3.6) * Pressflow 6.60.1 (core only) * Drupal 7.101.1 (core only) * Drupal 9.5.11 (core only) * Drupal 10.0.11 (core only) * Drupal 10.1.8 (core only) * Drupal 10.2.10 (core only) * Drupal 10.3.6 (core only) * Drupal 10.4.x-dev (core only) ### ### Stable BOA-5.4.0-pro - Full Edition ### Date: Wed 14 Aug 2024 06:24:03 AM AEST in Sydney ### @=> New BOA PRO Release & Comparison with LTS and DEV Branches We are excited to announce the release of BOA-5.4.0 PRO and BOA-5.4.0 LTS, marking the second release under our new branch structure and dual licensing model, which began with BOA-5.2.0. These new PRO and LTS versions bring the project fully up to date with the DEV branch, which has been actively developed over the past several months. As always, this announcement highlights only the most significant new features, critical fixes, and improvements. For a detailed list of all changes, please refer to the commit history. @=> New Features * Simplify and speed up BOA install/upgrades -- please check all details in the updated and greatly improved documentation: docs/INSTALL.md docs/UPGRADE.md docs/SELFUPGRADE.md docs/MAJORUPGRADE.md * AppArmor BOA integration for more strict system protection (needs docs) * Barracuda install without Octopus is now possible -- docs/INSTALL.md * Enable instant php-cli version switch for Ægir backend -- docs/DRUSH.md * Improve Ruby Gems and Node/NPM security and speed x3 -- docs/GEM.md * Let's Encrypt for Ægir Hostmaster installed automatically -- docs/SSL.md * Let's Encrypt Live Mode is enabled by default -- docs/SSL.md * Add three manual backup modes in Ægir (incomplete feature at the moment) * New Relic support with Octopus/Platform/Site Config -- docs/NEWRELIC.md * Restore _AEGIR_UPGRADE_ONLY {aegir} as supported barracuda upgrade mode * Restore {aegir|platforms|both} as supported octopus upgrade modes * Security Considerations for Multi-Ægir Systems -- docs/SECURITY.md * Use /root/.deny.clamav.cnf to auto-disable clamav if installed * Use /root/.deny.java.cnf to auto-disable Solr and Jetty if not used * Drush 12 in Ægir Tasks: Dynamically Utilize Site-Local Drush for the updatedb Operations on Drupal 10+ (needs docs). For now here is a brief explanation on how it works: # Both Migrate and Clone tasks in Ægir by default run the updatedb with Ægir own Drush 8 in the final deploy internal procedure. # This may cause unexpected issues in Drupal 10 and newer versions, so we have added a switch which allows you to tell Ægir to skip running `updatedb` on Drupal 10+ -- either globally with empty control file ~/static/control/DisAutoUpDb.info or per site with empty control file ~/static/control/sitename_DisAutoUpDb.info where `sitename` is the site main domain name used in its Drush alias. You could then unlock the Site-Local Drush and run it manually with `vdrush` in the platform app root (not web root) to better control what happens on `updatedb` using command: `vdrush @site-alias updatedb` # Automatic mode does it even better for Drupal 10+ Here's how it works, given no control file listed above exists: 1. Platform Verify task locks Site-Local Drush and patches Drupal core. 2. If the site is migrated to different platform or cloned to different platform, Ægir will check if **both old and new** platforms have the Site-Local Drush in their codebases. 3. If Site-Local Drush is detected in both platforms Ægir will unlock Drush in both platforms, will also revert the Drupal core patch it normally needs to use its own Drush 8. 4. Now Ægir will run the Site-Local Drush for `updatedb` command and will report all details in the task log in the admin interface. 5. Once the `updatedb` is complete, Ægir will automatically apply the Drupal core patch again and will lock Site-Local Drush, so you could run any other tasks in the control panel as usual. Magic! @=> Drupal platforms available for installation -- docs/PLATFORMS.md * Drupal 10.4.x-dev * Drupal 10.3.1 * Drupal 10.2.7 * Drupal 10.1.8 * Drupal 10.0.11 * Social 12.4.2 (10.2.6) * Thunder 7.3.0 (10.3.1) * Varbase 10.0.0 (10.3.1) * Varbase 9.1.3 (10.2.6) * Drupal 9.5.11 * OpenLucius 2.0.0 (9.5.11) * Opigno LMS 3.1.0 (9.5.11) * Commerce 1.72 * Commerce 2.77 * Drupal 7.101.1 * Ubercart 3.13 * Pressflow 6.60.1 * Ubercart 2.15 @=> Improvements * Add better protection from duplicate sql tasks * Improve Ægir tasks messages to identify new improvements in the backend * Update Drush 10+ aliases on the fly within Ægir deploy procedure * Add BOA Roadmap & Progress Update in ROADMAP.md * Add bring_all_ram_cpu_online * Add CSF self-update debugging log in /var/backups/csf/water/ * Add Dual License and BOA Branches Explained in DUALLICENSE.md * Add INI (platform level) docs in docs/ini/platform/INI.md * Add INI (site level) docs in docs/ini/site/INI.md * Add killer script for hanging apt-get update * Add support for /root/.force.queue.runner.cnf * Add switch_to_bash_in_octopus * Detect and remove stale pid faster * Display also system-manufacturer in the welcome messages and reports * Do not lower proc nice on init and major OS upgrades * Do not restart slow starting services during major OS upgrade * Execute post-install octopus auto-upgrade on boa and octopus install * Explain how upgrades affect BOA special shell wrapper * Improve and simplify is_logged_in early check in global.inc * Improve rsyslog to use separate log files for cron, mail, lfd, iptables * Limit noise printed in the console * Protect csf.allow from removing custom entries * Rewrite and improve all BOA project docs to use Markdown * Rewrite and improve the main README.md * Simplify upgrade docs * Turn Off AppArmor while running octopus * Update tests for Amazon EC2 environment detection * Use `drush11 aliases` or `drush11 sa` for Drupal 8+ core and PHP 8.2+ * Use new `fancynow` welcome screen only for interactive root sessions * Nginx: Sync js/css aggregation support * Nginx: Sync static files regex @=> Changes and Upgrades * Add compatibility with Redis 8.x-1.7.1 * Add igbinary support to PHP 5.6 * Add recommended security and privacy HTTP headers in Nginx config * Add required now $settings['state_cache'] = TRUE; in global.inc * Adjust patches and PHP versions * AdvAgg is no longer added to D8+ o_contrib * Barracuda upgrade after boa install is now automated * Build OpenSSH from sources by default * cURL 8.9.1 * Disable man-db/auto-update to speed up also autoinit and boa install * Duplicity 3.0.0 * Force mysql root password update on barracuda upgrade * Git 2.45.2 * Image Optimize toolkit binaries are now included by default * Install Python 3.12.4 for Duplicity * ionCube 13.0.4 * Launch daily.sh automatically after barracuda upgrade * Lshell 0.9.18.10 * MySecureShell master-29-06-2024 * New Relic 19.9.9.93 * New Relic no longer supports PHP 5.6 * Nginx 1.27.0 * Nginx: http2 is now a separate directive * OpenSSL 3.0.14 LTS * Re-enable cleanup for GHOST distros revisions * Remove /etc/apt/preferences * Remove cloud-utils if detected * Remove legacy i386/x32 support * Remove no longer supported MariaDB code * Remove not used mysql_hourly.sh * Removing old boa-init no longer needed after introducing fast autoinit * Removing systemd cleanup from boa, now handled by the fast autoinit * Replace mail with s-nail * Replace pdnsd with unbound * Restrict also find/scp to prevent lshell escape * Upgrade to openjdk 11.0.24 * Use /etc/ssh for OpenSSH built from sources (no new server keys, finally) * Use maximum compatible PhpRedis versions for legacy PHP * Use PermitRootLogin prohibit-password * We no longer allow to install BOA on Debian to avoid confusion * We no longer override server sshd keys to avoid confusion * Nginx: Remove the legacy X-XSS-Protection header * Nginx: block bytedance and PetalBot aggressive crawlers @=> Important Fixes * Add python3.5 compatibility for Stretch * Add second cron entry for critically important /var/xdrago/clear.sh * Add support for legacy python3.4 * Always copy hostmaster LE cert to /etc/ssl/private/ if just updated * Avoid any AppArmor code on legacy Debian systems * Bash 5.2 compatibility * Detect broken GIT early and reinstall from sources * Do not install PHP 8.2 8.3 with _OPENSSL_EOL_VRN and _OPENSSL_LEGACY_VRN * Do not use --with-http_v3_module for Nginx on legacy systems * Do not use --with-imap for PHP on Jessie * Do not use --with-imap for PHP on major upgrade on any OS * Do not use --with-sodium for PHP on Jessie * Fix confusing ICU logic * Fix for ignored nofile limits * Fix for iptables paths backward compatibility * Fix for non-blocking ntpdate * Fix New Relic APT config * Fix Percona apt config logic * Fix platforms symlinking in the limited shell account * Fix Pure-FTPD install and config * Force crontab update on major OS upgrade * Improve resolvconf auto-config * Let's Encrypt actually supports wildcard names already * Make sure that _PHP_SINGLE_INSTALL exists before disabling other versions * Modernize Percona keys logic * Nginx: Sync http2 in legacy tpl * Remove blocking cnf file if php-max is used * Show PHP patch results on _DEBUG_MODE=YES * Sync for python3.11 * Sync PHP extensions existence check directly, not just via ctrl files * Sync PhpRedis build options with versions compatibility * Sync with python3.9 * Update wkhtmltopdf versions logic * Use cURL 7.71.1 on Jessie * Use cURL 8.2.1 on Stretch * Use OpenSSH 8.3p1 on Jessie * Use OpenSSH 9.3p1 on Stretch * Use OpenSSL 1.0.2u on Jessie * Use OpenSSL 1.1.1w on Stretch * Fix for composer.json and composer.lock protection ### ### Stable BOA-5.3.0-pro - Full Edition ### Date: Mon 12 Aug 2024 05:33:46 AM AEST in Sydney ### @=> New BOA LTS Release & Comparison with PRO and DEV Branches We are excited to announce the release of the latest BOA LTS version, marking the first LTS release since the introduction of our new branch structure and dual licensing model, which began with the BOA-5.2.0 release. This LTS version brings the project up to date with BOA-5.3.0-pro, which has been available for several months. Both BOA-5.3.0-pro and BOA-5.3.0-lts are officially released today. Looking ahead, BOA-5.4.0-pro will be released within the next 48 hours, incorporating all recent developments from the DEV branch. Please note that the project README and documentation displayed on GitHub by default apply primarily to the BOA DEV branch, and shortly to BOA PRO. These do not cover BOA LTS. If you are working with the LTS version, ensure you switch to the appropriate branch to access legacy documentation relevant to BOA LTS. As always, we highlight only the most critical fixes and improvements in this announcement. For a comprehensive list of changes, please refer to the commit history. @=> New Features * PHP 8.3 Support * Update sFTP password and password expiration date with temporary pid file ~/static/control/run-sftp-password-update.pid Now the main Octopus limited shell user can easily self-update password based access if still has working SSH keys but lost working password. New password will be written to ~/static/control/new-USER-password.txt * Add boa cleanup {detect|purge} {user|batch} to automate Octopus instances cleanup. Requires existence of /data/disk/USER/log/CANCELLED file and no vhosts existing in /data/disk/USER/config/server_master/nginx/vhost.d/ It will archive only config files and delete everything else, but will not delete any databases nor db users (yet). @=> Improvements * Add ltd-shell account client access to moved sites files in static/files * Always install legacy OpenSSL first and force new on upgrade * Disable man-db/auto-update to speed up barracuda upgrades * MySQL: Disable performance_schema by default * MySQL: Do not run mysql_cleanup.sh on servers with >100 dbs * Nginx DoS-Guard: Add ignore_admin to protect site admin activity * Nginx DoS-Guard: Catch typical hack probe requests early * Nginx DoS-Guard: Detect and block ‘unknown’ IPs requests * Nginx DoS-Guard: Track and block 500/403/404 flood * Prepare for but do not enable http3/quic yet * Use cold solr7 restart only on barracuda upgrade @=> Changes and Upgrades * Build PHP --with-bz2 * Build Redis with --enable-redis-lzf --enable-redis-igbinary * Composer 2.7.7 * cURL 8.7.1 * Drupal 7.101.1 * Enable ClassicTrack for Ægir tasks by default * ionCube 13.0.2 * Nginx 1.26.0 * OpenSSH 9.8p1 * OpenSSL LTS with 3.0.13 (new default version) * PHP 8.1.29 * PHP 8.2.22 * PHP 8.3.10 * PHP APCu 5.1.23 * PHP igbinary 3.2.15 * PHP imagick 3.7.0 * Ruby 3.3.4 * Use _USE_FPM=1024 as minimum * Use phpredis 6.0.2 for 7.2 and newer @=> Important Fixes * Add clamd/freshclam to auto-healing * Add cleanup for ctrl files blocking PHP upgrade * Always check if all /var/xdrago/* scripts are present or force update * Always install openjdk-11-jre-headless * Fix for vdrush @site updb in Drush 12 * Fix protection from duplicate sql backups * Legacy PHP versions require legacy OpenSSL version * More protection from race conditions in auto-healing * Remove old auto-healing pids if detected * Restore ULIMIT in nginx init.d * Sync autoupboa cron to not collide with sql backups * The adduser no longer automates —home * Use only php-fpm reload instead of start on upgrade * Use PHP 7.4 in run_drush8_cmd if available ### ### Stable BOA-5.2.0 - Full Edition ### Date: Wed 03 Apr 2024 02:11:56 PM CEST in Warsaw ### @=> Notes on new available BOA branches and licenses BOA is available in three main branches, but only LTS for installation: * LTS which remains completely free to use without any kind of license as it was from the beginning (previously named HEAD or STABLE). This branch should be considered as BOA LTS with slow updates, focused on both security and bug fixes, but very limited new features additions. * DEV which requires paid license for both install and upgrade and includes the latest features, security and bug fixes and installed services versions. This branch shouldn't be used in production without extensive testing. * PRO which requires paid license and is available only as an upgrade from either LTS or DEV (or previous HEAD/STABLE) is the branch with regular monthly or bi-monthly releases, closely following tested DEV branch. Once you install BOA LTS and want to upgrade to PRO with license obtained from https://omega8.cc/licenses you will need to use up-pro command. Once you install BOA LTS or PRO and want to upgrade to DEV with license from https://omega8.cc/licenses you will need to use up-dev command. Old commands using in-head, in-stable, up-head and up-stable no longer work to avoid confusion and have been replaced with in-lts and up-lts in all installation and upgrade scripts. Please make sure to read updated docs/INSTALL.txt and docs/UPGRADE.txt @=> New Features * Add autodaedalus tool for easy automated major system upgrades * Add Linux Containers (LXC) guest as supported (tested only by others) * Add mysql_cleanup running hourly to keep known caches overhead at minimum * Add OpenVZ Containers guest as supported (tested only by others) * Add support for ~/static/control/disable_user_register_protection.info * Add support for du command in limited shell with /root/.allow.du.cnf * Debian Bookworm and Devuan Daedalus support (needs further testing) * Full Drupal 10.2 support for install and upgrades from Drupal 9 and 10 @=> Improvements * Add control/enable-drush-sa.info for native drush sa command * Add hyperv qemu and kvm aws as supported * Add ltd-shell alias vdrush:vendor/bin/drush * Do not enforce newrelic_background_job(FALSE) * Document BOA planned features in the ROADMAP.txt * Document Drush usage in docs/DRUSH.txt * Make it clear that only Devuan Chimaera should be used in production * New Relic: Separate Web and Drush stats * Purge firewall deny rules before reboot for faster system restart * README rewrite and improvements @=> Changes and Upgrades * Ægir D10 Platforms: 3x Drupal core 10.0.11 * Ægir D10 Platforms: 3x Drupal core 10.1.8 * Ægir D10 Platforms: 3x Drupal core 10.2.4 * Ægir D10 Platforms: Social 12.2.2 with core 10.2.4 * Ægir D10 Platforms: Thunder 7.2.0 with core 10.2.4 * Ægir D10 Platforms: Varbase 9.1.1 with core 10.2.4 * Disable support for several built-in legacy D7 distros * Do not enable /root/.fast.cron.cnf by default * Drush 8.4.12.9 * Nginx 1.24.0 * Nginx: update ssl_ciphers remove 4 weak but leave 2 to support Safari 6-8 * OpenSSH 9.7p1 * OpenSSL LTS with 3.0.13 (prepare, optional) * PHP 8.1.27 * PHP 8.2.17 * Redis 7.0.15 * Remove legacy Ubuntu support @=> Important Fixes * Always revert to iptables-legacy from nf_tables * Fix for broken cURL self-healing * Fix for cURL/libcurl version conflict * Force Nginx cold restart if status is locked * Improve auto-healing for duplicate move_sql and mysql_backup * Improve downgrade_protection * Revert "Sync /etc/security/limits.conf" * Update Drush yml sites aliases also for Ægir system user ### ### Stable BOA-5.1.0 - Full Edition ### Date: Sat 04 Nov 2023 03:26:41 PM CET in Warsaw ### ### Documenting details in progress... ### @=> New Features * Automatically detect and add known web-root dir names on Add New Platform * Lock Drush in any platform with Ægir task: Verify + Lock Drush * Manage pid files in platforms web-root for Drush Lock/Unlock status * Unlock Drush in any platform with new Ægir task: Unlock Local Drush @=> Improvements * Document ~/static/control/FastTrack.info in docs/FASTTRACK.txt * Improve BOA forks compatibility with standalone Ægir paths * Improve tasks labels in the Ægir control panel * Use Ægir backend built-in chmod for Unlock Drush w/o external scripts @=> Changes and Upgrades * Ægir D10 Platforms: 3x Drupal core 10.1.6 * Ægir D10 Platforms: Social 12.0.0-rc3 with core 10.0.11 * Ægir D10 Platforms: Thunder 7.1.2 with core 10.1.6 * Ægir D10 Platforms: Varbase 9.0.16 with core 10.1.6 * Enable hosting_site_backup_manager Ægir extension by default again * Fix permissions and ownership on every Platform Verify for Drupal 8/9/10 * OpenSSL 3.1.4 * PHP 8.1.25 * PHP 8.2.12 @=> Important Fixes * Added missing web-root paths in built-in platforms for Drupal 9/10 * Fix the ability to rename existing platforms in the Ægir control panel * Multiple fixes for built-in permissions and ownership Ægir scripts ### ### Stable BOA-5.0.0 - Full Edition ### Date: Thu 26 Oct 2023 09:55:22 PM CEST in Warsaw ### ### Documenting details in progress... ### @=> New Features * Add support for verbose Drush like 'drush -vvv @site status' * Ægir in BOA is now fully compatible with PHP 8.1 and 8.2 * Do not purge cache tables listed in /root/.my.cache.exceptions.cnf * Drupal 10 is fully supported (needs docs) * Drupal 10 platforms available: Thunder, Varbase, Drupal 10.1 and 10.0 * Make system reboot much faster, also with 'boa reboot' command * OpenSSL 3.x optional/test support with /root/.install.modern.openssl.cnf @=> Improvements * Always install latest Composer on barracuda upgrade * Enable ~/static/control/FastTrack.info by default (needs docs) * Minimize services downtime on upgrade using soft reload only if possible * Site Local Drush is no longer removed on platform Verify (only locked) * Use 'barracuda php-idle disable' to speed up major upgrades @=> Changes and Upgrades * Ægir D10 Platforms: 3x Drupal core 10.0.11 * Ægir D10 Platforms: 3x Drupal core 10.1.5 * Ægir D10 Platforms: Thunder 7.1.2 with core 10.1.5 * Ægir D10 Platforms: Varbase 9.0.16 with core 10.1.5 * Ægir D7 Platforms: Commerce 1.72 with core 7.98.1 * Ægir D7 Platforms: Commerce 2.77 with core 7.98.1 * Ægir D7 Platforms: Guardr 2.57 with core 7.98.1 * Ægir D7 Platforms: OpenOutreach 1.69 with core 7.98.1 * Ægir D7 Platforms: Opigno LMS 1.59 with core 7.98.1 * Ægir D7 Platforms: Panopoly 1.92 with core 7.98.1 * Ægir D7 Platforms: Ubercart 3.13 with core 7.98.1 * Ægir D9 Platforms: 3x Drupal 9.5.11 * Ægir D9 Platforms: OpenLucius 2.0.0 with core 9.5.11 * Ægir D9 Platforms: Opigno LMS 3.1.0 with core 9.5.11 * Ægir D9 Platforms: Social 11.9.14 with core 9.5.11 * BOA requires at least PHP 7.4 or newer as default version * Change redis_perm_ttl from 6h to 24h * Do not inlcude advagg/cdn in o_contrib_eight * Drupal 10: add minimum patch for core * Drupal 10: disable not working yet welcome email on install * Drupal 10: fix compatibility and add missing code in Drush 8 * Drupal 10: lock vendor/drush * Drupal 10: lock vendor/symfony/console/Input * Drupal 10: replace psr/log in core with Drush 8 version * Drush Launcher is not supported anymore so removed * Enable /root/.fast.cron.cnf by default (needs docs) * Remove confusing -bin suffix from Drush 10+ (needs docs) * Set _PURGE_BACKUPS default to 14 or 7 on hosted BOA * Set Composer Install Support in Ægir Backend as disabled by default * The redis_use_modern is no longer optional in the INI files * Update vendor code in the Ægir backend / Provision * Use _STRONG_PASSWORDS=YES by default * Use _USE_MYSQLTUNER=NO by default @=> Important Fixes * Do not enable redis on D7/D6 automatically, it works anyway * Fast DNS Cache Server (pdnsd) install is no longer optional since 2014 (!) * Fix for hosting_cron_queue() with ADV_CRON_MAX_PLL logic * Make sure that expired password will not hang backend task * Nginx: Add missing no-cache checks from @cache to @drupal * Nginx: Move exceptions to the /index.php location * Nginx: The css/js aggregation logic has changed in Drupal 10.1 ### ### Cutting Edge BOA-5.0.0-dev - Initial Edition ### Date: Sat 06 May 2023 08:42:31 AM EEST in Kyiv ### Слава Україні! ### ### Documenting details in progress... ### @=> New Features * Add 'barracuda php-idle disable/enable' (needs docs) * Automatic BOA System Major Upgrade Tool -- see docs/UPGRADE.txt * Debian Bullseye and Buster support * Devuan Chimaera and Beowulf support (systemd-free Debian alternative) * Make Composer running with PHP defined in ~/static/control/cli.info * Make PHP-CLI for Composer and Drush configurable on the fly (needs docs) * New multi-step BOA install procedure -- see docs/INSTALL.txt * PHP 8.2 support @=> Major Improvements * Barracuda first upgrade after boa install no longer requires reboot * Use all available CPU cores for much faster PHP, Nginx, OpenSSL etc builds @=> Important Changes * BOA requires the classic network interface naming convention (needs docs) * Disable all nightly codebase cleanup procedures * Nginx: Add PATCH to allowed $request_method list * Nginx: Remove deprecated upload_progress support * Remove AdvAgg and CDN from D9+ o_contrib * Rewrite the _PHP_MULTI_INSTALL cleanup to make it optional (needs docs) * Stop running any Drush operations on Drupal 8+ in daily.sh * Switch to Redis Server 7.x by default * The php-all should no longer include 7.3 and older versions (needs docs) * Ubuntu support is deprecated * Use php-max to install ALL nine (9) PHP versions (needs docs) @=> Important Fixes * Discover the system IPv4 once and store in a file * Fix several issues with ~/static/control/MyQuick.info logic * Maintain csf.allow/ignore backup on serial update in /var/backups/csf/ * Nginx: Fix protected access to /update.php * Nginx: Protect composer.json if exists in the Drupal web-root ### ### NEW BOA-4.2.0-stable - Full Edition ### Date: Sat 06 May 2023 07:42:19 AM EEST in Ivano-Frankivsk ### Слава Україні! ### ### Documenting details in progress... ### @=> New Features * Add 'barracuda php-idle disable/enable' (needs docs) * Automatic BOA System Major Upgrade Tool -- see docs/UPGRADE.txt * Debian Bullseye and Buster support * Devuan Chimaera and Beowulf support (systemd-free Debian alternative) * Make Composer running with PHP defined in ~/static/control/cli.info * Make PHP-CLI for Composer and Drush configurable on the fly (needs docs) * New multi-step BOA install procedure -- see docs/INSTALL.txt * PHP 8.2 support @=> Major Improvements * Barracuda first upgrade after boa install no longer requires reboot * Use all available CPU cores for much faster PHP, Nginx, OpenSSL etc builds @=> Important Changes * BOA requires the classic network interface naming convention (needs docs) * Disable all nightly codebase cleanup procedures * Remove AdvAgg and CDN from D9+ o_contrib * Rewrite the _PHP_MULTI_INSTALL cleanup to make it optional (needs docs) * Stop running any Drush operations on Drupal 8+ in daily.sh * Switch to Redis Server 7.x by default * The php-all should no longer include 7.3 and older versions (needs docs) * Ubuntu support is deprecated * Use php-max to install ALL nine (9) PHP versions (needs docs) @=> Important Fixes * Discover the system IPv4 once and store in a file * Maintain csf.allow/ignore backup on serial update in /var/backups/csf/ ### ### Stable BOA-4.1.4-rel - Full Edition ### Date: Fri Dec 10 22:30:49 CET 2021 in Warsaw ### ### Documenting details in progress... ### @=> New Features * * * @=> Major Improvements * * * @=> Important Changes * * * @=> Important Fixes * * * ### Stable BOA-4.1.3 Release - Full Edition ### Date: Thu Sep 24 18:51:49 CEST 2020 ### Milestone URL: https://github.com/omega8cc/boa/milestones/4.1.3 # Release Notes: This BOA release is a second transitional release before switching to rolling release policy. Detailed changelog will follow. This BOA update provides latest PHP versions, system updates, including security fixes, many bug fixes, latest Ægir version ..but no Ægir platforms are installed by default anymore, unless their keywords are listed in the file ~/static/control/platforms.info (please read further below for details) TL;DR * Yes, blazing fast site clone/migrate mode is available even for giant sites! * Yes, BOA still supports Pressflow 6 (LTS version only!) * No, we no longer install any supported distros as platforms by default. @=> Super fast site cloning and migration mode (NEW!) It is now possible to enable blazing fast migrations and cloning even sites with complex and giant databases with this empty control file: ~/static/control/MyQuick.info By the way, how fast is the super-fast? It's faster than you would expect! We have seen it speeding up the clone and migrate tasks normally taking 1-2 hours to... even 3-6 minutes! Yes, that's how fast it's! This file, if exists, will enable a super fast per table and parallel DB dump and import, although without leaving a conventional complete database dump file in the site archive normally created by Ægir when you run not only the backup task, but also clone, migrate and delete tasks, hence also restore task will not work anymore. We need to emphasise this again: with this control file present all normally super slow tasks will become blazing fast, but at the cost of not keeping an archived complete database dump file in the archive of the site directory where it would be otherwise included. Of course the system still maintains nightly backups of all your sites using the new split sql dump archives, but with this control file present you won't be able to use restore task in Ægir, because the site archive won't include the database dump -- you can still find that sql dump split into per table files in the backups directory, though, in the subdirectory with timestamp added, so you can still access it manually, if needed. @=> Drupal platforms and Composer support We no longer install any supported Drupal distros as platforms by default, but you can customize Octopus platform list via control file, which will be used on the next Octopus upgrade (you can request it individually if you are on hosted Ægir service): ~/static/control/platforms.info This file, if exists and contains a list of symbols used to define supported platforms, allows to control/override the value of _PLATFORMS_LIST variable normally defined in the /root/.${_USER}.octopus.cnf file, which can't be modified by the Ægir instance owner with no system root access. IMPORTANT: If used, it will replace/override the value defined on initial instance install and all previous upgrades. It takes effect on every future Octopus instance upgrade, which means that you will miss all newly added distributions, if they will not be listed also in this control file. Supported values which can be written in this file, listed in a single line or one per line: Drupal 9 based THR ----------- Thunder Drupal 8 based LHG ----------- Lightning OPG ----------- Opigno LMS SOC ----------- Social VBE ----------- Varbase Drupal 7 based D7P D7S D7D --- Drupal 7 prod/stage/dev AGV ----------- aGov CME ----------- Commerce v.2 CS7 ----------- Commons DCE ----------- Commerce v.1 GDR ----------- Guardr OA7 ----------- OpenAtrium OAD ----------- OpenAid OLS ----------- OpenLucius OOH ----------- OpenOutreach OPC ----------- OpenPublic OPO ----------- Opigno LMS PPY ----------- Panopoly RST ----------- Restaurant UC7 ----------- Ubercart Drupal 6 based D6P D6S D6D --- Pressflow (LTS) prod/stage/dev DCS ----------- Commons UCT ----------- Ubercart You can also use special keyword 'ALL' instead of any other symbols to have all available platforms installed, including newly added in all future BOA system releases. Examples: ALL LHG VBE D7P D7S D7D Composer will now use PHP 7.3 by default, and you can find many useful hints at: https://github.com/omega8cc/boa/blob/master/docs/COMPOSER.txt IMPORTANT: You must switch your ~/static/control/cli.info to 7.2 or newer PHP version (BOA hosted on Omega8.cc comes with 7.4, 7.3 and 7.2), because D8 based distros require at least PHP 7.2 -- this also means that to run the sites installed after switching cli.info to 7.2 or newer, you will also need to either switch your ~/static/control/fpm.info to 7.2 or newer, or more probably, to not break any existing sites not compatible with PHP 7.2+ you will need to list these D8 sites names in ~/static/control/multi-fpm.info Please check for more information: https://learn.omega8.cc/how-to-quickly-switch-php-to-newer-version-330 BOA supports Drupal 8 codebases both with classic directory structure like in Drupal 7 and also Drupal 8 distros you can download from Drupal.org, but if you use Composer based codebase with different structure, the platform path is not the codebase root directory, but the subdirectory where you see the Drupal own index.php and "core" subdirectory. It can be platform-name/web or platform-name/docroot or something similar depending on the distro design. ### Stable BOA-4.1.2 Release - Full Edition ### Date: Tue Sep 22 05:30:08 CEST 2020 ### Milestone URL: https://github.com/omega8cc/boa/milestones/4.1.2 # Release Notes: This BOA release is a transitional release before switching to rolling release policy. Detailed changelog will follow. ### Stable BOA-4.0.1 Release - Full Edition ### Date: Mon May 6 01:14:59 CEST 2019 ### Milestone URL: https://github.com/omega8cc/boa/milestones/4.0.1 # Release Notes: This BOA release provides three new PHP versions, system updates, including security fixes, many bug fixes, latest Ægir version, plus all included Drupal distributions updated to latest versions, and supplied with latest Drupal 7 or Drupal 8 core, if possible. Yes, BOA still supports Pressflow 6. Yes, Debian Stretch is supported. No newer Ubuntu releases are supported yet. Yes, we have added Solr 7 support and every 5 minutes updates! Four Drupal 8 based popular distributions have been included by default, plus much improved Composer support and automatic permissions-fix-magic on Platform and Site Verify tasks. No more manual fixes! By the way, Composer will now use PHP 7.3 by default, and you can find many useful hints at: https://github.com/omega8cc/boa/blob/master/docs/COMPOSER.txt Big improvements and changes are coming to (auto)managing Solr cores too! Solr cores are are now created every 5 minutes if needed, instead of during the nightly procedure only, and Solr 7 is used by default. Existing Solr 4 cores will continue to work as before, but the system will create new Solr 7 cores for all compatible sites, and will update the sites/foo.com/solr.php accordingly. For existing Solr 4 cores there can be namespace conflicts, so please make sure to check the updated sites/foo.com/solr.php file and adjust your site configuration if needed. Note: If you are using WinSCP and/or Putty on Windows, or Transmit/Coda by Panic on a Mac, please check the Known Issues section at the bottom of this BOA-4.0.1 release notes. @=> Solr 7 and Solr 4 support changes and improvements Both Solr 7 and Solr 4 powered by Jetty 9 server are available. Supported integration modules are limited to latest versions of either search_api_solr (D8/Solr7 and D7/Solr7 ) or apachesolr (D7/Solr4 and D6/Solr4). Currently supported versions are listed below: https://ftp.drupal.org/files/projects/search_api_solr-8.x-2.7.tar.gz https://ftp.drupal.org/files/projects/search_api_solr-7.x-1.14.tar.gz https://ftp.drupal.org/files/projects/apachesolr-7.x-1.11.tar.gz https://ftp.drupal.org/files/projects/apachesolr-6.x-3.1.tar.gz Note that you still need to add preferred integration module along with any its dependencies in your codebase since this feature doesn't modify your platform or site - it only creates Solr core with configuration files provided by integration module: schema.xml and solrconfig.xml etc. Important: search_api_solr-8.x-2.x is different from all previous versions, as it requires Composer to install the module and its dependencies, then you will need to configure it, and only then you will be able to generate customized Solr core config files, which you should upload in the path: sites/foo.com/files/solr/ and wait 5-10 minutes to have them activated on the Solr 7 core the system will create for you. This will affect the running every 5 minutes auto-installer, hence no need to wait until next morning to be able to use new Solr core. Win! Once the Solr core is ready to use, you will find a special file in your site directory: sites/foo.com/solr.php with details on how to access your new Solr core with correct credentials. Side note: the sites/foo.com/solr.php will be automatically deleted on every site Verify task in Ægir, to prevent copying it across with incorrect access credentials when you clone the site. As soon as the site is verified, its sites/foo.com/solr.php will get re-created automatically within 5-10 min. and the cloned site will also get its own Solr core created. For more details please check the docs at: https://github.com/omega8cc/boa/blob/master/docs/SOLR.txt @=> Drupal 8.7.0 platforms and Composer support Since BOA-4.0.1 new Drupal 8.7.0 based platforms are included: Lightning 3.3.0 -------------- https://drupal.org/project/lightning Thunder 8.2.39 --------------- https://drupal.org/project/thunder Varbase 8.6.8 ---------------- https://drupal.org/project/varbase Social 8.5.1 (8.6.15 core) --- https://drupal.org/project/social IMPORTANT: You must switch your ~/static/control/cli.info to 7.1 or newer PHP version (BOA hosted on Omega8.cc comes with 7,1, 7.2 and 7.3), because D8 based distros require at least PHP 7.1 -- this also means that to run the sites installed after switching cli.info to 7.1 or newer, you will also need to either switch your ~/static/control/fpm.info to 7.1 or newer, or more probably, to not break any existing sites not compatible with PHP 7.1+ you will need to list these D8 sites names in ~/static/control/multi-fpm.info Please check for more information: https://learn.omega8.cc/how-to-quickly-switch-php-to-newer-version-330 BOA supports Drupal 8 codebases both with classic directory structure like in Drupal 7 and also Drupal 8 distros you can download from Drupal.org, but if you use Composer based codebase with different structure, the platform path is not the codebase root directory, but the subdirectory where you see the Drupal own index.php and "core" subdirectory. It can be platform-name/web or platform-name/docroot or something similar depending on the distro design. As you have discovered if you have already tried, the path you should use in Ægir when adding Composer based codebase as a platform is the directory where index.php resides, so effectively anything above that directory is not available for web requests and thus safely protected. The information from Ægir project docs saying "When verifying a platform, Ægir runs composer install if a composer.json file is found." doesn't apply to BOA. We have disabled this. There are several reasons, most importantly: a/ having this feature enabled is actually against the codebase management workflow in Ægir, because it may modify codebase on a live site, b/ some tasks launch verify many times during clone and migrate, which results with giant overhead and conflicts if we allowed it to run composer install many times in parallel, c/ from our experience, having this poorly implemented feature enabled breaks clone and migration tasks between platforms when both have the composer.json file. It just doesn't make any sense in our opinion. The implementation should be improved to make it actually work similarly to Drush Makefiles. You should think about Composer like it was Drush Make replacement, and you should not re-build nor upgrade the codebase on a platform with sites already hosted. Just use it to build new codebases and then add them as platforms when the build works without errors. @=> Important PHP versions availability changes Still on PHP 5.6? You should switch to PHP 7.3 — It’s twice as fast as 5.6! But don't switch blindly -- even sites already running on PHP 7.0 before are most probably not ready for PHP 7.2 or 7.3 without proper fixes. Note: BOA-4.0.1 release removes PHP 5.3, 5.4 and 5.5, if installed. In addition to still supported, even if officially deprecated 5.6 and 7.0 versions, this release adds support for PHP 7.3, 7.2 and 7.1 Please check the PHP officially supported versions list at: http://php.net/supported-versions.php In our limited testing Drupal 7 core version included in this release works without noticeable issues with both PHP 7.2 and 7.3, although many contrib modules may not be ready to switch your instance to 7.3 or 7.2 just yet, especially if you have not used PHP 7.0 already. We recommend to test your sites clones with newer PHP versions using BOA multi-PHP-version support via ~/static/control/multi-fpm.info before switching your instance to use 7.3 or 7.2 by default. Please check for more information: https://learn.omega8.cc/how-to-quickly-switch-php-to-newer-version-330 We still include Pressflow 6 platforms, because in the meantime the LTS community support made the latest Pressflow 6 version compatible with PHP 7.2 If you still have a reason to use Drupal 6 core, we recommend to use our version: https://github.com/omega8cc/pressflow6/tree/pressflow-plus @=> BOA release policy changes In over 15 months since BOA-3.2.2 release we have tested a more agile approach with Rolling Release policy for BOA system part known as Barracuda. We have implemented many changes and updates only in BOA HEAD and used carefully tested HEAD in production. This worked flawlessly and allowed us to keep all BOA hosted and maintained systems continuosly updated without waiting for stable release. BOA project is very complex, build atop of many packages and individually built from sources components, plus other projects like Ægir, Drush and Drupal core and distributions -- each of them with their own release policy. After years of efforts to keep healthy balance between providing necessary upgrades and avoiding BOA users maintenance fatigue due to frequent releases, which usually results with skipping releases which has many adverse effects, including requirement to keep new versions backward compatible with 2-3 years old releases, we have decided that it's time to introduce Rolling Release policy for Barracuda while still using standard point releases policy for Octopus installer, which covers Ægir, Drush and Drupal platforms updates. We will still use point releases for Barracuda when there will be major changes introduced, like deprecating old PHP versions or changing components like Let's Encrypt integration agents or methods. BOA project docs will be updated to reflect these changes once another standard point release is made either for Octopus, Barracuda or both. The docs will explain how to run Barracuda system continuous updates properly. # New features: * Add auto-cleanup for empty old platforms in /var/aegir * Add experimental support for autoslave and cache_consistent * Add initial Composer docs * Add jsmin support for PHP7 #1250 * Add mongodb extension for PHP 7 and Drupal 8.2.x support #1127 * Add redis_oom_check() to monitoring * Add set_composer_manager_vendor_dir INI variable * Add support for include/exclude filelist for duplicity. #1159 * Add support for Percona 5.7 and use MariaDB 10.1 by default * Add UTF8MB4 Convert Drush extension #1047 * Automatically check and remove drush from codebase * Debian Stretch support #1176 * Do not run Verify daily if ~/static/control/noverify.info exists * Install ClamAV daemon by default * PHP 7.3, 7.2 and 7.1 Support #1126 * Run manage_solr_config.sh every 5 minutes * Update Solr with BOA #1305 * Use _DB_BACKUPS_TTL variable for local and cluster db backups rotation # Changes: * Add innodb_default_row_format = dynamic — fixes #1366 * Advanced Nginx microcaching to improve cache HITs #1271 * Change to dashes in bucket names and upgrade boto/duplicity #1247 * Create fpm.info and cli.info ctrl files on Octopus install * Deprecate MariaDB 5.5 and force 10.1 instead * Enable uploadprogress.so for testing on PHP 7+ * Force Composer to use PHP 7.2 if available #1213 * Higher PHP CLI limits to make Composer happy * Increase default TTLs to make BOA more friendly for big sites * Make DNS Cache Server pdnsd optional -- needs DCS keyword in _XTRAS_LIST * Minimum 4 GB RAM and 2 CPU (with Solr minimum 8 GB RAM and 4+ CPU rec.) * Re-verify LE enabled sites daily * Refresh the tasks list more frequently * Remove deprecated PHP versions #801 * Remove problematic opcache.fast_shutdown * Remove ultimate_cron and background_process from the blacklist * Replace Google DNS servers for Cloudflare DNS servers #1317 * Replace the complex public IP detection with an external API #1089 * Set PHP CLI to FPM version if only FPM is defined * SQL: disable innodb_adaptive_hash_index by default * Upgrade imagick to 3.4.3 for PHP7 support #1253 * Use /root/.backboa.autoupdate by default * Use utf8mb4/utf8mb4_general_ci by default # System upgrades: * Adminer 4.7.0 * CSF/LFD 12.10 * Drush 8.2.3.1 * Galera 10.0.37 * Lshell 0.9.18.9 * MariaDB Server 10.1.39 * MariaDB Server 10.2.19 * MariaDB Server 10.3.14 * MySQLTuner 1.7.15 * Nginx 1.16.0 * Node.js v10.x LTS * OpenSSH Server 8.0p1 * OpenSSL 1.0.2r for Nginx * PHP 7.3.5, 7.2.18, 7.1.29, 7.0.33, 5.6.40 * PHP Redis extension 4.2.0 * Pure-FTPd 1.0.49 * Redis Module 8.x mod-05-02-2019 * Redis Server 4.0.14 * Ruby 2.6.0 * Use latest Duplicity and dependencies # Fixes: * Add fix_ping_perms() * Add libzip-dev to satisfy PHP 7.3 requirements * Add nginx config to mitigate SA-CORE-2018-002 * Add patches for CORE-2018-004 and SA-CORE-2018-002 * Add procedure satellite_fix_broken_entity_module() * Add re_set_default_php_cli() procedure * Add redis_slow_check() * Ajax 200 parsererror on every Drupal site #1344 * Avoid potentially problematic --force-yes for apt-get * Backboa AWS S3 backup integration no longer working #1138 * Backboa not installed #1310 * Backboa: Certificate error #1141 * Cannot switch php-cli, cannot create varbase composer project. #1308 * Check sshd not ssh version * CiviCRM 4.7 not working under BOA #1223 * Crawlers see 403 on public path #1329 * Debian 9 (Stretch) _apt user + _STRICT_BIN_PERMISSIONS errors #1352 * Do not lock old/all hostmaster platforms automatically * Downgrade MySecureShell until we can figure out compatibility issues * Errors using site with CiviCRM #1304 * Extra cleanup for any codebase level drush copy * Fix for empty old hostmaster platforms cleanup * Fix for incomplete logic in multi-fpm mode * Fix for jessie-backports * Fix SA-CORE-2018-006 for D8 and D7 * Fix the site specific composer_manager dir also for D8 * Fix to include gitlab.com in ~/.ssh/known_hosts * Improve gpg keys handling * Improve pdnsd self-repair procedures * Infinite loop on INFO: Retrieving F1656F24C74CD1D8 key.. #1323 * Known issues with contrib module Redirect in Drupal 8 and BOA #1239 * Make sure redis-server is up immediately after upgrade * Make sure that ~/.rvmrc is fixed * Make sure that composer permissions are fixed * Make sure that the ownership on static/control is correct * Make sure to fix Redis permissions * Nginx: the "ssl" directive is deprecated since 1.15.0 * No live certificates from Let's Encrypt #1255 * No Web Server is added when BOA is installed locally #1306 * PSA-2018-003: Drupal core security release #1283 * Remove deprecated option UsePrivilegeSeparation if exists * Restore Jessie default apt mode on Stretch+ * Solr dir is not defined in in setup_solr() #1370 * SSHD - use without-password for backward compatibility * Switching out DNS servers caused breakage #1318 * Sync permissions fix on platform verify for D8, D7, D6 * Sync Solr 7 memory management logic * The _PERMISSIONS_FIX var gets overridden to YES daily basis #1311 * The innodb_lazy_drop_table has been deprecated in Percona * Update ~/static/control/README.txt if needed * Update boa info [more] for current years #1248 * Update lshell.config to not break valid D8 specific Drush commands * Update, sync and de-duplicate Zend OPcache config directives * Updated default robots.txt #1172 * Use gpg2 directly instead of deprecated apt-key * Use IP directly as a last fallback * xboa migrate Solr 7 data #1376 # Known issues: * SSH/SFTP WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! In short, nothing to worry about, but please read on how to fix this: https://learn.omega8.cc/2019-remote-host-identification-ssh-388 * PHP 7.1+ can't be installed w/ MariaDB 10.2+ until compatibility is fixed: https://jira.mariadb.org/browse/MDEV-14555 * Existing Solr 4 cores may experience namespace conflicts. Please make sure to check the updated sites/foo.com/solr.php file and adjust your site configuration if needed. * Error decoding SFTP packet -- affects WinSCP/Putty We recommend to use CybderDuck for reliable SFTP access. For known fix please check https://bit.ly/2HMGd6u -- quote below: >>>>> Basically we need to set the ‘Preferred SFTP protocol version’ to 3. How to do this: Edit the connection in WinSCP Open the Advanced menu Choose Advanced This will bring up a new popup. Under Environment click on SFTP Change ‘Preferred SFTP protocol version’ to 3 Save the changes. >>>>> * SFTP connection doesn't work with Transmit nor Coda by Panic software. We have not figured out the workaround yet, so we recommend using working alternatives on a Mac, like Cyberduck or ForkLift. * The filefield_nginx_progress module, which is deprecated for years, no longer works and breaks upload fields. The module has been removed from the supported modules list, and will be automatically disabled if active in any D7 site daily, so we recommend to use the current similar alternative (even if not so fancy) included now by default: https://www.drupal.org/project/file_resup ### Stable BOA-3.2.2 Release - Full Edition ### Date: Sat Jan 20 11:03:34 PST 2018 ### Milestone URL: https://github.com/omega8cc/boa/milestones/3.2.2 # Release Notes: This BOA release provides system security upgrades, many bug fixes, latest Ægir version, plus all supported Drupal distributions updated to latest versions, and supplied with latest Drupal 7 core, if possible. Thanks to Drush 8.1.15-dev we support also the newest Drupal 8.4.4 core. @=> Important changes planned in the next BOA feature release BOA-3.2.2 is the last release still supporting PHP 5.3, 5.4 and 5.5 versions. These versions will be *removed* in the next release, and instead there will be support for PHP 7.1 and 7.2 added. Future releases will no longer include Pressflow 6 platforms, but Pressflow 6 will be fully supported, and can still use PHP 5.6 -- We recommend to use our version: https://github.com/omega8cc/pressflow6/tree/pressflow-plus # Changes: * Add support for WOFF 2.0 * Commerce 2.51 * Guardr 2.40 * OpenAtrium 2.624 * Panopoly 1.49 # System upgrades: * Adminer 4.3.1 * Galera 10.0.33 * MariaDB 10.1.30 * MariaDB 10.2.12 * MariaDB 5.5.59 * Nginx 1.13.8 * OpenSSL 1.0.2n (used only in Nginx) * PHP 5.6.33 * PHP 7.0.27 * PHP extension for Redis 3.1.6 * Pure-FTPd 1.0.49 * Redis Server 4.0.6 * Ruby 2.4.2 * Use Redis integration mod-30-12-2017 (D7) # Fixes: * Add mongo to the list of permissions exceptions, if installed * Do not delete empty platforms if ~/static/control/platforms.info is used * Do not restart Redis daily if /root/.high_traffic.cnf exists * Fix Drupal 8 detection for distros with vendor dir moved out of docroot * Fix requirements for the latest compass version * Hints config update * LE not renewing expired certificates due to IPv6 DNS entries -- #1179 * Notifications about new BOA editions are sent to notify@omega8.cc -- #1219 * Override fastcgi_params to make geoip headers work again * Redirect module conflict with manual cron execution in D8 -- #1215 * Remove hmac-ripemd160 MAC, deprecated in OpenSSH 7.6 -- #1217 * The _SSH_ARMOUR=YES not compatible with OpenSSH 7.6 -- #1218 * Update keys for rvm.io * Update LE License to LE-SA-v1.2-November-15-2017.pdf * Use advagg-7.x-2.30 * Use modified rvm-installer.sh for user-level installations * Use reroute_email-7.x-1.3 * Use rvm_silence_path_mismatch_check_flag=1 ### Stable BOA-3.2.1 Release - Full Edition ### Date: Sat Oct 7 19:58:53 PDT 2017 ### Milestone URL: https://github.com/omega8cc/boa/milestones/3.2.1 # Release Notes: This BOA release provides system security upgrades, many bug fixes, latest Ægir version, plus all supported Drupal distributions updated to latest versions, and supplied with latest Drupal 7 core, if possible. Thanks to Drush 8.1.15-dev we support also the newest Drupal 8.4 core. @=> Important changes planned in the next BOA release BOA-3.2.1 is the last release still supporting PHP 5.3, 5.4 and 5.5 versions. These versions will be *removed* in the next release, and instead there will be support for PHP 7.1 and 7.2 added. Future releases will no longer include Pressflow 6 platforms, but Pressflow 6 will be fully supported, and can still use PHP 5.6 -- We recommend to use our version: https://github.com/omega8cc/pressflow6/tree/pressflow-plus @=> Drupal 6 vanilla core is deprecated starting with BOA-3.2.1 Drupal 6 vanilla core is no longer supported. It was never really supported, but could still work. Those running Drupal 6 instead of supported Pressflow 6 will notice that their site displays only the homepage and all links/menus no longer display expected content. This change is a result of new rewrite in the Nginx configuration, required to properly support both Drupal 8 and Drupal 7. Time to migrate to latest, included in this release, Pressflow 6! # Changes: * Add chained commands to forbidden list in lshell * Add Nginx Headers More module support * Add support for --include/exclude-filelist for duplicity -- #1158 * Add support for upcoming MariaDB 10.2 * Auto-update duplicity if installed * Deny bots on non-prod domains, not only on aliases -- #1178 * Do not pause the tasks queue during mysql backup * Do not truncate queue and accesslog tables by default * Enable New Relic integration for PHP 7.0 * Install ipset to improve CSF performance * mongodb.so for D8.2 and PHP7.0 -- #1128 * Run 3 queue tasks in parallel by default * Use redis_scan_enable = FALSE by default # System upgrades: * CSF 10.22 * Drush micro-8-07-10-2017 * Galera 10.0.32 * MariaDB 10.1.28 * MariaDB 10.2.9 * MariaDB 5.5.57 * Nginx 1.13.5 * Node 6.x version bump -- #1129 * OpenSSH 7.6p1 * OpenSSL 1.0.2l (used only in Nginx) * PHP 5.6.31 * PHP 7.0.24 * PHP extension for Redis 3.1.4 * Pure-FTPd 1.0.46 * Redis Server 4.0.2 * Update Redis module for Drupal 8 * Upgrade drush to support Drupal 8.4 -- #1206 * Upgrade wkhtmltopdf and wkhtmltoimage to 0.12.4 # Fixes: * Add SSH (RSA) keys how-to * Add support for tar.xz archives * Add symlink suggested in #999 * Allow a bit higher load limits for queue runner * Barracuda is not installing ipset so csf doesn't work -- #1203 * Deprecate no longer working distros * Disable innodb_corrupt_table_action in 10.2 * Do not enable entitycache in the Commons distro * Exclude special https.* proxy vhosts from daily cleanup * Fix permissions on password files for HTTP Basic Auth -- #1187 * Fix syntax and race conditions in fire/water * Galera compatibility: do not edit mysql.user directly * Improve CSF race conditions protection * Improve default system cron queue * Improve repo.psand.net/pubkey update * Improved PHP OPCache default configuration * Linux kernel CVE-2017-2636 hotfix * Linux kernel CVE-2017-6074 hotfix * Make sure that not supported tools are not re-installed on VServer * Move excludes first as they are more specific than includes -- #1168 * PHP not installed after Wheezy to Jessie upgrade -- #999 * Redirect module breaks Drupal 8 sites in BOA if present -- #1061 * Remove --numeric-ids option from xboa -- #1146 * Restart DB server on upgrade only if config has changed * Run fast enough fire.sh again * Silence mysql cleanup output -- #1180 * Site in subdirectory cookie is not set correctly -- #1211 * Sync PHP disable_functions across all versions * Update default robots.txt -- #1172 * Use --skip-add-locks — Galera Cluster compatibility * Use absolutely graceful MySQLD restart procedure * VServer 4.1.42-vs2.3.8.6-beng compatibility * Wait for MySQLD availability before running DB backup * Whitelist known search engines bots IPs ### Stable BOA-3.2.0 Release - Full Edition ### Date: Sun Feb 26 09:11:39 PST 2017 ### Milestone URL: https://github.com/omega8cc/boa/milestones/3.2.0 # Release Notes: This BOA release provides many new features, system security upgrades, many improvements and bug fixes, latest Ægir version, plus all supported Drupal platforms updated to latest versions, and supplied with latest Drupal 7 core, if possible. The reason we list here also new features and changes already listed in previous BOA-3.1.4 version is that they were supposed to be included in this (3.2.0) release, since we normally don't include new features in bugfix releases, but we had to publish more bugfix/security releases in the 3.1.x series than initially expected, while new features were already pushed to HEAD in anticipation of delayed 3.2.0 release. We have also moved some new features originally intended to be included in the (3.2.0) release to the next 3.3.0 milestone, which is expected in about one month after 3.2.0 release. @=> Magic permissions fix now happens on-the-fly The most interesting new Ægir feature is probably the ability to fix files permissions and ownership on any site and platform, without waiting for the running daily magic fix. Now it happens on-the-fly, when you run normal platform and site Verify tasks. @=> MariaDB 10.1 is now the new default version If you are already running 10.0, BOA will upgrade it to _DB_SERIES=10.1 but if you still run _DB_SERIES=5.5 it will continue to use MariaDB 5.5 on your system (not recommended). # New features and enhancements: * Add Microsoft Hyper-V to supported virtualization systems * Add support for _HOURLY_DB_BACKUPS=YES via Percona XtraBackup * Add support for ‘boa version’ command * Add support for /root/.my.batch_innodb.cnf weekly procedure * Add support for /root/.my.restart_after_optimize.cnf procedure * Add support for fix_ownership and fix_permissions on-the-fly * Add support for latest 3.18.44-vs2.3.7.5-beng VS kernel * Add support for latest 4.1.33-vs2.3.8.5.2-beng VS kernel * Add support for the Open Lucius Distribution to Ægir —- #888 * Add support for the Opigno LMS Distribution to Ægir —- #953 * Automatically whitelist CloudFlare and Sucuri IPs (faster version) * Bundle Opigno LMS dependencies: TinCanPHP and pdf.js * Configure _INNODB_LOG_FILE_SIZE automatically * Docs for Twig Debbuging in Drupal 8.2.x and BOA #1085 * Improve InnoDB performance * Improve Let's Encrypt docs * Include advagg, cdn, and robotstxt in o_contrib_eight -- #1096 * Install ClamAV and RKhunter by default —- #1019 * Make boost cache clearing configurable via _CLEAR_BOOST variable -- #1115 * MariaDB 10.1 support (new default version) -- #866 * Open LDAP ports 389 and 3268 for outgoing TCP connections * Speed up mysql stop/start * Update S3 regions list for backboa backups * Use blazing fast Redis (SCAN) method on wildcard cache delete * Use Redis_CacheCompressed mode, if available (saves a ton of RAM) # Changes: * Allow to run global OPTIMIZE only once per month, on the last Sunday * Always update barracuda, boa and octopus wrappers, ignore _SKYNET_MODE=OFF * Enable ARCHIVE Storage Engine in MariaDB 10.1 * Force _CUSTOM_CONFIG_SQL=NO on MariaDB major upgrade/reinstall * Remove exception for cache_form bin in Redis configuration * Remove no longer supported textile module * Run db OPTIMIZE only weekly, if configured * Use bzip2 also for standard db backups * Use lower system load limit for queue runner * Use MySQLTuner to configure SQL limits — enabled by default # System upgrades: * CSF/LFD 9.30 * Drupal 7.54.2 * Drush micro-8-07-02-2017 * Duplicity 0.7.11 (please run 'backboa install' to upgrade) * MariaDB 10.1.21 * MariaDB 5.5.54 * MariaDB Galera Cluster 10.0.29 * Nginx 1.11.10 * OpenSSL 1.0.2k (used only in Nginx) * PHP 5.6.30 * PHP 7.0.16 * Pure-FTPd 1.0.45 * Redis 3.2.8 * Redis D8/D7 integration mod-09-02-2017 * Use ImageMagick 7.0.4-6 if built from sources * Use Redis integration mod-14-02-2017 (D7) # Fixes: * Can't add clients on BOA3 -- #926 * Do not add newer InnoDB settings when old server version is in use -- #1122 * Do not disable site_readonly daily on migrated instances * Fix the not working hostmaster LE cert auto-update (typo) * Force vnstat restart on version upgrade * Improve disable_chattr() and enable_chattr() logic * Improve docs/FAQ.txt as suggested in #1119 * Improve userprotect initial-only setup -- #926 * MariaDB server not running properly alert -- #1122 * Migration should re-use Let's Encrypt certs in HTTPS proxy vhosts -- #1106 * Randomize SQL backup schedule * Rebuild hosting_custom_settings feature after enabling Redis on install * Sync db server (optional) restart with optimize * Sync max_execution_time for PHP-FPM * Sync max_input_time for PHP-FPM * Update docs/SSL.txt -- #1109 * Whitelist /dev/urandom in open_basedir ### Stable BOA-3.1.4 Release - Full Edition ### Date: Tue Dec 20 14:09:21 PST 2016 ### Milestone URL: https://github.com/omega8cc/boa/milestones/3.1.4 ### Latest hotfix added on: Wed Dec 21 12:44:58 PST 2016 # Release Notes: This BOA release provides system security upgrades, many improvements and bug fixes, latest Ægir version, plus all supported Drupal platforms updated to latest versions, and supplied with latest Drupal 7 core, if possible. @=> Magic permissions fix now happens on-the-fly The most interesting new Ægir feature included in this release is probably the ability to fix files permissions and ownership on any site and platform, without waiting for the running daily magic fix. Now it happens on-the-fly, when you run normal platform and site Verify tasks. @=> MariaDB 10.1 is now the new default version If you are already running _DB_SERIES=10.0, this BOA release will upgrade it to _DB_SERIES=10.1 -- but if you still run _DB_SERIES=5.5 it will continue to use MariaDB 5.5 on your system. # New features and enhancements: * Add Microsoft Hyper-V to supported virtualization systems * Add support for ‘boa version’ command * Add support for fix_ownership and fix_permissions on-the-fly * Add support for latest 3.18.44-vs2.3.7.5-beng VS kernel * Add support for latest 4.1.33-vs2.3.8.5.2-beng VS kernel * Automatically whitelist CloudFlare and Sucuri IPs (faster version) * Configure _INNODB_LOG_FILE_SIZE automatically * MariaDB 10.1 support (new default version) -- #866 * Use Redis_CacheCompressed mode, if available (saves a ton of RAM) # Changes: * Always update barracuda, boa and octopus wrappers, ignore _SKYNET_MODE=OFF * Enable ARCHIVE Storage Engine in MariaDB 10.1 * Force _CUSTOM_CONFIG_SQL=NO on MariaDB major upgrade/reinstall * Remove no longer supported textile module * Run db OPTIMIZE only weekly, if configured * Use MySQLTuner to configure SQL limits — enabled by default # System upgrades: * CSF 9.28 * Drush micro-8-17-12-2016 * MariaDB 10.1.20 * MariaDB Galera Cluster 10.0.28 * Nginx 1.11.7 * OpenSSH 7.4p1 (if installed from sources) * OpenSSL 1.0.2j (used only in Nginx) * PHP 5.6.29 * PHP 7.0.14 * PHPRedis 3.1.0 * Redis 3.2.6 * Use mydropwizard-6.x-1.6 * Use Redis module mod-20-12-2016 # Fixes: * Allow to run downgrade to _DB_SERIES 5.5 (experimental, not recommended!) * Always reinstall cURL from packages if broken * AMP support -- #948 * Archive PHP logs in /var/backups/php-logs/ * Check if bind should be installed early enough * Do not enable innodb-defragment — it may crash the server * Fix for check_root_keys_pwd() * Fix for disable_chattr() * Fix for missing PHP config regression -- #1105 * Fix for VnStat sysconfdir * Fix the check in detect_deprecated_php() * Ignore search lines to avoid breaking pdnsd config -- #1069 * Improve SQL defaults * Make sure innodb_buffer_pool_instances is always defined * Migration between installation profiles -- #1076 * Monitor more lines when /root/.hr.monitor.cnf exists * Multiply already high opcache.max_accelerated_files * Nginx: Set Access-Control-Allow-Origin header only for static files * Remove duplicate config updates and restarts * Remove various tmp/dot files breaking du command * Sync the new on-the-fly permissions magic with BOA daily.sh logic * The .git/* files are downloadable -- #1091 * Triple check that all sql tables are upgraded * Update JS module to 7.x-2.1 -- #586 * Update migrate docs to avoid issues with already migrated instances * Use long enough wait times for big SQL servers restarts * Use Open Atrium own patched Drupal core -- #1083 ### Stable BOA-3.1.3 Release - Barracuda Edition ### Date: Mon Sep 12 17:54:50 PDT 2016 ### Milestone URL: https://github.com/omega8cc/boa/milestones/3.1.3 # Release Notes: This BOA release provides important security upgrades and bug fixes. You should upgrade via 'barracuda up-stable system' immediately. Note: Octopus upgrade is **not** included in this BOA release. Technically, even by running normal system update with previous BOA release you would apply all security upgrades, since they are provided by MariaDB packages, and thus enforced no matter if we release new BOA version, or not, so we are doing this purely to make sure that all users have been alerted about the situation affecting their systems. # Changes: * Move Nginx cache cleanup to daily cleanup procedure * Use standard hourly schedule for self-update in clear.sh # System upgrades: * Add all Tika versions from 1.1 to 1.13 in /opt/tika9/ * MariaDB 10.0.27 (critical security upgrade) * MariaDB Galera Cluster 10.0.27 (critical security upgrade) * MongoDB database driver 1.6.14 for all PHP versions < 7 -- fixes #981 * Pure-FTPd 1.0.43 # Fixes: * Check if curl works and re-install if needed before running auto-update * Log LE renewal attempts * Log out all users after lshell em upgrade * Make sure that cURL is always listed in packages * Move permissions fix overrides check to the correct place * Nginx: default FastCGI cache levels value may exhaust all inodes -- #2791885 # Known problems: https://github.com/omega8cc/boa/milestones/3.1.x ### Stable BOA-3.1.2 Release - Full Edition ### Date: Sat Aug 20 14:43:43 PDT 2016 ### Milestone URL: https://github.com/omega8cc/boa/milestones/3.1.2 ### Latest hotfix added on: Thu Aug 25 09:17:59 PDT 2016 # Release Notes: This BOA release provides system security upgrades, improvements and bug fixes, plus all supported Drupal platforms updated to latest versions, and supplied with latest Drupal 7 core. @=> You can use NPM to install Grunt/Gulp/Bower -- #1028 by @pricejn2 (thanks!) Now the same ~/static/control/compass.info file will activate not only RVM, which can be used to install Compass Tools, but also NPM, which can be used to install Grunt/Gulp/Bower. You will need to re-initialize your account to have it added, by deleting the control file, and adding it again after ~10 minutes. More details: https://github.com/omega8cc/boa/blob/master/docs/RVM.txt @=> Redis integration works with Drupal 8 -- with no effort on your side We have added a smart activation procedure, to meet the D8 Redis module requirements. The system will add Redis integration to your Drupal 8 sites automatically, but will keep it inactive, until the module will be installed properly, during nightly system autonomous maintenance. This means that Redis will start working in every existing and newly installed Drupal 8 site with some initial delay, to get things installed in the correct order, and still without any effort on your side. # Other enhancements: * Add mydropwizard to Drush extensions for Drush Make D6 support * Add support for Drupal 8 specific development.services.yml file * Allow to configure stable/head BOA auto-upgrades via _AUTO_VER variable * Compatibility with Multi-byte UTF-8 support in Drupal 7 # Changes: * Add Adminer database manager and deprecate Chive manager -- #1036 * Enable Let's Encrypt LIVE mode via ~/static/control/ssl-live-mode.info * Force /root/.use.curl.from.packages.cnf to install cURL from packages * Run db sqlmagic auto conversion also on test/dev sites, if activated # System upgrades: * CSF 9.11 * Drush micro-8-23-07-2016 * Lshell 0.9.18.8 (security update for shell escalation issues) * MariaDB 10.0.26 * MariaDB 5.5.51 * Mysqltuner v1.6.15 * Nginx 1.11.3 * OpenSSH 7.3p1 (if installed from sources) * PHP 5.5.38 * PHP 5.6.25 * PHP 7.0.10 * PHPRedis dev5-11-08-2016 * PHPRedis dev7-11-08-2016 * Redis 3.2.3 * Redis D8 integration mod-12-08-2016 * vnStat 1.15 # Fixes: * Avoid race conditions on web system user update * Debian Jessie 8.3+ needs grub update -- fixes #912 * Detection of Amazon AWS / EC2 instance -- fixes #930 * Disable Redis integration until module is installed (D8 only) * Do not force --default-character-set=utf8 -- see #1020 * Don’t set $MANPATH when npm support is enabled * Fix for openssh-sftp-server status on Jessie * FMG installation hangs on keyring install -- fixes #1050 * Force InnoDB in sqlmagic for Drupal 7+ -- see #1020 * Ignore ~/control/multi-fpm.info on too old Octopus (2.4) instances * Linux Kernel CVE-2016-5696 mitigation * Mitigate httpoxy vulnerability * Nginx: Fix for not working autodiscover flood protection * Nginx: Fix for the add_header inheritance * Nginx: Improve fastcgi_cache_valid TTL settings * Octopus auto-upgrade should set _AUTOPILOT=YES on the fly -- fixes #1041 * Remove deprecated MyISAM exceptions in sqlmagic command * Run detect_cdorked_malware() only if /usr/sbin/nginx exists * Run registry-rebuild directly after hostmaster upgrade * Single _tmp_ dir is enough to require forced cleanup (Drush cache) * Sync keyring install command with BOA standard -- #1052 * Sync modules auto en/dis for Drupal 8 * Update check_boa_php_compatibility() * Upgrade to panels-7.x-3.7 (security) in all distros using the module * Whitelist elFinder requests * Workaround for aegir_backup_export_path # Known problems: https://github.com/omega8cc/boa/milestones/3.1.x ### Stable BOA-3.1.1 Release - Full Edition ### Date: Wed Jun 22 12:24:17 PDT 2016 ### Milestone URL: https://github.com/omega8cc/boa/milestones/3.1.1 ### Latest hotfix added on: Fri Jun 24 06:01:07 PDT 2016 # Release Notes: This BOA release provides system security upgrades, improvements and bug fixes, plus all supported Drupal platforms updated to latest versions, and supplied with latest Drupal 7 core (security release). # New features and enhancements: * Add _SSH_ARMOUR feature * Add strict check for supported virtualization systems * Allow to install ImageMagick from sources when _MAGICK_FROM_SOURCES=YES # Changes: * Deprecate support for old Solr versions <4 * Switch cluster support to 3.x # System upgrades: * Drush micro-8-15-06-2016 * MariaDB 5.5.50 * Nginx 1.11.1 * PHP 5.5.37 * PHP 5.6.23 * PHP 7.0.8 * Redis 3.2.1 # Fixes: * Add compatibility with magick src * Add ToC (Table of Contents) for the Let's Encrypt section in docs/SSL.txt * Downgrade JSmin from 2.0.1 to 2.0.0 -- fixes #993 * Fix for legacy cluster support * Fix for virtualbox detection -- see #972 * Fix permissions on sites directories * Fix sites/all/drush permissions compatibility with Drush 8.2 * Improve protection for custom solrconfig.xml and schema.xml -- fixes #969 * Migration: xboa supports only Ægir 2.x -- #960 * Reinstall default-jre on major OS upgrade, if needed -- fixes #986 * Remote Drush support regression -- fixes #984 * The ~/static/control/README.txt is not updated on octopus upgrade #965 * Update docs/SOLR.txt to match currently supported procedures -- fixes #963 * Use st_runner() wrapper only for apt-get/aptitude # Known problems: https://github.com/omega8cc/boa/milestones/3.1.x ### Stable BOA-3.1.0 Release - Full Edition ### Date: Thu May 26 16:41:40 PDT 2016 ### Milestone URL: https://github.com/omega8cc/boa/milestones/3.1.0 ### Latest hotfix added on: Mon May 30 08:55:03 PDT 2016 @=> Includes Ægir Hostmaster 3.x-head with improvements @=> Includes Ægir Provision 3.x-head with improvements @=> Includes Drush 8 customized for BOA # Release Notes: This BOA release includes new features, system upgrades, improvements and bug fixes, with most notable features and changes listed below. All supported Drupal platforms have been updated to latest versions. @=> Let's Encrypt free SSL certificates are supported directly in Ægir @=> PHP-FPM version can be switched per site hosted on the same instance @=> Both Ægir control panel and its backend are compatible with PHP 7.0.7 @=> Support for forced Drush cache clear in the Ægir backend @=> BOA can run Debian Wheezy to Debian Jessie upgrades easily More details on new features, enhancements and changes can be found below. ### #-### Let's Encrypt free SSL certificates are supported directly in Ægir ### You can find these important Let's Encrypt topics discussed below: # Introduction # How it works? # How to add Letsencrypt.org SSL certificate to hosted site? # How to add Letsencrypt.org SSL certificate to the Ægir Hostmaster site? # How to modify/renew Letsencrypt.org SSL certificate for SSL enabled site? # Are there any requirements, limitations or exceptions? # How to enable live mode? # How to replace Let's Encrypt certificate with custom certificate? [ Available also at: https://omega8.cc/node/381 ] This BOA release opens a new era in SSL support for all hosted Drupal sites. The old method of creating SSL proxy vhosts is officially deprecated, as explained in the docs/SSL.txt how-to: NOTE ###===>>> The old how-to is still useful if you prefer to use SSL termination separated from your Ægir system, or if you don't want to use built-in Letsencrypt.org SSL certificates support (available since BOA-3.1.0). But if you can use Letsencrypt.org SSL certificates, or you are willing to use also built-in BOA feature which allows you to replace Letsencrypt.org SSL certificate with any third-party certificate per site, while still managing SSL via Ægir control panel (for redirects, forced/required SSL mode), we highly recommend to use Ægir built-in SSL support, which is enabled and ready to use in all Octopus instances since BOA-3.1.0 release. NOTE ###===>>> * How it works? BOA leverages letsencrypt.sh utility to talk to Letsencrypt.org servers, and on the Ægir side it's using new `hosting_le` extension, which replaces self-signed SSL certificates generated by Ægir with Let's Encrypt ones. You can find more information on both at these URLs: https://github.com/lukas2511/letsencrypt.sh https://github.com/omega8cc/hosting_le * How to add Letsencrypt.org SSL certificate to hosted site? In your Ægir control panel please go to the site's node Edit tab, then under `SSL Settings > Encryption` choose either `Enabled` or `Required`, if you want to enable HTTP->HTTPS redirection on the fly. Now click `Save` and wait until you will see the Verify task completed. Done! NOTE: SSL Settings are not available in the Add Site form, only in Edit. * How to add Letsencrypt.org SSL certificate to the Ægir Hostmaster site? !!! WARNING !!! ###===>>> Don't enable SSL option for the Hostmaster site in Ægir !!! WARNING Let's Encrypt SSL for Ægir control panel is handled in BOA outside of the control panel, and you should never enable it within control panel. During octopus upgrade you will see this message, explaining what to do: BOA [02:44:59] ==> UPGRADE B: Letsencrypt SSL initial mode: DEMO BOA [02:44:59] ==> UPGRADE B: LE -- No real SSL certs will be generated BOA [02:44:59] ==> UPGRADE B: LE -- To enable live SSL mode, please delete file: BOA [02:44:59] ==> UPGRADE B: LE -- /data/disk/o1/tools/le/.ctrl/ssl-demo-mode.pid BOA [02:44:59] ==> UPGRADE B: LE -- Then run octopus forced upgrade * How to modify/renew Letsencrypt.org SSL certificate for SSL enabled site? When you modify aliases or redirections, Ægir will re-create the SSL certificate on the fly, to match current settings and aliases to list. BOA runs auto-renewal checks for you weekly, and forces renewal if there is less than 30 days to the certificate expiration date (Let's Encrypt certs are valid for up to 90 days before they have to be renewed). Also every Verify task against SSL enabled site runs this check on the fly. * Are there any requirements, limitations or exceptions? Yes, there are some: * All aliases must have valid DNS names pointing to your server IP address * Even with aliases redirection enabled all aliases are listed as SAN names * Avoid renaming SSL-enabled sites; move aliases between site's clones instead * Before you rename a site, disable SSL first; then re-enable once it's renamed NOTE: The Subject Alternative Names (SAN) is a feature which allows to issue multi-domain / multi-subdomain SSL certificates -- it is automated in BOA. Let's Encrypt API for live, real certificates has its own requirements and limits you should be aware of. Please visit their website for details: https://letsencrypt.org/docs/rate-limits/ To make this new BOA feature easy to test before you will be ready to generate real, live SSL certificates, BOA comes with Let's Encrypt demo mode enabled by default, so it will not hit limits enforced for live, real Let's Encrypt SSL certificates. It allows to generate "fake" certs, similar to self-signed certificate used in BOA by default. NOTE: All sites with one or more keywords (listed below) in the site's main name (this exception rule doesn't apply to aliases) will be ignored, and they will receive only self-signed SSL certificates generated by Ægir, once you will switch their SSL settings to `Enabled` or `Required`. `.(dev|devel|temp|tmp|temporary|test|testing|stage|staging).` Examples: `foo.temp.bar.org`, `foo.test.bar.org`, `foo.dev.bar.org` NOTE: This exception rule doesn't apply to aliases which are not used as a redirection target. Even aliases with listed special keywords in their names will be listed as SAN entries, as long as they are valid DNS names. * How to enable live mode? It is enough to delete the `[aegir_root]/tools/le/.ctrl/ssl-demo-mode.pid` control file and run Verify task on any SSL enabled site again. NOTE: If you are on hosted BOA, you don't have an access to this location on your system, so please open a ticket at: https://omega8.cc/support You could switch it back and forth to demo/live mode by adding and deleting the control file, and it will re-register your system via Let's Encrypt API, but we have not tested how it may affect already generated live certificates once you will run the switch many times, so please try not to abuse this feature. It is important to remember that once you will switch the Let's Encrypt mode to demo from live, or from live to demo, by adding or removing the `[aegir_root]/tools/le/.ctrl/ssl-demo-mode.pid` control file, it will not replace all previously issued certificates instantly, because certificates are updated, if needed, only when you (or the BOA system for you during its daily maintenance, if used) will run Verify tasks on SSL enabled sites. These BOA specific Verify tasks are normally scheduled to run weekly, between Monday and Sunday, depending on the first character in the site's main name, so both live and demo certificates may still work in parallel for SSL enabled sites until it will be their turn to run Verify and update the certificate according to currently set Let's Encrypt mode. NOTE: You may find some helpful details in the Verify task log -- look for lines with `[hosting_le]` prefix. * How to replace Let's Encrypt certificate with custom certificate? 1. Create an empty control file (replace `example.com` with your site name): `[aegir_root]/tools/le/.ctrl/dont-overwrite-example.com.pid` 2. Replace `privkey.pem` symlink with single file containing your custom certificate key -- use `privkey.pem` as a filename in the directory: `[aegir_root]/tools/le/certs/example.com/` 3. Replace `fullchain.pem` symlink with single file containing your custom certificate and all intermediate certificates beneath it -- use `fullchain.pem` as a filename in the same directory: `[aegir_root]/tools/le/certs/example.com/` 4. Run Verify task for your site in the Ægir control panel. Done! NOTE: If you are on hosted BOA, you don't have an access to this location on your system, so please open a ticket at: https://omega8.cc/support ### #-### Support for PHP-FPM version switch per Octopus instance (also per site) ### ### ~/static/control/fpm.info ### ### This file, if exists and contains supported and installed PHP-FPM version, ### will be used by running every 2-3 minutes system agent to switch PHP-FPM ### version used for serving web requests by this Octopus instance. ### ### IMPORTANT: If used, it will switch PHP-FPM for all Drupal sites ### hosted on the instance, unless multi-fpm.info control file also exists. ### ### Supported values for single PHP-FPM mode which can be written in this file: ### ### 7.0 ### 5.6 ### 5.5 ### 5.4 ### 5.3 ### ### NOTE: There must be only one line and one value (like: 7.0) in this file. ### Otherwise it will be ignored. ### ### It is now possible to make all installed PHP-FPM versions available ### simultaneously for sites on the Octopus instance with additional ### control file: ### ### ~/static/control/multi-fpm.info ### ### This file, if exists, will switch all hosted sites to highest ### available PHP-FPM version within the 5.3-5.6 range, with ability ### to override PHP-FPM version per site, if the site's name is listed ### in this additional control file, as shown below: ### ### foo.com 7.0 ### bar.com 5.5 ### old.com 5.3 ### ### NOTE: Each line in the multi-fpm.info file must start with main site name, ### followed by single space, and then the PHP-FPM version to use. ### ### #-### Support for PHP-CLI version switch per Octopus instance (all sites) ### ### ~/static/control/cli.info ### ### This file, while similar to fpm.info, if exists and contains supported ### and installed PHP version, will be used by running every 2-3 minutes ### system agent to switch PHP-CLI version for this Octopus instance, but ### it will do this for all hosted sites. There is no option to switch this ### or override per site hosted. ### ### NOTE: While current Ægir version 3.x included in BOA works fine with ### latest PHP 7.0, many hosted sites, especially using Pressflow 6 core or ### older Drupal 7 core without required patch we have included since 7.43.2, ### will not work properly and Ægir tasks run against those sites may fail, ### so it's recommended to use PHP-CLI 5.6, unless you have verified that all ### sites on the instance support PHP 7.0 without issues. ### ### Supported values which can be written in this file: ### ### 7.0 ### 5.6 ### 5.5 ### 5.4 ### 5.3 ### ### There must be only one line and one value (like: 5.6) in this control file. ### Otherwise it will be ignored. ### ### #-### Support for forced Drush cache clear in the Ægir backend ### ### ~/static/control/clear-drush-cache.info ### ### Octopus instance will pause all scheduled tasks in its queue, if it will ### detect a platform build from the makefile in progress, to make sure ### that no other running task could break the build. ### ### This is great, until there will be a broken build, and Drush will fail ### to clean up all leftovers from its .tmp/cache directory, which in turn ### will pause all tasks in the queue for up to 24-48 hours, until the cache ### directory will be automatically purged by running daily cleanup tasks, ### designed to not touch anything not old enough (24 hours at minimum) ### to not break any running builds. ### ### If you need to unlock the tasks queue by forcefully removing everything ### from the Ægir backend Drush cache, you can create an empty control file: ### ~/static/control/clear-drush-cache.info ### ### #-### BOA can run Debian Wheezy to Debian Jessie upgrades easily ### This feature works like it worked before for `_LENNY_TO_SQUEEZE=YES` and then for `_SQUEEZE_TO_WHEEZY=YES`. But make sure you follow all the steps exactly as listed below: 1. Upgrade both barracuda and octopus to current stable: $ cd;wget -q -U iCab http://files.aegir.cc/BOA.sh.txt;bash BOA.sh.txt $ barracuda up-stable $ octopus up-stable all both NOTE: You can upgrade octopus selectively, if you still need one running the old stable BOA-2.4.9 version, example: $ octopus up-2.4 o1 force $ octopus up-stable o2 force $ octopus up-stable o3 force 2. Add to your /root/.barracuda.cnf this line: _WHEEZY_TO_JESSIE=YES 3. Run another barracuda upgrade with command: $ barracuda up-stable 4. If there are no errors reported, try to run manual update: $ aptitude update $ aptitude full-upgrade It should tell you that there are no packages to upgrade left. 5. Reboot your system (preferably via remote console) $ reboot 6. Run barracuda upgrade again: $ barracuda up-stable 7. Try to run manual update: $ aptitude update $ aptitude full-upgrade It should tell you that there are no packages to upgrade left. 8. Congrats! You are running BOA stable on Debian Jessie. # New features and enhancements: * Add all aliases as Subject Alternative Names in Let's encrypt certs -- #941 * Add auto-renewal procedure for Let's encrypt certs -- #942 * Add option to exclude *.tar.gz Drush archives in backboa -- #936 * Add Restaurant 1.11 * Add support for arbitrarily selected redirection targets as valid SSL names * Allow to define PHP-FPM version per site hosted -- #935 * Allow to use drush7 and drush8 on command line directly * Even with redirection enabled all aliases are listed as SAN names -- #964 * Feature: _WHEEZY_TO_JESSIE major upgrade procedure -- #870 * Let's encrypt support -- #500 * New Relic integration compatibility with multi-FPM mode * Support for forced Drush cache clear in the Ægir backend * Use Let's encrypt for Hostmaster site (after Octopus upgrade) -- #940 # Changes: * Do not allow XtraDB to crash the server due to single broken cache table * Nginx: Use faster 301/302 redirects * Nginx: Use only TLSv1.1 TLSv1.2 * Redis: Exclude cache_form bin again to avoid rare issues with contrib * Use dynamic httpredir.debian.org mirrors # System upgrades: * cURL 7.49.0 (if installed from sources) * Jetty 9.2.16.v20160414 * Nginx 1.11.0 * PHP 5.5.36 * PHP 5.6.22 * PHP 7.0.7 * Redis 3.2.0 * SLF4J 1.7.21 # Fixes: * Add compatibility with "config.sh" renamed to "config" in letsencrypt.sh * Add ssl_trusted_certificate directive required by ssl_stapling * Add warning: "Don't enable SSL option for the Hostmaster site in Ægir" -- #962 * Check if parent dir exists before touching ctrl file -- #945 * Do not clear drush cache on every hosting-dispatch -- #943 * Do not create Letsencrypt cert for Hostmaster if still in demo mode * Do not force PHP rebuild on new cURL install from sources * Drush is broken error -- clear drush cache before testing it -- #946 * Fix for backward compatibility with FPM pool tpl in 2.4 * Fix for Chive auth (via SSH) access filtering * Fix for conflicting Jetty libs * Fix ownership and attr on usr home dirs / subdirs * Improve sub-accounts zombie cleanup * Let's Encrypt SSL - switching from demo to live -- #959 * Make backboa sub-tasks delays optional and disable them by default -- #919 * Nginx: Fix for ssl_dhparam if/else logic * Remove deprecated wildcard HTTPS warning * Run registry-rebuild before updatedb with --no-cache-clear -- #938 * Set LE mode to DEMO on initial setup -- both on octopus install and upgrade * Skynet upgrades for limited shell configuration -- #950 * Something is stuck after BOA upgrade to 3.0.2 -- #951 * The makefile based platform creation fails with permissions error -- #943 * The site's files should have Ægir backend user as an owner * Use strict paths checks to avoid running chown/chmod on parent dirs # Known problems: https://github.com/omega8cc/boa/milestones/3.1.x ### Stable BOA-3.0.2 Release - Full Edition ### Date: Tue May 3 22:26:09 PDT 2016 ### Milestone URL: https://github.com/omega8cc/boa/milestones/3.0.2 ### Latest hotfix added on: Fri May 6 08:42:13 PDT 2016 @=> Includes Ægir Hostmaster 3.x-head with improvements @=> Includes Ægir Provision 3.x-head with improvements @=> Includes Drush 8 customized for BOA # Release Notes: This BOA release includes several important system upgrades, improvements and bug fixes. All supported platforms have been updated to latest versions. @=> Latest Drupal 7 core version used in BOA in all built-in platforms is compatible with latest PHP 7.0.6 -- you can switch your Octopus instance easily via fpm.info control file: https://omega8.cc/node/330 but please don't use 7.0 in cli.info, because it is not supported in the Ægir backend yet. PHP 7.0 can't be used if you have any Pressflow 6 site. # New features and enhancements: * Add idna_convert to hostmaster for IDN domain names auto-conversion -- #916 * Allow to disable redis.path.inc feature via INI variable -- #815 * Drupal 7.43.2 (with PHP 7 compatibility patch) * PHP 7 compatibility improvements -- #716 * Pressflow 6.38.2 (only version update) * Truncate giant watchdog tables # Changes: * Disable (temporarily) support for outdated ERPAL distro * Disable auto-upgrade for legacy Octopus instances * Disable page cache only in hostmaster * Disable PAMAuthentication in pure-ftpd * Force PHP 5.6 or 5.5 cli.info in Octopus 2.4.9 * Force Redis SOCKET mode if PORT was used before * Redis module mod-03-05-2016 * Redis: Limit methods to define site prefix * Redis: Use maxmemory-policy volatile-ttl * Set redis_client_base * Use Redis in hostmaster * Use standard profile by default # System upgrades: * Drush micro-8-24-04-2016 * MariaDB 10.0.25 * MariaDB 5.5.49 * MariaDB Galera Cluster 10.0.25 * Nginx 1.9.15 * OpenSSL 1.0.2h (used only in custom built Nginx) * PHP 5.5.35 * PHP 5.6.21 * PHP 7.0.6 # Fixes: * Add check_boa_php_compatibility() procedure -- fixes #906 * Add patch for registration error (Commons) * Avoid duplicate entries in hosting_cron on hostmaster install -- #928 * Cron not running on cloned sites -- fixes #922 * Disable hosting-pause / Provision -- not needed in BOA, may hang upgrade * Do not force TERM * Do not set $conf['redis_eval_enabled'] = TRUE; * Enable _DEBUG_MODE=YES on Octopus upgrade from BOA-2.4.9 * Experimental hosting_git error, platform not installed -- fixes #904 * Improve the provision_autoload_register_prefix check * Make sure that auto-generated robots.txt is OK -- fixes #925 * Make sure that hostmaster cron is never disabled * Make sure to not set PHP 7 as system default * Restart php-fpm on upgrade as soon as possible * Run registry-rebuild directly after hostmaster-migrate * Run update_php_cli_cron() twice * Use inetutils-syslogd on VZ systems -- fixes #905 * Use syncpass during hostmaster upgrade * Workaround for hostmaster upgrade from 2.x # Known problems: https://github.com/omega8cc/boa/milestones/3.1.1 ### Stable BOA-3.0.1 Release - Full Edition ### Date: Mon Apr 11 18:49:43 PDT 2016 ### Milestone URL: https://github.com/omega8cc/boa/milestones/3.0.1 @=> Includes Ægir Hostmaster 3.x-head with improvements @=> Includes Ægir Provision 3.x-head with improvements @=> Includes Drush 8 customized for BOA # Release Notes: This BOA release includes important fixes and improvements in the upgrade procedure from BOA-2.4.9 and in the initial install procedures, along with support for latest Drupal 8.0.x and 8.1.x as custom platforms you can create in the ~/static directory tree. We list here also all hot-fixes applied after initial BOA-3.0.1 release. @=> BOA will not include built-in Drupal 8 platforms until Drupal 8 will support symlinks in the codebase, like all previous core versions. @=> Octopus Ægir instances hosted on Power Engine option will *not* receive upgrade to BOA-3.x unless requested via https://omega8.cc/support to prevent issues with (often) customized Hostmaster modules not ready for Drupal 7 based Ægir control panel. All hosted BOA systems will still continue to receive the Barracuda system upgrades. @=> It is possible to host previous stable BOA-2.4.9 Octopus instances on systems with Barracuda upgraded to BOA-3.0.1 # Known problems: https://github.com/omega8cc/boa/milestones/3.0.2 # New features and enhancements: * Allow boa in-octopus to specify version {stable|head|2.4} # Changes: * Allow to execute compass over SSH * Allow to upload dot-files via SFTP * Remove/don't install not used blocks in Hostmaster # System upgrades: * Add mydropwizard-6.x-1.4 to all existing D6 platforms * Drush micro-8-08-04-2016 * Lshell 0.9.18.3 -- #895 * Nginx 1.9.14 * PHP 5.5.34 * PHP 5.6.20 * PHP 7.0.5 (for testing only) * Redis module 7.x-3.12 # Fixes: * 3.0.0 clean install is broken -- #899 * boa in-2.4 fails to install on Debian Jessie -- #898 * Can't git pull -- #890 * CiviCRM error on verification D6 site -- #897 * D7 API compatibility fix for node_save() in Hostmaster * Do not switch default PHP to 7.0 if installed * Drush issues: no aliases available -- #887 * Fix for 3.x to 3.x upgrades * Fix for FPM master proc monitor * Fix for input filters upgrade path * Fix for series test to avoid downgrade attempts * Fix the legacy install mode -- #898 * Less and more no longer allowed -- #896 * Limit the list of allowed_shell_escape commands * Missing VBO options -- #892 * Overlay header title not showing -- #889 * Problems installing rvm / compass -- #895 * Remove deprecated sftp restriction * Require BOA-2.4.9 before upgrade to BOA-3.x also in barracuda -- #886 * Switch octopus upgrade mode automatically to legacy if needed * tar and gunzip fails because of permission denied -- #894 * Use Drush 8 on command line -- #887 * vi and vim both open nano instead of vim -- #893 ### Stable BOA-3.0.0 Release - Full Edition ### Date: Wed Mar 30 10:48:54 PDT 2016 ### Milestone URL: https://github.com/omega8cc/boa/milestones/3.0.0 ### Latest hotfix added on: Wed Apr 6 17:40:12 PDT 2016 @=> Includes Ægir Hostmaster 3.x-head with improvements @=> Includes Ægir Provision 3.x-head with improvements @=> Includes Drush 8 customized for BOA # Release Notes: This BOA release includes complete Ægir 3 with Drush 8, and introduces full support for latest Drupal 8.0.5 and Drupal 8.1.0-beta2 as custom platforms you can create in the ~/static directory tree. @=> BOA will not include built-in Drupal 8 platforms until Drupal 8 will support symlinks in the codebase, like all previous core versions. @=> All supported Ægir platforms have been updated to their latest releases @=> Octopus Ægir instances hosted on Power Engine option will *not* receive upgrade to BOA-3.x unless requested via https://omega8.cc/support to prevent issues with (often) customized Hostmaster modules not ready for Drupal 7 based Ægir control panel. All hosted BOA systems will still continue to receive the Barracuda system upgrades. @=> It is possible to host previous stable BOA-2.4.9 Octopus instances on systems with Barracuda upgraded to BOA-3.0.0 # Known problems: https://github.com/omega8cc/boa/milestones/3.0.1 While clean 3.0.0 install worked in our tests before the release, it doesn't work for others. Until this problem is fixed properly without regressions, we are switching boa installer back to 2.4.9, which makes getting 3.0.0 on initial installation a two step operation: first 'boa in-stable' install to get 2.4.9, and then 'barracuda up-stable' plus 'octopus up-stable' upgrade to get 3.0.0, because upgrades for barracuda and octopus from 2.4.9 to 3.0.0 work fine. This also means that 'boa in-octopus' will still install the legacy 2.4.9 octopus extra instances, and you can upgrade them to 3.0.0 with standard 'octopus up-stable' mode. It is still possible to test/debug boa 3.0.0 clean installs -- just create an empty /root/.debug-boa-installer.cnf file before running the installer. # New features and enhancements: * Add Hosting Git optional feature -- fixes #753 * Add mydropwizard module to D6 o_contrib by default * Add support for ap-northeast-2 Asia Pacific (Seoul) S3 * Add support for PHP 7.0 -- experimental ! -- fixes #716 * Add support for VServer kernel 4.1.19-vs2.3.8.4-beng * BOA with Ægir Hostmaster 3.x -- fixes #715 * Switch to Drush 8 for Drupal 8 -- fixes #729 * Allow to randomize duplicity full backup schedule * Monitor and block SSH connections flood * Run registry-rebuild in drush_provision_drupal_post_provision_deploy() # Changes: * Add linkchecker module to Contrib [F]orce[D]isabled * Deny sudo/su switch if used for root access - fixes #879 * Do not install / remove auditd on VServer systems * Do not install / remove udev on VServer systems * Merge hosting_advanced_cron into Ægir core cron * Use Redis 7.x-3.x integration module # System upgrades: * Boto 2.39.0-fix-python-2.7.9 (please run 'backboa install' to upgrade) * CSF 8.16 * Drush mini-8-08-03-2016 * Duplicity 0.7.06 (please run 'backboa install' to upgrade) * Lshell 0.9.18.3 * MongoDB database driver 1.6.13 for all PHP versions < 7 -- fixes #521 * Nginx 1.9.14 * OpenSSH 7.2p2 (if installed from sources) * OpenSSL 1.0.2g (used only in custom built Nginx) * PHP 5.5.34 * PHP 5.6.20 * PHP 7.0.5 (for testing only) * Twig C extension for PHP - v.1.24.0 * Use PHP jsmin 2.0.1 ext with newer PHP versions - fixes #878 # Fixes: * [system] sync fix_locales for root -- fixes #880 * Add mydropwizard-6.x-1.4 to all existing D6 platforms * Auto-Update lshell.conf on all systems * Fix for 3.x to 3.x upgrades * Fix for entitycache 1.2 to 1.5 upgrade problem #868 * Fix for FPM master proc monitor * Fix for series test to avoid downgrade attempts * Numerous lshell problems -- fixes #896 #895 #894 #893 #890 * Problems installing rvm / compass -- fixes #895 * Require 2.4.9 before upgrade to 3.0.0 also in barracuda -- fixes #886 * Restart rsyslog/sysklogd aggressively enough * Switch boa meta installer to 2.4.9 until #899 is fixed * Switch octopus upgrade mode automatically to legacy if needed * Sync max_user_connections * Update map $http_user_agent $is_crawler * Use Drush 7 on command line until #887 is fixed ### Stable BOA-2.4.9 Release - Full Edition ### Date: Sat Feb 27 15:22:11 GMT 2016 ### Milestone URL: https://github.com/omega8cc/boa/milestones/2.4.9 @=> Includes Ægir Hostmaster 2.x-head with improvements @=> Includes Ægir Provision 3.x-head with improvements @=> Includes Drush 7 customized for BOA # Release Notes: This BOA release includes latest Drupal 7 and Pressflow 6 security updates, along with bug fixes and other system software updates. @=> All supported Ægir platforms have been updated to their latest releases @=> What are BOA plans for Drupal 6 support after February 24th, 2016? We will support Drupal/Pressflow 6 in all new releases, as long as available PHP versions will allow to use it (we run our own Pressflow 6 based site on PHP 5.6 for many months with zero issues). For more details please check: https://github.com/omega8cc/boa/issues/824 @=> Even if deprecated PHP versions are still included in this release, any Octopus instance running PHP older than 5.5 will not be able to receive upgrade to BOA-2.4.9, as announced before -- Please switch your Octopus to PHP 5.6 or at least 5.5 to be able to upgrade not only the Barracuda system part of BOA, but also Octopus Satellite -- The how-to can be found at: https://omega8.cc/node/330 @=> Drupal 8 support for custom platforms in the ~/static directory tree will be included, along with Drush 8 and Hostmaster 3.x in the upcoming BOA-3.0.0 release: https://github.com/omega8cc/boa/milestones/3.0.0 Note: BOA will not include built-in Drupal 8 platforms until Drupal 8 will support symlinks in the codebase, like all previous core versions # System upgrades: * MariaDB Galera Cluster 10.0.24 * Nginx 1.9.12 # Fixes: * Do not force Ruby with RVM for root on every upgrade * SQL max_user_connections autoconf value can be too low -- fixes #873 ### Stable BOA-2.4.8 Release - Full Edition ### Date: Sat Feb 20 11:28:05 GMT 2016 ### Milestone URL: https://github.com/omega8cc/boa/milestones/2.4.8 ### Latest hotfix added on: Mon Feb 22 18:28:51 GMT 2016 @=> Includes Ægir Hostmaster 2.x-head with improvements @=> Includes Ægir Provision 3.x-head with improvements @=> Includes Drush 7 customized for BOA # Release Notes: This BOA release includes several important system upgrades and bug fixes, with most notable features and changes listed below. @=> Debian 8 Jessie is fully supported, but includes only PHP 5.5 and 5.6 @=> All supported Ægir platforms have been updated with latest Drupal cores @=> Even if deprecated PHP versions are still included in this release, any Octopus instance running PHP older than 5.5 will not be able to receive upgrade to BOA-2.4.8, as announced before -- Please switch your Octopus to PHP 5.6 or at least 5.5 to be able to upgrade not only the Barracuda system part of BOA, but also Octopus Satellite -- The how-to can be found at: https://omega8.cc/node/330 @=> Drupal 8 support for custom platforms in the ~/static directory tree will be included, along with Drush 8 and PHP 7 in the *upcoming* BOA-3.0.0 release: https://github.com/omega8cc/boa/milestones/3.0.0 Note: BOA will not include built-in Drupal 8 platforms until Drupal 8 will support symlinks in the codebase, like all previous core versions @=> What are BOA plans for Drupal 6 support after February 24th, 2016? We will support Drupal/Pressflow 6 in all new releases, as long as available PHP versions will allow to use it (we run our own Pressflow 6 based site on PHP 5.6 for many months with zero issues). For more details please check: https://github.com/omega8cc/boa/issues/824 # Changes: * Add "boa info" and 'boa info more' helper command * Add branch support in the boa wrapper * Allow to force re-install with /root/.force.reinstall.cnf present * Allow to run existing Octopus 2.4 on the upcoming Barracuda 3.0 * Deny Octopus upgrade unless it is running on a compatible PHP version 5.5+ * Full backboa backups are scheduled on Sunday, unless custom _AWS_FLC is set * Full duobackboa backups will run on Saturday, unless custom _AWS_FLC is set * Make base nice configurable via _B_NICE variable * Nginx: Sync htaccess level protection with Drupal core * Nginx: Update map $http_user_agent $is_crawler * Only instance already running 2.4.8 can upgrade to upcoming 3.0.0 * Remove no longer supported T1lib in PHP * Remove support for deprecated OS versions -- fixes #802 * Replace in-legacy and up-legacy with version specific commands * Revert "Issue #2377819: Gzipping backups suppresses file permissions errors" * Run minimal modules en/dis procedure on Wednesday and full on Saturday * Skip legacy PHP 5.3 and 5.4 on Jessie * Support for Debian 8 Jessie -- fixes #702 * The _MODULES_FIX variable is set to YES by default * The _PERMISSIONS_FIX variable is set to YES by default -- fixes #593 # System upgrades: * Git 2.7.0 (if installed from sources) * MariaDB 10.0.24 * MariaDB 5.5.48 * Nginx 1.9.11 * OpenSSH 7.1p2 (if installed from sources) * OpenSSL 1.0.2f (used only in custom built Nginx) * PHP 5.5.32 * PHP 5.6.18 * PHP: Imagick 3.3.0 * Redis 3.0.7 * Ruby 2.3.0 # Fixes: * Add duobackboa docs * Add missing libs in Jessie * Allow to install a specific PHP version on a local install -- fixes #848 * Allow to run upgrade from not really 3.x HEAD to 2.4.8 * Automate /root/.force.reinstall.cnf and improve docs * Disable Octopus 3.x specific version check (tmp) for 2.4.8 * Disable spinner on Jessie * Do not force rebuild on systems installed with 2.4.8 * Do not kill long running php-fpm childs * Do not run the old D7 core fix on newer BOA versions -- fixes #842 * Do not wait for simple sed replacements -- fixes #838 * Fix a typo in some locCnf variable calls -- fixes #854 * Fix for ignored boa_platform_control.ini * Fix for MariaDB version check * Fix for not working S3 bucket connection test * Fix for process.max and pm.max_children * Fix for undefined locCnf variable in BOND - fixes #748 * Fix the logic in mysql_proc_kill() * Fix too aggressive Jetty monitoring * Force clean rsyslog/sysklogd restart if required * Force rebuild for affected services built from sources -- CVE-2015-7547 * Improve backup sub-tasks randomized schedule * Improve initial install how-to with screen * Locales check should not be used with screen session -- fixes #871 * Nginx: Remove duplicate $args on redirects * Nginx: Workaround for broken autocomplete * Remove dependency on _MODULES_FIX=YES -- fixes #592 * Remove no longer used _SSL_FROM_SOURCES logic * Remove systemd on Debian Jessie -- fixes #840 * Restart syslog hourly * Run drush cache cleanup only once per account * Speed up backup tasks by removing extra conn_test * Speed up backup tasks by running extended cleanup and reporting weekly * Speed up initial setup procedure * Sync wait randomizer max value * Upgrade wkhtmltopdf and wkhtmltoimage to 0.12.3 - fixes #858 * Use date %u day of week (1..7); 1 is Monday * Whitelist missing upload progress path ### Stable BOA-2.4.7 Release - Full Edition ### Date: Fri Dec 4 08:09:21 PST 2015 ### Milestone URL: https://github.com/omega8cc/boa/milestones/2.4.7 ### Latest hotfix added on: Thu Dec 10 10:10:26 PST 2015 @=> Includes Ægir Hostmaster 2.x-head with improvements @=> Includes Ægir Provision 3.x-head with improvements @=> Includes Drush 7 customized for BOA # Release Notes: This BOA release includes several important system upgrades and bug fixes, with most notable features and changes listed below. @=> All supported Ægir platforms have been updated with latest Drupal cores @=> Drupal 8 support for custom platforms in the ~/static directory tree will be included, along with Drush 8 and PHP 7 in the *upcoming* BOA-3.0.0 release: https://github.com/omega8cc/boa/milestones/3.0.0 @=> This BOA release (2.4.7) is the last release which still supports deprecated PHP versions: 5.3 and 5.4 -- You should switch to PHP 5.6 or at least 5.5 as soon as possible, or you will not be able to upgrade to newer BOA versions after 2.4.7 -- https://omega8.cc/node/330 @=> What are BOA plans for Drupal 6 support after February 24th, 2016? We will support Drupal/Pressflow 6 in all new releases, as long as available PHP versions will allow to use it (we run our own Pressflow 6 based site on PHP 5.6 for many months with zero issues). For more details please check: https://github.com/omega8cc/boa/issues/824 @=> SSH (RSA) keys for root are required by newer OpenSSH versions used in BOA BOA installs SSH from sources by default (Debian only). This means that password based access for root will not work once BOA is installed or upgraded to current stable version. It is a result of OpenSSH changes in recent releases and not BOA specific change. BOA will deny the initial install and Barracuda will refuse to run upgrade if it detects that system root has no SSH (RSA) keys added and only password based access is available. You can still modify this behaviour in /usr/etc/sshd_config but future OpenSSH versions may still revert such changes, so it is not recommended. @=> BOA switched from SPDY to HTTP/2 + PFS on all supported OS versions # Changes: * Allow to disable SQL monitoring with /root/.no.sql.cpu.limit.cnf -- #799 * Disable page caching on the fly where needed * Disable temporarily support for broken Restaurant distro * Do not rebuild features and entities on cache clear * Document new requirement: SSH (RSA) keys for root -- fixes #786 #833 * Make ioncube_loader optional and disable by default with _PHP_IONCUBE=NO * Nginx SSL: enable OCSP stapling by default * Nginx SSL: enable OCSP stapling for existing HTTPS vhosts * Nginx: Add ssl_dhparam to existing vhosts, if needed * Nginx: HTTP/2 replaces SPDY -- fixes #624 * PHP: Add YAML extension with LibYAML * Preserve customized /etc/sysctl.conf -- fixes #789 * Run modules ON/OFF only weekly -- requires _MODULES_FIX=YES (default is NO) * Run most of crontab, install and upgrade tasks with low priority using nice and ionice -- fixes #780 # System upgrades: * cURL 7.45.0 (if installed from sources) * GEOS 3.5.0 (requires _PHP_GEOS=YES) * Git 2.6.1 (if installed from sources) * MariaDB 10.0.22 * MariaDB 5.5.47 * MariaDB Galera Cluster 10.0.22 * Nginx 1.9.7 * OpenSSL 1.0.2e (used only in custom built Nginx) * PHP 5.5.30 * PHP 5.6.16 * Redis 3.0.5 # Fixes: * Add /root/.skip_cleanup.cnf support * Add feature branch testing in HEAD * Avoid load spikes caused by long running tasks * Avoid race conditions on multi-line sed replacement -- fixes #806 * Clean up any remaining procs zombies * Clean up postfix queue to get rid of bounced emails * Disable ioncube and opcache for HHVM * Disable Redis for Hostmaster in the backend * Do not allow to install non-standard OpenSSH on Ubuntu * Do not break /data/all/cpuinfo permissions on Octopus upgrade * Do not run 'apt-get autoremove' automatically * Do not use wrapper for dot-files cleanup * Document better BOA aggressive installation behavior -- fixes #811 * Document boa in-octopus command -- fixes #817 * Don't strip $args from $request_uri in redirects * Fix cron schedule for upgrades * Fix for /etc/sudoers on _SQUEEZE_TO_WHEEZY * Fix for broken Git on Ubuntu * Fix for DNS on _SQUEEZE_TO_WHEEZY * Fix for not working PHP rebuild check * Fix for not working syncpass tool * Fix for Ruby rebuild on _SQUEEZE_TO_WHEEZY * Fix PHP deprecated warning in D8 -- fixes #804 * Ignore 'env COLUMNS' sent by Drush remotely -- fixes #373 * Ignore daily.sh in clear.sh * Improve _SQUEEZE_TO_WHEEZY procedure -- #627 * Improve cron tasks schedule * Improve daily cleanup performance + support for /root/.giant_traffic.cnf * Improve devpts check -- fixes #788 * Improve docs/MIGRATE.txt * Improve resolv.conf auto-recovery procedure * Improve system check -- fixes #811 * Move Redis restart procedure to correct script * PHP: Add missing path to open_basedir for CLI * Remove debug code to not kill the initial install * Remove not working /etc/logrotate.d/lshell -- fixes #823 * Update advagg auto configuration variables -- fixes #792 * Update boa/lib/functions/helper.sh.inc with current OS -- fixes #787 * Update FPM workers autoconf logic * Update the cache cleanup logic * Use better placeholder for solr_integration_module variable * Use correct DPkg::Options for dist-upgrade -- fixes #627 * Use known MySQLTuner version -- fixes #827 * Use LibYAML 0.1.6 * Use opcache.restrict_api * Use sha256 for self-signed certs ### Stable BOA-2.4.6 Release - Full Edition ### Date: Sat Sep 19 11:09:09 PDT 2015 ### Milestone URL: https://github.com/omega8cc/boa/milestones/2.4.6 ### Latest hotfix added on: Mon Sep 21 05:18:33 PDT 2015 @=> Includes Ægir Hostmaster 2.x-head with improvements @=> Includes Ægir Provision 3.x-head with improvements @=> Includes Drush 7 customized for BOA # Release Notes: This BOA release includes several important system upgrades and bug fixes. All supported Ægir platforms have been updated with latest Drupal cores. # Changes: * Add Twig C extension to PHP - v.1.22.1 * Allow to customize auto-upgrades mode * Disable support for broken OpenScholar and Recruiter * Open default Postgres port for outgoing connections * Remove support for deprecated Feature Server distro * Remove support for deprecated OpenAcademy distro * Remove support for deprecated OpenBlog distro * Remove support for deprecated OpenChurch v.1 distro * Remove support for deprecated OpenDeals distro * Use distro specific Drupal core for problematic distros # System upgrades: * cURL 7.44.0 (if installed from sources) * Duplicity 0.7.05 (please run 'backboa install' to upgrade) * Jetty 7.6.17.v20150415 * Jetty 8.1.17.v20150415 * MariaDB 10.0.21 * MariaDB 5.5.45 * MariaDB Galera Cluster 10.0.21 * Nginx 1.9.4 * OpenSSH 7.1p1 (if installed from sources) * PHP 5.6.13, 5.5.29, 5.4.45 * PHP: ionCube loader 5.0.18 * Pure-FTPd 1.0.42 * Redis 3.0.4 * Ruby 2.2.3, 2.0.0-p647 * Use pecl-jsmin-1.1.0 # Fixes: * Allow to re-install deleted D7/D6 platforms when dev doesn't exist * Do not install phpunit -- it adds many PHP tools we don't need * Drush requires php-eval to run drush_find_tmp() in sql-sync * Fix apache cleanup * Fix invalid regex in the INI docs * Improve auto-healing for SSHd * Improve Nginx DoS an DDoS protection * Improve pdnsd auto-healing * Improve SSL Docs to add more detail about multidomain certificates #757 * Issue #766 - Fix for broken boa in-octopus procedure * Nginx: Fix support for s3/files/styles (s3fs) * Restart PHP-FPM if too many running childs are detected * Sync .htaccess with D7 core * Sync keywords for exceptions in daily.sh with global.inc * Use short sleep on firewall temp blocks cleanup ### Stable BOA-2.4.5 Release - Full Edition ### Date: Fri Jul 10 11:25:43 PDT 2015 ### Milestone URL: https://github.com/omega8cc/boa/milestones/2.4.5 ### Latest hotfix added on: Fri Jul 10 14:49:11 PDT 2015 @=> Includes Ægir Hostmaster 2.x-head with improvements @=> Includes Ægir Provision 3.x-head with improvements @=> Includes Drush 7 customized for BOA # Release Notes: This BOA release includes PHP security upgrade for versions 5.6, 5.5 and 5.4 plus security upgrade for Redis server and four updated Octopus platforms. Support for Drupal 8 is temporarily removed, because now it would require an upgrade to Drush 8, which in turn completely removes support for PHP 5.3, while it's still more important to support legacy Pressflow 6 sites, if they are not ready to move beyond PHP 5.3 yet, than trying to support some (too fast) moving targets like Drupal 8 beta, and Drush 8 head. # Updated Octopus platforms: Commerce 2.26 ---------------- https://drupal.org/project/commerce_kickstart Commons 3.28 ----------------- https://drupal.org/project/commons OpenAtrium 2.43 -------------- https://drupal.org/project/openatrium Panopoly 1.25 ---------------- https://drupal.org/project/panopoly # Changes: * Drupal 8 is not supported until we can switch to Drush 8 and remove PHP 5.3 # System upgrades: * Nginx 1.9.2 * PHP 5.4.43 * PHP 5.5.27 * PHP 5.6.11 * Redis 3.0.2 ### Stable BOA-2.4.4 Release - Full Edition ### Date: Fri Jul 3 12:08:29 PDT 2015 ### Milestone URL: https://github.com/omega8cc/boa/milestones/2.4.4 ### Latest hotfix added on: Thu Jul 9 10:28:42 PDT 2015 @=> Includes Ægir Hostmaster 2.x-head with improvements @=> Includes Ægir Provision 3.x-head with improvements @=> Includes Drush 7 customized for BOA # Release Notes: This BOA release includes several important system upgrades and bug fixes. All supported Ægir platforms have been updated with latest Drupal cores. This version automatically switches all hosted sites to PHP 5.5 on systems hosted and managed remotely by Omega8.cc support team, unless you have explicitly switched your Octopus instance to use PHP version you prefer. Using PHP older than 5.5 is strongly discouraged, for security, stability and performance reasons. # Changes: * Do not change mysql root password by default -- workaround for #642 * Enable advagg_async_generation by default * Logic update for /root/.high_traffic.cnf * Redis Integration Module: Update to version mod-26-06-2015 * Use modern ssl_ciphers in all templates by default # System upgrades: * cURL 7.43.0 (if installed from sources) * Drush mini-7-30-06-2015 -- fixes #734 * MariaDB 5.5.44 * MariaDB Galera Cluster 10.0.20 * Nginx 1.9.1 * OpenSSH 6.9p1 (if installed from sources) * OpenSSL 1.0.1p (if installed from sources) * PHP 5.4.42 * PHP 5.5.26 * PHP 5.6.10 * PHPRedis master-27-06-2015 * Pure-FTPd 1.0.41 * vnStat 1.14 # Fixes: * Add 'grep' to overssh -- a list of commands allowed to execute over SSH * Broken pdnsd configuration breaks DNS resolver -- fixes #701 * Do not force update_agents() * Do not modify rkey/debug args in barracuda log/system upgrade mode * Don't remove Drupal 6 core themes -- fixes #738 * Fix for legacy vnStat config * Fixed backboa/duobackboa retrieve from remote host -- fixes #741 * Improve system cron tasks queue * Incorrect permissions on /usr/bin/optipng - fixes #722 * Mitigate LOGJAM - fixes #723 * Restart Postfix after system DNS update -- #701 * Skip daily reload on high traffic instances * Sync SQL connection limits with _PHP_FPM_WORKERS variable - fixes #699 * Use _AWS_URL to properly handle us-east-1 exception * Use 2048 bit where possible - see #723 * Use better default value for advagg_cache_level - fixes #726 ### Stable BOA-2.4.3 Release - Full Edition ### Date: Tue May 19 13:40:40 PDT 2015 ### Milestone URL: https://github.com/omega8cc/boa/milestones/2.4.3 ### Latest hotfix added on: Fri Jun 5 04:43:50 PDT 2015 @=> Includes Ægir Hostmaster 2.x-head with improvements @=> Includes Ægir Provision 3.x-head with improvements @=> Includes Drush 7 customized for BOA # Release Notes: This BOA release is focused on Ægir platforms update with latest Drupal core included. There are also a few system updates and bug fixes, as listed below. # Changes: * Redis Integration Module: Update to version mod-08-05-2015 * Use HTTPS intermediate mode to support legacy systems like XP/IE8 - see #718 # System upgrades: * Drush mini-7-08-05-2015 * MariaDB 10.0.19 * MariaDB Galera Cluster 10.0.19 * PHP 5.4.41 * PHP 5.5.25 * PHP 5.6.9 * Redis 3.0.1 # Fixes: * CiviCRM known bugs and regressions fixed * Improve drush aliases cleanup * Redis: sync net.core.somaxconn with tcp-backlog * sqlmagic: do not escape backslashes and EOL character - fixes #672 * SQL dump definer regexp causes invalid SQL during migrate/clone - #2497091 * Fix for backward compatibility with old Galera versions ### Stable BOA-2.4.2 Release - Full Edition ### Date: Mon Apr 27 11:12:09 PDT 2015 ### Milestone URL: https://github.com/omega8cc/boa/milestones/2.4.2 ### Latest hotfix added on: Fri May 1 02:07:54 PDT 2015 @=> Includes Ægir Hostmaster 2.x-head with improvements @=> Includes Ægir Provision 3.x-head with improvements @=> Includes Drush 7 customized for BOA # Release Notes: This BOA release includes 15 updated Ægir platforms with latest Drupal core, 2 new features and enhancements, 13 new software versions, 3 other changes, plus over 20 bug fixes. # Updated Octopus platforms: aGov 1.7 --------------------- https://drupal.org/project/agov Commerce 1.36 ---------------- https://drupal.org/project/commerce_kickstart Commerce 2.23 ---------------- https://drupal.org/project/commerce_kickstart Commons 2.24 ----------------- https://drupal.org/project/commons Commons 3.25 ----------------- https://drupal.org/project/commons Guardr 2.11 ------------------ https://drupal.org/project/guardr OpenAid 2.1 ------------------ https://drupal.org/project/openaid OpenAtrium 2.33 -------------- https://drupal.org/project/openatrium OpenChurch 1.17-b2 ----------- https://drupal.org/project/openchurch OpenChurch 2.1-b7 ------------ https://drupal.org/project/openchurch OpenOutreach 1.19 ------------ https://drupal.org/project/openoutreach OpenPublic 1.5 --------------- https://drupal.org/project/openpublic Panopoly 1.21 ---------------- https://drupal.org/project/panopoly Recruiter 1.6 ---------------- https://drupal.org/project/recruiter Restaurant 1.0-b12 ----------- https://drupal.org/project/restaurant @=> NOTE: Drupal 8 support is broken in this release, because latest Drush doesn't support older Drupal 8 beta versions, while new D8 beta is not released and tested yet, and we really need latest Drush to fix broken D6->D7 upgrade path, so we could prepare for full Ægir 3, which comes with D7 in the frontend. # New features and enhancements: * Re-create files/robots.txt if older than 7 days * Restore default DNS when /root/.use.default.nameservers.cnf exists # Changes: * Enable SPDY and PFS by default - fixes #545 * Use GitLab as a secondary mirror * Whitelist drush pm-updatestatus # System upgrades: * cURL 7.42.1 (if installed from sources) * Drush mini-7-25-04-2015 * Duplicity 0.7.02 (please run 'backboa install' to upgrade) * MariaDB 5.5.43 * MariaDB Galera Cluster 10.0.17 * MySecureShell master-20-03-2015 * Nginx 1.8.0 * OpenSSH 6.8p1 (if installed from sources) * OpenSSL 1.0.2a (if installed from sources) * PHP 5.6.8, 5.5.24, 5.4.40 * PHPRedis master-18-03-2015 * Redis 3.0.0 * Ruby 2.2.2 # Fixes: * Add service cron start to migrate docs - fixes #654 * BOA.sh.txt should update installers when invoked interactively - fixes #644 * Do not add Google DNS when custom DNS is expected * Do not count requests for images derivatives if private files mode is used * Do not create conflicting plain HTTP proxy for single IP mode - fixes #465 * Force csf/lfd update before and after running barracuda upgrade - fixes #685 * How to enable permanent redirect to HTTPS with single IP - #465 * Improve DNS self-healing magic - see #674 * Improve FPM auto-healing to properly detect conflicting instances * Make sure that dl mirrors never get blocked * Nginx: Stop the POST flood to /autodiscover/autodiscover.xml * Nginx: Use dummy db fastcgi_param placeholders if any of them is empty * Remove aggresive firewall cleanup - fixes #688 * Remove onetime fix intended to sync new defaults - fixes #678 * Update absolute URLs to files for sites cloned/migrated/renamed * Update composer on barracuda upgrade * Use _TOMCAT_TO_JETTY=NO in cnf template to avoid confusion - see #676 * Use correct placeholder in the xboa proxy - fixes #655 * Use MAIN_SITE_NAME instead of possibly fake SERVER_NAME - see #385 * Where to add the SSL redirect configuration snippet - fixes #681 ### Stable BOA-2.4.1 Release - Full Edition ### Date: Sun Mar 8 14:56:51 PDT 2015 ### Milestone URL: https://github.com/omega8cc/boa/milestones/2.4.1 ### Latest hotfix added on: Wed Mar 11 11:58:52 PDT 2015 @=> Includes Ægir Hostmaster 2.x-head with improvements @=> Includes Ægir Provision 3.x-head with improvements @=> Includes Drush 7.0.0-alpha9 customized for BOA # Release Notes: This new BOA release includes one new and 12 updated Ægir platforms, 8 new features and enhancements, 15 new software versions, 10 other changes, plus over 38 bug fixes, with most notable features and changes listed below: @=> Add duobackboa with /root/.duobackboa.cnf file to run duplicate backups @=> Add SSL with TLS/SNI on server with one IP, multiple certificates support @=> Add support for Octopus batch migration - see docs/MIGRATE.txt for details @=> Allow to use _PHP_GEOS=YES with all PHP versions # New Octopus platforms: OpenAid 2.0 ------------------ https://drupal.org/project/openaid # Updated Octopus platforms: Commerce 1.33 ---------------- https://drupal.org/project/commerce_kickstart Commerce 2.21 ---------------- https://drupal.org/project/commerce_kickstart Commons 2.22 ----------------- https://drupal.org/project/commons Commons 3.22 ----------------- https://drupal.org/project/commons Drupal 8.0.0-b7 -------------- https://drupal.org/drupal-8.0 Guardr 2.8 ------------------- https://drupal.org/project/guardr OpenAtrium 2.32 -------------- https://drupal.org/project/openatrium OpenChurch 2.1-b5 ------------ https://drupal.org/project/openchurch OpenOutreach 1.16 ------------ https://drupal.org/project/openoutreach OpenScholar 3.20.0 ----------- http://theopenscholar.org Panopoly 1.18 ---------------- https://drupal.org/project/panopoly Recruiter 1.5 ---------------- https://drupal.org/project/recruiter # New features and enhancements: * Add compatibility with latest VS beng kernel * Add duobackboa with /root/.duobackboa.cnf file to run duplicate backups * Add support for multivalued fields in SOLR 4 - pull request #626 * Add support for mysqladmin proc logging * Add support for Octopus batch migration - see docs/MIGRATE.txt for details * Add support for scout/mysql monitoring * CSF: Add popular ports 222 and 2222 to TCP_OUT by default * SSL with TLS/SNI on server with one IP, multiple certificates - fixes #465 # Changes: * Allow to run automated SQL conversion only weekly * Allow to use _PHP_GEOS=YES with all PHP versions * Do not send extra nocache cookie on GET requests * Drush mini-7-07-03-2015 * Make barracuda wrapper available on initial install to avoid confusion * Nginx: Update for crawlers exceptions list * Redis Integration Module: Update to version mod-05-03-2015 * Remove dependency on legacy Drush 4 * Use latest Apache Solr Search 6.x-3.x config * Use latest Apache Solr Search 7.x-1.x config # System upgrades: * Apache Solr 4.9.1 * cURL 7.41.0 (if installed from sources) * Git 2.3.0 (if installed from sources) * Jetty 9.2.7.v20150116 * MariaDB 10.0.17 * MariaDB 5.5.42 * MariaDB Galera Cluster 10.0.17 * Nginx 1.7.10 * OpenSSL 1.0.2 (if installed from sources) * PHP 5.4.38 * PHP 5.5.22 * PHP 5.6.6 * PHP: ionCube loader 4.7.4 * Pure-FTPd 1.0.37 * Ruby 2.2.1 * Use duplicity 0.7.01 and boto 2.36.0 - fixes #630 * Vnstat 1.13 # Fixes: * [provision] False "load on system too heavy" messages - fixes #619 * [provision] Issue #2350695 - Profile is registered twice, also as a module * [provision] Nginx: Remove webform keyword from regex locations - fixes #599 * Add also manage_ltd_users to the list - fixes #616 * Avoid installing New Relic with no valid license key provided - fixes #608 * Do not add no longer used symlink * Do not create conflicting plain HTTP proxy for single IP mode - fixes #465 * Do not delete backboa while duplicity is running * Do not replace any contrib in latest OA - fixes #2420131 * Do not run D7 core hotfix on already fixed instances * Fix for legacy systems autoupdate logic * Fix for missing chattr -i on web user update * Fix for missing datestamp * Fix for too dangerous pdnsd auto-config logic * Fix pdnsd restarts procedures - fixes #610 * Fix permissions for pdnsd if needed * Fix variable in autoupboa - pull request #629 * Force php.ini update * Hotfix for cluster instances * Hotfix for OpenSSL/cURL versions out of sync * How to enable permanent redirect to HTTPS with single IP - #465 * Issue #2425963 - Broken slider in Commerce Kickstart 2.21 * Make sure that @hostmaster alias works after migration * Provide a patch for older civicrm versions to make them Drush 7 compatible * Randomize backups schedule to avoid issues with AWS limits * Reload nginx service automatically - #465 * Remove conflicting pdnsd restarts to avoid race conditions - fixes #610 * Remove deprecated sysctl options * Remove post-install leftovers if needed * Single PHP-version installation fails - fixes #598 * Typo - fixes #539 * Unable to connect to SOLR on latest head - fixes #623 * Update installers as expected, also with _SKYNET_MODE=OFF - fixes #644 * Update meta-installers for new stable * Update the upgrade procedure how-to - fixes ##616 * Use civicrm-4.5.6 compatible with Drush 7 * Use correct AWS Endpoint when us-east-1 Region is specified * Use correct open_basedir for lshell user - fixes #603 * Use separate loops for symlinks and ghost cleanup * Workaround for EntityMalformedException in Open Outreach - fixes #229 * Workaround for missing interface/lo.pdnsd on legacy systems * Workaround for SA-CONTRIB-2015-063 - Webform - Cross Site Scripting ### Stable BOA-2.4.0 Release - Full Edition ### Date: Wed Feb 4 20:30:04 CET 2015 ### Milestone URL: https://github.com/omega8cc/boa/milestones/2.4.0 ### Latest hotfix added on: Sat Feb 21 10:18:15 UTC 2015 @=> Includes Ægir Hostmaster 2.x-head with improvements @=> Includes Ægir Provision 3.x-head with improvements @=> Includes Drush 7.0.0-alpha8 customized for BOA # Release Notes: This new BOA release includes 7 updated Ægir platforms, over 28 new features and enhancements, 12 new software versions, over 36 important changes, plus over 100 bug fixes, with most notable features and changes listed below: @=> Added Support for latest Drupal 8.0.0-beta with D8B platform keyword @=> Added Support for latest Drupal 8.0.0-dev with D8D platform keyword @=> Added Support for latest PHP 5.6 @=> BOA can auto-detect its fastest download mirror on install, upgrade etc. @=> BOA Code Refactoring to make it modular and easier to read (in progress) @=> BOA Skynet auto-updates can be turned off with _SKYNET_MODE=OFF @=> Cron is run only for live sites with no tmp, temp, dev, test etc keywords @=> Force single PHP version with command keyword on install and upgrade @=> Introducing Support for HHVM -- see docs/HHVM.txt for details. @=> PHP 5.5 is used by default on new installs instead of old 5.3 @=> PHP-FPM (and HHVM) runs now as a separate, very limited system user @=> Removed Support for legacy PHP 5.2 @=> Sites Names Exceptions and Special Keywords have changed @=> The _MODULES_FIX variable is set to NO by default @=> The _PERMISSIONS_FIX variable is set to NO by default @=> The built-in registry-rebuild on every Verify task is not run by default @=> The Dev-Mode works only for site aliases, no longer for main site name Please read further below for more details. # Caveats for self-hosted BOA: We recommend to proceed with major upgrade procedure as follows: $ cd;wget -q -U iCab http://files.aegir.cc/BOA.sh.txt;bash BOA.sh.txt $ barracuda up-stable $ barracuda up-stable system $ octopus up-stable all both $ bash /var/xdrago/manage_ltd_users.sh $ bash /var/xdrago/daily.sh # Updated Octopus platforms: aGov 1.6 --------------------- https://drupal.org/project/agov Commerce 1.32 (with 1.11) ---- https://drupal.org/project/commerce_kickstart Guardr 2.7 ------------------- https://drupal.org/project/guardr OpenAtrium 2.26 -------------- https://drupal.org/project/openatrium OpenChurch 1.17-b1 ----------- https://drupal.org/project/openchurch OpenPublic 1.4 --------------- https://drupal.org/project/openpublic Panopoly 1.15 ---------------- https://drupal.org/project/panopoly # New features and enhancements: * Add backboa variables to configure full backup cycle and log verbosity. * Add Backdrop CMS compatibility in global.inc (experimental) * Add Drupal 8 compatibility in global.inc * Add Drush Make Local - fixes #332 * Add safe_cache_form_clear Drush extension by default - fixes #568 * Add support for writable .aws directory in the web user home. * Allow to set _PHP_SINGLE_INSTALL on command line - on install and upgrade. * Allow to use both platform specific and ALL keyword in _PLATFORMS_LIST. * BOA auto-selects the fastest download mirror on install, upgrade and update. * Detect critically low free RAM and forcefully restart services if needed. * Detect OOM incidents and forcefully restart services if needed. * Improve backboa with AWS connection testing. * Install latest D8-dev with D8D keyword specified. * Monitor and rotate PHP error logs if too big (over 1 GB). * Monitor the number of master PHP-FPM processes and force restart if needed. * New 'nodns' option to skip DNS and SMTP checks on the fly. * Nginx: Add support for images derivatives with URI shortcuts - fixes #481 * Nginx: Add support for URI shortcuts for sites in subdirectories. * PHP: Add HHVMinfo. * PHP: Add support for latest 5.6 * PHP: Allow to define version to install and use on command line - fixes #536 * PHP: Disable not used CLI versions if _PHP_SINGLE_INSTALL is defined. * PHP: Disable not used FPM and CLI versions. * PHP: HHVM experimental support - fixes #443 * Provide default value for composer_manager_vendor_dir variable - fixes #385 * Redis: Allow to configure remote IP via _REDIS_LISTEN_MODE /cluster support. * Use cron scheduler fast mode (every 10 sec) if /root/.fast.cron.cnf exists. * Use Drush Make Local for Hostmaster with download mirrors auto-detection. # Changes: * Alter the cron_interval for existing sites to match Ægir default. * Change required exceptions keywords to .temporary. and .testing. * Dev mode detection and URLs protection - now works only for aliases. * Do not display .cnf files contents if _DEBUG_MODE is not set to YES. * Do not restart Redis daily if /root/.high_traffic.cnf exists - fixes #533 * Drush 7 is now used by default instead of Drush 6. * Drush: Upgrade to mini-7-02-02-2015 * Force _TOMCAT_TO_JETTY=YES - fixes #570 * Hostmaster: Use Drush Make Local instead of downloading contrib with Drush * Limit status messages verbosity if _DEBUG_MODE is not set to YES * Make it possible to opt-out from BOA Skynet auto-updates - fixes #557 * Nginx: Block SEOkicks crawler. * PHP: Always use by default version 5.5 * PHP: Disable legacy 5.2 version if installed. * PHP: Ignore --with-curlwrappers defined in _PHP_EXTRA_CONF for 5.5 and 5.6 * PHP: Rebuild to remove --with-curlwrappers unless added in _PHP_EXTRA_CONF * PHP: Remove no longer working custom config protection - see #559 * PHP: Tune FPM defaults for speed and RAM optimization. * PHP: Use built-in Zend OPcache in 5.5 * PHP: Use built-in Zend OPcache in 5.6 * Redis Integration Module: Update to version mod-14-12-2014 * Reload system cron hourly. * Remove deprecated RC4 from ssl_protocols. * Remove the _O_CONTRIB_UP variable/feature. * Run cron for 3 sites at once max. * Set _MODULES_FIX=NO by default * Set _PERMISSIONS_FIX=NO by default * Site mode detection and cron protection - cron works only for live sites * Split huge BARRACUDA script into lib includes. * Switch to special limited system user also in PHP-FPM mode - fixes #551 * There is no need to update drupalgeddon every 5 minutes. * Use 86400 as a default cron_interval to sync with Drupal default. * Use MySQLTuner only if _USE_MYSQLTUNER=YES is set in .barracuda.cnf * Use provision_civicrm 6.x-2.x directly. * Use separate versioning for Ægir extensions download URLs. * Run built-in registry-rebuild on Verify only if empty ctrl file sites/all/modules/registry-rebuild.ini exists. # System upgrades: * cURL 7.40.0 (if installed from sources) * Git 2.2.1 (if installed from sources) * MariaDB 10.0.16 * MariaDB 5.5.42 * MariaDB Galera Cluster 10.0.16 * Nginx 1.7.9 * PHP 5.4.37 * PHP 5.5.21 * PHP 5.6.5 * PHP: ionCube loader 4.7.3 * Redis 2.8.19 * Ruby 2.2.0 # Fixes: * Add CONTRIBUTING.txt guidelines. * Add in docs/HINTS.txt Helper locations to avoid 404 on legacy images paths. * Add still missing updates for migrated instances. * Add warning about vCloud Air incompatibility with Drupal. * Aliases are wiped out after site rename - fixes #542 * Allow slower DNS response. * Always disable spinner when running boa in-octopus. * Avoid broken install on D8 core where sites/all doesn't exist by default. * Avoid confusing EXIT: You must specify already installed PHP version. * Avoid sed warnings in old stable and legacy modes. * Backward compatibility with Drush 6. * Block attempts to lookup /etc/passwd via web shell. * Check only LANG environment variable in locale test - fixes #584 * Compare $new_uri with d()->name and not d()->uri in the Site Rename Check. * Delete duplicity ghost pid file if older than 2 days. * Do not confuse D7 with D8 or Backdrop CMS. * Do not force cURL reinstall from packages - fixes #565 * Do not try to add platforms nodes if no new platform has been installed. * Do not update backboa if duplicity is running. * Document when to use /root/.fast.cron.cnf * Drupal 8 removed drupal_mail() * Drupal 8 requires container_yamls defined. * Drupal 8 requires read permissions in sites/all * Drupal 8 requires trusted_host_patterns defined in settings.php * Drupal 8 with $clean_urls=1 should use /cron/ URI. * Drush 7 requires composer. * Fix and Improve Squeeze to Wheezy upgrade procedure. * Fix for $HOME detection if not set for some reason. * Fix for Drush aliases protection. * Fix for octopus batch upgrade mode. * Fix for octopus single upgrade mode. * Fix for pdnsd install/update logic. * Fix missing symlinks after broken openjdk-6 upgrade. * Fix path to PHP-CLI if needed. * Fix public IP auto-detection on AWS in Octopus. * Fix the logic for aegir/platforms upgrade mode. * Fix the logic for TMPDIR set on the fly - fixes #552 * Fix: LANGUAGE (en_US.UTF-8) is not compatible with LC_ALL (). Disabling it. * Force _PHP_MULTI_INSTALL to match defined _PHP_FPM_VERSION on cluster nodes. * Force _THIS_DB_HOST=localhost on AWS. * HHVM: Add /home/ to open_basedir so access to the .tmp works - fixes #569 * HHVM: Add workarounds for potential security issues - fixes #443 * Improve Ægir tasks scheduling and load spikes protection. * Improve docs for backboa. * Improve pdnsd configuration update by removing non-IP lines early enough. * Improve procs monitor. * Improve web wrapper. * Increase inotify defaults to improve lsyncd support. * Issue #2372653: Add --no-autocommit when dumping MySQL tables. * Jetty: Detect if running as zombie and force restart if needed. * Make sure that AcceptEnv is set in sshd_config. * Make sure to never run cron on just cloned site. * MariaDB patch is no longer needed. * Monitor lsyncd and xinetd if installed and expected to run. * Never delete tmp dirs to avoid Drush/PHP segfaults and race conditions. * Nginx: Add missing variables in subdirectory config template. * Nginx: Fix for D8-specific /cron/ location regex. * Nginx: Force clean URLs for Drupal 8. * Nginx: Helper locations to avoid 404 on legacy images paths (subdir only) * Nginx: Hide X-Drupal-Cache-Tags header. * Nginx: Use safe fallback for mysteriously empty $db_port * PHP: Avoid version guessing for Octopus when _PHP_SINGLE_INSTALL is used. * PHP: Make sure that _PHP_SINGLE_INSTALL takes precedence. * PHP: OPcache configuration for Drupal 8 - fixes #419 * PHP: Re-install libmagickwand-dev to avoid broken extension build. * PHP: The fallback version should be detected and not hardcoded. * Prevent 'Could not change permissions' warnings with CiviCRM - fixes #523 * Remove Drupal 8 specific code from settings template used in older Drupal. * Remove known sensitive credentials from barracuda upgrade log. * Revert "Issue #2313327: Fixed Unknown options for provision-verify." * Run agents update on cluster nodes. * Run single mirror check - fixes #565 * RVM: Install also eventmachine-1.0.3 * Set files paths on D8 install to avoid using system default /tmp. * Silence confusing noise - fixes #589 * Skip auto-update for agents not compatible with older versions. * Skip extra SQL connection test on AWS. * Standardize platforms version and naming convention. * Support for _NGINX_NAXSI is experimental (don't use) * Symlinks directories expected by Drush/Ægir in D8 root. * Sync defaults for hosting_advanced_cron_default_interval * Syntax error - fixes #587 * Syntax error - fixes #588 * The _NGINX_FORWARD_SECRECY=YES is ignored on Debian Wheezy - fixes #591 * The /login suffix is no longer supported in Drupal 8 and results with 404. * The backend verify sub-task breaks site import for Drupal 8. * Tomcat is not used anymore - see #570 * Use consistent stderr 2 stdout redirects in grep checks. * Use correct _THIS_DB_HOST on master instance. * Use correct pid file in procs monitor. * Use correct user to run drush test commands. * Use extended display mode for messages longer than 200 chars. * Use faster mysqldump mode/flags. * Use mirror to download complete vendor directory for Drush 7. * Use more intuitive PHP keyword naming convention. * Use mutatable interface in install_8.inc - fxes #2409085 * Use recommended releases for views404 and views_accelerator - fixes #578 * Use release specific o_contrib downloads. * Use safe tmp cleanup to avoid race conditions. * Where to set _USE_MYSQLTUNER variable - fixes #594 ### Stable BOA-2.3.8 Release - Full Edition ### Date: Sat Nov 29 09:58:45 SGT 2014 ### Includes Ægir 2.x-head with improvements # Release Notes: This new BOA release includes new features, improvements and bug fixes. #-### Support for optional Drupalgeddon daily checks on all hosted D7 sites ~/static/control/drupalgeddon.info Previously enabled by default, now requires this control file to still run daily, because it may generate some false positives not always possible to avoid or silence, so it no longer makes sense to run this check daily, especially after BOA has run it automatically for a month and finally even disabled automatically all clearly compromised sites. Note that your system administrator may still enable this with root level control file /root/.force.drupalgeddon.cnf, so it will still run, even if you will not create the Octopus instance level empty control file: ~/static/control/drupalgeddon.info Please note that current version of Drupalgeddon Drush extension needs the 'update' module to be enabled to avoid even more false positives, so BOA will enable the 'update' module temporarily while running this check, which in turn will result with even more emails notices sent to the site admin email, if these notices are enabled. #-### Support for automated BOA upgrades: weekly and one-time You can configure BOA to run automated upgrades to latest stable version for both Barracuda and all Octopus instances with three variables, empty by default. All three variables must be defined to enable auto-upgrade. You can set _AUTO_UP_MONTH and _AUTO_UP_DAY to any date in the past if you wish to enable only weekly system upgrades. Remember that one-time upgrades will include complete upgrade to latest BOA stable for Barracuda and all Octopus instances, while weekly upgrade is designed to run only 'barracuda up-stable system' upgrade. _AUTO_UP_WEEKLY= #------ Day of week (1-7) for weekly system upgrades _AUTO_UP_MONTH= #------- Month (1-12) to define date of one-time upgrade _AUTO_UP_DAY= #--------- Day (1-31) to define date of one-time upgrade All three variables should be added in your /root/.barracuda.cnf file. # Updated Octopus platforms: ERPAL 2.2 -------------------- https://drupal.org/project/erpal # New features and enhancements in this release: * Support for automated BOA upgrades: weekly and one-time. # Changes in this release: * Drupalgeddon daily checks on all hosted D7 sites are now optional. # Fixes in this release: * Issue #508 - The _EASY_HOSTNAME is not required in local install mode. * Issue #516 - Do not break binaries detection with 'which'. ### Stable BOA-2.3.7 Release - Full Edition ### Date: Tue Nov 25 15:44:48 PST 2014 ### Includes Ægir 2.x-head with improvements # Release Notes: This new BOA release includes updated versions of all supported Drupal platforms to provide latest Drupal 7.34 and Pressflow 6.34 cores, plus new features, improvements and bug fixes. We recommend that you upgrade your D7 sites using this safe workflow: https://omega8.cc/your-drupal-site-upgrade-safe-workflow-298 For up-to-date information on #Drupageddon please check: https://omega8.cc/drupageddon-psa-2014-003-342 #-### Support for locking/unlocking web server write access in all codebases This new, auto-enabled by default protection will enhance your system security, especially for sites in custom platforms you maintain in the ~/static directory tree. It is important to understand that your web server / PHP-FPM runs as your shell/ftps user, although with a different group. This allows to maintain virtual chroot for Octopus instances, which significantly improves security. However, it had a serious drawback: the web server had write access in all your platforms codebases located in the ~/static directory tree, because all files you have uploaded there have the same owner. While it allows you to use code management which requires web hooks, it also opens a door for possible attack vectors, like for the infamous #drupageddon disaster, where Drupal allowed attackers to create .php files intended to be used as backdoors in future attacks - inside your codebase. Even if it could affect only custom platforms you maintain in the ~/static directory tree, since all built-in Octopus platforms always had Drupal core completely write-protected, plus, even if created by attacking bot, these extra .php files are completely useless for attackers, because BOA default restricted configuration doesn't allow to execute not whitelisted, unknown .php files, having codebase writable by your web server is still dangerous, because at least theoretically it may open a possibility to overwrite valid .php files, so they could be used as an entry point in a future attack. BOA now protects all your codebases by reverting (daily) ownership on all files and directories in your codebase (modules and themes) so they are owned by the Ægir backend user and not your shell/ftps user. While this new default procedure protects all your codebases in the ~/static directory tree, and even in the sites/all directory tree, and even in the sites/foo.com/modules|themes tree in all your built-in Octopus platforms, you can still manage the code and themes with your main and extra shell accounts as usual, because your codebase is still group writable, and your shell accounts are members of the group not available for the web server. You can easily disable this default daily procedure with a single switch: ~/static/control/unlock.info You can also exclude any custom platform you maintain in the ~/static directory tree from this global procedure by adding an empty skip.info control file in the given platform root directory, so all other platforms are still protected, and only excluded platform is open for write access also for the web server. But normally you should never need this unlock! Please note that this procedure will not affect any platform if you have the non-default _PERMISSIONS_FIX=NO setting in your /root/.barracuda.cnf file. It will also skip any platform with fix_files_permissions_daily variable set to FALSE in the given platform active INI file. # Updated Octopus platforms: Commerce 1.32 ---------------- https://drupal.org/project/commerce_kickstart Commerce 2.20 ---------------- https://drupal.org/project/commerce_kickstart Commons 2.21 ----------------- https://drupal.org/project/commons Commons 3.20 ----------------- https://drupal.org/project/commons Guardr 2.5 ------------------- https://drupal.org/project/guardr Open Atrium 2.25 ------------- https://drupal.org/project/openatrium Open Outreach 1.13 ----------- https://drupal.org/project/openoutreach Panopoly 1.14 ---------------- https://drupal.org/project/panopoly # New features and enhancements in this release: * Support for locking/unlocking web server write access in all codebases. # Changes in this release: * Do not force site_readonly to be disabled on non-dev sites. # System upgrades in this release: * MariaDB 10.0.15 # Fixes in this release: * Allow any single site to use 1/2 of available SQL connections max. * Clean up dot files after installing or updating RVM. * Do not run extra updates on systems running latest head version. * Improve ghost sites cleanup. * Issue #467 - Centralize control files outside of codebases tree. * Issue #498 - ERPAL: Fatal error: Unsupported operand types. * Issue #499 - RVM: Add oily_png gem version 1.1.1 * Issue #504 - Add docs/RVM.txt * Issue #504 - Remove ~/.rvm/scripts/notes script breaking lshell. * Issue #509 - Do not delete anything from hostmaster site level modules. * It is safe to run manage_ltd_users every minute. * Never touch hostmaster aliases and vhosts even they appear broken. * Nginx: Fix for possible problem with files/imagecache in legacy D6 sites. * Use gnupg2 by default. * Use latest Ruby 2.1.x or 2.0.x available. * Use verbose RVM install mode to improve debugging. ### Stable BOA-2.3.6 Release - Full Edition ### Date: Mon Nov 17 08:11:17 SGT 2014 ### Includes Ægir 2.x-head with improvements # Release Notes: This new BOA release includes updated versions of all supported Drupal platforms to provide latest Drupal 7.33 core, plus great new features, improvements and bug fixes. We recommend that you upgrade your D7 sites using this safe workflow: https://omega8.cc/your-drupal-site-upgrade-safe-workflow-298 For up-to-date information on #Drupageddon please check: https://omega8.cc/drupageddon-psa-2014-003-342 #-### Support for automated, encrypted, daily backups to Amazon S3 * This new feature is available on self-hosted BOA and hosted Power Engines. * Note that provided 'backboa' tool uses symmetric password-only encryption. * You can configure AWS Region you prefer to use and Backup Rotation policy. It will archive all directories required to restore your data (sites files, databases archives, Nginx configuration and more) on a freshly installed BOA: /etc /var/aegir /var/www /home /data It will start to run nightly at 2:08 AM (server time) only once you will add five required _AWS_* variables in the /root/.barracuda.cnf file and run the special command 'backboa install' while logged in as root. To restore any file from backups created with 'backboa' tool, you can use the same script on the same or any other BOA server. Please read docs/BACKUPS.txt at https://github.com/omega8cc/boa for details. # Updated Octopus platforms: Commons 3.19 ----------------- https://drupal.org/project/commons Open Atrium 2.24 ------------- https://drupal.org/project/openatrium Open Deals 1.35 -------------- https://drupal.org/project/opendeals OpenChurch 1.15 -------------- https://drupal.org/project/openchurch OpenChurch 2.0-b2 ------------ https://drupal.org/project/openchurch OpenScholar 3.16.0 ----------- http://theopenscholar.org Panopoly 1.13 ---------------- https://drupal.org/project/panopoly Restaurant 1.0-b10 ----------- https://drupal.org/project/restaurant Ubercart 2.14 ---------------- https://drupal.org/project/ubercart Ubercart 3.8 ----------------- https://drupal.org/project/ubercart # New features and enhancements in this release: * Add support for automated, encrypted, daily backups to Amazon S3. * Automatic shutdown for sites with known #Drupageddon users/roles added. * Drush drupalgeddon extension added in all accounts. * Make _STRONG_PASSWORDS length configurable: 8-128, YES (32), NO (8). * Support for web and db clusters with MariaDB Galera (work in progress). * Apply SA-CORE-2014-005 hot-fix daily everywhere, also on BOA (any version) servers left on the auto-pilot. # Changes in this release: * Do not force site_readonly to be disabled on non-dev sites. * Ignore disabled sites in daily monitoring and healing procedures. * Remove support for abandoned Managing News distro. * Remove support for abandoned Open Atrium 6.x distro. * Remove support for abandoned Spark distro. * Remove support for abandoned Totem distro. * Set _PERMISSIONS_FIX=YES by default, so important fixes can be applied. * Update BOA wrappers hourly. # System upgrades in this release: * cURL 7.39.0 (if installed from sources) * Drush: Upgrade command line version 6 to mini-6-30-10-2014 * Nginx 1.7.7 * PHP 5.4.35 * PHP 5.5.19 * PHP: Zend OPcache master-08-11-2014 # Fixes in this release: * Add scout user if _SCOUT_KEY is not empty or cron entry exists. * Always escape dots in preg_replace() to not truncate www. by mistake. * Check if directory tree exists before running extended checks/fixes. * Clear drush cache directly before running hostmaster-migrate. * Disable scout if installed and enable later. * Do not export LC_CTYPE on initial install. * Do not use Redis on provision-save. * Fix for edge case when incorrect permissions were set in custom platform. * Fix for openatrium-7.x-2.22-7.32.1 * Fix for site_readonly mode in migrated instances. * Force setting to avoid issues with not expected to work RVM self-update. * Hint for Apache Solr Attachments and Java path possible confusion. * Improve web wrapper filtering. * Issue #2163979 - Check if field_info_field_map() is available. * Issue #2373923 - HTTPS and aliases redirection problem with Nginx. * Issue #438 - PHP: Remove support for 5.5 built-in Zend OPcache. * Issue #452 - PHP build could be broken also with MariaDB newer than 5.5.40 * Issue #456 - Aliases redirection: problems with AdvAgg paths. * Issue #457 - Aliases redirection: 404 file not found for resources. * Issue #461 - Remote Import needs Drush strict=0 mode. * Issue #463 - The yajl-ruby gem needs native binaries building. * Issue #480 - Normalize /etc/hosts to avoid FQDN mapped to 127.0.1.1 * Issue #490 - Nginx: Block semalt botnet. * Issue #496 - RVM 1.26.0 introduces signed releases (rvm: not found error). * Make sure that hostmaster site usage is not counted. * Move DB GRANTS setup for master instance to the correct level. * Move redis server daily restart to daily.sh agent. * Nginx: Fail if required db creds are empty to never create a broken vhost. * Remove hardcoded DNS for files.aegir.cc * Strict Permissions on All Binaries are default, not optional. * There is no point in running MySQLTuner on initial install. * Whitelist mysql command for overssh in lshell. ### Stable BOA-2.3.5 Release - Full Edition ### Date: Wed Oct 15 16:28:25 PDT 2014 ### Includes Ægir 2.1 with improvements ### Latest hotfix added on: Thu Oct 16 08:55:02 PDT 2014 # Release Notes: This new BOA release includes important updates and bug fixes. * All new Drupal 7 platforms received Drupal core security upgrade. For details please read: https://www.drupal.org/SA-CORE-2014-005 * All existing Drupal 7 built-in platforms will receive a hot-fix for this known vulnerability: https://www.drupal.org/SA-CORE-2014-005 once you will run 'barracuda up-stable' command on your server. This procedure is automated on hosted and managed Ægir at Omega8.cc * Your custom D7 platforms created in the ~/static directory tree will be checked in the next 12 hours after the upgrade, and if you have not applied this patch yet, it will be applied automatically for you - but only if there is at least one active site present in the given custom D7 platform. Note that while this procedure is automated on hosted and managed Ægir at Omega8.cc, on self-hosted BOA systems it will work only if you will set _PERMISSIONS_FIX=YES in /root/.barracuda.cnf (default is NO) We recommend that you upgrade your D7 sites using safe workflow: https://omega8.cc/your-drupal-site-upgrade-safe-workflow-298 # Updated Octopus platforms: aGov 1.5 --------------------- https://drupal.org/project/agov Commerce 1.31 ---------------- https://drupal.org/project/commerce_kickstart Commerce 2.19 ---------------- https://drupal.org/project/commerce_kickstart ERPAL 2.1 -------------------- https://drupal.org/project/erpal Guardr 1.14 ------------------ https://drupal.org/project/guardr Open Atrium 2.22 ------------- https://drupal.org/project/openatrium Open Outreach 1.12 ----------- https://drupal.org/project/openoutreach OpenPublic 1.2 --------------- https://drupal.org/project/openpublic Panopoly 1.12 ---------------- https://drupal.org/project/panopoly Recruiter 1.3 ---------------- https://drupal.org/project/recruiter # New features and enhancements in this release: * Explain that Solr self-provisioning works only if _MODULES_FIX=YES is set. * Reverify all sites daily if /root/.force.sites.verify.cnf ctrl file exists and _PERMISSIONS_FIX=YES is set in /root/.barracuda.cnf (default is NO) # Changes in this release: * Security: Remove support for SSLv3 due to POODLE vulnerability. * Disable Redis in Hostmaster until we will fix the Views based pages/blocks. * Disable site_readonly for non-dev sites by default. * Drush: Upgrade command line version 6 to mini-6-04-10-2014 * Enable AllowUserFXP in Pure-FTPd config by default. * Remove support for already deprecated non-LTS Ubuntu versions. * Run manage_ip_auth_access only once per minute. * The INI variable redis_flush_forced_mode is enabled by default (again). * Use sysklogd instead of rsyslog on Ubuntu. # System upgrades in this release: * MariaDB 5.5.40 * Nginx 1.7.6 * OpenSSH 6.7p1 (if installed from sources) * OpenSSL 1.0.1j (if installed from sources) - security upgrade. * PHP 5.5.18 * PHPRedis: master-03-10-2014 # Fixes in this release: * Add auto-detection of Legacy Ruby patch level update on old systems. * Add cleanup for ghost/broken sites dirs leftovers. * Add missing cleanup for backup_migrate leftovers. * Always cleanup pid files on exit/abort. * Apply patch for SA-CORE-2014-005 in all shared D7 cores/built-in platforms. * Compass Tools: Install 1.9.3 ffi expected by older themes. * Fix db_port entry in all vhosts hourly. * Fix for broken erpal-7.x-2.0-7.31.1 * Fix for broken site level drushrc.php file. * Fix for false alarm caused by ghost sites leftovers. * Fix for incorrect hash filtering on systems with OpenSSL built from sources. * Fix locales: Numerous fixes and improvements -- thanks ar-jan! * Fix typo in REVISIONS. * Force site Verify via frontend if drushrc.php has been fixed. * Issue #435 - SQL: Remove deprecated table_cache +update table_open_cache * Issue #440 - Improve innodb_buffer_pool_size calculation and add 10% * Issue #441 - New Relic is not disabled after removing newrelic.info file. * Issue #442 - Skip locked/fpmcheck if /root/.high_traffic.cnf exists. * Issue #444 - PHP: Remove useless sed replacement in pool.d/www{*}.conf * Issue #445 - Remote Import: update 6.x-2.x branch for Ægir 2.x and Drush 6 * Issue #447 - Export LANG, LANGUAGE and all LC_ environment variables. * Issue #447 - Improve locales consistency. * Issue #447 - Set default LC_CTYPE and LC_COLLATE environment variables. * Issue #447 - Simplify locales configuration on Ubuntu. * Issue #448 - Enforce locale settings by configuring defaults. * Issue #452 - PHP build is broken with latest MariaDB 5.5.40 * Make sure that db_port is never empty and defaults to 3306. * Make sure that firewall monitoring scripts never run simultaneously. * Make sure that standard caching is enabled in hostmaster. * Pause hostmaster tasks when RVM install for any user is running. * PHP: Do not run rebuilds if not needed. * PHP: Fix for broken upgrade logic on libcurl or libssl packages upgrade. * Remove acquia_connector from latest Commons to avoid broken installs. * Remove all legacy gems and re-install RVM/Ruby for root from scratch. * Remove legacy replacement to avoid converting symlinked includes into files. * SQL: Use correct defaults if MySQLTuner test failed. * Workaround for Drupal flood using 127.0.0.1 for all requests behind proxy. ### Stable BOA-2.3.4 Release - Full Edition ### Date: Wed Oct 15 09:51:08 PDT 2014 ### Includes Ægir 2.1 with improvements Release Notes and changelog for BOA-2.3.4 has been merged into BOA-2.3.5 above after security upgrades related to OpenSSL and SSLv3 have been added shortly after 2.3.4 release. ### Stable BOA-2.3.3 Release - Full Edition ### Date: Sat Sep 27 01:25:46 PDT 2014 ### Includes Ægir 2.1 with improvements # Release Notes: This BOA Edition includes important fixes to address some issues discovered after BOA-2.3.1 release. Please read also the release notes for BOA-2.3.1 further below before running the upgrade! #-### Important details on CiviCRM versions compatibility and profiles support * All BOA-2.3.x Editions fully support latest CiviCRM 4.5.0 for Drupal 7. * CiviCRM for Drupal 6 is not supported because of known CiviCRM issues. * CiviCRM support for Drupal 7 works great when added in sites/all/modules * CiviCRM support for Drupal 7 also works when added in profiles/foo/modules but no CiviCRM cron is currently managed until this known issue is fixed, therefore BOA-2.3.3 will check all platforms on the Octopus instance and if it will detect any with CiviCRM added in the installation profile directory tree, it will refuse to upgrade such instance to not break things for those using currently not fully supported CiviCRM codebase structure. # New Octopus platforms: OpenChurch 2.0-b1 ------------ https://drupal.org/project/openchurch # Updated Octopus platforms: ERPAL 2.0 -------------------- https://drupal.org/project/erpal Guardr 1.13 ------------------ https://drupal.org/project/guardr Open Outreach 1.11 ----------- https://drupal.org/project/openoutreach OpenChurch 1.14 -------------- https://drupal.org/project/openchurch OpenPublic 1.0-rc5 ----------- https://drupal.org/project/openpublic OpenScholar 3.15.1 ----------- http://theopenscholar.org # New features and enhancements in this release: * Add makefiles for CiviCRM 4.4.7 * Add makefiles for CiviCRM 4.5.0 # Changes in this release: * Drush: Upgrade command line version 6 to mini-6-27-09-2014 * Restart SSH hourly. * The INI variable redis_flush_forced_mode is now disabled by default. * Use aegir_custom_settings-6.x-3.12 * Use Provision CiviCRM boa-2.3.3-dev # System upgrades in this release: * MariaDB 10.0.14 * Nginx 1.7.5 * PHP 5.4.33 * PHP 5.5.17 * PHPRedis: master-02-09-2014 * Redis 2.8.17 # Fixes in this release: * Add extra cleanup for Drush related caches. * Always respect _SSH_PORT if set. * Always start cron before aborting on error. * Do not add duplicate cron entry for runner.sh * Do not allow system only upgrades if Master Instance is still on 2.2.x * Do not disable _DNS_SETUP_TEST * Enable path_alias_cache by default also in the hostmaster site. * Fix for broken pdnsd configuration if wrong IPs are detected. * Fix for insufficient permissions on files/civicrm/ConfigAndLog * Fix for insufficient permissions on files/civicrm/custom * Fix for insufficient permissions on files/civicrm/dynamic * Fix for missing cron entry for Scout, if _SCOUT_KEY is not empty. * Fix the not working procedure to revert hostmaster features. * Force problematic gems install to add them on accounts with enabled RVM. * Fox for Java version for Jetty 9 on newer systems. * Hardcode files.aegir.cc DNS entry. * Improve docs/ctrl/system.ctrl readability. * Install openjdk on CI instances by default. * Issue #411 - Unable to update Octopus Instance - Reports PHP on 5.2 * Issue #423 - Make sure that innodb_buffer_pool_size is not smaller than 64M * Issue #424 - Update mysqltuner.pl to support MariaDB 10.0 * Make sure that lsb-release is installed properly. * Make the check_civicrm_compatibility more reliable to avoid false alarms. * New Relic not enabled if no custom ~/static/control/{fpm|cli}.info exists. * Nginx: Auto-Switch to wildcard all vhosts existing in the Master Instance. * Nginx: Avoid any downtime on upgrade by using www53.fpm.socket temporarily. * Nginx: Convert all config templates to wildcard mode in legacy instances. * Nginx: Convert all Octopus vhosts to wildcard mode on Barracuda upgrade. * Nginx: Convert config to use PHP 5.2 if the instance still depends on it. * Nginx: Delete ghost, outdated or broken config includes in all instances. * Nginx: Delete ghost, outdated or broken vhosts in all instances. * Nginx: Force special vhosts access rules rebuild hourly. * Nginx: Improve wildcard conversion procedure on some really old instances. * Purge all ghost delete tasks before running hostmaster-migrate / upgrade. * Purge Drush related caches cleanly when needed. * Recreate possibly broken vhosts. * Remove duplicate cron entry for runner.sh to avoid critical system load. * Remove legacy replacement to not convert config symlinks into regular files. * Run check_civicrm_compatibility only on upgrade. * Single feature revert may not be enough. * Update contrib in Open Atrium D7 to maintain upgrade path. * Update cron defaults and remove legacy code. * Update default SSL Wildcard Nginx Proxy to use wildcard listen mode. * Use strict regex in vhosts listen mode conversion to not break ports. ### Stable BOA-2.3.2 Release - Full Edition ### Date: Thu Sep 18 15:16:33 PDT 2014 ### Includes Ægir 2.1 with improvements Release Notes and changelog for BOA-2.3.2 has been merged into BOA-2.3.3 above after several hotfixes and various updates have been added shortly after 2.3.2 release to address all identified post-release issues. ### Stable BOA-2.3.1 Release - Full Edition ### Date: Sun Sep 14 15:53:25 SGT 2014 ### Includes Ægir 2.1 with improvements ### Latest hotfix added on: Mon Sep 15 19:10:07 SGT 2014 # Release Notes: This major BOA Edition introduces many new features, changes and fixes. You should carefully read about some caveats further below **before** running this major upgrade on your system. Please secure a fresh system backup first. If you haven't run full barracuda+octopus upgrade to latest BOA Stable Edition yet, don't use any partial/system upgrade modes. Once new BOA Stable is released, you must run *full* upgrades with commands: $ cd;wget -q -U iCab http://files.aegir.cc/BOA.sh.txt;bash BOA.sh.txt $ barracuda up-stable $ octopus up-stable all both @=> Key new features: * BOA-2.3.1 comes with new, shiny Ægir 2.1 stable version! * Support for Drupal sites in subdirectories is enabled by default * Solr 4 cores can be added/updated/deleted via site level INI settings * Super-easy to use New Relic support with per Octopus license key * Ability to add new Octopus instances with new, simple command syntax @=> Ægir control panel new features: * The list of sites is searchable by name or installation profile * Sites have dedicated tabs: Backups, Task log, Edit and Packages * Platform have tabs: Add site, Clients, Task log, Edit and Packages * You can schedule tasks against filtered sites in batches * Scheduling tasks in batches is available also on the platform view * Scheduling tasks in batches is available also on the profile view * Scheduling tasks in batches is available also on the client view * You can schedule tasks also against platforms in batches * You can safely apply db updates via 'Run db updates' task on any site * The new 'Clients' menu item allows to list and manage sub-accounts * Profiles are listed with both human-readable and machine names * It is now possible to choose any existing alias or the main site name as a redirect target, but without the need to rename the site -- it will just re-verify the site and create new vhost automatically @=> Ægir control panel changes: * The hosting/signup form is still available but not included in the menu * The node/add/site form is no longer included in the main menu * The optional pseudo-CDN-aliases feature is now disabled by default @=> Other important changes: * Support for PHP 5.2 has been officially deprecated * The www53 PHP-FPM pool has been switched from port to default socket mode * All existing vhosts must use wildcard in the Nginx 'listen' directive * Legacy mode for Install and Upgrade moves to 2.2.x branch * DB credentials are no longer in settings.php, only in drushrc.php * Latest Drush 6 version is used in the Ægir backend by default But what if you are not ready for this major upgrade and you would like to have more time for testing, but still be able to run system upgrades, thus effectively still using previous version 2.2.9 ? #-### Legacy mode for Install and Upgrade moves to 2.2.x branch From now on, the 'legacy' install and upgrade mode available in all meta- installers will utilize branch 2.2.x instead of deprecated 2.1.x series. This means that starting with meta installers updated to use BOA-2.3.1 version you can use commands like shown below to update Barracuda, Octopus and also to install more Octopus instances, while still using version 2.2.9: $ boa in-legacy public server.mydomain.org my@email o1 $ barracuda up-legacy system $ octopus up-legacy o1 $ boa in-legacy public server.mydomain.org my@email o2 mini etc. Remember to update your meta-installers first! $ cd;wget -q -U iCab http://files.aegir.cc/BOA.sh.txt;bash BOA.sh.txt Note also that if you will upgrade to current 'stable', it is not possible to downgrade back to the 'old stable' with 'legacy' mode, so please proceed with care! Remember also that current legacy version will not receive any further updates, even for security issues (besides those provided as packages by your OS vendor - Debian or Ubuntu, which will still work), because it is already different enough from current 2.3.1 stable, so we can't reliably maintain both with working upgrade path. #-### Caveats: This upgrade will force wildcard in the Nginx 'listen' directive If you have old enough BOA system which still uses legacy IP mode and not a wildcard in the Nginx 'listen' directive, which is both Ægir and BOA standard for a long time already, this upgrade will fix the problem and update directives only in vhosts known and controlled by BOA. If you have any other vhosts, located in standard or non-standard Nginx/BOA directories for vhosts, you have to update them manually after upgrade to BOA-2.3.0 or newer, or they will take over all other vhosts on the system and cause redirects to /install.php which results with Nginx error 403 or 404, depending on the prior configuration. It will happen because IP based 'listen' directive in Nginx has higher priority, and will mess things horribly if there are vhosts using wildcard and some using the main system IP address. What and how to replace? Here are the commands you need to run as root: $ sed -i "s/.*listen.*:80;/ listen \*:80;/g" /path/to/vhost.file $ service nginx reload Note: this **doesn't** affect special vhosts for SSL enabled sites, if used, because they are designed to use IP based 'listen' directives to provide separation between SSL enabled IPs and their associated certificates, while their associated 'upstream' block may even point to either local or remote IP address, so there is no wildcard to use in this case, and it will not conflict with all other vhosts managed by Ægir, because all SSL enabled vhosts listen on other IP addresses than the main system IP, which is by default used by all vhosts with wildcard in the 'listen' directive. The problem may happen only when you have vhosts using wildcard and also some vhosts using **main** system IP address in the 'listen' directive, which may happen also unintentionally during upgrade to BOA-2.3.0 or never, if there are either vhosts BOA doesn't control, or there are ghost vhosts not yet purged if you didn't upgrade to BOA-2.2.9 before, or there are some disabled sites, so their vhosts will not be re-created by Ægir during this major upgrade (because only active sites can be re-verified). While BOA will fix also any such ghost vhosts anyway, it will not be able to detect and fix vhosts outside of the standard directories managed by Ægir. #-### Ability to add new Octopus instances with new, simple command syntax It is now possible to add stable Octopus instances w/o forcing Barracuda upgrade, plus optionally with no platforms added by default -- usage: $ boa {in-octopus} {email} {o2} {mini|max|none} #-### The www53 PHP-FPM pool has been switched from port to default socket mode. Note that we are breaking backward compatibility here, so it will cause downtime on upgrade from any too old BOA version, until you will upgrade also Octopus instance(s) and update any other non-standard vhosts or includes still using legacy port mode for 'fastcgi_pass' Nginx directive. If you have 'fastcgi_pass 127.0.0.1:9090;' in any custom vhost or Nginx include file on the Octopus instance, you should replace it with: fastcgi_pass unix:/var/run/o1.fpm.socket; where 'o1' is your corresponding Octopus system username. Note that if you have custom vhosts or includes in the Ægir Master Instance, you should instead replace 'fastcgi_pass 127.0.0.1:9090;' with: fastcgi_pass unix:/var/run/www53.fpm.socket; where '53' is related to PHP version defined via _PHP_FPM_VERSION in your /root/.barracuda.cnf file. Note that while variable has a dot, the socket name doesn't. #-### Support for PHP 5.2 has been officially deprecated While Barracuda 2.3.1 can continue to run and even upgrade if needed also the very old PHP 5.2 version, only Octopus instances running at least PHP 5.3 or newer in both FPM and CLI mode can be upgraded to Octopus 2.3.1 Edition. If you are still using PHP 5.2 in your Octopus instance, you will not receive Ægir nor Drupal Platforms upgrade, but the Barracuda part of your system will receive upgrade to 2.3.1 anyway, so it will be ready to support your outdated Octopus instance upgrade as soon as you will switch it to modern and secure PHP version -- which is easy! Let's quote the original how-to for reference: #-### Support for PHP FPM/CLI version safe switch per Octopus instance This allows to easily switch PHP version by the instance owner w/o system admin (root) help. All you need to do is to create ~/static/control/fpm.info and ~/static/control/cli.info file with a single line telling the system which available PHP version should be used (if installed): 5.5 or 5.4 or 5.3 Only one of them can be set, but you can use separate versions for web access (fpm.info) and the Ægir backend (cli.info). The system will switch versions defined via these control files in 5 minutes or less. We use external control files and not any option in the Ægir interface to make sure you will never lock yourself by switching to version which may cause unexpected problems. #-### Support for New Relic monitoring with per Octopus instance license key This new feature will disable global New Relic monitoring by deactivating server-level license key, so it can safely auto-enable or auto-disable it every 5 minutes, but per Octopus instance -- for all sites hosted on the given instance -- when a valid license key is present in the special new ~/static/control/newrelic.info control file. Please note that valid license key is a 40-character hexadecimal string that New Relic provides when you sign up for an account. To disable New Relic monitoring for the Octopus instance, simply delete its ~/static/control/newrelic.info control file and wait a few minutes. Please note that on a self-hosted BOA you still need to add your valid license key as _NEWRELIC_KEY in the /root/.barracuda.cnf file and run system upgrade with at least 'barracuda up-stable' first. This step is not required on Omega8.cc hosted service, where New Relic agent is already pre-installed for you. #-### Solr 4 cores can be added/updated/deleted via site level INI settings ;; ;; This option allows to activate Solr 4 core configuration for the site. ;; ;; Only Solr 4 powered by Jetty server is available. Supported integration ;; modules are limited to latest versions of either search_api_solr (D7 only) ;; or apachesolr (will use Drupal core specific version automatically). ;; ;; Currently used versions are listed below: ;; ;; https://ftp.drupal.org/files/projects/search_api_solr-7.x-1.6.tar.gz ;; https://ftp.drupal.org/files/projects/apachesolr-7.x-1.7.tar.gz ;; https://ftp.drupal.org/files/projects/apachesolr-6.x-3.0.tar.gz ;; ;; Note that you still need to add preferred integration module along with ;; any its dependencies in your codebase since this feature doesn't modify ;; your platform or site - it only creates Solr core with configuration ;; files provided by integration module: schema.xml and solrconfig.xml ;; ;; This setting affects only the running daily maintenance system behaviour, ;; so you need to wait until next morning to be able to use new Solr 4 core. ;; ;; Once the Solr core is ready to use, you will find a special file in your ;; site directory: sites/foo.com/solr.php with details on how to access ;; your new Solr core with correct credentials. ;; ;; The site with enabled Solr core can be safely migrated between platforms, ;; integration module can be moved within your codebase and even upgraded, ;; as long as it is using compatible schema.xml and solrconfig.xml files. ;; ;; Supported values for the solr_integration_module variable: ;; ;; apachesolr ;; search_api_solr ;; ;; To delete existing Solr core simply comment out this line. ;; The system will cleanly delete existing Solr core next morning. ;; ;; IMPORTANT if you are using self-hosted BOA: _MODULES_FIX=YES must be set ;; in the /root/.barracuda.cnf file (this is default value) to make this ;; feature active. ;; ;solr_integration_module = your_module_name_here ;; ;; This option allows to auto-update your Solr 4 core configuration files: ;; ;; schema.xml ;; solrconfig.xml ;; ;; If there is new release for either apachesolr or search_api_solr, your ;; Solr core will not be automatically upgraded to use newer schema.xml and ;; solrconfig.xml, unless allowed by switching solr_update_config to YES. ;; ;; This option will be ignored if you will set solr_custom_config to YES. ;; ;solr_update_config = NO ;; ;; This option allows to protect custom Solr 4 core configuration files: ;; ;; schema.xml ;; solrconfig.xml ;; ;; To use customized version of either schema.xml or solrconfig.xml, you need ;; to switch solr_custom_config to YES below and if you are using hosted ;; Ægir service, submit a support ticket to get these files updated with ;; your custom versions. On self-hosted BOA simply update these files directly. ;; ;; Please remember to use Solr 4 compatible config files. ;; ;solr_custom_config = NO # Updated Octopus platforms: aGov 1.4 --------------------- https://drupal.org/project/agov Guardr 1.12 ------------------ https://drupal.org/project/guardr Open Academy 1.1 ------------- https://drupal.org/project/openacademy Restaurant 1.0-b9 ------------ https://drupal.org/project/restaurant Ubercart 3.7 ----------------- https://drupal.org/project/ubercart # New features and enhancements in this release: * Ability to add new Octopus instances with new, simple command syntax * Add default aggressive php-fpm monitoring + /root/.no.fpm.cpu.limit.cnf * Allow to define always disabled modules via _MODULES_FORCE variable. * Better wait limits on connection testing for slow network / long distance. * Issue #1927522 - Add support for easy Solr cores self-management. * Issue #362 - Add imageapi_optimize binaries via IMG in _XTRAS_LIST * Issue #376 - Add New Relic support with per Octopus instance license key. * Make firewall management faster with randomized schedule. * Procs monitor runs every 3 seconds. * Run mysql_proc_control every 5 seconds for better results. * You can safely apply db updates via 'Run db updates' task on any site. # Changes in this release: * DB credentials are no longer visible in settings.php, only in drushrc.php * Delete default profiles in the hostmaster platform. * Disable _DEBUG_MODE if not enabled on the fly. * Disable newrelic-sysmond unless /root/.enable.newrelic.sysmond.cnf exists. * Drush: Upgrade command line version 6 to mini-6-14-09-2014 * Nginx: Remove deprecated code - _HTTP_WILDCARD is already used by default. * Nginx: Use limit_conn protection only for known dynamic requests. * Redis Integration Module (cache_backport): Update to version 6.x-1.0-rc2 * Redis Integration Module: Update to version mod-12-09-2014 * Remove _ALLOW_UNSUPPORTED legacy and no longer working properly feature. * Remove dependency on Update Manager globally. * Remove deprecated multi-instance labels in the New Relic configuration. * Replace old hosting_civicrm_cron with newer hosting_civicrm module. * Set hosting_default_profile to 'minimal' to improve Ubercart 3 visibility. * The www53 PHP-FPM pool has been switched from port to default socket mode. * Use Provision CiviCRM boa-2.3.1-dev # System upgrades in this release: * cURL 7.38.0 (if installed from sources) * Git 2.1.0 (if installed from sources) * Jetty 7.6.16.v20140903 * Jetty 8.1.16.v20140903 * Jetty 9.2.3.v20140905 * PHP 5.3.29 EOL! Please read: http://php.net/archive/2014.php#id2014-08-14-1 * PHP 5.4.32 * PHP 5.5.16 * Redis 2.8.14 # Fixes in this release: * Add cleanup for _GIT_FORCE_REINSTALL if added in .barracuda.cnf * Add missing drush cache-clear drush to improve upgrade path. * Add new features in the README.txt * Add wheezy to the exceptions list where required. * Allow to clear drush cache without directory restrictions. * Always set correct TMP path for supported users. * Cleanup for cron pid files in user specific .tmp dirs. * Count properly also symlinked files directories (improved). * D6 colorbox module requires old 1.3.18 library. * Delete drush_make leftovers. * Delete duplicate menu items on upgrade. * Do not allow to install SSH from sources on Trusty to avoid problems. * Do not skip daily.sh during barracuda system only update. * Eldir theme: Use max width for buttons, if possible. * Explain why installing RVM may take longer than expected. * Fix cleanup for drush aliases in sub-accounts. * Fix daily cleanup for user specific .tmp directories. * Fix docs/HINTS.txt * Fix for broken mariadb.list * Fix for broken, way too aggressive PHP-FPM monitoring. * Fix for ghost dirs cleanup. * Fix for ghost vhosts cleanup. * Fix for missing symlinks to existing platforms. * Fix for not working protection from blocking local IPs on multi-IP systems. * Fix for subdirs_support universal check. * Fix for unreliable _IS_OLD check on Octopus instances upgrade. * Fix for warning "Could not create directory ." on Hostmaster site Verify. * Fix the fields order in the site edit form. * Fix the regex to not whitelist unexpected IP ranges inadvertently. * Force cURL rebuild if installed with outdated OpenSSL version. * Guard against destructive or insecure tasks run on the hostmaster site. * Improve cleanup for empty platforms directories. * Improve monitoring to protect against convert trying to overload the system. * Issue #2330781 - Use Drush dt() wrapper instead of not always available t() * Issue #357 - Fix the logic for Git (re)install from sources. * Issue #360 - Exclude special --CDN vhosts from daily cleanup. * Issue #361 - Update and improve docs/FAQ.txt * Issue #369 - Automatically download and fix /bin/websh if missing. * Issue #369 - Restore classic /bin/sh symlink automatically if needed. * Issue #373 - Set correct TMP, TEMP, TMPDIR env variables in limited shell. * Issue #373 - Too restrictive lshell forbidden list breaks drush sql-sync. * Issue #380 - Nameserver / pdnsd problem -- Fixes also Issue #2007990. * Issue #381 - Zend OPcache forced adds useless noise in the log. * Issue #388 - Version 6.x-2.x of provision_civicrm requires hosting_civicrm * Issue #389 - hosting_civicrm breaks site install form with confusing error. * Issue #390 - Duplicate platforms nodes are created after upgrade to 2.3.0 * Issue #395 - Validate username isn't reserved before running install script. * Issue #396 - Locale isn't getting set properly. * Issue #397 - Not actually prompted for platforms during installation. * Issue #398 - Make locales setup/fix for Debian always OS compatible. * Issue #399 - The hitimes gem needs to be pre-installed to support Omega4. * Issue #400 - CiviCRM is not installed on 2.3.0 * Issue #401 - Create sites/all/* subdirs in Hostmaster early enough. * Issue #402 - Fix for ghost or disabled vhosts which still listen on IP. * Issue #405 - Installer hangs due to yes/no dialog - "Untrusted packages" * Issue #406 - Force keyring reinstall also upon 'GPG error'. * Issue #407 - Fix for 'username is already taken' error on a local VM install * Issue #408 - Fix for multiple funny typos. Thanks ar-jan! * Make it clear that subdomain and subdirectory name must be identical. * Make sure that keys subdirectory exists to avoid active platforms cleanup. * Make the PHP-FPM processes monitor less aggressive by default. * New Relic not enabled if no custom ~/static/control/{fpm|cli}.info exists. * Nginx: Add config symlinks only on legacy instances. * Nginx: Add cron access support for subdir sites. * Nginx: Convert all vhosts to wildcard mode on Barracuda upgrade. * Nginx: Disable monitoring for POST requests related to cart/checkout URI. * Nginx: Do not touch nginx_wild_ssl.conf during this upgrade. * Nginx: Improve wildcard conversion procedure on some really old instances. * Nginx: Remove deprecated code and config templates. * Nginx: Sanitize aliases in vhost_disabled.tpl.php to avoid warnings. * Nginx: Update config includes to match optional BOA features improvements. * Nginx: Update unified configuration templates in Provision to unfork BOA. * Nginx: Update vhosts templates to match BOA improvements. * PHP: Avoid unintended duplicate rebuilds. * PHP: Sync disable_functions list. * Protect sites/all/drush * Provision: Backport provision_hosting_feature_enabled() * Provision: Remove legacy subdir code and update checks. * Redis config should sync with PHP-CLI, not PHP-FPM. * Remove legacy procs monitoring code. * Remove no longer needed limreq global fixes. * Remove no longer needed/used contrib updates. * Remove redundant file_exists() if is_readable() is also used. * Replace old hosting_civicrm_cron with newer hosting_civicrm module. * Restart pdnsd before running barracuda upgrade. * Restore BOA formatting for tasks log to improve readability. * Restore BOA naming convention and docs in Hostmaster. * Restore BOA naming convention for Installation profiles in Hostmaster. * Restore BOA strict _hosting_valid_fqdn* testing procedures in Hostmaster. * Restore BOA weight defaults in the form in Hostmaster. * Restore punycode in Hostmaster. * Restore tasks sort to always show tasks scheduled and running at the top. * Sanitize cli.info and fpm.info * Set _PLATFORMS_LIST properly. * Silence early sed replacements to avoid confusion. * Simplify colorbox-1.3.18 download. * Simplify colorbox-1.5.13 download. * Switch branch on the fly and add support for Ægir vanilla mode. * Sync /tmp access restrictions. * The hosting_civicrm_cron is now a submodule and should be also auto-enabled. * The wildcard transition **doesn't** affect vhosts for SSL enabled sites. * There is no need to force backend clone from GitHub on initial upgrade. * Update for the Hostmaster welcome page. * Update FPM monitoring settings. * Use as short labels on the site node as possible. * Use control files properly to not run redundant Jetty/Solr upgrade. * Use correct paths to platform level drushrc.php file. * Use correct Provision version on initial upgrade to 2.3.0 * Use Drush6 with @hostmaster. * Use is_dir() instead of file_exists() when checking directory existence. * Use is_file() and is_link() instead of file_exists() before trying unlink() * Use is_readable() and file_exists() instead of file_exists() for backup. * Use is_readable() check instead of insufficient file_exists() for includes. * Use is_readable() instead of file_exists() when checking alias existence. * Install latest Git even if not specified via _XTRAS_LIST but previous version built from sources is detected. * Issue #2278847 - Derivatives can't be created on install with Drush and Ægir or when no vhost is available yet (Drupal Commons) ### Stable BOA-2.3.0 Release - Full Edition ### Date: Mon Sep 8 08:42:01 PDT 2014 ### Includes Ægir 2.1 with improvements Release Notes and changelog for BOA-2.3.0 has been merged into BOA-2.3.1 above after several hotfixes and some great new features have been added shortly after 2.3.0 release to address all identified post-release issues. ### Stable BOA-2.2.9 Release - Full Edition ### Date: Wed Aug 6 17:08:10 PDT 2014 ### Includes Ægir 2.x-boa-custom version. ### Latest hotfix added on: Fri Aug 15 09:37:04 PDT 2014 # Release Notes: This release includes updated versions of all supported Drupal platforms to provide latest Drupal 7 and Pressflow 6 core, plus some changes, improvements, bug fixes, and many updated Octopus platforms. NOTE: Since the first Edition in the BOA-2.3.x series is not ready for release yet, and new Drupal core has been released to fix security issues, followed by yet another release to fix serious regressions, followed by yet another security release, we have decided to make it available to everyone and release yet another stable BOA-2.2.x Edition. IMPORTANT! This is the last Edition in the 2.2.x series, which marks the end of Drupal 5, PHP 5.2 and Drush 4 support. Next Edition will open 2.3.x series, which will allow us to provide newer Ægir version with built-in Drush 6 support, sites in subdirectories, and many Ægir User Interface improvements. If you still host any Drupal 5 sites or you are using PHP 5.2 for D6 sites, you will not be able to upgrade to the next 2.3.x Edition and you will have to stay on the 'legacy' BOA 2.2.x version, which will receive only system security upgrades, but no further feature nor bugfix releases. This also means that from now on the 'legacy' 2.2.x version will no longer receive Drupal core upgrades, even if there will be security core releases. It is time to upgrade away from Drupal 5 and away from PHP 5.2, if still used. # Updated Octopus platforms: aGov 1.2 --------------------- https://drupal.org/project/agov Commerce 1.29 ---------------- https://drupal.org/project/commerce_kickstart Commerce 2.17 ---------------- https://drupal.org/project/commerce_kickstart Commons 2.20 ----------------- https://drupal.org/project/commons Commons 3.17 ----------------- https://drupal.org/project/commons ERPAL 2.0-b5 ----------------- https://drupal.org/project/erpal Guardr 1.11 ------------------ https://drupal.org/project/guardr Open Atrium 2.21 ------------- https://drupal.org/project/openatrium Open Outreach 1.10 ----------- https://drupal.org/project/openoutreach OpenPublic 1.0-rc4 ----------- https://drupal.org/project/openpublic Panopoly 1.11 ---------------- https://drupal.org/project/panopoly Restaurant 1.0-b2 ------------ https://drupal.org/project/restaurant # New features and enhancements in this release: * Allow to define always disabled modules via _MODULES_FORCE variable. * Eldir: Add subtle 3D and round some edges. * Eldir: Improve spacing and hide useless headers. * Fix permissions on sites/all/{modules,libraries,themes} on Platform Verify. * Make firewall management faster with randomized schedule. * Merge pull request #362 from pricejn2/imageapi-optimize-binaries * RVM: Add exceptions for gems which can't be installed in Limited Shell. * Shell: Compass Tools: Allow to access guard. * Shell: Improve config to better support advanced Drush commands over SSH. # Changes in this release: * Drush: Upgrade command line version 6 to mini-6-14-08-2014 * Nginx: Add DBot to is_crawler list. * Remove no longer supported NodeStream distro. * Run complete modules-dis-list weekly (Saturday) and basic list daily. # System upgrades in this release: * MariaDB 10.0.13 * MariaDB 5.5.39 * Nginx 1.7.4 * OpenSSL 1.0.1i (if installed from sources) * PHP: ionCube loader 4.6.1 * PHP: Zend OPcache master-30-07-2014 # Fixes in this release: * Add cleanup for .tmp in sub-accounts. * Add cleanup for drush-backups leftovers. * Add cleanup for various /var/backups/* leftovers. * Add daily auto-cleanup for ghost vhosts, platforms and drush aliases. * Add exception for symlinked /data/all * Add hint for HTTPS-only mode forced in local.settings.php * Allow to clear drush cache without directory restrictions. * Avoid "Is a directory" noise in the log. * Commons 2.20 has changed its profile name from drupal_commons to commons. * Do not modify site_footer on hostmaster upgrade. * Do not rename the legacy Commons profile name. * Fix -mtime expected values. * Fix cleanup for .restore vhost leftovers. * Fix cleanup for drush aliases in sub-accounts. * Fix for unreliable _IS_OLD check on Octopus instances upgrade. * Fix Nginx monitor to respect all whitelisted POST requests in both modes. * Fix permissions on sites/all/{modules,libraries,themes} globally. * Fix weird typo in global.inc * Improve cleanup for empty platforms directories. * Improve RVM cleanup. * Issue #2278847 - Derivatives (Drupal Commons) can't be created on install. * Issue #334 - Backported provision_civicrm #1485920 * Issue #334 - Delete the civicrm_class_loader variable after deploying. * Issue #334 - Install civicrm in any location (sites/ profiles + contrib). * Issue #360 - Exclude special --CDN vhosts from daily cleanup. * Make sure that /keys subdirectory exists to avoid active platforms cleanup. * Make sure that local IPs are never blocked by mistake. * Never touch websh wrapper to avoid high load because of redirect loop. * Nginx: Detected $device is not used in Boost config, only in Speed Booster. * Nginx: Fix limreq also for some really old vhosts. * Nginx: Modify only vhosts known as included in the protected mode. * Remove /var/run/daily-fix.pid if exists when it shouldn't. * Remove debugging mode in old codebases cleanup. * Remove no longer needed/used contrib updates. * Restore default websh wrapper symlink as fast as possible. * Run manage_ltd_users every 3 minutes instead of every minute. * Simplify colorbox-1.3.18 download. * Simplify colorbox-1.5.13 download. * Uninstall css_emimage only on hostmaster upgrade. * Update and improve docs/FAQ.txt * Update regex for exceptions in Nginx monitoring. ### Stable BOA-2.2.8 Release - Full Edition ### Date: Sat Jul 26 15:31:29 PDT 2014 ### Includes Ægir 2.x-boa-custom version. ### Latest hotfix added on: Tue Aug 5 14:47:17 PDT 2014 # Release Notes: This release includes updated versions of all supported Drupal platforms to provide latest Drupal 7 and Pressflow 6 core, plus some changes, improvements, bug fixes, and six (6) updated Octopus platforms. NOTE: Since the first Edition in the BOA-2.3.x series is not ready for release yet, and new Drupal core has been released to fix security issues, followed by yet another release to fix serious regressions, we have decided to make it available to everyone and release yet another stable BOA-2.2.x Edition. IMPORTANT! This is the last Edition in the 2.2.x series, which marks the end of Drupal 5, PHP 5.2 and Drush 4 support. Next Edition will open 2.3.x series, which will allow us to provide newer Ægir version with built-in Drush 6 support, sites in subdirectories, and many Ægir User Interface improvements. If you still host any Drupal 5 sites or you are using PHP 5.2 for D6 sites, you will not be able to upgrade to the next 2.3.x Edition and you will have to stay on the 'legacy' BOA 2.2.x version, which will receive only system security upgrades, but no further feature nor bugfix releases. This also means that from now on the 'legacy' 2.2.x version will no longer receive Drupal core upgrades, even if there will be security core releases. It is time to upgrade away from Drupal 5 and away from PHP 5.2, if still used. # Updated Octopus platforms: Commerce 1.28 ---------------- https://drupal.org/project/commerce_kickstart Commerce 2.16 ---------------- https://drupal.org/project/commerce_kickstart Commons 3.16 ----------------- https://drupal.org/project/commons Open Outreach 1.8 ------------ https://drupal.org/project/openoutreach OpenBlog 1.0-v3 -------------- https://drupal.org/project/openblog Panopoly 1.8 ----------------- https://drupal.org/project/panopoly # New features and enhancements in this release: * Allow to force OpenSSL etc. re-install with _SSL_FORCE_REINSTALL=YES * Auto-Move no longer used shared codebases to /var/backups/codebases-cleanup # Changes in this release: * Drush: Upgrade command line version 6 to mini-6-29-07-2014 * Issue #334 - Update provision_civicrm version - code by ixiam - thanks! * Redis Integration Module: Update to version mod-21-07-2014 * Uninstall css_emimage in hostmaster to avoid broken upgrades. * Update for Contrib [F]orce[D]isabled modules list. * Use more aggressive defaults for _PURGE_BACKUPS and _PURGE_TMP if not set. # System upgrades in this release: * PHP 5.4.31 * PHP 5.5.15 # Fixes in this release: * Add auto-cleanup for civimail ghost leftovers. * Add cleanup drush aliases in the main SSH account properly. * Add cleanup for RVM archives and logs. * Fix for default value on hot fix update. * Fix for dev regression - it shouldn't set $conf['cache'] on valid dev URLs. * Fix the logic for custom _DEL_OLD_EMPTY_PLATFORMS defaults. * Issue #333 - Update BOA changelog URL shortcut. * Nginx: Automate SPDY test to determine if OpenSSL re-install is required. * Nginx: Silence access log for already protected /civicrm admin requests. * Remove special one-time variables if set, once used. * RVM: Install OS compatible Ruby version + various related adjustments. * Silence useless noise in the log. * Sync firewall limits. ### Stable BOA-2.2.7 Release - Full Edition ### Date: Thu Jul 17 03:11:47 CEST 2014 ### Includes Ægir 2.x-boa-custom version. ### Latest hotfix added on: Fri Jul 18 18:21:40 CDT 2014 # Release Notes: This release includes some nice new features, improvements, bug fixes, one new Octopus platform, five (5) updated Octopus platforms, along with latest Drupal core security upgrades for all supported platforms. NOTE: Since the first Edition in the BOA-2.3.x series is not ready for release yet, and new Drupal core has been released today to fix security issues, we have decided to make it available to everyone and release yet another stable BOA-2.2.x series Edition. IMPORTANT! This is the last Edition in the 2.2.x series, which marks the end of Drupal 5, PHP 5.2 and Drush 4 support. Next Edition will open 2.3.x series, which will allow us to provide newer Ægir version with built-in Drush 6 support, sites in subdirectories, and many Ægir User Interface improvements. If you still host any Drupal 5 sites or you are using PHP 5.2 for D6 sites, you will not be able to upgrade to the next 2.3.x Edition and you will have to stay on the 'legacy' BOA 2.2.x version, which will receive only system security upgrades, but no further feature nor bugfix releases. This also means that from now on the 'legacy' 2.2.x version will no longer receive Drupal core upgrades, even if there will be security core releases. It is time to upgrade away from Drupal 5 and away from PHP 5.2, if still used. # New Octopus platforms: OpenPublic 1.0-b23 ----------- https://drupal.org/project/openpublic # Updated Octopus platforms: Commerce 1.27 ---------------- https://drupal.org/project/commerce_kickstart Commons 3.15 ----------------- https://drupal.org/project/commons ERPAL 2.0-b4 ----------------- https://drupal.org/project/erpal Guardr 1.9 ------------------- https://drupal.org/project/guardr Open Deals 1.33 -------------- https://drupal.org/project/opendeals # New features and enhancements in this release: * Add early auto-repair procedure if Provision is missing for any reason. * Add support for Debian Squeeze LTS updates. * Add support for Debian Squeeze Stable Proposed Updates. * Add views_accelerator in all D7 platforms by default via o_contrib bundle. * Issue #307 - Support for Compass Tools via RVM with local user gems. * Make $conf['cache'] configurable via disable_drupal_page_cache INI variable. # Changes in this release: * Nginx: Send Boost compatible Cache-Control headers also with Speed Booster. This is to mimic Drupal core behaviour when full-page cache is disabled, even if it is not really disabled via disable_drupal_page_cache INI variable. Note that Speed Booster continues to ignore Cache-Control headers sent by Drupal backend, as before, to force its own TTL set via INI variable: speed_booster_anon_cache_ttl or in the custom local.settings.php code. * Add css_emimage to hostmaster makefile to remove dependency on o_contrib. * Do not upgrade existing o_contrib, only add new if missing in old platforms. * Drush: Upgrade command line version 6 to mini-6-16-07-2014 * Limited Shell configuration update. * Nginx: Do not log HTTPS redirects. * PHP: AutoRemove 5.2 from _PHP_MULTI_INSTALL if no instance is using it. * Prefer dash if available. * Redis Integration Module: Update to version mod-10-07-2014 * The ?nocache=1 in the URL should also force $conf['cache'] = 0; on the fly. * Update lfd default configuration. # System upgrades in this release: * cURL 7.37.1 (if installed from sources) * Nginx 1.7.3 * PHP 5.4.30 * PHP 5.5.14 * PHPRedis: master-06-07-2014 * Redis 2.8.13 # Fixes in this release: * Authorized IPs detection - it should ignore serial/remote console logins. * BND --- Bind9 DNS Server (available on Debian only). * Clear packages cache more aggressively to avoid issues during OS upgrades. * Configure RVM env properly if installed in the user home directory. * Contrib update: filefield-6.x-3.13 * Disable redis integration during hostmaster upgrade. * Do not allow known bots to activate nocache and noredis URLs behaviour. * Do not use css_emimage in hostmaster to avoid broken upgrades. * Fix for o_contrib update logic. * Fix for possible permissions problem with redis log file. * Fix incorrect version in the permissions fix. * Fix legacy test logic to allow head instances to upgrade to another 2.2.x * Fix regex in procs monitor. * Fix the check for legacy systems on upgrade. * Force keyring reinstall if reported as broken. * Issue #316 - Octopus upgrade fails because of missing cd $_ROOT/.drush/sys * Issue #319 - XTRAS_LIST settings are being overwritten (Ubuntu). * Issue #320 - Compass Tools available on Squeeze, Wheezy, Precise and Trusty. * Issue #324 - HTTPS results in redirect loop on AWS due to ignored _MY_OWNIP. * Issue #328 - The /bin/sh symlink modified daily causes false lfd alarm. * Make it clear that we recommend and support Debian 64bit. * Make sure that redis and cache_backport are available for hostmaster. * Purge no longer used jdk leftovers. * Readme improvements. * Remove no longer needed tmp chown -R * Remove no longer used /data/src directory. * Remove remote_import if found if the wrong directory. * Sanitize logs lines before analyzing them. * The list of platforms symbols can be in a single line or one per line. * There is no need to force SHELL in the websh wrapper. * Update nginx documentation URL. * Use static ftp.debian.org instead of unreliable http.debian.net mirrors. ### Stable BOA-2.2.6 Release - Full Edition ### Date: Sat Jun 21 06:14:18 PDT 2014 ### Includes Ægir 2.x-boa-custom version. ### Latest hotfix added on: Mon Jul 14 14:54:04 CDT 2014 # Release Notes: This release includes great new features, improvements, important changes, many bug fixes, plus 3 new and 7 updated Octopus platforms. IMPORTANT! This is the last Edition in the 2.2.x series, which marks the end of Drupal 5, PHP 5.2 and Drush 4 support. Next Edition will open 2.3.x series, which will allow us to provide newer Ægir version with built-in Drush 6 support, sites in subdirectories, and many Ægir User Interface improvements. If you still host any Drupal 5 sites or you are using PHP 5.2 for D6 sites, you will not be able to upgrade to the next 2.3.x Edition and you will have to stay on the 'legacy' BOA 2.2.x version, which will receive only system security upgrades, but no further feature nor bugfix releases. This also means that from now on the 'legacy' 2.2.x version will no longer receive Drupal core upgrades, even if there will be security core releases. It is time to upgrade away from Drupal 5 and away from PHP 5.2, if still used. # New Octopus platforms: aGov 1.0-rc8 ----------------- https://drupal.org/project/agov ERPAL 2.0-b2 ----------------- https://drupal.org/project/erpal Restaurant 1.0-a5 ------------ https://drupal.org/project/restaurant # Updated Octopus platforms: Commerce 2.15 ---------------- https://drupal.org/project/commerce_kickstart Commons 2.18 ----------------- https://drupal.org/project/commons Commons 3.14 ----------------- https://drupal.org/project/commons Guardr 1.5 ------------------- https://drupal.org/project/guardr Open Atrium 2.19 ------------- https://drupal.org/project/openatrium Open Outreach 1.7 ------------ https://drupal.org/project/openoutreach Panopoly 1.6 ----------------- https://drupal.org/project/panopoly # New features and enhancements in this release: * Drush aliases based workflows are now supported also remotely over SSH. This is significant improvement since we have added automatically generated and updated Drush aliases for the on-the-server use in BOA-2.2.0 * Add gems: compass_radix v2 and compass_twitter_bootstrap * Add support for automatic Scout App upgrade on RVM/Ruby/Gems upgrade. * Install headless JRE and only if Solr is expected to run. * Issue #2268889 - Allow to whitelist IPs for chive, cgp and sqlbuddy access. * Issues #2248907 #1299526 - Allow to use comments for admin notes. * Nginx: Disable proxy_buffering to avoid useless extra layer in local proxy. * SQL: Allow to change InnoDB log file size via _INNODB_LOG_FILE_SIZE variable * Use better subdirectory tree for Drush extensions. * Add support for disable_user_register_protection INI variable on the platform level - on self-hosted BOA and Power Engines only. * Issue #2240277 - Customize Octopus platforms list via control file. ~/static/control/platforms.info This file, if exists and contains a single line with supported platforms symbols, allows to control/override the value of _PLATFORMS_LIST variable normally defined in the /root/.${_USER}.octopus.cnf file, which can't be modified by the Ægir instance owner with no system root access. IMPORTANT: If used, it will replace/override the value defined on initial instance install and all previous upgrades. It takes effect on every future Octopus instance upgrade, which means that you will miss all newly added distributions, if they will not be listed also in this control file. Supported values which can be written in this file - remember: all in a single line, space separated, so not one per line, as listed below only for readability: # D7P D7S D7D --- Drupal 7 prod/stage/dev # D6P D6S D6D --- Pressflow 6 p/s/d # AGV ----------- aGov # CME ----------- Commerce v.2 # CS7 ----------- Commons 7 # DCE ----------- Commerce v.1 # DCS ----------- Commons 6 # ERP ----------- ERPAL # FSR ----------- Feature Server # GDR ----------- Guardr # MNS ----------- Managing News # OA7 ----------- Open Atrium D7 # OAM ----------- Open Atrium D6 # OAY ----------- Open Academy # OBG ----------- OpenBlog # OCH ----------- OpenChurch # ODS ----------- Open Deals # OOH ----------- Open Outreach # OSR ----------- OpenScholar # PPY ----------- Panopoly # RER ----------- Recruiter # RST ----------- Restaurant # SRK ----------- Spark # TTM ----------- Totem # UC7 ----------- Ubercart D7 # UCT ----------- Ubercart D6 You can also use special keyword 'ALL' to have all available platforms installed, including newly added in the future BOA system releases. Examples: ALL D7P D6P OAM MNS OOH RST * Issue #314 - Make _BACKEND_ITEMS configurable via _BACKEND_ITEMS_LIST You can whitelist extra binaries to make them available for web server requests, in addition to already whitelisted, known as safe binaries. NOTE: This feature is available only on self-hosted BOA systems. Please be aware that you could easily open security holes by whitelisting commands which may provide access to otherwise not available parts of the system, because the exec() in PHP doesn't respect other limitations like open_basedir directive. You should list only filenames, not full paths, for example: _BACKEND_ITEMS_LIST="git foo bar" # Changes in this release: * Add memcache, memcache_admin to the list of automatically disabled modules. * Add support for Debian Squeeze LTS updates. * Add support for Debian Squeeze Stable Proposed Updates. * Add varnish to the list of automatically disabled modules. * Add watchdog_live to the list of automatically disabled modules. * Disable and remove not used init scripts on known VM systems. * Drush: Upgrade command line version 6 to mini-6-21-06-2014 * Fast DNS Cache Server (pdnsd) install is no longer optional. * Install only vanilla core platforms by default (can be overridden) * Nginx: Update default limit_conn settings. * Nginx: Use only newer control file to force DoS monitor aggressive mode. * Sync permissions with new defaults in the hardened setup. * Update files ownership to match defaults in the hardened setup. * Use dynamic mirror selection provided by Debian instead of forced static. * The BOA project has moved to Github! We no longer use repositories and issue queues on drupal.org, in an effort to avoid fragmentation and duplication. We have moved all downloads used by Barracuda and Octopus to our mirrors a few months ago, and it helped to make BOA faster and more reliable during both system install and upgrades. The next step is to use http://boa.readthedocs.org as a new home for all future documentation efforts - it will build the docs, including printable versions, on the fly, using dedicated Github repository as a backend, where you can help migrate existing docs and improve them, both via boa-docs project issue queue and pull requests: https://github.com/omega8cc/boa-docs We also encourage you to use drupal.stackexchange.com for BOA support: http://drupal.stackexchange.com/questions/tagged/aegir Please use our Github project for contributing code, reporting bugs, and also suggesting new features and ideas: https://github.com/omega8cc/boa # System upgrades in this release: * cURL 7.37.0 (if installed from sources) * MariaDB 10.0.12 * MariaDB 5.5.38 * MySecureShell 1.33 * Nginx 1.7.2 * OpenSSL 1.0.1h (if installed from sources) * PHP 5.4.29 * PHP 5.5.13 * PHP: Zend OPcache master-28-05-2014 * Redis 2.8.11 * Ruby 2.1.2 # Fixes in this release: * Add caveats to docs/REMOTE.txt * Add explicit whitelisting in websh wrapper to avoid any edge case problems. * Add info about Two-Factor Auth for Chive in the welcome email template. * Add missing exceptions in global.inc and simplify docs/REMOTE.txt * Add missing wrapper exceptions required by daily.sh script. * Clean up packages cache on finale() * Create symlink for boa wrapper on the initial install only. * Delete daily both files and directories in the ~/static/trash/ * Do not remove bundler in CI instances if /root/.keep.bundler.cnf exists. * Explain that _ALLOW_UNSUPPORTED works only with head. * Fix for _NGINX_DOS_LIMIT logical error in the scan_nginx template. * Fix for already installed Open Atrium 2.18 7.28.1 * Fix for Postfix configuration. * Fix incorrect version in the permissions fix. * Fix permissions after every upgrade. * Fix permissions and owner/group required for feeds (upload) support. * Fix regex in procs monitor. * Force apticron re-install if apticron.conf is outdated. * Generate /data/all/cpuinfo daily to be used in Provision. * GPL Ghostscript should be available for the web (PHP-FPM) access. * Issue #2248037 - Add Platform and Site INI files Templates on Verify task. * Issue #2262935 - Modules dir must be group writable in custom platforms. * Issue #315 - Upgrading from older versions of BOA fails * Issue #316 - Upgrade fails because of missing cd $_ROOT/.drush/sys line. * Issue #319 - XTRAS_LIST settings are being overwritten (Ubuntu) * Issue #324 - HTTPS results in redirect loop on AWS due to ignored _MY_OWNIP. * PHP: Add protection from switching to not installed CLI or FPM version. * PHP: Do not block getenv function. * Provision: Use /data/all/cpuinfo generated by BOA daily, if exists. * Remove redundant downloads silencer. * Remove remote_import if found in the wrong directory. * Sanitize logs lines before analyzing them. * SQL: Do not run update_innodb_log_file_size() if the size is the same. * Sync BOND with BARRACUDA. * Update for switch_to_bash procedure. * Use already downloaded patches. * Use Debian release specific proposed-updates. * Use full path to sqlmagic in daily.sh to avoid 'command not found' error. * Use static ftp.debian.org instead of unreliable http.debian.net mirrors. * Fix for authorized IPs detection in the protected vhosts logic - it should ignore serial/remote console logins. * Provision: Use higher hardcoded threshold to avoid breaking tasks due to high load on multi-CPU systems when provision can't determine the real load. ### Stable BOA-2.2.5 Release - Full Edition ### Date: Thu May 8 11:59:23 PDT 2014 ### Includes Ægir 2.x-boa-custom version. ### Latest hotfix added on: Sat May 10 09:05:19 PDT 2014 # Release Notes: This release includes no new features, but does include bug fixes plus latest Drupal 7.28.1 and Pressflow 6.31.2 core in all built-in Octopus platforms. There are also three updated distributions included, as listed below. We also list here all hot-fixes applied to previous stable after its release. # Important - Read This First! (for self-hosted BOA only) If you haven't run full barracuda+octopus upgrade to latest BOA Stable Edition yet, don't use any partial upgrade modes explained in docs/UPGRADE.txt Once new BOA Stable is released, you must run *full* upgrades with commands: $ barracuda up-stable $ octopus up-stable all both For silent, logged mode with email message sent once the upgrade is complete, but no progress is displayed in the terminal window, you can run alternatively, starting with screen session to avoid incomplete upgrade if your SSH session will be closed for any reason before the upgrade will complete: $ screen $ barracuda up-stable log $ octopus up-stable all both log Note that the silent, non-interactive mode will automatically say Y/Yes to all prompts and is thus useful to run auto-upgrades scheduled in cron. If you have skipped some recent BOA releases, and you have new default config option: _PERMISSIONS_FIX=NO in your /root/.barracuda.cnf configuration file, plus, you are not sure if you follow best practices for managing permissions as recommended in our docs: https://omega8.cc/node/116 then we recommend that you change it to _PERMISSIONS_FIX=YES temporarily, or even permanently if your VPS is fast enough, and then run this powerful script as root: $ bash /var/xdrago/daily.sh Note that BOA 'legacy' mode is still at version 2.1.3 # Updated Octopus platforms: Commons 3.12 ----------------- https://drupal.org/project/commons Open Atrium 2.18 ------------- https://drupal.org/project/openatrium Open Outreach 1.6 ------------ https://drupal.org/project/openoutreach # Changes in this release: * Add rsyslog/sysklogd to auto-healing procedures. * Make the aggressive scan_nginx mode optional and use old mode by default. * Nginx: Add HiScan to blocked crawlers list. * Nginx: Add Riddler to blocked crawlers list. * PHP: Use pm.process_idle_timeout = 10s for speed and RAM optimization. # System upgrades in this release: * MySecureShell 1.33 * PHP 5.4.28 * PHP 5.5.12 # Fixes in this release: * Always define _PHP_CN variable properly. * Firewall: Sync CONNLIMIT for web ports with updated limit_conn in Nginx. * Fix for _NGINX_DOS_LIMIT logical error in the scan_nginx template. * Force Pure-FTPd server re-install if key files are missing for any reason. * Issue #2237167 - Improve authorized IPs detection in all protected vhosts. * Issue #2262935 - Modules dir must be group writable in custom platforms. * Nginx: Do not overwrite custom symlinks to the Under Construction template. * Nginx: Update limit_conn in all instances and vhosts on Barracuda upgrade. * PHP: Delete pear in legacy paths, if still exists. * PHP: Fix for CVE-2014-0185 privilege escalation in FPM (doesn't affect BOA) * Postfix: Force re-install if broken permissions detected on upgrade. * Pressflow 6: Fix #GH 84 by using drupal_page_is_cacheable(). * Pressflow 6: Merge pull request #GH 85 from pressflow/SA-CORE-2014-002-fix. * Pressflow 6: Remove duplicate openid_update_6001(). * Revert "Force MariaDB 5.5 re-install". * Set the TERM env variable if missing to avoid errors. * Skip packages set on hold when running apticron. * The ~/static/control must be writeable by lshell user to manage ctrl files. * Add extra cron semaphore to prevent concurrent cron invocations via multiple running runner.sh instances. ### Stable BOA-2.2.4 Release - Full Edition ### Date: Wed Apr 30 17:03:36 PDT 2014 ### Includes Ægir 2.x-boa-custom version. ### Latest hotfix added on: Fri May 2 04:54:25 PDT 2014 # Release Notes: This release includes several bug fixes along with five updated platforms, plus some hot-fixes applied to previous stable after its release. We have also added a fix for known problem is recent Drupal 7.27 [#2245331] hence the change from Drupal 7.27.1 to 7.27.2 in all D7 platforms. # Updated Octopus platforms: ### Drupal 7.27.2 Commerce 1.25 ---------------- https://drupal.org/project/commerce_kickstart Commerce 2.14 ---------------- https://drupal.org/project/commerce_kickstart Commons 3.11 ----------------- https://drupal.org/project/commons Panopoly 1.5 ----------------- https://drupal.org/project/panopoly ### Pressflow 6.31.1 Commons 2.17 ----------------- https://drupal.org/project/commons Note: Always read and follow upgrade procedure if explained in the distro release notes, like for Panopoly 1.5 at https://drupal.org/node/2255133 # New o_contrib modules: * print-6.x-1.19 (includes patch to auto-detect /usr/bin/wkhtmltopdf) * print-7.x-2.0 (includes patch to auto-detect /usr/bin/wkhtmltopdf) # New features and enhancements in this release: * Support for session.gc_maxlifetime configurable via INI files. You can control session garbage collector (EOL) per site and per platform. The value (in seconds) of the session_gc_eol variable is used as session.gc_maxlifetime value and specifies the number of seconds after which data will be seen as 'garbage' and potentially cleaned up, resulting with $_SESSION variable discarded and affected authenticated users logged out. BOA default defined in the system level global.inc file is 86400 == 24h. # Changes in this release: * Drush: Upgrade command line version 6 to mini-6-26-04-2014 * Nginx: Use higher defaults for limit_conn to avoid error 503 (CloudFlare) * Nginx: Use more aggressive limits against spambots trying to rgstr accounts. * Redis: Integration module (the modern variant) upgrade to 7.x-2.x-o8-2.6-B # System upgrades in this release: * Nginx 1.7.0 * PHP 5.5.12 * Redis 2.8.9 # Fixes in this release: * Add symlinks in the home directory if missing (every 5 minutes). * Add warning that Compass Tools install and upgrade may take a LONG time. * Always define _PHP_CN variable properly. * Do not delete symlinks to wrappers to avoid false LFD alarms. * Fix for 'Force backward compatible SERVER_SOFTWARE'. * Fix in websh for _IN_PATH logic to not break backend Drush tasks. * Fix the logic for wrappers update and symlinks. * Improve status messages to display when silent mode is used on upgrade. * Improve whitelisting in the websh wrapper. * Issue #2238805 - Command filtering - no word containing *drush* is allowed. * Issue #2241495 - wkhtmltopdf stopped working after upgrade. * Issue #2247997 - Update docs/REMOTE.txt with workaround for websh issue. * Issue #2250397 - Always follow (limited) redirects in cURL requests. * Issue #GH-304 - [rvm] use $_RUBY_VERSION as default. * Issue #GH-305 - Check disk usage before running install/upgrade. * Issue #GH-306 - Allow ruby 1.8 to remain installed. * Nginx: Allow to configure keywords for aggressive requests rate monitoring. * Nginx: Do not overwrite custom symlinks to the Under Construction template. * Nginx: Sync FastCGI timeouts with other Nginx and PHP-FPM defaults. * PHP: Add /opt/local/bin/php tmp symlink on barracuda/octopus upgrade. * PHP: Allow to set custom _PHP_FPM_TIMEOUT but not lower than 60 (in seconds) * PHP: Always respect _PHP_FPM_WORKERS variable if set to numeric value > 0 * PHP: Better defaults for realpath_cache_ttl and realpath_cache_size. * PHP: Fix for CVE-2014-0185 privilege escalation in FPM (doesn't affect BOA) * PHP: pm.max_children was not properly updated on FPM version self-switch. * PHP: Sync incorrect default_socket_timeout with max_execution_time (180s). * PHP: Use 30s for pm.process_idle_timeout - it prevents too high RAM usage. * PHP: Variable _PROCESS_MAX_FPM is not used on the Satellite Instance level. * Postfix: Force re-install if broken permissions detected on upgrade. * Prevent duplicate cron invocations with more strict delays. * Restart rsyslog once the install or upgrade is complete. * Set the TERM env variable if missing to avoid errors. * Shell: Proper fix for wildcard in the path (cd command only) * Standardize install and upgrade for Chive, SQL Buddy and CGP. * Sync Redis timeout with default FPM timeout (180s). * Sync SQL connect_timeout with default mysql.connect_timeout in PHP (60s). * The ~/static/control must be writeable by lshell user to manage ctrl files. * Update the logic for multi-version PHP support in BOND. * Update the logic for multi-version PHP support in docs/REMOTE.txt ### Stable BOA-2.2.3 Release - Full Edition ### Date: Fri Apr 18 12:57:40 PDT 2014 ### Includes Ægir 2.x-boa-custom version. # Release Notes: This release includes several bug fixes and security upgrades both for the system services and Drupal core, along with three updated platforms and new features, including support for MariaDB 10.0 and Ubuntu 14.04 LTS Trusty. # Updated Octopus platforms: ### Drupal 7.27.1 Guardr 1.3 ------------------- https://drupal.org/project/guardr Open Atrium 2.17 ------------- https://drupal.org/project/openatrium Recruiter 1.2 ---------------- https://drupal.org/project/recruiter # New features and enhancements in this release: * Add docs/FAQ.txt * Add support for MariaDB 10.0 or 5.5 install via _DB_SERIES variable. * Add support for Ubuntu 14.04 LTS Trusty. * Improve auto-healing for multi-version PHP-FPM setup. * Improve docs/UPGRADE.txt * Improve health check for protected vhosts during live SSH-auth update. * Nginx: More aggressive limits against spambots trying to register accounts. # Changes in this release: * Issue #GH-299 - Force disable LESS developer mode on production sites. * Move custom scripts to /opt/local/bin/ * Nginx: Use higher defaults for limit_conn to avoid error 503 (CloudFlare) * Normalize localhost entry in /etc/hosts to avoid FQDN mapped to 127.0.0.1 * PHP: Do not use separate FPM pool for cron if _PHP_FPM_DENY is empty. # System upgrades in this release: * MariaDB 5.5.37 # Fixes in this release: * Add 'exit 0' line if missing. * Add /opt/local/bin to PATH by default. * Add symlinks for wrappers only temporarily. * Add warning that Compass Tools install and upgrade may take a LONG time. * Better gem uninstall options. * Compass: Multiple fixes for various expected gems versions install/upgrades. * Do not override lshell env_path in websh wrapper. * Do not use monitored bin path for custom scripts to avoid LFD false alarms. * Extra db GRANT for 127.0.0.1 not added when migrating site. * Improve auto-healing to create required directories in /var/run/ if missing. * Issue #2230269 - New Jetty 9 version overrides JETTY_PORT=8099 with 8080. * Issue #2235991 - Drush make needs better exceptions in websh wrapper. * Issue #2236475 - Clarify what the Legacy mode really means. * Issue #2238965 - Add missing path to switch_to_bash(). * Issue #2241013 - Git commands should be whitelisted in websh wrapper. * Issue #2241495 - wkhtmltopdf stopped working after upgrade. * Issue #GH-301 - Update the list of restricted keywords for Octopus username. * Issue #GH-304 - [rvm] use $_RUBY_VERSION as default. * Make sure that permissions on Chive Manager dir/files are correct. * Note: _SSL_FROM_SOURCES=YES is ignored and not needed on Wheezy and Precise. * PHP: Add /opt/local/bin/php tmp symlink on barracuda/octopus upgrade. * PHP: Allow to set custom _PHP_FPM_TIMEOUT but not lower than 60 (in seconds) * PHP: Always respect _PHP_FPM_WORKERS variable if set to numeric value > 0 * PHP: pm.max_children was not properly updated on FPM version self-switch. * PHP: Variable _PROCESS_MAX_FPM is not used on the Satellite Instance level. * Remove the line with header TABLE_NAME (sqlmagic). * Reset PATH to avoid RVM overrides after Compass Tools install/upgrade. * Shell: Allow to run 'drush cache-clear drush' in any directory. * The _PHP_MODERN_ONLY variable is no longer used. * Ubuntu 14.04 LTS Trusty requires MariaDB 10.0 * Use hostname -b instead of deprecated hostname -v. ### Stable BOA-2.2.2 Release - Barracuda Edition ### Date: Tue Apr 8 07:24:18 PDT 2014 ### Includes Ægir 2.x-boa-custom version. # Release Notes: This is a bug-fix only release to address issues discovered after recent major BOA-2.2.0 and subsequent BOA-2.2.1 Releases. The most important problem fixed in this Release is related to known OpenSSL security issue, which has been fixed in OpenSSL 1.0.1g To learn more please visit: http://heartbleed.com @=> Note for those on self-hosted BOA (skip this if you are on a hosted Ægir) We recommend that you enable _SSL_FROM_SOURCES=YES option in your system /root/.barracuda.cnf file, to always build latest OpenSSL from sources. Note that it will also trigger OpenSSH and cURL install from sources, plus subsequent PHP rebuild to include latest SSL libraries. Note that _SSL_FROM_SOURCES=YES will not force the build from sources on Debian Wheezy and Ubuntu Precise, to avoid confirmed conflicts and because both OS versions already provide custom, patched OpenSSL packages. This Release doesn't include any updates to the Octopus installer, so there is no point in running full upgrade. It is enough to run the barracuda only, system upgrade in the "silent mode" with: $ screen $ barracuda up-stable system The system will send you an email with results when the upgrade is complete, but there will be no upgrade progress displayed in the console. You can watch it, if you prefer, with command (DATE/TIME are placeholders for real values): $ tail -f /var/backups/reports/up/barracuda/DATE/barracuda-up-DATE-TIME.log # System upgrades in this release: * Nginx 1.5.13 * OpenSSL 1.0.1g (if installed from sources) * PHP 5.4.27 * PHP 5.5.11 # Fixes in this release: * Chive Authentication via SSH session may break Nginx due to race conditions. * Drush specific dt() wrapper is required in Provision for custom platforms. * Fix Compass Tools support for Omega (gems dependencies via bundle install). * Fix default shell for system level cron tasks. * Fix for csf firewall compatibility test. * Force better health check on protected vhosts on live SSH-auth update. * Improved health check for protected vhosts during live SSH-auth update. * Issue #2229555 - On fresh boa install link missing durring install. * Issue #2229715 - Tasks queue doesn't work on the Master Instance. * Issue #2231093 - Add new line before 'UseDNS no' in the sshd_config file. * Issue #2235991 - Drush make needs better exceptions in websh wrapper. * Issue #294 - New Relic ext not installed even if _NEWRELIC_KEY is not empty. * Nginx: Backup and re-create default wildcard SSL cert/key with rsa:4096 * Nginx: Generate 4096 bit long DH parameters when _NGINX_FORWARD_SECRECY=YES * Normalize localhost entry in /etc/hosts to avoid FQDN mapped to 127.0.0.1 * PHP: Better default workers limits for the ondemand mode. * PHP: max_input_time should be set to 180 and not 60, by default. * PHP: Zend OPcache directive opcache.enable=1 must be set in all ini files. * Reset PATH to avoid RVM overrides after Compass Tools install/upgrade. * The 'scp' command is broken in limited shell. * Too broad whitelisting breaks commands in limited shell with 'tmp' keyword. * Too restrictive open_basedir defaults break access to valid PEAR paths. * Too restrictive open_basedir defaults break access to valid Tika paths. * Use rsa:4096 by default in self-signed certs for Nginx and FTPS. ### Stable BOA-2.2.1 Release - Full Edition ### Date: Tue Apr 1 10:28:45 SGT 2014 ### Includes Ægir 2.x-boa-custom version. # Release Notes: This is a bug-fix only release to address issues discovered after recent major BOA-2.2.0 Release. # Fixes in this release: * Chive Authentication via SSH session doesn't work on some older instances. * Compass Tools don't use correct paths to Ruby 2.1.1 * Cron for sites doesn't work on old instances without Nginx wildcard vhost. * FTPS (FTP over SSL) connections may experience TLS problems. * PHP: Disabled 'assert' may cause warnings on features revert. * PHP: Disabled 'create_function' may break some contrib modules or code. * The 'git pull' command is broken in limited shell. * The 'rsync' command is broken in limited shell. * The 'drush dl foo' command can't be run outside of site directory. # Known Issues on systems upgraded to BOA-2.2.1 (and 2.2.0) releases ==> Updated on Tue Apr 8 01:26:47 PDT 2014 @=> Issues fixed in BOA head (running the hotfix in stable is enough): * Chive Authentication via SSH session may break Nginx due to race conditions. * Drush specific dt() wrapper is required in Provision for custom platforms. * Issue #2229715 - Tasks queue doesn't work on the Master Instance. * PHP: max_input_time should be set to 180 and not 60, by default. * The 'scp' command is broken in limited shell. * Too broad whitelisting breaks commands in limited shell with 'tmp' keyword. * Too restrictive open_basedir defaults break access to valid Tika paths. * Zend OPcache directive opcache.enable=1 must be set in all php.ini files. To fix all those problems you can run as root on self-hosted system: $ wget -q -U iCab http://files.aegir.cc/update/boa221fix.txt $ bash boa221fix.txt We have fixed this on all hosted and remotely managed Ægir instances already. @=> Other issues fixed in BOA head (run 'barracuda up-head system' to apply): * PHP: New Relic extension not installed even if _NEWRELIC_KEY is not empty. * Too restrictive open_basedir defaults break access to valid PEAR paths. ### Stable BOA-2.2.0 Release - Full Edition ### Date: Mon Mar 31 06:44:08 SGT 2014 ### Includes Ægir 2.x-boa-custom version. # Release Notes: There are many important changes and improvements in this release you should be aware of *before* running your BOA system upgrade. Even if you are on a hosted BOA system with upgrades managed for you, it is very important to read at least this extensive release notes. Here is a list of topics covered in detail further below: * New 'legacy' mode available for installs and upgrades * Important Note For Those Using Our Hosted Ægir Service! * Custom php.ini protection has changed and will not honor old settings * Barracuda no longer supports Percona since 2.2.0 release * Support for PHP FPM/CLI version safe switch per Octopus instance * All PHP FPM workers in 5.5, 5.4 and 5.3 now use the 'ondemand' mode * Drush aliases are now automatically copied to all relevant accounts * Drush is now restricted to use only trusted modules installed by default * The ~/.drush and other important directories and symlinks are protected * Support for safely configurable cache bins exceptions in Redis * Two-Factor-like Authentication to protect access to Chive DB Manager * Support for session.cookie_lifetime configurable via INI files * Support for files permissions-fix exceptions via platform level INI file * High-performance JavaScript callback handler (js) in all platforms And if you are more curious, read also the big changelog further below, which covers only a small number of over 560 commits since BOA-2.1.3 release. But what if you are not ready for this major upgrade and you would like to have more time for testing, but still be able to run system upgrades, thus effectively still using previous version 2.1.3 with standard command 'barracuda up-stable system', as explained in the docs/UPGRADE.txt? #-### New 'legacy' mode available for installs and upgrades We are introducing special 'legacy' mode both for BOA installs and upgrades. This means that starting with BOA-2.2.0 you can use commands like: $ boa in-legacy public server.mydomain.org my@email o1 $ barracuda up-legacy system $ octopus up-legacy o1 etc. These special 'legacy' commands allow you to install and/or upgrade the 'old stable', once the 'new stable' is released. But only until another 'stable' is released, of course. Thus you can use it only as an interim solution if you are not yet ready for latest 'stable' BOA Edition, for any reason, but you want to update at least the low level system packages, kernel etc. Note also that if you will upgrade to current 'stable', it is not possible to downgrade back to the 'old stable' with 'legacy' mode, so please proceed with care! This option will be particularly important once we release *next* major BOA Edition. It will come with terminated support for Drush 4, Drupal 5 and, yes, PHP 5.2 (finally). This step is required to use latest Drush 6+ with supported Drupal cores versions and supported PHP versions, which in fact is required to introduce the real Ægir 2.0 in BOA -- we are still using older, customized for backward compatibility, Ægir 2 HEAD version, so it is time to move on and stay up to date with everything, get new features like ability to manage Drupal sites in subdirectories etc. Once that *next* major BOA Edition is released, we will freeze the 'legacy' mode at 2.2.x series level, which will receive only security upgrades and no further feature nor bugfix releases. At that point you will have to stick to the 'legacy' BOA version if you will need to run PHP 5.2 and Drupal 5 with Ægir based on Drush 4. It will be still possible, but not recommended and not really supported, besides security related issues outside of Drupal. This also means that at that point the 'legacy' version will no longer receive Drupal core upgrades, even if there will be security core releases. Note that we don't use the term "major release" in the known convention for versions naming. It is because the first digit, for historical reasons, refers to the Ægir version supported, the second digit refers to BOA stack major release, and the last digit refers to both feature and bugfix BOA stack upgrades. #-### Important Note For Those Using Our Hosted Ægir Service! NOW is the time (and last chance) to upgrade all your legacy Drupal 5 sites and outdated Drupal 6 sites still not compatible with at least PHP 5.3, because once we upgrade to the *next* major BOA Edition, it will be no longer possible to still run Drupal sites not compatible with PHP 5.3 -- there were literally years of this legacy support provided, and this finally comes to the end, because we will not use the BOA 'legacy' mode on our own servers. It will be still available for remotely managed 'Ægir on Your Own Server' option, though, but only on request: https://omega8.cc/support #-### Custom php.ini protection has changed and will not honor old settings If you have custom settings in any of your php.ini files protected with old variable in the /root/.barracuda.cnf, make a backup of your ini files before running this upgrade. While these files will not get overwritten, they will no longer be used, because we have introduced new, standardized directory structure to properly support multi-PHP-versions systems. Respective php.ini files are now located in /opt/phpXX/etc/phpXX.ini for FPM and /opt/phpXX/lib/php.ini for CLI, where XX is 55, 54, 53 or 52, depending on the versions listed via _PHP_MULTI_INSTALL variable in the /root/.barracuda.cnf file. Also the variables used to protect ini files from being overwritten have changed to _CUSTOM_CONFIG_PHPXX. If you need any non-standard settings in any of active ini files, don't overwrite them with the old files, but rather carefully review and apply only the differences you need. #-### Barracuda no longer supports Percona since 2.2.0 release If you have used Percona before, Barracuda will force upgrade to MariaDB 5.5 and PHP rebuild automatically. We plan to add possibility to install MariaDB 10.0 once released as stable and tested. MariaDB is the default DB server in Barracuda for a long time already. #-### Support for PHP FPM/CLI version safe switch per Octopus instance This allows to easily switch PHP version by the instance owner w/o system admin (root) help. All you need to do is to create ~/static/control/fpm.info and ~/static/control/cli.info file with a single line telling the system which available PHP version should be used (if installed): 5.5 or 5.4 or 5.3 Only one of them can be set, but you can use separate versions for web access (fpm.info) and the Ægir backend (cli.info). The system will switch versions defined via these control files in 5 minutes or less. We use external control files and not any option in the Ægir interface to make sure you will never lock yourself by switching to version which may cause unexpected problems. Note that the same version will be used in all platforms and all sites hosted on the same Octopus instance. Why not to try latest and greatest PHP 5.5 now? #-### All PHP FPM workers in 5.5, 5.4 and 5.3 now use the 'ondemand' mode This change will help to better manage memory use, especially on systems with multiple PHP versions running in parallel. This will also free resources and allocate them dynamically only when requests are coming and only to the active FPM pools. Note that the 'ondemand' mode doesn't affect Zend OPcache, because it is managed by the parent process(es) which stay(s) active. The net result is that on a vanilla BOA install, without non-hostmaster sites running, the complete stack consumes just ~200 MB of RAM (in total, so with MariaDB, Redis and Nginx etc. included) with all three PHP-FPM versions running in parallel: 5.5, 5.4 and 5.3: CPU[#* 2.0%] Mem[|||||||||||||###***********************************209/1002MB] Swp[ 0/0MB] magic:~# ps axf | grep fpm 8380 ? Ss 0:00 php-fpm: master process (/opt/php55/etc/php55-fpm.conf) 8391 ? Ss 0:00 php-fpm: master process (/opt/php54/etc/php54-fpm.conf) 8402 ? Ss 0:00 php-fpm: master process (/opt/php53/etc/php53-fpm.conf) magic:~# #-### Drush aliases are now automatically copied to all relevant accounts While Ægir manages Drush aliases for its backend needs, they are normally not available for the main nor the extra shell users on the instance. But starting with 2.2.0, BOA automatically manages copies of all Drush aliases, by adding them, updating or removing, every 5 minutes, once it detects that there are changes applied, like: the site has been migrated to another platform, or associated client/owner has been updated, etc. You no longer need to `cd` to the respective site directory to perform some available Drush tasks. Just check the available aliases list with `drush aliases` and then enjoy the beauty of `drush @foo.com command` syntax. #-### Drush is now restricted to use only trusted modules installed by default Note: this change affects only Ægir backend/system user, typically o1, while all other limited shell accounts are not affected, because they are already individually jailed with protected custom php.ini and special Drush wrappers and settings. This means that you can skip this section if you are on a hosted Ægir. Customized Drush now included in BOA by default, will be able to use only extensions/commands bundled with contrib modules which are either a part of modules added in every platform via shared o_contrib/o_contrib_seven symlink located in the platform core modules directory, or are included in the built-in platforms installation profiles space, or in the system account, protected .drush sub-directory. This means that any Drush extension/command bundled with contrib module uploaded to the sites/all/modules space in all built-in platforms will be ignored and not available on command line for the backend user. The same applies to site level contrib space, if used. Additionally, any Drush extension/command bundled with custom platforms located in the ~/static directory tree will be completely ignored by Drush, no matter where uploaded: core, profiles, sites/all or sites/foo.com space. This is not a problem in hosted environments, where users normally never should have an access to the Ægir backend user, anyway. If you have any reason to use Drush on command line as an Ægir backend/system user, for example to escape limited shell restrictions, we recommend to install vanilla Drush 6, for example in /opt/tools/drush/vanilla/drush/ and then symlink it into /usr/local/bin/ with custom name, so it will be available automatically in your backend o1 user's PATH. Further improvements to secure sites and instances in a completely locked virtual jails are planned in next BOA releases, which will address all other known and even potential security issues in Ægir. #-### The ~/.drush and other important directories and symlinks are protected There are directories, files and symlinks which should be protected from any changes and managed exclusively by the BOA system. The reasons may vary from security to avoidable support requests when the less experienced user will delete his sites or platforms symlinks, while they can't be easily nor automatically recreated. It also prevents the sub-accounts users from using their account home directory as a private upload/archive disk space. #-### Support for safely configurable cache bins exceptions in Redis Sometimes you may want to exclude some problematic cache bins from Redis so they will use default SQL engine, at least until related issue will be fixed either in your contrib code or in the Redis integration module. Normally you had to edit the local.settings.php file which is both tedious and dangerous because of extra steps: https://omega8.cc/node/230 to add a line, for example: $conf['cache_class_cache_foo'] = 'DrupalDatabaseCache'; Plus, it had to be done for every site separately. Now you can simply list the cache bins to exclude, comma separated, either in the site or platform level active INI file. Example: redis_exclude_bins = "cache_views,cache_foo,cache_bar" #-### Two-Factor-like Authentication to protect access to Chive DB Manager We are introducing Two-Factor-like Authentication logic - now extended also to protect Chive DB Manager, Collectd Graph Panel and SQL Buddy DB Manager. You must be logged in via SSH and run any auto-continuos command, for example: `ping -i 30 google.com` to keep the access open for your IP address. Why is this important? While BOA forces HTTPS connection for Chive, anyone who knows the URL can access it and attempt to either run brute-force attack to get into your site's database, or at least attempt to hammer the server and cause DoS-like effects, at least until the system will block his IP on the firewall. The other important reason is that your site's DB credentials change only when you migrate or rename the site, and otherwise remain intact. Now, what if you have an employee or a freelancer whom you no longer want to be able to access your site? If you think that deleting his SFTP sub-account is enough, think again. He still can access your site's database via Chive, if he knows the site's DB credentials and the Chive URL. But now it's no longer possible. Only the visitor who is able to successfully authenticate himself via SSH, and keeps active SSH session, will be able to access the Chive URL. The rest of the world will see just dummy Nginx 403 Access Denied error. And in case you are using self-hosted BOA, the same protection is applied also to Collectd Graph Panel and SQL Buddy DB Manager. #-### Support for session.cookie_lifetime configurable via INI files You can control session cookies expiration (TTL) per site and per platform. The value (in seconds) of the session_cookie_ttl variable is used as session.cookie_lifetime value. BOA default defined in the system level global.inc file is 86400 == 24h. We also recommend that you enable and configure built-in session_expire module, which allows you to keep the sessions DB table tidy. Make sure that TTL set via session_cookie_ttl variable is *lower* than TTL configured in the session_expire module, because the module does not care about PHP settings and simply deletes old entries from the sessions table on cron run. #-### Support for files permissions-fix exceptions via platform level INI file You can opt-out from globally enabled daily-permissions-fix procedure per platform with new fix_files_permissions_daily variable. This feature can be useful when you prefer to manage custom platform in a monolithic codebase mode in Git, so forcing permissions could conflict with your workflow or development tools. Otherwise you should never disable this to avoid issues with Ægir tasks related to sites on this platform. Note that the system level option _PERMISSIONS_FIX (introduced in BOA-2.1.0 and set to NO by default) should be also enabled with YES in the system level /root/.barracuda.cnf file, if you prefer to have permissions fixed in all sites on all platforms, except those with fix_files_permissions_daily = FALSE set in the platform level, active INI file. #-### High-performance JavaScript callback handler (js) in all platforms All platforms, both built-in and custom in the ~/static directory tree, enjoy automatically added High-performance JavaScript callback handler (js) support, which requires extra /js.php file in the platform root and also proper Nginx rewrites. The module itself is also included in the built-in o_contrib bundle. All you need is to enable the module, if recommended by any other module, and enjoy much faster page generation, where possible. You can review the full list of modules which will benefit from this great helper module on its project page: https://drupal.org/project/js Enjoy another super-fast and even more powerful BOA Edition! # New Octopus platforms: ### Drupal 7.26.4 Guardr 1.1 ------------------- https://drupal.org/project/guardr # Updated Octopus platforms: ### Drupal 7.26.4 Commerce 1.24 ---------------- https://drupal.org/project/commerce_kickstart Commerce 2.13 ---------------- https://drupal.org/project/commerce_kickstart Commons 3.9.1 ---------------- https://drupal.org/project/commons Drupal 7.26.4 ---------------- https://drupal.org/drupal-7.26 Open Academy 1.0 ------------- https://drupal.org/project/openacademy Open Atrium 2.15 ------------- https://drupal.org/project/openatrium Open Deals 1.32 -------------- https://drupal.org/project/opendeals Open Outreach 1.5 ------------ https://drupal.org/project/openoutreach OpenBlog 1.0-a3 -------------- https://drupal.org/project/openblog OpenChurch 1.12 -------------- https://drupal.org/project/openchurch OpenScholar 3.12.1 ----------- http://theopenscholar.org Panopoly 1.2 ----------------- https://drupal.org/project/panopoly Recruiter 1.1.2 -------------- https://drupal.org/project/recruiter Spark 1.0-b1 ----------------- https://drupal.org/project/spark Totem 1.1.2 ------------------ https://drupal.org/project/totem Ubercart 3.6 ----------------- https://drupal.org/project/ubercart ### Pressflow 6.30.1 Commons 2.16 ----------------- https://drupal.org/project/commons Feature Server 1.2 ----------- http://bit.ly/fserver Managing News 1.2.4 ---------- https://drupal.org/project/managingnews Open Atrium 1.7.2 ------------ https://drupal.org/project/openatrium Pressflow 6.30.1 ------------- http://pressflow.org Ubercart 2.13 ---------------- https://drupal.org/project/ubercart # New features and enhancements in this release: * Add High-performance JavaScript callback handler (js) in all platforms. * Add session_expire module to shared contrib space in all platforms. * Add support for session.cookie_lifetime configurable via INI variable. * Allow to control swap clear with control file /root/.no.swap.clear.cnf * Auto-Update all BOA install and upgrade wrappers daily. * Default system /bin/sh symlink target replaced with /bin/websh wrapper. * Disable tcp_slow_start_after_idle for better SPDY performance. * Improve the logic in the global.inc for faster processing. * Issue #1217486 - Add o_contrib symlinks on platform Verify task. * Issue #1310054 - Add support for drush aliases in all lshell accounts. * Issue #2148335 - Add Default Localhost Vhost. * Issue #2166641 - Make hard-coded load thresholds configurable. * Issue #2170079 - Use _CUSTOM_CONFIG_LSHELL to protect lshell.conf template. * Issue #2226919 - Custom Platforms in Version Control (skip permissions fix). * Lshell: Update /etc/lshell.conf only when required instead of every 5 min. * Manage extra db GRANT for 127.0.0.1 to allow SSH tunneling for SQL access. * New option _REDIS_LISTEN_MODE to configure PORT or SOCKET mode globally. * Nginx: Add support for protected PHP-FPM monitor. * Nginx: Force aggressive no-cache headers for the under construction page. * Nginx: Switch to buffered logging when /root/.high_traffic.cnf exists. * PHP: Add support for FPM/CLI version safe switch per Octopus instance. * PHP: Allow to install and run all supported versions: 5.5, 5.4, 5.3, 5.2 * PHP: Extra php.ini files automatically managed per system and shell user. * PHP: FPM workers in 5.5, 5.4 and 5.3 will use 'ondemand' mode by default. * PHP: Use separate FPM pools per Octopus instance. * PHP: Use TCP Socket mode for all FPM pools and Port mode for legacy vhosts. * Protect ~/.drush and other important directories and symlinks from changes. * Redis: Allow to exclude cache bins on the fly, per site or per platform. * Save 295 seconds on BOA Install and Upgrade. * Set and auto-manage strict permissions on some important config files. * Set PHP CLI version in the /bin/websh wrapper on the fly. * Use Two-Factor-like Authentication logic for Chive DB Manager access. * Improve `sqlmagic fix file.sql` to properly replace INSERT INTO with INSERT IGNORE INTO (a workaround for duplicate keys in the DB dump) * Use the same trick with modules/local-allow.info to temporarily make civicrm.settings.php writable, if exists. # Changes in this release: * Add ~/static/trash/* to automatic daily cleanup. * Add coder to auto-disabled modules -- see #2068771 * Allow 'drush uli' as root, but deny root access to Drush by default. * Disable D8 install via _ALLOW_UNSUPPORTED until next release. * Do not enable SYNFLOOD protection by default. * Do not force old_short_name in any profile file directly. * Firewall: Allow to connect to Apple Push Notification service (APNs) * Issue #289 - Update lshell env_path for RVM and install/update global gems. * Issue #292 - Open standard RTMP port 1935. * Lshell: Use latest Drush 6 (master) by default and remove other versions. * Nginx and PHP-FPM: Better default timeout limits. * Nginx: Add apk, pxl, ipa to known mime types / download extensions. * Nginx: Use text/xml mime type for .xml URLs and restore other mime defaults. * Open local access for web based sites cron. * Open outgoing port 2525 for custom SMTP connections. * Percona DB server is no longer supported. * PHP: Always build from sources. * PHP: Disable 5.2 FPM if installed, but not used. * PHP: Only critical errors are enabled by default in the CLI mode. * PHP: Reloading FPM hourly no longer makes any sense. * PHP: Remove support for deprecated APC and Memcached. * PHP: Restore MailParse support - 2.1.6 * PHP: Use aggressive disable_functions defaults (further tuned per FPM pool). * Redis: Integration module (the modern variant) upgrade to 7.x-2.x-o8-2.6-A * Redis: Use modern version with enabled fast lock and aggressive flush mode. * Remove insecure exception for wkhtmltopdf uploaded in the user space. * Rename master repository on GitHub from legacy nginx-for-drupal to boa. * Set _STRICT_BIN_PERMISSIONS=YES by default. * Upgrade Compass Tools on every upgrade, not just on new BOA release. * Use 60s opcache.revalidate_freq by default to save disk I/O on live sites. * Use Ruby Version Manager (RVM) by default to manage Compass Tools etc. * Use RVM for global gem installation and updates. * Use search_api_solr-7.x-1.4 for new installs. * Use web based cron by default to benefit from Zend OPcache. * Do not check existence nor auto-config Purge/Expire unless INI variable purge_expire_auto_configuration is set to TRUE (automatically, when the module is detected as enabled). * New naming convention for Ubercart 3.x platforms: [ud2] to support upgrades from uberdrupal profile, and [aq3] to support upgrades from acquia profile. Note that you have to choose Vanilla Testing profile to see [ud2] or Vanilla Minimal to see [aq3] platform in the Add Site form. * GitHub is now our main repository, we re-open the issue queue there for patches merge requests, while d.o has a code mirror status from now on. * Make it crystal clear that Ubuntu is barely supported, rarely tested and thus not recommended. * The "Run cron" extra task has been removed for security reasons. Site cron can be run either via standard, scheduled in Ægir procedure, which uses local, but web based request to the protected /cron.php URL, or on command line, or from the site admin area, as usual. # System upgrades in this release: * Bazaar Version Control System (bzr) 2.6.0 * Collectd Graph Panel (CGP) master-30-03-2014 * cURL 7.36.0 (if installed from sources) * Git 1.9.1 (if installed from sources) * Jetty 7.6.14, 8.1.14, 9.1.3 * Limited Shell 0.9.16.5-om8 * MariaDB 5.5.36 * MySecureShell 1.32 * Nginx 1.5.12 * OpenSSH 6.6p1 (if installed from sources) * OpenSSL 1.0.1f (if installed from sources) * PHP 5.4.26 * PHP 5.5.10 * PHP: Imagick 3.1.2 * PHP: ionCube loader 4.5.3 * PHP: MongoDB 1.4.5 (optional add-on) * PHP: Zend OPcache master-09-03-2014 * PHPRedis: master-22-03-2014 * Redis 2.8.8 * Ruby 2.1.1 (from now on compiled from sources) # Fixes in this release: * Add fix_collectd_nginx for Collectd config update. * Add missing panopoly_demo app in the Panopoly distro to fix broken install. * Add missing variables to active INI files, if needed. * Avoid way too long Speed Booster TTL for bots, especially for rss feeds. * Changing old_short_name mapping to: uberdrupal->testing and acquia->minimal * Do not force old_short_name if already set in db/drushrc. * Do not run swap clean when heavy tasks like cdp backup run. * Drush: Simplify and improve access restrictions logic when aliases are used. * Excessive and useless Drush internal cache clear in daily.sh removed. * Fix default PATH in all sub-scripts. * Fix for broken cURL from sources install logic. * Fix for drush make broken by websh fix for cd wildcard crash fix. * Fix for multi-IP cron access. * Fix missing /dev/fd early enough to avoid broken tasks in Ægir. * Fix the logic in manage_ip_auth_access() * Fix to avoid daily services maintenance/cron freeze if Jetty didn't stop. * Force backward compatible SERVER_SOFTWARE to silence core warnings. * Force OpenSSH rebuild on OpenSSL upgrade (if installed from sources). * Issue #1317322 - Filters UI broken. * Issue #1991908 - Fix the syslog flood caused by collectd df plugin. * Issue #2057213 - Use better SQL GRANT style. * Issue #2110589 - Unable to install BOA correctly on Debian 6.0 and OpenVZ * Issue #2141283 - Drush aliases like `drush dbup` no longer work properly. * Issue #2144801 - Display bug on add site. * Issue #2144947 - Install new Ruby for better compatibility with new gems. * Issue #2150557 - Make the check and update procedure for UseDNS safe. * Issue #2152383 - Fix for [js module] - add js_server_software variable. * Issue #2159881 - Drush is broken because Console_Table URL no longer works. * Issue #2161115 - AdvAgg: Strictly follow RFC 2616 14.21 * Issue #2167141 - Do not exclude --with-ldap --with-gmp in the PHP on Wheezy. * Issue #2172089 - Fix for syntax error. * Issue #2173209 - Do not use legacy (removed) symlink for version check. * Issue #2175197 - Regex configuration not matching esi/ssi tags. * Issue #2177837 - process.max not set correctly for PHP 5.5 and 5.4 * Issue #2182671 - Solr 4 with Jetty 8 does not start after upgrade. * Issue #2188907 - Update docs criteria for not rebuilding ssh, ssl, and curl. * Issue #2199229 - CiviCRM 4.4.4 Requires change in the Nginx configuration. * Issue #288 - SMTP Authentication Module depends on fsockopen. * Lshell: Fix for crash on wildcard cd. * Lshell: Remove symlinks for legacy drush_make. * Modules can be incorrectly whitelisted from dis by installation profile. * Nginx: Add exceptions for known video players. * Nginx: Avoid downtime on upgrade because of too low variables_hash_max_size * Nginx: Better gzip defaults. * Nginx: Default value of variables_hash_max_size is too low. * Nginx: Do not overwrite gzip_types. * Nginx: Improve fastcgi defaults. * Nginx: Remove too broad regex for 'flag' keyword in the URI. * Nginx: Send Access-Control-Allow-Origin * header also for /favicon.ico * Nginx: Use port 9090 in nginx_octopus_include.conf by default (PHP-FPM 5.3) * Nginx: Use Redirect 301 for legacy paths /sites/default/files/* * Once you have next 2.3.x installed, you can't downgrade to legacy 2.2.x * PHP: Add protection for instance level php.ini files. * PHP: Fix for broken build when --with-ldap is used. * PHP: Fix for broken dependencies in newer Debian and Ubuntu systems. * PHP: Fix for forced rebuild mode if lib curl is broken or updated with apt. * PHP: Fix for GEOS 3.4.2 and multi-version install. * PHP: Fix for legacy 5.2 logic. * PHP: Force 5.5 to use correct SQL drivers so its built-in will not be used. * PHP: Reduce duplicate rebuilds. * PHP: The --with-curlwrappers option has been removed in 5.5 * Redis: Auto-Restart if socket is missing only when socket mode is enabled. * Redis: Exclude cache_form bin or it will break modules like ajax_comments. * Redis: Force clean restart daily, with long enough sleep time. * Redis: Restore pwd protection. * Redis: The cache_metatag bin needs aggressive flush mode -- see #2062379 * Reduce system load during db backups with short delays between databases. * Remove collectd on major system upgrade even if /var/www/cgp doesn't exist. * Silence AIS (Adaptive Image Styles) module .htaccess requirements. * Sort and group cnf variables to bring some order into this chaos. * Symlink main drush wrapper to shared location outside of Master Instance. * Update for Redis bins exceptions logic. * Update system load check method in all scripts. * Use forced Jetty restart mode. * Use https in the welcome screen image src URL. * Use IPv4-strict hostname and IP checks only. # Known Issues on systems upgraded to BOA-2.2.0 release (all fixed) ==> Updated on Tue Apr 1 12:20:27 SGT 2014 @=> Issues hot-fixed in stable (run 'barracuda up-stable system' to apply): * Compass Tools don't use correct paths to Ruby 2.1.1 * Chive Authentication via SSH session doesn't work on some older instances. * PHP: Disabled 'create_function' may break some contrib modules or code. * PHP: Disabled 'assert' may cause warnings on features revert. * Cron for sites doesn't work on old instances without Nginx wildcard vhost. * The 'git pull' command is broken in limited shell. * FTPS (FTP over SSL) connections may experience TLS problems. * The 'rsync' command is broken in limited shell. * The drush dl foo can't be run outside of site directory. ### Stable BOA-2.1.3 Release - Full Edition ### Date: Thu Nov 21 17:55:47 SGT 2013 ### Includes Ægir 2.x-boa-custom version. # Release Notes: This release provides Drupal 7.24.1 and Pressflow 6.29.1 core security upgrade for all supported distributions. It also includes two updated platforms and several fixes for issues discovered since BOA-2.1.2 released 3 days ago, plus some clever improvements to help you automatically optimize all tables daily, or even automatically convert tables to-innodb or to-myisam, either per site or per platform, or per entire Octopus instance. There is also Purge Cruft Machine available to run some spring-cleaning daily with configurable TTL. Enjoy another super-fast and even more clever BOA Edition! # Updated Octopus platforms: ### Drupal 7.24.1 Open Atrium 2.0.9 ------------ http://drupal.org/project/openatrium OpenScholar 3.9.3 ------------ http://openscholar.harvard.edu # New features and enhancements in this release: * Purge Cruft Machine moved to daily.sh agent and made configurable with _DEL_OLD_BACKUPS and _DEL_OLD_TMP per Octopus instance. If changed to any number greater than "0" it will automatically delete backups stored in the /data/disk/U/backups/ directory and in all hosted sites backup_migrate directories, during daily cleanup, if created more than X days ago, where X is a number of days defined in _DEL_OLD_BACKUPS. If "0" then this feature is disabled. It can't be configured via INI files, so you may need to submit support request if you want to customize this option set to 7 days by default on all hosted instances, as per our backups policy: https://omega8.cc/backups The same logic applies to _DEL_OLD_TMP which defines for how long the temporary files in all hosted sites files/tmp/ and private/temp/ directories are kept before deleting them during running daily maintenance. * Added sql_conversion_mode variable in the platform and site level INI to customize instance-wide mode optionally set via _SQL_CONVERT. This option allows to activate and/or customize DB tables conversion per site, per platform and via _SQL_CONVERT per Octopus instance. Supported values are: innodb and myisam (lowercase only!) Note that this conversion will run daily even if all tables have been already converted, so it will run OPTIMIZE on all tables, effectively. Related Issue #2126471 - Convert DB engine control files to ini format. # Changes in this release: * Allow to install unsupported distros only in head, not stable. * Contrib update: advagg-7.x-2.3 * Map drush to drush6 on command line. You can still use drush4 and drush5. * New contrib: display_cache * New contrib: panels_content_cache * Nginx 1.5.7 -- security upgrade. * Use dev versions of CDN module with patch for AdvAgg 7 compatibility. * Use Drush 5 and 6 head until next release. # Fixes in this release: * Always cleanup temp downloads to avoid failed builds due to leftovers. * Always fix permissions on contrib on upgrade and in daily.sh agent. * Better auto-recovery when broken libcurl is detected. * Delete any tar/gz/zip files in modules|themes|libraries daily. * Delete dangerous local-allow.info file. * Display all active INI variables in HTTP headers on dev URLs. * Fix for cron auto-correction. * Fix for Feature Server broken due to incorrect context version downloaded. * Fix the logic for cURL install from sources. * Nginx: Add Access-Control-Allow-Origin header also for static .json * Nginx: Protect also .md files in modules|themes|libraries dirs. * Issue #2137583 - Permissions on the site directory are broken after running, how ironically, the Health Check task. * Issue #2138811 - Maintenance agent disables modules from its standard turn-off list, even if they are required by other modules, apps or features. # Known Issues on systems upgraded to initial BOA-2.1.3 release ==> Updated on Thu Nov 28 18:33:58 SGT 2013. @=> Issues which will trigger `barracuda up-stable system` if discovered: * PHP: Fix for broken cURL from sources install logic. * PHP: Fix for forced rebuild mode if lib curl is broken or updated. * PHP: Fix for legacy 5.2 rebuild required when broken libcurl is detected. * Use dummy variable instead of 'true' to avoid breaking the logic. @=> Issues which will NOT trigger `barracuda up-stable system` if discovered: * Add coder to the auto-disabled modules list -- see #2068771 * Excessive and useless Drush internal cache clear in daily.sh * Issue #2141283 - Drush aliases like `drush dbup` no longer work properly. * Issue #8215957 - Invalid version type error in old Drush Make. * MariaDB 5.5.34 just released. * Redis: Incorrect permissions on the integration module directory. * Modules can be incorrectly whitelisted by installation profile and never disabled, while they should be. # HotFix for known post-upgrade issues Run the boa-fix-upgrade script when logged in as system root: $ cd;rm -f boa-fix-upgrade.sh.txt* $ wget -q -U iCab http://files.aegir.cc/update/boa-fix-upgrade.sh.txt $ bash boa-fix-upgrade.sh.txt This script is updated once there is any new regression or bug discovered, so it is safe and recommended to run it again if the list of known issues have been updated. Note that this script will detect and fix all Octopus instances on your system at once. ### Stable BOA-2.1.2 Release - Full Edition ### Date: Mon Nov 18 00:03:30 SGT 2013 ### Includes Ægir 2.x-boa-custom version. # Release Notes: This is primarily a bug-fix release and you should read release notes and also the changelog for both BOA-2.1.1 and BOA-2.1.0 for a context, especially if you are upgrading from BOA-2.0.9 or older release (we have tested upgrades from as old Editions as BOA-2.0.1, released on Dec 28 07:00:00 EST 2011). This Edition includes fixes for all Known Issues on systems already upgraded to initial BOA-2.1.1 release, plus some extra improvements and one updated platform (Managing News). Important new features include ability to use either legacy (default) or modern (highly recommended) version of Redis integration module. The reason we don't enable the modern version by default is that it may need some testing before using it on a complex Drupal sites. The modern version of Redis integration module comes with some great new features which allow you to configure flush mode per cache bin, with three modes available. Please refer to the module README for more information on all available advanced flush modes: http://bit.ly/1drmi35 It also comes with super-fast lock backend, which can be enabled only when you are using the modern version, but still needs more improvements, so we auto-configure some exceptions on the fly, when it is used, to avoid known issues, as reported in the queue: https://drupal.org/node/2135545 Please read also INI docs to understand how it works, and how to improve performance by enabling and tuning these settings: http://bit.ly/1bwfZZj Enjoy! # Updated Octopus platforms: ### Pressflow 6.28.3 Managing News 1.2.4 ---------- http://drupal.org/project/managingnews # New features and enhancements in this release: * Redis: Modern integration module 7.x-2.5 with latest fixes from #2135545 is available as an option with new INI variable: redis_use_modern * Redis: New option redis_flush_forced_mode to better control flush modes when redis_use_modern = TRUE * Add example for custom Speed Booster cache TTL configuration in the optional override.global.inc file. It can be used also in local.settings.php file. * Add detection and auto-config for the allow_private_file_downloads variable. * Issue #1978066 - Add _RESERVED_RAM variable for "reserved" memory. * Map all old_short_name profiles relations in the Ægir Provision directly. # Updated Ægir modules or extensions: * Newer aegir_custom_settings 6.x-2.3 with site clone added for client role. * Newer registry_rebuild 7.x-2.1 with fixed critical bug - see: #2130905 # Changes in this release: * Auto-Disable views_cache_bully also when Ubercart is enabled. * Do not delete testing profile, we need it for acquia->testing upgrade path. * Do not map old_short_name on the Octopus level, it is moved to Provision. * Make ACTIVE INI files comments-free to never confuse them with templates. * Make the fix for known Feeds problem global, not just ManagingNews specific. * PHP: 5.4.22 and 5.5.6 as an option (for testing only). * PHP: Use latest (master) phpredis_new by default. * Redis: Default integration module version reverted to pre-7.x-2.0 release. * Redis: Force rebuild on system upgrade to update also Redis config. * Redis: Make redis_lock_enable available only when redis_use_modern = TRUE * Set opcache.revalidate_freq to 5 sec only on non-dev URLs by default. * Switch Ubercart 3 to use D7 Minimal instead if Standard to fix upgrade path. * Update prev release notes to explain importance of using latest Pressflow 6. # Fixes in this release: * Always fix permissions on contrib on upgrade and in daily.sh agent. * Avoid files checks for Drupal for Facebook and Domain Access by default. * Better auto-recovery when broken libcurl is detected. * Fix for cron auto-correction. * Fix for post-upgrade permissions issues affecting modules|themes|libraries. * Fix for too restrictive permissions in /data/all/000/* * Fix regression in the logic for dev URLs detection and auto-configuration. * Fix the forced contrib upgrade logic. * Fix the logic for cURL install from sources. * Improve procs monitoring agent with better whitelisting. * Improve sanitize_string() filtering to avoid issues with strong passwords. * Issue #1860706 - Native, unified support also for D6 lock backend. * Issue #2023895 - Do not kill java, only jetty and tomcat procs when needed. * Issue #2105477 - Allowed gem commands need custom aliases in lshell. * Issue #2134329 - Going from 2.0.9 to 2.1.1 does not update platforms. * Issue #2135545 - Lock Backend freezes the site on cache clear. * Issue #2136413 - Use -H to force correct HOME environment variable. * Issue #2136413 - Use sudo to avoid lshell protection in DB auto-conversion. * Make sure that /usr/local/bin is in the PATH. * Make the check_if_required test in daily.sh six (6) times faster. * Nginx: Fix too restrictive access policy for Ægir specific /hosting URI. * Redis: Add some debugging on dev URLs to make sure permissions are correct. * Redis: Added prefix support for lock backend. * Redis: Disable persistent mode to never use on-disk storage, see #2135545 * Redis: Do not enable tcp-keepalive or weird things may happen, see #2135545 * Redis: Exclude some bins to avoid issues with lock support, see #2135545 * Redis: Missing default values on variable_get() calls causing D6 break. * Redis: Update docs and naming convention for modern integration module. * Silence cURL test in meta-installers. * Sync randpass with sanitize_string(). * Set less restrictive permissions on civicrm.settings.php since provision_civicrm does not make the file writable temporarily as it should. # Known Issues on systems upgraded to initial BOA-2.1.2 release ==> Updated on Thu Nov 21 01:28:23 SGT 2013 with all fixes applied to stable. * Feature Server platform is broken since BOA-2.1.0 due to incorrect context module version downloaded via makefile. This bug affects only some instances upgraded to head and not stable, but since in the first 24 hours after BOA-2.1.2 release our static downloads were still out of sync on two of our mirrors, it is safe to assume that you should run the HotFix via boa-fix-upgrade.sh.txt anyway. * There is regression introduced in the maintenance agent logic, which results with dependency check effectively ignored. This may cause various disastrous effects, like disabling all modules chained via feature or via apps module, because apps module requires update module, which is normally disabled. While any feature which requires dblog or update module enabled is considered as a serious developer error and should be avoided, we have to respect all dependencies defined to never break any site by forcefully disabling modules. * Part of the Site Health Check task (the `drush6 status-report` command) breaks permissions on the site directory, which blocks any further tasks like Clone, Migrate and Backup. This regression was introduced in the BOA-2.1.0 release. # HotFix for known post-upgrade issues Run the boa-fix-upgrade script when logged in as system root: $ cd;rm -f boa-fix-upgrade.sh.txt* $ wget -q -U iCab http://files.aegir.cc/update/boa-fix-upgrade.sh.txt $ bash boa-fix-upgrade.sh.txt This script is updated once there is any new regression or bug discovered, so it is safe and recommended to run it again if the list of known issues have been updated. Note that this script will detect and fix all Octopus instances on your system at once. ### Stable BOA-2.1.1 Release - Full Edition ### Date: Sat Nov 9 17:00:00 EST 2013 ### Includes Ægir 2.x-boa-custom version. # Release Notes: There are some important bug fixes in this release, along with changes to the Auto-(En|Dis)able agent, explained in greater detail in embedded docs included in platform specific INI file template. Note that the system agent doesn't modify any existing and active INI file, so updated docs are included only in the updated each morning INI templates: default.boa_platform_control.ini and default.boa_site_control.ini You can find both INI templates also online at: https://omega8.cc/node/293 We have also added some docs to help you if you experience any issues with cached, Views based pages and panels: https://omega8.cc/node/292 Note also that since BOA-2.1.0 all D6 based sites are forced to use PHP 5.3.27 on hosted and managed Ægir instances, even if they were previously configured to use deprecated, insecure, unstable and outdated PHP 5.2 for D6 based sites. This means that if you are using either too old D6 core (older than 6.28.x) some features will stop working, namely imagecache, /update.php and any feature which depends on contrib modules not yet compatible with PHP 5.3 We have allowed to use PHP 5.2 for too long, to give enough time (in years) to upgrade to latest Pressflow 6.x version and we no longer can extend this allowance, for obvious security and systems stability reasons. Furthermore, sticking with PHP 5.2 would not allow us to use latest Ægir 2.x version (BOA still includes a bit older Ægir 2.x for backward compatibility), since newer Ægir versions need newer Drush (BOA still uses ancient Drush 4.6) and newer Drush requires newer PHP version. It is even more important because Drupal 8 will not run on older PHP nor Drush older than 7.x, so there is basically no choice other than make all your sites compatible with PHP 5.3, or you will miss all future BOA system upgrades. Now even PHP 5.3 is officially in the EOL (End-of-Live) phase, with only security fixes expected, but also only until July 2014 and then it will be completely deprecated, so we will have to switch to modern PHP 5.5, first introduced as an option, later this year. Upgrading to latest Pressflow 6.x is *very* easy. Just add all contrib modules you are using in your outdated 6.x platform to the latest Pressflow 6.x platform we provide by default, reverify the new platform, clone the site in the old platform, migrate the cloned copy to the new platform and if everything works fine, migrate also your live site. It will take less than 15 minutes and there is absolutely no excuse to not upgrade. If you experience issues with your site due to the old core used on now forced PHP 5.3, we can temporarily revert it to PHP 5.2 for the last time, but it is really a bad idea. Much better idea is to find those 15 minutes and upgrade your site, so we could continue to provide future upgrades and new amazing features also for your Ægir instance. Enjoy new, shiny BOA Edition! # Updated Octopus platforms: ### Drupal 7.23.3 Open Atrium 2.0.4 ------------ http://drupal.org/project/openatrium Open Deals 1.31 -------------- http://drupal.org/project/opendeals OpenBlog 1.0-a3 -------------- http://drupal.org/project/openblog Recruiter 1.1.2 -------------- http://drupal.org/project/recruiter Spark 1.0-a10 ---------------- http://drupal.org/project/spark Totem 1.1.2 ------------------ http://drupal.org/project/totem ### Pressflow 6.28.3 Commons 2.13.2 --------------- http://drupal.org/project/commons Open Atrium 1.7.2 ------------ http://drupal.org/project/openatrium # New features and enhancements in this release: * Document all system-level control files in docs/ctrl/system.ctrl * Fast Redis lock implementation is now enabled by default for D6 and D7. * Nginx: Add NAXSI (Nginx Anti XSS & SQL Injection) WAF as an option. * Use 100% static downloads in stable to remove dependency on github and d.o * Use extended connection check procedure before exit 1. * Use reliable Redis UP check via PING/PONG instead of pid file check. # Updated o_contrib modules: * Contrib update: httprl-6.x-1.13 * Contrib update: httprl-7.x-1.13 * Contrib update: redis-7.x-2.3 * Contrib update: views_cache_bully-6.x-3.x * Contrib update: views_cache_bully-7.x-3.x * Contrib update: views_content_cache-7.x-3.0-alpha3 # Changes in this release: * Introducing Pressflow 6.28.3 to include fix for #2130865 * Updated INI docs for views_cache_bully and views_content_cache. * ProsePoint moved to unsupported. * Private files mode in D7 requires allow_private_file_downloads = TRUE in boa_site_control.ini or boa_platform_control.ini and is disabled by default. * Do not enable views_cache_bully and views_content_cache, unless special control files exist and related variables in the platform specific INI are not set to TRUE. * Auto-Disable views_cache_bully on sites with commerce module enabled, but allow to override it with ~/static/control/enable_views_cache_bully.info and views_cache_bully_dont_enable = FALSE # Fixes in this release: * All-in-One Site Health Check in Ægir not displayed for non-uid=1 users. * Always prepare shared D6 and D7 cores. * Always remove www. from the Redis cache key prefix. * Better check for not yet updated Octopus instances in a batch upgrade mode. * Check if ctools is enabled before attempting to enable views_content_cache. * Do not force HEAD on Precise. * Fix for /root/.upstart.cnf consistency. * Fix for PATH in aegir.sh * Fix still too aggressive procs monitoring. * Fix the check_if_required() logic in the Auto-Disable agent. * Improve all cURL based downloads with auto-continue mode. * Issue #1980250 - Fix for broken cache_page bin in Redis integration module. * Issue #2127237 - New Relic: Unable to initialize module on Debian Wheezy. * Issue #2128233 - Rsyslog is still installed and consumes all CPU on OpenVZ. * Issue #2128819 - Better exceptions in too aggressive process monitoring. * Make sure to never set any HTTP headers or redirects in the backend. * Nginx: Do not use separate location for /images/ URI shortcut. * Nginx: Fix for regression in "Rewrite for legacy requests with /index.php". * Nginx: Fix the logic for restricted access to /authorize.php and /update.php * Nginx: Map URI shortcuts early to avoid overrides in other locations. * Remove rsyslog on VZ, if installed. * Restore backward compatibility with IP and not wildcard based vhosts. * Use silent upgrade mode in _LENNY_TO_SQUEEZE and _SQUEEZE_TO_WHEEZY. * Issue #2127329 - AdvAgg (D6 version) presence in o_contrib should not auto-disable standard aggregation, unless the module is enabled. # Known Issues on systems upgraded to initial BOA-2.1.1 release ==> Updated on Tue Nov 12 14:44:16 EST 2013 with all fixes applied to stable. * Fast Redis lock may cause problems on node edit, with temporary error saying that the node was changed by "another user", because current implementation was not multisite-aware enough. * Views Cache Bully module, if enabled after upgrade to BOA-2.1.0, may break the cart and checkout on sites using Ubercart, and should be disabled automatically like it is done for Commerce based sites since BOA-2.1.1 * The version of Redis integration module included: 7.x-2.3 causes warnings for D6 sites, visible either on dev URLs or on command line and may break some advanced Views configurations if custom caching is not yet enabled. It may also break menu updates due to not aggressive enough cache clear policy for cache_menu bin. * Permissions set daily on the civicrm.settings.php file are too restrictive and since provision_civicrm extension does not make this file writable before attempting to re-create it, as it should, all tasks on CiviCRM enabled sites fail. * Permissions on sites/all/{modules,theme,libraries} on newly added, empty platforms with no sites created yet, so not included in the running daily permissions fix, are initially not group writable, as they should be. * The check_if_required procedure in the running daily maintenance agent to detect if the module is required by any other module or feature or by installation profile, is 6 (six) slower than it should be and never disables devel module properly. * The running daily maintenance agent does not disable files checks for Drupal for Facebook (fb) and Domain Access modules as it should in the platform level INI file, unless those modules are detected. # HotFix for known post-upgrade issues Run the boa-fix-upgrade script when logged in as system root: $ cd;rm -f boa-fix-upgrade.sh.txt* $ wget -q -U iCab http://files.aegir.cc/update/boa-fix-upgrade.sh.txt $ bash boa-fix-upgrade.sh.txt This script is updated once there is any new regression or bug discovered, so it is safe and recommended to run it again if the list of known issues have been updated. You can also run another upgrade with "barracuda up-stable system" command, followed by "octopus up-stable all both log" since all fixes have been applied to current stable as well, but boa-fix-upgrade script is faster than running complete upgrade again. ### Stable BOA-2.1.0 Release - Full Edition - Now NSA-proof ### Date: Sat Nov 2 18:15:19 EDT 2013 ### Includes Ægir 2.x-boa-custom version. # Release Notes: There are some really important changes and improvements in this release you should be aware of before running your BOA system upgrade. Even if you are on a hosted BOA system with upgrades managed for you, it is very important to read at least this release notes. And if you are more curious, read also the giant changelog further below. Besides all changes, fixes and improvements, all currently supported Drupal distributions have been upgraded to use latest Drupal core versions. Plus, there are seven (7) NEW platforms included! #-### Control files to customize your BOA system per platform and per site Almost all control files are now replaced with two centralized, platform and site specific INI files, using standard PHP INI format. The platform specific INI file template with extensive documentation included, has filename default.boa_platform_control.ini and is located in the sites/all/modules directory. The site specific INI file template with extensive documentation included, has filename default.boa_site_control.ini and is located in the sites/foo.com/modules directory. Any existing control files, both on the platform and site level will be automatically converted into active INI files and then deleted to avoid confusion, also automatically, on the first run of the special maintenance script: /var/xdrago/daily.sh but defaults in the global.inc file will allow for smooth, fully automated transition. This change will improve customizing your BOA system maintainability and overall system performance/load thanks to minimized files checks. #-### Empty and not used platforms auto-cleanup BOA has finally the ability to auto-delete, during daily maintenance, which happens each morning (server time zone), all empty and not used platforms. While on all hosted instances the TTL (time-to-live) is set to 60 days (counted since last verify task date/time on the platform), it can be configured per instance in the /root/.USER.octopus.cnf file by changing value of _DEL_OLD_EMPTY_PLATFORMS variable to anything higher than 0 (days), which is default (and means the feature is OFF). Note that every Octopus instance upgrade re-verifies all existing platforms, so if you will configure the TTL to 90 days but you will run the upgrade every month or every two months, no platforms will ever be deleted. If you wish to have this TTL customized on the hosted instance, where it is set to 60 (days) by default, please open a support ticket via: https://omega8.cc/support Remotely managed BOA systems can have this feature enabled and configured upon request submitted via https://omega8.cc/support #-### All-in-One Site Health Check in your Ægir control panel You will notice a new Task available on every site page in your Ægir Control Panel, named "Run health check". This new task will run a few important tests on your site and will store all results in the Task Log, so you easily review all results by clicking on the "View" button to the right of the task, when it is complete. Make sure to check all details by clicking on the "Expand" links in the log. What are the tests included? 1. The "drush clean-modules" command will be run for you to make sure there is no module left in the system table as "enabled" while it no longer even exists on the system. This part will utilize (behind the scenes) extension: https://drupal.org/project/clean_missing_modules If it will find any such leftover, it will clean it up, automatically. 2. The "drush6 pm-updatestatus" command is a native Drush command which tells you if there are any waiting module/code updates in the site. Note: it will *not* upgrade anything, it is a check only. Of course there should be no updates waiting if you follow Ægir site upgrade best practices and your site's code is up to date. Yes, this check will automatically enable the "update" module for you, but it will not auto-disable it afterwards (to not break things in case it is required by some other module or feature). 3. The "drush6 status-report" command is a native Drush command which provides you a complete overview of your site status. Instead of logging into the site, you can review it easily here. 4. The "drush6 updatedb-status" command is a native Drush command which tells you if there are any waiting database updates in the site. Note: it will *not* apply these updates, it is a check only. Of course there should be no updates waiting if you follow Ægir site upgrade best practices, but who knows, hence the check. 5. The "drush security-review" command will run only on Drupal 7 based sites and provides some additional information by using (behind the scenes) this extension: https://drupal.org/project/security_review #-### PFS (Perfect Forward Secrecy) support in Nginx BOA now fully supports the most secure, yet still compatible with most used systems and browsers SSL configuration. All hosted BOA instances have been already upgraded automatically and you don't need to do anything to make it work -- it is already done for you -- both on any SSL enabled site with dedicated certificate and IP address and also on the standard, system-wide SSL proxy level, which is available for every hosted site -- just type HTTPS:// in the URL. On self-hosted instances it needs to be enabled by adding a line in your /root/.barracuda.cnf file: _NGINX_FORWARD_SECRECY=YES before the upgrade. Note that depending on the system used, it may auto-install some requirements like latest OpenSSL libraries and packages. Remotely managed BOA systems can have this feature enabled upon request submitted via https://omega8.cc/support #-### SPDY (new networking protocol) support in Nginx BOA now fully supports the advanced, new protocol which allows to run sites over HTTPS with much better performance than plain HTTP. While not all browsers support this protocol yet, it is already enabled by default on all hosted BOA instances (but obviously works only when you access the site via HTTPS:// in the URL). On self-hosted instances it needs to be enabled by adding a line in your /root/.barracuda.cnf file: _NGINX_SPDY=YES before the upgrade. Note that depending on the system used, it may auto-install some requirements like latest OpenSSL libraries and packages. Remotely managed BOA systems can have this feature enabled upon request submitted via https://omega8.cc/support #-### Zend OPcache replaced APC in PHP Newer versions of PHP already come with next generation opcode cache from Zend, which is now open-sourced and available also as an extension for older PHP versions, including 5.2 and 5.3 BOA leverages this opportunity and now uses Zend OPcache instead of APC. This change is introduced automatically on all systems, both hosted and managed for you and also self-hosted. Only Debian Squeeze and Ubuntu Precise systems which are using PHP installed from packages and not from sources, so with _BUILD_FROM_SRC=NO set in the /root/.barracuda.cnf file, still use APC by default. You can install Zend OPcache by changing it to _BUILD_FROM_SRC=YES before running the upgrade. Note that Zend OPcache default configuration caches every script for 60 seconds, so any changes you will introduce, will be visible with up to 1 minute delay. However, if there is .dev. or .devel. in the site name, this delay is lowered automatically to just 1 second. You can change the default per site permanently by adding in the local.settings.php preferred value, for example, to set it to 10 seconds: ini_set('opcache.revalidate_freq', '10'); -- but remember that you will override default (1 second) for dev URLs using this method. Enjoy the most advanced, NSA-proof BOA Edition yet! # New Octopus platforms: ### Drupal 7.23.3 Open Academy 1.0-rc3 --------- http://drupal.org/project/openacademy Open Atrium 2.0 -------------- http://drupal.org/project/openatrium OpenBlog 1.0-a2 -------------- http://drupal.org/project/openblog OpenScholar 3.8.1 ------------ http://openscholar.harvard.edu Recruiter 1.1 ---------------- http://drupal.org/project/recruiter Spark 1.0-a9 ----------------- http://drupal.org/project/spark Totem 1.1 -------------------- http://drupal.org/project/totem # Updated Octopus platforms: ### Drupal 7.23.3 Commerce 1.20 ---------------- http://drupal.org/project/commerce_kickstart Commerce 2.9 ----------------- http://drupal.org/project/commerce_kickstart Commons 3.4 ------------------ http://drupal.org/project/commons Conference 1.0-a2 ------------ http://drupal.org/project/cod Drupal 7.23.3 ---------------- http://drupal.org/drupal-7.23 Open Deals 1.27 -------------- http://drupal.org/project/opendeals Open Outreach 1.2 ------------ http://drupal.org/project/openoutreach OpenChurch 1.11-b14 ---------- http://drupal.org/project/openchurch Panopoly 1.0-rc5 ------------- http://drupal.org/project/panopoly Ubercart 3.5.1 --------------- http://drupal.org/project/ubercart ### Pressflow 6.28.2 Commons 2.13 ----------------- http://drupal.org/project/commons Feature Server 1.2 ----------- http://bit.ly/fserver Managing News 1.2.3 ---------- http://drupal.org/project/managingnews Open Atrium 1.7.1 ------------ http://drupal.org/project/openatrium Pressflow 6.28.2 ------------- http://pressflow.org ProsePoint 0.46 -------------- http://prosepoint.org Ubercart 2.12.1 -------------- http://drupal.org/project/ubercart # New features and enhancements in this release: * Add a workaround for an edge case problem -- a missing /etc/resolv.conf * Add auto-config for AdvAgg on both Drupal 7 and Drupal 6. * Add command to check for available updates: `drushextra check updates` * Add gems for Omega 4 by default. * Add sass-globbing gem by default. * Allow to install latest OpenSSH from sources with _SSH_FROM_SOURCES * Allow to install latest OpenSSL from sources with _SSL_FROM_SOURCES * Anonymize lshell intro message. * Better code sharing with central core dirs for all built-in platforms. * BOA installer wrapper depends on curl instead of wget. * Do not stop/start cron if /root/.upstart.cnf control file exists. * Drush: Add embedded how-to for aliased commands. * Enable views_cache_bully and views_content_cache if views is enabled. * Firewall: Disable incoming ping/ICMP. * Firewall: Protect port 80 only with CONNLIMIT and remove it from PORTFLOOD. * Firewall: Update config template and enable port/syn flood protection * FTP: Allow to list/see up to 3000 files/subdirs in a directory. * Improve daily.sh performance. * Improve dist-upgrade procedure. * Improve docs/MODULES.txt * Improve meta-installers auto-update procedures. * Improve SQL limits auto-configuration. * Install pdnsd as a last service. * Issue #2000932 - Add also zen-grids. * Issue #2015553 - Fix the logic for protected registration of new accounts. * Issue #2044589 - SPDY Nginx support. * Issue #2052703 - Conversion from control files to ini includes. * Issue #2092599 - Switch to disable MySQL password reset on upgrades. * Issue #2105477 - Add support for bundler gem. * Issue #2116387 - Nginx and PHP: Improve system hardening. * Issue #2116395 - Nginx: Better protection and 404 instead of 403. * Issue #2118393 - Mark drush/cron as newrelic_background_job * Make Bazaar installation optional with BZR keyword required in _XTRAS_LIST * Nginx: Use forced HTTPS-only access for Chive and SQL Buddy. * PHP: Add experimental support for 5.4 and 5.5 * PHP: Install Zend OPcache instead of deprecated APC by default. * PHP: Reload FPM hourly unless /root/.high_traffic.cnf exists. * Restart db server when backup is complete if /root/.my.optimize.cnf exists. * Restore support for Expire and Purge modules. * Shell: Add gunzip to allowed commands. * Shell: Disable mc on the fly unless /root/.allow.mc.cnf control file exists. * Shell: Use MySecureShell 1.31 for SFTP by default. * Try to download wrapper 4 times before it gives up. * Use MySQLTuner to better tune SQL configuration on install and upgrade. * Use sqlmagic to fix errors caused by duplicate keys in the db dump. * Use standard D7 profile for Ubercart 3 and update related contrib. * We no longer depend on drupal.org for any downloads. * Add optional, configurable per site, automated and smart (via sqlmagic tool) DB table format/engine conversion, enabled per instance with non-default _SQL_CONVERT=YES option. * Add support for _MODULES_SKIP variable and make the auto-disable agent much smarter to never disable any module defined as required by any other module or feature. * Improve auto-recovery from manual permissions/ownership big mistakes related to critical files and dirs. * Issue #2067193 - PFS (Perfect Forward Secrecy) support in Nginx with _NGINX_FORWARD_SECRECY=YES config option. * Use _DEL_OLD_EMPTY_PLATFORMS to enable and define auto-cleanup for old, empty platforms with no sites hosted, separately per Satellite instance (it does not affect Master instance). * Issue #2000932 - Add more Compass tools/extensions: (compass_radix, zurb-foundation) and make sure the gems are updated on upgrade. * Nginx: Add support for domain specific /robots.txt mapped to static files/$host.robots.txt to make it possible to manage it per domain also when Domain Access module is used. * Improve the logic for daily permissions fix (no longer enabled by default) and make it configurable via _PERMISSIONS_FIX variable. * Improve the logic for daily modules fix (still enabled by default) and make it configurable via _MODULES_FIX variable. * Generate static sites/foo.com/files/robots.txt file per site, which is mapped to /robots.txt # New and updated Ægir modules or extensions: * Add security_review extension * Use registry_rebuild 7.x-2.x # New o_contrib modules: * Add Advagg 6 and 7 to all platforms. * Add force_password_change to all platforms. * Add views_cache_bully to all platforms. # Changes in this release: * All D6 based sites are forced to use latest PHP 5.3.27 version. * Chive 1.3 * cURL 7.33.0 as an option. * Drush 5.10.0 and 6.1.0 (available as drush5 and drush6) * Git 1.8.4.1 * Lshell 0.9.16.4-om8 * MariaDB 5.5.33a * Nginx 1.5.6 * Nginx: ngx_cache_purge-2.1 * OpenSSH 6.3p1 as an option. * Percona 5.5.33 * PHP 5.4.21 and 5.5.5 as an option. * Redis 2.6.16 * Vnstat 1.11 * Deprecate CiviCRM as a separate platform. * Remove obsolete MartPlug distro. * Move OpenPublish to unsupported. * Move NodeStream to unsupported. * Do not include D6 core translations, never included also in D7 platforms. * Do not include notoriously buggy backup_migrate module. # Fixes in this release: * Add all extra, non-standard options in the barracuda.cnf docs template. * Add built-in support for Domain Access also for sites/all/modules/contrib * Add exception to support commerce_multicurrency module properly. * Add info about self-signed SSL certificate in the welcome email (again). * Add support for /usr/etc/sshd_config if exists. * Always force update_newrelic - even if there is no new PHP version. * Better check for GitHub partial downtime. * Better logic for clean resolvconf re-install when needed. * Contrib: Make the list readable. * Delete too old pid files if any exists. * Do not allow to break working DNS cache server with parent system overrides. * Do not allow to install OpenSSL and cURL from sources also on Precise. * Do not install rsyslog on VZ based VM. * Do not set session.cookie_secure on SSL requests for sites < D7 * Enable dev mode also when HTTP_HOST begins with dev. * Firewall: Adjust some defaults to improve flood protection, * Firewall: Always upgrade, unless _CUSTOM_CONFIG_CSF is set to YES. * Firewall: Better support for auto-whitelisting multi-IP systems. * Firewall: Fix csf.uidignore file to whitelist important system uids. * Firewall: Fix for csf template on VZ. * Firewall: Improve some flood protection defaults. * Firewall: Improve whitelisted IPs msg. * Firewall: Remove deprecated monitoring for now closed port 25 (incoming). * Firewall: Update config template. * Firewall: VZ compatibility. * Fix for /etc/resolv.conf and curl requirement in the BOA Meta Installer. * Fix for cron tasks queue. * Fix for forced pdnsd and resolvconf upgrades. * Fix for incorrect nproc discovery results on some VM systems. * Fix for proper handling mysql connections leftovers. * Fix for selected packages hold status. * Fix for the auto-update logic -- now it is default. * Fix permissions for control files to avoid leftovers on delete task. * Fix permissions on default backup_migrate dirs. * Fix the auto-healing to avoid killing all php-fpm processes at midnight. * Fix the automatic generation of static robots.txt file per site. * Fix the daily enable/disable logic and use faster drush version. * Fix the logic for chained installs from sources on upgrade. * Fix the makefiles to avoid issues after d.o upgrade. * Fix the not really working auto-healing to properly restart mysqld. * Fix the not really working lshell logs monitor. * Force clean pdnsd and resolvconf reinstall when needed. * Force contrib update to include redis module stable release. * Force cURL and OpenSSH re-install from sources when OpenSSL is from src. * Force Git rebuild from sources if SSL/cURL was built from sources. * Force Lshell rebuild when OpenSSL is installed from sources. * Force MSS and FTP rebuild when OpenSSL is installed from sources. * Force Nginx, PHP and Pure-FTPd re-install when OpenSSL is from sources. * Force PHP-FPM restart if 9+ connections with 499 in the last 60 seconds. * Generate 2048 bit long DH parameters when _NGINX_FORWARD_SECRECY=YES * IDS monitor should use lower defaults after introducing last min checks. * Improve gem and bundler allowed/denied restrictions. * Improve procs monitoring and whitelist backend tasks properly. * Improvements for Ubercart 2 installation + contrib updates. * Install latest CGP, collectd 5 compatible. * Issue #1751916 - Add Spark 1.0-a9 * Issue #1874786 - Fix for GNU Mailutils support. * Issue #1991312 - Fix support and auto-config for AdvAgg 7 and HTTPRL. * Issue #1991658 - Firewall: Close port 25 for incoming connections * Issue #1994346 - DoS protection for not cached URLs doesn't respect $scheme * Issue #1994346 - Fix the logic for SSESS/SESS prefix in the cookie name. * Issue #1995342 - X-Accel-Expires is never send when $expire_in_seconds == 0 * Issue #2002678 - barracuda up-stable system adds annoying extra delay. * Issue #2005116 - 403 on every attempt to log in from Hostmaster homepage. * Issue #2015551 - Fix for broken dev mode support switch. * Issue #2015551 - Fix the keyword check used to trigger "dev" mode. * Issue #2020043 - Send PUT requests for *.json URI to Drupal. * Issue #2032379 - _AUTOPILOT=YES should be forced also for "silent" modes. * Issue #2083373 - drush dl foo --destination=/path/ should be restricted. * Issue #2101193 - Support Drupal for Facebook from sites/all/modules/contrib * Issue #2105259 - All Platforms Installation Fails with Permission Denied. * Issue #2116177 - Use phpredis 2.2.4 * Lshell: Better settings for newer Drush versions. * Lshell: Fix for env_path * Lshell: version update and monitoring improvements. * Make sure o_contrib is updated also on head-to-head upgrades. * Make sure to rebuild PHP if cURL is installed from sources. * Make the upgrade email generic. * More compact code for downloads. * Move csf/lfd corrections after pdnsd install. * Move the giant modules list from README.txt to docs/MODULES.txt * Nginx: Add access protection for .txt files in the modules|themes|libraries. * Nginx: Add access protection with fast 404 also for authorize.php * Nginx: Add access protection with fast 404 for extra .php known URLs. * Nginx: Add example site specific config for legacy .php URIs 301 redirects. * Nginx: Better support for static and dynamic .json requests/URIs * Nginx: Deny spiders on glossary/* URI, as they are never allowed to crawl. * Nginx: Fix for dynamically generated PDFs. * Nginx: Fix for redirects for legacy URLs with asp/aspx extension. * Nginx: Improve auto-whitelisting in the access log monitor. * Nginx: Improve POST requests monitoring. * Nginx: Move AJAX and webform requests location after civicrm location. * Nginx: Normalize newlines and spacing when fixing proxy config files. * Nginx: Remove 'results' from the bots-protected URI regex. * Nginx: Remove deprecated conf.d directory, if exists. * Nginx: Replace legacy keyword gulag with neutral limreq everywhere. * Nginx: Replace the zone legacy name also in Provision. * Nginx: Rewrite legacy requests with /index.php to extension-free URL. * Nginx: The /admin* URI protection logic has been moved to global.inc * Nginx: Update gzip_types to list all expected mime.types * Nginx: Update headers for AdvAgg compatibility. * Nginx: Update mime.types * Nginx: Use more precise wildcard in paths for replacements. * PHP: 5.4 requires uploadprogress-1.0.3.1 * PHP: Disable ionCube Loader for PHP 5.5 * PHP: Do not force extensions re-install unless _PHP_FORCE_REINSTALL=YES * PHP: Fix config overrides for 5.4 and 5.5 * PHP: Fix possible issues with legacy 5.2 support logic. * PHP: Fix unintended overrides in the ini files. * PHP: Force All Extensions Rebuild when _FROM_SOURCES=NO * PHP: Force APC instead of Zend OPcache on Squeeze/Precise on no-src install. * PHP: Force legacy version rebuild if exists. * PHP: Improve rebuild logic if SSL/cURL was built from sources. * PHP: Make sure that latest version of ionCube loader is installed. * PHP: Rebuild extensions also for 5.2, even if _PHP_MODERN_ONLY=YES * PHP: Set opcache.revalidate_freq to 1 second on dev alias/URL on the fly. * PHP: Start more FPM workers by default to avoid Nginx 499 and timeouts. * PHP: Use correct version of ioncube_loader for 5.4 * PHP: Use pecl-jsmin-0.1.1 with newer PHP versions. * PHP: Zend OPcache is a zend_extension and needs full path in the php.ini * Redis: Make redis_client_password optional and none by default. * Reload PHP-FPM before auto-healing will force its restart after midnight. * Remove already deprecated platforms. * Remove insecure files from libraries/plupload/examples. * Remove lock files before adding new users. * Security updates for selected contrib on all affected D7 platforms. * Shell: Fix FTPS compatibility after switching to MySecureShell * Shell: Sync IdleTimeOut for MSS with SSH and FTPS default 15m. * Shorten some too long status messages. * Silent Mode Option: aegir == Only stock Ægir forced up-head upgrade. * Simplify vnstat setup. * Split usage monitor into two separate scripts. * SQL auto-healing should always stop-stop-start and not just restart it. * SQL: Allow the engine to manage correct innodb_thread_concurrency value. * SSH: Make sure that 'UseDNS no' is always set. * Sync $cookie_domain validation with Drupal 7 core. * Sync dates with BOA defaults. * Unify apt-get options order. * Update for Redis config template. * Update or create /etc/apt/sources.list early enough. * Update PHP and SQL config early enough to avoid issues during upgrade. * Use --force-yes option if apt-get -y is used. * Use correct version of /etc/apt/preferences * Use drush6 only when required. * Use extended GitHub tests on HEAD and non-stock build only. * Use forced symlinks mode if possible. * Use is_readable() check instead of file_exists() for all includes. * Use mirror downloads for all contrib and patches to make it faster. * Use more restrictive permissions on lshell log files. ### Stable BOA-2.0.9 Release - Barracuda Edition ### Date: Thu May 9 11:25:59 EDT 2013 ### Includes Ægir from BOA-2.0.8 Edition # This is the first Barracuda-only Edition, released to address important security issue with Nginx server and provide system level upgrades. This Edition will not upgrade Ægir Master nor Ægir Satellite Instances, because there was no new Drupal core released since BOA-2.0.8 Edition and there were not enough updates to built-in platforms or contrib accumulated. Releasing Barracuda-only Edition separately from full Edition allows us to address system/services security issues without any extra delay, while releasing Octopus-only Edition will allow us to provide Drupal core or Ægir version upgrades, without affecting system level services. There is also another reason why separate releases will be useful. BOA-2.0.9 is the last Edition where Ægir 2.x still uses old Drush 4.6 in the backend. We need to sync BOA specific Ægir 2.x with upstream and finally switch to Drush 5, or even Drush 6, if possible. This change, however, may cause issues if you still host legacy Drupal 5 or some old Drupal 6 sites, with either core or contrib not compatible with PHP 5.3, which is now used by default. That is why we plan to introduce ability to install older/previous Barracuda and/or Octopus release, if you need more time to upgrade. # New features and enhancements in this release: * Debian 7.0 Wheezy support. * Automated upgrade from Squeeze with _SQUEEZE_TO_WHEEZY=YES option. * Added config template with inline how-to in docs/cnf/barracuda.cnf * Added config template with inline how-to in docs/cnf/octopus.cnf * Added passwords encryption how-to in docs/BLOWFISH.txt * Added the list of symbols used on install in docs/PLATFORMS.txt * Forced mysql restart if there are too many high CPU mysqld processes. * Improved docs/NOTES.txt * Improved docs/README.txt * Install libpam-unix2 and libxcrypt1 by default. * Install s3cmd by default. * Issue #1974640 - Allow to use Midnight Commander for limited shell users. * Limited Shell Logs Monitor enabled by default. * Nginx: Check for Linux/Cdorked.A malware and delete if discovered. * Re-generate and sync Ægir passwords before and after instance upgrade. * The silent 'system' mode documented in docs/UPGRADE.txt * Allow to exclude platform from otherwise forced `drush en entitycache -y` if sites/all/modules/entitycache_dont_enable.info control file is present. # Changes in this release: * Nginx 1.5.0 - security upgrade for CVE-2013-2028 * PHP 5.3.25 * Redis 2.6.13 * Do not disable update module in platforms known to include it as required. * Firewall: Open port 1129 for outgoing connections (some gateways need it). * Force syslog module as disabled by default and save some disk I/O. * Tune kernel to always use max RAM and not swap, if possible. # Fixes in this release: * Add outgoing port 25 SMTP to the list of requirements. * Firewall: Add truly permanent block for heavy abusers. * Fix for mytop support, available again on systems with MariaDB. * Fix permissions in the /data/all tree if required. * Fix the order of checks - they scan only the last (current) minute. * Force _STRONG_PASSWORDS=NO if locales still look broken on second check. * Improve detecting no longer running drush.php and/or cron PHP processes. * Improve fix_locales logic. * Improve global.inc symlinking on initial install and upgrade. * Improve messages displayed when fix_locales discovers broken locales. * Improve monitoring to avoid duplicate entries on low traffic systems. * Improve sanitize_string() filtering to avoid issues with strong passwords. * Improve syncpass tool - Update system user passwd and flush privileges. * Issue #1961226 - Warning: Could not change permissions of sites/all to 751. * Issue #1962458 - 403 for anonymous users on node/add. * Issue #1963044 - Force UTF-8 locales if not present/configured properly. * Issue #1974542 - Use /root/.home.no.wildcard.chmod.cnf control file. * Issue #1987936 - Restore ability to install PHP 5.2 for FPM and CLI. * Make sure that /dev/null is writable for everyone. * Make sure that all drushrc.php files are owned by Ægir system user. * Make sure that all expected sites/all/{modules,themes,libraries} dirs exist. * Make sure that DB server is restarted on upgrade after config tuning. * Make sure that pdnsd and resolvconf are properly installed. * Nginx: Remove duplicate Vary: Accept-Encoding headers. * Percona no longer supports older Ubuntu non-LTS releases. * PHP: Do not reload FPM every hour - it may cause error 502. * PHP: Fix paths depending on CLI version used. * PHP: Fix the extensions installation and upgrade logic. * PHP: Make sure that the FPM port is set correctly for D6 sites with 5.2 * PHP: Properly uninstall all related packages when using source build. * PHP: Start more FPM workers on systems with enough RAM by default. * Purge bin logs before disabling them. * Run New Relic re-install early enough to avoid locking full-upgrade. * Sync the load limits for spiders and backend tasks. * The Java/Jetty monitor should use higher allowed limits by default. * Update apticron message to recommend system mode instead of full upgrade. * Update docs for _BUILD_FROM_SRC option. * Use aggressive enough Jetty restart procedure on nightly services reload. * Use correct status messages on install and upgrade. * Use installer and not Ægir version download on stable install/upgrade. ### Stable Edition BOA-2.0.8 ### Date: Mon Apr 8 01:41:36 CEST 2013 ### Installs Ægir 2.x # Updated Octopus platforms: ### Drupal 7.22.1 Commerce 2.6 ----------------- http://drupal.org/project/commerce_kickstart NodeStream 2.0-rc5 ----------- http://drupal.org/project/nodestream Open Deals 1.19 -------------- http://drupal.org/project/opendeals All other not listed above platforms are available with latest D6 or D7 core, even if there were no new distro version released. # Fixes: * Critical Issue #1962690 - Fix for broken Percona support. * Allow to use [a-z0-9] subdomains and not only [www] for IDN domain names. * Change the interval between platforms builds from 5 to 3 seconds. * Forced 1s Speed Booster TTL for vhosts behind local proxy is deprecated. * Move old firewall logs to backups to avoid crazy load after upgrade. * Nginx: Better exceptions handling in the Abuse Guard for js/shs modules. * PHP: CLI is at 5.3 since BOA-2.0.4, so symlink old 5.2 binary path to 5.3 * Update _LENNY_TO_SQUEEZE major upgrade procedure. * Update contrib with login_security-7.x-1.2 * Use static downloads for all distros in stable edition. ### Stable Edition BOA-2.0.7 ### Date: Thu Apr 4 00:00:17 EDT 2013 ### Installs Ægir 2.x # Updated Octopus platforms: ### Drupal 7.22.1 Commons 3.2 ------------------ http://drupal.org/project/commons All other not listed above platforms are available with latest D6 or D7 core, even if there were no new distro version released. # Fixes: * Create dot dirs and keys if not exist, plus known_hosts for system user. * Fix the sqlmagic regex to really convert only expected tables. * Issue #1958502 - Add missing symlinks to the new Drush extensions. * Issue #1960192 - Fix literal path replacement with sites/$new_url in D7. * Issues #1930670 #1958898 #1932616 - Fix for hosting_server_update_6200. * Taxonomy Edge update to 7.x-1.7 and 6.x-1.7 * Update contrib in all D7 platforms to ctools-7.x-1.3 - security upgrade. ### Stable Edition BOA-2.0.6 ### Date: Mon Apr 1 21:34:04 EDT 2013 ### Installs Ægir 2.x # New Octopus platforms: ### Drupal 7 Commons 3.1 ------------------ http://drupal.org/project/commons # Updated Octopus platforms: ### Drupal 7 CiviCRM 4.2.8 ---------------- http://civicrm.org Commerce 1.16 ---------------- http://drupal.org/project/commerce_kickstart Commerce 2.5 ----------------- http://drupal.org/project/commerce_kickstart Drupal 7.21.2 ---------------- http://drupal.org/drupal-7.21 NodeStream 2.0-rc4 ----------- http://drupal.org/project/nodestream Open Deals 1.18 -------------- http://drupal.org/project/opendeals Open Outreach 1.0-rc10 ------- http://drupal.org/project/openoutreach OpenChurch 1.11-beta9 -------- http://drupal.org/project/openchurch Panopoly 1.0-rc4a ------------ http://drupal.org/project/panopoly Ubercart 3.4.1 --------------- http://drupal.org/project/ubercart ### Pressflow 6 Acquia 6.28.1 ---------------- http://bit.ly/acquiadrupal Commons 2.12 ----------------- http://drupal.org/project/commons Feature Server 1.2 ----------- http://bit.ly/fserver Managing News 1.2.3 ---------- http://drupal.org/project/managingnews Open Atrium 1.7.1 ------------ http://drupal.org/project/openatrium Pressflow 6.28.1 ------------- http://pressflow.org ProsePoint 0.46 -------------- http://prosepoint.org Ubercart 2.11.1 -------------- http://drupal.org/project/ubercart All other not listed above platforms are available with latest D6 or D7 core, even if there were no new distro version released. # No longer supported Octopus platforms: The platforms listed below can be re-added when their maintainers will fix all critical issues and/or apply required updates: ELMS ------------------------- http://drupal.org/project/elms MartPlug --------------------- http://drupal.org/project/martplug Octopus Video ---------------- http://octopusvideo.org Open Academy ----------------- http://drupal.org/project/openacademy Open Enterprise -------------- http://drupal.org/project/openenterprise OpenPublic ------------------- http://drupal.org/project/openpublic OpenScholar ------------------ http://openscholar.harvard.edu Videola ---------------------- http://videola.tv # New features: * Add an option to allow cron based, unattended system-only upgrades. * Add randpass helper script. * Add support for wkhtmltoimage. * Add syncpass tool to repair broken instances after incomplete upgrade. * Allow to specify extra apt-get packages with _EXTRA_PACKAGES option. * Allow to tune PHP-CLI timeout in the BOND script with separate option. * Install auditd with aureport by default. * Issue #1479300 - Add optional LDAP support in Nginx. * Issue #1876418 - Support for High-performance JavaScript callback handler. * Issue #1916804 - Validated bypass of flood control based on tty. * Jetty: Make migration from Tomcat easy with _TOMCAT_TO_JETTY=YES * PHP: Allow to use _PHP_EXTRA_CONF for custom builds from src. * Redis: Add Lock Backend Support for Drupal 6 and Drupal 7. * Redis: Enable lock support if modules/redis_lock_enable.info exists. * Shell: Add extra Drush versions available as drush4, drush5 and drush6. * SOLR: Support for 1.x / Jetty 7, 3.x / Jetty 8 and 4.x / Jetty 9. * SOLR: Use Jetty 8 for Solr 4 on systems with Java 1.6 available. * SOLR: Use Jetty 9 for Solr 4 on systems with Java 1.7 available. * SQL: Add sqlmagic tool to fix SQL dumps and convert to/from InnoDB/MyISAM. * SQL: Make default_storage_engine configurable with _DB_ENGINE option. * Use Registry Rebuild with Fixed Redis Lock Support aware configuration. * Allow to force SERVER_NAME based $cookie_domain with special modules/cookie_domain.info control file per site. # New Ægir modules or extensions: * Add drush clean-modules command - clean_missing_modules extension. * Add drush_ecl extension - Drush Entity Cache Loader. * Add hosting_site_backup and provision_site_backup enabled by default. # Changes: * Git 1.8.2 * MariaDB 5.5.30 * Nginx 1.3.15 * Percona 5.5.30 * PHP 5.3.23 * Redis 2.6.12 * Deprecate CiviCRM 3.4.8 D6 - only available with _ALLOW_UNSUPPORTED=YES. * Do not force filefield_nginx_progress as enabled also for D7. * Drupal 8.0-dev-tested deprecated and moved to unsupported group. * ELMS 1.0-beta1 deprecated and moved to unsupported group. * Enable entitycache module by default. * Master Ægir: Re-create secure db password on every barracuda upgrade. * Master Ægir: Sync generating secure db password also on barracuda install. * Nginx: Set 24h Speed Booster cache TTL for spiders/bots by default. * NodeStream 1.5.1 deprecated and moved to unsupported group. * Open default MongoDB port 27017 for outgoing connections. * OpenScholar deprecated and moved to unsupported group. * PHP: Deprecate 5.2 also on upgrade. * PHP: Install MongoDB driver if MNG keyword is listed in _XTRAS_LIST. * PHP: Set _PHP_CLI_VERSION=5.3 by default. * PHP: Switch to forced CLI 5.3 and FPM 5.3 also in the custom config. * PHP: Switch to FPM 5.3 also for D6 sites by default. * Pressflow 5.23 deprecated and moved to unsupported group. * Redis: Re-create secure password on every barracuda upgrade. * Satellite Ægir: Re-create secure db password on every octopus upgrade. * SQL: Do not run DB OPTIMIZE unless /root/.my.optimize.cnf ctrl file exists. * SQL: Re-generate new secure mysql root password on every barracuda upgrade. * SQL: Use key_buffer = 2M by default. * SQL: Use more safe memory limits after introducing higher key_buffer_size * Use better names for various control files. * Watch crons running > 2 min and kill crons running > 3 min. * Split _XTRAS_LIST into two groups: included via ALL keyword and other which need to be listed explicitly. # Fixes: * Add Ksplice-aware kernel upgrade alert. * Add some delay to avoid race conditions when removing more zombies. * Allow higher system load before disabling access for spiders temporarily. * Always send upgrade log when running in the silent mode. * Avoid cron collisions and make sure all maintenance tasks run 0-6 AM. * Better and separate backup rotation on hostmaster upgrade. * Better check if Webmin GnuPG signing key has been added properly. * Better fix for $cookie_domain and DA compatibility. * Better protection for all ports usually targeted in brute force attacks. * Check if nproc is present and fall back to /proc/cpuinfo otherwise. * Clean swap on kernel tuning update. * Delete broken o_contrib symlinks before trying to recreate them. * Do not add and remove bind from /etc/sudoers since it is not supported. * Do not block @ in the limited shell - it breaks git foo git@bar etc. * Do not force _DEBUG_MODE=YES if not required. * Do not force _HTTP_WILDCARD=NO for stock install option. * Do not run extra IP checks for requests below $mininumber threshold. * Do not run initial apticron check in local install. * Do not run two mysql restarts in a row on mysql upgrade. * Downgrade to working wkhtmltopdf-0.10.0_rc2 and wkhtmltoimage-0.10.0_rc2 * Drupal 7.x core with Field API memory optimization - see #1915646 * Enable image_allow_insecure_derivatives to avoid issues with drupal-7.20 * Fix apticron to suggest barracuda up-stable instead of apt-get upgrades. * Fix AWS system auto-discovery and auto-configuration. * Fix Drush 5.x and _USE_STOCK support. * Fix for Bazaar (bzr) 2.6b2 extensions build. * Fix for pdnsd install on Ubuntu Precise. * Fix the 32 long ALNUM password generation for lshell users. * Fix the hint to just display the uptrack command, not run it. * Force logrotate on demand if /var/log/syslog > 1GB * Force mysql tables check and upgrade before hostmaster upgrade. * Force proper pdnsd and resolvconf re-installation if needed. * Force proper resolvconf configuration to support and use pdnsd server. * FTPS on all modern systems requires lshell path added in /etc/shells. * Hostmaster/Octopus contrib modules are now added via Ægir makefile. * Improve autonomous IDS auto-cleaning and permanent block mgmt. * Improve compatibility testing with Drush 5 and Drush 6. * Improve kernel default tuning. * Improve Master Instance upgrade logic. * Improve mysqldump performance by default. * Improve the default strict configuration for $cookie_domain. * Improve Tomcat/Jetty self-healing to avoid stuck processes. * Install also hostmaster contrib when stock option is used. * Issue #1782034 - Use fixed version of the message_notify module. * Issue #1825018 - Disable binary logging and make it optional. * Issue #1871060 - CiviCRM 4.2.6 needs separate civicrml10n fix. * Issue #1873478 - Localhost install broken because getent test is used. * Issue #1875348 - Fix for Nginx 1.3.10 bug causing random segfaults. * Issue #1886920 - Fix the unrecognized option [service=system-auth] error. * Issue #1886920 - Pure-FTPd config broken because of deprecated pam_stack.so * Issue #1888380 - Deleted platform cache folder recreated automatically. * Issue #1889322 - Domain Access module breaks sites provisioning. * Issue #1897018 - Set Pin-Priority also in wrappers to fix also stable. * Issue #1897018 - Ubuntu Precise breaks install and upgrade. * Issue #1906760 - Incomplete access_log directive in the purge vhost. * Issue #1906900 - Nginx microcaching not disabled on prefixed admin URIs. * Issue #1909208 - Changed MariaDB GnuPG signing key hangs install/upgrade. * Issue #1913394 - Disable automatic CSF/LFD upgrade. * Issue #1913488 - Do not install GEOS PHP ext. unless explicitly listed. * Issue #1914294 - APC 3.1.14 disappeared from PECL - downgrade to 3.1.13 * Issue #1918722 - Add diff command as allowed in the limited shell. * Issue #1920972 - Could not change permissions warnings on site verify. * Issue #1932388 - Use correct keyword PPY for Panopoly install. * Issue #1935388 - Use reliable check for Master Instance install path. * Issue #1947082 - Permissions are never fixed on the profile level. * Issue #1949740 - Make sure that cache_prefix for Redis is always set. * Issue #1952042 - Make strong passwords optional and not default. * Issue #1953248 - Extra Drush versions should be added properly. * Issue #1957762 - Upgrade to Bazaar (bzr) 2.6b2 * Jetty: Tune memory limits automatically to avoid extra RAM requirements. * Keep all extra modules in the same profiles/hostmaster/modules directory. * Lshell: Allow ping command to help keep session active / auto-whitelist. * Make apticron aware of the BOA version currently running. * Make BOND aware of _CUSTOM_CONFIG_SQL if present. * Make Compass Tools available in the standard path, if installed. * Make sure that all removed zombies use unique dir names. * Make sure that all users home dirs are protected. * Make sure that now redundant hosting_backup_gc module is removed. * Make sure that SERVER_NAME is set to HTTP_HOST early enough, if required. * Make the errors monitor aware of system only upgrade mode. * Make URI filtering regex localization-aware in the global.inc * Nginx Security: BEAST attack protection and fix for PCI compliance. * Nginx: Another fix for broken imagecache paths in some imported sites. * Nginx: Better protection from DoS attempts on never cached uri. * Nginx: Do not block spiders on imagecache/styles URIs. * Nginx: Do not force use epoll - it is set on install properly. * Nginx: Do not force worker_connections. It will not work in the VM guest. * Nginx: Do not force worker_rlimit_nofile. It will not work in the VM guest. * Nginx: Force rebuild to include LDAP support if enabled via _NGINX_LDAP=YES * Nginx: Improve Abuse Guard to better protect from imagecache|styles flood. * Nginx: Improve no-cache exceptions for known AJAX and webform requests. * Nginx: Make json compatible with boost caching but dynamic for POST. * Nginx: Restore fast 404 for static json requests. * Nginx: Set workers number to available CPUs x2 with min/max defaults. * Nginx: Use default buffer=32k in the access_log for better performance. * Nginx: Use static /normal/ instead of dynamic /$device/ for Boost cache. * PHP: Enable more FPM workers by default for better performance. * PHP: Force php53-fpm restart if there is no master process running. * PHP: Many Drupal 7 based distros require 196M limit at minimum. * PHP: Never force php53-fpm restart when another script reloads it. * PHP: Use more safe limits on low memory systems. * Prevent turning the feature server site into a spam machine. * Protect also from not supported request types if Nginx server is busy. * Randomize tasks wait/start intervals better to avoid high system load. * Redis: Do not disable it on the fly when there is /nojs/ in the URI. * Redis: Double check if $cache_lock_path exists before using it. * Redis: No need to force exception for cache_menu bin. * Redis: Tune sysctl for better memory management by default. * Remove up to two last zombies on Master Instance upgrade. * Remove up to two last zombies on Satellite Instance upgrade. * Rename profiles to avoid confusion between Commons 2 and Commons 3. * Run drush @hostmaster hosting-dispatch during upgrade to sync things. * Send also OK report when running in the silent mode. * Set correct default DNS entry in /etc/hosts before running local install. * Shell: Fix for too restrictive Drush commands filtering. * Shell: Fix the broken Git support over SSH. * Shell: Fixed too restrictive permissions on the extra Drush directories. * SQL: Do not run the purge_binlogs script when binary logging is disabled. * SQL: Improve sqlmagic converter and allow it to use control files. * SQL: The sqlmagic_convert should not be available for extra lshell users. * SQL: Tune also key_buffer_size by default. * Sync generating secure passwords also for limited shell users. * Update csf.conf template. * Update self-healing for Tomcat/Jetty support. * Update welcome email template to better explain how to manage databases. * Use Boost with silenced false alarms. * Use Limited Shell branch with fixed tab completion. * Use public DNS during pdnsd (re)installation to avoid issues. * Whitelist /tmp/make_tmp.* in the csf.fignore to avoid false alarms. ### Stable Edition BOA-2.0.5 ### Date: Sun Dec 23 15:35:46 EST 2012 ### Installs Ægir 2.0.5 compatible with Ægir 1.9 # Updated Octopus platforms: Commerce 1.12.1 -------------- http://drupalcommerce.org Commerce 2.0 ----------------- http://drupalcommerce.org Commons 2.11 ----------------- http://acquia.com/drupalcommons Drupal 7.18.1 ---------------- http://drupal.org/drupal-7.18 Open Deals 1.14 -------------- http://opendealsapp.com Open Outreach 1.0-rc7 -------- http://openoutreach.org OpenChurch 1.11-beta7 -------- http://openchurchsite.com Panopoly 1.0-rc3 ------------- http://drupal.org/project/panopoly Pressflow 6.27.1 ------------- http://pressflow.org ProsePoint 0.45 -------------- http://prosepoint.org Ubercart 2.11.1 -------------- http://ubercart.org Ubercart 3.3.1 --------------- http://ubercart.org All other not listed above platforms are available with latest D6 or D7 core, even if there were no new distro version released. # New Ægir modules or extensions: * Add drush clean-modules command - clean_missing_modules extension. # New o_contrib modules: * Add reroute_email module in both D6 and D7 contrib. # Changes: * Git 1.8.0.2 * MariaDB 5.3.11 on Debian Lenny * MariaDB 5.5.28a * Nginx 1.3.9 * PHP 5.3.20 * Redis 2.6.7 * Delete old tmp files in all sites daily. * Disable Expire and Purge modules by default - they are no longer needed. * Redis integration module updated to 7.x-2.0-beta2 * There is no need to restart Redis and Tomcat hourly. * Use higher innodb_lock_wait_timeout by default - 120 instead of 50. * Use 1h instead of 30min default timeout for sql and php-cli to avoid breaking some extra long running backend tasks on some really big sites. # Fixes: * Allow more drush commands over SSH. * Always force drupal_http_request_fails to FALSE to avoid false alarm. * Better check for standalone vhosts firewall setup. * Better lshell forbidden list of keywords. * Better regex to deny wildcards with top-level or country level domains. * Check for existence of host_master and not host_master/001 directory. * Compass is not available on older OS versions. * Delete ltd-shell extra user/client if there is no site associated/owned. * Delete old symlinks in the client directory for no longer associated sites. * Fix broken usage.sh script - it does not enable/disable modules. * Fix date formatting also in the sqlcheck script. * Fix for some really old installs without .barracuda.cnf file. * Fix permissions for Boost cache directory with correct chmod. * Fix the hint - it should say to restart mysql. * Issue #1081266 - Avoid re-scanning modules directory. * Issue #1263602 - Force New Relic re-install on every upgrade, if used. * Issue #1460882 - Send .json requests to @drupal instead of =404. * Issue #1837418 - Fix permissions inside ~/.drush directory. * Issue #1837776 - Do not disable httprl module. * Issue #1837910 - Upload progress broken for all D6 sites. * Issue #1839122 - Disabling Redis on known AJAX calls breaks UI elements. * Issue #1839544 - Use language neutral checks for users, groups and hosts. * Issue #1841230 - BOA provides Apache Solr 1.4 with Tomcat 6. * Issue #1841246 - Fix csf.fignore file to whitelist /tmp/drush_* * Issue #1842554 - Replace broken links to Skitch screenshots. * Issue #1847682 - Fix extra Nginx config support in the Master Instance. * Issue #1850034 - Disable SYSLOG_CHECK in csf to avoid false alarms. * Issue #1857250 - Domain Access support is broken in the backend cli. * Issue #1857990 - Include reroute_email module in o_contrib by default. * Issue #1860100 - Use provision-backup-delete instead of backup_delete. * Issue #1865112 - Add drush clean-modules command. * Issue #1867264 - Too many Redis caching exceptions cause serious confusion. * Issue #1871060 - CiviCRM l10n should be moved to proper directory. * Lshell: Map drush mup to up instead of upc. Add new drush mupc map for upc. * Max supported version of Search API Solr search is 7.x-1.0-rc2 * More complete permissions fix on install and upgrade. * More strict check for _LENNY_TO_SQUEEZE option. * Nginx: Better regex in the Nginx monitor. * Nginx: Exclude also files/progress path in the Nginx monitor. * Nginx: Fix rewrite rules in the CDN Far Future expiration support. * Nginx: Make sure that any older packages are uninstalled on upgrade. * Nginx: Make sure that default Nginx vhosts are deleted also on upgrade. * Nginx: Skip all logged media and download requests in the Nginx monitor. * PHP: Use high enough value for max_input_vars in PHP 5.3 by default. * Really fix the datestamp comparison logic on various systems. * Rebuild registry without --no-cache-clear option to avoid issues. * Redis: Check if Redis binary exists, not symlink. * Redis: Delete redis-server symlink to avoid failed Redis install. * Redis: Do not use all three extra exceptions on the hostmaster site. * Redis: Do not use sleep breaks during Redis full restart. * Redis: The cache_menu bin should be still excluded from Redis caching. * Redis: The hostmaster site needs exception for cache_class_cache bin. * Stop and Start CSF only if installed. * The locked auto-healing script needs to kill tomcat more aggressively. * Update csf.conf template. * Upgrade to ctools-6.x-1.10 in the hostmaster platform. * Use aliases in drush commands where possible. * Use better name for non-web New Relic app tracking. * You must remove remote_import extension from the source server. ### Stable Edition BOA-2.0.4 ### Date: Thu Nov 8 18:31:01 EST 2012 ### Installs Ægir 2.0.4 compatible with Ægir 1.9 # New Octopus platforms: Commerce 2.0-rc4 ------------- http://drupalcommerce.org # Updated Octopus platforms: CiviCRM 4.1.6-d6 ------------- http://civicrm.org CiviCRM 4.2.6-d7 ------------- http://civicrm.org Commerce 1.11.1 -------------- http://drupalcommerce.org Commons 2.10 ----------------- http://acquia.com/drupalcommons Conference 1.0-rc2 ----------- http://usecod.com Drupal 7.17.1 ---------------- http://drupal.org/drupal-7.17 Drupal 8.0-dev-tested -------- http://bit.ly/drupal-eight ELMS 1.0-beta1 --------------- http://elms.psu.edu NodeStream 1.5.1 ------------- http://nodestream.org NodeStream 2.0-beta8 --------- http://nodestream.org Open Atrium 1.6.1 ------------ http://openatrium.com Open Deals 1.11 -------------- http://opendealsapp.com Open Outreach 1.0-rc6 -------- http://openoutreach.org OpenChurch 1.11-beta5 -------- http://openchurchsite.com OpenPublish 3.0-beta7 -------- http://openpublishapp.com OpenScholar 2.0-rc1 ---------- http://openscholar.harvard.edu Panopoly 1.0-rc2 ------------- http://drupal.org/project/panopoly Ubercart 2.10.1 -------------- http://ubercart.org Ubercart 3.2.1 --------------- http://ubercart.org * We plan to shorten BOA system release and upgrades cycle to 1-2 months max, so we have decided to remove support for some outdated distros. We have tried to manage both security and version updates for some abandoned or semi-abandoned distros, to keep them useful for you, but since it involves increasing amount of work because of cascades of no longer compatible patches and various dependencies, we have decided that it is time to stop doing it, if their original maintainers no longer care about their users. Here is a list of distros we no longer support: MartPlug ------------ http://drupal.org/project/martplug Octopus Video ------- http://octopusvideo.org Open Academy -------- http://drupal.org/project/openacademy Open Enterprise ----- http://drupal.org/project/openenterprise OpenPublic ---------- http://openpublicapp.com Videola ------------- http://videola.tv The platforms listed above can be re-added when their maintainers will fix all critical issues and/or apply required updates. # New features: * Add auto-healing support for Bind9. * Add LOCK/FROZEN check for PHP-FPM and Tomcat in the auto-healing. * Add option to force 15min Speed Booster cache TTL for anonymous visitors. * Add optional easy install of already supported Compass Tools. * Add support for aegir|platforms|both modes on octopus upgrade. * Allow for another one upgrade daily but only to add more platforms. * Allow to install unsupported distros with option _ALLOW_UNSUPPORTED=YES * Allow to install vanilla Ægir 2.x and Drush 5.7 with "stock" option. * Improved databases backup with added OPTIMIZE TABLE foo action per table. * New Relic PHP Agent version 3.0 compatibility. * Pseudo-streaming server-side support for Flash Video (FLV) and H.264/AAC. * Support for Wysiwyg Fields module. # New Ægir modules or extensions: * Add hosting_tasks_extra module and provision_tasks_extra extension. # New o_contrib modules: * Add login_security module in D7 contrib. * Add cdn module in both D6 and D7 contrib. # Changes: * Allow outgoing mysql connections by default. * APC 3.1.13 * Chive 1.2 * Do not bundle seckit module in o_contrib. * Do not enable Expire and Purge modules by default. * Enable Syslog module by default. * Git 1.8.0 * MariaDB 5.3.9 on Debian Lenny * MariaDB 5.5.28 * Nginx 1.3.8 * Percona 5.5.28 * PHP 5.3.18 * Pure-FTPd 1.0.36 * Redis 2.6.4 * Remove not supported httprl module and disable if enabled. * The filefield_nginx_progress is forced-enabled in all D7 sites, again. * Use PHP-FPM 5.3 for Chive, Collectd and other non-Drupal sites. * Use php-cli 5.3 for drush on command line by default. You can still force 5.2 with --php=/usr/local/bin/php drush option. # Fixes: * Add cache_tax_image bin to no-redis-cache exceptions. * Add support for pdnsd in the VServer guest. * Allow all standard compass/sass commands in limited shell. * Auto-discover _NEWRELIC_KEY if not listed in .barracuda.cnf * Better auto-healing for php-fpm zombies edge case. * Better check for failed login attempts (when user exists). * Better permissions magic repair running daily. * Deny crawlers on search results pages - they may cause very high load. * Disable spinner if screen is used. * Do not force default Debian and Ubuntu mirrors even if _AUTOPILOT=YES. * Do not quote password in .my.cnf - it breaks mytop. * Do not use log/custom_cron for anything. * Do not use resolveip in the localhost mode. * Exclude cache_bootstrap and cache_pulled_tweets from Redis caching. * Fix for broken drush make edge case caused by leftovers. * Fix for broken Tika download URL. * Fix for civicrm_engage in D6. * Fix for Debian Lenny upgrade. * Fix for global.inc logic related to high traffic sites only. * Fix for NGX, PHP and SQL forced reinstall mode. * Fix for Pin-Priority in Squeeze. * Fix for sql abuse monitor. * Fix for the selectively forced upgrade mode. * Fix motd for Skynet fun. * Fix too restrictive lshell command filtering. * Force Pure-FTPd rebuild on every upgrade to avoid broken binary. * Force tomcat restart and reload php-fpm hourly. * Improve Domain module support. * Improve mysql crashed tables detection and repair in auto-healing. * Improve Nginx Abuse Guard by stopping those never cached POST DoS attacks. * Improve Nginx guard support for VServer guests. * Improved checkpoint info in Octopus. * Issue #1225380 - Do not truncate sessions table during db daily backup. * Issue #1472786 - SQL check ERROR and too many SQL check CLEAN notices. * Issue #1528726 - Fix for Redis support in all shared directories/code. * Issue #1540242 - Do not install conflicting libavcodec53 or libavcodec52. * Issue #1588060 - Make sure that /var/run is present in open_basedir. * Issue #1589052 - Incomplete PATH breaks standard tasks. * Issue #1590120 - Fix for java path changed in recent Ubuntu releases. * Issue #1591746 - Update GeoIP.dat file automatically. * Issue #1592646 - Enabled old cache backend integration module causes WSOD. * Issue #1592650 - Do not use Hide platforms with non-default profiles. * Issue #1592680 - Upload progress module breaks uploads on all D7 sites. * Issue #1593794 - New redis-only caching backend settings. * Issue #1593810 - Duplicate php-cli 5.3 binaries after upgrade. * Issue #1593980 - Remove invisible characters breaking localhost install. * Issue #1597580 - External/Aggressive caching in D6 breaks path_alias_cache. * Issue #1598676 - Collectd graphs broken. * Issue #1600426 - Cron is run every minute on all sites not yet defined. * Issue #1602142 - Do not use device specific keys for Redis cache entries. * Issue #1606146 - The manage_ltd_users.sh script locks important tasks. * Issue #1614162 - CRON Not Running on Octopus Satellites and Sites. * Issue #1643616 - APC is missing in the Ubuntu Precise based install. * Issue #1659452 - Add support for Ægir HTTPS header in the Speed Booster. * Issue #1663262 - Fix FMG install on Ubuntu Precise. * Issue #1679114 - New user name check in Octopus is too restrictive. * Issue #1689656 - Avoid caching /civicrm* and known webform requests. * Issue #1716004 - The zlib.output_compression should be disabled in 5.3 * Issue #1728616 - Better CDN Far Future expiration support. * Issue #1777982 - Do not break wordpress_migrate module support. * Issue #1778712 - Better workaround for MariaDB 5.5.27 critical bug. * Issue #1784440 - Cannot stat scan_nginx when using BOND.sh.txt * Issue #1796420 - Do not break write access to the tcpdf cache directory. * Issue #1798288 - Provision-backup_delete could not be found. * Issue #1799116 - Standardize on installation vs. install profile. * Issue #1821866 - Force Nginx rebuild to include pseudo-streaming support. * Issue #1824888 - BOND.sh.txt breaks Nginx, SQL and PHP configuration. * Issue #1825298 - Redis: force rebuild from sources on version mismatch. * Issue #1825420 - Avoid the Use of undefined constant OctopusNoCacheID. * Issue #1825630 - Remove duplicate code causing false alarm. * Issue #1825992 - Redis cache is never cleared via php-cli. * Issue #1825998 - Improved auto-healing for Redis. * Issue #1835796 - Default cache headers break CloudFlare Always Online. * Make sure that path_alias_cache module takes precedence. * Make sure that PHP 5.2 is re-installed if required. * Monitor and kill too long running sites cron tasks. * Move away buagent init script if exists when Barracuda runs. * Nginx: Allow to include high level local configuration override. * Nginx: Better regex for exceptions in the abuse guard monitor. * Nginx: Block stupid spiders/downloaders with 403 error, not CSF. * Nginx: Deny known bots on some heavy URLs. * Nginx: FileField Nginx Progress 7.x-2.3 compatibility. * Nginx: Fix for broken images paths in civicrm. * Nginx: Fix for D6 upload progress support. * Nginx: Make the abuse monitor aware of possible lang code prefixes. * Nginx: Monitor and block if required also via-multi-proxy attacks. * Nginx: Remove packages on every upgrade to avoid duplicate re-installs. * Nginx: Remove redundant URL filtering. * Nginx: Send 403 for vbulletin URI to avoid Drupal heavy 404. * Nginx: Support for /contrib/ for wysiwyg helpers exceptions location. * Nginx: Use latest nginx-upload-progress-module v0.9.0 * Nginx: Use ngx_cache_purge-1.6 * PHP: Allow short_open_tag also in 5.3 * PHP: Disable the original php5-fpm init script causing segfaults. * PHP: Fix for _FROM_SOURCES PHP-FPM 5.3 build. * PHP: Fix for the php53-fpm init script. * PHP: Force proper php53-fpm restart if required. * PHP: Install JSMin extension by default. * PHP: Install php-pear by default also in no-src based default install. * PHP: Load extensions in a safe, correct order. * PHP: Log killed php-fpm events. * PHP: Make sure that all builds use correct, fresh downloads. * PHP: Make sure that php53-fpm is disabled during apt-get based upgrade. * PHP: Make sure that suhosin.so is removed and jsmin.so added. * PHP: Remove duplicate and conflicting allow_call_time_pass_reference. * PHP: Remove php5-sasl extension causing segfaults. * PHP: Remove php5-suhosin from the stack - too many weird issues. * PHP: The realpath_cache_ttl should be as low for CLI as possible. * PHP: Use 2x higher limits in the tune_web_server_config logic. * Purge Redis cache hourly. * Randomize runner intervals. * Remove all control files on init to avoid aborted Octopus upgrades. * Remove any extra search directive from resolv.conf when pdnsd is installed. * Remove Dotdeb libmysqld-dev conflicting with Percona libmysqlclient-dev. * Remove not really working properly Boost separate mobile bins. * Remove not supported MTA only on initial install. * Remove old cache module from all old profiles. * Segfault monitor should not disable sites by default. * Serve .less files as static by default, no log. * Set hosting_advanced_cron_default_interval to 3 hours. * SQL: Use skip-name-resolve by default. * Support both HTTP_X_FORWARDED_PROTO and HTTPS. * The dev. should not disable Redis cache. * The missing /usr/bin/lshell entry may affect also Lucid. * There is no need to force Debian mirror. * Tune AdvAgg config - disable async mode and use JSMin by default. * Use autoselect for civicrm downloads. * Use DrupalDatabaseCache for some Redis bins to avoid confirmed issues. * Use higher default timeouts for php-cli and wait_timeout in mysql. * Use SERVER_NAME instead of HTTP_HOST header in the Redis cache key. * Use version specific directory for static downloads. * Yet another umask trick for shell and SFTP. ### Stable Edition BOA-2.0.3 ### Date: Thu May 17 18:17:40 EST 2012 ### Installs Ægir 2.0.3 compatible with Ægir 1.9 # There are major improvements and new features added in this BOA Edition. Here is the description of those most important/expected, while complete list of all changes, new features and fixes is available further below. * Caching backend has been simplified. We no longer use chained cache system with Memcached+Redis+database. New system uses only Redis cache and the same configuration for all Drupal 6 and Drupal 7 platforms. This new system doesn't require any extra module to be enabled in any site. Complete integration is already enabled by default for every platform/site installed by default and for every custom platform as before - the next day after first site on the custom platform has been created. You can disable this caching layer using the same modules/cache/NO.txt control file as before. While there is just one cache engine (Redis) used, there is also an automatic, instant failover to standard database caching, just in case Redis is not available for some reason. You can also disable Redis cache on the fly for debugging by adding ?noredis=1 to any URL. * We have added support for Drupal 8.x while still using modified Drush 4.6-dev version, so we can still support Drupal 5 on the same system, but on another Octopus instance. * You can choose different PHP version for PHP-FPM (web access) and PHP-CLI, for even greater control over compatibility with various Drupal major versions. * You can choose both PHP-FPM and PHP-CLI versions per Octopus instance, on the same system. And you can change those versions on upgrade. * Installing and upgrading BOA system has been greatly simplified. You can still configure and run both installers as before, but you can also use these new, shockingly simple command line tools to install Barracuda and Octopus at once, to install more Octopus instances, to run selective or batch upgrades of all Octopus instances etc. See docs/INSTALL.txt and docs/UPGRADE.txt for details. * We have added an 'easy install' configuration shortcuts for both standard (public) and localhost installs. You no longer need to read, understand and configure all options, unless you prefer to choose some non-default configuration options. * Default installs on Debian Squeeze and Ubuntu Precise use packages for PHP 5.3, so initial setup takes just 10-15 minutes. * You can easily grant limited shell and FTPS access for developers, simply by creating "Clients" in the Ægir control panel and define them as 'owners' of one or more sites. Their access will be limited to only sites they can manage, but only if you will send them their access credentials, which are independent of their Ægir control panel credentials and stored in the ~/users/ directory in your main account. You will find there files with passwords for every "Client" with at least one site attached. For example ~/users/o1.username file means that this Client's username for SSH and FTPS access is 'o1.username' while his password is stored in this file. This means that SSH/FTPS access is not granted automatically, but you can decide who should receive it. How to change any extra user's password? Simply delete his ~/users/o1.username file and wait up to 5 minutes - the system will re-create his account with new password. And how to delete the user completely? Simply delete this user "Client" account in the Ægir control panel and allow the system to delete also his SSH/FTPS access in the next 5 minutes. * We have added segfault monitor for php-fpm and nginx, enabled by default. It is pretty aggressive, because it disables vhost of any site causing segfault errors and sends email alert to the Octopus instance owner and server owner email addresses. Simple site re-verify in Ægir enables the site again - but until the next segfault only, so read the info included in the email alert message, if this will happen. If you prefer to not run this monitor: `rm -f /var/xdrago/monitor/check/segfault_alert` * Previously recommended site and platforms re-verify on Clone or Migrate is now fully automated. Ægir will run these extra tasks as a part of Clone or Migrate task, to make sure that there are no errors and that Ægir is using up-to-date information collected about platforms and sites. It also automatically fixes the known problem with domain aliases incorrectly written in the original and cloned sites, as reported in the Ægir queue: http://drupal.org/node/1004526 * Apps are now fully supported. If the App is not downloaded yet, installing it via browser only requires write permissions, normally never available for the web server user, so you need to create an empty control file, either in sites/all/modules/apps-allow.info or sites/domain/modules/apps-allow.info and then run 'Reset password' task. It will open write access where required until the next site 'Verify' task will run . After installing the App, remember to re-Verify the site to restore default, safe permissions. * Custom local.settings.php file support uses similar logic with control file sites/domain/modules/local-allow.info and also 'Reset password' task. After running this task the local.settings.php file will be group writable, so you will be able to edit it also when logged in as limited shell user. Remember to run site Verify when done, to restore standard, safe permissions. Note that this file is created automatically, but is not open for write access by default. # Notes on new and updated platforms and new Drupal core: All 6.x and 7.x platforms have been updated with latest core, so they are all in fact new in this BOA Edition, but we list here only really new platforms or those with new version released since last BOA Edition, with one exception: we list also basic 6.26.2 and 7.14.2 platforms as new. NOTE: before you will try to upgrade any of your sites, please read our important how-to: http://omega8.cc/the-best-recipes-for-disaster-139 http://omega8.cc/are-there-any-specific-good-habits-to-learn-116 http://omega8.cc/managing-your-code-in-the-aegir-style-110 REALLY, PLEASE READ IT TO AVOID SOME HEAVY HEADACHES! # New Octopus platforms: CiviCRM 4.1.2-d6 ------------- http://civicrm.org CiviCRM 4.1.2-d7 ------------- http://civicrm.org Drupal 7.14.2 ---------------- http://drupal.org/drupal-7.14 Drupal 8.0-dev --------------- http://bit.ly/drupal-eight MartPlug 1.0-beta1b ---------- http://drupal.org/project/martplug Octopus Video 1.0-alpha6 ----- http://octopusvideo.org Panopoly 1.0-beta3 ----------- http://drupal.org/project/panopoly Pressflow 6.26.2 ------------- http://pressflow.org # Updated Octopus platforms: Acquia 6.26.2 ---------------- http://bit.ly/acquiadrupal CiviCRM 3.4.8-d6 ------------- http://civicrm.org CiviCRM 4.0.8-d7 ------------- http://civicrm.org Commerce 1.7.1 --------------- http://drupalcommerce.org Commons 2.6 ------------------ http://acquia.com/drupalcommons Feature Server 1.1 ----------- http://bit.ly/fserver Managing News 1.2.2 ---------- http://managingnews.com NodeStream 1.5 --------------- http://nodestream.org NodeStream 2.0-beta1 --------- http://nodestream.org Open Atrium 1.4.1 ------------ http://openatrium.com Open Deals 1.0-beta7e -------- http://opendealsapp.com Open Outreach 1.0-rc1 -------- http://openoutreach.org OpenChurch 1.10-alpha1 ------- http://openchurchsite.com OpenPublish 3.0-alpha8 ------- http://openpublishapp.com Ubercart 2.9.1 --------------- http://ubercart.org Ubercart 3.1.1 --------------- http://ubercart.org Videola 1.0-alpha3 ----------- http://videola.tv # New features: * Add Adaptive Image Styles support. * Add Compass compatibility in the limited shell (Compass is not installed by default). * Add ssh-copy-id and ssh-add commands as allowed over SSH. * Add X-Speed-Cache-Key header for Speed Booster debugging. * All Clone/Migrate forms in the Ægir control panel have useful inline help added. * Allow to easily re-start BOA failed install, just by running boa installer again. * Allow to install PHP 5.3 only with option _PHP_MODERN_ONLY=YES (default). * Deny HTTPS access on Nginx level for all known bots and crawlers. * Do not force HTTPS for Ægir if /data/conf/no-https-aegir.inc control file exists. * Fix system time hourly via auto-healing. * Install wkhtmltopdf by default - available at /usr/bin/wkhtmltopdf * Issue #1263602 - New Relic Server and Apps Monitor with per Site/Instance reporting. * Issue #1392498 - Use .barracuda.cnf to define YES/NO for some config overrides. * Issue #1428078 - Compatibility with resp_img module. * Issue #1436522 - Add option to set _PHP_CLI_VERSION. * Issue #1438906 - Add Imagick to PHP by default. * Issue #1463494 - Add support for radioactivity module. * Issue #1542712 - Automated wildcard DNS for easy localhost mode. * Lock temporarily almost all known crawlers on high load with error 503. * Make _NGINX_DOS_LIMIT configurable and allow higher load by default. * Make both 1 and 5 minute max allowed load configurable in the auto-healing. * Support for automatically managed extra SSH/FTPS accounts per Ægir Client. * The _LOAD_LIMIT used in the auto-healing system is now configurable. * The _SPEED_VALID_MAX used as a Speed Booster cache TTL is now configurable. * Ubuntu Precise 12.04 is fully supported. * Use nice default /root/.bashrc config. # New Ægir modules or extensions: * Add hosting_advanced_cron module - enabled by default. * Add hosting_civicrm_cron module - enabled by default. * Add hosting_task_gc module - enabled by default. * Add provision_cdn module and extension, by default not enabled. * Add remote_import and hosting_remote_import - not enabled by default. * Add revision_deletion module - automatically configured and enabled by default. * Registry Rebuild Drush extension - installed by default. # New o_contrib modules: * entitycache-7.x-1.x-dev * nocurrent_pass-7.x-1.0 * speedy-7.x-1.0 # Changes: * Acquia 7.x platform has been merged with Ubercart 3. * Always disable css_gzip, javascript_aggregator and performance modules. * Automate database server secure setup on initial install. * Disable /etc/cron.daily/mlocate by default. * Do not disable update module - it may break some features depending on it. * Do not enable filefield_nginx_progress module by default. * Do not remove Testing profile and use better naming convention for D7/D8. * Do not search for mirrors by default. * Drupal 8 compatible Drush 4.6-dev * GitHub availability is required also when another mirror is used by default. * Installing Git from sources is now optional. * Limited shell 0.9.15.1-sec-noreload * Lower default APC and Redis memory in VZ to 64MB to avoid/limit known VZ issues. * MariaDB and Percona 5.5 * Modify Ubercart platform to include some contrib modules in the D6 version. * Nginx 1.3.0 * Open Enterprise 1.0-beta3 is deprecated and not supported. * Plain FTP access disabled with FTPS-only mode available. * Pure-FTPd server install is now optional, but still default. * Send all known bots to $args free URLs. * Use _HTTP_WILDCARD=YES by default to match Ægir standard setup. # Fixes: * Abort all parent installers as soon as any sub-installer fails with fatal error. * Add $http_x_forwarded_proto to the cache key to never mix HTTP and HTTPS entries. * Add a list/chart in the readme for an easy overview of all included modules. * Add volatile updates to /etc/apt/sources.list for Squeeze. * All connection tests should be run after netcat is installed if not yet available. * Allow more than one IP to connect to the same FTPS account at the same time. * Allow some known php files also in profiles - a fix for Nginx config regression. * Always update nginx_speed_purge.conf file on upgrade. * Archive install and upgrade logs in /var/backups/ * Avoid double dots in $cookie_domain. * Better detection of real visitor IP in the scan_nginx abuse guard. * Cache 403 response for 5s by default. * Count only valid requests in the scan_nginx abuse guard. * Disable caching in admin_menu module by default. * Disabled allow_url_fopen breaks drush dl. * Do not allow bots to create cache entries with long expire time. * Do not prompt for D6 or D7 vanilla platforms install if not defined in the config. * Explain in the email templates that plain FTP is no longer available. * Fix cart block issue in Ubercart. * Fix for Debian Lenny support - packages have been moved to archives. * Fix for slow networks/DNS in pdnsd cache default config. * Fix for VServer on _LENNY_TO_SQUEEZE upgrade. * Fix tune_memory_limits logic to really tune the config on low mem systems. * Follow some symlinks when running chmod/ownership repair daily. * Force global upgrade for Expire and Purge modules. * Force safe default settings for expire module. * Improved Lenny to Squeeze major upgrade support. * Increase allowed limit_conn for local purge requests. * Issue #1216420 - Incorrect lshell path in /etc/passwd breaks FTPS on Squeeze. * Issue #1317264 #1543118 - Uninstall Sendmail if exists to avoid breaking Postfix. * Issue #1377492 - Improve Install / Upgrade mode detection and move away any zombies. * Issue #1398050 - Use our mirror for all downloads on install and upgrade. * Issue #1436522 - Add missing php.ini for PHP-CLI 5.3 * Issue #1440796 - Ægir support broken due to duplicate db update in Commons/OG. * Issue #1441366 - The _USE_SPEED_BOOSTER switch is deprecated. * Issue #1443284 - Early start of CSF may lockout the ssh user and break the install. * Issue #1445460 - Broken Git install on Ubuntu Lucid. * Issue #1451262 - Do not lock the access to phpinfo. * Issue #1472460 #1524738 - Nginx denies request methods: PUT, DELETE and OPTIONS. * Issue #1475416 - Unable to install Barracuda due to Ægir failed install. * Issue #1478984 - Add Access-Control-Allow-Origin header with wildcard where required. * Issue #1479188 - Octopus does not respect _DNS_SETUP_TEST setting on upgrade. * Issue #1505370 - Conflict between Mime Type and Document Type in Nginx. * Issue #1515762 - Nginx microcaching should skip all known AJAX requests. * Issue #1526382 - The _PHP_CLI_VERSION set in cnf file is not respected. * Issue #1527852 - Random WSOD on D7 sites with Redis enabled for anonymous visitors. * Issue #1528692 - Both cache_backport and redis modules are never added on upgrade. * Issue #1528726 - Redis caching backend should be unified across all instances. * Issue #1528996 - Nginx microcaching should use TTL 1s only for upstream errors. * Issue #1534306 - Duplicate directives break Dotdeb Nginx version. * Issue #1539512 - Keep custom Redis configuration during upgrade. * Issue #1540112 - HEAD install fails on Debian Squeeze 32bit. * Issue #1540242 - Add useful codecs to ffmpeg if enabled. * Issue #1541334 - Add kvm to supported virtualization systems. * Issue #1544144 - Use $server_name instead of $host in all sites/ paths. * Issue #1547878 - Port 11371 should be open for outgoing connections. * Issue #1553150 - Both php.ini and my.cnf config files get overridden upon upgrade. * Issue #1553166 - Disable incompatible mysql config options. * Issue #1554972 - PHP cli downgraded to 5.2 on upgrade with _PHP_MODERN_ONLY=YES * Issue #1556192 - Upgrade Entity API to head to fix issue with Drupal 7.14 * Issue #1585348 - Disable openchurch_video_demo_content to avoid fatal error. * Kill nash-hotplug if running. * Lower some my.cnf defaults to better support low mem systems. * Make default myisam_sort_buffer_size big enough to run repair if required. * Make sure that /dev/null has correct permissions. * Pass some expected headers when using local proxy. * Remind people that they should use their own email address or exit early. * Remove deprecated Nginx config includes and use symlinks for backward compatibility. * Sanitize important variables early. * Save 330 seconds with 3x faster spinner. * Set hosting_queue_cron_frequency to 8888 weeks by default to really use schedule defined via hosting_advanced_cron module and never override it. * Share and symlink civicrm code. * Skip _AEGIR_LOGIN_URL in the debug mode - it is empty then. * Update mime.types for Nginx. * Use _FULL_FORCE_REINSTALL when recovering from broken/partial install automatically. * Use faster locations matching where possible in the Nginx config. * Use higher values for limit_conn in Nginx to avoid issues when required. * Use loglevel warning in Redis config. * Use safe placeholders to avoid issues on low-mem machines. ### Stable Edition BOA-2.0.2 ### Date: Thu Feb 9 14:00:00 EST 2012 ### Installs Ægir 2.0.2 # Note on new and updated platforms and new Drupal core: All 6.x and 7.x platforms have been updated with latest core, so they are all in fact new in this BOA Edition, but we list here only really new platforms or those with new version released since last BOA Edition, with one exception: we list also basic 6.24.1 and 7.12 platforms as new. Please note that instead of waiting for 6.25, we already included patches required to fix major issues with 6.24: http://drupal.org/node/1425868 http://drupal.org/node/1425260 Our Pressflow 6.24.1 +Extra version includes not only listed above patches, but also a few extra, performance related patches discussed here: http://groups.drupal.org/node/187209 Note also that we renamed too basic Acquia 7.x platform to Ubercart 3.x platform. It is based on the same acquia install profile, but includes all contrib modules required for any basic Ubercart 3.x site. NOTE: before you will try to upgrade any of your sites, please read our important how-to: http://omega8.cc/the-best-recipes-for-disaster-139 http://omega8.cc/are-there-any-specific-good-habits-to-learn-116 http://omega8.cc/managing-your-code-in-the-aegir-style-110 REALLY, PLEASE READ IT TO AVOID SOME HEAVY HEADACHES! # New Octopus platforms: Drupal 7.12 ------------------ http://drupal.org/drupal-7.12 NodeStream 2.0-alpha6 -------- http://nodestream.org OpenPublish 3-alpha3 --------- http://openpublishapp.com Pressflow 6.24.1 ------------- http://pressflow.org Ubercart 3.0.1 --------------- http://ubercart.org # Updated Octopus platforms: Acquia Commons 2.4 ----------- http://acquia.com/drupalcommons Commerce Kickstart 1.3 ------- http://drupalcommerce.org ELMS 1.0-alpha6 -------------- http://elms.psu.edu Open Atrium 1.2.1 ------------ http://openatrium.com Open Deals 1.0-beta7 --------- http://opendealsapp.com Open Outreach 1.0-beta7a ----- http://openoutreach.org ProsePoint 0.43 -------------- http://prosepoint.org Videola 1.0-alpha2 ----------- http://videola.tv # New features: * Barracuda now supports Debian Lenny to Squeeze major upgrade. Of course you should create full backup image before running this major system upgrade, just in case, but all the rest is fully automated - it is enough to set advanced configuration option in Barracuda to _LENNY_TO_SQUEEZE=YES and run Barracuda as usual. It will upgrade your system to Squeeze and re-build everything, with almost no downtime during the upgrade. You will still need to reboot the server when it will complete all upgrades. Important: Debian Lenny reached EOL on February 6, 2012. Details: http://lists.debian.org/debian-announce/2012/msg00001.html * All new 7.x sites now run on latest PHP-FPM 5.3.10 by default. For existing sites it is enough to re-verify them in your Ægir control panel to get them on PHP-FPM 5.3.10 automatically. All existing and new 5.x sites run on the old PHP-FPM 5.2.17 version by default and you can't change that. You can still choose between PHP-FPM 5.2.17 and 5.3.10 for all your 6.x sites - just let us know via http://omega8.cc/support that you wish to switch to 5.3.10 - but make sure first that all your 6.x sites are fully PHP 5.3 compatible. By default all 6.x sites still run on PHP-FPM 5.2.17. Of course you could choose 5.3.10 for 6.x sites on one Octopus instance and 5.2.17 on another - on the same server. Just one more reason to use Octopus built-in intelligence :) All of this works the same both for Ægir Master Instance and all Ægir Satellite Instances. * Both Speed Booster, Boost and Redis/Memcached supports separate caches per mobile device, so it is safe to use separate themes or content for mobile devices. We use simple logic to determine the kind of device and there are separate cache bins for mobile-tablet, mobile-smart and mobile-other. You can review it here: http://bit.ly/wYz6PG * Purge module is now enabled by default in all 6.x and also 7.x sites. Now Speed Booster works like a Boost - it expires immediately the cache for any node/page as soon as it has been edited or comment added. It also automatically expires the cache for the homepage and RSS feed at once. You no longer need to wait up to one hour for Speed Booster cache expiration. Plus, unlike in Boost, it purges all separate caches for all mobile devices along with non-mobile cache, at once. Now you have a good reason to disable Boost and use our crazy fast Speed Booster only. * You can use GeoIP data provided by your Nginx server in your custom code or modules with variables: $_SERVER['GEOIP_COUNTRY_CODE'] and $_SERVER['GEOIP_COUNTRY_NAME'] to display content or block depending on the visitor's country. You can check/review it from your location also on command line with: 'curl -I http://your-domain' - you will see GeoIP headers. * You can safely manage Clients/Users attached to hosted sites in your Ægir interface. Make sure that all sites have its associated Client! Otherwise the site will be listed as available for all Clients/Users you have added. The site can lost its association with Client after Clone task if there is any non-alphanumeric value in the Client name, like &. * CloudFlare specific header 'CF-Connecting-IP' is now supported out of the box and available as standard $_SERVER['REMOTE_ADDR'] in all 5.x, 6.x and 7.x platforms without any contrib module. * You can disable both Boost and Speed Booster on the fly by adding ?nocache=1 to any URL. Useful for debugging. * Speed Booster offers now also ESI microcaching, as explained in this article: http://groups.drupal.org/node/197478. This may enhance not only anonymous visitors, but also logged in users experience, since it allows you to separate microcache for ESI/SSI includes (valid for just 15 seconds) from both default Speed Booster cache for anonymous visitors (valid by default for 3 hours, unless purged on demand via recently introduced Purge/Expire modules) and also from Speed Booster cache per logged in user (valid for 60 seconds). The ESI module is included in all 6.x platforms but is not enabled and not configured automatically, so please consult its documentation for details on how to use it properly. Now you have three different levels of Speed Booster cache to leverage and deliver the 'live content' experience for all visitors, and still protect your server from DoS or simply high load caused by unexpected high traffic etc. * Automatic configuration of options required when Barracuda detects _VMFAMILY=AWS (Amazon EC2). * Both _NGINX_WORKERS and _PHP_FPM_WORKERS are now configurable. * You can avoid overwriting /etc/mysql/my.cnf with empty control file: $ touch /etc/mysql/custom.my.cnf * You can avoid overwriting /opt/php52/etc/php52.ini on upgrade with empty control file: $ touch /opt/etc/custom.php.ini * You can avoid overwriting /opt/php52/lib/php.ini on upgrade with empty control file: $ touch /opt/etc/custom.php.ini * You can avoid overwriting /opt/php53/etc/php53.ini on upgrade with empty control file: $ touch /opt/etc/custom.php53.ini * You can avoid overwriting /var/spool/cron/crontabs/root on upgrade by adding your extra/custom entries in the extra file: $ nano /var/xdrago/cron/custom.txt * You can avoid overwriting your CSF configuration on upgrade with empty control file: $ touch /var/log/custom.csf.log # New o_contrib modules: * taxonomy_edge-6.x-1.3 (with core patch) * taxonomy_edge-7.x-1.1 (with core patch) * purge-6.x-1.x * purge-7.x-1.x * expire-6.x-1.x * expire-7.x-1.x # Changes: * Nginx upgrade to 1.0.12 * Lshell upgrade to 0.9.15-beta1 * Percona upgrade to 5.5.19 * Chive upgrade to 1.0.2 * Git upgrade to 1.7.9 * Suhosin upgrade to 0.9.33 * Textile upgrade to 2.3 * Mytop is now installed by default. * Drush based method for sites cron is more reliable and now set by default. * More compact naming for platforms in Octopus. * Speed Booster cache per logged in user now valid for only 60 seconds. * Speed Booster anonymous cache now valid for 3 hours, unless purged. * Extra $_COOKIE[OctopusCacheID] has been removed. * We use $cache_uid from parent map (Nginx) in fastcgi_cache_key. * Forced external caching only for Pressflow 6 core. * Octopus installs by default: D7P D7S D7D D6P D6S D6D OAM. * We no longer need to force Percona on Oneiric. MariaDB also works. * We no longer need to force MariaDB on Lenny and MariaDB Natty on Oneiric. * We no longer need to use Percona for Maverick on Natty and Oneiric. * We use _THIS_DB_HOST=localhost by default. * Secure/restricted access to manage users/clients is open by default in every Ægir Satellite Instance also for the extra non-uid=1 admin. * Users in every Ægir Satellite Instance are protected with userprotect and protect_critical_users modules. * Some default SQL limits have been increased. * The insecure D7 plugin manager is now forced as disabled by default. * The hosting_platform_pathauto module is now enabled in Ægir by default. * The provision_boost module is now added and enabled in Ægir by default. # Fixes: * Simplified Nginx config with 'modern', 'octopus' and 'legacy' templates. * Removed duplicate code and fixed caching logic for D5, D6 and D7. * Fixed logic for ESI microcache and Boost cache. * Removed imageinfo_cache module. It breaks platforms with imagecache module. * Disable deslash in globalredirect to avoid redirect loop. * Load IonCube also in php-cli. * Use core version in paths for all platforms. * Make sure that 301 redirects are only microcached - 5 seconds by default. * Do not run duplicate PHP-FPM rebuild on upgrade when there is no new DB server version installed/available. * Set boost_ignore_htaccess_warning to 1 by default. * Use provision_civicrm 6.x-1.x branch instead of outdated master. * Fix for broken regex on lshell.conf update per user. * All broken symlinks in the clients directory now deleted daily. * All broken symlinks in the lshell user home directory now deleted daily. * Avoid breaking Ægir upgrade because of high load. * Set correct loglevel for Redis to avoid useless I/O noise. * Add curl as allowed command to lshell default config. * Use faster download instead of git for Pressflow core. * Issue #1432668 - Octopus username should never start with a digit. * Issue #1408972 - Make nginx rewrites compatible with audio module. * Issue #1428990 - Load memcache in php-cli. * Issue #1408200 - AgrCache breaks aggregation and should be removed. * Issue #1420758 - Make sure that Nginx config includes are really used on initial Barracuda install. * Issue #1418608 - Add --with-xmlrpc in the PHP-FPM build by default. * Issue #1396204 - Add GeoIP support in Nginx by default * Issue #1394152 - Build PHP-FPM with --enable-calendar by default. * Issue #1392498 - Do not overwrite CSF configuration on Barracuda upgrade. # Recommendations: * Use _FORCE_GIT_MIRROR=github because it is 10x faster than others. ### Stable Edition BOA-2.0.1 ### Date: Wed Dec 28 07:00:00 EST 2011 ### Installs Ægir 2.0.1 # New Octopus platforms: ELMS 1.0-alpha5 -------------- http://elms.psu.edu Open Deals 1.0-alpha4 -------- http://opendealsapp.com Open Outreach 1.0-beta6 ------ http://openoutreach.org # Updated Octopus platforms: Acquia 7.10.10 --------------- http://bit.ly/acquiadrupal Acquia Commons 2.3 ----------- http://acquia.com/drupalcommons CiviCRM 3.4.8 ---------------- http://civicrm.org CiviCRM 4.0.8 ---------------- http://civicrm.org Commerce Kickstart 1.0-rc7 --- http://drupalcommerce.org Drupal 7.10 ------------------ http://drupal.org/drupal-7.0 Managing News 1.2.1 ---------- http://managingnews.com NodeStream 1.1 --------------- http://nodestream.org Open Atrium 1.1.1 ------------ http://openatrium.com OpenChurch 1.22-a ------------ http://openchurchsite.com OpenScholar 2.0-beta13 ------- http://openscholar.harvard.edu ProsePoint 0.41 -------------- http://prosepoint.org # New features: * Speed Booster Purge Server for all Drupal 6.x based platforms with automatically configured support for all devices caching. * Enhanced Pressflow core for all bundled 6.22 based platforms, applied automatically also to already installed platforms: https://github.com/omega8cc/pressflow6 * Added access to the "clients" directory with shortcuts/symlinks to all hosted sites per Ægir "client". # New o_contrib modules: * ESI for Nginx SSI - http://drupal.org/sandbox/mikeytown2/1328648 * Purge for Speed Booster - http://drupal.org/project/purge * Expire for Speed Booster - http://drupal.org/project/expire # Changes: * Nginx upgrade to 1.0.11 * MariaDB upgrade to 5.2.10 * Percona upgrade to 5.5.18 * Chive upgrade to 1.0.1 * Pure-FTPd upgrade to 1.0.35 * The syslog module is no longer enabled by default and added to the list of automatically disabled modules. # Fixes: * Mobile devices detection and caching improved. * Many fixes and enhancements for Speed Booster caching logic. * Many fixes and enhancements for Boost caching logic. * More reliable Nginx auto-healing. * Broken symlinks in the "clients" directory are now purged daily. * The preg_match for dev should check for dev. and devel. only. * Issue #1366564 - Use instance specific .octopus.cnf files. * Issue #1262988 - Use reliable test for upload progress availability. * Issue #1350028 - Make sure that all BOA pid files are removed on reboot. * Issue #1348906 - BOND script outdated _INSTALLER_VERSION variable fixed. * Issue #1321428 - Make sure that _SSH_PORT is written in /etc/ssh/sshd_config. ### Stable Edition BOA-1.4S ### Date: Mon, 24 October 2011 14:00:00 +0200 ### Installs Ægir stable 1.4S # Updated Octopus platforms: Acquia 7.8.7 ----------------- http://bit.ly/acquiadrupal Acquia Commons 2.2 ----------- http://acquia.com/drupalcommons CiviCRM 3.4.7 ---------------- http://civicrm.org CiviCRM 4.0.7 ---------------- http://civicrm.org Commerce Kickstart 1.0-rc4 --- http://drupalcommerce.org OpenPublic 1.0-beta3 --------- http://openpublicapp.com Ubercart 6.x-2.7 ------------- http://ubercart.org # New features: * Mobile devices detection for mobile-tablet, mobile-smart and mobile-other. * Mobile devices detection integrated with Redis/Memcached caches. * Mobile devices detection integrated with Boost cache. * Mobile devices detection integrated with Speed Booster cache. * Responsive Images 7.x module support. * New .barracuda.cnf and .octopus.cnf files for better configuration management. * Ubuntu Oneiric 11.10 is now fully supported. * Issue #1266912 - Support for Apache Solr Attachments - Tika. * Issue #1310082 - Disable XML Sitemap for dev automatically. * Support for fbconnect module. * Support testing->minimal->standard migrations for D7 out-of-the-box. * The Speed Booster $key_uri enhanced logic included in the default Nginx config. # Changes: * Nginx upgrade to 1.0.8 * Create mobile cache separate subdirs for Boost by default. * _MODULES_ON and _MODULES_OFF now forced also for D7 sites. * Do not force hosting_ignore_default_profiles by default. * Some o_contrib modules received updates - use _O_CONTRIB_UP=YES to apply them. * Allow 'contrib' subdirectory in the modules path for allowed PHP files. * Issue #1309996 - Extended support for common modules locations/paths. * Issue #1305542 - Do not overwrite php.ini and my.cnf if control files exist. * Add collectd to the auto-healing monitor and automated restart. * Disable l10n_update module by default to avoid issues when d.o servers are down. * Updated docs/SOLR.txt to explain how to configure any core to support 7.x. * Duplicate parts of Nginx config moved to maps in the parent server.tpl.php file. * Add 'drush pmi' to the list of displayed/allowed commands. * Issue #1243068 - Allow to override in override.global.inc also Redis/Memcached etc. * Deny known crawlers on the HTTPS proxy level. # Fixes: * The wkhtmltopdf binary should be always executable if exists. * Issue #1238200 - Use custom _SSH_PORT only in TCP_IN. * Make sure the keys for MariaDB or Percona are added to avoid broken install. * Issue #1307664 - Test repo.percona.com and ftp.osuosl.org availability. * Issue #1262988 - Missing upload_progress_test.conf breaks upgrade for older installs. * Issue #1281896 - Add some missing video types to mime.types in the Nginx config. * Do not use path_alias_cache in the Hostmaster site to avoid broken URL aliases. * Issue #1270724 and #1263124 - really use /tmp directory during 'drush dl module'. * Do not break admin/reports/status/rebuild URL in D7. ### Stable Edition 1.0-boa-T-8.10 ### Date: Mon, 5 September 2011 16:15:00 +0200. ### Installs Ægir stable 1.3.1 # New Octopus platforms: OpenChurch 1.21 -------------- http://openchurchsite.com # Updated Octopus platforms: Acquia 7.7.6 ----------------- http://bit.ly/acquiadrupal Acquia Commons 2.0 ----------- http://acquia.com/drupalcommons CiviCRM 3.4.5 ---------------- http://civicrm.org CiviCRM 4.0.5 ---------------- http://civicrm.org Conference 1.0-beta2 --------- http://usecod.com Drupal 7.8 ------------------- http://drupal.org/drupal-7.0 Drupal Commerce 1.0 ---------- http://drupalcommerce.org OpenPublic 1.0-beta2 7.8 ----- http://openpublicapp.com Ubercart 2.6 6.22 ------------ http://ubercart.org # Changes: * Drush Make upgrade to 2.3 * Drush upgrade to 4.5 * Nginx upgrade to 1.0.6 * MariaDB upgrade to 5.2.8 * Higher limit_conn for AdvAgg to support high async connections rate. # Fixes: * Tomcat runs as a separate 'tomcat' user instead of root. * Issue #1250448 - Textile 7 requires Vars module. * Issue #1248432 - support for CNAME records in the DNS check. # New features: * HTTP/HTTPS redirects example in the override.global.inc file. * Enabled by default HTTPS and HTTP sessions/cookies for D7. * Issue #1243068 - Allow to override $cache_module_path. ### Stable Edition 1.0-boa-T-8.9 ### Date: Sat, 30 July 2011 23:50:00 +0200. ### Installs Ægir HEAD 1.2.1 # Updated Octopus platforms: Drupal 7.7 ------------------- http://drupal.org/drupal-7.0 Acquia 7.7.5 ----------------- http://bit.ly/acquiadrupal OpenPublic 1.0-beta1 7.7 ----- http://openpublicapp.com Drupal Commerce 1.0-rc1 ------ http://drupalcommerce.org Open Atrium 1.0 6.22 --------- http://openatrium.com ProsePoint 0.40 6.22 --------- http://prosepoint.org # Fixes: * Two critical cache related bugs fixed in Nginx 1.0.5. * Critical Issue #1222208 - broken web-based cron for sites. * Issue #1223506 - cloning a site looses client site ownership. * Missing jquery.ui symlink in Conference COD breaks install. * Issue #1230420 - do not purge /tmp too aggressively. * Issue #1234470 - SSL proxy didn't respect HTTP wildcard. * Boost's false alarm about permissions silenced. * Permissions for sites/domain/private/* also fixed daily. # Changes: * Nginx upgrade to 1.0.5 * Chive upgrade to 0.5.1 * Web-based method set by default for sites cron in Ægir. # New features: * Speed Booster Purge experimental backend can be installed, but is not used in production yet - see _PURGE_MODE flag and Issue #1048000. ### Stable Edition 1.0-boa-T-8.8 ### Date: Thu, 15 July 2011 08:00:00 +0200 ### Installs Ægir stable 1.2 # New Octopus platforms: Drupal 7.4 ------------------- http://drupal.org/drupal-7.0 CiviCRM 3.4.4 ---------------- http://civicrm.org CiviCRM 4.0.4 ---------------- http://civicrm.org Videola 1.0-alpha1 ----------- http://videola.tv # Updated Octopus platforms: OpenPublic 1.0-beta1 7.4 ----- http://openpublicapp.com Drupal Commerce 1.0-beta4 ---- http://drupalcommerce.org Acquia Commons 1.7 ----------- http://acquia.com/drupalcommons Acquia 7.4.4 ----------------- http://bit.ly/acquiadrupal OpenScholar 2.0-beta11 ------- http://openscholar.harvard.edu Conference 1.0-beta1 --------- http://usecod.com # New features: * Speed Booster can be disabled per site or per platform. * Redis/Memcached can be disabled per site or per platform. * Redis/Memcached chained cache enabled also for anonymous visitors. * Support for private_upload module added. * Support for static sites/domain/files/robots.txt file per site #1173954. * New _HTTP_WILDCARD Barracuda option for Nginx configuration #1152316. * New _XTRAS_LIST Barracuda option to define extras to be used. * Scripts to add extra ftp or lshell standard or lshell master users. * New _PLATFORMS_LIST Octopus option to configure the list of platforms. * You can migrate sites between some installation profiles by default: Drupal/Pressflow -> Acquia Acquia -> Drupal/Pressflow Acquia -> CiviCRM 3 Cocomore/CDC/DrupalCenter -> Pressflow * New _O_CONTRIB_UP Octopus option to upgrade last two contrib sets. # Changes: * Migration from commercedev to commerce_kickstart profile. * More system info stored in BOA logs to help with debugging. * Nginx config - deny access to /hosting/c/server_master. * Better how-to in the override.global.inc template. * Chive upgrade to 0.4.2 * Nginx upgrade to 1.0.4 # Fixes: * OpenPublic password policy issue fixed on site install. * OpenScholar missing libraries issue fixed. * Issue #1213094 - FServer platform missing module fixed. * Mollom problem when running via (SSL) proxy fixed. * Issue #1209150 - always use _MY_OWNIP when defined. * Issue #1208386 - fix for broken csf configuration template. * Boost cache write permissions after site migration fixed. * Nginx config - better support for CiviCRM. * Issue #1198572 - do not run SMTP check if _SMTP_RELAY_HOST is set. * Forced PHP-FPM rebuild on MariaDB 5.2.7 upgrade. * Issue #1196006 - fixed Nginx X-Accel-Redirect support. * Security Issue #1197172 - bypass access restrictions to protected files fixed. * Issue #1182680 - fixed support for backup_migrate module. * Issue #1182582 - fixed search paths for node.js, image.jpg etc. * Critical Issue #1183500 #1182660 - fall back to the wildcard * in Nginx. * Issue #962188 - Nginx version check in vhost.tpl.php now works. * Issue #1170498 - Extra config variable was missing in Nginx config templates. * Percona upgrade path fixed. * Broken dev version of the backup_migrate module replaced with stable. * Use correct platforms versions numbers in the ftp symlinks. ### Stable Edition 1.0-boa-T-8.7 ### Date: Mon, 30 May 2011 11:40:00 +0200 ### Installs Ægir HEAD 1.1.2 1. Fixed critical issue with MariaDB upgrade from 5.1 to 5.2 2. Fixed critical issue with Nginx build. 3. Fixed critical issue with Feature Server platform build. 4. Added upgrade monitor. ### Stable Edition 1.0-boa-T-8.6 ### Date: Sun, 29 May 2011 13:30:00 +0200 ### Installs Ægir HEAD 1.1.2 ---------------------------------------- # Added or upgraded since January 2011 ---------------------------------------- * Added support for install and upgrade to Percona Server 5.5 * MariaDB server upgraded to version 5.2.6. * Nginx server upgraded to version Barracuda/1.0.2 * Added support for Debian Squeeze and Ubunty Natty. * Open Atrium includes extra features: Atrium Folders: http://bit.ly/oafolders Ideation: http://bit.ly/oaideation * Hostmaster platform comes with ready to enable extra modules: http://drupal.org/project/hosting_backup_queue http://drupal.org/project/hosting_backup_gc http://drupal.org/project/hosting_upload * New Octopus platforms: OpenPublic 1.0-beta1 --------- http://openpublicapp.com NodeStream 1.0 --------------- http://nodestream.org Drupal Commons 1.6 ----------- http://acquia.com/drupalcommons OpenScholar 2.0-beta10-1 ----- http://openscholar.harvard.edu Conference 1.0-alpha3 -------- http://usecod.com Open Enterprise 1.0-beta3 ---- http://leveltendesign.com/enterprise Acquia 7.2.2 ----------------- http://bit.ly/acquiadrupal Drupal Commerce 1.0-beta3 ---- http://drupalcommerce.org * Basic Drupal 6 and Drupal 7 platforms now come in three instances, to make your standard workflow easier for: -dev, -stage and -prod, with correct suffix: D.00x, S.00x and P.00x in the platform name. * Speed Booster cache for 5.x, 6.x and 7.x Drupal platforms. This new feature adds super fast caching for anonymous visitors, and yes! - also for logged in users (cache per user) directly on the web server level - no Drupal module required. It works for all platforms, except of Ubercart, Commerce and any platform with ubercart in sites/all/modules/ubercart. * Support for secure ubercart keys location to use ../keys path. * The filefield_nginx_progress now also in every 7.x platform. * Drush upgraded to version 4.4 * Drush Make upgraded to version 2.2 * Redis cache server upgraded to version 2.0.5 * PHP-FPM server upgraded to version 5.2.17 * APC upgraded to version 3.1.9 * Memcache extension replaced with memcached and libmemcached. * Chive database manager upgraded to version 0.4.1 * Added support for robotstxt module in all new 6.x based platforms. * Drush gm / generate-makefile command added as allowed to lshell. * Git over ssh added as allowed to lshell. ---------------------------------------- # Improvements since January 2011 ---------------------------------------- * Speed Booster now works also in the Ægir Master Instance. * Full Barracuda install takes only 30 minutes (tested on Linode). * Nginx abuse guard is now integrated with csf firewall. * Bots/crawlers are now denied on any "dev" type subdomain. * The pdnsd server install is now optional. * The csf/lfd firewall install is now optional. * Limited shell configuration is now updated on every upgrade. * Auto-tuning in Barracuda leaves more memory for MyISAM etc. * Ægir runs cron for D5 and D6 sites using Wget instead of Drush to leverage APC cache, while D7 can use built-in poormanscron. * Many improvements in the Speed Booster cache configuration. * Improved memcached/redis cache bins configuration. * The o_contrib modules now symlinked also in custom platforms. * Boost directories created automatically also in custom platforms. * Improved web server self-healing monitor. * PHP notices no longer displayed for dev subdomains, only errors. * Many improvements in the Nginx configuration - now it's faster. * Permissions on uploaded modules, themes and files are now automatically fixed every morning to help with post-import issues. * Almost all 6.x platforms now come with performance related modules already enabled and configured on site install by default. * Nginx config - now doesn't use php-fpm to serve fckeditor files. * Introduced possibility to add upgrade-safe custom Nginx rewrite rules to support transparent migration of legacy URLs/content. * Ægir Hostmaster control panel received extra caching and speed. * Better support for securepages 1.9 with forced secure cookies. * Better support for dynamically created base_url for http/https. * Too generic D7 profile names replaced with unique Drupal 7 names. * A few new commands have been added to your Ægir Drush Shell (SSH). * You can use git to manage the code and rsync to manage backups. * Useful new commands from Drush v.4 are now available. * Now it is possible to delete old sites backups created in Ægir. * You can access Ægir backups also via SSH or SFTP/FTPS. * You can cancel queued task in Ægir before it is started. * The "dev" anywhere in the subdomain enables all PHP errors. * You can use "dev" type alias for live site for easier debugging. * Added support for imagecache_external module. * It is possible to safely delete any not used platforms on request. * Access to static files allowed only for currently used domain. * Added crossdomain.xml in the root of every new platform. * New rewrite introduced to map /files to /sites/domain/files, /images to /sites/domain/files/images and /downloads to /sites/domain/files/downloads. * The standard /update.php works again, however using "drush dbup" command is recommended. * The "drush mup" command allows now to upgrade contributed modules. ---------------------------------------- # Fixes since January 2011 ---------------------------------------- * Auto-healing no longer starts concurrent servers when InnoDB start takes more time on servers with big or many databases. * Hostname is no longer reverted to default on Linode and similar. * Barracuda supports now both old and new Mailx behavior. * All platforms paths and symlinks include core version numbers. * Fixed some memory issues with Virtuozzo family systems. * Fixed issue with broken site when non-lowercase domain was used on Migrate or Clone task. * Fixed upgrade path for Drupal 5 * Fixed double slash in the images paths issue in the Pressflow core. * Speed Booster cookies shouldn't be sent for imagecache/styles and AdvAgg module dynamic requests. * Speed Booster shouldn't cache imagecache/styles and AdvAgg module dynamic requests on the Nginx level. * Nginx upgrade to 1.0.0 fixes known issue with random but very high CPU load on Nginx server configuration reload/restart. * Fix for critical bug causing sessions issues on older sites without $cookie_domain set in settings.php when speed booster is enabled. * The session.cookie_secure is no longer forced in D6 platforms. * Security issue #1098304 - domain aliases were not sanitized. * Nginx config - proper fix for broken wysiwyg pop-ups. * Fixed issue with Nginx configuration for private files access. * The authorize.php added to allowed php files - required in D7. * Known issue with paths to files not rewritten is now fixed. * Known issue with sites cron semaphore in Ægir now resolved. * Known issue with PHP notices breaking some Ægir tasks resolved. * Fixed web server rewrites to support "ad" module. * Fixed Ægir issue with .info and .pl domains extensions. * Drush make via SSH now works as expected. * Fixed Nginx issue with /system/ paths and static files or images. * Fixed issue with broken site when non-lowercase domain was used. ---------------------------------------- # Other changes ---------------------------------------- * Forced public downloads for all 6.x platforms, except of ubercart. * Boost crawler option is now denied for performance reasons. * Forced log-out on browser quit only for Ægir control panel. ### Project and issue queue moved to Drupal.org ### Date: Sat, 7 May 2011 14:00:00 +0200 ### http://drupal.org/project/barracuda ### http://drupal.org/project/octopus ### Stable Edition 1.0-boa-T-8.5 ### Date: Tue, 3 May 2011 14:30:00 +0200 ### Installs Ægir stable 1.1 ### Stable Edition 1.0-boa-T-8.4 ### Date: Sun, 1 May 2011 23:30:00 +0200 ### Installs Ægir stable 1.1 ### Stable Edition 1.0-boa-T-8.3 ### Date: Sat, 30 Apr 2011 20:15:00 +0200 ### Installs Ægir stable 1.1 ### Stable Edition 1.0-boa-T-8.2 ### Date: Tue, 26 Apr 2011 21:45:00 +0200 ### Installs Ægir stable 1.1 ### Stable Edition 1.0-boa-T-8.1 ### Date: Wed, 20 Apr 2011 19:30:00 +0200 ### Installs Ægir stable 1.1 ### Stable Edition 1.0-boa-T-8 ### Date: Mon, 18 Apr 2011 20:15:00 +0200 ### Installs Ægir stable 1.0 ### Stable Edition 1.0-boa-T-5 ### Date: Fri, 8 Apr 2011 19:15:00 +0200 ### Installs Ægir working HEAD after 1.0-rc6 ### Stable Edition 1.0-boa-T-2 ### Date: Wed, 6 Apr 2011 01:34:40 +0200 ### Installs Ægir working HEAD before 1.0-rc3 ### Stable Edition 1.0-boa-T ### Date: Mon, 14 Mar 2011 02:43:15 +0100 ### Stable Edition 0.4-boa-C ### Date: Thu, 10 Feb 2011 04:41:57 +0100 ### For changes/improvements between 2010-09-24 and 2010-12-31 please see comments in the commits history. ### ### Thu, 2010-09-23 17:30 - Edition 0.4-HEAD-A14.B Added/Fixed: (upgrade for all pre-A14.A required) 1. Introducing default SSL Wildcard Nginx Proxy. Works for all sites/hostmaster instances on the same server and can be used also for encrypted connections to Chive and Collectd. Doesn't interfere even with SSL enabled sites on the same IP (with separate certs). 2. The redirects are now back and enhanced. Fully compatible with Nginx in any combination with aliases and SSL settings/modes. 3. Barracuda and Octopus by default installs still Ægir HEAD, but the latest alpha14 also works. 4. Octopus can define its separate IP address if available. 5. Fixed issue with too aggressive Hot Sauce check, causing creating not shared copies of code for platforms on every install or upgrade. 6. Barracuda and Octopus now allows to skip DNS test, to make it possible to install on any virtualbox with dynamic DNS/IP etc. There is no guarantee it will work, but another switch is now available, if someone needs it. 7. Octopus can now turn off local Memcache and Redis caches and switch all sites to use defined remote caches. 8. Forced /etc/apt/sources.list rewrite also before the Barracuda system upgrade. 9. Fix for the already installed and possibly broken git-core. 10. Fix for Ægir sites with .info domains, the path alias should now work without 403 error. ### Fri, 2010-09-17 11:00 - Edition 0.4-HEAD-A14.A Added/Fixed: (upgrade required) 1. Barracuda and Octopus by default installs now Ægir HEAD to use the fix for critical issue on sites import. It will be included in alpha14, please don't use alpha13. 2. Debian Lenny on 32bit systems works again. Fix for broken git-core after upgrade to version: 1:1.5.6.5-3+lenny3.1 on Lenny 32bit. 3. Fix and better inline warnings/info about missing locales at Linode and RackSpaceCloud. 4. More details in the installer log for better debugging and version tracking. 5. E-mail address for alerts on database repair started by auto-healing now correctly replaced. 6. Redis for Lenny now built from sources due to apt version moved already to Squeeze. 7. Critical bugfix for failed platforms install when hostmaster is not upgraded. 8. Introducing simple edition archive: http://omega8.cc/dev/bo-a14a.tar.gz 9. Octopus now better supports using newer shared code for platforms and introduces new setting: _HOT_SAUCE to allow forced fresh/hot code. ### Tue, 2010-09-12 21:50 - Edition 0.4-HEAD-A13.A Added/Fixed: (upgrade recommended) 1. Octopus now creates SSH/FTPS separate, non-aegir account for every Ægir Satellite Instance, with limited shell to avoid using commands like "drush up" since they should never be used on sites managed in the Ægir system. 2. Octopus now by default sends a welcome email with some useful intro information and access details to the address defined as _CLIENT_EMAIL. 3. When Octopus is used the first time to create an Ægir Satellite Instance, it doesn't allow to skip installing all platforms, since it is recommended to add all available platforms with initial install, for easier re-using the code by next Ægir Satellite Instances. 4. The second and all future non-core Hostmaster installs allow to choose one or more platforms or to skip adding platforms at all. 5. Octopus by default honors initial domain used for the Ægir Satellite Instance on every upgrade to avoid mistakes with using different copies of the script for different Ægir Satellite Instances upgrades. 6. Also Barracuda will always honor initial domain used for the core Hostmaster to avoid mistakes on upgrade when you don't use the original version of the script. 7. Better checks if the script is running as root. 8. Removed memcache module since cache is used. 9. SMTP connection test is now optional. 10. Nginx version set to 0.8.50. 11. By default Ægir 0.4-HEAD instead of alpha13 is now installed to fix critical issues with importing sites. See also: http://drupal.org/node/907248 12. Solr and Chive are now optional (Yes/no). 13. Added optional install of Collectd monitor. 14. Fixed issue with SSL mode. 15. Better compatibility for upgrades from pre-Barracuda Nginx installs. 16. Now it doesn't start cron before completing all install tasks to avoid breaking spinner. 17. Both Barracuda and Octopus now can better support re-starting stopped install/upgrade. 18. Octopus now refuses to run if defined domain doesn't resolve yet to the server IP address. 19. Octopus now refuses to run on system not created initially by Barracuda installer. 20. Custom FQDN hostname is now forced (if defined) in Barracuda before running DNS checks. 21. Fix for some missing mime types in vanilla Nginx. 22. Updated versions of Open Atrium, Drupal Commons and Cocomore Drupal distros installed by Octopus. 23. Lowered memory defaults in the MariaDB configuration. ### Tue, 2010-08-31 23:50 - Edition 0.4-HEAD-A12.D Added/Fixed: (upgrade recommended because it works!) 1. Upgrade of Ægir Master Instance by Barracuda and upgrade of Ægir Satellite Instances by Octopus finally works as expected. 2. It is now possible to use Barracuda to install environment and Ægir Master Instance, to upgrade only environment, to upgrade only Ægir Master Instance, or both at the same time. 3. Octopus now can separately install and/or upgrade any Ægir Satellite Instance or any platform on any instance, separately, using detailed prompt with version numbers and links to distributions home pages. 4. New platform Cocomore Drupal added in Octopus: http://drupal.cocomore.com ### Sat, 2010-08-28 20:15 - Edition 0.4-HEAD-A12.C Added/Fixed: (upgrade recommended) 1. By default Ægir 0.4-HEAD with Drush 3.3 is now installed to fix critical issues with importing sites. The fix is also available as a patch for alpha12: http://drupal.org/node/882970#comment-3382542 2. Both Barracuda and Octopus now allow to choose if the Ægir Hostmaster will be upgraded or not. 3. Added versions numbers and links to all platforms Yes/no prompts. 4. /tmp directory no longer used to avoid problems due to secure noexec mount. 5. Improved readme and docs (in progress). 6. Removed old, no longer supported installer. ### Fri, 2010-08-27 04:15 - Edition 0.4-alpha12-A12.B Added/Fixed: (upgrade optional) 1. Octopus now allows to install or upgrade only Ægir Satellite Instance without any platforms added. 2. Enabled again early exit on the first error to avoid confusing cascade of errors if something went wrong. 3. Both Barracuda and Octopus runs now faster. ### Thu, 2010-08-26 19:30 - Edition 0.4-alpha12-A12.A Added/Fixed: (upgrade from previous versions recommended) 1. Barracuda now includes multicore Apache Solr Search, Redis and Memcache. 2. Barracuda now can upgrade packages selectively. Just run it again to upgrade the system and the Ægir Master Instance. 3. Octopus can create many Ægir Satellite Instances on the same server, each with different set of platforms, but with ability to share the code between instances, so you can use this system even on the low end VPS. 4. Chive database manager added by default with db. subdomain (may require dns entry or wildcard). ### Thu, 2010-08-26 08:55 - Edition 0.4-alpha12-A12.A Added/Fixed: (upgrade from previous versions recommended) 1. By default Ægir 0.4-alpha12 with Drush 3.3 is now installed. 2. Introduced new Octopus and Barracuda installers. See README.txt for more information. Both are in pre-alpha debugging phase. 3. All installers code and helpers now hosted on GitHub. ### Thu, 2010-08-18 21:30 - Edition 0.4-HEAD-A11.B Added/Fixed: (upgrade from previous versions recommended) 1. By default Ægir 0.4-HEAD with Drush 3.3 is now installed. 2. Introduced support for Virtuozzo/OpenVZ IP address automatic discovery. ### Thu, 2010-08-12 22:15 - Edition 0.4-alpha11-A11.A Added/Fixed: (upgrade from previous versions recommended) 1. By default Ægir 0.4-alpha11 with Drush 3.3 is now installed. 2. PHP-FPM version is now 5.2.14. 3. Improved UX - only interesting status messages are now displayed. 4. Hostmaster root directory now properly named using Ægir version: '-0.4-alpha11' or '-HEAD'. ### Thu, 2010-08-12 06:10 - Edition 0.4-alpha10-A10.A Added/Fixed: (upgrade from previous versions recommended) 1. By default Ægir 0.4-alpha10 with Drush 3.3 is now installed. 2. Nginx version is now 0.8.49, MariaDB is 5.1.49 and Drupal is 6.19. 3. Fixed freezing request on the first /admin hit. 4. Better tuned Nginx, PHP-FPM and MariaDB settings. 5. Various small improvements in the code. ### Thu, 2010-08-07 06:10 - Edition 0.4-alpha9-A9.F Added/Fixed: (upgrade of existing installs not required) 1. By default latest HEAD from git.aegirproject.org is now installed, due to critical bug found, see this for details: http://drupal.org/node/874716 The default install will be reverted to 0.4-alpha10 when it will be released. You can use 0.4-alpha9 with caution (just don't use remote servers new feature to stay safe). 2. Fixed problem with setting up FQDN hostname on Linode based servers. The fix can help also with other providers probably. 3. Installer now writes date and version used in file: /var/aegir/config/includes/installer_version.txt ### Thu, 2010-08-05 22:00 Added/Fixed: (upgrade of existing installs not required) 1. Fixed critical problem with Drush broken due to change of URL to the required php library: http://drupal.org/node/875196 2. Ægir version is now configurable. By default latest 0.4-alpha9 will be installed, but it is also possible to install latest HEAD from git.aegirproject.org. 3. Ægir front-end (sub)domain is now configurable and can be different than machine FQDN hostname. 4. Machine FQDN hostname and IP is now configurable. 5. Nginx version updated to 0.8.48. 6. Fixed progress spinner on Ubuntu. 7. Fixed problem with automatic ionCube loader discovery of required version 32/64 bit. ### Mon, 2010-08-02 01:08 Added/Fixed: 1. Added automatic, full support for Ubuntu Lucid and Karmic. 2. If there is no FQDN hostname, we are trying to set it using reverse IP hostname, if exists. 3. Now we are trying both `uname -n` and `hostname -f` to make sure if the FQDN hostname is already set, but not available with `uname -n` test. 4. Added support for ionCube Loader with automatic discovery of required version 32/64 bit. ### Sat, 2010-07-31 18:00 Added/Fixed: 1. Simplified installer by removing unnecessary duplicate prompts in the original embedded install script. 2. Check for SMTP outgoing port 25 now fully automated. 3. Even more fun added :) ### Fri, 2010-07-30 19:00 Added/Removed: 1. New all-in-one installer for Debian 5.0 Lenny Ægir 0.4-alpha9 compatible. 2. Removed deprecated scripts & how-to. ### Sat, 2010-02-06 23:55 Added/Fixed: 1. Missing --with-libevent=shared added in php-fpm-install.txt http://github.com/omega8cc/boa/issues/#issue/2 2. Debian specific stuff added in php-fpm-install.txt to allow easy install on vanilla vps. 3. Xcache replaced with APC and Memcache install added. ### Wed, 2010-02-03 06:37 Added/Fixed: 1. mkdir for required cache dirs added in nginx-install.txt http://github.com/omega8cc/boa/issues#issue/1 ### Fri, 2010-01-29 06:37 Added/Fixed: 1. FCKeditor/CKEditor fix for .xml files. 2. Security: deny direct access to backup_migrate directory. ### Mon, 2010-01-11 01:46 1. Added custom fix required only when using purl, spaces & og for modules: ajax_comments, watcher and fasttoggle. 2. Simplified rewrite rules for location @drupal resolves also some problems with imagecache. 3. Changed order of try_files for Boost to match newer version of dirs structure first. ### Tue, 2009-12-01 16:19 Added/Fixed: 1. Latest Boost compatibility for /cache/normal & /cache/perm. 2. Json cache for Boost added. 3. Fix for xml/feed Boost cache files with .html extension. 4. Fix for xml/feed Boost cache correct mime type. ================================================ FILE: DIFFERENT30Y.md ================================================ # 30 Years of Heritage We are unique within the hosting industry for many important reasons. Our 15 years of Ægir-based hosting, plus earlier experience with Adgrafix (the first company to offer a control panel for website management in 1995), have helped shape what makes us different today. Fun fact: Robert “Bo” Bennett, the founder of Adgrafix, started as a self-taught programmer and created the world's first web hosting control panel entirely in Perl. We continued to build on that fundation for almost ten years, adding shopping cart and marketing tools and the early BOA version -- everything in Perl. Why not in PHP? Because PHP was still in its infancy, since its early prototype 1.0 was released in June 1995 by Rasmus Lerdorf, while Perl 4 had been out since 1991 and was already a stable, mature, widely adopted language used both for server tools, websites backend and frontend. boa-on-excalibur ## Why We’re Different We avoid marketing noise. Think of us like your electricity provider — reliable, fast, essential. You know we’re there, running everything **silently and smoothly** in the background. No need for constant attention or distractions. ## Focus, focus, focus — like no one else Our website has been running on GravCMS for years, but our hosting and associated service itself is 100% Drupal-focused — and has been for 15 years. Others have tried and failed to stay focused, adding WordPress and a dozen other platforms. That’s not how you become **best-in-class, fastest, and most trusted** by the open-source community. ## Technological sovereignty We take **Open Source seriously** — it’s not a buzzword for us. It’s about freedom from corporate control. Here's a short look back at our 15-year Ægir journey and 19 years with Drupal. Our BOA system is the most complete solution of its kind. It has been designed from the ground up to make Drupal hosting **faster, easier, safer, and more efficient** — especially for teams that don’t want to get lost in DevOps. It was always built on Debian OS, but we never accepted systemd, imposed by Red Hat. After years of battling, we switched fully to **Devuan** — the true Debian fork without systemd, built by Debian veterans. At the same time, we stayed away from MariaDB, because it drifted away from MySQL compatibility and became vendor-focused. Instead, we adopted **Percona** — a truly open, compatible, and community-aligned database option. The same thing happened with Redis — the fast cache-in-memory server. As soon as Redis switched to a restrictive corporate license, we moved to the open-source **Valkey** fork. Bottom line: BOA is **architected around technological freedom and independence**. We work for you — not for Oracle, Red Hat, investors or proprietary agendas. That matters, especially for universities, NGOs, and businesses who rely on no-compromise sovereignty. Make your high-traffic demanding Drupal sites **Lightning Fast and Secure** with our [**Pro Hosted Plans »**](https://omega8.cc/pro) Ægir-BOA ## Support for legacy Drupal versions While Drupal 7 users were largely abandoned by core developers without an upgrade path to Drupal 8 and beyond, we still fully support Pressflow 6 and Drupal 7. We even maintain our own improved core forks, provide Drupal 7 LTS, and made Drupal 7 compatible with PHP 8.4 ages ago. Make your legacy Drupal sites **Fast and Secure** with our [**Basic Hosted Plans »**](https://omega8.cc/basic) ## Support for Ægir 3 and Drupal 11+ Many believed Ægir 3 would never support Drupal 9 — until we made it work. Same for Drupal 10. This year, we did it again and added Drupal 11 support to Ægir — a “mission impossible” at first glance. We recently took over the technical stewardship of Ægir 3 project, ensuring its future is bright. Make your modern Drupal sites **Blazing Fast and Secure** with our [**Advanced Hosted Plans »**](https://omega8.cc/advanced) ## 90-day backups running every six hours Your site backups (files + database) are securely stored via Backblaze with a full 90-day retention period — taken automatically every six hours. Far better than the industry-standard daily or weekly backups. You can also configure your own automatic backups, using any of 8 supported storage providers. Because there is no such thing in the universe like "too many backups". ## Drupal codebase upgrades powered by Jenkins We’ve built highly tailored CI/CD pipelines for Drupal, including custom Composer-based setups and multi-environment workflows. If you’ve never used CI/CD, we understand — it can be complex. The good news is that you can use it without any learning — if you’re tired of constant updates, PHP compatibility issues, or security patching — we can help using Jenkins wizardry in the backend, including same-day updates — check our [**Managed Drupal Updates Plans »**](https://omega8.cc/managed) **We’d be happy to show you how it all works and talk through how it could fit with your projects** — [**Contact Us Today! »**](https://omega8.cc/contact) to discuss your needs. ================================================ FILE: DUALLICENSE.md ================================================ # Dual License and BOA Branches Explained **BOA** remains a **Free/Libre Open Source Project**. While all of **BOA** code is **Free/Libre Open Source**, only the **BOA LTS** branch and **Ægir** are available without any cost or restrictions. - **LTS**: This public branch remains completely free to use without any commercial license, as it has been from the beginning (previously named HEAD or STABLE). This branch should be considered the **BOA Long Term Support** variant, with slow updates focused on security and bug fixes, and limited new features. - **DEV**: This public branch requires a commercial license for both installation and upgrades. It includes the latest features, security updates, bug fixes, and updated service versions. This branch should not be used in production without extensive testing. - **PRO**: This public branch requires a commercial license and is available only as an upgrade from either LTS or DEV (or previous HEAD/STABLE). It offers new releases once ready, closely following the tested DEV branch. - **OMM**: This private branch is managed separately, with some unused components removed and others added. It is generally simplified for easier maintenance and adheres to modern coding standards. You can install only **BOA LTS** and then upgrade to **PRO** with a license from [Omega8.cc](https://omega8.cc/licenses). ## **LTS** branch will enter a full code-freeze on December 31, 2025 Please note that **as of December 31, 2025, the LTS branch will enter a full code-freeze**. No further feature development or regular releases are planned for 2026. A possible re-evaluation may occur in 2027, but this should not be assumed. After the freeze, **only critical functional fixes within BOA itself will be considered**. There will be **no updates** for underlying components such as PHP, Percona, Nginx, Valkey, OpenSSL, OpenSSH, or related system libraries, although your barracuda will still be able to upgrade your system with newer Devuan packages. Several of the upcoming and most impactful features are planned **exclusively for BOA PRO**, as outlined in the [ROADMAP](https://github.com/omega8cc/boa/tree/5.x-dev/ROADMAP.md). For continued access to new features, ongoing improvements, and a future-proof stack, [BOA PRO](https://omega8.cc/licenses) is the recommended upgrade path. ## Practical Differences Between **LTS** and **PRO** Over time, **PRO** will be ahead of **LTS** as its name suggests. The `BOA-5.9.1` release is the last parallel release including all features developed for **PRO**, so both **PRO** and **LTS** users will enjoy the same improvements, bug fixes, and new features. In the future, new features will be regularly added to **PRO**, while **LTS** will receive only security updates and critical fixes for BOA itself. There may be exceptions, and some new features may find their way to **LTS**, but only as exceptions. The **PRO** will be available in three main variants, and while all **BOA PRO** licenses will grant access to the same **BOA PRO** branch and features, they will differ in terms of available support levels. ### **PRO** with **Basic Support** This license is designed for **BOA** users familiar with managing and monitoring their own systems who don't need extended support, monitoring, or assistance in managing their **BOA** installation and updates. Our support is limited to the Issue Queue on GitHub without any kind of SLA or Best Effort guarantee. Ideal for: Small businesses or developers who need basic support and can handle issues independently or with community help. ### **PRO** with **Advanced Support** This license is designed for **BOA** users who are familiar with managing their own server but need assistance in handling their custom needs or fixing individual problems privately via our helpdesk at [Ægir Helpdesk](https://aegir.happyfox.com), without posting details on GitHub. There is no SLA guarantee, only a Best Effort guarantee. System local and remote uptime monitoring with Site24x7 is included. Ideal for: Medium to large businesses needing reliable support during business hours with quick response times for critical issues. ### **PRO** with **Hands-Off Experience** This license is for **BOA** users who prefer to delegate all the work needed to maintain their **BOA** server, including regular upgrades (both **BOA** and major OS upgrades), active monitoring, and responding to DoS incidents. It comes with a fully managed **BOA PRO** installation you can use without worrying about anything else, with our general SLA guarantee applied: [Omega8.cc SLA](https://omega8.cc/sla). System local and remote uptime monitoring with Site24x7 is included. Ideal for: Enterprises requiring comprehensive, around-the-clock support with quick response times for all issues. You can obtain a **BOA PRO** license from [Omega8.cc](https://omega8.cc/licenses). ## Upcoming **PRO-Only** Features Certain planned features are likely to be exclusive to **BOA PRO**. If these features are added to other **BOA** versions, it will be with a significant delay. Check out the details in [ROADMAP](https://github.com/omega8cc/boa/tree/5.x-dev/ROADMAP.md) ================================================ FILE: HTTP3.md ================================================ # Strap in, your sites are getting an F1 engine We’re rolling out a meaningful upgrade across BOA/Omega8.cc nodes: HTTP/3 and KTLS support. If you run Drupal sites that should feel fast and responsive (and stay that way during spikes), this is genuinely good news. It’s not a “new feature in the control panel” kind of update — it’s the kind that improves the *experience* visitors have without you touching a single line of code. ## Why this is a big deal Nearly everything on the web is encrypted now (HTTPS). That’s great for security, but it also means every visit involves extra work just to establish and maintain that secure connection. The upgrades are all about making secure browsing feel lighter and faster. ### What visitors should notice * Faster “start” to loading (especially for first-time or returning visits after a while) * Smoother browsing on mobile and Wi-Fi (fewer annoying stalls when the connection quality changes) * More consistent performance during traffic spikes (less overhead spent on transport/encryption, more resources left for actual Drupal work) ### Why it matters for *your server* too * More efficient HTTPS handling can mean lower CPU pressure in the busiest parts of the request path. * That translates into more headroom for PHP-FPM, caches, and database work when it really counts. In short: faster for users, more efficient for servers, and no application changes required. screenshot 2026-02-05 at 10 35 06 ## What’s being enabled (friendly version) ### HTTP/3 HTTP/3 is the newest “dialect” browsers can use to talk to your site. It’s designed for today’s reality: phones, roaming, Wi-Fi, variable quality connections. When a visitor’s browser supports HTTP/3, it can: * connect more quickly, * recover better from “internet wobble,” * and keep page loads feeling responsive even when conditions aren’t perfect. And the best part: browsers choose it automatically. Nobody needs to configure anything on their device. ### KTLS KTLS helps the operating system handle part of the secure connection workload more efficiently. The result is simpler to describe than the internals: * less overhead * more throughput * better stability under load It’s one of those improvements that quietly makes a platform feel “stronger” and less stressed during peak times. ## What you need to do (this is the important part) We’ll make sure the server side is ready after the upgrades — but to actually *apply* the new capabilities cleanly across your BOA/Ægir-managed stack, you need to run Verify so configurations are regenerated with the updated features. ### After the maintenance completes: 1. Log in to your Ægir Control Panel 2. Go to Platforms → run Verify on all platforms you use to host sites 3. Go to Sites → run Verify on your hosted sites * If you host many sites: use the bulk actions on the Sites list so you don’t have to click site-by-site. This ensures your platform and site configs are refreshed and the upgraded stack is applied consistently. ## “Will anything break?” (No — it’s designed not to) * If a browser supports HTTP/3, it will use it automatically. * If it doesn’t, it will quietly fall back to HTTP/2 or HTTP/1.1. * Your Drupal code stays the same. * Your visitors don’t have to do anything. ## Want more detail? We’ll publish our own concise, friendly explainer that goes deeper into: * what HTTP/3 changes in real-life browsing, * why KTLS improves HTTPS efficiency, * and how to confirm your browser is using HTTP/3. More details: *(link coming soon — we’ll share it as soon as it’s live)* ## Quick checklist (save this) After the system upgrade: 1. Ægir → Platforms → Verify (all platforms) 2. Ægir → Sites → Verify (use bulk actions if you have many sites) That’s it. Once Verify is done, you’re ready to benefit automatically — and your visitors get a faster, smoother ride. Enjoy! ================================================ FILE: OCTOPUS.sh.txt ================================================ #!/bin/bash ###----------------------------------------### ### ### Octopus Ægir Installer ### ### Copyright (C) 2009-2026 Omega8.cc ### noc@omega8.cc www.omega8.cc ### ### This program is free software. You can ### redistribute it and/or modify it under ### the terms of the GNU GPL as published by ### the Free Software Foundation, version 2 ### or later. ### ### This program is distributed in the hope ### that it will be useful, but WITHOUT ANY ### WARRANTY; without even the implied ### warranty of MERCHANTABILITY or FITNESS ### FOR A PARTICULAR PURPOSE. See the GNU GPL ### for more details. ### ### You should have received a copy of the ### GNU GPL along with this program. ### If not, see http://www.gnu.org/licenses/ ### ### Code: https://github.com/omega8cc/boa ### ###----------------------------------------### export PATH=/usr/local/bin:/usr/local/sbin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin:/usr/libexec export SHELL=/bin/bash ### ### Default values for main Octopus instance variables ### _USER=o1 _MY_OCTO_EMAIL="noc@omega8.cc" _CLIENT_EMAIL="notify@omega8.cc" _CLIENT_OPTION=POWER _CLIENT_SUBSCR=M _CLIENT_CORES=1 ### ### Required by AegirSetupA script, running in ### the same env, to avoid chicken/egg race. ### export _USER="${_USER}" ### ### Drush and Redis Variables ### export _DRUSH_VERSION=8.5.0.5 export _REDIS_C_VERSION=com-19-04-2021 export _REDIS_L_VERSION=7.x-3.19.1 export _REDIS_N_VERSION=com-19-04-2021 export _REDIS_T_VERSION=8.x-1.8.2 export _REDIS_E_VERSION=8.x-1.11.2 ### ### Drupal Core Versions ### export _SMALLCORE10_0_V=10.0.11 export _SMALLCORE10_1_V=10.1.8 export _SMALLCORE10_2_V=10.2.12 export _SMALLCORE10_3_V=10.3.14 export _SMALLCORE10_4_V=10.4.9 export _SMALLCORE10_5_V=10.5.8 export _SMALLCORE10_6_V=10.6.3 export _SMALLCORE11_1_V=11.1.9 export _SMALLCORE11_2_V=11.2.10 export _SMALLCORE11_3_V=11.3.3 export _SMALLCORE6_V=6.60.1 export _SMALLCORE7_V=7.105.1 export _SMALLCORE9_V=9.5.11 ### ### Drupal Core Variables ### export _DRUPAL10_0="drupal-${_SMALLCORE10_0_V}" export _DRUPAL10_1="drupal-${_SMALLCORE10_1_V}" export _DRUPAL10_2="drupal-${_SMALLCORE10_2_V}" export _DRUPAL10_3="drupal-${_SMALLCORE10_3_V}" export _DRUPAL10_4="drupal-${_SMALLCORE10_4_V}" export _DRUPAL10_5="drupal-${_SMALLCORE10_5_V}" export _DRUPAL10_6="drupal-${_SMALLCORE10_6_V}" export _DRUPAL11_1="drupal-${_SMALLCORE11_1_V}" export _DRUPAL11_2="drupal-${_SMALLCORE11_2_V}" export _DRUPAL11_3="drupal-${_SMALLCORE11_3_V}" export _DRUPAL6="pressflow-${_SMALLCORE6_V}" export _DRUPAL7="drupal-${_SMALLCORE7_V}" export _DRUPAL9="drupal-${_SMALLCORE9_V}" export _DRUPAL6_D="${_DRUPAL6}-dev" export _DRUPAL6_P="${_DRUPAL6}-prod" export _DRUPAL6_S="${_DRUPAL6}-stage" export _DRUPAL7_D="${_DRUPAL7}-dev" export _DRUPAL7_P="${_DRUPAL7}-prod" export _DRUPAL7_S="${_DRUPAL7}-stage" export _DRUPAL9_D="${_DRUPAL9}-dev" export _DRUPAL9_P="${_DRUPAL9}-prod" export _DRUPAL9_S="${_DRUPAL9}-stage" export _DRUPAL10_0_D="${_DRUPAL10_0}-dev" export _DRUPAL10_0_P="${_DRUPAL10_0}-prod" export _DRUPAL10_0_S="${_DRUPAL10_0}-stage" export _DRUPAL10_1_D="${_DRUPAL10_1}-dev" export _DRUPAL10_1_P="${_DRUPAL10_1}-prod" export _DRUPAL10_1_S="${_DRUPAL10_1}-stage" export _DRUPAL10_2_D="${_DRUPAL10_2}-dev" export _DRUPAL10_2_P="${_DRUPAL10_2}-prod" export _DRUPAL10_2_S="${_DRUPAL10_2}-stage" export _DRUPAL10_3_D="${_DRUPAL10_3}-dev" export _DRUPAL10_3_P="${_DRUPAL10_3}-prod" export _DRUPAL10_3_S="${_DRUPAL10_3}-stage" export _DRUPAL10_4_D="${_DRUPAL10_4}-dev" export _DRUPAL10_4_P="${_DRUPAL10_4}-prod" export _DRUPAL10_4_S="${_DRUPAL10_4}-stage" export _DRUPAL10_5_D="${_DRUPAL10_5}-dev" export _DRUPAL10_5_P="${_DRUPAL10_5}-prod" export _DRUPAL10_5_S="${_DRUPAL10_5}-stage" export _DRUPAL10_6_D="${_DRUPAL10_6}-dev" export _DRUPAL10_6_P="${_DRUPAL10_6}-prod" export _DRUPAL10_6_S="${_DRUPAL10_6}-stage" export _DRUPAL11_1_D="${_DRUPAL11_1}-dev" export _DRUPAL11_1_P="${_DRUPAL11_1}-prod" export _DRUPAL11_1_S="${_DRUPAL11_1}-stage" export _DRUPAL11_2_D="${_DRUPAL11_2}-dev" export _DRUPAL11_2_P="${_DRUPAL11_2}-prod" export _DRUPAL11_2_S="${_DRUPAL11_2}-stage" export _DRUPAL11_3_D="${_DRUPAL11_3}-dev" export _DRUPAL11_3_P="${_DRUPAL11_3}-prod" export _DRUPAL11_3_S="${_DRUPAL11_3}-stage" export _SPINNER=NO export _T_BUILD=SRC export _USRG=users export _WEBG=www-data if [ -n "${STY+x}" ]; then export _SPINNER=NO fi export _F_TIME="$(date)" ### ### Instance specific variables ### export _WEB="${_USER}.web" export _DOMAIN="${_USER}.$(cat /etc/hostname 2>/dev/null | tr -d '\n' || hostname -f 2>/dev/null)" export _ROOT="/data/disk/${_USER}" export _THIS_DB_PORT=3306 export _octCnf="/root/.${_USER}.octopus.cnf" export _octInc="${_ROOT}/config/includes" export _octTpl="${_ROOT}/.drush/sys/provision/http/Provision/Config/Nginx" export _octSetTpl="${_ROOT}/.drush/sys/provision/Provision/Config/Drupal" ### ### Helper variables ### export _bldPth="/opt/tmp/boa" export _crlGet="-L --max-redirs 3 -k -s --retry 9 --retry-delay 9 -A iCab" export _wgetGet="--max-redirect=3 --no-check-certificate -q --tries=9 --wait=9 --user-agent='iCab'" export _filIncO="octopus.sh.cnf" export _gCb="git clone --branch" export _gitHub="https://github.com/omega8cc" export _gitLab="https://gitlab.com/omega8cc" export _libFnc="${_bldPth}/lib/functions" export _tocIncO="${_filIncO}.${_USER}" export _vBs="/var/backups" ### ### Avoid too many questions ### export DEBIAN_FRONTEND=noninteractive export APT_LISTCHANGES_FRONTEND=none if [ -z "${TERM+x}" ]; then export TERM=vt100 fi ### ### Clean pid files on exit ### _clean_pid_exit() { if [ -n "${1}" ]; then echo "REASON ${1} on $(date)" >> /root/.octopus.sh.exit.exceptions.log [ -e "/opt/tmp/boa" ] && rm -rf /opt/tmp/* fi [ -e "/run/boa_wait.pid" ] && rm -f /run/boa_wait.pid [ -e "/run/boa_run.pid" ] && rm -f /run/boa_run.pid service cron start &> /dev/null exit 1 } ### ### Panic on missing include ### _panic_exit() { echo echo " EXIT: Required lib file not available?" echo " EXIT: $1" echo " EXIT: Cannot continue" echo " EXIT: Bye (0)" echo _clean_pid_exit _panic_exit_a } ### ### Include default settings and basic functions ### if [ -e "${_vBs}/${_tocIncO}" ]; then source "${_vBs}/${_tocIncO}" _tInc="${_vBs}/${_tocIncO}" elif [ -e "${_vBs}/${_filIncO}" ]; then source "${_vBs}/${_filIncO}" _tInc="${_vBs}/${_filIncO}" else _panic_exit "${_tInc}" fi ### ### Download helpers and libs ### if [ "${_OS_CODE}" = "excalibur" ]; then _DB_SERVER=Percona else _DB_SERVER=Percona fi if [ "$(boa info | grep -c ${_DB_SERVER})" -lt 3 ] || [ ! -e "/usr/sbin/csf" ]; then if [ ! -e "/opt/tmp/boa/aegir/helpers/apt.conf.noi.nrml" ] \ || [ ! -e "/opt/tmp/boa/aegir/helpers/apt.conf.noi.dist" ]; then _download_helpers_libs fi else _download_helpers_libs fi ### ### Include shared functions ### _FL="helper dns satellite" for f in ${_FL}; do [ -r "${_libFnc}/${f}.sh.inc" ] || _panic_exit "${f}" source "${_libFnc}/${f}.sh.inc" done ### ### Welcome msg ### echo " " _msg "Skynet Agent v.${_X_VERSION} on $(dmidecode -s system-manufacturer 2>&1) welcomes you aboard!" echo " " sleep 3 ### ### Turn Off AppArmor while running octopus ### _turn_off_apparmor_in_octopus ### ### Unlock sendmail for allow-snail group ### _unlock_sendmail_for_snail ### ### Switch to dash while running octopus ### _switch_to_dash_in_octopus ### ### More local default variables ### _LASTNUM=001 _LAST_HMR=001 _LAST_ALL=001 _DISTRO=001 _HM_DISTRO=001 _ALL_DISTRO=001 _STATUS=INIT ### ### Misc checks ### _satellite_check_php_compatibility _satellite_check_octopus_vs_barracuda_ver _satellite_if_head_github_connection_test _satellite_if_sql_exception_test _satellite_if_running_as_root_octopus _satellite_check_sanitize_user_name _satellite_if_localhost_mode_magic _satellite_check_sanitize_domain_name _satellite_detect_vm_family _check_git_repos ### ### Main procedures ### _satellite_cnf _satellite_if_init_or_upgrade _satellite_if_major_upgrade _satellite_if_check_dns _satellite_checkpoint _satellite_pre_cleanup _satellite_make _satellite_post_cleanup exit 0 ###----------------------------------------### ### ### Octopus Ægir Installer ### Copyright (C) 2009-2026 Omega8.cc ### noc@omega8.cc www.omega8.cc ### ###----------------------------------------### ================================================ FILE: README.md ================================================ # Welcome to BOA! BOA stands for Barracuda, Octopus, and Ægir—a high-performance LEMP stack supporting Drupal from Pressflow 6 to the latest Drupal 11, as well as Backdrop CMS and Grav CMS (soon). ## Strap in, your sites are getting an F1 engine We’re rolling out a meaningful upgrade across BOA/Omega8.cc nodes: HTTP/3 and KTLS support. If you run Drupal sites that should feel fast and responsive (and stay that way during spikes), this is genuinely good news. Why this is a big deal? What visitors should notice? Why it matters for *your server* too [**Read the full story!**](https://github.com/omega8cc/boa/tree/5.x-dev/HTTP3.md) ## 30 Years of Heritage We are unique within the hosting industry for many important reasons. Our 15 years of Ægir-based hosting, plus earlier experience with Adgrafix (the first company to offer a control panel for website management in 1995), have helped shape what makes us different today. We take **Open Source seriously** — it’s not a buzzword for us. It’s about freedom from corporate control. Here's a short look back at our 15-year Ægir journey and 19 years with Drupal. [**Read the full story!**](https://github.com/omega8cc/boa/tree/5.x-dev/DIFFERENT30Y.md) ## What is Ægir? Ægir, named after the Norse god of the sea, is an open-source hosting system for managing multiple Drupal sites. The name Ægir was chosen to reflect the relationship between Drupal's water drop logo, symbolizing individual sites, and Ægir's role as the god of the ocean, representing the hosting of many Drupal sites together. It automates tasks such as site installation, upgrades, and maintenance, making your life easier. **Announcement from Omega8.cc team**: [**The Future of Ægir 3 is Bryght!**](https://github.com/omega8cc/boa/tree/5.x-dev/ANNOUNCEMENT.md) ### Key Features of Ægir: - **Site Management**: Manage multiple Drupal sites from a single interface. - **Automation**: Automate code deployment, database updates, and site backups. - **Scalability**: Easily scale your Drupal hosting infrastructure. - **Multitenancy**: Share a codebase across multiple sites with separate databases. - **Open-Source**: Customize and extend Ægir to fit your needs. - **Integration with Drush**: Use powerful command-line tools for site administration. Ægir-BOA ## Why Barracuda? Barracuda is a specially tuned hosting environment for Ægir, designed to be lightning fast and agile, just like the barracuda fish known for its incredible speed and agility in the ocean. ## Why Octopus? Octopus is a smart system designed to manage multiple Ægir instances within Barracuda. Just like the sea creature with eight limbs, Octopus allows you to create and manage many separate but connected Ægir instances, showcasing its intelligence and adaptability in efficiently handling complex hosting environments. ## Dual License **BOA** remains a **Free/Libre Open Source Project**. While all of **BOA** code is **Free/Libre Open Source**, only the **BOA LTS** branch and **Ægir** are available without any cost or restrictions. Check out the details in [**DUALLICENSE.md**](https://github.com/omega8cc/boa/tree/5.x-dev/DUALLICENSE.md). ## BOA Priorities - **High Performance**: Ensure your sites run fast. - **Security**: Keep your sites and system secure. - **Automation**: Minimize daily maintenance with automated system and OS upgrades. ## Multi-Ægir Hosting Leverage one Ægir Master Instance and multiple Satellite Instances. Use Satellite Instances to host your sites, as the Master holds the central Nginx configuration. Note: The 'Master' and 'Satellite' names in the Barracuda/Octopus context are not related to the multi-server Ægir features but to the multi-instance environment with virtual chroot/jail for each Ægir Satellite instance. ## Installation Scripts - **BOA**: Runs Barracuda and Octopus to install complete BOA system. - **BARRACUDA**: Upgrades the system and the Ægir Master Instance. - **OCTOPUS**: Updates Ægir Instances + Drupal platforms. ## Bug Reporting Follow the guidelines in [**docs/CONTRIBUTING.md**](https://github.com/omega8cc/boa/tree/5.x-dev/docs/CONTRIBUTING.md). ## Requirements - Basic sysadmin skills and experience. - Willingness to accept BOA PI (paranoid idiosyncrasies). - Minimum 4 GB RAM and 2 CPUs (8 GB RAM and 4+ CPUs with Solr). - SSH (ed25519) keys for root are required by newer OpenSSH versions used in BOA. - Wget must be installed. - Open outgoing TCP ports: 25, 53, 80, 443. - Locales with UTF-8 support, otherwise en_US.UTF-8 (default) is forced. ## Provided Services and Features Check out the details in [**docs/PROVIDES.md**](https://github.com/omega8cc/boa/tree/5.x-dev/docs/PROVIDES.md). ## Supported Virtualization Systems - Linux Containers (LXC) - Linux KVM guest - Microsoft Hyper-V - OpenVZ Containers - Parallels guest - Red Hat KVM guest - VirtualBox guest - VMware ESXi guest (but excluding vCloud Air) - VServer guest - Xen guest - Xen guest fully virtualized (HVM) - Xen paravirtualized guest domain ## Supported Operating Systems boa-on-excalibur ### Devuan (recommended) - Excalibur (supported, but only with Percona 8.4) - Daedalus (default, with Percona 5.7, 8.0 or 8.4) - Chimaera (supported but upgrade recommended) - Beowulf (supported for upgrades) ### Debian (for migration) - Trixie (supported only as a base for migration to Devuan) - Bookworm (supported only as a base for migration to Devuan) - Bullseye (supported only as a base for migration to Devuan) - Buster (supported only as a base for migration to Devuan) - Stretch (deprecated but still works, please upgrade to Chimaera) - Jessie (deprecated but still works, please upgrade to Chimaera) ## Project Roadmap Check out the details in [**ROADMAP.md**](https://github.com/omega8cc/boa/tree/5.x-dev/ROADMAP.md) ## Documentation and Templates - Installation Instructions: [docs/INSTALL.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/INSTALL.md) - Upgrade Instructions: [docs/UPGRADE.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/UPGRADE.md) - Major-Upgrade Instructions: [docs/MAJORUPGRADE.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/MAJORUPGRADE.md) - Importance of Keeping SKYNET Enabled in BOA: [docs/SKYNET.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/SKYNET.md) - INI configuration per site: [docs/ini/site/INI.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/ini/site/INI.md) - INI configuration per platform: [docs/ini/platform/INI.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/ini/platform/INI.md) - Configuration Templates: [docs/cnf/barracuda.cnf](https://github.com/omega8cc/boa/tree/5.x-dev/docs/cnf/barracuda.cnf), [docs/cnf/octopus.cnf](https://github.com/omega8cc/boa/tree/5.x-dev/docs/cnf/octopus.cnf) - System Control Files Index: [docs/ctrl/system.ctrl](https://github.com/omega8cc/boa/tree/5.x-dev/docs/ctrl/system.ctrl) - How we build newer codebases for testing: [docs/BUILDTESTS.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/BUILDTESTS.md) ## Documentation for BOA PRO - New Backups for BOA SysAdmin [docs/BACKUP_ROOT.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/BACKUP_ROOT.md) - New Backups for Octopus Lshell User [docs/BACKUP_USER.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/BACKUP_USER.md) - New Backups Retention Policy Configuration [docs/BACKUP_RETENTION.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/BACKUP_RETENTION.md) - Supported Regions and Bucket Creation Guidelines [docs/BACKUP_REGIONS.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/BACKUP_REGIONS.md) ## Additional Documentation - Composer How-To: [docs/COMPOSER.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/COMPOSER.md) - Dev-Mode Notes: [docs/DEVELOPMENT.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/DEVELOPMENT.md) - Drupal Contrib Modules: [docs/MODULES.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/MODULES.md) - Extra Comments: [docs/CAVEATS.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/CAVEATS.md) - FAQ: [docs/FAQ.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/FAQ.md) - Fast DB Operations: [docs/MYQUICK.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/MYQUICK.md) - Fast Migrate/Clone: [docs/FASTTRACK.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/FASTTRACK.md) - Included Platforms: [docs/PLATFORMS.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/PLATFORMS.md) - Let’s Encrypt: [docs/SSL.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/SSL.md) - Live Disk Resize How-To: [docs/DISK_RESIZE.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/DISK_RESIZE.md) - Migration (Octopus Instance): [docs/MIGRATE.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/MIGRATE.md) - Migration (Single Site): [docs/REMOTE.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/REMOTE.md) - New Relic How-To: [docs/NEWRELIC.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/NEWRELIC.md) - Nginx Custom Rewrites: [docs/REWRITES.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/REWRITES.md) - PHP-CLI and Drush Configuration How-To: [docs/DRUSH-CLI.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/DRUSH-CLI.md) - PHP-FPM Configuration How-To: [docs/PHP-FPM.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/PHP-FPM.md) - Remote S3 Backups: [docs/BACKUPS.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/BACKUPS.md) - Ruby Gems and NPM: [docs/GEM.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/GEM.md) - Security Settings: [docs/SECURITY.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/SECURITY.md) - Self-Upgrade How-To: [docs/SELFUPGRADE.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/SELFUPGRADE.md) - SMTP SSL Error Debugging: [docs/SMTP_SSL_DEBUG.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/SMTP_SSL_DEBUG.md) - Solr and Jetty How-To: [docs/SOLR.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/SOLR.md) - SSH Encryption: [docs/BLOWFISH.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/BLOWFISH.md) - VServer Cluster: [docs/CLUSTER.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/CLUSTER.md) (deprecated) ## Useful Links - BOA User Handbook (legacy): [**Learn BOA**](https://learn.omega8.cc/library/good-to-know) - Ægir Docs (legacy): [**Ægir Project**](https://docs.aegirproject.org) ## Maintainers BOA is maintained by [**Omega8.cc**](https://omega8.cc/about). ## Credits Thanks to the Ægir Project founders and developers. [**Ægir Team**](https://docs.aegirproject.org/community/core-team/). ## Support Support BOA development by purchasing a commercial license or using Omega8.cc hosted services. Check out [**Omega8.cc**](https://omega8.cc/compare) for more info. Thank you for supporting BOA! ================================================ FILE: ROADMAP.md ================================================ # BOA Roadmap & Progress Documenting ongoing, upcoming and completed tasks. Some tasks are relatively simple, while others are major undertakings that take weeks or months. Therefore, we are working on many things simultaneously. This document highlights the most complex or important tasks we are working on or planning to undertake. Routine tasks such as debugging, fixing issues, and implementing small improvements are usually documented in the commit history and changelog, which are updated with each new BOA release. Several of the upcoming and most impactful features are planned **exclusively for BOA PRO**, as outlined below. Please also note that **as of December 31, 2025, the LTS branch will enter a full code-freeze**. No further feature development or regular releases are planned for 2026. A possible re-evaluation may occur in 2027, but this should not be assumed. After the freeze, **only critical functional fixes within BOA itself will be considered**. There will be **no updates** for underlying components such as PHP, Percona, Nginx, Valkey, OpenSSL, OpenSSH, or related system libraries. For continued access to new features, ongoing improvements, and a future-proof stack, **BOA PRO is the recommended upgrade path**. ## IN PROGRESS (PRO only) - **Import from Classic Ægir**: Extend xboa to import from remote classic Ægir servers using Nginx or Apache (PRO) - **Backdrop CMS Support**: Implement Backdrop CMS as a supported platform (PRO) - **Grav CMS Support**: Introduce support for Grav CMS (command line only) (PRO) - **Optional AppArmor Support**: Enhanced security and accounts privilege separation (PRO) - **Tar Pipelines on Clone**: Use Tar Pipelines to create separate symlinked copies during site clone tasks (PRO) - **Ægir Admin Interface**: Transition the Ægir admin interface to Backdrop CMS (PRO) - **BO4D**: Offer a *BOA For Docker* version tailored for local development (PRO) - **DDEV Integration**: Add support for BOA-compatible configurations within DDEV (PRO) - **Documentation Consolidation**: Convert legacy and built-in docs into a unified Grav CMS site. (PRO) ## RELEASED IN BOA PRO only - **Amazon S3 Alternatives**: Integrate support for AWS S3 eight (8) alternatives in `multiback` and `mybackup` (PRO) ## MAJOR NEW FEATURES RELEASED IN BOA LTS/PRO - **HTTP/3 on QUIC with KTLS Magic**: Strap in, your sites are getting an F1 engine (PRO/LTS) - **Drupal 11 with Ægir 3**: They Said It Couldn’t Be Done — We Did It Anyway (PRO/LTS) - **Debian Trixie and Devuan Excalibur**: Ensure compatibility for installation and automated upgrades (PRO/LTS) - **Debian Bookworm and Devuan Daedalus**: Ensure compatibility for installation and automated upgrades (PRO/LTS) - **Percona for MySQL 8.4**: Add support for Percona Server 8.4, the new Percona LTS (PRO/LTS) - **Original MySQL 8.4**: Add support for original MySQL Server 8.4 on Trixie/Excalibur (PRO/LTS) - **Percona for MySQL 8.0**: Add support for Percona Server 8.0, necessary for Drupal 11 (PRO/LTS) - **Super Fast System AutoInit**: Facilitate easy upgrades to the latest Devuan before BOA installation (PRO/LTS) - **Use OpenSSL 3 by default**: Maintain compatibility with OpenSSL 1.1.1 for legacy PHP versions (PRO/LTS) ## OTHER NEW FEATURES RELEASED IN BOA LTS/PRO - **PHP 8.5 Support**: Enhancing performance and supporting twelve PHP versions (PRO/LTS) - **PHP 8.4 Support**: Enhancing performance and supporting eleven PHP versions (PRO/LTS) - **PHP 8.3 Support**: Required for Drupal 11, enhancing performance and supporting ten PHP versions (PRO/LTS) - **Add instant SQL fallback for Valkey/Redis**: zero downtime during upgrades/restarts/etc - **Symlink Site Files**: Automatically symlink all site files to expedite migration tasks and conserve disk space (PRO/LTS) - **Solr 9 Support**: Add latest Solr Server 9 as supported via BOA automation (PRO/LTS) - **Ruby Gems and Node/NPM Support 3x Faster**: From 15 to 5 minutes, with improved security (PRO/LTS) - **Ægir Task for SQL Backup**: Enable classic mysqldump backups for individual site downloads (PRO/LTS) - **Drush 12/13 in Ægir Tasks**: Dynamically Utilize Site-Local Drush for `updatedb` Operations on Drupal 10+ (PRO/LTS) - **Documentation Conversion to Markdown**: Update all BOA documentation from legacy TXT to Markdown. ================================================ FILE: aegir/conf/apparmor/opt.php56.bin.php ================================================ # AppArmor profile for PHP-CLI # This profile restricts PHP-CLI (php56) to essential operations only. #include /opt/php56/bin/php flags=(complain) { # Include common AppArmor abstractions include include include include include # Capabilities needed by PHP-CLI capability audit_write, capability chown, capability dac_override, capability dac_read_search, capability fowner, capability fsetid, capability mknod, capability setgid, capability setuid, capability sys_ptrace, capability sys_resource, # Allow PHP-CLI to execute its own binary /opt/php56/bin/php mrix, # Allow PHP-CLI to signal/ptrace other processes ptrace (read) peer=/opt/php*/bin/php, signal (send) peer=unconfined, signal (send) peer=/usr/sbin/nginx, ptrace (read) peer=/opt/php*/sbin/php-fpm, ptrace (read) peer=/usr/bin/mysqld_safe, ptrace (read) peer=/usr/bin/redis-server, ptrace (read) peer=/usr/local/sbin/pure-ftpd, ptrace (read) peer=/usr/sbin/nginx, ptrace (read) peer=/usr/sbin/rsyslogd, ptrace (read) peer=/usr/sbin/unbound, ptrace (read) peer=unconfined, # Allow PHP-CLI to read required configuration files /data/disk/*/.subversion/ r, /data/disk/*/.subversion/* r, /etc/default/nginx r, /etc/ImageMagick-6/log.xml r, /etc/ImageMagick-6/policy.xml r, /etc/ld.so.cache r, /etc/ldap/ldap.conf r, /etc/mailname r, /etc/mysql/conf.d/ r, /etc/mysql/conf.d/* r, /etc/mysql/my.cnf r, /etc/newrelic/upgrade_please.key r, /etc/nginx/conf.d/ r, /etc/nginx/conf.d/** r, /etc/nginx/fastcgi_params r, /etc/nginx/mime.types r, /etc/nginx/nginx.conf r, /etc/postfix/dynamicmaps.cf r, /etc/postfix/dynamicmaps.cf.d/ r, /etc/postfix/main.cf r, /etc/ssl/private/ r, /etc/ssl/private/* r, /etc/ssl/private/nginx-wild-ssl.crt r, /etc/ssl/private/nginx-wild-ssl.dhp r, /etc/ssl/private/nginx-wild-ssl.key r, /etc/subversion/ r, /etc/subversion/* r, /etc/wgetrc r, /home/*/.drush/ r, /home/*/.drush/** r, /usr/local/share/git-core/templates/ r, /usr/local/share/git-core/templates/* r, /usr/local/share/git-core/templates/** r, /usr/share/GeoIP/GeoIP.dat r, /usr/share/GeoIP/GeoIPv6.dat r, /usr/share/GeoIP/GeoLite2-ASN.mmdb r, /usr/share/GeoIP/GeoLite2-City.mmdb r, /usr/share/GeoIP/GeoLite2-Country.mmdb r, /opt/php56/** r, # Allow PHP-CLI to read required user/access files /etc/login.defs r, /etc/pam.d/* r, /etc/passwd r, /etc/security/capability.conf r, /etc/security/limits.conf r, /etc/security/limits.d/ r, /etc/security/limits.d/* r, /etc/shadow r, /etc/sudo.conf r, /etc/sudoers r, /etc/sudoers.d/ r, /etc/sudoers.d/* r, /run/sudo/ts/ r, /run/sudo/ts/* r, # Allow PHP-CLI to execute some other binaries /usr/bin/symlinks mrix, /bin/cat mrix, /bin/chmod mrix, /bin/chown mrix, /bin/cp mrix, /bin/dash mrix, /bin/date mrix, /bin/egrep mrix, /bin/grep mrix, /bin/kmod mrix, /bin/mkdir mrix, /bin/mv mrix, /bin/pidof mrix, /bin/rm mrix, /bin/run-parts mrix, /bin/sed mrix, /bin/stty mrix, /bin/tar mrix, /bin/touch mrix, /opt/local/bin/websh mrix, /data/disk/*/**/vendor/drush/drush/drush.php mrix, /etc/init.d/nginx mrix, /sbin/killall5 mrix, /sbin/unix_chkpwd mrix, /usr/bin/chromium mrix, /usr/bin/convert mrix, /usr/bin/find mrix, /usr/bin/id mrix, /usr/bin/magick mrix, /usr/bin/mysql mrix, /usr/bin/patch mrix, /usr/bin/sudo mrix, /usr/bin/svn mrix, /usr/bin/tput mrix, /usr/bin/tr mrix, /usr/bin/unzip mrix, /usr/bin/wget mrix, /usr/bin/which mrix, /usr/bin/which.debianutils mrix, /usr/local/bin/composer mrix, /usr/local/bin/curl mrix, /usr/local/bin/fix-drupal-platform-ownership.sh mrix, /usr/local/bin/fix-drupal-platform-permissions.sh mrix, /usr/local/bin/fix-drupal-site-ownership.sh mrix, /usr/local/bin/fix-drupal-site-permissions.sh mrix, /usr/local/bin/git mrix, /usr/local/bin/lock-local-drush-permissions.sh mrix, /usr/local/bin/mydumper mrix, /usr/local/bin/myloader mrix, /usr/local/bin/wkhtmltoimage mrix, /usr/local/bin/wkhtmltopdf mrix, /usr/local/libexec/git-core/* mrix, /usr/local/libexec/git-core/** mrix, /usr/sbin/nginx mrix, /usr/sbin/postdrop mrix, /usr/sbin/sendmail mrix, # Allow PHP-CLI to access some /dev /dev/null rw, /dev/random r, /dev/tty rw, /dev/urandom r, # Allow PHP-CLI to use tmp files /tmp/ r, /tmp/** rw, /var/spool/postfix/maildrop/ r, /var/spool/postfix/maildrop/* rw, /var/tmp/** rw, # Allow read access to necessary libraries /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /opt/php*/lib/php/** mr, /usr/lib/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/libexec/** mr, /usr/local/include/** mr, /usr/local/ioncube/ioncube_loader_lin_*.so mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, # Allow PHP-CLI to read and write its log files /var/log/php/** rw, /var/log/newrelic/php_agent.log rw, # Allow PHP-CLI to write to some other log/pid files /run/nginx.pid rw, /var/log/nginx/access.log rw, /var/log/nginx/error.log rw, # Allow PHP-CLI to access /proc and /sys for necessary information /proc/ r, /proc/** r, /sys/ r, /sys/** r, # Allow PHP-CLI to use /dev/shm for temporary storage /dev/shm/ r, /dev/shm/** rw, # Deny execution of binaries from these directories deny /home/*/.tmp/** m, deny /home/*/** m, deny /tmp/** m, deny /var/tmp/** m, # Allow PHP-CLI to access drush /data/disk/*/tools/drush/ r, /data/disk/*/tools/drush/* mrix, /data/disk/*/tools/drush/** r, /opt/tools/drush/** mrix, /usr/local/bin/cv.phar mrix, /var/aegir/drush/ r, /var/aegir/drush/* mrix, /var/aegir/drush/** r, # Allow PHP-CLI to access System Default Web Root /var/www/** r, owner /var/www/** rw, # Allow PHP-CLI to read/write in the Ægir Backend on Master Instance owner /var/aegir/.drush/ r, owner /var/aegir/.drush/* rw, owner /var/aegir/.drush/** rw, owner /var/aegir/.tmp/ r, owner /var/aegir/.tmp/* rw, owner /var/aegir/.tmp/** rw, owner /var/aegir/config/ r, owner /var/aegir/config/* rw, owner /var/aegir/config/** rw, owner /var/aegir/host_master-*/ r, owner /var/aegir/host_master-*/* rw, owner /var/aegir/host_master-*/** rw, owner /var/aegir/host_master/ r, owner /var/aegir/host_master/* rw, owner /var/aegir/host_master/** rw, owner /var/aegir/platforms/ r, owner /var/aegir/platforms/* rw, owner /var/aegir/platforms/** rw, # Allow PHP-CLI to read/write in the Ægir Backend on Octopus Instances /data/all/ r, /data/all/* r, /data/all/** r, /data/conf/ r, /data/conf/* r, /data/conf/** r, /data/disk/*/.bashrc r, owner /data/disk/*/.cache/**/pack-* l, owner /data/disk/*/static/**/pack-* l, owner /data/disk/*/log/ r, owner /data/disk/*/log/* rw, owner /data/disk/*/.*.pass.php r, owner /data/disk/*/.rnd rw, owner /data/disk/*/backups/ rwl, owner /data/disk/*/backups/* rwl, owner /data/disk/*/backups/** rwl, owner /data/disk/*/backup-exports/ rwl, owner /data/disk/*/backup-exports/* rwl, owner /data/disk/*/backup-exports/** rwl, owner /data/disk/*/.config/ rwl, owner /data/disk/*/.config/* rwl, owner /data/disk/*/.config/** rwl, owner /data/disk/*/.cache/ rwl, owner /data/disk/*/.cache/* rwl, owner /data/disk/*/.cache/** rwl, owner /data/disk/*/.drush/ rwl, owner /data/disk/*/.drush/* rwl, owner /data/disk/*/.drush/** rwl, owner /data/disk/*/.tmp/ rwl, owner /data/disk/*/.tmp/* rwl, owner /data/disk/*/.tmp/** rwl, owner /data/disk/*/clients/ rw, owner /data/disk/*/clients/* rw, owner /data/disk/*/clients/** rw, owner /data/disk/*/config/ rw, owner /data/disk/*/config/* rw, owner /data/disk/*/config/** rw, owner /data/disk/*/tools/le/ rw, owner /data/disk/*/tools/le/* rw, owner /data/disk/*/tools/le/** rw, # Allow PHP-CLI to read/write in the Ægir Frontend on Octopus Instances owner /data/disk/*/aegir/ rw, owner /data/disk/*/aegir/* rw, owner /data/disk/*/aegir/** rw, # Allow PHP-CLI to read/write in the limited shell user home for Drush support owner /home/*/.drush/sites/ rw, owner /home/*/.drush/sites/* rw, owner /home/*/.drush/sites/** rw, owner /home/*/.drush/cache/ rw, owner /home/*/.drush/cache/* rw, owner /home/*/.drush/cache/** rw, owner /home/*/.tmp/ rw, owner /home/*/.tmp/* rw, owner /home/*/.tmp/** rw, # Allow PHP-CLI to read/write in the custom web root directories /data/disk/*/static/ rw, /data/disk/*/static/* rw, /data/disk/*/static/** rw, /data/disk/*/distro/ rw, /data/disk/*/distro/* rw, /data/disk/*/distro/** rw, /data/disk/*/platforms/ rw, /data/disk/*/platforms/* rw, /data/disk/*/platforms/** rw, # Allow PHP-CLI to read and write in the root tmp owner /root/.tmp/ rw, owner /root/.tmp/* rw, owner /root/.tmp/** rw, # Deny access to various sensitive directories and files deny /boot/** mrwklx, # Catchall to deny everything else #deny /** rwklx, # Site-specific additions and overrides can be added below } ================================================ FILE: aegir/conf/apparmor/opt.php56.sbin.php-fpm ================================================ # AppArmor profile for PHP-FPM # This profile restricts the PHP-FPM (php56) to essential operations only. #include /opt/php56/sbin/php-fpm flags=(attach_disconnected) { # Include common AppArmor abstractions include include include include # Capabilities needed by PHP-FPM capability chown, capability dac_override, capability dac_read_search, capability fowner, capability kill, capability setgid, capability setuid, capability sys_resource, # Allow PHP-FPM to accept signal from PHP-CLI processes signal (receive) peer=/opt/php*/bin/php, network inet stream, network inet6 stream, # Allow PHP-FPM to execute its own binary /opt/php56/sbin/php-fpm mrix, # Allow PHP-FPM to read its configuration files /data/conf/ r, /data/conf/** r, /etc/ImageMagick-6/log.xml r, /etc/ImageMagick-6/policy.xml r, /etc/ld.so.cache r, /etc/mailname r, /etc/newrelic/upgrade_please.key r, /etc/postfix/dynamicmaps.cf r, /etc/postfix/dynamicmaps.cf.d/ r, /etc/postfix/dynamicmaps.cf.d/* r, /etc/postfix/main.cf r, /home/*/.drush/** r, /opt/etc/fpm/** r, /var/spool/postfix/maildrop/ r, /var/spool/postfix/maildrop/* rw, /opt/php56/** r, # Allow PHP-FPM to execute some other binaries /bin/dash mrix, /opt/local/bin/websh mrix, /usr/bin/advdef mrix, /usr/bin/advpng mrix, /usr/bin/chromium mrix, /usr/bin/convert mrix, /usr/bin/id mrix, /usr/bin/jpegoptim mrix, /usr/bin/jpegtran mrix, /usr/bin/magick mrix, /usr/bin/optipng mrix, /usr/bin/pngcrush mrix, /usr/bin/pngquant mrix, /usr/lib/postfix/sbin/smtpd mrix, /usr/local/bin/curl mrix, /usr/local/bin/wkhtmltoimage mrix, /usr/local/bin/wkhtmltopdf mrix, /usr/sbin/postdrop mrix, /usr/sbin/sendmail mrix, # Allow PHP-FPM to access some /dev /dev/null rw, /dev/random r, /dev/tty wr, /dev/urandom r, # Allow PHP-FPM to access its run directory /run/** rw, # Allow PHP-FPM to use tmp files /home/*/.tmp/ r, /home/*/.tmp/** rw, /tmp/ r, /tmp/** rw, /var/tmp/** rw, # Allow read access to necessary libraries /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /opt/php*/lib/php/** mr, /usr/lib/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/libexec/** mr, /usr/local/include/** mr, /usr/local/ioncube/ioncube_loader_lin_*.so mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, # Allow PHP-FPM to read and write its log files /var/log/newrelic/php_agent.log rw, /var/log/php/** rw, # Allow PHP-FPM to access /proc and /sys for necessary information /proc/** r, /sys/** r, # Allow PHP-FPM to use /dev/shm for temporary storage /dev/shm/ r, /dev/shm/** rw, # Deny execution of binaries from these directories deny /home/*/.tmp/** m, deny /home/*/** m, deny /tmp/** m, deny /var/tmp/** m, # Allow PHP-FPM to read and write in the custom web root directories /var/www/** r, /var/aegir/host_master/** r, /var/aegir/platforms/** r, /data/disk/*/aegir/** r, /data/disk/*/distro/** r, /data/disk/*/platforms/** r, /data/disk/*/static/** r, /data/disk/*/tools/le/** r, /data/all/ r, /data/all/* r, /data/all/** r, /data/conf/ r, /data/conf/* r, /data/conf/** r, owner /var/aegir/host_master/** rw, owner /var/aegir/platforms/** rw, owner /data/disk/*/aegir/** rw, owner /data/disk/*/distro/** rw, owner /data/disk/*/platforms/** rw, owner /data/disk/*/static/** rw, owner /var/www/** rw, /home/*.web/.aws/ r, /home/*.web/.aws/* rw, /home/*.web/.drush/ r, /home/*.web/.drush/* r, /home/*.web/.tmp/ r, /home/*.web/.tmp/* rw, # Deny access to various sensitive directories and files deny /boot/** mrwklx, deny /etc/shadow* rwlx, deny /root/** mrwklx, # Catchall to deny everything else #deny /** rwklx, # Site-specific additions and overrides can be added below } ================================================ FILE: aegir/conf/apparmor/opt.php70.bin.php ================================================ # AppArmor profile for PHP-CLI # This profile restricts PHP-CLI (php70) to essential operations only. #include /opt/php70/bin/php flags=(complain) { # Include common AppArmor abstractions include include include include include # Capabilities needed by PHP-CLI capability audit_write, capability chown, capability dac_override, capability dac_read_search, capability fowner, capability fsetid, capability mknod, capability setgid, capability setuid, capability sys_ptrace, capability sys_resource, # Allow PHP-CLI to execute its own binary /opt/php70/bin/php mrix, # Allow PHP-CLI to signal/ptrace other processes ptrace (read) peer=/opt/php*/bin/php, signal (send) peer=unconfined, signal (send) peer=/usr/sbin/nginx, ptrace (read) peer=/opt/php*/sbin/php-fpm, ptrace (read) peer=/usr/bin/mysqld_safe, ptrace (read) peer=/usr/bin/redis-server, ptrace (read) peer=/usr/local/sbin/pure-ftpd, ptrace (read) peer=/usr/sbin/nginx, ptrace (read) peer=/usr/sbin/rsyslogd, ptrace (read) peer=/usr/sbin/unbound, ptrace (read) peer=unconfined, # Allow PHP-CLI to read required configuration files /data/disk/*/.subversion/ r, /data/disk/*/.subversion/* r, /etc/default/nginx r, /etc/ImageMagick-6/log.xml r, /etc/ImageMagick-6/policy.xml r, /etc/ld.so.cache r, /etc/ldap/ldap.conf r, /etc/mailname r, /etc/mysql/conf.d/ r, /etc/mysql/conf.d/* r, /etc/mysql/my.cnf r, /etc/newrelic/upgrade_please.key r, /etc/nginx/conf.d/ r, /etc/nginx/conf.d/** r, /etc/nginx/fastcgi_params r, /etc/nginx/mime.types r, /etc/nginx/nginx.conf r, /etc/postfix/dynamicmaps.cf r, /etc/postfix/dynamicmaps.cf.d/ r, /etc/postfix/main.cf r, /etc/ssl/private/ r, /etc/ssl/private/* r, /etc/ssl/private/nginx-wild-ssl.crt r, /etc/ssl/private/nginx-wild-ssl.dhp r, /etc/ssl/private/nginx-wild-ssl.key r, /etc/subversion/ r, /etc/subversion/* r, /etc/wgetrc r, /home/*/.drush/ r, /home/*/.drush/** r, /usr/local/share/git-core/templates/ r, /usr/local/share/git-core/templates/* r, /usr/local/share/git-core/templates/** r, /usr/share/GeoIP/GeoIP.dat r, /usr/share/GeoIP/GeoIPv6.dat r, /usr/share/GeoIP/GeoLite2-ASN.mmdb r, /usr/share/GeoIP/GeoLite2-City.mmdb r, /usr/share/GeoIP/GeoLite2-Country.mmdb r, /opt/php70/** r, # Allow PHP-CLI to read required user/access files /etc/login.defs r, /etc/pam.d/* r, /etc/passwd r, /etc/security/capability.conf r, /etc/security/limits.conf r, /etc/security/limits.d/ r, /etc/security/limits.d/* r, /etc/shadow r, /etc/sudo.conf r, /etc/sudoers r, /etc/sudoers.d/ r, /etc/sudoers.d/* r, /run/sudo/ts/ r, /run/sudo/ts/* r, # Allow PHP-CLI to execute some other binaries /usr/bin/symlinks mrix, /bin/cat mrix, /bin/chmod mrix, /bin/chown mrix, /bin/cp mrix, /bin/dash mrix, /bin/date mrix, /bin/egrep mrix, /bin/grep mrix, /bin/kmod mrix, /bin/mkdir mrix, /bin/mv mrix, /bin/pidof mrix, /bin/rm mrix, /bin/run-parts mrix, /bin/sed mrix, /bin/stty mrix, /bin/tar mrix, /bin/touch mrix, /opt/local/bin/websh mrix, /data/disk/*/**/vendor/drush/drush/drush.php mrix, /etc/init.d/nginx mrix, /sbin/killall5 mrix, /sbin/unix_chkpwd mrix, /usr/bin/chromium mrix, /usr/bin/convert mrix, /usr/bin/find mrix, /usr/bin/id mrix, /usr/bin/magick mrix, /usr/bin/mysql mrix, /usr/bin/patch mrix, /usr/bin/sudo mrix, /usr/bin/svn mrix, /usr/bin/tput mrix, /usr/bin/tr mrix, /usr/bin/unzip mrix, /usr/bin/wget mrix, /usr/bin/which mrix, /usr/bin/which.debianutils mrix, /usr/local/bin/composer mrix, /usr/local/bin/curl mrix, /usr/local/bin/fix-drupal-platform-ownership.sh mrix, /usr/local/bin/fix-drupal-platform-permissions.sh mrix, /usr/local/bin/fix-drupal-site-ownership.sh mrix, /usr/local/bin/fix-drupal-site-permissions.sh mrix, /usr/local/bin/git mrix, /usr/local/bin/lock-local-drush-permissions.sh mrix, /usr/local/bin/mydumper mrix, /usr/local/bin/myloader mrix, /usr/local/bin/wkhtmltoimage mrix, /usr/local/bin/wkhtmltopdf mrix, /usr/local/libexec/git-core/* mrix, /usr/local/libexec/git-core/** mrix, /usr/sbin/nginx mrix, /usr/sbin/postdrop mrix, /usr/sbin/sendmail mrix, # Allow PHP-CLI to access some /dev /dev/null rw, /dev/random r, /dev/tty rw, /dev/urandom r, # Allow PHP-CLI to use tmp files /tmp/ r, /tmp/** rw, /var/spool/postfix/maildrop/ r, /var/spool/postfix/maildrop/* rw, /var/tmp/** rw, # Allow read access to necessary libraries /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /opt/php*/lib/php/** mr, /usr/lib/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/libexec/** mr, /usr/local/include/** mr, /usr/local/ioncube/ioncube_loader_lin_*.so mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, # Allow PHP-CLI to read and write its log files /var/log/php/** rw, /var/log/newrelic/php_agent.log rw, # Allow PHP-CLI to write to some other log/pid files /run/nginx.pid rw, /var/log/nginx/access.log rw, /var/log/nginx/error.log rw, # Allow PHP-CLI to access /proc and /sys for necessary information /proc/ r, /proc/** r, /sys/ r, /sys/** r, # Allow PHP-CLI to use /dev/shm for temporary storage /dev/shm/ r, /dev/shm/** rw, # Deny execution of binaries from these directories deny /home/*/.tmp/** m, deny /home/*/** m, deny /tmp/** m, deny /var/tmp/** m, # Allow PHP-CLI to access drush /data/disk/*/tools/drush/ r, /data/disk/*/tools/drush/* mrix, /data/disk/*/tools/drush/** r, /opt/tools/drush/** mrix, /usr/local/bin/cv.phar mrix, /var/aegir/drush/ r, /var/aegir/drush/* mrix, /var/aegir/drush/** r, # Allow PHP-CLI to access System Default Web Root /var/www/** r, owner /var/www/** rw, # Allow PHP-CLI to read/write in the Ægir Backend on Master Instance owner /var/aegir/.drush/ r, owner /var/aegir/.drush/* rw, owner /var/aegir/.drush/** rw, owner /var/aegir/.tmp/ r, owner /var/aegir/.tmp/* rw, owner /var/aegir/.tmp/** rw, owner /var/aegir/config/ r, owner /var/aegir/config/* rw, owner /var/aegir/config/** rw, owner /var/aegir/host_master-*/ r, owner /var/aegir/host_master-*/* rw, owner /var/aegir/host_master-*/** rw, owner /var/aegir/host_master/ r, owner /var/aegir/host_master/* rw, owner /var/aegir/host_master/** rw, owner /var/aegir/platforms/ r, owner /var/aegir/platforms/* rw, owner /var/aegir/platforms/** rw, # Allow PHP-CLI to read/write in the Ægir Backend on Octopus Instances /data/all/ r, /data/all/* r, /data/all/** r, /data/conf/ r, /data/conf/* r, /data/conf/** r, /data/disk/*/.bashrc r, owner /data/disk/*/.cache/**/pack-* l, owner /data/disk/*/static/**/pack-* l, owner /data/disk/*/log/ r, owner /data/disk/*/log/* rw, owner /data/disk/*/.*.pass.php r, owner /data/disk/*/.rnd rw, owner /data/disk/*/backups/ rwl, owner /data/disk/*/backups/* rwl, owner /data/disk/*/backups/** rwl, owner /data/disk/*/backup-exports/ rwl, owner /data/disk/*/backup-exports/* rwl, owner /data/disk/*/backup-exports/** rwl, owner /data/disk/*/.config/ rwl, owner /data/disk/*/.config/* rwl, owner /data/disk/*/.config/** rwl, owner /data/disk/*/.cache/ rwl, owner /data/disk/*/.cache/* rwl, owner /data/disk/*/.cache/** rwl, owner /data/disk/*/.drush/ rwl, owner /data/disk/*/.drush/* rwl, owner /data/disk/*/.drush/** rwl, owner /data/disk/*/.tmp/ rwl, owner /data/disk/*/.tmp/* rwl, owner /data/disk/*/.tmp/** rwl, owner /data/disk/*/clients/ rw, owner /data/disk/*/clients/* rw, owner /data/disk/*/clients/** rw, owner /data/disk/*/config/ rw, owner /data/disk/*/config/* rw, owner /data/disk/*/config/** rw, owner /data/disk/*/tools/le/ rw, owner /data/disk/*/tools/le/* rw, owner /data/disk/*/tools/le/** rw, # Allow PHP-CLI to read/write in the Ægir Frontend on Octopus Instances owner /data/disk/*/aegir/ rw, owner /data/disk/*/aegir/* rw, owner /data/disk/*/aegir/** rw, # Allow PHP-CLI to read/write in the limited shell user home for Drush support owner /home/*/.drush/sites/ rw, owner /home/*/.drush/sites/* rw, owner /home/*/.drush/sites/** rw, owner /home/*/.drush/cache/ rw, owner /home/*/.drush/cache/* rw, owner /home/*/.drush/cache/** rw, owner /home/*/.tmp/ rw, owner /home/*/.tmp/* rw, owner /home/*/.tmp/** rw, # Allow PHP-CLI to read/write in the custom web root directories /data/disk/*/static/ rw, /data/disk/*/static/* rw, /data/disk/*/static/** rw, /data/disk/*/distro/ rw, /data/disk/*/distro/* rw, /data/disk/*/distro/** rw, /data/disk/*/platforms/ rw, /data/disk/*/platforms/* rw, /data/disk/*/platforms/** rw, # Allow PHP-CLI to read and write in the root tmp owner /root/.tmp/ rw, owner /root/.tmp/* rw, owner /root/.tmp/** rw, # Deny access to various sensitive directories and files deny /boot/** mrwklx, # Catchall to deny everything else #deny /** rwklx, # Site-specific additions and overrides can be added below } ================================================ FILE: aegir/conf/apparmor/opt.php70.sbin.php-fpm ================================================ # AppArmor profile for PHP-FPM # This profile restricts the PHP-FPM (php70) to essential operations only. #include /opt/php70/sbin/php-fpm flags=(attach_disconnected) { # Include common AppArmor abstractions include include include include # Capabilities needed by PHP-FPM capability chown, capability dac_override, capability dac_read_search, capability fowner, capability kill, capability setgid, capability setuid, capability sys_resource, # Allow PHP-FPM to accept signal from PHP-CLI processes signal (receive) peer=/opt/php*/bin/php, network inet stream, network inet6 stream, # Allow PHP-FPM to execute its own binary /opt/php70/sbin/php-fpm mrix, # Allow PHP-FPM to read its configuration files /data/conf/ r, /data/conf/** r, /etc/ImageMagick-6/log.xml r, /etc/ImageMagick-6/policy.xml r, /etc/ld.so.cache r, /etc/mailname r, /etc/newrelic/upgrade_please.key r, /etc/postfix/dynamicmaps.cf r, /etc/postfix/dynamicmaps.cf.d/ r, /etc/postfix/dynamicmaps.cf.d/* r, /etc/postfix/main.cf r, /home/*/.drush/** r, /opt/etc/fpm/** r, /var/spool/postfix/maildrop/ r, /var/spool/postfix/maildrop/* rw, /opt/php70/** r, # Allow PHP-FPM to execute some other binaries /bin/dash mrix, /opt/local/bin/websh mrix, /usr/bin/advdef mrix, /usr/bin/advpng mrix, /usr/bin/chromium mrix, /usr/bin/convert mrix, /usr/bin/id mrix, /usr/bin/jpegoptim mrix, /usr/bin/jpegtran mrix, /usr/bin/magick mrix, /usr/bin/optipng mrix, /usr/bin/pngcrush mrix, /usr/bin/pngquant mrix, /usr/lib/postfix/sbin/smtpd mrix, /usr/local/bin/curl mrix, /usr/local/bin/wkhtmltoimage mrix, /usr/local/bin/wkhtmltopdf mrix, /usr/sbin/postdrop mrix, /usr/sbin/sendmail mrix, # Allow PHP-FPM to access some /dev /dev/null rw, /dev/random r, /dev/tty wr, /dev/urandom r, # Allow PHP-FPM to access its run directory /run/** rw, # Allow PHP-FPM to use tmp files /home/*/.tmp/ r, /home/*/.tmp/** rw, /tmp/ r, /tmp/** rw, /var/tmp/** rw, # Allow read access to necessary libraries /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /opt/php*/lib/php/** mr, /usr/lib/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/libexec/** mr, /usr/local/include/** mr, /usr/local/ioncube/ioncube_loader_lin_*.so mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, # Allow PHP-FPM to read and write its log files /var/log/newrelic/php_agent.log rw, /var/log/php/** rw, # Allow PHP-FPM to access /proc and /sys for necessary information /proc/** r, /sys/** r, # Allow PHP-FPM to use /dev/shm for temporary storage /dev/shm/ r, /dev/shm/** rw, # Deny execution of binaries from these directories deny /home/*/.tmp/** m, deny /home/*/** m, deny /tmp/** m, deny /var/tmp/** m, # Allow PHP-FPM to read and write in the custom web root directories /var/www/** r, /var/aegir/host_master/** r, /var/aegir/platforms/** r, /data/disk/*/aegir/** r, /data/disk/*/distro/** r, /data/disk/*/platforms/** r, /data/disk/*/static/** r, /data/disk/*/tools/le/** r, /data/all/ r, /data/all/* r, /data/all/** r, /data/conf/ r, /data/conf/* r, /data/conf/** r, owner /var/aegir/host_master/** rw, owner /var/aegir/platforms/** rw, owner /data/disk/*/aegir/** rw, owner /data/disk/*/distro/** rw, owner /data/disk/*/platforms/** rw, owner /data/disk/*/static/** rw, owner /var/www/** rw, /home/*.web/.aws/ r, /home/*.web/.aws/* rw, /home/*.web/.drush/ r, /home/*.web/.drush/* r, /home/*.web/.tmp/ r, /home/*.web/.tmp/* rw, # Deny access to various sensitive directories and files deny /boot/** mrwklx, deny /etc/shadow* rwlx, deny /root/** mrwklx, # Catchall to deny everything else #deny /** rwklx, # Site-specific additions and overrides can be added below } ================================================ FILE: aegir/conf/apparmor/opt.php71.bin.php ================================================ # AppArmor profile for PHP-CLI # This profile restricts PHP-CLI (php71) to essential operations only. #include /opt/php71/bin/php flags=(complain) { # Include common AppArmor abstractions include include include include include # Capabilities needed by PHP-CLI capability audit_write, capability chown, capability dac_override, capability dac_read_search, capability fowner, capability fsetid, capability mknod, capability setgid, capability setuid, capability sys_ptrace, capability sys_resource, # Allow PHP-CLI to execute its own binary /opt/php71/bin/php mrix, # Allow PHP-CLI to signal/ptrace other processes ptrace (read) peer=/opt/php*/bin/php, signal (send) peer=unconfined, signal (send) peer=/usr/sbin/nginx, ptrace (read) peer=/opt/php*/sbin/php-fpm, ptrace (read) peer=/usr/bin/mysqld_safe, ptrace (read) peer=/usr/bin/redis-server, ptrace (read) peer=/usr/local/sbin/pure-ftpd, ptrace (read) peer=/usr/sbin/nginx, ptrace (read) peer=/usr/sbin/rsyslogd, ptrace (read) peer=/usr/sbin/unbound, ptrace (read) peer=unconfined, # Allow PHP-CLI to read required configuration files /data/disk/*/.subversion/ r, /data/disk/*/.subversion/* r, /etc/default/nginx r, /etc/ImageMagick-6/log.xml r, /etc/ImageMagick-6/policy.xml r, /etc/ld.so.cache r, /etc/ldap/ldap.conf r, /etc/mailname r, /etc/mysql/conf.d/ r, /etc/mysql/conf.d/* r, /etc/mysql/my.cnf r, /etc/newrelic/upgrade_please.key r, /etc/nginx/conf.d/ r, /etc/nginx/conf.d/** r, /etc/nginx/fastcgi_params r, /etc/nginx/mime.types r, /etc/nginx/nginx.conf r, /etc/postfix/dynamicmaps.cf r, /etc/postfix/dynamicmaps.cf.d/ r, /etc/postfix/main.cf r, /etc/ssl/private/ r, /etc/ssl/private/* r, /etc/ssl/private/nginx-wild-ssl.crt r, /etc/ssl/private/nginx-wild-ssl.dhp r, /etc/ssl/private/nginx-wild-ssl.key r, /etc/subversion/ r, /etc/subversion/* r, /etc/wgetrc r, /home/*/.drush/ r, /home/*/.drush/** r, /usr/local/share/git-core/templates/ r, /usr/local/share/git-core/templates/* r, /usr/local/share/git-core/templates/** r, /usr/share/GeoIP/GeoIP.dat r, /usr/share/GeoIP/GeoIPv6.dat r, /usr/share/GeoIP/GeoLite2-ASN.mmdb r, /usr/share/GeoIP/GeoLite2-City.mmdb r, /usr/share/GeoIP/GeoLite2-Country.mmdb r, /opt/php71/** r, # Allow PHP-CLI to read required user/access files /etc/login.defs r, /etc/pam.d/* r, /etc/passwd r, /etc/security/capability.conf r, /etc/security/limits.conf r, /etc/security/limits.d/ r, /etc/security/limits.d/* r, /etc/shadow r, /etc/sudo.conf r, /etc/sudoers r, /etc/sudoers.d/ r, /etc/sudoers.d/* r, /run/sudo/ts/ r, /run/sudo/ts/* r, # Allow PHP-CLI to execute some other binaries /usr/bin/symlinks mrix, /bin/cat mrix, /bin/chmod mrix, /bin/chown mrix, /bin/cp mrix, /bin/dash mrix, /bin/date mrix, /bin/egrep mrix, /bin/grep mrix, /bin/kmod mrix, /bin/mkdir mrix, /bin/mv mrix, /bin/pidof mrix, /bin/rm mrix, /bin/run-parts mrix, /bin/sed mrix, /bin/stty mrix, /bin/tar mrix, /bin/touch mrix, /opt/local/bin/websh mrix, /data/disk/*/**/vendor/drush/drush/drush.php mrix, /etc/init.d/nginx mrix, /sbin/killall5 mrix, /sbin/unix_chkpwd mrix, /usr/bin/chromium mrix, /usr/bin/convert mrix, /usr/bin/find mrix, /usr/bin/id mrix, /usr/bin/magick mrix, /usr/bin/mysql mrix, /usr/bin/patch mrix, /usr/bin/sudo mrix, /usr/bin/svn mrix, /usr/bin/tput mrix, /usr/bin/tr mrix, /usr/bin/unzip mrix, /usr/bin/wget mrix, /usr/bin/which mrix, /usr/bin/which.debianutils mrix, /usr/local/bin/composer mrix, /usr/local/bin/curl mrix, /usr/local/bin/fix-drupal-platform-ownership.sh mrix, /usr/local/bin/fix-drupal-platform-permissions.sh mrix, /usr/local/bin/fix-drupal-site-ownership.sh mrix, /usr/local/bin/fix-drupal-site-permissions.sh mrix, /usr/local/bin/git mrix, /usr/local/bin/lock-local-drush-permissions.sh mrix, /usr/local/bin/mydumper mrix, /usr/local/bin/myloader mrix, /usr/local/bin/wkhtmltoimage mrix, /usr/local/bin/wkhtmltopdf mrix, /usr/local/libexec/git-core/* mrix, /usr/local/libexec/git-core/** mrix, /usr/sbin/nginx mrix, /usr/sbin/postdrop mrix, /usr/sbin/sendmail mrix, # Allow PHP-CLI to access some /dev /dev/null rw, /dev/random r, /dev/tty rw, /dev/urandom r, # Allow PHP-CLI to use tmp files /tmp/ r, /tmp/** rw, /var/spool/postfix/maildrop/ r, /var/spool/postfix/maildrop/* rw, /var/tmp/** rw, # Allow read access to necessary libraries /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /opt/php*/lib/php/** mr, /usr/lib/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/libexec/** mr, /usr/local/include/** mr, /usr/local/ioncube/ioncube_loader_lin_*.so mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, # Allow PHP-CLI to read and write its log files /var/log/php/** rw, /var/log/newrelic/php_agent.log rw, # Allow PHP-CLI to write to some other log/pid files /run/nginx.pid rw, /var/log/nginx/access.log rw, /var/log/nginx/error.log rw, # Allow PHP-CLI to access /proc and /sys for necessary information /proc/ r, /proc/** r, /sys/ r, /sys/** r, # Allow PHP-CLI to use /dev/shm for temporary storage /dev/shm/ r, /dev/shm/** rw, # Deny execution of binaries from these directories deny /home/*/.tmp/** m, deny /home/*/** m, deny /tmp/** m, deny /var/tmp/** m, # Allow PHP-CLI to access drush /data/disk/*/tools/drush/ r, /data/disk/*/tools/drush/* mrix, /data/disk/*/tools/drush/** r, /opt/tools/drush/** mrix, /usr/local/bin/cv.phar mrix, /var/aegir/drush/ r, /var/aegir/drush/* mrix, /var/aegir/drush/** r, # Allow PHP-CLI to access System Default Web Root /var/www/** r, owner /var/www/** rw, # Allow PHP-CLI to read/write in the Ægir Backend on Master Instance owner /var/aegir/.drush/ r, owner /var/aegir/.drush/* rw, owner /var/aegir/.drush/** rw, owner /var/aegir/.tmp/ r, owner /var/aegir/.tmp/* rw, owner /var/aegir/.tmp/** rw, owner /var/aegir/config/ r, owner /var/aegir/config/* rw, owner /var/aegir/config/** rw, owner /var/aegir/host_master-*/ r, owner /var/aegir/host_master-*/* rw, owner /var/aegir/host_master-*/** rw, owner /var/aegir/host_master/ r, owner /var/aegir/host_master/* rw, owner /var/aegir/host_master/** rw, owner /var/aegir/platforms/ r, owner /var/aegir/platforms/* rw, owner /var/aegir/platforms/** rw, # Allow PHP-CLI to read/write in the Ægir Backend on Octopus Instances /data/all/ r, /data/all/* r, /data/all/** r, /data/conf/ r, /data/conf/* r, /data/conf/** r, /data/disk/*/.bashrc r, owner /data/disk/*/.cache/**/pack-* l, owner /data/disk/*/static/**/pack-* l, owner /data/disk/*/log/ r, owner /data/disk/*/log/* rw, owner /data/disk/*/.*.pass.php r, owner /data/disk/*/.rnd rw, owner /data/disk/*/backups/ rwl, owner /data/disk/*/backups/* rwl, owner /data/disk/*/backups/** rwl, owner /data/disk/*/backup-exports/ rwl, owner /data/disk/*/backup-exports/* rwl, owner /data/disk/*/backup-exports/** rwl, owner /data/disk/*/.config/ rwl, owner /data/disk/*/.config/* rwl, owner /data/disk/*/.config/** rwl, owner /data/disk/*/.cache/ rwl, owner /data/disk/*/.cache/* rwl, owner /data/disk/*/.cache/** rwl, owner /data/disk/*/.drush/ rwl, owner /data/disk/*/.drush/* rwl, owner /data/disk/*/.drush/** rwl, owner /data/disk/*/.tmp/ rwl, owner /data/disk/*/.tmp/* rwl, owner /data/disk/*/.tmp/** rwl, owner /data/disk/*/clients/ rw, owner /data/disk/*/clients/* rw, owner /data/disk/*/clients/** rw, owner /data/disk/*/config/ rw, owner /data/disk/*/config/* rw, owner /data/disk/*/config/** rw, owner /data/disk/*/tools/le/ rw, owner /data/disk/*/tools/le/* rw, owner /data/disk/*/tools/le/** rw, # Allow PHP-CLI to read/write in the Ægir Frontend on Octopus Instances owner /data/disk/*/aegir/ rw, owner /data/disk/*/aegir/* rw, owner /data/disk/*/aegir/** rw, # Allow PHP-CLI to read/write in the limited shell user home for Drush support owner /home/*/.drush/sites/ rw, owner /home/*/.drush/sites/* rw, owner /home/*/.drush/sites/** rw, owner /home/*/.drush/cache/ rw, owner /home/*/.drush/cache/* rw, owner /home/*/.drush/cache/** rw, owner /home/*/.tmp/ rw, owner /home/*/.tmp/* rw, owner /home/*/.tmp/** rw, # Allow PHP-CLI to read/write in the custom web root directories /data/disk/*/static/ rw, /data/disk/*/static/* rw, /data/disk/*/static/** rw, /data/disk/*/distro/ rw, /data/disk/*/distro/* rw, /data/disk/*/distro/** rw, /data/disk/*/platforms/ rw, /data/disk/*/platforms/* rw, /data/disk/*/platforms/** rw, # Allow PHP-CLI to read and write in the root tmp owner /root/.tmp/ rw, owner /root/.tmp/* rw, owner /root/.tmp/** rw, # Deny access to various sensitive directories and files deny /boot/** mrwklx, # Catchall to deny everything else #deny /** rwklx, # Site-specific additions and overrides can be added below } ================================================ FILE: aegir/conf/apparmor/opt.php71.sbin.php-fpm ================================================ # AppArmor profile for PHP-FPM # This profile restricts the PHP-FPM (php71) to essential operations only. #include /opt/php71/sbin/php-fpm flags=(attach_disconnected) { # Include common AppArmor abstractions include include include include # Capabilities needed by PHP-FPM capability chown, capability dac_override, capability dac_read_search, capability fowner, capability kill, capability setgid, capability setuid, capability sys_resource, # Allow PHP-FPM to accept signal from PHP-CLI processes signal (receive) peer=/opt/php*/bin/php, network inet stream, network inet6 stream, # Allow PHP-FPM to execute its own binary /opt/php71/sbin/php-fpm mrix, # Allow PHP-FPM to read its configuration files /data/conf/ r, /data/conf/** r, /etc/ImageMagick-6/log.xml r, /etc/ImageMagick-6/policy.xml r, /etc/ld.so.cache r, /etc/mailname r, /etc/newrelic/upgrade_please.key r, /etc/postfix/dynamicmaps.cf r, /etc/postfix/dynamicmaps.cf.d/ r, /etc/postfix/dynamicmaps.cf.d/* r, /etc/postfix/main.cf r, /home/*/.drush/** r, /opt/etc/fpm/** r, /var/spool/postfix/maildrop/ r, /var/spool/postfix/maildrop/* rw, /opt/php71/** r, # Allow PHP-FPM to execute some other binaries /bin/dash mrix, /opt/local/bin/websh mrix, /usr/bin/advdef mrix, /usr/bin/advpng mrix, /usr/bin/chromium mrix, /usr/bin/convert mrix, /usr/bin/id mrix, /usr/bin/jpegoptim mrix, /usr/bin/jpegtran mrix, /usr/bin/magick mrix, /usr/bin/optipng mrix, /usr/bin/pngcrush mrix, /usr/bin/pngquant mrix, /usr/lib/postfix/sbin/smtpd mrix, /usr/local/bin/curl mrix, /usr/local/bin/wkhtmltoimage mrix, /usr/local/bin/wkhtmltopdf mrix, /usr/sbin/postdrop mrix, /usr/sbin/sendmail mrix, # Allow PHP-FPM to access some /dev /dev/null rw, /dev/random r, /dev/tty wr, /dev/urandom r, # Allow PHP-FPM to access its run directory /run/** rw, # Allow PHP-FPM to use tmp files /home/*/.tmp/ r, /home/*/.tmp/** rw, /tmp/ r, /tmp/** rw, /var/tmp/** rw, # Allow read access to necessary libraries /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /opt/php*/lib/php/** mr, /usr/lib/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/libexec/** mr, /usr/local/include/** mr, /usr/local/ioncube/ioncube_loader_lin_*.so mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, # Allow PHP-FPM to read and write its log files /var/log/newrelic/php_agent.log rw, /var/log/php/** rw, # Allow PHP-FPM to access /proc and /sys for necessary information /proc/** r, /sys/** r, # Allow PHP-FPM to use /dev/shm for temporary storage /dev/shm/ r, /dev/shm/** rw, # Deny execution of binaries from these directories deny /home/*/.tmp/** m, deny /home/*/** m, deny /tmp/** m, deny /var/tmp/** m, # Allow PHP-FPM to read and write in the custom web root directories /var/www/** r, /var/aegir/host_master/** r, /var/aegir/platforms/** r, /data/disk/*/aegir/** r, /data/disk/*/distro/** r, /data/disk/*/platforms/** r, /data/disk/*/static/** r, /data/disk/*/tools/le/** r, /data/all/ r, /data/all/* r, /data/all/** r, /data/conf/ r, /data/conf/* r, /data/conf/** r, owner /var/aegir/host_master/** rw, owner /var/aegir/platforms/** rw, owner /data/disk/*/aegir/** rw, owner /data/disk/*/distro/** rw, owner /data/disk/*/platforms/** rw, owner /data/disk/*/static/** rw, owner /var/www/** rw, /home/*.web/.aws/ r, /home/*.web/.aws/* rw, /home/*.web/.drush/ r, /home/*.web/.drush/* r, /home/*.web/.tmp/ r, /home/*.web/.tmp/* rw, # Deny access to various sensitive directories and files deny /boot/** mrwklx, deny /etc/shadow* rwlx, deny /root/** mrwklx, # Catchall to deny everything else #deny /** rwklx, # Site-specific additions and overrides can be added below } ================================================ FILE: aegir/conf/apparmor/opt.php72.bin.php ================================================ # AppArmor profile for PHP-CLI # This profile restricts PHP-CLI (php72) to essential operations only. #include /opt/php72/bin/php flags=(complain) { # Include common AppArmor abstractions include include include include include # Capabilities needed by PHP-CLI capability audit_write, capability chown, capability dac_override, capability dac_read_search, capability fowner, capability fsetid, capability mknod, capability setgid, capability setuid, capability sys_ptrace, capability sys_resource, # Allow PHP-CLI to execute its own binary /opt/php72/bin/php mrix, # Allow PHP-CLI to signal/ptrace other processes ptrace (read) peer=/opt/php*/bin/php, signal (send) peer=unconfined, signal (send) peer=/usr/sbin/nginx, ptrace (read) peer=/opt/php*/sbin/php-fpm, ptrace (read) peer=/usr/bin/mysqld_safe, ptrace (read) peer=/usr/bin/redis-server, ptrace (read) peer=/usr/local/sbin/pure-ftpd, ptrace (read) peer=/usr/sbin/nginx, ptrace (read) peer=/usr/sbin/rsyslogd, ptrace (read) peer=/usr/sbin/unbound, ptrace (read) peer=unconfined, # Allow PHP-CLI to read required configuration files /data/disk/*/.subversion/ r, /data/disk/*/.subversion/* r, /etc/default/nginx r, /etc/ImageMagick-6/log.xml r, /etc/ImageMagick-6/policy.xml r, /etc/ld.so.cache r, /etc/ldap/ldap.conf r, /etc/mailname r, /etc/mysql/conf.d/ r, /etc/mysql/conf.d/* r, /etc/mysql/my.cnf r, /etc/newrelic/upgrade_please.key r, /etc/nginx/conf.d/ r, /etc/nginx/conf.d/** r, /etc/nginx/fastcgi_params r, /etc/nginx/mime.types r, /etc/nginx/nginx.conf r, /etc/postfix/dynamicmaps.cf r, /etc/postfix/dynamicmaps.cf.d/ r, /etc/postfix/main.cf r, /etc/ssl/private/ r, /etc/ssl/private/* r, /etc/ssl/private/nginx-wild-ssl.crt r, /etc/ssl/private/nginx-wild-ssl.dhp r, /etc/ssl/private/nginx-wild-ssl.key r, /etc/subversion/ r, /etc/subversion/* r, /etc/wgetrc r, /home/*/.drush/ r, /home/*/.drush/** r, /usr/local/share/git-core/templates/ r, /usr/local/share/git-core/templates/* r, /usr/local/share/git-core/templates/** r, /usr/share/GeoIP/GeoIP.dat r, /usr/share/GeoIP/GeoIPv6.dat r, /usr/share/GeoIP/GeoLite2-ASN.mmdb r, /usr/share/GeoIP/GeoLite2-City.mmdb r, /usr/share/GeoIP/GeoLite2-Country.mmdb r, /opt/php72/** r, # Allow PHP-CLI to read required user/access files /etc/login.defs r, /etc/pam.d/* r, /etc/passwd r, /etc/security/capability.conf r, /etc/security/limits.conf r, /etc/security/limits.d/ r, /etc/security/limits.d/* r, /etc/shadow r, /etc/sudo.conf r, /etc/sudoers r, /etc/sudoers.d/ r, /etc/sudoers.d/* r, /run/sudo/ts/ r, /run/sudo/ts/* r, # Allow PHP-CLI to execute some other binaries /usr/bin/symlinks mrix, /bin/cat mrix, /bin/chmod mrix, /bin/chown mrix, /bin/cp mrix, /bin/dash mrix, /bin/date mrix, /bin/egrep mrix, /bin/grep mrix, /bin/kmod mrix, /bin/mkdir mrix, /bin/mv mrix, /bin/pidof mrix, /bin/rm mrix, /bin/run-parts mrix, /bin/sed mrix, /bin/stty mrix, /bin/tar mrix, /bin/touch mrix, /opt/local/bin/websh mrix, /data/disk/*/**/vendor/drush/drush/drush.php mrix, /etc/init.d/nginx mrix, /sbin/killall5 mrix, /sbin/unix_chkpwd mrix, /usr/bin/chromium mrix, /usr/bin/convert mrix, /usr/bin/find mrix, /usr/bin/id mrix, /usr/bin/magick mrix, /usr/bin/mysql mrix, /usr/bin/patch mrix, /usr/bin/sudo mrix, /usr/bin/svn mrix, /usr/bin/tput mrix, /usr/bin/tr mrix, /usr/bin/unzip mrix, /usr/bin/wget mrix, /usr/bin/which mrix, /usr/bin/which.debianutils mrix, /usr/local/bin/composer mrix, /usr/local/bin/curl mrix, /usr/local/bin/fix-drupal-platform-ownership.sh mrix, /usr/local/bin/fix-drupal-platform-permissions.sh mrix, /usr/local/bin/fix-drupal-site-ownership.sh mrix, /usr/local/bin/fix-drupal-site-permissions.sh mrix, /usr/local/bin/git mrix, /usr/local/bin/lock-local-drush-permissions.sh mrix, /usr/local/bin/mydumper mrix, /usr/local/bin/myloader mrix, /usr/local/bin/wkhtmltoimage mrix, /usr/local/bin/wkhtmltopdf mrix, /usr/local/libexec/git-core/* mrix, /usr/local/libexec/git-core/** mrix, /usr/sbin/nginx mrix, /usr/sbin/postdrop mrix, /usr/sbin/sendmail mrix, # Allow PHP-CLI to access some /dev /dev/null rw, /dev/random r, /dev/tty rw, /dev/urandom r, # Allow PHP-CLI to use tmp files /tmp/ r, /tmp/** rw, /var/spool/postfix/maildrop/ r, /var/spool/postfix/maildrop/* rw, /var/tmp/** rw, # Allow read access to necessary libraries /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /opt/php*/lib/php/** mr, /usr/lib/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/libexec/** mr, /usr/local/include/** mr, /usr/local/ioncube/ioncube_loader_lin_*.so mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, # Allow PHP-CLI to read and write its log files /var/log/php/** rw, /var/log/newrelic/php_agent.log rw, # Allow PHP-CLI to write to some other log/pid files /run/nginx.pid rw, /var/log/nginx/access.log rw, /var/log/nginx/error.log rw, # Allow PHP-CLI to access /proc and /sys for necessary information /proc/ r, /proc/** r, /sys/ r, /sys/** r, # Allow PHP-CLI to use /dev/shm for temporary storage /dev/shm/ r, /dev/shm/** rw, # Deny execution of binaries from these directories deny /home/*/.tmp/** m, deny /home/*/** m, deny /tmp/** m, deny /var/tmp/** m, # Allow PHP-CLI to access drush /data/disk/*/tools/drush/ r, /data/disk/*/tools/drush/* mrix, /data/disk/*/tools/drush/** r, /opt/tools/drush/** mrix, /usr/local/bin/cv.phar mrix, /var/aegir/drush/ r, /var/aegir/drush/* mrix, /var/aegir/drush/** r, # Allow PHP-CLI to access System Default Web Root /var/www/** r, owner /var/www/** rw, # Allow PHP-CLI to read/write in the Ægir Backend on Master Instance owner /var/aegir/.drush/ r, owner /var/aegir/.drush/* rw, owner /var/aegir/.drush/** rw, owner /var/aegir/.tmp/ r, owner /var/aegir/.tmp/* rw, owner /var/aegir/.tmp/** rw, owner /var/aegir/config/ r, owner /var/aegir/config/* rw, owner /var/aegir/config/** rw, owner /var/aegir/host_master-*/ r, owner /var/aegir/host_master-*/* rw, owner /var/aegir/host_master-*/** rw, owner /var/aegir/host_master/ r, owner /var/aegir/host_master/* rw, owner /var/aegir/host_master/** rw, owner /var/aegir/platforms/ r, owner /var/aegir/platforms/* rw, owner /var/aegir/platforms/** rw, # Allow PHP-CLI to read/write in the Ægir Backend on Octopus Instances /data/all/ r, /data/all/* r, /data/all/** r, /data/conf/ r, /data/conf/* r, /data/conf/** r, /data/disk/*/.bashrc r, owner /data/disk/*/.cache/**/pack-* l, owner /data/disk/*/static/**/pack-* l, owner /data/disk/*/log/ r, owner /data/disk/*/log/* rw, owner /data/disk/*/.*.pass.php r, owner /data/disk/*/.rnd rw, owner /data/disk/*/backups/ rwl, owner /data/disk/*/backups/* rwl, owner /data/disk/*/backups/** rwl, owner /data/disk/*/backup-exports/ rwl, owner /data/disk/*/backup-exports/* rwl, owner /data/disk/*/backup-exports/** rwl, owner /data/disk/*/.config/ rwl, owner /data/disk/*/.config/* rwl, owner /data/disk/*/.config/** rwl, owner /data/disk/*/.cache/ rwl, owner /data/disk/*/.cache/* rwl, owner /data/disk/*/.cache/** rwl, owner /data/disk/*/.drush/ rwl, owner /data/disk/*/.drush/* rwl, owner /data/disk/*/.drush/** rwl, owner /data/disk/*/.tmp/ rwl, owner /data/disk/*/.tmp/* rwl, owner /data/disk/*/.tmp/** rwl, owner /data/disk/*/clients/ rw, owner /data/disk/*/clients/* rw, owner /data/disk/*/clients/** rw, owner /data/disk/*/config/ rw, owner /data/disk/*/config/* rw, owner /data/disk/*/config/** rw, owner /data/disk/*/tools/le/ rw, owner /data/disk/*/tools/le/* rw, owner /data/disk/*/tools/le/** rw, # Allow PHP-CLI to read/write in the Ægir Frontend on Octopus Instances owner /data/disk/*/aegir/ rw, owner /data/disk/*/aegir/* rw, owner /data/disk/*/aegir/** rw, # Allow PHP-CLI to read/write in the limited shell user home for Drush support owner /home/*/.drush/sites/ rw, owner /home/*/.drush/sites/* rw, owner /home/*/.drush/sites/** rw, owner /home/*/.drush/cache/ rw, owner /home/*/.drush/cache/* rw, owner /home/*/.drush/cache/** rw, owner /home/*/.tmp/ rw, owner /home/*/.tmp/* rw, owner /home/*/.tmp/** rw, # Allow PHP-CLI to read/write in the custom web root directories /data/disk/*/static/ rw, /data/disk/*/static/* rw, /data/disk/*/static/** rw, /data/disk/*/distro/ rw, /data/disk/*/distro/* rw, /data/disk/*/distro/** rw, /data/disk/*/platforms/ rw, /data/disk/*/platforms/* rw, /data/disk/*/platforms/** rw, # Allow PHP-CLI to read and write in the root tmp owner /root/.tmp/ rw, owner /root/.tmp/* rw, owner /root/.tmp/** rw, # Deny access to various sensitive directories and files deny /boot/** mrwklx, # Catchall to deny everything else #deny /** rwklx, # Site-specific additions and overrides can be added below } ================================================ FILE: aegir/conf/apparmor/opt.php72.sbin.php-fpm ================================================ # AppArmor profile for PHP-FPM # This profile restricts the PHP-FPM (php72) to essential operations only. #include /opt/php72/sbin/php-fpm flags=(attach_disconnected) { # Include common AppArmor abstractions include include include include # Capabilities needed by PHP-FPM capability chown, capability dac_override, capability dac_read_search, capability fowner, capability kill, capability setgid, capability setuid, capability sys_resource, # Allow PHP-FPM to accept signal from PHP-CLI processes signal (receive) peer=/opt/php*/bin/php, network inet stream, network inet6 stream, # Allow PHP-FPM to execute its own binary /opt/php72/sbin/php-fpm mrix, # Allow PHP-FPM to read its configuration files /data/conf/ r, /data/conf/** r, /etc/ImageMagick-6/log.xml r, /etc/ImageMagick-6/policy.xml r, /etc/ld.so.cache r, /etc/mailname r, /etc/newrelic/upgrade_please.key r, /etc/postfix/dynamicmaps.cf r, /etc/postfix/dynamicmaps.cf.d/ r, /etc/postfix/dynamicmaps.cf.d/* r, /etc/postfix/main.cf r, /home/*/.drush/** r, /opt/etc/fpm/** r, /var/spool/postfix/maildrop/ r, /var/spool/postfix/maildrop/* rw, /opt/php72/** r, # Allow PHP-FPM to execute some other binaries /bin/dash mrix, /opt/local/bin/websh mrix, /usr/bin/advdef mrix, /usr/bin/advpng mrix, /usr/bin/chromium mrix, /usr/bin/convert mrix, /usr/bin/id mrix, /usr/bin/jpegoptim mrix, /usr/bin/jpegtran mrix, /usr/bin/magick mrix, /usr/bin/optipng mrix, /usr/bin/pngcrush mrix, /usr/bin/pngquant mrix, /usr/lib/postfix/sbin/smtpd mrix, /usr/local/bin/curl mrix, /usr/local/bin/wkhtmltoimage mrix, /usr/local/bin/wkhtmltopdf mrix, /usr/sbin/postdrop mrix, /usr/sbin/sendmail mrix, # Allow PHP-FPM to access some /dev /dev/null rw, /dev/random r, /dev/tty wr, /dev/urandom r, # Allow PHP-FPM to access its run directory /run/** rw, # Allow PHP-FPM to use tmp files /home/*/.tmp/ r, /home/*/.tmp/** rw, /tmp/ r, /tmp/** rw, /var/tmp/** rw, # Allow read access to necessary libraries /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /opt/php*/lib/php/** mr, /usr/lib/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/libexec/** mr, /usr/local/include/** mr, /usr/local/ioncube/ioncube_loader_lin_*.so mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, # Allow PHP-FPM to read and write its log files /var/log/newrelic/php_agent.log rw, /var/log/php/** rw, # Allow PHP-FPM to access /proc and /sys for necessary information /proc/** r, /sys/** r, # Allow PHP-FPM to use /dev/shm for temporary storage /dev/shm/ r, /dev/shm/** rw, # Deny execution of binaries from these directories deny /home/*/.tmp/** m, deny /home/*/** m, deny /tmp/** m, deny /var/tmp/** m, # Allow PHP-FPM to read and write in the custom web root directories /var/www/** r, /var/aegir/host_master/** r, /var/aegir/platforms/** r, /data/disk/*/aegir/** r, /data/disk/*/distro/** r, /data/disk/*/platforms/** r, /data/disk/*/static/** r, /data/disk/*/tools/le/** r, /data/all/ r, /data/all/* r, /data/all/** r, /data/conf/ r, /data/conf/* r, /data/conf/** r, owner /var/aegir/host_master/** rw, owner /var/aegir/platforms/** rw, owner /data/disk/*/aegir/** rw, owner /data/disk/*/distro/** rw, owner /data/disk/*/platforms/** rw, owner /data/disk/*/static/** rw, owner /var/www/** rw, /home/*.web/.aws/ r, /home/*.web/.aws/* rw, /home/*.web/.drush/ r, /home/*.web/.drush/* r, /home/*.web/.tmp/ r, /home/*.web/.tmp/* rw, # Deny access to various sensitive directories and files deny /boot/** mrwklx, deny /etc/shadow* rwlx, deny /root/** mrwklx, # Catchall to deny everything else #deny /** rwklx, # Site-specific additions and overrides can be added below } ================================================ FILE: aegir/conf/apparmor/opt.php73.bin.php ================================================ # AppArmor profile for PHP-CLI # This profile restricts PHP-CLI (php73) to essential operations only. #include /opt/php73/bin/php flags=(complain) { # Include common AppArmor abstractions include include include include include # Capabilities needed by PHP-CLI capability audit_write, capability chown, capability dac_override, capability dac_read_search, capability fowner, capability fsetid, capability mknod, capability setgid, capability setuid, capability sys_ptrace, capability sys_resource, # Allow PHP-CLI to execute its own binary /opt/php73/bin/php mrix, # Allow PHP-CLI to signal/ptrace other processes ptrace (read) peer=/opt/php*/bin/php, signal (send) peer=unconfined, signal (send) peer=/usr/sbin/nginx, ptrace (read) peer=/opt/php*/sbin/php-fpm, ptrace (read) peer=/usr/bin/mysqld_safe, ptrace (read) peer=/usr/bin/redis-server, ptrace (read) peer=/usr/local/sbin/pure-ftpd, ptrace (read) peer=/usr/sbin/nginx, ptrace (read) peer=/usr/sbin/rsyslogd, ptrace (read) peer=/usr/sbin/unbound, ptrace (read) peer=unconfined, # Allow PHP-CLI to read required configuration files /data/disk/*/.subversion/ r, /data/disk/*/.subversion/* r, /etc/default/nginx r, /etc/ImageMagick-6/log.xml r, /etc/ImageMagick-6/policy.xml r, /etc/ld.so.cache r, /etc/ldap/ldap.conf r, /etc/mailname r, /etc/mysql/conf.d/ r, /etc/mysql/conf.d/* r, /etc/mysql/my.cnf r, /etc/newrelic/upgrade_please.key r, /etc/nginx/conf.d/ r, /etc/nginx/conf.d/** r, /etc/nginx/fastcgi_params r, /etc/nginx/mime.types r, /etc/nginx/nginx.conf r, /etc/postfix/dynamicmaps.cf r, /etc/postfix/dynamicmaps.cf.d/ r, /etc/postfix/main.cf r, /etc/ssl/private/ r, /etc/ssl/private/* r, /etc/ssl/private/nginx-wild-ssl.crt r, /etc/ssl/private/nginx-wild-ssl.dhp r, /etc/ssl/private/nginx-wild-ssl.key r, /etc/subversion/ r, /etc/subversion/* r, /etc/wgetrc r, /home/*/.drush/ r, /home/*/.drush/** r, /usr/local/share/git-core/templates/ r, /usr/local/share/git-core/templates/* r, /usr/local/share/git-core/templates/** r, /usr/share/GeoIP/GeoIP.dat r, /usr/share/GeoIP/GeoIPv6.dat r, /usr/share/GeoIP/GeoLite2-ASN.mmdb r, /usr/share/GeoIP/GeoLite2-City.mmdb r, /usr/share/GeoIP/GeoLite2-Country.mmdb r, /opt/php73/** r, # Allow PHP-CLI to read required user/access files /etc/login.defs r, /etc/pam.d/* r, /etc/passwd r, /etc/security/capability.conf r, /etc/security/limits.conf r, /etc/security/limits.d/ r, /etc/security/limits.d/* r, /etc/shadow r, /etc/sudo.conf r, /etc/sudoers r, /etc/sudoers.d/ r, /etc/sudoers.d/* r, /run/sudo/ts/ r, /run/sudo/ts/* r, # Allow PHP-CLI to execute some other binaries /usr/bin/symlinks mrix, /bin/cat mrix, /bin/chmod mrix, /bin/chown mrix, /bin/cp mrix, /bin/dash mrix, /bin/date mrix, /bin/egrep mrix, /bin/grep mrix, /bin/kmod mrix, /bin/mkdir mrix, /bin/mv mrix, /bin/pidof mrix, /bin/rm mrix, /bin/run-parts mrix, /bin/sed mrix, /bin/stty mrix, /bin/tar mrix, /bin/touch mrix, /opt/local/bin/websh mrix, /data/disk/*/**/vendor/drush/drush/drush.php mrix, /etc/init.d/nginx mrix, /sbin/killall5 mrix, /sbin/unix_chkpwd mrix, /usr/bin/chromium mrix, /usr/bin/convert mrix, /usr/bin/find mrix, /usr/bin/id mrix, /usr/bin/magick mrix, /usr/bin/mysql mrix, /usr/bin/patch mrix, /usr/bin/sudo mrix, /usr/bin/svn mrix, /usr/bin/tput mrix, /usr/bin/tr mrix, /usr/bin/unzip mrix, /usr/bin/wget mrix, /usr/bin/which mrix, /usr/bin/which.debianutils mrix, /usr/local/bin/composer mrix, /usr/local/bin/curl mrix, /usr/local/bin/fix-drupal-platform-ownership.sh mrix, /usr/local/bin/fix-drupal-platform-permissions.sh mrix, /usr/local/bin/fix-drupal-site-ownership.sh mrix, /usr/local/bin/fix-drupal-site-permissions.sh mrix, /usr/local/bin/git mrix, /usr/local/bin/lock-local-drush-permissions.sh mrix, /usr/local/bin/mydumper mrix, /usr/local/bin/myloader mrix, /usr/local/bin/wkhtmltoimage mrix, /usr/local/bin/wkhtmltopdf mrix, /usr/local/libexec/git-core/* mrix, /usr/local/libexec/git-core/** mrix, /usr/sbin/nginx mrix, /usr/sbin/postdrop mrix, /usr/sbin/sendmail mrix, # Allow PHP-CLI to access some /dev /dev/null rw, /dev/random r, /dev/tty rw, /dev/urandom r, # Allow PHP-CLI to use tmp files /tmp/ r, /tmp/** rw, /var/spool/postfix/maildrop/ r, /var/spool/postfix/maildrop/* rw, /var/tmp/** rw, # Allow read access to necessary libraries /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /opt/php*/lib/php/** mr, /usr/lib/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/libexec/** mr, /usr/local/include/** mr, /usr/local/ioncube/ioncube_loader_lin_*.so mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, # Allow PHP-CLI to read and write its log files /var/log/php/** rw, /var/log/newrelic/php_agent.log rw, # Allow PHP-CLI to write to some other log/pid files /run/nginx.pid rw, /var/log/nginx/access.log rw, /var/log/nginx/error.log rw, # Allow PHP-CLI to access /proc and /sys for necessary information /proc/ r, /proc/** r, /sys/ r, /sys/** r, # Allow PHP-CLI to use /dev/shm for temporary storage /dev/shm/ r, /dev/shm/** rw, # Deny execution of binaries from these directories deny /home/*/.tmp/** m, deny /home/*/** m, deny /tmp/** m, deny /var/tmp/** m, # Allow PHP-CLI to access drush /data/disk/*/tools/drush/ r, /data/disk/*/tools/drush/* mrix, /data/disk/*/tools/drush/** r, /opt/tools/drush/** mrix, /usr/local/bin/cv.phar mrix, /var/aegir/drush/ r, /var/aegir/drush/* mrix, /var/aegir/drush/** r, # Allow PHP-CLI to access System Default Web Root /var/www/** r, owner /var/www/** rw, # Allow PHP-CLI to read/write in the Ægir Backend on Master Instance owner /var/aegir/.drush/ r, owner /var/aegir/.drush/* rw, owner /var/aegir/.drush/** rw, owner /var/aegir/.tmp/ r, owner /var/aegir/.tmp/* rw, owner /var/aegir/.tmp/** rw, owner /var/aegir/config/ r, owner /var/aegir/config/* rw, owner /var/aegir/config/** rw, owner /var/aegir/host_master-*/ r, owner /var/aegir/host_master-*/* rw, owner /var/aegir/host_master-*/** rw, owner /var/aegir/host_master/ r, owner /var/aegir/host_master/* rw, owner /var/aegir/host_master/** rw, owner /var/aegir/platforms/ r, owner /var/aegir/platforms/* rw, owner /var/aegir/platforms/** rw, # Allow PHP-CLI to read/write in the Ægir Backend on Octopus Instances /data/all/ r, /data/all/* r, /data/all/** r, /data/conf/ r, /data/conf/* r, /data/conf/** r, /data/disk/*/.bashrc r, owner /data/disk/*/.cache/**/pack-* l, owner /data/disk/*/static/**/pack-* l, owner /data/disk/*/log/ r, owner /data/disk/*/log/* rw, owner /data/disk/*/.*.pass.php r, owner /data/disk/*/.rnd rw, owner /data/disk/*/backups/ rwl, owner /data/disk/*/backups/* rwl, owner /data/disk/*/backups/** rwl, owner /data/disk/*/backup-exports/ rwl, owner /data/disk/*/backup-exports/* rwl, owner /data/disk/*/backup-exports/** rwl, owner /data/disk/*/.config/ rwl, owner /data/disk/*/.config/* rwl, owner /data/disk/*/.config/** rwl, owner /data/disk/*/.cache/ rwl, owner /data/disk/*/.cache/* rwl, owner /data/disk/*/.cache/** rwl, owner /data/disk/*/.drush/ rwl, owner /data/disk/*/.drush/* rwl, owner /data/disk/*/.drush/** rwl, owner /data/disk/*/.tmp/ rwl, owner /data/disk/*/.tmp/* rwl, owner /data/disk/*/.tmp/** rwl, owner /data/disk/*/clients/ rw, owner /data/disk/*/clients/* rw, owner /data/disk/*/clients/** rw, owner /data/disk/*/config/ rw, owner /data/disk/*/config/* rw, owner /data/disk/*/config/** rw, owner /data/disk/*/tools/le/ rw, owner /data/disk/*/tools/le/* rw, owner /data/disk/*/tools/le/** rw, # Allow PHP-CLI to read/write in the Ægir Frontend on Octopus Instances owner /data/disk/*/aegir/ rw, owner /data/disk/*/aegir/* rw, owner /data/disk/*/aegir/** rw, # Allow PHP-CLI to read/write in the limited shell user home for Drush support owner /home/*/.drush/sites/ rw, owner /home/*/.drush/sites/* rw, owner /home/*/.drush/sites/** rw, owner /home/*/.drush/cache/ rw, owner /home/*/.drush/cache/* rw, owner /home/*/.drush/cache/** rw, owner /home/*/.tmp/ rw, owner /home/*/.tmp/* rw, owner /home/*/.tmp/** rw, # Allow PHP-CLI to read/write in the custom web root directories /data/disk/*/static/ rw, /data/disk/*/static/* rw, /data/disk/*/static/** rw, /data/disk/*/distro/ rw, /data/disk/*/distro/* rw, /data/disk/*/distro/** rw, /data/disk/*/platforms/ rw, /data/disk/*/platforms/* rw, /data/disk/*/platforms/** rw, # Allow PHP-CLI to read and write in the root tmp owner /root/.tmp/ rw, owner /root/.tmp/* rw, owner /root/.tmp/** rw, # Deny access to various sensitive directories and files deny /boot/** mrwklx, # Catchall to deny everything else #deny /** rwklx, # Site-specific additions and overrides can be added below } ================================================ FILE: aegir/conf/apparmor/opt.php73.sbin.php-fpm ================================================ # AppArmor profile for PHP-FPM # This profile restricts the PHP-FPM (php73) to essential operations only. #include /opt/php73/sbin/php-fpm flags=(attach_disconnected) { # Include common AppArmor abstractions include include include include # Capabilities needed by PHP-FPM capability chown, capability dac_override, capability dac_read_search, capability fowner, capability kill, capability setgid, capability setuid, capability sys_resource, # Allow PHP-FPM to accept signal from PHP-CLI processes signal (receive) peer=/opt/php*/bin/php, network inet stream, network inet6 stream, # Allow PHP-FPM to execute its own binary /opt/php73/sbin/php-fpm mrix, # Allow PHP-FPM to read its configuration files /data/conf/ r, /data/conf/** r, /etc/ImageMagick-6/log.xml r, /etc/ImageMagick-6/policy.xml r, /etc/ld.so.cache r, /etc/mailname r, /etc/newrelic/upgrade_please.key r, /etc/postfix/dynamicmaps.cf r, /etc/postfix/dynamicmaps.cf.d/ r, /etc/postfix/dynamicmaps.cf.d/* r, /etc/postfix/main.cf r, /home/*/.drush/** r, /opt/etc/fpm/** r, /var/spool/postfix/maildrop/ r, /var/spool/postfix/maildrop/* rw, /opt/php73/** r, # Allow PHP-FPM to execute some other binaries /bin/dash mrix, /opt/local/bin/websh mrix, /usr/bin/advdef mrix, /usr/bin/advpng mrix, /usr/bin/chromium mrix, /usr/bin/convert mrix, /usr/bin/id mrix, /usr/bin/jpegoptim mrix, /usr/bin/jpegtran mrix, /usr/bin/magick mrix, /usr/bin/optipng mrix, /usr/bin/pngcrush mrix, /usr/bin/pngquant mrix, /usr/lib/postfix/sbin/smtpd mrix, /usr/local/bin/curl mrix, /usr/local/bin/wkhtmltoimage mrix, /usr/local/bin/wkhtmltopdf mrix, /usr/sbin/postdrop mrix, /usr/sbin/sendmail mrix, # Allow PHP-FPM to access some /dev /dev/null rw, /dev/random r, /dev/tty wr, /dev/urandom r, # Allow PHP-FPM to access its run directory /run/** rw, # Allow PHP-FPM to use tmp files /home/*/.tmp/ r, /home/*/.tmp/** rw, /tmp/ r, /tmp/** rw, /var/tmp/** rw, # Allow read access to necessary libraries /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /opt/php*/lib/php/** mr, /usr/lib/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/libexec/** mr, /usr/local/include/** mr, /usr/local/ioncube/ioncube_loader_lin_*.so mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, # Allow PHP-FPM to read and write its log files /var/log/newrelic/php_agent.log rw, /var/log/php/** rw, # Allow PHP-FPM to access /proc and /sys for necessary information /proc/** r, /sys/** r, # Allow PHP-FPM to use /dev/shm for temporary storage /dev/shm/ r, /dev/shm/** rw, # Deny execution of binaries from these directories deny /home/*/.tmp/** m, deny /home/*/** m, deny /tmp/** m, deny /var/tmp/** m, # Allow PHP-FPM to read and write in the custom web root directories /var/www/** r, /var/aegir/host_master/** r, /var/aegir/platforms/** r, /data/disk/*/aegir/** r, /data/disk/*/distro/** r, /data/disk/*/platforms/** r, /data/disk/*/static/** r, /data/disk/*/tools/le/** r, /data/all/ r, /data/all/* r, /data/all/** r, /data/conf/ r, /data/conf/* r, /data/conf/** r, owner /var/aegir/host_master/** rw, owner /var/aegir/platforms/** rw, owner /data/disk/*/aegir/** rw, owner /data/disk/*/distro/** rw, owner /data/disk/*/platforms/** rw, owner /data/disk/*/static/** rw, owner /var/www/** rw, /home/*.web/.aws/ r, /home/*.web/.aws/* rw, /home/*.web/.drush/ r, /home/*.web/.drush/* r, /home/*.web/.tmp/ r, /home/*.web/.tmp/* rw, # Deny access to various sensitive directories and files deny /boot/** mrwklx, deny /etc/shadow* rwlx, deny /root/** mrwklx, # Catchall to deny everything else #deny /** rwklx, # Site-specific additions and overrides can be added below } ================================================ FILE: aegir/conf/apparmor/opt.php74.bin.php ================================================ # AppArmor profile for PHP-CLI # This profile restricts PHP-CLI (php74) to essential operations only. #include /opt/php74/bin/php flags=(complain) { # Include common AppArmor abstractions include include include include include # Capabilities needed by PHP-CLI capability audit_write, capability chown, capability dac_override, capability dac_read_search, capability fowner, capability fsetid, capability mknod, capability setgid, capability setuid, capability sys_ptrace, capability sys_resource, # Allow PHP-CLI to execute its own binary /opt/php74/bin/php mrix, # Allow PHP-CLI to signal/ptrace other processes ptrace (read) peer=/opt/php*/bin/php, signal (send) peer=unconfined, signal (send) peer=/usr/sbin/nginx, ptrace (read) peer=/opt/php*/sbin/php-fpm, ptrace (read) peer=/usr/bin/mysqld_safe, ptrace (read) peer=/usr/bin/redis-server, ptrace (read) peer=/usr/local/sbin/pure-ftpd, ptrace (read) peer=/usr/sbin/nginx, ptrace (read) peer=/usr/sbin/rsyslogd, ptrace (read) peer=/usr/sbin/unbound, ptrace (read) peer=unconfined, # Allow PHP-CLI to read required configuration files /data/disk/*/.subversion/ r, /data/disk/*/.subversion/* r, /etc/default/nginx r, /etc/ImageMagick-6/log.xml r, /etc/ImageMagick-6/policy.xml r, /etc/ld.so.cache r, /etc/ldap/ldap.conf r, /etc/mailname r, /etc/mysql/conf.d/ r, /etc/mysql/conf.d/* r, /etc/mysql/my.cnf r, /etc/newrelic/upgrade_please.key r, /etc/nginx/conf.d/ r, /etc/nginx/conf.d/** r, /etc/nginx/fastcgi_params r, /etc/nginx/mime.types r, /etc/nginx/nginx.conf r, /etc/postfix/dynamicmaps.cf r, /etc/postfix/dynamicmaps.cf.d/ r, /etc/postfix/main.cf r, /etc/ssl/private/ r, /etc/ssl/private/* r, /etc/ssl/private/nginx-wild-ssl.crt r, /etc/ssl/private/nginx-wild-ssl.dhp r, /etc/ssl/private/nginx-wild-ssl.key r, /etc/subversion/ r, /etc/subversion/* r, /etc/wgetrc r, /home/*/.drush/ r, /home/*/.drush/** r, /usr/local/share/git-core/templates/ r, /usr/local/share/git-core/templates/* r, /usr/local/share/git-core/templates/** r, /usr/share/GeoIP/GeoIP.dat r, /usr/share/GeoIP/GeoIPv6.dat r, /usr/share/GeoIP/GeoLite2-ASN.mmdb r, /usr/share/GeoIP/GeoLite2-City.mmdb r, /usr/share/GeoIP/GeoLite2-Country.mmdb r, /opt/php74/** r, # Allow PHP-CLI to read required user/access files /etc/login.defs r, /etc/pam.d/* r, /etc/passwd r, /etc/security/capability.conf r, /etc/security/limits.conf r, /etc/security/limits.d/ r, /etc/security/limits.d/* r, /etc/shadow r, /etc/sudo.conf r, /etc/sudoers r, /etc/sudoers.d/ r, /etc/sudoers.d/* r, /run/sudo/ts/ r, /run/sudo/ts/* r, # Allow PHP-CLI to execute some other binaries /usr/bin/symlinks mrix, /bin/cat mrix, /bin/chmod mrix, /bin/chown mrix, /bin/cp mrix, /bin/dash mrix, /bin/date mrix, /bin/egrep mrix, /bin/grep mrix, /bin/kmod mrix, /bin/mkdir mrix, /bin/mv mrix, /bin/pidof mrix, /bin/rm mrix, /bin/run-parts mrix, /bin/sed mrix, /bin/stty mrix, /bin/tar mrix, /bin/touch mrix, /opt/local/bin/websh mrix, /data/disk/*/**/vendor/drush/drush/drush.php mrix, /etc/init.d/nginx mrix, /sbin/killall5 mrix, /sbin/unix_chkpwd mrix, /usr/bin/chromium mrix, /usr/bin/convert mrix, /usr/bin/find mrix, /usr/bin/id mrix, /usr/bin/magick mrix, /usr/bin/mysql mrix, /usr/bin/patch mrix, /usr/bin/sudo mrix, /usr/bin/svn mrix, /usr/bin/tput mrix, /usr/bin/tr mrix, /usr/bin/unzip mrix, /usr/bin/wget mrix, /usr/bin/which mrix, /usr/bin/which.debianutils mrix, /usr/local/bin/composer mrix, /usr/local/bin/curl mrix, /usr/local/bin/fix-drupal-platform-ownership.sh mrix, /usr/local/bin/fix-drupal-platform-permissions.sh mrix, /usr/local/bin/fix-drupal-site-ownership.sh mrix, /usr/local/bin/fix-drupal-site-permissions.sh mrix, /usr/local/bin/git mrix, /usr/local/bin/lock-local-drush-permissions.sh mrix, /usr/local/bin/mydumper mrix, /usr/local/bin/myloader mrix, /usr/local/bin/wkhtmltoimage mrix, /usr/local/bin/wkhtmltopdf mrix, /usr/local/libexec/git-core/* mrix, /usr/local/libexec/git-core/** mrix, /usr/sbin/nginx mrix, /usr/sbin/postdrop mrix, /usr/sbin/sendmail mrix, # Allow PHP-CLI to access some /dev /dev/null rw, /dev/random r, /dev/tty rw, /dev/urandom r, # Allow PHP-CLI to use tmp files /tmp/ r, /tmp/** rw, /var/spool/postfix/maildrop/ r, /var/spool/postfix/maildrop/* rw, /var/tmp/** rw, # Allow read access to necessary libraries /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /opt/php*/lib/php/** mr, /usr/lib/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/libexec/** mr, /usr/local/include/** mr, /usr/local/ioncube/ioncube_loader_lin_*.so mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, # Allow PHP-CLI to read and write its log files /var/log/php/** rw, /var/log/newrelic/php_agent.log rw, # Allow PHP-CLI to write to some other log/pid files /run/nginx.pid rw, /var/log/nginx/access.log rw, /var/log/nginx/error.log rw, # Allow PHP-CLI to access /proc and /sys for necessary information /proc/ r, /proc/** r, /sys/ r, /sys/** r, # Allow PHP-CLI to use /dev/shm for temporary storage /dev/shm/ r, /dev/shm/** rw, # Deny execution of binaries from these directories deny /home/*/.tmp/** m, deny /home/*/** m, deny /tmp/** m, deny /var/tmp/** m, # Allow PHP-CLI to access drush /data/disk/*/tools/drush/ r, /data/disk/*/tools/drush/* mrix, /data/disk/*/tools/drush/** r, /opt/tools/drush/** mrix, /usr/local/bin/cv.phar mrix, /var/aegir/drush/ r, /var/aegir/drush/* mrix, /var/aegir/drush/** r, # Allow PHP-CLI to access System Default Web Root /var/www/** r, owner /var/www/** rw, # Allow PHP-CLI to read/write in the Ægir Backend on Master Instance owner /var/aegir/.drush/ r, owner /var/aegir/.drush/* rw, owner /var/aegir/.drush/** rw, owner /var/aegir/.tmp/ r, owner /var/aegir/.tmp/* rw, owner /var/aegir/.tmp/** rw, owner /var/aegir/config/ r, owner /var/aegir/config/* rw, owner /var/aegir/config/** rw, owner /var/aegir/host_master-*/ r, owner /var/aegir/host_master-*/* rw, owner /var/aegir/host_master-*/** rw, owner /var/aegir/host_master/ r, owner /var/aegir/host_master/* rw, owner /var/aegir/host_master/** rw, owner /var/aegir/platforms/ r, owner /var/aegir/platforms/* rw, owner /var/aegir/platforms/** rw, # Allow PHP-CLI to read/write in the Ægir Backend on Octopus Instances /data/all/ r, /data/all/* r, /data/all/** r, /data/conf/ r, /data/conf/* r, /data/conf/** r, /data/disk/*/.bashrc r, owner /data/disk/*/.cache/**/pack-* l, owner /data/disk/*/static/**/pack-* l, owner /data/disk/*/log/ r, owner /data/disk/*/log/* rw, owner /data/disk/*/.*.pass.php r, owner /data/disk/*/.rnd rw, owner /data/disk/*/backups/ rwl, owner /data/disk/*/backups/* rwl, owner /data/disk/*/backups/** rwl, owner /data/disk/*/backup-exports/ rwl, owner /data/disk/*/backup-exports/* rwl, owner /data/disk/*/backup-exports/** rwl, owner /data/disk/*/.config/ rwl, owner /data/disk/*/.config/* rwl, owner /data/disk/*/.config/** rwl, owner /data/disk/*/.cache/ rwl, owner /data/disk/*/.cache/* rwl, owner /data/disk/*/.cache/** rwl, owner /data/disk/*/.drush/ rwl, owner /data/disk/*/.drush/* rwl, owner /data/disk/*/.drush/** rwl, owner /data/disk/*/.tmp/ rwl, owner /data/disk/*/.tmp/* rwl, owner /data/disk/*/.tmp/** rwl, owner /data/disk/*/clients/ rw, owner /data/disk/*/clients/* rw, owner /data/disk/*/clients/** rw, owner /data/disk/*/config/ rw, owner /data/disk/*/config/* rw, owner /data/disk/*/config/** rw, owner /data/disk/*/tools/le/ rw, owner /data/disk/*/tools/le/* rw, owner /data/disk/*/tools/le/** rw, # Allow PHP-CLI to read/write in the Ægir Frontend on Octopus Instances owner /data/disk/*/aegir/ rw, owner /data/disk/*/aegir/* rw, owner /data/disk/*/aegir/** rw, # Allow PHP-CLI to read/write in the limited shell user home for Drush support owner /home/*/.drush/sites/ rw, owner /home/*/.drush/sites/* rw, owner /home/*/.drush/sites/** rw, owner /home/*/.drush/cache/ rw, owner /home/*/.drush/cache/* rw, owner /home/*/.drush/cache/** rw, owner /home/*/.tmp/ rw, owner /home/*/.tmp/* rw, owner /home/*/.tmp/** rw, # Allow PHP-CLI to read/write in the custom web root directories /data/disk/*/static/ rw, /data/disk/*/static/* rw, /data/disk/*/static/** rw, /data/disk/*/distro/ rw, /data/disk/*/distro/* rw, /data/disk/*/distro/** rw, /data/disk/*/platforms/ rw, /data/disk/*/platforms/* rw, /data/disk/*/platforms/** rw, # Allow PHP-CLI to read and write in the root tmp owner /root/.tmp/ rw, owner /root/.tmp/* rw, owner /root/.tmp/** rw, # Deny access to various sensitive directories and files deny /boot/** mrwklx, # Catchall to deny everything else #deny /** rwklx, # Site-specific additions and overrides can be added below } ================================================ FILE: aegir/conf/apparmor/opt.php74.sbin.php-fpm ================================================ # AppArmor profile for PHP-FPM # This profile restricts the PHP-FPM (php74) to essential operations only. #include /opt/php74/sbin/php-fpm flags=(attach_disconnected) { # Include common AppArmor abstractions include include include include # Capabilities needed by PHP-FPM capability chown, capability dac_override, capability dac_read_search, capability fowner, capability kill, capability setgid, capability setuid, capability sys_resource, # Allow PHP-FPM to accept signal from PHP-CLI processes signal (receive) peer=/opt/php*/bin/php, network inet stream, network inet6 stream, # Allow PHP-FPM to execute its own binary /opt/php74/sbin/php-fpm mrix, # Allow PHP-FPM to read its configuration files /data/conf/ r, /data/conf/** r, /etc/ImageMagick-6/log.xml r, /etc/ImageMagick-6/policy.xml r, /etc/ld.so.cache r, /etc/mailname r, /etc/newrelic/upgrade_please.key r, /etc/postfix/dynamicmaps.cf r, /etc/postfix/dynamicmaps.cf.d/ r, /etc/postfix/dynamicmaps.cf.d/* r, /etc/postfix/main.cf r, /home/*/.drush/** r, /opt/etc/fpm/** r, /var/spool/postfix/maildrop/ r, /var/spool/postfix/maildrop/* rw, /opt/php74/** r, # Allow PHP-FPM to execute some other binaries /bin/dash mrix, /opt/local/bin/websh mrix, /usr/bin/advdef mrix, /usr/bin/advpng mrix, /usr/bin/chromium mrix, /usr/bin/convert mrix, /usr/bin/id mrix, /usr/bin/jpegoptim mrix, /usr/bin/jpegtran mrix, /usr/bin/magick mrix, /usr/bin/optipng mrix, /usr/bin/pngcrush mrix, /usr/bin/pngquant mrix, /usr/lib/postfix/sbin/smtpd mrix, /usr/local/bin/curl mrix, /usr/local/bin/wkhtmltoimage mrix, /usr/local/bin/wkhtmltopdf mrix, /usr/sbin/postdrop mrix, /usr/sbin/sendmail mrix, # Allow PHP-FPM to access some /dev /dev/null rw, /dev/random r, /dev/tty wr, /dev/urandom r, # Allow PHP-FPM to access its run directory /run/** rw, # Allow PHP-FPM to use tmp files /home/*/.tmp/ r, /home/*/.tmp/** rw, /tmp/ r, /tmp/** rw, /var/tmp/** rw, # Allow read access to necessary libraries /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /opt/php*/lib/php/** mr, /usr/lib/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/libexec/** mr, /usr/local/include/** mr, /usr/local/ioncube/ioncube_loader_lin_*.so mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, # Allow PHP-FPM to read and write its log files /var/log/newrelic/php_agent.log rw, /var/log/php/** rw, # Allow PHP-FPM to access /proc and /sys for necessary information /proc/** r, /sys/** r, # Allow PHP-FPM to use /dev/shm for temporary storage /dev/shm/ r, /dev/shm/** rw, # Deny execution of binaries from these directories deny /home/*/.tmp/** m, deny /home/*/** m, deny /tmp/** m, deny /var/tmp/** m, # Allow PHP-FPM to read and write in the custom web root directories /var/www/** r, /var/aegir/host_master/** r, /var/aegir/platforms/** r, /data/disk/*/aegir/** r, /data/disk/*/distro/** r, /data/disk/*/platforms/** r, /data/disk/*/static/** r, /data/disk/*/tools/le/** r, /data/all/ r, /data/all/* r, /data/all/** r, /data/conf/ r, /data/conf/* r, /data/conf/** r, owner /var/aegir/host_master/** rw, owner /var/aegir/platforms/** rw, owner /data/disk/*/aegir/** rw, owner /data/disk/*/distro/** rw, owner /data/disk/*/platforms/** rw, owner /data/disk/*/static/** rw, owner /var/www/** rw, /home/*.web/.aws/ r, /home/*.web/.aws/* rw, /home/*.web/.drush/ r, /home/*.web/.drush/* r, /home/*.web/.tmp/ r, /home/*.web/.tmp/* rw, # Deny access to various sensitive directories and files deny /boot/** mrwklx, deny /etc/shadow* rwlx, deny /root/** mrwklx, # Catchall to deny everything else #deny /** rwklx, # Site-specific additions and overrides can be added below } ================================================ FILE: aegir/conf/apparmor/opt.php80.bin.php ================================================ # AppArmor profile for PHP-CLI # This profile restricts PHP-CLI (php80) to essential operations only. #include /opt/php80/bin/php flags=(complain) { # Include common AppArmor abstractions include include include include include # Capabilities needed by PHP-CLI capability audit_write, capability chown, capability dac_override, capability dac_read_search, capability fowner, capability fsetid, capability mknod, capability setgid, capability setuid, capability sys_ptrace, capability sys_resource, # Allow PHP-CLI to execute its own binary /opt/php80/bin/php mrix, # Allow PHP-CLI to signal/ptrace other processes ptrace (read) peer=/opt/php*/bin/php, signal (send) peer=unconfined, signal (send) peer=/usr/sbin/nginx, ptrace (read) peer=/opt/php*/sbin/php-fpm, ptrace (read) peer=/usr/bin/mysqld_safe, ptrace (read) peer=/usr/bin/redis-server, ptrace (read) peer=/usr/local/sbin/pure-ftpd, ptrace (read) peer=/usr/sbin/nginx, ptrace (read) peer=/usr/sbin/rsyslogd, ptrace (read) peer=/usr/sbin/unbound, ptrace (read) peer=unconfined, # Allow PHP-CLI to read required configuration files /data/disk/*/.subversion/ r, /data/disk/*/.subversion/* r, /etc/default/nginx r, /etc/ImageMagick-6/log.xml r, /etc/ImageMagick-6/policy.xml r, /etc/ld.so.cache r, /etc/ldap/ldap.conf r, /etc/mailname r, /etc/mysql/conf.d/ r, /etc/mysql/conf.d/* r, /etc/mysql/my.cnf r, /etc/newrelic/upgrade_please.key r, /etc/nginx/conf.d/ r, /etc/nginx/conf.d/** r, /etc/nginx/fastcgi_params r, /etc/nginx/mime.types r, /etc/nginx/nginx.conf r, /etc/postfix/dynamicmaps.cf r, /etc/postfix/dynamicmaps.cf.d/ r, /etc/postfix/main.cf r, /etc/ssl/private/ r, /etc/ssl/private/* r, /etc/ssl/private/nginx-wild-ssl.crt r, /etc/ssl/private/nginx-wild-ssl.dhp r, /etc/ssl/private/nginx-wild-ssl.key r, /etc/subversion/ r, /etc/subversion/* r, /etc/wgetrc r, /home/*/.drush/ r, /home/*/.drush/** r, /usr/local/share/git-core/templates/ r, /usr/local/share/git-core/templates/* r, /usr/local/share/git-core/templates/** r, /usr/share/GeoIP/GeoIP.dat r, /usr/share/GeoIP/GeoIPv6.dat r, /usr/share/GeoIP/GeoLite2-ASN.mmdb r, /usr/share/GeoIP/GeoLite2-City.mmdb r, /usr/share/GeoIP/GeoLite2-Country.mmdb r, /opt/php80/** r, # Allow PHP-CLI to read required user/access files /etc/login.defs r, /etc/pam.d/* r, /etc/passwd r, /etc/security/capability.conf r, /etc/security/limits.conf r, /etc/security/limits.d/ r, /etc/security/limits.d/* r, /etc/shadow r, /etc/sudo.conf r, /etc/sudoers r, /etc/sudoers.d/ r, /etc/sudoers.d/* r, /run/sudo/ts/ r, /run/sudo/ts/* r, # Allow PHP-CLI to execute some other binaries /usr/bin/symlinks mrix, /bin/cat mrix, /bin/chmod mrix, /bin/chown mrix, /bin/cp mrix, /bin/dash mrix, /bin/date mrix, /bin/egrep mrix, /bin/grep mrix, /bin/kmod mrix, /bin/mkdir mrix, /bin/mv mrix, /bin/pidof mrix, /bin/rm mrix, /bin/run-parts mrix, /bin/sed mrix, /bin/stty mrix, /bin/tar mrix, /bin/touch mrix, /opt/local/bin/websh mrix, /data/disk/*/**/vendor/drush/drush/drush.php mrix, /etc/init.d/nginx mrix, /sbin/killall5 mrix, /sbin/unix_chkpwd mrix, /usr/bin/chromium mrix, /usr/bin/convert mrix, /usr/bin/find mrix, /usr/bin/id mrix, /usr/bin/magick mrix, /usr/bin/mysql mrix, /usr/bin/patch mrix, /usr/bin/sudo mrix, /usr/bin/svn mrix, /usr/bin/tput mrix, /usr/bin/tr mrix, /usr/bin/unzip mrix, /usr/bin/wget mrix, /usr/bin/which mrix, /usr/bin/which.debianutils mrix, /usr/local/bin/composer mrix, /usr/local/bin/curl mrix, /usr/local/bin/fix-drupal-platform-ownership.sh mrix, /usr/local/bin/fix-drupal-platform-permissions.sh mrix, /usr/local/bin/fix-drupal-site-ownership.sh mrix, /usr/local/bin/fix-drupal-site-permissions.sh mrix, /usr/local/bin/git mrix, /usr/local/bin/lock-local-drush-permissions.sh mrix, /usr/local/bin/mydumper mrix, /usr/local/bin/myloader mrix, /usr/local/bin/wkhtmltoimage mrix, /usr/local/bin/wkhtmltopdf mrix, /usr/local/libexec/git-core/* mrix, /usr/local/libexec/git-core/** mrix, /usr/sbin/nginx mrix, /usr/sbin/postdrop mrix, /usr/sbin/sendmail mrix, # Allow PHP-CLI to access some /dev /dev/null rw, /dev/random r, /dev/tty rw, /dev/urandom r, # Allow PHP-CLI to use tmp files /tmp/ r, /tmp/** rw, /var/spool/postfix/maildrop/ r, /var/spool/postfix/maildrop/* rw, /var/tmp/** rw, # Allow read access to necessary libraries /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /opt/php*/lib/php/** mr, /usr/lib/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/libexec/** mr, /usr/local/include/** mr, /usr/local/ioncube/ioncube_loader_lin_*.so mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, # Allow PHP-CLI to read and write its log files /var/log/php/** rw, /var/log/newrelic/php_agent.log rw, # Allow PHP-CLI to write to some other log/pid files /run/nginx.pid rw, /var/log/nginx/access.log rw, /var/log/nginx/error.log rw, # Allow PHP-CLI to access /proc and /sys for necessary information /proc/ r, /proc/** r, /sys/ r, /sys/** r, # Allow PHP-CLI to use /dev/shm for temporary storage /dev/shm/ r, /dev/shm/** rw, # Deny execution of binaries from these directories deny /home/*/.tmp/** m, deny /home/*/** m, deny /tmp/** m, deny /var/tmp/** m, # Allow PHP-CLI to access drush /data/disk/*/tools/drush/ r, /data/disk/*/tools/drush/* mrix, /data/disk/*/tools/drush/** r, /opt/tools/drush/** mrix, /usr/local/bin/cv.phar mrix, /var/aegir/drush/ r, /var/aegir/drush/* mrix, /var/aegir/drush/** r, # Allow PHP-CLI to access System Default Web Root /var/www/** r, owner /var/www/** rw, # Allow PHP-CLI to read/write in the Ægir Backend on Master Instance owner /var/aegir/.drush/ r, owner /var/aegir/.drush/* rw, owner /var/aegir/.drush/** rw, owner /var/aegir/.tmp/ r, owner /var/aegir/.tmp/* rw, owner /var/aegir/.tmp/** rw, owner /var/aegir/config/ r, owner /var/aegir/config/* rw, owner /var/aegir/config/** rw, owner /var/aegir/host_master-*/ r, owner /var/aegir/host_master-*/* rw, owner /var/aegir/host_master-*/** rw, owner /var/aegir/host_master/ r, owner /var/aegir/host_master/* rw, owner /var/aegir/host_master/** rw, owner /var/aegir/platforms/ r, owner /var/aegir/platforms/* rw, owner /var/aegir/platforms/** rw, # Allow PHP-CLI to read/write in the Ægir Backend on Octopus Instances /data/all/ r, /data/all/* r, /data/all/** r, /data/conf/ r, /data/conf/* r, /data/conf/** r, /data/disk/*/.bashrc r, owner /data/disk/*/.cache/**/pack-* l, owner /data/disk/*/static/**/pack-* l, owner /data/disk/*/log/ r, owner /data/disk/*/log/* rw, owner /data/disk/*/.*.pass.php r, owner /data/disk/*/.rnd rw, owner /data/disk/*/backups/ rwl, owner /data/disk/*/backups/* rwl, owner /data/disk/*/backups/** rwl, owner /data/disk/*/backup-exports/ rwl, owner /data/disk/*/backup-exports/* rwl, owner /data/disk/*/backup-exports/** rwl, owner /data/disk/*/.config/ rwl, owner /data/disk/*/.config/* rwl, owner /data/disk/*/.config/** rwl, owner /data/disk/*/.cache/ rwl, owner /data/disk/*/.cache/* rwl, owner /data/disk/*/.cache/** rwl, owner /data/disk/*/.drush/ rwl, owner /data/disk/*/.drush/* rwl, owner /data/disk/*/.drush/** rwl, owner /data/disk/*/.tmp/ rwl, owner /data/disk/*/.tmp/* rwl, owner /data/disk/*/.tmp/** rwl, owner /data/disk/*/clients/ rw, owner /data/disk/*/clients/* rw, owner /data/disk/*/clients/** rw, owner /data/disk/*/config/ rw, owner /data/disk/*/config/* rw, owner /data/disk/*/config/** rw, owner /data/disk/*/tools/le/ rw, owner /data/disk/*/tools/le/* rw, owner /data/disk/*/tools/le/** rw, # Allow PHP-CLI to read/write in the Ægir Frontend on Octopus Instances owner /data/disk/*/aegir/ rw, owner /data/disk/*/aegir/* rw, owner /data/disk/*/aegir/** rw, # Allow PHP-CLI to read/write in the limited shell user home for Drush support owner /home/*/.drush/sites/ rw, owner /home/*/.drush/sites/* rw, owner /home/*/.drush/sites/** rw, owner /home/*/.drush/cache/ rw, owner /home/*/.drush/cache/* rw, owner /home/*/.drush/cache/** rw, owner /home/*/.tmp/ rw, owner /home/*/.tmp/* rw, owner /home/*/.tmp/** rw, # Allow PHP-CLI to read/write in the custom web root directories /data/disk/*/static/ rw, /data/disk/*/static/* rw, /data/disk/*/static/** rw, /data/disk/*/distro/ rw, /data/disk/*/distro/* rw, /data/disk/*/distro/** rw, /data/disk/*/platforms/ rw, /data/disk/*/platforms/* rw, /data/disk/*/platforms/** rw, # Allow PHP-CLI to read and write in the root tmp owner /root/.tmp/ rw, owner /root/.tmp/* rw, owner /root/.tmp/** rw, # Deny access to various sensitive directories and files deny /boot/** mrwklx, # Catchall to deny everything else #deny /** rwklx, # Site-specific additions and overrides can be added below } ================================================ FILE: aegir/conf/apparmor/opt.php80.sbin.php-fpm ================================================ # AppArmor profile for PHP-FPM # This profile restricts the PHP-FPM (php80) to essential operations only. #include /opt/php80/sbin/php-fpm flags=(attach_disconnected) { # Include common AppArmor abstractions include include include include # Capabilities needed by PHP-FPM capability chown, capability dac_override, capability dac_read_search, capability fowner, capability kill, capability setgid, capability setuid, capability sys_resource, # Allow PHP-FPM to accept signal from PHP-CLI processes signal (receive) peer=/opt/php*/bin/php, network inet stream, network inet6 stream, # Allow PHP-FPM to execute its own binary /opt/php80/sbin/php-fpm mrix, # Allow PHP-FPM to read its configuration files /data/conf/ r, /data/conf/** r, /etc/ImageMagick-6/log.xml r, /etc/ImageMagick-6/policy.xml r, /etc/ld.so.cache r, /etc/mailname r, /etc/newrelic/upgrade_please.key r, /etc/postfix/dynamicmaps.cf r, /etc/postfix/dynamicmaps.cf.d/ r, /etc/postfix/dynamicmaps.cf.d/* r, /etc/postfix/main.cf r, /home/*/.drush/** r, /opt/etc/fpm/** r, /var/spool/postfix/maildrop/ r, /var/spool/postfix/maildrop/* rw, /opt/php80/** r, # Allow PHP-FPM to execute some other binaries /bin/dash mrix, /opt/local/bin/websh mrix, /usr/bin/advdef mrix, /usr/bin/advpng mrix, /usr/bin/chromium mrix, /usr/bin/convert mrix, /usr/bin/id mrix, /usr/bin/jpegoptim mrix, /usr/bin/jpegtran mrix, /usr/bin/magick mrix, /usr/bin/optipng mrix, /usr/bin/pngcrush mrix, /usr/bin/pngquant mrix, /usr/lib/postfix/sbin/smtpd mrix, /usr/local/bin/curl mrix, /usr/local/bin/wkhtmltoimage mrix, /usr/local/bin/wkhtmltopdf mrix, /usr/sbin/postdrop mrix, /usr/sbin/sendmail mrix, # Allow PHP-FPM to access some /dev /dev/null rw, /dev/random r, /dev/tty wr, /dev/urandom r, # Allow PHP-FPM to access its run directory /run/** rw, # Allow PHP-FPM to use tmp files /home/*/.tmp/ r, /home/*/.tmp/** rw, /tmp/ r, /tmp/** rw, /var/tmp/** rw, # Allow read access to necessary libraries /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /opt/php*/lib/php/** mr, /usr/lib/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/libexec/** mr, /usr/local/include/** mr, /usr/local/ioncube/ioncube_loader_lin_*.so mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, # Allow PHP-FPM to read and write its log files /var/log/newrelic/php_agent.log rw, /var/log/php/** rw, # Allow PHP-FPM to access /proc and /sys for necessary information /proc/** r, /sys/** r, # Allow PHP-FPM to use /dev/shm for temporary storage /dev/shm/ r, /dev/shm/** rw, # Deny execution of binaries from these directories deny /home/*/.tmp/** m, deny /home/*/** m, deny /tmp/** m, deny /var/tmp/** m, # Allow PHP-FPM to read and write in the custom web root directories /var/www/** r, /var/aegir/host_master/** r, /var/aegir/platforms/** r, /data/disk/*/aegir/** r, /data/disk/*/distro/** r, /data/disk/*/platforms/** r, /data/disk/*/static/** r, /data/disk/*/tools/le/** r, /data/all/ r, /data/all/* r, /data/all/** r, /data/conf/ r, /data/conf/* r, /data/conf/** r, owner /var/aegir/host_master/** rw, owner /var/aegir/platforms/** rw, owner /data/disk/*/aegir/** rw, owner /data/disk/*/distro/** rw, owner /data/disk/*/platforms/** rw, owner /data/disk/*/static/** rw, owner /var/www/** rw, /home/*.web/.aws/ r, /home/*.web/.aws/* rw, /home/*.web/.drush/ r, /home/*.web/.drush/* r, /home/*.web/.tmp/ r, /home/*.web/.tmp/* rw, # Deny access to various sensitive directories and files deny /boot/** mrwklx, deny /etc/shadow* rwlx, deny /root/** mrwklx, # Catchall to deny everything else #deny /** rwklx, # Site-specific additions and overrides can be added below } ================================================ FILE: aegir/conf/apparmor/opt.php81.bin.php ================================================ # AppArmor profile for PHP-CLI # This profile restricts PHP-CLI (php81) to essential operations only. #include /opt/php81/bin/php flags=(complain) { # Include common AppArmor abstractions include include include include include # Capabilities needed by PHP-CLI capability audit_write, capability chown, capability dac_override, capability dac_read_search, capability fowner, capability fsetid, capability mknod, capability setgid, capability setuid, capability sys_ptrace, capability sys_resource, # Allow PHP-CLI to execute its own binary /opt/php81/bin/php mrix, # Allow PHP-CLI to signal/ptrace other processes ptrace (read) peer=/opt/php*/bin/php, signal (send) peer=unconfined, signal (send) peer=/usr/sbin/nginx, ptrace (read) peer=/opt/php*/sbin/php-fpm, ptrace (read) peer=/usr/bin/mysqld_safe, ptrace (read) peer=/usr/bin/redis-server, ptrace (read) peer=/usr/local/sbin/pure-ftpd, ptrace (read) peer=/usr/sbin/nginx, ptrace (read) peer=/usr/sbin/rsyslogd, ptrace (read) peer=/usr/sbin/unbound, ptrace (read) peer=unconfined, # Allow PHP-CLI to read required configuration files /data/disk/*/.subversion/ r, /data/disk/*/.subversion/* r, /etc/default/nginx r, /etc/ImageMagick-6/log.xml r, /etc/ImageMagick-6/policy.xml r, /etc/ld.so.cache r, /etc/ldap/ldap.conf r, /etc/mailname r, /etc/mysql/conf.d/ r, /etc/mysql/conf.d/* r, /etc/mysql/my.cnf r, /etc/newrelic/upgrade_please.key r, /etc/nginx/conf.d/ r, /etc/nginx/conf.d/** r, /etc/nginx/fastcgi_params r, /etc/nginx/mime.types r, /etc/nginx/nginx.conf r, /etc/postfix/dynamicmaps.cf r, /etc/postfix/dynamicmaps.cf.d/ r, /etc/postfix/main.cf r, /etc/ssl/private/ r, /etc/ssl/private/* r, /etc/ssl/private/nginx-wild-ssl.crt r, /etc/ssl/private/nginx-wild-ssl.dhp r, /etc/ssl/private/nginx-wild-ssl.key r, /etc/subversion/ r, /etc/subversion/* r, /etc/wgetrc r, /home/*/.drush/ r, /home/*/.drush/** r, /usr/local/share/git-core/templates/ r, /usr/local/share/git-core/templates/* r, /usr/local/share/git-core/templates/** r, /usr/share/GeoIP/GeoIP.dat r, /usr/share/GeoIP/GeoIPv6.dat r, /usr/share/GeoIP/GeoLite2-ASN.mmdb r, /usr/share/GeoIP/GeoLite2-City.mmdb r, /usr/share/GeoIP/GeoLite2-Country.mmdb r, /opt/php81/** r, # Allow PHP-CLI to read required user/access files /etc/login.defs r, /etc/pam.d/* r, /etc/passwd r, /etc/security/capability.conf r, /etc/security/limits.conf r, /etc/security/limits.d/ r, /etc/security/limits.d/* r, /etc/shadow r, /etc/sudo.conf r, /etc/sudoers r, /etc/sudoers.d/ r, /etc/sudoers.d/* r, /run/sudo/ts/ r, /run/sudo/ts/* r, # Allow PHP-CLI to execute some other binaries /usr/bin/symlinks mrix, /bin/cat mrix, /bin/chmod mrix, /bin/chown mrix, /bin/cp mrix, /bin/dash mrix, /bin/date mrix, /bin/egrep mrix, /bin/grep mrix, /bin/kmod mrix, /bin/mkdir mrix, /bin/mv mrix, /bin/pidof mrix, /bin/rm mrix, /bin/run-parts mrix, /bin/sed mrix, /bin/stty mrix, /bin/tar mrix, /bin/touch mrix, /opt/local/bin/websh mrix, /data/disk/*/**/vendor/drush/drush/drush.php mrix, /etc/init.d/nginx mrix, /sbin/killall5 mrix, /sbin/unix_chkpwd mrix, /usr/bin/chromium mrix, /usr/bin/convert mrix, /usr/bin/find mrix, /usr/bin/id mrix, /usr/bin/magick mrix, /usr/bin/mysql mrix, /usr/bin/patch mrix, /usr/bin/sudo mrix, /usr/bin/svn mrix, /usr/bin/tput mrix, /usr/bin/tr mrix, /usr/bin/unzip mrix, /usr/bin/wget mrix, /usr/bin/which mrix, /usr/bin/which.debianutils mrix, /usr/local/bin/composer mrix, /usr/local/bin/curl mrix, /usr/local/bin/fix-drupal-platform-ownership.sh mrix, /usr/local/bin/fix-drupal-platform-permissions.sh mrix, /usr/local/bin/fix-drupal-site-ownership.sh mrix, /usr/local/bin/fix-drupal-site-permissions.sh mrix, /usr/local/bin/git mrix, /usr/local/bin/lock-local-drush-permissions.sh mrix, /usr/local/bin/mydumper mrix, /usr/local/bin/myloader mrix, /usr/local/bin/wkhtmltoimage mrix, /usr/local/bin/wkhtmltopdf mrix, /usr/local/libexec/git-core/* mrix, /usr/local/libexec/git-core/** mrix, /usr/sbin/nginx mrix, /usr/sbin/postdrop mrix, /usr/sbin/sendmail mrix, # Allow PHP-CLI to access some /dev /dev/null rw, /dev/random r, /dev/tty rw, /dev/urandom r, # Allow PHP-CLI to use tmp files /tmp/ r, /tmp/** rw, /var/spool/postfix/maildrop/ r, /var/spool/postfix/maildrop/* rw, /var/tmp/** rw, # Allow read access to necessary libraries /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /opt/php*/lib/php/** mr, /usr/lib/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/libexec/** mr, /usr/local/include/** mr, /usr/local/ioncube/ioncube_loader_lin_*.so mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, # Allow PHP-CLI to read and write its log files /var/log/php/** rw, /var/log/newrelic/php_agent.log rw, # Allow PHP-CLI to write to some other log/pid files /run/nginx.pid rw, /var/log/nginx/access.log rw, /var/log/nginx/error.log rw, # Allow PHP-CLI to access /proc and /sys for necessary information /proc/ r, /proc/** r, /sys/ r, /sys/** r, # Allow PHP-CLI to use /dev/shm for temporary storage /dev/shm/ r, /dev/shm/** rw, # Deny execution of binaries from these directories deny /home/*/.tmp/** m, deny /home/*/** m, deny /tmp/** m, deny /var/tmp/** m, # Allow PHP-CLI to access drush /data/disk/*/tools/drush/ r, /data/disk/*/tools/drush/* mrix, /data/disk/*/tools/drush/** r, /opt/tools/drush/** mrix, /usr/local/bin/cv.phar mrix, /var/aegir/drush/ r, /var/aegir/drush/* mrix, /var/aegir/drush/** r, # Allow PHP-CLI to access System Default Web Root /var/www/** r, owner /var/www/** rw, # Allow PHP-CLI to read/write in the Ægir Backend on Master Instance owner /var/aegir/.drush/ r, owner /var/aegir/.drush/* rw, owner /var/aegir/.drush/** rw, owner /var/aegir/.tmp/ r, owner /var/aegir/.tmp/* rw, owner /var/aegir/.tmp/** rw, owner /var/aegir/config/ r, owner /var/aegir/config/* rw, owner /var/aegir/config/** rw, owner /var/aegir/host_master-*/ r, owner /var/aegir/host_master-*/* rw, owner /var/aegir/host_master-*/** rw, owner /var/aegir/host_master/ r, owner /var/aegir/host_master/* rw, owner /var/aegir/host_master/** rw, owner /var/aegir/platforms/ r, owner /var/aegir/platforms/* rw, owner /var/aegir/platforms/** rw, # Allow PHP-CLI to read/write in the Ægir Backend on Octopus Instances /data/all/ r, /data/all/* r, /data/all/** r, /data/conf/ r, /data/conf/* r, /data/conf/** r, /data/disk/*/.bashrc r, owner /data/disk/*/.cache/**/pack-* l, owner /data/disk/*/static/**/pack-* l, owner /data/disk/*/log/ r, owner /data/disk/*/log/* rw, owner /data/disk/*/.*.pass.php r, owner /data/disk/*/.rnd rw, owner /data/disk/*/backups/ rwl, owner /data/disk/*/backups/* rwl, owner /data/disk/*/backups/** rwl, owner /data/disk/*/backup-exports/ rwl, owner /data/disk/*/backup-exports/* rwl, owner /data/disk/*/backup-exports/** rwl, owner /data/disk/*/.config/ rwl, owner /data/disk/*/.config/* rwl, owner /data/disk/*/.config/** rwl, owner /data/disk/*/.cache/ rwl, owner /data/disk/*/.cache/* rwl, owner /data/disk/*/.cache/** rwl, owner /data/disk/*/.drush/ rwl, owner /data/disk/*/.drush/* rwl, owner /data/disk/*/.drush/** rwl, owner /data/disk/*/.tmp/ rwl, owner /data/disk/*/.tmp/* rwl, owner /data/disk/*/.tmp/** rwl, owner /data/disk/*/clients/ rw, owner /data/disk/*/clients/* rw, owner /data/disk/*/clients/** rw, owner /data/disk/*/config/ rw, owner /data/disk/*/config/* rw, owner /data/disk/*/config/** rw, owner /data/disk/*/tools/le/ rw, owner /data/disk/*/tools/le/* rw, owner /data/disk/*/tools/le/** rw, # Allow PHP-CLI to read/write in the Ægir Frontend on Octopus Instances owner /data/disk/*/aegir/ rw, owner /data/disk/*/aegir/* rw, owner /data/disk/*/aegir/** rw, # Allow PHP-CLI to read/write in the limited shell user home for Drush support owner /home/*/.drush/sites/ rw, owner /home/*/.drush/sites/* rw, owner /home/*/.drush/sites/** rw, owner /home/*/.drush/cache/ rw, owner /home/*/.drush/cache/* rw, owner /home/*/.drush/cache/** rw, owner /home/*/.tmp/ rw, owner /home/*/.tmp/* rw, owner /home/*/.tmp/** rw, # Allow PHP-CLI to read/write in the custom web root directories /data/disk/*/static/ rw, /data/disk/*/static/* rw, /data/disk/*/static/** rw, /data/disk/*/distro/ rw, /data/disk/*/distro/* rw, /data/disk/*/distro/** rw, /data/disk/*/platforms/ rw, /data/disk/*/platforms/* rw, /data/disk/*/platforms/** rw, # Allow PHP-CLI to read and write in the root tmp owner /root/.tmp/ rw, owner /root/.tmp/* rw, owner /root/.tmp/** rw, # Deny access to various sensitive directories and files deny /boot/** mrwklx, # Catchall to deny everything else #deny /** rwklx, # Site-specific additions and overrides can be added below } ================================================ FILE: aegir/conf/apparmor/opt.php81.sbin.php-fpm ================================================ # AppArmor profile for PHP-FPM # This profile restricts the PHP-FPM (php81) to essential operations only. #include /opt/php81/sbin/php-fpm flags=(attach_disconnected) { # Include common AppArmor abstractions include include include include # Capabilities needed by PHP-FPM capability chown, capability dac_override, capability dac_read_search, capability fowner, capability kill, capability setgid, capability setuid, capability sys_resource, # Allow PHP-FPM to accept signal from PHP-CLI processes signal (receive) peer=/opt/php*/bin/php, network inet stream, network inet6 stream, # Allow PHP-FPM to execute its own binary /opt/php81/sbin/php-fpm mrix, # Allow PHP-FPM to read its configuration files /data/conf/ r, /data/conf/** r, /etc/ImageMagick-6/log.xml r, /etc/ImageMagick-6/policy.xml r, /etc/ld.so.cache r, /etc/mailname r, /etc/newrelic/upgrade_please.key r, /etc/postfix/dynamicmaps.cf r, /etc/postfix/dynamicmaps.cf.d/ r, /etc/postfix/dynamicmaps.cf.d/* r, /etc/postfix/main.cf r, /home/*/.drush/** r, /opt/etc/fpm/** r, /var/spool/postfix/maildrop/ r, /var/spool/postfix/maildrop/* rw, /opt/php81/** r, # Allow PHP-FPM to execute some other binaries /bin/dash mrix, /opt/local/bin/websh mrix, /usr/bin/advdef mrix, /usr/bin/advpng mrix, /usr/bin/chromium mrix, /usr/bin/convert mrix, /usr/bin/id mrix, /usr/bin/jpegoptim mrix, /usr/bin/jpegtran mrix, /usr/bin/magick mrix, /usr/bin/optipng mrix, /usr/bin/pngcrush mrix, /usr/bin/pngquant mrix, /usr/lib/postfix/sbin/smtpd mrix, /usr/local/bin/curl mrix, /usr/local/bin/wkhtmltoimage mrix, /usr/local/bin/wkhtmltopdf mrix, /usr/sbin/postdrop mrix, /usr/sbin/sendmail mrix, # Allow PHP-FPM to access some /dev /dev/null rw, /dev/random r, /dev/tty wr, /dev/urandom r, # Allow PHP-FPM to access its run directory /run/** rw, # Allow PHP-FPM to use tmp files /home/*/.tmp/ r, /home/*/.tmp/** rw, /tmp/ r, /tmp/** rw, /var/tmp/** rw, # Allow read access to necessary libraries /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /opt/php*/lib/php/** mr, /usr/lib/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/libexec/** mr, /usr/local/include/** mr, /usr/local/ioncube/ioncube_loader_lin_*.so mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, # Allow PHP-FPM to read and write its log files /var/log/newrelic/php_agent.log rw, /var/log/php/** rw, # Allow PHP-FPM to access /proc and /sys for necessary information /proc/** r, /sys/** r, # Allow PHP-FPM to use /dev/shm for temporary storage /dev/shm/ r, /dev/shm/** rw, # Deny execution of binaries from these directories deny /home/*/.tmp/** m, deny /home/*/** m, deny /tmp/** m, deny /var/tmp/** m, # Allow PHP-FPM to read and write in the custom web root directories /var/www/** r, /var/aegir/host_master/** r, /var/aegir/platforms/** r, /data/disk/*/aegir/** r, /data/disk/*/distro/** r, /data/disk/*/platforms/** r, /data/disk/*/static/** r, /data/disk/*/tools/le/** r, /data/all/ r, /data/all/* r, /data/all/** r, /data/conf/ r, /data/conf/* r, /data/conf/** r, owner /var/aegir/host_master/** rw, owner /var/aegir/platforms/** rw, owner /data/disk/*/aegir/** rw, owner /data/disk/*/distro/** rw, owner /data/disk/*/platforms/** rw, owner /data/disk/*/static/** rw, owner /var/www/** rw, /home/*.web/.aws/ r, /home/*.web/.aws/* rw, /home/*.web/.drush/ r, /home/*.web/.drush/* r, /home/*.web/.tmp/ r, /home/*.web/.tmp/* rw, # Deny access to various sensitive directories and files deny /boot/** mrwklx, deny /etc/shadow* rwlx, deny /root/** mrwklx, # Catchall to deny everything else #deny /** rwklx, # Site-specific additions and overrides can be added below } ================================================ FILE: aegir/conf/apparmor/opt.php82.bin.php ================================================ # AppArmor profile for PHP-CLI # This profile restricts PHP-CLI (php82) to essential operations only. #include /opt/php82/bin/php flags=(complain) { # Include common AppArmor abstractions include include include include include # Capabilities needed by PHP-CLI capability audit_write, capability chown, capability dac_override, capability dac_read_search, capability fowner, capability fsetid, capability mknod, capability setgid, capability setuid, capability sys_ptrace, capability sys_resource, # Allow PHP-CLI to execute its own binary /opt/php82/bin/php mrix, # Allow PHP-CLI to signal/ptrace other processes ptrace (read) peer=/opt/php*/bin/php, signal (send) peer=unconfined, signal (send) peer=/usr/sbin/nginx, ptrace (read) peer=/opt/php*/sbin/php-fpm, ptrace (read) peer=/usr/bin/mysqld_safe, ptrace (read) peer=/usr/bin/redis-server, ptrace (read) peer=/usr/local/sbin/pure-ftpd, ptrace (read) peer=/usr/sbin/nginx, ptrace (read) peer=/usr/sbin/rsyslogd, ptrace (read) peer=/usr/sbin/unbound, ptrace (read) peer=unconfined, # Allow PHP-CLI to read required configuration files /data/disk/*/.subversion/ r, /data/disk/*/.subversion/* r, /etc/default/nginx r, /etc/ImageMagick-6/log.xml r, /etc/ImageMagick-6/policy.xml r, /etc/ld.so.cache r, /etc/ldap/ldap.conf r, /etc/mailname r, /etc/mysql/conf.d/ r, /etc/mysql/conf.d/* r, /etc/mysql/my.cnf r, /etc/newrelic/upgrade_please.key r, /etc/nginx/conf.d/ r, /etc/nginx/conf.d/** r, /etc/nginx/fastcgi_params r, /etc/nginx/mime.types r, /etc/nginx/nginx.conf r, /etc/postfix/dynamicmaps.cf r, /etc/postfix/dynamicmaps.cf.d/ r, /etc/postfix/main.cf r, /etc/ssl/private/ r, /etc/ssl/private/* r, /etc/ssl/private/nginx-wild-ssl.crt r, /etc/ssl/private/nginx-wild-ssl.dhp r, /etc/ssl/private/nginx-wild-ssl.key r, /etc/subversion/ r, /etc/subversion/* r, /etc/wgetrc r, /home/*/.drush/ r, /home/*/.drush/** r, /usr/local/share/git-core/templates/ r, /usr/local/share/git-core/templates/* r, /usr/local/share/git-core/templates/** r, /usr/share/GeoIP/GeoIP.dat r, /usr/share/GeoIP/GeoIPv6.dat r, /usr/share/GeoIP/GeoLite2-ASN.mmdb r, /usr/share/GeoIP/GeoLite2-City.mmdb r, /usr/share/GeoIP/GeoLite2-Country.mmdb r, /opt/php82/** r, # Allow PHP-CLI to read required user/access files /etc/login.defs r, /etc/pam.d/* r, /etc/passwd r, /etc/security/capability.conf r, /etc/security/limits.conf r, /etc/security/limits.d/ r, /etc/security/limits.d/* r, /etc/shadow r, /etc/sudo.conf r, /etc/sudoers r, /etc/sudoers.d/ r, /etc/sudoers.d/* r, /run/sudo/ts/ r, /run/sudo/ts/* r, # Allow PHP-CLI to execute some other binaries /usr/bin/symlinks mrix, /bin/cat mrix, /bin/chmod mrix, /bin/chown mrix, /bin/cp mrix, /bin/dash mrix, /bin/date mrix, /bin/egrep mrix, /bin/grep mrix, /bin/kmod mrix, /bin/mkdir mrix, /bin/mv mrix, /bin/pidof mrix, /bin/rm mrix, /bin/run-parts mrix, /bin/sed mrix, /bin/stty mrix, /bin/tar mrix, /bin/touch mrix, /opt/local/bin/websh mrix, /data/disk/*/**/vendor/drush/drush/drush.php mrix, /etc/init.d/nginx mrix, /sbin/killall5 mrix, /sbin/unix_chkpwd mrix, /usr/bin/chromium mrix, /usr/bin/convert mrix, /usr/bin/find mrix, /usr/bin/id mrix, /usr/bin/magick mrix, /usr/bin/mysql mrix, /usr/bin/patch mrix, /usr/bin/sudo mrix, /usr/bin/svn mrix, /usr/bin/tput mrix, /usr/bin/tr mrix, /usr/bin/unzip mrix, /usr/bin/wget mrix, /usr/bin/which mrix, /usr/bin/which.debianutils mrix, /usr/local/bin/composer mrix, /usr/local/bin/curl mrix, /usr/local/bin/fix-drupal-platform-ownership.sh mrix, /usr/local/bin/fix-drupal-platform-permissions.sh mrix, /usr/local/bin/fix-drupal-site-ownership.sh mrix, /usr/local/bin/fix-drupal-site-permissions.sh mrix, /usr/local/bin/git mrix, /usr/local/bin/lock-local-drush-permissions.sh mrix, /usr/local/bin/mydumper mrix, /usr/local/bin/myloader mrix, /usr/local/bin/wkhtmltoimage mrix, /usr/local/bin/wkhtmltopdf mrix, /usr/local/libexec/git-core/* mrix, /usr/local/libexec/git-core/** mrix, /usr/sbin/nginx mrix, /usr/sbin/postdrop mrix, /usr/sbin/sendmail mrix, # Allow PHP-CLI to access some /dev /dev/null rw, /dev/random r, /dev/tty rw, /dev/urandom r, # Allow PHP-CLI to use tmp files /tmp/ r, /tmp/** rw, /var/spool/postfix/maildrop/ r, /var/spool/postfix/maildrop/* rw, /var/tmp/** rw, # Allow read access to necessary libraries /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /opt/php*/lib/php/** mr, /usr/lib/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/libexec/** mr, /usr/local/include/** mr, /usr/local/ioncube/ioncube_loader_lin_*.so mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, # Allow PHP-CLI to read and write its log files /var/log/php/** rw, /var/log/newrelic/php_agent.log rw, # Allow PHP-CLI to write to some other log/pid files /run/nginx.pid rw, /var/log/nginx/access.log rw, /var/log/nginx/error.log rw, # Allow PHP-CLI to access /proc and /sys for necessary information /proc/ r, /proc/** r, /sys/ r, /sys/** r, # Allow PHP-CLI to use /dev/shm for temporary storage /dev/shm/ r, /dev/shm/** rw, # Deny execution of binaries from these directories deny /home/*/.tmp/** m, deny /home/*/** m, deny /tmp/** m, deny /var/tmp/** m, # Allow PHP-CLI to access drush /data/disk/*/tools/drush/ r, /data/disk/*/tools/drush/* mrix, /data/disk/*/tools/drush/** r, /opt/tools/drush/** mrix, /usr/local/bin/cv.phar mrix, /var/aegir/drush/ r, /var/aegir/drush/* mrix, /var/aegir/drush/** r, # Allow PHP-CLI to access System Default Web Root /var/www/** r, owner /var/www/** rw, # Allow PHP-CLI to read/write in the Ægir Backend on Master Instance owner /var/aegir/.drush/ r, owner /var/aegir/.drush/* rw, owner /var/aegir/.drush/** rw, owner /var/aegir/.tmp/ r, owner /var/aegir/.tmp/* rw, owner /var/aegir/.tmp/** rw, owner /var/aegir/config/ r, owner /var/aegir/config/* rw, owner /var/aegir/config/** rw, owner /var/aegir/host_master-*/ r, owner /var/aegir/host_master-*/* rw, owner /var/aegir/host_master-*/** rw, owner /var/aegir/host_master/ r, owner /var/aegir/host_master/* rw, owner /var/aegir/host_master/** rw, owner /var/aegir/platforms/ r, owner /var/aegir/platforms/* rw, owner /var/aegir/platforms/** rw, # Allow PHP-CLI to read/write in the Ægir Backend on Octopus Instances /data/all/ r, /data/all/* r, /data/all/** r, /data/conf/ r, /data/conf/* r, /data/conf/** r, /data/disk/*/.bashrc r, owner /data/disk/*/.cache/**/pack-* l, owner /data/disk/*/static/**/pack-* l, owner /data/disk/*/log/ r, owner /data/disk/*/log/* rw, owner /data/disk/*/.*.pass.php r, owner /data/disk/*/.rnd rw, owner /data/disk/*/backups/ rwl, owner /data/disk/*/backups/* rwl, owner /data/disk/*/backups/** rwl, owner /data/disk/*/backup-exports/ rwl, owner /data/disk/*/backup-exports/* rwl, owner /data/disk/*/backup-exports/** rwl, owner /data/disk/*/.config/ rwl, owner /data/disk/*/.config/* rwl, owner /data/disk/*/.config/** rwl, owner /data/disk/*/.cache/ rwl, owner /data/disk/*/.cache/* rwl, owner /data/disk/*/.cache/** rwl, owner /data/disk/*/.drush/ rwl, owner /data/disk/*/.drush/* rwl, owner /data/disk/*/.drush/** rwl, owner /data/disk/*/.tmp/ rwl, owner /data/disk/*/.tmp/* rwl, owner /data/disk/*/.tmp/** rwl, owner /data/disk/*/clients/ rw, owner /data/disk/*/clients/* rw, owner /data/disk/*/clients/** rw, owner /data/disk/*/config/ rw, owner /data/disk/*/config/* rw, owner /data/disk/*/config/** rw, owner /data/disk/*/tools/le/ rw, owner /data/disk/*/tools/le/* rw, owner /data/disk/*/tools/le/** rw, # Allow PHP-CLI to read/write in the Ægir Frontend on Octopus Instances owner /data/disk/*/aegir/ rw, owner /data/disk/*/aegir/* rw, owner /data/disk/*/aegir/** rw, # Allow PHP-CLI to read/write in the limited shell user home for Drush support owner /home/*/.drush/sites/ rw, owner /home/*/.drush/sites/* rw, owner /home/*/.drush/sites/** rw, owner /home/*/.drush/cache/ rw, owner /home/*/.drush/cache/* rw, owner /home/*/.drush/cache/** rw, owner /home/*/.tmp/ rw, owner /home/*/.tmp/* rw, owner /home/*/.tmp/** rw, # Allow PHP-CLI to read/write in the custom web root directories /data/disk/*/static/ rw, /data/disk/*/static/* rw, /data/disk/*/static/** rw, /data/disk/*/distro/ rw, /data/disk/*/distro/* rw, /data/disk/*/distro/** rw, /data/disk/*/platforms/ rw, /data/disk/*/platforms/* rw, /data/disk/*/platforms/** rw, # Allow PHP-CLI to read and write in the root tmp owner /root/.tmp/ rw, owner /root/.tmp/* rw, owner /root/.tmp/** rw, # Deny access to various sensitive directories and files deny /boot/** mrwklx, # Catchall to deny everything else #deny /** rwklx, # Site-specific additions and overrides can be added below } ================================================ FILE: aegir/conf/apparmor/opt.php82.sbin.php-fpm ================================================ # AppArmor profile for PHP-FPM # This profile restricts the PHP-FPM (php82) to essential operations only. #include /opt/php82/sbin/php-fpm flags=(attach_disconnected) { # Include common AppArmor abstractions include include include include # Capabilities needed by PHP-FPM capability chown, capability dac_override, capability dac_read_search, capability fowner, capability kill, capability setgid, capability setuid, capability sys_resource, # Allow PHP-FPM to accept signal from PHP-CLI processes signal (receive) peer=/opt/php*/bin/php, network inet stream, network inet6 stream, # Allow PHP-FPM to execute its own binary /opt/php82/sbin/php-fpm mrix, # Allow PHP-FPM to read its configuration files /data/conf/ r, /data/conf/** r, /etc/ImageMagick-6/log.xml r, /etc/ImageMagick-6/policy.xml r, /etc/ld.so.cache r, /etc/mailname r, /etc/newrelic/upgrade_please.key r, /etc/postfix/dynamicmaps.cf r, /etc/postfix/dynamicmaps.cf.d/ r, /etc/postfix/dynamicmaps.cf.d/* r, /etc/postfix/main.cf r, /home/*/.drush/** r, /opt/etc/fpm/** r, /var/spool/postfix/maildrop/ r, /var/spool/postfix/maildrop/* rw, /opt/php82/** r, # Allow PHP-FPM to execute some other binaries /bin/dash mrix, /opt/local/bin/websh mrix, /usr/bin/advdef mrix, /usr/bin/advpng mrix, /usr/bin/chromium mrix, /usr/bin/convert mrix, /usr/bin/id mrix, /usr/bin/jpegoptim mrix, /usr/bin/jpegtran mrix, /usr/bin/magick mrix, /usr/bin/optipng mrix, /usr/bin/pngcrush mrix, /usr/bin/pngquant mrix, /usr/lib/postfix/sbin/smtpd mrix, /usr/local/bin/curl mrix, /usr/local/bin/wkhtmltoimage mrix, /usr/local/bin/wkhtmltopdf mrix, /usr/sbin/postdrop mrix, /usr/sbin/sendmail mrix, # Allow PHP-FPM to access some /dev /dev/null rw, /dev/random r, /dev/tty wr, /dev/urandom r, # Allow PHP-FPM to access its run directory /run/** rw, # Allow PHP-FPM to use tmp files /home/*/.tmp/ r, /home/*/.tmp/** rw, /tmp/ r, /tmp/** rw, /var/tmp/** rw, # Allow read access to necessary libraries /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /opt/php*/lib/php/** mr, /usr/lib/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/libexec/** mr, /usr/local/include/** mr, /usr/local/ioncube/ioncube_loader_lin_*.so mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, # Allow PHP-FPM to read and write its log files /var/log/newrelic/php_agent.log rw, /var/log/php/** rw, # Allow PHP-FPM to access /proc and /sys for necessary information /proc/** r, /sys/** r, # Allow PHP-FPM to use /dev/shm for temporary storage /dev/shm/ r, /dev/shm/** rw, # Deny execution of binaries from these directories deny /home/*/.tmp/** m, deny /home/*/** m, deny /tmp/** m, deny /var/tmp/** m, # Allow PHP-FPM to read and write in the custom web root directories /var/www/** r, /var/aegir/host_master/** r, /var/aegir/platforms/** r, /data/disk/*/aegir/** r, /data/disk/*/distro/** r, /data/disk/*/platforms/** r, /data/disk/*/static/** r, /data/disk/*/tools/le/** r, /data/all/ r, /data/all/* r, /data/all/** r, /data/conf/ r, /data/conf/* r, /data/conf/** r, owner /var/aegir/host_master/** rw, owner /var/aegir/platforms/** rw, owner /data/disk/*/aegir/** rw, owner /data/disk/*/distro/** rw, owner /data/disk/*/platforms/** rw, owner /data/disk/*/static/** rw, owner /var/www/** rw, /home/*.web/.aws/ r, /home/*.web/.aws/* rw, /home/*.web/.drush/ r, /home/*.web/.drush/* r, /home/*.web/.tmp/ r, /home/*.web/.tmp/* rw, # Deny access to various sensitive directories and files deny /boot/** mrwklx, deny /etc/shadow* rwlx, deny /root/** mrwklx, # Catchall to deny everything else #deny /** rwklx, # Site-specific additions and overrides can be added below } ================================================ FILE: aegir/conf/apparmor/opt.php83.bin.php ================================================ # AppArmor profile for PHP-CLI # This profile restricts PHP-CLI (php83) to essential operations only. #include /opt/php83/bin/php flags=(complain) { # Include common AppArmor abstractions include include include include include # Capabilities needed by PHP-CLI capability audit_write, capability chown, capability dac_override, capability dac_read_search, capability fowner, capability fsetid, capability mknod, capability setgid, capability setuid, capability sys_ptrace, capability sys_resource, # Allow PHP-CLI to execute its own binary /opt/php83/bin/php mrix, # Allow PHP-CLI to signal/ptrace other processes ptrace (read) peer=/opt/php*/bin/php, signal (send) peer=unconfined, signal (send) peer=/usr/sbin/nginx, ptrace (read) peer=/opt/php*/sbin/php-fpm, ptrace (read) peer=/usr/bin/mysqld_safe, ptrace (read) peer=/usr/bin/redis-server, ptrace (read) peer=/usr/local/sbin/pure-ftpd, ptrace (read) peer=/usr/sbin/nginx, ptrace (read) peer=/usr/sbin/rsyslogd, ptrace (read) peer=/usr/sbin/unbound, ptrace (read) peer=unconfined, # Allow PHP-CLI to read required configuration files /data/disk/*/.subversion/ r, /data/disk/*/.subversion/* r, /etc/default/nginx r, /etc/ImageMagick-6/log.xml r, /etc/ImageMagick-6/policy.xml r, /etc/ld.so.cache r, /etc/ldap/ldap.conf r, /etc/mailname r, /etc/mysql/conf.d/ r, /etc/mysql/conf.d/* r, /etc/mysql/my.cnf r, /etc/newrelic/upgrade_please.key r, /etc/nginx/conf.d/ r, /etc/nginx/conf.d/** r, /etc/nginx/fastcgi_params r, /etc/nginx/mime.types r, /etc/nginx/nginx.conf r, /etc/postfix/dynamicmaps.cf r, /etc/postfix/dynamicmaps.cf.d/ r, /etc/postfix/main.cf r, /etc/ssl/private/ r, /etc/ssl/private/* r, /etc/ssl/private/nginx-wild-ssl.crt r, /etc/ssl/private/nginx-wild-ssl.dhp r, /etc/ssl/private/nginx-wild-ssl.key r, /etc/subversion/ r, /etc/subversion/* r, /etc/wgetrc r, /home/*/.drush/ r, /home/*/.drush/** r, /usr/local/share/git-core/templates/ r, /usr/local/share/git-core/templates/* r, /usr/local/share/git-core/templates/** r, /usr/share/GeoIP/GeoIP.dat r, /usr/share/GeoIP/GeoIPv6.dat r, /usr/share/GeoIP/GeoLite2-ASN.mmdb r, /usr/share/GeoIP/GeoLite2-City.mmdb r, /usr/share/GeoIP/GeoLite2-Country.mmdb r, /opt/php83/** r, # Allow PHP-CLI to read required user/access files /etc/login.defs r, /etc/pam.d/* r, /etc/passwd r, /etc/security/capability.conf r, /etc/security/limits.conf r, /etc/security/limits.d/ r, /etc/security/limits.d/* r, /etc/shadow r, /etc/sudo.conf r, /etc/sudoers r, /etc/sudoers.d/ r, /etc/sudoers.d/* r, /run/sudo/ts/ r, /run/sudo/ts/* r, # Allow PHP-CLI to execute some other binaries /usr/bin/symlinks mrix, /bin/cat mrix, /bin/chmod mrix, /bin/chown mrix, /bin/cp mrix, /bin/dash mrix, /bin/date mrix, /bin/egrep mrix, /bin/grep mrix, /bin/kmod mrix, /bin/mkdir mrix, /bin/mv mrix, /bin/pidof mrix, /bin/rm mrix, /bin/run-parts mrix, /bin/sed mrix, /bin/stty mrix, /bin/tar mrix, /bin/touch mrix, /opt/local/bin/websh mrix, /data/disk/*/**/vendor/drush/drush/drush.php mrix, /etc/init.d/nginx mrix, /sbin/killall5 mrix, /sbin/unix_chkpwd mrix, /usr/bin/chromium mrix, /usr/bin/convert mrix, /usr/bin/find mrix, /usr/bin/id mrix, /usr/bin/magick mrix, /usr/bin/mysql mrix, /usr/bin/patch mrix, /usr/bin/sudo mrix, /usr/bin/svn mrix, /usr/bin/tput mrix, /usr/bin/tr mrix, /usr/bin/unzip mrix, /usr/bin/wget mrix, /usr/bin/which mrix, /usr/bin/which.debianutils mrix, /usr/local/bin/composer mrix, /usr/local/bin/curl mrix, /usr/local/bin/fix-drupal-platform-ownership.sh mrix, /usr/local/bin/fix-drupal-platform-permissions.sh mrix, /usr/local/bin/fix-drupal-site-ownership.sh mrix, /usr/local/bin/fix-drupal-site-permissions.sh mrix, /usr/local/bin/git mrix, /usr/local/bin/lock-local-drush-permissions.sh mrix, /usr/local/bin/mydumper mrix, /usr/local/bin/myloader mrix, /usr/local/bin/wkhtmltoimage mrix, /usr/local/bin/wkhtmltopdf mrix, /usr/local/libexec/git-core/* mrix, /usr/local/libexec/git-core/** mrix, /usr/sbin/nginx mrix, /usr/sbin/postdrop mrix, /usr/sbin/sendmail mrix, # Allow PHP-CLI to access some /dev /dev/null rw, /dev/random r, /dev/tty rw, /dev/urandom r, # Allow PHP-CLI to use tmp files /tmp/ r, /tmp/** rw, /var/spool/postfix/maildrop/ r, /var/spool/postfix/maildrop/* rw, /var/tmp/** rw, # Allow read access to necessary libraries /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /opt/php*/lib/php/** mr, /usr/lib/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/libexec/** mr, /usr/local/include/** mr, /usr/local/ioncube/ioncube_loader_lin_*.so mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, # Allow PHP-CLI to read and write its log files /var/log/php/** rw, /var/log/newrelic/php_agent.log rw, # Allow PHP-CLI to write to some other log/pid files /run/nginx.pid rw, /var/log/nginx/access.log rw, /var/log/nginx/error.log rw, # Allow PHP-CLI to access /proc and /sys for necessary information /proc/ r, /proc/** r, /sys/ r, /sys/** r, # Allow PHP-CLI to use /dev/shm for temporary storage /dev/shm/ r, /dev/shm/** rw, # Deny execution of binaries from these directories deny /home/*/.tmp/** m, deny /home/*/** m, deny /tmp/** m, deny /var/tmp/** m, # Allow PHP-CLI to access drush /data/disk/*/tools/drush/ r, /data/disk/*/tools/drush/* mrix, /data/disk/*/tools/drush/** r, /opt/tools/drush/** mrix, /usr/local/bin/cv.phar mrix, /var/aegir/drush/ r, /var/aegir/drush/* mrix, /var/aegir/drush/** r, # Allow PHP-CLI to access System Default Web Root /var/www/** r, owner /var/www/** rw, # Allow PHP-CLI to read/write in the Ægir Backend on Master Instance owner /var/aegir/.drush/ r, owner /var/aegir/.drush/* rw, owner /var/aegir/.drush/** rw, owner /var/aegir/.tmp/ r, owner /var/aegir/.tmp/* rw, owner /var/aegir/.tmp/** rw, owner /var/aegir/config/ r, owner /var/aegir/config/* rw, owner /var/aegir/config/** rw, owner /var/aegir/host_master-*/ r, owner /var/aegir/host_master-*/* rw, owner /var/aegir/host_master-*/** rw, owner /var/aegir/host_master/ r, owner /var/aegir/host_master/* rw, owner /var/aegir/host_master/** rw, owner /var/aegir/platforms/ r, owner /var/aegir/platforms/* rw, owner /var/aegir/platforms/** rw, # Allow PHP-CLI to read/write in the Ægir Backend on Octopus Instances /data/all/ r, /data/all/* r, /data/all/** r, /data/conf/ r, /data/conf/* r, /data/conf/** r, /data/disk/*/.bashrc r, owner /data/disk/*/.cache/**/pack-* l, owner /data/disk/*/static/**/pack-* l, owner /data/disk/*/log/ r, owner /data/disk/*/log/* rw, owner /data/disk/*/.*.pass.php r, owner /data/disk/*/.rnd rw, owner /data/disk/*/backups/ rwl, owner /data/disk/*/backups/* rwl, owner /data/disk/*/backups/** rwl, owner /data/disk/*/backup-exports/ rwl, owner /data/disk/*/backup-exports/* rwl, owner /data/disk/*/backup-exports/** rwl, owner /data/disk/*/.config/ rwl, owner /data/disk/*/.config/* rwl, owner /data/disk/*/.config/** rwl, owner /data/disk/*/.cache/ rwl, owner /data/disk/*/.cache/* rwl, owner /data/disk/*/.cache/** rwl, owner /data/disk/*/.drush/ rwl, owner /data/disk/*/.drush/* rwl, owner /data/disk/*/.drush/** rwl, owner /data/disk/*/.tmp/ rwl, owner /data/disk/*/.tmp/* rwl, owner /data/disk/*/.tmp/** rwl, owner /data/disk/*/clients/ rw, owner /data/disk/*/clients/* rw, owner /data/disk/*/clients/** rw, owner /data/disk/*/config/ rw, owner /data/disk/*/config/* rw, owner /data/disk/*/config/** rw, owner /data/disk/*/tools/le/ rw, owner /data/disk/*/tools/le/* rw, owner /data/disk/*/tools/le/** rw, # Allow PHP-CLI to read/write in the Ægir Frontend on Octopus Instances owner /data/disk/*/aegir/ rw, owner /data/disk/*/aegir/* rw, owner /data/disk/*/aegir/** rw, # Allow PHP-CLI to read/write in the limited shell user home for Drush support owner /home/*/.drush/sites/ rw, owner /home/*/.drush/sites/* rw, owner /home/*/.drush/sites/** rw, owner /home/*/.drush/cache/ rw, owner /home/*/.drush/cache/* rw, owner /home/*/.drush/cache/** rw, owner /home/*/.tmp/ rw, owner /home/*/.tmp/* rw, owner /home/*/.tmp/** rw, # Allow PHP-CLI to read/write in the custom web root directories /data/disk/*/static/ rw, /data/disk/*/static/* rw, /data/disk/*/static/** rw, /data/disk/*/distro/ rw, /data/disk/*/distro/* rw, /data/disk/*/distro/** rw, /data/disk/*/platforms/ rw, /data/disk/*/platforms/* rw, /data/disk/*/platforms/** rw, # Allow PHP-CLI to read and write in the root tmp owner /root/.tmp/ rw, owner /root/.tmp/* rw, owner /root/.tmp/** rw, # Deny access to various sensitive directories and files deny /boot/** mrwklx, # Catchall to deny everything else #deny /** rwklx, # Site-specific additions and overrides can be added below } ================================================ FILE: aegir/conf/apparmor/opt.php83.sbin.php-fpm ================================================ # AppArmor profile for PHP-FPM # This profile restricts the PHP-FPM (php83) to essential operations only. #include /opt/php83/sbin/php-fpm flags=(attach_disconnected) { # Include common AppArmor abstractions include include include include # Capabilities needed by PHP-FPM capability chown, capability dac_override, capability dac_read_search, capability fowner, capability kill, capability setgid, capability setuid, capability sys_resource, # Allow PHP-FPM to accept signal from PHP-CLI processes signal (receive) peer=/opt/php*/bin/php, network inet stream, network inet6 stream, # Allow PHP-FPM to execute its own binary /opt/php83/sbin/php-fpm mrix, # Allow PHP-FPM to read its configuration files /data/conf/ r, /data/conf/** r, /etc/ImageMagick-6/log.xml r, /etc/ImageMagick-6/policy.xml r, /etc/ld.so.cache r, /etc/mailname r, /etc/newrelic/upgrade_please.key r, /etc/postfix/dynamicmaps.cf r, /etc/postfix/dynamicmaps.cf.d/ r, /etc/postfix/dynamicmaps.cf.d/* r, /etc/postfix/main.cf r, /home/*/.drush/** r, /opt/etc/fpm/** r, /var/spool/postfix/maildrop/ r, /var/spool/postfix/maildrop/* rw, /opt/php83/** r, # Allow PHP-FPM to execute some other binaries /bin/dash mrix, /opt/local/bin/websh mrix, /usr/bin/advdef mrix, /usr/bin/advpng mrix, /usr/bin/chromium mrix, /usr/bin/convert mrix, /usr/bin/id mrix, /usr/bin/jpegoptim mrix, /usr/bin/jpegtran mrix, /usr/bin/magick mrix, /usr/bin/optipng mrix, /usr/bin/pngcrush mrix, /usr/bin/pngquant mrix, /usr/lib/postfix/sbin/smtpd mrix, /usr/local/bin/curl mrix, /usr/local/bin/wkhtmltoimage mrix, /usr/local/bin/wkhtmltopdf mrix, /usr/sbin/postdrop mrix, /usr/sbin/sendmail mrix, # Allow PHP-FPM to access some /dev /dev/null rw, /dev/random r, /dev/tty wr, /dev/urandom r, # Allow PHP-FPM to access its run directory /run/** rw, # Allow PHP-FPM to use tmp files /home/*/.tmp/ r, /home/*/.tmp/** rw, /tmp/ r, /tmp/** rw, /var/tmp/** rw, # Allow read access to necessary libraries /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /opt/php*/lib/php/** mr, /usr/lib/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/libexec/** mr, /usr/local/include/** mr, /usr/local/ioncube/ioncube_loader_lin_*.so mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, # Allow PHP-FPM to read and write its log files /var/log/newrelic/php_agent.log rw, /var/log/php/** rw, # Allow PHP-FPM to access /proc and /sys for necessary information /proc/** r, /sys/** r, # Allow PHP-FPM to use /dev/shm for temporary storage /dev/shm/ r, /dev/shm/** rw, # Deny execution of binaries from these directories deny /home/*/.tmp/** m, deny /home/*/** m, deny /tmp/** m, deny /var/tmp/** m, # Allow PHP-FPM to read and write in the custom web root directories /var/www/** r, /var/aegir/host_master/** r, /var/aegir/platforms/** r, /data/disk/*/aegir/** r, /data/disk/*/distro/** r, /data/disk/*/platforms/** r, /data/disk/*/static/** r, /data/disk/*/tools/le/** r, /data/all/ r, /data/all/* r, /data/all/** r, /data/conf/ r, /data/conf/* r, /data/conf/** r, owner /var/aegir/host_master/** rw, owner /var/aegir/platforms/** rw, owner /data/disk/*/aegir/** rw, owner /data/disk/*/distro/** rw, owner /data/disk/*/platforms/** rw, owner /data/disk/*/static/** rw, owner /var/www/** rw, /home/*.web/.aws/ r, /home/*.web/.aws/* rw, /home/*.web/.drush/ r, /home/*.web/.drush/* r, /home/*.web/.tmp/ r, /home/*.web/.tmp/* rw, # Deny access to various sensitive directories and files deny /boot/** mrwklx, deny /etc/shadow* rwlx, deny /root/** mrwklx, # Catchall to deny everything else #deny /** rwklx, # Site-specific additions and overrides can be added below } ================================================ FILE: aegir/conf/apparmor/opt.php84.bin.php ================================================ # AppArmor profile for PHP-CLI # This profile restricts PHP-CLI (php84) to essential operations only. #include /opt/php84/bin/php flags=(complain) { # Include common AppArmor abstractions include include include include include # Capabilities needed by PHP-CLI capability audit_write, capability chown, capability dac_override, capability dac_read_search, capability fowner, capability fsetid, capability mknod, capability setgid, capability setuid, capability sys_ptrace, capability sys_resource, # Allow PHP-CLI to execute its own binary /opt/php84/bin/php mrix, # Allow PHP-CLI to signal/ptrace other processes ptrace (read) peer=/opt/php*/bin/php, signal (send) peer=unconfined, signal (send) peer=/usr/sbin/nginx, ptrace (read) peer=/opt/php*/sbin/php-fpm, ptrace (read) peer=/usr/bin/mysqld_safe, ptrace (read) peer=/usr/bin/redis-server, ptrace (read) peer=/usr/local/sbin/pure-ftpd, ptrace (read) peer=/usr/sbin/nginx, ptrace (read) peer=/usr/sbin/rsyslogd, ptrace (read) peer=/usr/sbin/unbound, ptrace (read) peer=unconfined, # Allow PHP-CLI to read required configuration files /data/disk/*/.subversion/ r, /data/disk/*/.subversion/* r, /etc/default/nginx r, /etc/ImageMagick-6/log.xml r, /etc/ImageMagick-6/policy.xml r, /etc/ld.so.cache r, /etc/ldap/ldap.conf r, /etc/mailname r, /etc/mysql/conf.d/ r, /etc/mysql/conf.d/* r, /etc/mysql/my.cnf r, /etc/newrelic/upgrade_please.key r, /etc/nginx/conf.d/ r, /etc/nginx/conf.d/** r, /etc/nginx/fastcgi_params r, /etc/nginx/mime.types r, /etc/nginx/nginx.conf r, /etc/postfix/dynamicmaps.cf r, /etc/postfix/dynamicmaps.cf.d/ r, /etc/postfix/main.cf r, /etc/ssl/private/ r, /etc/ssl/private/* r, /etc/ssl/private/nginx-wild-ssl.crt r, /etc/ssl/private/nginx-wild-ssl.dhp r, /etc/ssl/private/nginx-wild-ssl.key r, /etc/subversion/ r, /etc/subversion/* r, /etc/wgetrc r, /home/*/.drush/ r, /home/*/.drush/** r, /usr/local/share/git-core/templates/ r, /usr/local/share/git-core/templates/* r, /usr/local/share/git-core/templates/** r, /usr/share/GeoIP/GeoIP.dat r, /usr/share/GeoIP/GeoIPv6.dat r, /usr/share/GeoIP/GeoLite2-ASN.mmdb r, /usr/share/GeoIP/GeoLite2-City.mmdb r, /usr/share/GeoIP/GeoLite2-Country.mmdb r, /opt/php84/** r, # Allow PHP-CLI to read required user/access files /etc/login.defs r, /etc/pam.d/* r, /etc/passwd r, /etc/security/capability.conf r, /etc/security/limits.conf r, /etc/security/limits.d/ r, /etc/security/limits.d/* r, /etc/shadow r, /etc/sudo.conf r, /etc/sudoers r, /etc/sudoers.d/ r, /etc/sudoers.d/* r, /run/sudo/ts/ r, /run/sudo/ts/* r, # Allow PHP-CLI to execute some other binaries /usr/bin/symlinks mrix, /bin/cat mrix, /bin/chmod mrix, /bin/chown mrix, /bin/cp mrix, /bin/dash mrix, /bin/date mrix, /bin/egrep mrix, /bin/grep mrix, /bin/kmod mrix, /bin/mkdir mrix, /bin/mv mrix, /bin/pidof mrix, /bin/rm mrix, /bin/run-parts mrix, /bin/sed mrix, /bin/stty mrix, /bin/tar mrix, /bin/touch mrix, /opt/local/bin/websh mrix, /data/disk/*/**/vendor/drush/drush/drush.php mrix, /etc/init.d/nginx mrix, /sbin/killall5 mrix, /sbin/unix_chkpwd mrix, /usr/bin/chromium mrix, /usr/bin/convert mrix, /usr/bin/find mrix, /usr/bin/id mrix, /usr/bin/magick mrix, /usr/bin/mysql mrix, /usr/bin/patch mrix, /usr/bin/sudo mrix, /usr/bin/svn mrix, /usr/bin/tput mrix, /usr/bin/tr mrix, /usr/bin/unzip mrix, /usr/bin/wget mrix, /usr/bin/which mrix, /usr/bin/which.debianutils mrix, /usr/local/bin/composer mrix, /usr/local/bin/curl mrix, /usr/local/bin/fix-drupal-platform-ownership.sh mrix, /usr/local/bin/fix-drupal-platform-permissions.sh mrix, /usr/local/bin/fix-drupal-site-ownership.sh mrix, /usr/local/bin/fix-drupal-site-permissions.sh mrix, /usr/local/bin/git mrix, /usr/local/bin/lock-local-drush-permissions.sh mrix, /usr/local/bin/mydumper mrix, /usr/local/bin/myloader mrix, /usr/local/bin/wkhtmltoimage mrix, /usr/local/bin/wkhtmltopdf mrix, /usr/local/libexec/git-core/* mrix, /usr/local/libexec/git-core/** mrix, /usr/sbin/nginx mrix, /usr/sbin/postdrop mrix, /usr/sbin/sendmail mrix, # Allow PHP-CLI to access some /dev /dev/null rw, /dev/random r, /dev/tty rw, /dev/urandom r, # Allow PHP-CLI to use tmp files /tmp/ r, /tmp/** rw, /var/spool/postfix/maildrop/ r, /var/spool/postfix/maildrop/* rw, /var/tmp/** rw, # Allow read access to necessary libraries /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /opt/php*/lib/php/** mr, /usr/lib/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/libexec/** mr, /usr/local/include/** mr, /usr/local/ioncube/ioncube_loader_lin_*.so mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, # Allow PHP-CLI to read and write its log files /var/log/php/** rw, /var/log/newrelic/php_agent.log rw, # Allow PHP-CLI to write to some other log/pid files /run/nginx.pid rw, /var/log/nginx/access.log rw, /var/log/nginx/error.log rw, # Allow PHP-CLI to access /proc and /sys for necessary information /proc/ r, /proc/** r, /sys/ r, /sys/** r, # Allow PHP-CLI to use /dev/shm for temporary storage /dev/shm/ r, /dev/shm/** rw, # Deny execution of binaries from these directories deny /home/*/.tmp/** m, deny /home/*/** m, deny /tmp/** m, deny /var/tmp/** m, # Allow PHP-CLI to access drush /data/disk/*/tools/drush/ r, /data/disk/*/tools/drush/* mrix, /data/disk/*/tools/drush/** r, /opt/tools/drush/** mrix, /usr/local/bin/cv.phar mrix, /var/aegir/drush/ r, /var/aegir/drush/* mrix, /var/aegir/drush/** r, # Allow PHP-CLI to access System Default Web Root /var/www/** r, owner /var/www/** rw, # Allow PHP-CLI to read/write in the Ægir Backend on Master Instance owner /var/aegir/.drush/ r, owner /var/aegir/.drush/* rw, owner /var/aegir/.drush/** rw, owner /var/aegir/.tmp/ r, owner /var/aegir/.tmp/* rw, owner /var/aegir/.tmp/** rw, owner /var/aegir/config/ r, owner /var/aegir/config/* rw, owner /var/aegir/config/** rw, owner /var/aegir/host_master-*/ r, owner /var/aegir/host_master-*/* rw, owner /var/aegir/host_master-*/** rw, owner /var/aegir/host_master/ r, owner /var/aegir/host_master/* rw, owner /var/aegir/host_master/** rw, owner /var/aegir/platforms/ r, owner /var/aegir/platforms/* rw, owner /var/aegir/platforms/** rw, # Allow PHP-CLI to read/write in the Ægir Backend on Octopus Instances /data/all/ r, /data/all/* r, /data/all/** r, /data/conf/ r, /data/conf/* r, /data/conf/** r, /data/disk/*/.bashrc r, owner /data/disk/*/.cache/**/pack-* l, owner /data/disk/*/static/**/pack-* l, owner /data/disk/*/log/ r, owner /data/disk/*/log/* rw, owner /data/disk/*/.*.pass.php r, owner /data/disk/*/.rnd rw, owner /data/disk/*/backups/ rwl, owner /data/disk/*/backups/* rwl, owner /data/disk/*/backups/** rwl, owner /data/disk/*/backup-exports/ rwl, owner /data/disk/*/backup-exports/* rwl, owner /data/disk/*/backup-exports/** rwl, owner /data/disk/*/.config/ rwl, owner /data/disk/*/.config/* rwl, owner /data/disk/*/.config/** rwl, owner /data/disk/*/.cache/ rwl, owner /data/disk/*/.cache/* rwl, owner /data/disk/*/.cache/** rwl, owner /data/disk/*/.drush/ rwl, owner /data/disk/*/.drush/* rwl, owner /data/disk/*/.drush/** rwl, owner /data/disk/*/.tmp/ rwl, owner /data/disk/*/.tmp/* rwl, owner /data/disk/*/.tmp/** rwl, owner /data/disk/*/clients/ rw, owner /data/disk/*/clients/* rw, owner /data/disk/*/clients/** rw, owner /data/disk/*/config/ rw, owner /data/disk/*/config/* rw, owner /data/disk/*/config/** rw, owner /data/disk/*/tools/le/ rw, owner /data/disk/*/tools/le/* rw, owner /data/disk/*/tools/le/** rw, # Allow PHP-CLI to read/write in the Ægir Frontend on Octopus Instances owner /data/disk/*/aegir/ rw, owner /data/disk/*/aegir/* rw, owner /data/disk/*/aegir/** rw, # Allow PHP-CLI to read/write in the limited shell user home for Drush support owner /home/*/.drush/sites/ rw, owner /home/*/.drush/sites/* rw, owner /home/*/.drush/sites/** rw, owner /home/*/.drush/cache/ rw, owner /home/*/.drush/cache/* rw, owner /home/*/.drush/cache/** rw, owner /home/*/.tmp/ rw, owner /home/*/.tmp/* rw, owner /home/*/.tmp/** rw, # Allow PHP-CLI to read/write in the custom web root directories /data/disk/*/static/ rw, /data/disk/*/static/* rw, /data/disk/*/static/** rw, /data/disk/*/distro/ rw, /data/disk/*/distro/* rw, /data/disk/*/distro/** rw, /data/disk/*/platforms/ rw, /data/disk/*/platforms/* rw, /data/disk/*/platforms/** rw, # Allow PHP-CLI to read and write in the root tmp owner /root/.tmp/ rw, owner /root/.tmp/* rw, owner /root/.tmp/** rw, # Deny access to various sensitive directories and files deny /boot/** mrwklx, # Catchall to deny everything else #deny /** rwklx, # Site-specific additions and overrides can be added below } ================================================ FILE: aegir/conf/apparmor/opt.php84.sbin.php-fpm ================================================ # AppArmor profile for PHP-FPM # This profile restricts the PHP-FPM (php84) to essential operations only. #include /opt/php84/sbin/php-fpm flags=(attach_disconnected) { # Include common AppArmor abstractions include include include include # Capabilities needed by PHP-FPM capability chown, capability dac_override, capability dac_read_search, capability fowner, capability kill, capability setgid, capability setuid, capability sys_resource, # Allow PHP-FPM to accept signal from PHP-CLI processes signal (receive) peer=/opt/php*/bin/php, network inet stream, network inet6 stream, # Allow PHP-FPM to execute its own binary /opt/php84/sbin/php-fpm mrix, # Allow PHP-FPM to read its configuration files /data/conf/ r, /data/conf/** r, /etc/ImageMagick-6/log.xml r, /etc/ImageMagick-6/policy.xml r, /etc/ld.so.cache r, /etc/mailname r, /etc/newrelic/upgrade_please.key r, /etc/postfix/dynamicmaps.cf r, /etc/postfix/dynamicmaps.cf.d/ r, /etc/postfix/dynamicmaps.cf.d/* r, /etc/postfix/main.cf r, /home/*/.drush/** r, /opt/etc/fpm/** r, /var/spool/postfix/maildrop/ r, /var/spool/postfix/maildrop/* rw, /opt/php84/** r, # Allow PHP-FPM to execute some other binaries /bin/dash mrix, /opt/local/bin/websh mrix, /usr/bin/advdef mrix, /usr/bin/advpng mrix, /usr/bin/chromium mrix, /usr/bin/convert mrix, /usr/bin/id mrix, /usr/bin/jpegoptim mrix, /usr/bin/jpegtran mrix, /usr/bin/magick mrix, /usr/bin/optipng mrix, /usr/bin/pngcrush mrix, /usr/bin/pngquant mrix, /usr/lib/postfix/sbin/smtpd mrix, /usr/local/bin/curl mrix, /usr/local/bin/wkhtmltoimage mrix, /usr/local/bin/wkhtmltopdf mrix, /usr/sbin/postdrop mrix, /usr/sbin/sendmail mrix, # Allow PHP-FPM to access some /dev /dev/null rw, /dev/random r, /dev/tty wr, /dev/urandom r, # Allow PHP-FPM to access its run directory /run/** rw, # Allow PHP-FPM to use tmp files /home/*/.tmp/ r, /home/*/.tmp/** rw, /tmp/ r, /tmp/** rw, /var/tmp/** rw, # Allow read access to necessary libraries /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /opt/php*/lib/php/** mr, /usr/lib/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/libexec/** mr, /usr/local/include/** mr, /usr/local/ioncube/ioncube_loader_lin_*.so mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, # Allow PHP-FPM to read and write its log files /var/log/newrelic/php_agent.log rw, /var/log/php/** rw, # Allow PHP-FPM to access /proc and /sys for necessary information /proc/** r, /sys/** r, # Allow PHP-FPM to use /dev/shm for temporary storage /dev/shm/ r, /dev/shm/** rw, # Deny execution of binaries from these directories deny /home/*/.tmp/** m, deny /home/*/** m, deny /tmp/** m, deny /var/tmp/** m, # Allow PHP-FPM to read and write in the custom web root directories /var/www/** r, /var/aegir/host_master/** r, /var/aegir/platforms/** r, /data/disk/*/aegir/** r, /data/disk/*/distro/** r, /data/disk/*/platforms/** r, /data/disk/*/static/** r, /data/disk/*/tools/le/** r, /data/all/ r, /data/all/* r, /data/all/** r, /data/conf/ r, /data/conf/* r, /data/conf/** r, owner /var/aegir/host_master/** rw, owner /var/aegir/platforms/** rw, owner /data/disk/*/aegir/** rw, owner /data/disk/*/distro/** rw, owner /data/disk/*/platforms/** rw, owner /data/disk/*/static/** rw, owner /var/www/** rw, /home/*.web/.aws/ r, /home/*.web/.aws/* rw, /home/*.web/.drush/ r, /home/*.web/.drush/* r, /home/*.web/.tmp/ r, /home/*.web/.tmp/* rw, # Deny access to various sensitive directories and files deny /boot/** mrwklx, deny /etc/shadow* rwlx, deny /root/** mrwklx, # Catchall to deny everything else #deny /** rwklx, # Site-specific additions and overrides can be added below } ================================================ FILE: aegir/conf/apparmor/opt.php85.bin.php ================================================ # AppArmor profile for PHP-CLI # This profile restricts PHP-CLI (php85) to essential operations only. #include /opt/php85/bin/php flags=(complain) { # Include common AppArmor abstractions include include include include include # Capabilities needed by PHP-CLI capability audit_write, capability chown, capability dac_override, capability dac_read_search, capability fowner, capability fsetid, capability mknod, capability setgid, capability setuid, capability sys_ptrace, capability sys_resource, # Allow PHP-CLI to execute its own binary /opt/php85/bin/php mrix, # Allow PHP-CLI to signal/ptrace other processes ptrace (read) peer=/opt/php*/bin/php, signal (send) peer=unconfined, signal (send) peer=/usr/sbin/nginx, ptrace (read) peer=/opt/php*/sbin/php-fpm, ptrace (read) peer=/usr/bin/mysqld_safe, ptrace (read) peer=/usr/bin/redis-server, ptrace (read) peer=/usr/local/sbin/pure-ftpd, ptrace (read) peer=/usr/sbin/nginx, ptrace (read) peer=/usr/sbin/rsyslogd, ptrace (read) peer=/usr/sbin/unbound, ptrace (read) peer=unconfined, # Allow PHP-CLI to read required configuration files /data/disk/*/.subversion/ r, /data/disk/*/.subversion/* r, /etc/default/nginx r, /etc/ImageMagick-6/log.xml r, /etc/ImageMagick-6/policy.xml r, /etc/ld.so.cache r, /etc/ldap/ldap.conf r, /etc/mailname r, /etc/mysql/conf.d/ r, /etc/mysql/conf.d/* r, /etc/mysql/my.cnf r, /etc/newrelic/upgrade_please.key r, /etc/nginx/conf.d/ r, /etc/nginx/conf.d/** r, /etc/nginx/fastcgi_params r, /etc/nginx/mime.types r, /etc/nginx/nginx.conf r, /etc/postfix/dynamicmaps.cf r, /etc/postfix/dynamicmaps.cf.d/ r, /etc/postfix/main.cf r, /etc/ssl/private/ r, /etc/ssl/private/* r, /etc/ssl/private/nginx-wild-ssl.crt r, /etc/ssl/private/nginx-wild-ssl.dhp r, /etc/ssl/private/nginx-wild-ssl.key r, /etc/subversion/ r, /etc/subversion/* r, /etc/wgetrc r, /home/*/.drush/ r, /home/*/.drush/** r, /usr/local/share/git-core/templates/ r, /usr/local/share/git-core/templates/* r, /usr/local/share/git-core/templates/** r, /usr/share/GeoIP/GeoIP.dat r, /usr/share/GeoIP/GeoIPv6.dat r, /usr/share/GeoIP/GeoLite2-ASN.mmdb r, /usr/share/GeoIP/GeoLite2-City.mmdb r, /usr/share/GeoIP/GeoLite2-Country.mmdb r, /opt/php85/** r, # Allow PHP-CLI to read required user/access files /etc/login.defs r, /etc/pam.d/* r, /etc/passwd r, /etc/security/capability.conf r, /etc/security/limits.conf r, /etc/security/limits.d/ r, /etc/security/limits.d/* r, /etc/shadow r, /etc/sudo.conf r, /etc/sudoers r, /etc/sudoers.d/ r, /etc/sudoers.d/* r, /run/sudo/ts/ r, /run/sudo/ts/* r, # Allow PHP-CLI to execute some other binaries /usr/bin/symlinks mrix, /bin/cat mrix, /bin/chmod mrix, /bin/chown mrix, /bin/cp mrix, /bin/dash mrix, /bin/date mrix, /bin/egrep mrix, /bin/grep mrix, /bin/kmod mrix, /bin/mkdir mrix, /bin/mv mrix, /bin/pidof mrix, /bin/rm mrix, /bin/run-parts mrix, /bin/sed mrix, /bin/stty mrix, /bin/tar mrix, /bin/touch mrix, /opt/local/bin/websh mrix, /data/disk/*/**/vendor/drush/drush/drush.php mrix, /etc/init.d/nginx mrix, /sbin/killall5 mrix, /sbin/unix_chkpwd mrix, /usr/bin/chromium mrix, /usr/bin/convert mrix, /usr/bin/find mrix, /usr/bin/id mrix, /usr/bin/magick mrix, /usr/bin/mysql mrix, /usr/bin/patch mrix, /usr/bin/sudo mrix, /usr/bin/svn mrix, /usr/bin/tput mrix, /usr/bin/tr mrix, /usr/bin/unzip mrix, /usr/bin/wget mrix, /usr/bin/which mrix, /usr/bin/which.debianutils mrix, /usr/local/bin/composer mrix, /usr/local/bin/curl mrix, /usr/local/bin/fix-drupal-platform-ownership.sh mrix, /usr/local/bin/fix-drupal-platform-permissions.sh mrix, /usr/local/bin/fix-drupal-site-ownership.sh mrix, /usr/local/bin/fix-drupal-site-permissions.sh mrix, /usr/local/bin/git mrix, /usr/local/bin/lock-local-drush-permissions.sh mrix, /usr/local/bin/mydumper mrix, /usr/local/bin/myloader mrix, /usr/local/bin/wkhtmltoimage mrix, /usr/local/bin/wkhtmltopdf mrix, /usr/local/libexec/git-core/* mrix, /usr/local/libexec/git-core/** mrix, /usr/sbin/nginx mrix, /usr/sbin/postdrop mrix, /usr/sbin/sendmail mrix, # Allow PHP-CLI to access some /dev /dev/null rw, /dev/random r, /dev/tty rw, /dev/urandom r, # Allow PHP-CLI to use tmp files /tmp/ r, /tmp/** rw, /var/spool/postfix/maildrop/ r, /var/spool/postfix/maildrop/* rw, /var/tmp/** rw, # Allow read access to necessary libraries /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /opt/php*/lib/php/** mr, /usr/lib/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/libexec/** mr, /usr/local/include/** mr, /usr/local/ioncube/ioncube_loader_lin_*.so mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, # Allow PHP-CLI to read and write its log files /var/log/php/** rw, /var/log/newrelic/php_agent.log rw, # Allow PHP-CLI to write to some other log/pid files /run/nginx.pid rw, /var/log/nginx/access.log rw, /var/log/nginx/error.log rw, # Allow PHP-CLI to access /proc and /sys for necessary information /proc/ r, /proc/** r, /sys/ r, /sys/** r, # Allow PHP-CLI to use /dev/shm for temporary storage /dev/shm/ r, /dev/shm/** rw, # Deny execution of binaries from these directories deny /home/*/.tmp/** m, deny /home/*/** m, deny /tmp/** m, deny /var/tmp/** m, # Allow PHP-CLI to access drush /data/disk/*/tools/drush/ r, /data/disk/*/tools/drush/* mrix, /data/disk/*/tools/drush/** r, /opt/tools/drush/** mrix, /usr/local/bin/cv.phar mrix, /var/aegir/drush/ r, /var/aegir/drush/* mrix, /var/aegir/drush/** r, # Allow PHP-CLI to access System Default Web Root /var/www/** r, owner /var/www/** rw, # Allow PHP-CLI to read/write in the Ægir Backend on Master Instance owner /var/aegir/.drush/ r, owner /var/aegir/.drush/* rw, owner /var/aegir/.drush/** rw, owner /var/aegir/.tmp/ r, owner /var/aegir/.tmp/* rw, owner /var/aegir/.tmp/** rw, owner /var/aegir/config/ r, owner /var/aegir/config/* rw, owner /var/aegir/config/** rw, owner /var/aegir/host_master-*/ r, owner /var/aegir/host_master-*/* rw, owner /var/aegir/host_master-*/** rw, owner /var/aegir/host_master/ r, owner /var/aegir/host_master/* rw, owner /var/aegir/host_master/** rw, owner /var/aegir/platforms/ r, owner /var/aegir/platforms/* rw, owner /var/aegir/platforms/** rw, # Allow PHP-CLI to read/write in the Ægir Backend on Octopus Instances /data/all/ r, /data/all/* r, /data/all/** r, /data/conf/ r, /data/conf/* r, /data/conf/** r, /data/disk/*/.bashrc r, owner /data/disk/*/.cache/**/pack-* l, owner /data/disk/*/static/**/pack-* l, owner /data/disk/*/log/ r, owner /data/disk/*/log/* rw, owner /data/disk/*/.*.pass.php r, owner /data/disk/*/.rnd rw, owner /data/disk/*/backups/ rwl, owner /data/disk/*/backups/* rwl, owner /data/disk/*/backups/** rwl, owner /data/disk/*/backup-exports/ rwl, owner /data/disk/*/backup-exports/* rwl, owner /data/disk/*/backup-exports/** rwl, owner /data/disk/*/.config/ rwl, owner /data/disk/*/.config/* rwl, owner /data/disk/*/.config/** rwl, owner /data/disk/*/.cache/ rwl, owner /data/disk/*/.cache/* rwl, owner /data/disk/*/.cache/** rwl, owner /data/disk/*/.drush/ rwl, owner /data/disk/*/.drush/* rwl, owner /data/disk/*/.drush/** rwl, owner /data/disk/*/.tmp/ rwl, owner /data/disk/*/.tmp/* rwl, owner /data/disk/*/.tmp/** rwl, owner /data/disk/*/clients/ rw, owner /data/disk/*/clients/* rw, owner /data/disk/*/clients/** rw, owner /data/disk/*/config/ rw, owner /data/disk/*/config/* rw, owner /data/disk/*/config/** rw, owner /data/disk/*/tools/le/ rw, owner /data/disk/*/tools/le/* rw, owner /data/disk/*/tools/le/** rw, # Allow PHP-CLI to read/write in the Ægir Frontend on Octopus Instances owner /data/disk/*/aegir/ rw, owner /data/disk/*/aegir/* rw, owner /data/disk/*/aegir/** rw, # Allow PHP-CLI to read/write in the limited shell user home for Drush support owner /home/*/.drush/sites/ rw, owner /home/*/.drush/sites/* rw, owner /home/*/.drush/sites/** rw, owner /home/*/.drush/cache/ rw, owner /home/*/.drush/cache/* rw, owner /home/*/.drush/cache/** rw, owner /home/*/.tmp/ rw, owner /home/*/.tmp/* rw, owner /home/*/.tmp/** rw, # Allow PHP-CLI to read/write in the custom web root directories /data/disk/*/static/ rw, /data/disk/*/static/* rw, /data/disk/*/static/** rw, /data/disk/*/distro/ rw, /data/disk/*/distro/* rw, /data/disk/*/distro/** rw, /data/disk/*/platforms/ rw, /data/disk/*/platforms/* rw, /data/disk/*/platforms/** rw, # Allow PHP-CLI to read and write in the root tmp owner /root/.tmp/ rw, owner /root/.tmp/* rw, owner /root/.tmp/** rw, # Deny access to various sensitive directories and files deny /boot/** mrwklx, # Catchall to deny everything else #deny /** rwklx, # Site-specific additions and overrides can be added below } ================================================ FILE: aegir/conf/apparmor/opt.php85.sbin.php-fpm ================================================ # AppArmor profile for PHP-FPM # This profile restricts the PHP-FPM (php85) to essential operations only. #include /opt/php85/sbin/php-fpm flags=(attach_disconnected) { # Include common AppArmor abstractions include include include include # Capabilities needed by PHP-FPM capability chown, capability dac_override, capability dac_read_search, capability fowner, capability kill, capability setgid, capability setuid, capability sys_resource, # Allow PHP-FPM to accept signal from PHP-CLI processes signal (receive) peer=/opt/php*/bin/php, network inet stream, network inet6 stream, # Allow PHP-FPM to execute its own binary /opt/php85/sbin/php-fpm mrix, # Allow PHP-FPM to read its configuration files /data/conf/ r, /data/conf/** r, /etc/ImageMagick-6/log.xml r, /etc/ImageMagick-6/policy.xml r, /etc/ld.so.cache r, /etc/mailname r, /etc/newrelic/upgrade_please.key r, /etc/postfix/dynamicmaps.cf r, /etc/postfix/dynamicmaps.cf.d/ r, /etc/postfix/dynamicmaps.cf.d/* r, /etc/postfix/main.cf r, /home/*/.drush/** r, /opt/etc/fpm/** r, /var/spool/postfix/maildrop/ r, /var/spool/postfix/maildrop/* rw, /opt/php85/** r, # Allow PHP-FPM to execute some other binaries /bin/dash mrix, /opt/local/bin/websh mrix, /usr/bin/advdef mrix, /usr/bin/advpng mrix, /usr/bin/chromium mrix, /usr/bin/convert mrix, /usr/bin/id mrix, /usr/bin/jpegoptim mrix, /usr/bin/jpegtran mrix, /usr/bin/magick mrix, /usr/bin/optipng mrix, /usr/bin/pngcrush mrix, /usr/bin/pngquant mrix, /usr/lib/postfix/sbin/smtpd mrix, /usr/local/bin/curl mrix, /usr/local/bin/wkhtmltoimage mrix, /usr/local/bin/wkhtmltopdf mrix, /usr/sbin/postdrop mrix, /usr/sbin/sendmail mrix, # Allow PHP-FPM to access some /dev /dev/null rw, /dev/random r, /dev/tty wr, /dev/urandom r, # Allow PHP-FPM to access its run directory /run/** rw, # Allow PHP-FPM to use tmp files /home/*/.tmp/ r, /home/*/.tmp/** rw, /tmp/ r, /tmp/** rw, /var/tmp/** rw, # Allow read access to necessary libraries /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /opt/php*/lib/php/** mr, /usr/lib/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/libexec/** mr, /usr/local/include/** mr, /usr/local/ioncube/ioncube_loader_lin_*.so mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, # Allow PHP-FPM to read and write its log files /var/log/newrelic/php_agent.log rw, /var/log/php/** rw, # Allow PHP-FPM to access /proc and /sys for necessary information /proc/** r, /sys/** r, # Allow PHP-FPM to use /dev/shm for temporary storage /dev/shm/ r, /dev/shm/** rw, # Deny execution of binaries from these directories deny /home/*/.tmp/** m, deny /home/*/** m, deny /tmp/** m, deny /var/tmp/** m, # Allow PHP-FPM to read and write in the custom web root directories /var/www/** r, /var/aegir/host_master/** r, /var/aegir/platforms/** r, /data/disk/*/aegir/** r, /data/disk/*/distro/** r, /data/disk/*/platforms/** r, /data/disk/*/static/** r, /data/disk/*/tools/le/** r, /data/all/ r, /data/all/* r, /data/all/** r, /data/conf/ r, /data/conf/* r, /data/conf/** r, owner /var/aegir/host_master/** rw, owner /var/aegir/platforms/** rw, owner /data/disk/*/aegir/** rw, owner /data/disk/*/distro/** rw, owner /data/disk/*/platforms/** rw, owner /data/disk/*/static/** rw, owner /var/www/** rw, /home/*.web/.aws/ r, /home/*.web/.aws/* rw, /home/*.web/.drush/ r, /home/*.web/.drush/* r, /home/*.web/.tmp/ r, /home/*.web/.tmp/* rw, # Deny access to various sensitive directories and files deny /boot/** mrwklx, deny /etc/shadow* rwlx, deny /root/** mrwklx, # Catchall to deny everything else #deny /** rwklx, # Site-specific additions and overrides can be added below } ================================================ FILE: aegir/conf/apparmor/sbin.dhclient ================================================ # AppArmor profile for DHCP dhclient # This profile restricts DHCP dhclient (dhclient) to essential operations only. #include /{,usr/}sbin/dhclient flags=(complain) { # Include common AppArmor abstractions include include include # Capabilities needed by DHCP dhclient capability net_bind_service, capability net_raw, capability dac_override, capability net_admin, network packet, network raw, @{PROC}/[0-9]*/net/ r, @{PROC}/[0-9]*/net/** r, # dhclient wants to update its threads with functional names owner @{PROC}/@{pid}/task/[0-9]*/comm rw, /{,usr/}sbin/dhclient mrix, /{,usr/}bin/bash mrix, /etc/dhclient.conf r, /etc/dhcp/ r, /etc/dhcp/** r, /var/lib/dhcp{,3}/dhclient* lrw, /{,var/}run/dhclient*.pid lrw, /{,var/}run/dhclient*.lease* lrw, # NetworkManager /{,var/}run/nm*conf r, /{,var/}run/sendsigs.omit.d/network-manager.dhclient*.pid lrw, /{,var/}run/NetworkManager/dhclient*.pid lrw, /var/lib/NetworkManager/dhclient*.conf lrw, /var/lib/NetworkManager/dhclient*.lease* lrw, signal (receive) peer=/usr/sbin/NetworkManager, ptrace (readby) peer=/usr/sbin/NetworkManager, # connman /{,var/}run/connman/dhclient*.pid lrw, /{,var/}run/connman/dhclient*.leases lrw, # synce-hal /usr/share/synce-hal/dhclient.conf r, # if there is a custom script, let it run unconfined /etc/dhcp/dhclient-script Uxr, # The dhclient-script shell script sources other shell scripts rather than # executing them, so we can't just use a separate profile for dhclient-script # with 'Uxr' on the hook scripts. However, for the long-running dhclient3 # daemon to run arbitrary code via /sbin/dhclient-script, it would need to be # able to subvert dhclient-script or write to the hooks.d directories. As # such, if the dhclient3 daemon is subverted, this effectively limits it to # only being able to run the hooks scripts. /{,usr/}sbin/dhclient-script Uxr, # Run the ELF executables under their own unrestricted profiles /usr/lib/NetworkManager/nm-dhcp-client.action Pxrm, /usr/lib/connman/scripts/dhclient-script Pxrm, # Support the new executable helper from NetworkManager. /usr/lib/NetworkManager/nm-dhcp-helper Pxrm, signal (receive) peer=/usr/lib/NetworkManager/nm-dhcp-helper, } # Profile for NetworkManager action /usr/lib/NetworkManager/nm-dhcp-client.action flags=(complain) { include include /usr/lib/NetworkManager/nm-dhcp-client.action mrix, /var/lib/NetworkManager/*lease r, signal (receive) peer=/usr/sbin/NetworkManager, ptrace (readby) peer=/usr/sbin/NetworkManager, network inet dgram, network inet6 dgram, } # Profile for NetworkManager helper /usr/lib/NetworkManager/nm-dhcp-helper flags=(complain) { include include /usr/lib/NetworkManager/nm-dhcp-helper mrix, /run/NetworkManager/private-dhcp rw, signal (send) peer=/sbin/dhclient, /var/lib/NetworkManager/*lease r, signal (receive) peer=/usr/sbin/NetworkManager, ptrace (readby) peer=/usr/sbin/NetworkManager, network inet dgram, network inet6 dgram, } # Profile for connman script /usr/lib/connman/scripts/dhclient-script flags=(complain) { include include /usr/lib/connman/scripts/dhclient-script mrix, network inet dgram, network inet6 dgram, } ================================================ FILE: aegir/conf/apparmor/usr.bin.chromium ================================================ # File: /etc/apparmor.d/usr.bin.chromium #include /usr/bin/chromium flags=(complain) { # Include common AppArmor abstractions include include include # Deny capability sys_ptrace deny capability sys_ptrace, # System paths chromium needs to operate /usr/bin/chromium mrix, /usr/lib/chromium/** mrix, # Temp usage owner /tmp/** rwk, owner /dev/shm/** rwk, # Proc/sys reads /proc/** r, /sys/** r, # Devices commonly accessed /dev/null rw, /dev/urandom r, /dev/random r, # Allow read access to necessary libraries /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /usr/lib/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/libexec/** mr, /usr/local/include/** mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, # Fonts + fontconfig /etc/fonts/** r, /usr/share/fonts/** r, /var/cache/fontconfig/** r, # Allow to read and write in the web root directories /var/www/** r, /data/disk/*/aegir/** r, /data/disk/*/distro/** r, /data/disk/*/platforms/** r, /data/disk/*/static/** r, owner /data/disk/*/distro/** rwk, owner /data/disk/*/platforms/** rwk, owner /data/disk/*/static/** rwk, owner /var/www/** rwk, /home/*.web/.aws/ r, /home/*.web/.aws/* rw, /home/*.web/.drush/ r, /home/*.web/.drush/* r, /home/*.web/.tmp/ r, /home/*.web/.tmp/* rw, # Catchall to deny everything else #deny /** rwklx, } ================================================ FILE: aegir/conf/apparmor/usr.bin.freshclam ================================================ # AppArmor profile for Freshclam service # This profile restricts Freshclam service (freshclam) to essential operations only. #include /usr/bin/freshclam flags=(complain) { # Include common AppArmor abstractions include include include include include # Capabilities needed by Freshclam service capability chown, capability dac_override, capability net_admin, capability net_bind_service, capability setgid, capability setuid, network inet stream, network inet dgram, network inet6 stream, network inet6 dgram, # Allow execution of necessary shells and the freshclam binary /bin/dash mrix, /bin/bash mrix, /bin/sh mrix, /usr/bin/freshclam mrix, # Allow access to /dev /dev/log w, /dev/null rw, /dev/random r, /dev/urandom r, # Allow access to /proc and /sys for necessary information /proc/** r, /sys/** r, # Allow access to temporary directories /tmp/ r, /tmp/** rw, /var/tmp/** rw, # Deny access to samba specific directories deny /{,var/}run/samba/{gencache,unexpected}.tdb mrwlk, # Allow read access to ClamAV configuration files /etc/clamav/clamd.conf r, /etc/clamav/freshclam.conf r, /etc/clamav/onerrorexecute.d/* mr, /etc/clamav/onupdateexecute.d/* mr, /etc/clamav/virusevent.d/* mr, # Allow read access to SSL libraries /usr/local/ssl3/lib64/libcrypto.so.* mr, /usr/local/ssl3/lib64/libssl.so.* mr, /usr/local/ssl3/openssl.cnf r, # Allow access to ClamAV directories and files /var/lib/clamav/ r, /var/lib/clamav/** rwk, /var/log/clamav/* rwk, /{,var/}run/clamav/clamd.ctl rw, /{,var/}run/clamav/freshclam.pid w, # Allow reading filesystems information @{PROC}/filesystems r, # Allow read/write access to ClamAV user directories owner /home/*/.clamtk/db/ r, owner /home/*/.clamtk/db/** rwk, owner /home/*/.klamav/database/ r, owner /home/*/.klamav/database/** rwk, owner @{PROC}/[0-9]*/status r, # Deny access to sensitive files and directories deny /etc/shadow* rwlx, deny /etc/passwd* rwlx, deny /root/** rwklx, # Catchall to deny everything else #deny /** rwklx, # Site-specific additions and overrides can be added below } ================================================ FILE: aegir/conf/apparmor/usr.bin.man ================================================ # AppArmor profile for Man service # This profile restricts Man service (man) to essential operations only. #include /usr/bin/man flags=(complain) { # Include common AppArmor abstractions include # Use a special profile when man calls anything groff-related. We only # include the programs that actually parse input data in a non-trivial # way, not wrappers such as groff and nroff, since the latter would need a # broader profile. /usr/bin/eqn mrCx -> &man_groff, /usr/bin/grap mrCx -> &man_groff, /usr/bin/pic mrCx -> &man_groff, /usr/bin/preconv mrCx -> &man_groff, /usr/bin/refer mrCx -> &man_groff, /usr/bin/tbl mrCx -> &man_groff, /usr/bin/troff mrCx -> &man_groff, /usr/bin/vgrind mrCx -> &man_groff, # Similarly, use a special profile when man calls decompressors and other # simple filters. /{,usr/}bin/bzip2 mrCx -> &man_filter, /{,usr/}bin/gzip mrCx -> &man_filter, /usr/bin/col mrCx -> &man_filter, /usr/bin/compress mrCx -> &man_filter, /usr/bin/iconv mrCx -> &man_filter, /usr/bin/lzip.lzip mrCx -> &man_filter, /usr/bin/tr mrCx -> &man_filter, /usr/bin/xz mrCx -> &man_filter, # Allow basic filesystem access, subject to DAC /** mrixwlk, unix, # Capabilities needed by Man service capability setuid, capability setgid, # Ordinary permission checks sometimes involve checking whether the # process has this capability, which can produce audit log messages. # Silence them. deny capability dac_override, deny capability dac_read_search, signal peer=@{profile_name}, signal peer=/usr/bin/man//&man_groff, signal peer=/usr/bin/man//&man_filter, } profile man_groff flags=(complain) { include include /usr/bin/eqn mrix, /usr/bin/grap mrix, /usr/bin/pic mrix, /usr/bin/preconv mrix, /usr/bin/refer mrix, /usr/bin/tbl mrix, /usr/bin/troff mrix, /usr/bin/vgrind mrix, /etc/groff/** r, /etc/papersize r, /usr/lib/groff/site-tmac/** r, /usr/share/groff/** r, /tmp/groff* rw, signal peer=/usr/bin/man, signal peer=/usr/bin/man//&man_groff, } profile man_filter flags=(complain) { include include /{,usr/}bin/bzip2 mrix, /{,usr/}bin/gzip mrix, /usr/bin/col mrix, /usr/bin/compress mrix, /usr/bin/iconv mrix, /usr/bin/lzip.lzip mrix, /usr/bin/tr mrix, /usr/bin/xz mrix, # Manual pages can be more or less anywhere, especially with "man -l", and # there's no harm in allowing wide read access here since the worst it can # do is feed data to the invoking man process. /** r, # Allow writing cat pages. /var/cache/man/** rw, signal peer=/usr/bin/man, signal peer=/usr/bin/man//&man_filter, } ================================================ FILE: aegir/conf/apparmor/usr.bin.mysecureshell ================================================ # AppArmor profile for MySecureShell # This profile restricts MySecureShell (mysecureshell) to essential operations only. #include /usr/bin/mysecureshell flags=(complain) { # Include common AppArmor abstractions include include include include include include include include # Read access to its own config and logs /etc/ssh/sftp_config r, /etc/lshell.conf r, /var/log/lsh/ r, /var/log/lsh/* rw, /opt/php*/lib/php.ini r, # Allow read access to necessary libraries /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /opt/php*/lib/php/** mr, /usr/lib/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/libexec/** mr, /usr/local/include/** mr, /usr/local/ioncube/ioncube_loader_lin_*.so mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, # Allow MySecureShell to access /proc and /sys for necessary information /proc/ r, /proc/** r, /sys/ r, /sys/** r, # Read/write access to user home /home/*/ r, /home/*/** rw, # Read/write access to SSH client files /home/*/.ssh/ r, /home/*/.ssh/** rw, # Read-only access to Drush aliases and php.ini files /home/*/.drush/ r, /home/*/.drush/** r, # Drush access /opt/tools/drush/** mrix, /usr/local/bin/cv.phar mrix, # Read-only access to Octopus directories /data/disk/*/.drush/ r, /data/disk/*/.drush/** r, /data/disk/*/backups/ r, /data/disk/*/backups/** r, /data/disk/*/clients/ r, /data/disk/*/clients/** r, /data/disk/*/distro/** r, /data/disk/*/static/ r, /data/disk/*/static/** r, # Allow write access to Octopus user directories and files owner /data/disk/*/distro/** rw, owner /data/disk/*/static/ r, owner /data/disk/*/static/** rw, owner /opt/user/npm/*/** rw, owner /opt/user/gems/*/** rw, owner /opt/user/gems/*/bin/** k, # Read/write access to Drush cache /home/*/.drush/cache/ r, /home/*/.drush/cache/** rw, # Deny access to critical system files deny /etc/shadow* rwlx, # Allow read access to user information files /etc/passwd r, /etc/group r, /etc/nsswitch.conf r, /etc/hosts r, # Allow read-only access to resolv.conf for DNS resolution /etc/resolv.conf r, # Temporary files and directories /home/*/.tmp/ r, /home/*/.tmp/** rw, # Deny execution of any shell or command not explicitly allowed deny /bin/bash x, deny /usr/bin/perl x, # Allow execution of necessary binaries /bin/dash mrix, /opt/local/bin/websh mrix, /usr/bin/mysecureshell mrix, /usr/bin/python* mrix, /usr/local/bin/lshell mrix, # Additional binaries allowed in Limited Shell /bin/bzip2 mrix, /bin/cat mrix, /bin/chmod mrix, /bin/cp mrix, /bin/echo mrix, /bin/egrep mrix, /bin/grep mrix, /bin/gunzip mrix, /bin/gzip mrix, /bin/ls mrix, /bin/mkdir mrix, /bin/mv mrix, /bin/nano mrix, /bin/ping mrix, /bin/pwd mrix, /bin/rm mrix, /bin/rmdir mrix, /bin/sed mrix, /bin/stty mrix, /bin/tar mrix, /bin/touch mrix, /bin/true mrix, /data/disk/*/tools/drush/drush.php mrix, /opt/local/bin/mybackup mrix, /opt/local/bin/sqlmagic mrix, /opt/php*/bin/php mrix, /usr/bin/diff mrix, /usr/bin/du mrix, /usr/bin/env mrix, /usr/bin/find mrix, /usr/bin/id mrix, /usr/bin/mysql mrix, /usr/bin/mysqldump mrix, /usr/bin/node mrix, /usr/bin/openssl mrix, /usr/bin/passwd mrix, /usr/bin/patch mrix, /usr/bin/rsync mrix, /usr/bin/rvim mrix, /usr/bin/tput mrix, /usr/bin/unzip mrix, /usr/bin/wget mrix, /usr/bin/which.debianutils mrix, /usr/bin/zstd mrix, /usr/lib/node_modules/npm/bin/** mrix, /usr/local/bin/composer mrix, /usr/local/bin/curl mrix, /usr/local/bin/gem mrix, /usr/local/bin/git mrix, /usr/local/bin/git-receive-pack mrix, /usr/local/bin/git-upload-archive mrix, /usr/local/bin/git-upload-pack mrix, /usr/local/bin/mydumper mrix, /usr/local/bin/myloader mrix, /usr/local/bin/scp mrix, /usr/local/bin/sftp mrix, /usr/local/bin/ssh mrix, /usr/local/bin/ssh-keygen mrix, owner /opt/user/gems/*/** mrix, owner /opt/user/npm/*/** mrix, # Deny execution of any other binaries #deny /** rwklx, } ================================================ FILE: aegir/conf/apparmor/usr.bin.mysql ================================================ # AppArmor profile for MySQL client # This profile restricts MySQL client (mysql) to essential operations only. #include /usr/bin/mysql flags=(complain) { # Include common AppArmor abstractions include include include include # Capabilities needed by MySQL client capability net_bind_service, capability setgid, capability setuid, # Allow execution of the mysql binary /usr/bin/mysql mrix, # Allow execution of the mysqld binary /usr/sbin/mysqld mrix, # Allow execution of necessary utilities /bin/** mrix, /usr/bin/** mrix, /usr/sbin/** mrix, # Allow reading necessary directories /bin/ r, /usr/bin/ r, /usr/sbin/ r, /etc/inputrc r, # Allow MySQL to read its configuration files /etc/mysql/** r, /etc/mysql/conf.d/** r, /etc/mysql/mysql.conf.d/** r, # Allow MySQL to access its data directory /var/lib/mysql/ rwk, /var/lib/mysql/** rwk, # Allow MySQL to access its run directory /run/mysqld/ r, /run/mysqld/** rw, # Allow MySQL to access its tmp directory /tmp/ r, /tmp/** rw, # Allow MySQL to read system libraries /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /usr/lib/** mr, /usr/lib/mysql/plugin/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, /usr/share/mysql/** r, /usr/share/zoneinfo/** r, # Allow MySQL to access /proc and /sys for necessary information /proc/** r, /sys/** r, # Allow MySQL to use /dev/shm for temporary storage /dev/shm/** rw, /dev/shm/ r, # Allow MySQL to read network-related configurations /etc/hosts.allow r, /etc/hosts.deny r, /etc/services r, # Disallow execution of binaries from /tmp and /var/tmp deny /tmp/** m, deny /var/tmp/** m, # Deny access to various sensitive directories deny /boot/** mrwklx, # Deny access to various sensitive files deny /etc/shadow* rwlx, deny /etc/shadow- r, deny /etc/gshadow r, deny /etc/gshadow- r, # Allow reading the user's .my.cnf file /root/.my.cnf r, /home/*/.my.cnf r, # Allow writing to log files in user's home directory /home/*/.mysql_history rw, /root/.mysql_history rw, # Catchall to deny everything else #deny /** rwklx, # Site-specific additions and overrides can be added below } ================================================ FILE: aegir/conf/apparmor/usr.bin.mysqld_safe ================================================ # AppArmor profile for MySQLd starter # This profile restricts MySQLd starter (mysqld_safe) to essential operations only. #include /usr/bin/mysqld_safe flags=(complain) { # Include common AppArmor abstractions include include include include # Capabilities needed by MySQLd starter capability dac_override, capability dac_read_search, capability setgid, capability setuid, capability sys_resource, capability sys_nice, network inet stream, network inet6 stream, # Allow MySQLd to accept signal from PHP-CLI processes signal (receive) peer=/opt/php*/bin/php, # Allow mysqld_safe to read its configuration files /etc/mysql/** r, /etc/mysql/conf.d/** r, /etc/mysql/mysql.conf.d/** r, /etc/hosts.deny r, /etc/hosts.allow r, # Allow mysqld_safe to access its data directory /var/lib/mysql/ rwk, /var/lib/mysql/** rwk, # Allow mysqld_safe to access its run directory /run/mysqld/ r, /run/mysqld/** rw, # Allow mysqld_safe to write to its log files /var/log/mysql/ r, /var/log/mysql/** rw, # Allow mysqld_safe to access tmp directories /tmp/ r, /tmp/** rw, /var/tmp/** rw, # Allow mysqld_safe to read system libraries /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /usr/lib/** mr, /usr/lib/mysql/plugin/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, /usr/share/mysql/** r, /usr/share/zoneinfo/** r, # Allow mysqld_safe to access /proc and /sys for necessary information /proc/** r, /sys/** r, # Allow mysqld_safe to use /dev/shm for temporary storage /dev/shm/** rw, /dev/shm/ r, # Allow execution of mysqld_safe /usr/bin/mysqld_safe mrix, # Allow execution of the mysql binary /usr/bin/mysql mrix, # Allow execution of the mysqld binary /usr/sbin/mysqld mrix, # Allow execution of necessary utilities /bin/** mrix, /usr/bin/** mrix, /usr/sbin/** mrix, # Allow reading necessary directories /bin/ r, /usr/bin/ r, /usr/sbin/ r, # Catchall to deny everything else #deny /** rwklx, # Site-specific additions and overrides can be added below } ================================================ FILE: aegir/conf/apparmor/usr.bin.newrelic-daemon ================================================ # AppArmor profile for New Relic # This profile restricts the New Relic (newrelic-daemon) to essential operations only. #include /usr/bin/newrelic-daemon flags=(complain) { # Include common AppArmor abstractions include include # Capabilities needed by New Relic capability net_admin, capability setgid, capability setuid, network inet stream, network inet dgram, network inet6 stream, network inet6 dgram, # Allow execution of the newrelic-daemon binary /usr/bin/newrelic-daemon mrix, # Allow newrelic-daemon to read its configuration files /etc/newrelic/** r, # Allow newrelic-daemon to read system libraries /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /usr/lib/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/lib64/** mr, /usr/local/include/** mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, # Allow newrelic-daemon to access /proc for necessary information /proc/** r, # Allow newrelic-daemon to access log files /var/log/newrelic/** rw, # Allow newrelic-daemon to use tmp files /tmp/ r, /tmp/** rw, /var/tmp/** rw, # Allow newrelic-daemon to access run directory /run/newrelic/** rw, # Allow newrelic-daemon to access shared memory /dev/shm/** rw, /dev/shm/ r, # Disallow execution of binaries from /tmp and /var/tmp deny /tmp/** m, deny /var/tmp/** m, # Deny access to various sensitive directories deny /boot/** mrwklx, deny /opt/** mrwklx, deny /root/** mrwklx, # Catchall to deny everything else #deny /** rwklx, # Site-specific additions and overrides can be added below } ================================================ FILE: aegir/conf/apparmor/usr.bin.node ================================================ # AppArmor profile for Node/NPM # This profile restricts Limited Shell (lshell) to essential operations only. #include /usr/bin/node flags=(complain) { # Include common AppArmor abstractions include include # Capability permissions capability ipc_lock, capability sys_resource, # Network access network inet, # Allow read access to necessary libraries /etc/ssl/openssl.cnf r, /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /usr/lib/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/libexec/** mr, /usr/local/include/** mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, # Allow reading of environment variables /proc/** r, /sys/** r, # Specific file permissions owner /home/*/.npmrc r, # Temporary files and directories owner /home/*/.tmp/ r, owner /home/*/.tmp/** rw, # Miscellaneous /dev/urandom rw, /dev/null rw, /dev/tty rw, # Deny execution of any shell or command not explicitly allowed deny /bin/bash x, deny /bin/dash x, deny /bin/websh x, deny /usr/bin/perl x, deny /usr/bin/python* x, deny /usr/local/bin/ruby x, # Deny certain capabilities deny capability sys_chroot, # Deny changing root deny capability sys_admin, # Deny various system admin privileges deny capability setuid, # Deny changing user IDs deny capability setgid, # Deny changing group IDs deny capability kill, # Deny sending signals to arbitrary processes # Deny execution of binaries from these directories deny /home/*/.tmp/** m, deny /home/*/** m, deny /tmp/** m, deny /var/tmp/** m, # Allow execution of npm etc /usr/bin/node mrix, /usr/bin/npm mrix, /opt/user/npm/*/ r, /opt/user/npm/*/** mrix, # Allow to read and write in the custom web root directories /data/disk/*/distro/** r, /data/disk/*/platforms/** r, /data/disk/*/static/** r, owner /data/disk/*/distro/** rw, owner /data/disk/*/platforms/** rw, owner /data/disk/*/static/** rw, # Deny access to various sensitive directories and files deny /boot/** mrwklx, deny /root/** mrwklx, deny /etc/shadow* rwlx, deny /etc/passwd* rwlx, # Catchall to deny everything else #deny /** rwklx, # Site-specific additions and overrides can be added below } ================================================ FILE: aegir/conf/apparmor/usr.bin.redis-server ================================================ # AppArmor profile for Redis server # This profile restricts the Redis server (redis-server) to essential operations only. #include /usr/bin/redis-server flags=(complain) { # Include common AppArmor abstractions include include include # Allow Redis to accept signal from PHP-CLI processes signal (receive) peer=/opt/php*/bin/php, # Allow reading necessary kernel parameters /proc/sys/** r, /sys/devices/** r, /sys/kernel/** r, # Allow execution of redis-server binary /usr/bin/redis-server mrix, # Allow Redis to read its configuration file /etc/redis/redis.conf r, # Allow Redis to read and write its data files /var/lib/redis/** rwk, # Allow Redis to read and write its log files /var/log/redis/** rw, # Allow Redis to open TCP sockets on any address network inet stream, # Allow Redis to use syslog /dev/log w, /usr/bin/logger ixr, # Allow Redis to read system libraries /lib/** mr, /lib64/** mr, /usr/lib/** mr, /usr/local/sbin/* mrix, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, # Allow Redis to use /run for pid/sock files /run/redis/** rw, # Allow Redis to use tmp files /tmp/ r, /tmp/** rw, owner /proc/*/smaps r, owner /proc/*/stat r, owner /var/lib/redis/ r, owner /var/lib/redis/dump.rdb rw, owner /var/lib/redis/temp-*.rdb rw, owner /var/log/redis/redis-server.log rw, # Catchall to deny everything else #deny /** rwklx, } ================================================ FILE: aegir/conf/apparmor/usr.bin.valkey-server ================================================ # AppArmor profile for Valkey server # This profile restricts the Valkey server (valkey-server) to essential operations only. #include /usr/bin/valkey-server flags=(complain) { # Include common AppArmor abstractions include include include # Allow Valkey to accept signal from PHP-CLI processes signal (receive) peer=/opt/php*/bin/php, # Allow reading necessary kernel parameters /proc/sys/** r, /sys/devices/** r, /sys/kernel/** r, # Allow execution of valkey-server binary /usr/bin/valkey-server mrix, # Allow Valkey to read its configuration file /etc/valkey/valkey.conf r, # Allow Valkey to read and write its data files /var/lib/valkey/** rwk, # Allow Valkey to read and write its log files /var/log/valkey/** rw, # Allow Valkey to open TCP sockets on any address network inet stream, # Allow Valkey to use syslog /dev/log w, /usr/bin/logger ixr, # Allow Valkey to read system libraries /lib/** mr, /lib64/** mr, /usr/lib/** mr, /usr/local/sbin/* mrix, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, # Allow Valkey to use /run for pid/sock files /run/valkey/** rw, # Allow Valkey to use tmp files /tmp/ r, /tmp/** rw, owner /proc/*/smaps r, owner /proc/*/stat r, owner /var/lib/valkey/ r, owner /var/lib/valkey/dump.rdb rw, owner /var/lib/valkey/temp-*.rdb rw, owner /var/log/valkey/valkey-server.log rw, # Catchall to deny everything else #deny /** rwklx, } ================================================ FILE: aegir/conf/apparmor/usr.local.bin.lshell ================================================ # AppArmor profile for Limited Shell # This profile restricts Limited Shell (lshell) to essential operations only. #include /usr/local/bin/lshell flags=(complain) { # Include common AppArmor abstractions include include include include include include include include # Read access to its own config and logs /etc/ssh/sftp_config r, /etc/lshell.conf r, /var/log/lsh/ r, /var/log/lsh/* rw, /opt/php*/lib/php.ini r, # Allow read access to necessary libraries /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /opt/php*/lib/php/** mr, /usr/lib/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/libexec/** mr, /usr/local/include/** mr, /usr/local/ioncube/ioncube_loader_lin_*.so mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, # Allow Limited Shell to access /proc and /sys for necessary information /proc/ r, /proc/** r, /sys/ r, /sys/** r, # Read/write access to user home /home/*/ r, /home/*/** rw, # Read/write access to SSH client files /home/*/.ssh/ r, /home/*/.ssh/** rw, # Read-only access to Drush aliases and php.ini files /home/*/.drush/ r, /home/*/.drush/** r, # Drush access /opt/tools/drush/** mrix, /usr/local/bin/cv.phar mrix, # Read-only access to Octopus directories /data/disk/*/.drush/ r, /data/disk/*/.drush/** r, /data/disk/*/backups/ r, /data/disk/*/backups/** r, /data/disk/*/clients/ r, /data/disk/*/clients/** r, /data/disk/*/distro/** r, /data/disk/*/static/ r, /data/disk/*/static/** r, # Allow write access to Octopus user directories and files owner /data/disk/*/distro/** rw, owner /data/disk/*/static/ r, owner /data/disk/*/static/** rw, owner /opt/user/npm/*/** rw, owner /opt/user/gems/*/** rw, owner /opt/user/gems/*/bin/** k, # Read/write access to Drush cache /home/*/.drush/cache/ r, /home/*/.drush/cache/** rw, # Deny access to critical system files deny /etc/shadow* rwlx, # Allow read access to user information files /etc/passwd r, /etc/group r, /etc/nsswitch.conf r, /etc/hosts r, # Allow read-only access to resolv.conf for DNS resolution /etc/resolv.conf r, # Temporary files and directories /home/*/.tmp/ r, /home/*/.tmp/** rw, # Deny execution of any shell or command not explicitly allowed deny /bin/bash x, deny /usr/bin/perl x, # Allow execution of necessary binaries /bin/dash mrix, /opt/local/bin/websh mrix, /usr/bin/mysecureshell mrix, /usr/bin/python* mrix, /usr/local/bin/lshell mrix, # Additional binaries allowed in Limited Shell /bin/bzip2 mrix, /bin/cat mrix, /bin/chmod mrix, /bin/cp mrix, /bin/echo mrix, /bin/egrep mrix, /bin/grep mrix, /bin/gunzip mrix, /bin/gzip mrix, /bin/ls mrix, /bin/mkdir mrix, /bin/mv mrix, /bin/nano mrix, /bin/ping mrix, /bin/pwd mrix, /bin/rm mrix, /bin/rmdir mrix, /bin/sed mrix, /bin/stty mrix, /bin/tar mrix, /bin/touch mrix, /bin/true mrix, /data/disk/*/tools/drush/drush.php mrix, /opt/local/bin/mybackup mrix, /opt/local/bin/sqlmagic mrix, /opt/php*/bin/php mrix, /usr/bin/diff mrix, /usr/bin/du mrix, /usr/bin/env mrix, /usr/bin/find mrix, /usr/bin/id mrix, /usr/bin/mysql mrix, /usr/bin/mysqldump mrix, /usr/bin/node mrix, /usr/bin/openssl mrix, /usr/bin/passwd mrix, /usr/bin/patch mrix, /usr/bin/rsync mrix, /usr/bin/rvim mrix, /usr/bin/tput mrix, /usr/bin/unzip mrix, /usr/bin/wget mrix, /usr/bin/which.debianutils mrix, /usr/bin/zstd mrix, /usr/lib/node_modules/npm/bin/** mrix, /usr/local/bin/composer mrix, /usr/local/bin/curl mrix, /usr/local/bin/gem mrix, /usr/local/bin/git mrix, /usr/local/bin/git-receive-pack mrix, /usr/local/bin/git-upload-archive mrix, /usr/local/bin/git-upload-pack mrix, /usr/local/bin/mydumper mrix, /usr/local/bin/myloader mrix, /usr/local/bin/scp mrix, /usr/local/bin/sftp mrix, /usr/local/bin/ssh mrix, /usr/local/bin/ssh-keygen mrix, owner /opt/user/gems/*/** mrix, owner /opt/user/npm/*/** mrix, # Deny execution of any other binaries #deny /** rwklx, } ================================================ FILE: aegir/conf/apparmor/usr.local.bin.ssh ================================================ # AppArmor profile for SSH client # This profile restricts the SSH client (ssh) to essential operations only. #include /usr/local/bin/ssh flags=(complain) { # Include common AppArmor abstractions include include include include include include include include # Allow execution of the ssh binary /usr/local/bin/ssh mrix, # Allow read access to necessary libraries /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /usr/lib/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/libexec/** mr, /usr/local/include/** mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, # Read access to SSH client configuration files /etc/ssh/ssh_config r, /etc/ssh/ssh_known_hosts r, /home/*/.ssh/** rw, # Allow network access for making outbound connections network inet stream, network inet6 stream, # Deny access to critical system files deny /etc/shadow* rwlx, # Allow read access to user information files /etc/passwd r, /etc/group r, /etc/nsswitch.conf r, /etc/hosts r, # Allow read-only access to resolv.conf for DNS resolution /etc/resolv.conf r, # Temporary files and directories /tmp/ r, /tmp/** rw, /var/tmp/** rw, # Allow execution of necessary binaries /bin/dash mrix, /bin/sh mrix, /opt/local/bin/websh mrix, /usr/bin/id mrix, /usr/bin/mysecureshell mrix, /usr/local/bin/lshell mrix, /usr/local/bin/ssh-agent mrix, # Additional binaries used by SSH (e.g., scp, sftp) /usr/local/bin/scp mrix, /usr/local/bin/sftp mrix, # Deny execution of any other binaries #deny /** rwklx, } ================================================ FILE: aegir/conf/apparmor/usr.local.bin.wkhtmltoimage ================================================ # File: /etc/apparmor.d/usr.local.bin.wkhtmltoimage # Template from https://wkhtmltopdf.org/apparmor.html #include /usr/local/bin/wkhtmltoimage flags=(complain) { # Include common AppArmor abstractions include include include # Deny capability sys_ptrace deny capability sys_ptrace, # System paths wkhtmltoimage needs to operate /proc/*/maps r, /usr/local/bin/wkhtmltoimage mrix, /var/cache/fontconfig/* r, /tmp/** rwlk, # Allow read access to necessary libraries /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /usr/lib/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/libexec/** mr, /usr/local/include/** mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, # Allow to read and write in the web root directories /var/www/** r, /data/disk/*/aegir/** r, /data/disk/*/distro/** r, /data/disk/*/platforms/** r, /data/disk/*/static/** r, owner /data/disk/*/distro/** rwk, owner /data/disk/*/platforms/** rwk, owner /data/disk/*/static/** rwk, owner /var/www/** rwk, /home/*.web/.aws/ r, /home/*.web/.aws/* rw, /home/*.web/.drush/ r, /home/*.web/.drush/* r, /home/*.web/.tmp/ r, /home/*.web/.tmp/* rw, # Catchall to deny everything else #deny /** rwklx, } ================================================ FILE: aegir/conf/apparmor/usr.local.bin.wkhtmltopdf ================================================ # File: /etc/apparmor.d/usr.local.bin.wkhtmltopdf # Template from https://wkhtmltopdf.org/apparmor.html #include /usr/local/bin/wkhtmltopdf flags=(complain) { # Include common AppArmor abstractions include include include # Deny capability sys_ptrace deny capability sys_ptrace, # System paths wkhtmltopdf needs to operate /proc/*/maps r, /usr/local/bin/wkhtmltopdf mrix, /var/cache/fontconfig/* r, /tmp/** rwlk, # Allow read access to necessary libraries /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /usr/lib/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/libexec/** mr, /usr/local/include/** mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, # Allow to read and write in the web root directories /var/www/** r, /data/disk/*/aegir/** r, /data/disk/*/distro/** r, /data/disk/*/platforms/** r, /data/disk/*/static/** r, owner /data/disk/*/distro/** rwk, owner /data/disk/*/platforms/** rwk, owner /data/disk/*/static/** rwk, owner /var/www/** rwk, /home/*.web/.aws/ r, /home/*.web/.aws/* rw, /home/*.web/.drush/ r, /home/*.web/.drush/* r, /home/*.web/.tmp/ r, /home/*.web/.tmp/* rw, # Catchall to deny everything else #deny /** rwklx, } ================================================ FILE: aegir/conf/apparmor/usr.local.sbin.pure-ftpd ================================================ # AppArmor profile for Pure-FTPd server # This profile restricts Pure-FTPd server (pure-ftpd) to essential operations only. #include /usr/local/sbin/pure-ftpd flags=(complain) { # Include common AppArmor abstractions include include include include # Capabilities needed by Pure-FTPd server capability net_bind_service, capability setgid, capability setuid, capability mknod, network inet stream, network inet6 stream, # Allow Pure-FTPd to accept signal from PHP-CLI processes signal (receive) peer=/opt/php*/bin/php, # Allow execution of /bin/sh /bin/sh mrix, /opt/local/bin/websh mrix, # Allow access to /dev /dev/log w, /dev/urandom r, # Allow read access to system configuration and password files /etc/hostname r, /etc/hosts r, /etc/pure-ftpd.conf r, /etc/passwd r, /etc/group r, /etc/shadow r, # Allow read access to necessary libraries /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /usr/lib/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/libexec/** mr, /usr/local/include/** mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, # Allow read access to SSL certificates /etc/ssl/private/pure-ftpd.pem r, /etc/ssl/private/pure-ftpd-dhparams.pem r, # Allow reading necessary kernel parameters /proc/** r, /sys/** r, # Allow access to run directory /run/pure-ftpd.pid rw, /run/pure-ftpd/ r, /run/pure-ftpd/** rwk, # Allow access to temporary directories /tmp/ r, /tmp/** rw, /var/tmp/** rw, # Allow write access to log files /var/log/pureftpd.log rw, # Allow execution of the pure-ftpd binary and configuration script /usr/local/sbin/pure-ftpd mrix, /usr/local/sbin/pure-config.pl mrix, # Allow read access to Octopus user directories and files /data/disk/*/.drush/ r, /data/disk/*/.drush/** r, /data/disk/*/backups/ r, /data/disk/*/backups/** r, /data/disk/*/clients/ r, /data/disk/*/clients/** r, /data/disk/*/distro/** r, /data/disk/*/static/ r, /data/disk/*/static/** r, /home/*/.drush/ r, /home/*/.drush/** r, /opt/tools/drush/** r, # Allow write access to Octopus user directories and files owner /data/disk/*/distro/** rw, owner /data/disk/*/static/ r, owner /data/disk/*/static/** rw, owner /home/*/ r, owner /home/*/.drush/cache/ r, owner /home/*/.drush/cache/** rw, owner /home/*/** rw, # Catchall to deny everything else #deny /** rwklx, # Site-specific additions and overrides can be added below } ================================================ FILE: aegir/conf/apparmor/usr.local.sbin.sshd ================================================ # AppArmor profile for SSHd daemon # This profile restricts the SSHd daemon (sshd) to essential operations only. #include /usr/local/sbin/sshd flags=(complain) { # Include common AppArmor abstractions include include include include include include include include # Allow execution of the sshd binary /usr/local/sbin/sshd mrix, # Capabilities needed by SSHd daemon capability audit_control, capability audit_write, capability chown, capability dac_override, capability dac_read_search, capability fowner, capability fsetid, capability kill, capability net_bind_service, capability setgid, capability setuid, capability sys_admin, capability sys_chroot, capability sys_resource, capability sys_tty_config, network inet stream, network inet6 stream, # Allow read access to necessary libraries /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /usr/lib/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/libexec/** mr, /usr/local/include/** mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, # Read/Write access /dev/null rw, /dev/ptmx rw, /dev/pts/* rw, /dev/tty rw, /dev/urandom r, /proc/** rw, /run/** rwk, /sys/** r, /tmp/ r, /tmp/** rw, /var/** r, /var/lib/sshd/** rw, # Read/Write owner access owner /** rwk, owner /etc/group rw, owner /etc/motd rw, owner /etc/passwd rw, owner /etc/shadow rw, owner /etc/ssh/* rw, owner /proc/*/oom_score_adj rw, owner /root/** rw, owner /run/sshd.pid rw, # Exec access /{media,mnt,opt,srv}/** mrix, /bin/* mrix, /opt/local/bin/* mrix, /usr/bin/* mrix, /usr/local/bin/* mrix, /usr/local/sbin/* mrix, /usr/sbin/* mrix, # Read access to SSH daemon configuration files /etc/default/locale r, /etc/environment r, /etc/hosts.allow r, /etc/hosts.deny r, /etc/modules.conf r, /etc/security/** r, /etc/ssh/* r, /etc/ssl/openssl.cnf r, # Write access to the PID file /run/sshd.pid rw, # Allow network access for accepting inbound connections network inet stream, network inet6 stream, # Allow reading user home directories and authorized keys /home/*/*/ r, /home/*/*/.ssh/ r, /home/*/.ssh/authorized_keys{,2} r, # Temporary files and directories /tmp/ r, /tmp/** rw, /var/tmp/** rw, /dev/pts/[0-9]* rw, /etc/ssh/moduli r, @{PROC}/@{pid}/mounts r, /etc/motd r, /{,var/}run/motd{,.new} rw, /tmp/ssh-*/agent.[0-9]* rwl, /tmp/ssh-*[0-9]*/ w, # Allow execution of various shells /bin/ash rUx, /bin/bash rUx, /bin/bash2 rUx, /bin/bsh rUx, /bin/csh rUx, /bin/dash rUx, /bin/ksh rUx, /bin/sh rUx, /bin/tcsh rUx, /bin/zsh rUx, /bin/zsh4 rUx, /sbin/nologin rUx, /usr/bin/mysecureshell rUx, /usr/local/bin/lshell rUx, # Allow ptrace read access for necessary binaries ptrace read peer=unconfined, ptrace read peer=/opt/php*/bin/php, ptrace read peer=/opt/php*/sbin/php-fpm, ptrace read peer=/usr/bin/newrelic-daemon, ptrace read peer=/sbin/dhclient, ptrace read peer=/usr/bin/mysqld_safe, ptrace read peer=/usr/bin/mysqld, ptrace read peer=/usr/bin/redis-server, ptrace read peer=/usr/lib/jvm/java-11-openjdk-amd64/bin/java, ptrace read peer=/usr/lib/jvm/java-17-openjdk-amd64/bin/java, ptrace read peer=/usr/lib/jvm/java-21-openjdk-amd64/bin/java, ptrace read peer=/usr/lib/postfix/sbin/master, ptrace read peer=/usr/lib/postfix/sbin/pickup, ptrace read peer=/usr/lib/postfix/sbin/qmgr, ptrace read peer=/usr/local/sbin/pure-ftpd, ptrace read peer=/usr/sbin/nginx, ptrace read peer=/usr/sbin/unbound, ^EXEC flags=(complain) { # Include base abstractions include /bin/ash Ux, /bin/bash Ux, /bin/bash2 Ux, /bin/bsh Ux, /bin/csh Ux, /bin/dash Ux, /bin/ksh Ux, /bin/sh Ux, /bin/tcsh Ux, /bin/zsh Ux, /bin/zsh4 Ux, /sbin/nologin Ux, /usr/bin/mysecureshell Ux, /usr/local/bin/lshell Ux, } ^PRIVSEP flags=(complain) { # Include base and nameservice abstractions include include capability sys_chroot, capability setuid, capability setgid, } ^PRIVSEP_MONITOR flags=(complain) { # Include authentication, base, nameservice, and wutmp abstractions include include include include capability setuid, capability setgid, capability chown, /home/*/.ssh/authorized_keys{,2} r, /dev/ptmx rw, /dev/pts/[0-9]* rw, /dev/urandom r, /etc/hosts.allow r, /etc/hosts.deny r, /etc/ssh/moduli r, @{PROC}/@{pid}/mounts r, } ^AUTHENTICATED flags=(complain) { # Include authentication, consoles, nameservice, and wutmp abstractions include include include include capability sys_tty_config, capability setgid, capability setuid, /dev/log w, /dev/ptmx rw, /etc/default/passwd r, /etc/localtime r, /etc/writable/localtime r, /etc/login.defs r, /etc/motd r, /{,var/}run/motd{,.new} rw, /tmp/ssh-*/agent.[0-9]* rwl, /tmp/ssh-*[0-9]*/ w, } } ================================================ FILE: aegir/conf/apparmor/usr.sbin.clamd ================================================ # AppArmor profile for Clamd service # This profile restricts Clamd service (clamd) to essential operations only. #include /usr/sbin/clamd flags=(complain) { # Include common AppArmor abstractions include include include # Capabilities needed by Clamd service capability chown, capability dac_override, capability dac_read_search, capability setgid, capability setuid, capability sys_resource, network inet stream, network inet6 stream, network inet dgram, network inet6 dgram, # Allow execution of necessary shells and the clamd binary /bin/dash mrix, /bin/bash mrix, /bin/sh mrix, /usr/sbin/clamd mrix, # Allow access to /dev /dev/log w, /dev/null rw, /dev/random r, /dev/urandom r, # Allow access to /proc and /sys for necessary information /proc/** r, /sys/** r, # Allow access to temporary directories /tmp/ r, /tmp/** rw, /var/tmp/** rw, # Allow read access to necessary libraries /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /usr/lib/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/libexec/** mr, /usr/local/include/** mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, # Allow access to ClamAV configuration and data /etc/clamav/clamd.conf r, /var/lib/amavis/tmp/** r, /var/lib/clamav/ r, /var/lib/clamav/** rwk, /var/log/clamav/* rwk, /var/spool/MIMEDefang/mdefang-*/Work/ r, /var/spool/MIMEDefang/mdefang-*/Work/** r, /var/spool/clamsmtp/* r, /var/spool/exim4/** r, /var/spool/havp/** r, /var/spool/p3scan/children/** r, /var/spool/qpsmtpd/* r, /{,var/}run/clamav/clamd.ctl w, /{,var/}run/clamav/clamd.pid w, # Allow read access to user directories /data/all/** r, /data/conf/* r, /data/disk/*/distro/** r, /data/disk/*/platforms/** r, /data/disk/*/static/** r, /home/*/ r, /home/*/** r, # Allow reading filesystems information @{PROC}/[0-9]*/status r, @{PROC}/filesystems r, # Deny access to sensitive files and directories deny /etc/shadow* rwlx, deny /etc/passwd* rwlx, deny /root/** rwklx, # Catchall to deny everything else #deny /** rwklx, # Site-specific additions and overrides can be added below } ================================================ FILE: aegir/conf/apparmor/usr.sbin.mysqld ================================================ # AppArmor profile for MySQLd server # This profile restricts MySQLd server (mysqld) to essential operations only. #include /usr/sbin/mysqld flags=(complain) { # Include common AppArmor abstractions include include include # Capabilities needed by MySQLd server capability dac_override, capability dac_read_search, capability sys_resource, capability setgid, capability setuid, capability sys_nice, network inet stream, network inet6 stream, # Allow execution of mysqld_safe /usr/bin/mysqld_safe mrix, # Allow execution of the mysql binary /usr/bin/mysql mrix, # Allow execution of the mysqld binary /usr/sbin/mysqld mrix, # Allow execution of necessary utilities /bin/** mrix, /usr/bin/** mrix, /usr/sbin/** mrix, # Allow reading necessary directories /bin/ r, /usr/bin/ r, /usr/sbin/ r, # Allow MySQL to read its configuration files /etc/mysql/** r, /etc/mysql/conf.d/** r, /etc/mysql/mysql.conf.d/** r, # Allow MySQL to access its data directory /var/lib/mysql/ rwk, /var/lib/mysql/** rwk, # Allow MySQL to access its run directory /run/mysqld/ r, /run/mysqld/** rw, # Allow MySQL to write to its log files /var/log/mysql/ r, /var/log/mysql/** rw, # Allow MySQL to access its tmp directories /tmp/ r, /tmp/** rw, /var/tmp/** rw, # Allow MySQL to read system libraries /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /usr/lib/** mr, /usr/lib/mysql/plugin/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, /usr/share/mysql/** r, /usr/share/zoneinfo/** r, # Allow MySQL to access /proc and /sys for necessary information /proc/** r, /sys/** r, # Allow MySQL to use /dev/shm for temporary storage /dev/shm/** rw, /dev/shm/ r, # Allow MySQL to read network-related configurations /etc/hosts.allow r, /etc/hosts.deny r, /etc/services r, # Disallow execution of binaries from /tmp and /var/tmp deny /tmp/** m, deny /var/tmp/** m, # Deny access to various sensitive directories deny /boot/** mrwklx, deny /root/** mrwklx, # Catchall to deny everything else #deny /** rwklx, # Site-specific additions and overrides can be added below } ================================================ FILE: aegir/conf/apparmor/usr.sbin.nginx ================================================ # AppArmor profile for Nginx server # This profile restricts Nginx server (nginx) to essential operations only. #include /usr/sbin/nginx flags=(complain) { # Include common AppArmor abstractions include include include include include include # Capabilities needed by Nginx server capability dac_override, capability dac_read_search, capability mknod, # Allow Nginx to accept signal from PHP-CLI processes signal (receive) peer=/opt/php*/bin/php, # Allow read access to necessary libraries /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /usr/lib/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/libexec/** mr, /usr/local/include/** mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, # Allow execution of the nginx binary /usr/sbin/nginx mrix, # Allow read/write access to nginx specific directories and files /etc/default/nginx r, /etc/nginx/ r, /etc/nginx/** r, /etc/nginx/conf.d/ r, /etc/nginx/conf.d/** r, /etc/nginx/fastcgi_params r, /etc/nginx/mime.types r, /etc/nginx/nginx.conf r, /etc/ssl/private/ r, /etc/ssl/private/* r, /etc/ssl/private/nginx-wild-ssl.crt r, /etc/ssl/private/nginx-wild-ssl.dhp r, /etc/ssl/private/nginx-wild-ssl.key r, /var/www/ r, /var/www/** r, # Specific directories used by Ægir (if applicable) /var/aegir/.drush/ r, /var/aegir/.drush/** r, /var/aegir/config/ r, /var/aegir/config/** r, /var/aegir/host_master/** r, /var/aegir/platforms/** r, /data/disk/*/aegir/** r, /data/disk/*/config/** r, /data/disk/*/distro/** r, /data/disk/*/platforms/** r, /data/disk/*/static/** r, /data/disk/*/tools/le/** r, # Additional specific directories /data/all/** r, /data/conf/ r, /data/conf/* r, # Other required directories and files /proc/sys/** r, /run/nginx.pid rw, /run/nginx.pid.oldbin rw, /usr/fastcgi_temp/ r, /usr/fastcgi_temp/** rw, /usr/share/GeoIP/GeoIP.dat r, /usr/share/GeoIP/GeoIPv6.dat r, /usr/share/GeoIP/GeoLite2-ASN.mmdb r, /usr/share/GeoIP/GeoLite2-City.mmdb r, /usr/share/GeoIP/GeoLite2-Country.mmdb r, /var/lib/nginx/ r, /var/lib/nginx/** rw, /var/log/nginx/ r, /var/log/nginx/access.log w, /var/log/nginx/error.log w, # Catchall to deny everything else #deny /** rwklx, } ================================================ FILE: aegir/conf/apparmor/usr.sbin.rsyslogd ================================================ # AppArmor profile for Rsyslogd service # This profile restricts Rsyslogd service (rsyslogd) to essential operations only. #include /usr/sbin/rsyslogd flags=(complain) { # Include common AppArmor abstractions include include include # Capabilities needed by Rsyslogd service capability syslog, # Allow Rsyslogd to accept signal from PHP-CLI processes signal (receive) peer=/opt/php*/bin/php, # Allow execution of the rsyslogd binary /usr/sbin/rsyslogd mrix, # Allow read access to necessary libraries /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /usr/lib/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/libexec/** mr, /usr/local/include/** mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, # Allow read access to system configuration files /etc/rsyslog.conf r, /etc/rsyslog.d/ r, /etc/rsyslog.d/** r, /etc/localtime r, /etc/ssl/certs/** r, # Allow read and write access to the log directories and files /var/log/** rwk, /var/spool/rsyslog/** rw, /var/spool/postfix/** rw, # Allow network access network inet stream, network inet dgram, # Allow access to pid files /run/rsyslogd.pid rw, /run/rsyslogd.pid.tmp rw, # Capabilities needed by Rsyslogd service capability net_bind_service, capability setuid, capability setgid, capability chown, capability dac_override, # Allow reading necessary kernel parameters /proc/sys/kernel/random/uuid r, /proc/cpuinfo r, /proc/meminfo r, /proc/kmsg r, /proc/stat r, # Allow access to /dev for logging /dev/log w, /dev/kmsg w, # Catchall to deny everything else #deny /** rwklx, } ================================================ FILE: aegir/conf/apparmor/usr.sbin.unbound ================================================ # AppArmor profile for Unbound server # This profile restricts Unbound server (unbound) to essential operations only. #include /usr/sbin/unbound flags=(complain) { # Include common AppArmor abstractions include include include include # Capabilities needed by Unbound server capability chown, capability fowner, capability fsetid, capability kill, capability net_bind_service, capability setgid, capability setuid, capability sys_chroot, capability sys_resource, capability net_admin, capability dac_override, # Allow to open TCP sockets on any address network inet stream, network inet6 stream, # Allow Unbound to accept signal from PHP-CLI processes signal (receive) peer=/opt/php*/bin/php, # Allow read access to necessary libraries /lib/** mr, /lib/x86_64-linux-gnu/** mr, /lib64/** mr, /usr/lib/** mr, /usr/lib/x86_64-linux-gnu/** mr, /usr/libexec/** mr, /usr/local/include/** mr, /usr/local/lib/** mr, /usr/local/ssl/** mr, /usr/local/ssl3/** mr, # Allow Unbound to access some /dev /dev/log w, /dev/random r, /dev/urandom r, # Allow Unbound to access tmp directories /tmp/ r, /tmp/** rw, /var/tmp/** rw, # Access root hints from dns-data-root /usr/share/dns/root.* r, # Unbound configuration paths /etc/unbound/ r, /etc/unbound/** r, /usr/etc/unbound/ r, /usr/etc/unbound/** r, /var/lib/unbound/ r, /var/lib/unbound/** r, # Unbound logs /var/log/unbound/ r, /var/log/unbound/** rw, # Unbound keys (if write access is needed) /usr/etc/unbound/keys/** rw, # Allow Unbound to execute its own binary /usr/sbin/unbound mrix, # Allow Unbound to access its pid and control socket /run/unbound.ctl rw, /run/unbound.pid rw, /run/unbound/ r, /run/unbound/** r, /run/unbound/unbound.ctl rw, /run/unbound/unbound.pid rw, } ================================================ FILE: aegir/conf/dns/unbound ================================================ #!/bin/dash ### BEGIN INIT INFO # Provides: unbound # Required-Start: $network $remote_fs $syslog # Required-Stop: $network $remote_fs $syslog # Default-Start: 2 3 4 5 # Default-Stop: 0 1 6 # Short-Description: Validating, recursive, and caching DNS resolver ### END INIT INFO NAME="unbound" DESC="DNS server" DAEMON="/usr/sbin/unbound" PIDFILE="/run/unbound/unbound.pid" HELPER="/usr/libexec/unbound-helper" test -x $DAEMON || exit 0 export PATH=/usr/local/bin:/usr/local/sbin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin:/usr/libexec . /lib/lsb/init-functions # Override this variable by editing or creating /etc/default/unbound. DAEMON_OPTS="" [ -d /run/unbound ] || mkdir -p /run/unbound [ -d /run/unbound ] && chown -R unbound:unbound /run/unbound if [ -f /etc/default/unbound ]; then . /etc/default/unbound fi # --- BEGIN CI NoMail hook --- apply_ci_nomail() { if [ "${UNBOUND_CI_NOMAIL:-NO}" = "YES" ] && [ -x /usr/local/sbin/unbound_ci_nomail.sh ]; then /usr/bin/env _LOCAL_ZONE_TYPE="${UNBOUND_CI_NOMAIL_TYPE:-always_nxdomain}" \ /usr/local/sbin/unbound_ci_nomail.sh fi } # --- END CI NoMail hook --- case "$1" in start) log_daemon_msg "Starting $DESC" "$NAME" $HELPER chroot_setup $HELPER root_trust_anchor_update 2>&1 | tee /dev/fd/2 | logger -p daemon.info -t unbound if start-stop-daemon --start --quiet --oknodo --pidfile $PIDFILE --name $NAME --startas $DAEMON -- $DAEMON_OPTS; then $HELPER resolvconf_start apply_ci_nomail log_end_msg 0 else log_end_msg 1 fi ;; stop) log_daemon_msg "Stopping $DESC" "$NAME" if start-stop-daemon --stop --quiet --oknodo --remove-pidfile --pidfile $PIDFILE --name $NAME --retry 5; then $HELPER resolvconf_stop $HELPER chroot_teardown log_end_msg 0 else log_end_msg 1 fi ;; restart|force-reload) log_daemon_msg "Restarting $DESC" "$NAME" start-stop-daemon --stop --quiet --remove-pidfile --pidfile $PIDFILE --name $NAME --retry 5 $HELPER resolvconf_stop if start-stop-daemon --start --quiet --oknodo --pidfile $PIDFILE --name $NAME --startas $DAEMON -- $DAEMON_OPTS; then $HELPER chroot_setup $HELPER resolvconf_start apply_ci_nomail log_end_msg 0 else log_end_msg 1 fi ;; reload) log_daemon_msg "Reloading $DESC" "$NAME" if start-stop-daemon --stop --pidfile $PIDFILE --name $NAME --signal 1; then $HELPER chroot_setup apply_ci_nomail log_end_msg 0 else log_end_msg 1 fi ;; status) status_of_proc -p $PIDFILE $DAEMON $NAME && exit 0 || exit $? ;; *) N=/etc/init.d/$NAME echo "Usage: $N {start|stop|restart|status|reload|force-reload}" >&2 exit 1 ;; esac exit 0 ================================================ FILE: aegir/conf/dns/unbound-helper ================================================ #!/bin/dash -e UNBOUND_CONF="/etc/unbound/unbound.conf" UNBOUND_BASE_DIR="${UNBOUND_CONF%/*}" CHROOT_DIR="$(unbound-checkconf -o chroot)" DNS_ROOT_KEY_FILE="/usr/share/dns/root.key" ROOT_TRUST_ANCHOR_FILE="/var/lib/unbound/root.key" # Override these variables by editing or creating /etc/default/unbound. RESOLVCONF=true ROOT_TRUST_ANCHOR_UPDATE=true if [ -f /etc/default/unbound ]; then . /etc/default/unbound case "$RESOLVCONF" in false|0|no) RESOLVCONF=false ;; esac case "$ROOT_TRUST_ANCHOR_UPDATE" in false|0|no) ROOT_TRUST_ANCHOR_UPDATE=false ;; esac fi do_resolvconf_start() { [ false != "$RESOLVCONF" -a -x /sbin/resolvconf ] || return 0 unbound-checkconf $CHROOT_DIR/$UNBOUND_CONF -o interface | { default=yes while read interface; do default= # XXXX here, only localhost and all-zero addresses are handled # in case some other IP is specified it will not work case "$interface" in ( 0.0.0.0 | 127.0.0.1 ) echo "nameserver 127.0.0.1" ;; ( ::0 | ::1 ) echo "nameserver ::1" ;; esac done [ -z "$default" ] || # unbound defaults to listening on localhost echo "nameserver 127.0.0.1" } | /sbin/resolvconf -a lo.unbound } do_resolvconf_stop() { [ false != "$RESOLVCONF" -a -x /sbin/resolvconf ] || return 0 /sbin/resolvconf -d lo.unbound } do_chroot_setup() { [ -n "$CHROOT_DIR" -a -d "$CHROOT_DIR" ] || return 0 if [ "$CHROOT_DIR" != "$UNBOUND_BASE_DIR" ]; then # we probably should not do the force-recreate but just a refresh rm -rf "$CHROOT_DIR/$UNBOUND_BASE_DIR" mkdir -p "$CHROOT_DIR/$UNBOUND_BASE_DIR" tar -C "$UNBOUND_BASE_DIR" -c . | tar -C "$CHROOT_DIR/$UNBOUND_BASE_DIR" -x fi if [ -S "/run/systemd/notify" ]; then if [ ! -e "$CHROOT_DIR/run/systemd/notify" ]; then mkdir -p "$CHROOT_DIR/run/systemd" touch "$CHROOT_DIR/run/systemd/notify" fi if ! mountpoint -q "$CHROOT_DIR/run/systemd/notify"; then mount --bind "/run/systemd/notify" "$CHROOT_DIR/run/systemd/notify" fi fi } do_chroot_teardown() { if [ -n "$CHROOT_DIR" -a -d "$CHROOT_DIR" ] && mountpoint -q "$CHROOT_DIR/run/systemd/notify"; then umount "$CHROOT_DIR/run/systemd/notify" fi } do_root_trust_anchor_update() { [ false != "$ROOT_TRUST_ANCHOR_UPDATE" -a \ -n "$ROOT_TRUST_ANCHOR_FILE" -a \ -r "$DNS_ROOT_KEY_FILE" ] || return if [ ! -e "$ROOT_TRUST_ANCHOR_FILE" ] || # we do not want to copy if unbound's file is more recent [ "$DNS_ROOT_KEY_FILE" -nt "$ROOT_TRUST_ANCHOR_FILE" ]; then echo "Updating $ROOT_TRUST_ANCHOR_FILE from $DNS_ROOT_KEY_FILE" # Copy to temp first and do mv only when done to ensure the file is in # good condition. Can use install(1) here to set correct owner but need # mv anyway, and doing both as root in an untrusted dir seems risky. setpriv --reuid=unbound --regid=unbound --clear-groups \ sh -c "\ cp --remove-destination --preserve \ \"$DNS_ROOT_KEY_FILE\" \"$ROOT_TRUST_ANCHOR_FILE.tmp\" && \ mv -f \"$ROOT_TRUST_ANCHOR_FILE.tmp\" \"$ROOT_TRUST_ANCHOR_FILE\"" fi } case "$1" in ( resolvconf_start \ | resolvconf_stop \ | chroot_setup \ | chroot_teardown \ | root_trust_anchor_update \ ) do_$1 ;; (*) echo "Usage: $0 {resolvconf_start|resolvconf_stop|chroot_setup|chroot_teardown|root_trust_anchor_update}" >&2 exit 1 ;; esac ================================================ FILE: aegir/conf/dns/unbound.conf ================================================ ### ### /etc/unbound/unbound.conf.d/unbound.conf ### server: # Log use-syslog: no logfile: "/var/log/unbound/unbound.log" log-time-ascii: yes verbosity: 1 # Pid pidfile: "/run/unbound/unbound.pid" # Listen interface: 127.0.0.1 port: 53 do-tcp: yes do-ip4: yes do-udp: yes do-ip6: no prefer-ip6: no # Performance settings num-threads: 2 so-rcvbuf: 1m so-sndbuf: 1m # Access control access-control: 127.0.0.0/8 allow access-control: ::1 allow access-control: 192.168.1.0/24 allow # DNSSEC configuration val-log-level: 2 val-permissive-mode: no val-clean-additional: yes harden-dnssec-stripped: yes harden-below-nxdomain: yes harden-glue: yes # Prevent DNS rebinding attacks private-address: 192.168.0.0/16 private-address: 172.16.0.0/12 private-address: 10.0.0.0/8 private-address: fd00::/8 private-address: fe80::/10 # Prefetching and caching prefetch: yes prefetch-key: yes cache-max-ttl: 14400 cache-min-ttl: 900 edns-buffer-size: 1232 # TLS and DNS-over-TLS configuration (if needed) tls-cert-bundle: "/etc/ssl/certs/ca-certificates.crt" tls-port: 853 tls-service-key: "/etc/unbound/unbound_server.key" tls-service-pem: "/etc/unbound/unbound_server.pem" # Misc chroot: "" hide-identity: yes hide-version: yes minimal-responses: yes qname-minimisation: yes rrset-roundrobin: yes root-hints: "/var/lib/unbound/root.hints" auto-trust-anchor-file: "/var/lib/unbound/root.key" use-caps-for-id: no remote-control: # Enable the control interface control-enable: yes # Define control interface control-interface: /run/unbound/unbound.ctl # Specify server key and certificate server-key-file: "/etc/unbound/unbound_control.key" server-cert-file: "/etc/unbound/unbound_control.pem" # Specify control key and certificate control-key-file: "/etc/unbound/unbound_control.key" control-cert-file: "/etc/unbound/unbound_control.pem" include-toplevel: "/usr/etc/unbound/unbound.conf.d/*.conf" ================================================ FILE: aegir/conf/droplet/droplet-agent ================================================ #!/usr/bin/env bash ### BEGIN INIT INFO # Provides: droplet-agent # Required-Start: $remote_fs $syslog $network # Required-Stop: $remote_fs $syslog $network # Default-Start: 2 3 4 5 # Default-Stop: 0 1 6 # Short-Description: DigitalOcean Droplet Agent ### END INIT INFO _PATHS="/usr/bin/droplet-agent /usr/local/bin/droplet-agent /opt/digitalocean/bin/droplet-agent /opt/digitalocean/droplet-agent/droplet-agent" _DAEMON="" _NAME="droplet-agent" _DESC="DigitalOcean Droplet Agent" _PIDFILE="/run/${_NAME}.pid" _USER="root" _NICE="0" _for_each_path() { for _P in ${_PATHS}; do if [ -x "${_P}" ]; then _DAEMON="${_P}"; return 0; fi done return 1 } _do_start() { if [ -z "${_DAEMON}" ] && ! _for_each_path; then echo "${_DESC}: binary not found"; return 1 fi start-stop-daemon --start --quiet --background \ --make-pidfile --pidfile "${_PIDFILE}" \ --chuid "${_USER}" --nicelevel "${_NICE}" \ --exec "${_DAEMON}" -- || return 1 return 0 } _do_stop() { if [ -f "${_PIDFILE}" ]; then start-stop-daemon --stop --quiet --pidfile "${_PIDFILE}" --retry=TERM/15/KILL/5 rm -f "${_PIDFILE}" 2>/dev/null || true return 0 fi pkill -f "${_NAME}" 2>/dev/null || true return 0 } _do_status() { if [ -f "${_PIDFILE}" ] && ps -p "$(cat "${_PIDFILE}" 2>/dev/null)" >/dev/null 2>&1; then echo "${_DESC} is running (pid $(cat "${_PIDFILE}"))" return 0 fi pgrep -f "${_NAME}" >/dev/null 2>&1 && { echo "${_DESC} seems running (no pidfile)"; return 0; } echo "${_DESC} is not running" return 3 } case "$1" in start) _do_start ;; stop) _do_stop ;; restart) _do_stop; _do_start ;; status) _do_status ;; *) echo "Usage: $0 {start|stop|restart|status}"; exit 2 ;; esac ================================================ FILE: aegir/conf/etc/etc-ImageMagick-6-policy.xml ================================================ ]> ================================================ FILE: aegir/conf/ftpd/ftpusers ================================================ root daemon bin sys sync games man lp mail news uucp nobody ================================================ FILE: aegir/conf/ftpd/pure-config.pl.txt ================================================ #! /usr/bin/perl # (C) 2001-2009 Aristotle Pagaltzis # derived from code (C) 2001-2002 Frank Denis and Matthias Andree use strict; my ($conffile, @flg) = @ARGV; my $PUREFTPD; -x && ($PUREFTPD=$_, last) for qw( ${exec_prefix}/sbin/pure-ftpd /usr/local/pure-ftpd/sbin/pure-ftpd /usr/local/pureftpd/sbin/pure-ftpd /usr/local/sbin/pure-ftpd /usr/sbin/pure-ftpd /opt/sbin/pure-ftpd ); my %simple_switch_for = ( IPV4Only => "-4", IPV6Only => "-6", ChrootEveryone => "-A", BrokenClientsCompatibility => "-b", Daemonize => "-B", VerboseLog => "-d", DisplayDotFiles => "-D", AnonymousOnly => "-e", NoAnonymous => "-E", DontResolve => "-H", AnonymousCanCreateDirs => "-M", NATmode => "-N", CallUploadScript => "-o", AntiWarez => "-s", AllowUserFXP => "-w", AllowAnonymousFXP => "-W", ProhibitDotFilesWrite => "-x", ProhibitDotFilesRead => "-X", AllowDotFiles => "-z", AutoRename => "-r", AnonymousCantUpload => "-i", LogPID => "-1", NoChmod => "-R", KeepAllFiles => "-K", CreateHomeDir => "-j", NoRename => "-G", CustomerProof => "-Z", NoTruncate => "-0", ); my %string_switch_for = ( FileSystemCharset => "-8", ClientCharset => "-9", SyslogFacility => "-f", FortunesFile => "-F", ForcePassiveIP => "-P", Bind => "-S", AnonymousBandwidth => "-t", UserBandwidth => "-T", TrustedIP => "-V", AltLog => "-O", PIDFile => "-g", ); my %numeric_switch_for = ( MaxIdleTime => "-I", MaxDiskUsage => "-k", TrustedGID => "-a", MaxClientsNumber => "-c", MaxClientsPerIP => "-C", MaxLoad => "-m", MinUID => "-u", TLS => "-Y", ); my %numpairb_switch_for = ( LimitRecursion => "-L", PassivePortRange => "-p", AnonymousRatio => "-q", UserRatio => "-Q", ); my %numpairc_switch_for = ( Umask => "-U", Quota => "-n", PerUserLimits => "-y", ); my %auth_method_for = ( LDAPConfigFile => "ldap", MySQLConfigFile => "mysql", PGSQLConfigFile => "pgsql", PureDB => "puredb", ExtAuth => "extauth", ); my $simple_switch = qr/(@{[join "|", keys %simple_switch_for ]})\s+yes/i; my $string_switch = qr/(@{[join "|", keys %string_switch_for ]})\s+(\S+)/i; my $numeric_switch = qr/(@{[join "|", keys %numeric_switch_for ]})\s+(\d+)/i; my $numpairb_switch = qr/(@{[join "|", keys %numpairb_switch_for ]})\s+(\d+)\s+(\d+)/i; my $numpairc_switch = qr/(@{[join "|", keys %numpairc_switch_for ]})\s+(\d+):(\d+)/i; my $auth_method = qr/(@{[join "|", keys %auth_method_for ]})\s+(\S+)/i; die "Usage: pure-config.pl [extra options]\n" unless defined $conffile; open CONF, "< $conffile" or die "Can't open $conffile: $!\n"; !/^\s*(?:$|#)/ and (chomp, push @flg, /$simple_switch/i ? ($simple_switch_for{$1}) : /$string_switch/i ? ($string_switch_for{$1} . $2) : /$numeric_switch/i ? ($numeric_switch_for{$1} . $2) : /$numpairb_switch/i ? ($numpairb_switch_for{$1} . "$2:$3") : /$numpairc_switch/i ? ($numpairc_switch_for{$1} . "$2:$3") : /$auth_method/i ? ("-l" . "$auth_method_for{$1}:$2") : /UnixAuthentication\s+yes/i ? ("-l" . "unix") : /PAMAuthentication\s+yes/i ? ("-l" . "pam") : () ) while ; close CONF; print "Running: $PUREFTPD ", join(" ", @flg), "\n"; exec { $PUREFTPD } ($PUREFTPD, @flg) or die "cannot exec $PUREFTPD: $!"; ================================================ FILE: aegir/conf/ftpd/pure-ftpd.conf ================================================ ############################################################ # # # Configuration file for pure-ftpd # # # ############################################################ # If you want to run Pure-FTPd with this configuration # instead of command-line options, please run the # following command : # # ${exec_prefix}/sbin/sbin/pure-ftpd /etc/pure-ftpd.conf # # Online documentation: # https://www.pureftpd.org/project/pure-ftpd/doc # Restrict users to their home directory ChrootEveryone yes # If the previous option is set to "no", members of the following group # won't be restricted. Others will be. If you don't want chroot()ing anyone, # just comment out ChrootEveryone and TrustedGID. # TrustedGID 100 # Turn on compatibility hacks for broken clients BrokenClientsCompatibility yes # Maximum number of simultaneous users MaxClientsNumber 50 # Run as a background process Daemonize yes # Maximum number of simultaneous clients with the same IP address MaxClientsPerIP 8 # If you want to log all client commands, set this to "yes". # This directive can be specified twice to also log server responses. VerboseLog yes # List dot-files even when the client doesn't send "-a". DisplayDotFiles no # Disallow authenticated users - Act only as a public FTP server. AnonymousOnly no # Disallow anonymous connections. Only accept authenticated users. NoAnonymous yes # Syslog facility (auth, authpriv, daemon, ftp, security, user, local*) # The default facility is "ftp". "none" disables logging. SyslogFacility ftp # Display fortune cookies # FortunesFile /usr/share/fortune/zippy # Don't resolve host names in log files. Recommended unless you trust # reverse host names, and don't care about DNS resolution being possibly slow. DontResolve yes # Maximum idle time in minutes (default = 15 minutes) MaxIdleTime 15 # LDAP configuration file (see README.LDAP) # LDAPConfigFile /etc/pureftpd-ldap.conf # MySQL configuration file (see README.MySQL) # MySQLConfigFile /etc/pureftpd-mysql.conf # PostgreSQL configuration file (see README.PGSQL) # PGSQLConfigFile /etc/pureftpd-pgsql.conf # PureDB user database (see README.Virtual-Users) # PureDB /etc/pureftpd.pdb # Path to pure-authd socket (see README.Authentication-Modules) # ExtAuth /run/ftpd.sock # If you want to enable PAM authentication, uncomment the following line # PAMAuthentication yes # If you want simple Unix (/etc/passwd) authentication, uncomment this UnixAuthentication yes # Please note that LDAPConfigFile, MySQLConfigFile, PAMAuthentication and # UnixAuthentication can be used specified once, but can be combined # together. For instance, if you use MySQLConfigFile, then UnixAuthentication, # the SQL server will be used first. If the SQL authentication fails because the # user wasn't found, a new attempt will be done using system authentication. # If the SQL authentication fails because the password didn't match, the # authentication chain stops here. Authentication methods are chained in # the order they are given. # 'ls' recursion limits. The first argument is the maximum number of # files to be displayed. The second one is the max subdirectories depth. LimitRecursion 10000 8 # Are anonymous users allowed to create new directories? AnonymousCanCreateDirs no # If the system load is greater than the given value, anonymous users # aren't allowed to download. MaxLoad 4 # Port range for passive connections - keep it as broad as possible. PassivePortRange 30000 50000 # Force an IP address in PASV/EPSV/SPSV replies. - for NAT. # Symbolic host names are also accepted for gateways with dynamic IP # addresses. # ForcePassiveIP 192.168.0.1 # Upload/download ratio for anonymous users. # AnonymousRatio 1 10 # Upload/download ratio for all users. # This directive supersedes the previous one. # UserRatio 1 10 # Disallow downloads of files owned by the "ftp" system user; # files that were uploaded but not validated by a local admin. AntiWarez yes # IP address/port to listen to (default=all IP addresses, port 21). # Bind 127.0.0.1,21 # Maximum bandwidth for anonymous users in KB/s # AnonymousBandwidth 8 # Maximum bandwidth for *all* users (including anonymous) in KB/s # Use AnonymousBandwidth *or* UserBandwidth, not both. # UserBandwidth 8 # File creation mask. : . # 177:077 if you feel paranoid. Umask 113:002 # Minimum UID for an authenticated user to log in. # For example, a value of 100 prevents all users whose user id is below # 100 from logging in. If you want "root" to be able to log in, use 0. MinUID 100 # Allow FXP transfers for authenticated users. AllowUserFXP yes # Allow anonymous FXP for anonymous and non-anonymous users. AllowAnonymousFXP no # Users can't delete/write files starting with a dot ('.') # even if they own them. But if TrustedGID is enabled, that group # will exceptionally have access to dot-files. ProhibitDotFilesWrite no # Prohibit *reading* of files starting with a dot (.history, .ssh...) ProhibitDotFilesRead no # Don't overwrite files. When a file whose name already exist is uploaded, # it gets automatically renamed to file.1, file.2, file.3, ... AutoRename no # Prevent anonymous users from uploading new files (no = upload is allowed) AnonymousCantUpload yes # Only connections to this specific IP address are allowed to be # non-anonymous. You can use this directive to open several public IPs for # anonymous FTP, and keep a private firewalled IP for remote administration. # You can also only allow a non-routable local IP (such as 10.x.x.x) for # authenticated users, and run a public anon-only FTP server on another IP. # TrustedIP 10.1.1.1 # To add the PID to log entries, uncomment the following line. # LogPID yes # Create an additional log file with transfers logged in a Apache-like format : # fw.c9x.org - jedi [13/Apr/2017:19:36:39] "GET /ftp/linux.tar.bz2" 200 21809338 # This log file can then be processed by common HTTP traffic analyzers. # AltLog clf:/var/log/pureftpd.log # Create an additional log file with transfers logged in a format optimized # for statistic reports. # AltLog stats:/var/log/pureftpd.log # Create an additional log file with transfers logged in the standard W3C # format (compatible with many HTTP log analyzers) AltLog w3c:/var/log/pureftpd.log # Disallow the CHMOD command. Users cannot change perms of their own files. # NoChmod yes # Allow users to resume/upload files, but *NOT* to delete them. # KeepAllFiles yes # Automatically create home directories if they are missing # CreateHomeDir yes # Enable virtual quotas. The first value is the max number of files. # The second value is the maximum size, in megabytes. # So 1000:10 limits every user to 1000 files and 10 Mb. # Quota 1000:10 # If your pure-ftpd has been compiled with standalone support, you can change # the location of the pid file. The default is /run/pure-ftpd.pid PIDFile /run/pure-ftpd.pid # If your pure-ftpd has been compiled with pure-uploadscript support, # this will make pure-ftpd write info about new uploads to # /run/pure-ftpd.upload.pipe so pure-uploadscript can read it and # spawn a script to handle the upload. # Don't enable this option if you don't actually use pure-uploadscript. # CallUploadScript yes # This option is useful on servers where anonymous upload is # allowed. When the partition is more that percententage full, # new uploads are disallowed. MaxDiskUsage 90 # Set to 'yes' to prevent users from renaming files. # NoRename yes # Be 'customer proof': forbids common customer mistakes such as # 'chmod 0 public_html', that are valid, but can cause customers to # unintentionally shoot themselves in the foot. CustomerProof yes # Per-user concurrency limits. Will only work if the FTP server has # been compiled with --with-peruserlimits. # Format is: : # For example, 3:20 means that an authenticated user can have up to 3 active # sessions, and that up to 20 anonymous sessions are allowed. # PerUserLimits 3:20 # When a file is uploaded and there was already a previous version of the file # with the same name, the old file will neither get removed nor truncated. # The file will be stored under a temporary name and once the upload is # complete, it will be atomically renamed. For example, when a large PHP # script is being uploaded, the web server will keep serving the old version and # later switch to the new one as soon as the full file will have been # transferred. This option is incompatible with virtual quotas. # NoTruncate yes # This option accepts three values: # 0: disable SSL/TLS encryption layer (default). # 1: accept both cleartext and encrypted sessions. # 2: refuse connections that don't use the TLS security mechanism, # including anonymous sessions. # Do _not_ uncomment this blindly. Double check that: # 1) The server has been compiled with TLS support (--with-tls), # 2) A valid certificate is in place, # 3) Only compatible clients will log in. TLS 2 # Cipher suite for TLS sessions. # The default suite is secure and setting this property is usually # only required to *lower* the security to cope with legacy clients. # Prefix with -C: in order to require valid client certificates. # If -C: is used, make sure that clients' public keys are present on # the server. # TLSCipherSuite HIGH # Certificate file, for TLS # The certificate itself and the keys can be bundled into the same # file or split into two files. # CertFile is for a cert+key bundle, CertFileAndKey for separate files. # Use only one of these. # CertFile /etc/ssl/private/pure-ftpd.pem # CertFileAndKey "/etc/pure-ftpd.pem" "/etc/pure-ftpd.key" # Unix socket of the external certificate handler, for TLS # ExtCert /run/ftpd-certs.sock # Listen only to IPv4 addresses in standalone mode (ie. disable IPv6) # By default, both IPv4 and IPv6 are enabled. # IPV4Only yes # Listen only to IPv6 addresses in standalone mode (i.e. disable IPv4) # By default, both IPv4 and IPv6 are enabled. # IPV6Only yes ================================================ FILE: aegir/conf/global/global-10.inc ================================================ = 8) { $config['automated_cron.settings']['interval'] = 0; $config['mail_safety.settings']['default_mail_address'] = ''; $config['mail_safety.settings']['enabled'] = TRUE; $config['mail_safety.settings']['send_mail_to_dashboard'] = TRUE; $config['mail_safety.settings']['send_mail_to_default_mail'] = FALSE; $config['scheduler.settings']['lightweight_cron_access_key'] = ''; $config['simple_cron.settings']['interval'] = 0; $config['system.cron']['key'] = ''; $config['system.cron']['last'] = 0; $config['system.cron']['threshold']['auto'] = 0; $config['ultimate_cron.job.cron_queue']['status'] = FALSE; $config['ultimate_cron.settings']['scheduler'] = 'never'; } else { $conf['mail_safety_enabled'] = TRUE; $conf['mail_safety_send_mail_to_dashboard'] = TRUE; } } /** * Use site specific composer_manager dir */ if ($all_ini['set_composer_manager_vendor_dir'] && !$is_install) { if ($drupal_core >= 8) { $config['composer_manager.settings']['vendor_dir'] = 'sites/' . $_SERVER['SERVER_NAME'] . '/vendor'; } else { $conf['composer_manager_vendor_dir'] = 'sites/' . $_SERVER['SERVER_NAME'] . '/vendor'; } } /** * Domain Access Module Paths Detection */ if ($all_ini['auto_detect_domain_access_integration']) { if (is_readable('sites/all/modules/domain/settings.inc')) { $da_inc = 'sites/all/modules/domain/settings.inc'; } elseif (is_readable('sites/all/modules/contrib/domain/settings.inc')) { $da_inc = 'sites/all/modules/contrib/domain/settings.inc'; } elseif (is_readable('profiles/' . $conf['install_profile'] . '/modules/domain/settings.inc')) { $da_inc = 'profiles/' . $conf['install_profile'] . '/modules/domain/settings.inc'; } elseif (is_readable('profiles/' . $conf['install_profile'] . '/modules/contrib/domain/settings.inc')) { $da_inc = 'profiles/' . $conf['install_profile'] . '/modules/contrib/domain/settings.inc'; } } /** * Domain Access Module inc should not be loaded during installation */ if ($is_install) { $da_inc = FALSE; } /** * Domain Access Module inc loading */ if (!$custom_da) { if ($da_inc) { require_once($da_inc); } } /** * Drupal for Facebook (fb) * * Important: * Facebook client libraries will not work properly if arg_separator.output is not & * The default value is &. Change this in settings.php. Make the value "&" * https://drupal.org/node/205476 */ if (!$custom_fb && $all_ini['auto_detect_facebook_integration']) { if (is_readable('sites/all/modules/fb/fb_settings.inc')) { ini_set('arg_separator.output', '&'); require_once "sites/all/modules/fb/fb_settings.inc"; $conf['fb_api_file'] = "sites/all/modules/fb/facebook-platform/php/facebook.php"; } elseif (is_readable('sites/all/modules/contrib/fb/fb_settings.inc')) { ini_set('arg_separator.output', '&'); require_once "sites/all/modules/contrib/fb/fb_settings.inc"; $conf['fb_api_file'] = "sites/all/modules/contrib/fb/facebook-platform/php/facebook.php"; } elseif (is_readable('profiles/' . $conf['install_profile'] . '/modules/fb/fb_settings.inc')) { ini_set('arg_separator.output', '&'); require_once 'profiles/' . $conf['install_profile'] . '/modules/fb/fb_settings.inc'; $conf['fb_api_file'] = 'profiles/' . $conf['install_profile'] . '/modules/fb/facebook-platform/php/facebook.php'; } elseif (is_readable('profiles/' . $conf['install_profile'] . '/modules/contrib/fb/fb_settings.inc')) { ini_set('arg_separator.output', '&'); require_once 'profiles/' . $conf['install_profile'] . '/modules/contrib/fb/fb_settings.inc'; $conf['fb_api_file'] = 'profiles/' . $conf['install_profile'] . '/modules/contrib/fb/facebook-platform/php/facebook.php'; } } /** * Unset config arrays on non-dev URLs */ if (!$is_dev) { unset($boa_ini); unset($usr_plr_ini); unset($usr_loc_ini); unset($all_ini); } ================================================ FILE: aegir/conf/global/global-front-end.inc ================================================ = 7) { ini_set('session.cookie_secure', TRUE); if ($is_dev) { header('X-Cookie-Sec: YES'); } } } if ($is_dev) { header('X-Local-Proto: https'); } } else { if ($site_subdir && $raw_host) { $base_url = 'http://' . $raw_host . '/' . $site_subdir; } else { $base_url = 'http://' . $_SERVER['HTTP_HOST']; } } } else { if ($site_subdir && $raw_host) { $base_url = 'http://' . $raw_host . '/' . $site_subdir; } else { $base_url = 'http://' . $_SERVER['HTTP_HOST']; } } if ($base_url && $is_dev) { header("X-Base-Url: " . $base_url); } if ($site_subdir && $is_dev) { header("X-Site-Subdir: " . $site_subdir); } if ($all_ini['server_name_cookie_domain']) { $domain = '.' . preg_replace('`^www\.`', '', $_SERVER['SERVER_NAME']); } elseif ($site_subdir && isset($_SERVER['RAW_HOST'])) { $domain = '.' . preg_replace('`^www\.`', '', $_SERVER['RAW_HOST']); } else { $domain = '.' . preg_replace('`^www\.`', '', $_SERVER['HTTP_HOST']); } $domain = str_replace('..', '.', $domain); if (count(explode('.', $domain)) > 2 && !is_numeric(str_replace('.', '', $domain))) { ini_set('session.cookie_domain', $domain); $cookie_domain = $domain; header("X-Cookie-Domain: " . $cookie_domain); } $this_prefix = preg_replace('`^www\.`', '', $_SERVER['SERVER_NAME']) . '_z_'; if ($is_dev) { header("X-Valkey-Prefix: " . $this_prefix); } if (isset($_SERVER['REQUEST_TIME']) && isset($_SERVER['REMOTE_ADDR']) && isset($_SERVER['HTTP_USER_AGENT']) && !preg_match("/^\/esi\//", $_SERVER['REQUEST_URI'])) { // Determine if the site is running on HTTPS $request_type = 'NONSSL'; if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) || isset($_SERVER['HTTPS'])) { $request_type = ($_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https' || $_SERVER['HTTPS'] == 'on') ? 'SSL' : 'NONSSL'; } if ($request_type == "SSL") { $is_https = TRUE; if ($is_dev) { header('X-Request-Type:' . $request_type); } } else { $is_https = FALSE; if ($is_dev) { header('X-Request-Type:' . $request_type); } } // Create a unique identifier for the request $identity = $_SERVER['REQUEST_TIME'] . $_SERVER['REMOTE_ADDR'] . $_SERVER['SERVER_NAME'] . $_SERVER['HTTP_USER_AGENT']; $identity = 'BD' . md5($identity); if ($is_dev) { header('X-Identity:' . $identity); } if ($drupal_core >= 8) { // Check if the user is logged in by looking for the session cookie. // The session cookie name starts with "SESS" or "SSESS" followed by a hash. // This check is not site specific in Drupal 8+ like it is in Drupal 7 // or Drupal 6, but should be sufficient for the intended use case below. $cookie_prefix = ini_get('session.cookie_secure') ? 'SSESS' : 'SESS'; $is_logged_in = FALSE; foreach ($_COOKIE as $key => $value) { if (strpos($key, $cookie_prefix) == 0) { $is_logged_in = TRUE; break; } } if ($is_dev) { header('X-Cookie-Prefix-A:' . $cookie_prefix); header('X-Is-Logged-In-A:' . $is_logged_in); } } elseif ($drupal_core == 7) { // For Drupal 7 use sha256 hash and cookie prefix based on session.cookie_secure $cookie_prefix = ini_get('session.cookie_secure') ? 'SSESS' : 'SESS'; $test_sess_name = $cookie_prefix . substr(hash('sha256', $cookie_domain), 0, 32); if ($is_dev) { header('X-Cookie-Prefix-B:' . $cookie_prefix); header('X-Test-Sess-Name-B:' . $test_sess_name); } } else { // For Drupal 6 use md5 hash and SESS prefix only $cookie_prefix = 'SESS'; $test_sess_name = $cookie_prefix . md5($cookie_domain); if ($is_dev) { header('X-Cookie-Prefix-C:' . $cookie_prefix); header('X-Test-Sess-Name-C:' . $test_sess_name); } } // Check if the session cookie is present if (isset($_COOKIE[$test_sess_name]) || $is_logged_in) { $is_anon = 'LOGGED'; } else { $is_anon = 'ANONYMOUS'; } if ($is_dev) { header('X-Is-Anon:' . $is_anon); } // Redirect not logged in visitors to homepage to protect admin URLs from bots if ($is_anon == 'ANONYMOUS') { if (preg_match("/\/(?:node\/[0-9]+\/edit|node\/add)/", $_SERVER['REQUEST_URI'])) { if (empty($all_ini['allow_anon_node_add'])) { header("Location: " . $base_url . "/", true, 301); exit; } } if (preg_match("/^\/(?:[a-z]{2}\/)?(?:admin|logout|privatemsg|approve)/", $_SERVER['REQUEST_URI'])) { if (empty($all_ini['disable_admin_dos_protection'])) { header("Location: " . $base_url . "/", true, 301); exit; } } } // Additional logic for caching or other needs if ($is_anon == 'ANONYMOUS' && !empty($all_ini['speed_booster_anon_cache_ttl']) && preg_match("/^[0-9]{2,}$/", $all_ini['speed_booster_anon_cache_ttl'])) { if ($all_ini['speed_booster_anon_cache_ttl'] > 10) { $expire_in_seconds = $all_ini['speed_booster_anon_cache_ttl']; header('X-Limit-Booster:' . $all_ini['speed_booster_anon_cache_ttl']); } } // Prevent turning the feature server site into a spam machine // Disable self-registration also on hostmaster if ($conf['install_profile'] == 'feature_server' || $conf['install_profile'] == 'hostmaster') { $conf['user_register'] = 0; // Force "Only site administrators can create new user accounts" } if (!$is_bot && !$high_traffic) { if (preg_match("/^\/(?:[a-z]{2}\/)?(?:admin|cart|checkout|logout|privatemsg)/", $_SERVER['REQUEST_URI']) || preg_match("/\/(?:node\/[0-9]+\/edit|node\/add|comment\/reply|approve|ajax_comments|commerce_currency_select)/", $_SERVER['REQUEST_URI']) || preg_match("/(?:^dev\.|\.dev\.|\.devel\.)/", $_SERVER['HTTP_HOST'])) { $expire_in_seconds = '1'; header('X-Limit-Booster: 1'); } if (isset($_SERVER['REQUEST_URI']) && preg_match("/(?:x-progress-id|ahah|progress\/|autocomplete|ajax|batch|js\/.*)/i", $_SERVER['REQUEST_URI'])) { $expire_in_seconds = '0'; if ($is_dev) { header('X-Skip-Booster: AjaxRU'); } } if (isset($_SERVER['QUERY_STRING']) && preg_match("/(?:x-progress-id|ahah|progress\/|autocomplete|ajax|batch|js\/.*)/i", $_SERVER['QUERY_STRING'])) { $expire_in_seconds = '0'; if ($is_dev) { header('X-Skip-Booster: AjaxQS'); } } if (isset($_SERVER['REQUEST_METHOD']) && $_SERVER['REQUEST_METHOD'] == 'POST') { if (!isset($_COOKIE['NoCacheID'])) { $lifetime = '15'; setcookie('NoCacheID', 'POST' . $identity, $_SERVER['REQUEST_TIME'] + $lifetime, '/', $cookie_domain); } $expire_in_seconds = '0'; if ($is_dev) { header('X-Skip-Booster: PostRM'); } } } if ($is_bot) { if (!preg_match("/Pingdom/i", $_SERVER['HTTP_USER_AGENT']) && !preg_match("/(?:rss|feed)/i", $_SERVER['REQUEST_URI'])) { $expire_in_seconds = '3600'; if ($is_dev) { header('X-Bot-Booster: 3600'); } } } if ($conf['install_profile'] != 'hostmaster' && ($expire_in_seconds > -1)) { header("X-Accel-Expires: " . $expire_in_seconds); if ($expire_in_seconds > -1 && $expire_in_seconds < 2) { $conf['cache'] = 0; // Disable page caching on the fly } } } } /** * Support files/styles with short URIs also for files not generated yet */ if (preg_match("/^\/files\/styles\//", $_SERVER['REQUEST_URI'])) { header("Location: " . $base_url . "/sites/" . $_SERVER['SERVER_NAME'] . $_SERVER['REQUEST_URI'], true, 301); exit; } ================================================ FILE: aegir/conf/global/global-if-redis.inc ================================================ = 6) { $use_valkey = TRUE; } if (isset($_SERVER['SERVER_NAME'])) { if ($all_ini['valkey_cache_disable'] || $all_ini['redis_cache_disable']) { $use_valkey = FALSE; } } if (!$is_bot && isset($_SERVER['REQUEST_URI'])) { if (preg_match("/noredis=1/", $_SERVER['REQUEST_URI'])) { $use_valkey = FALSE; } } /* ---------------- Defaults -------------------------------------------- */ $valkey_up = FALSE; /* ---------------- Connection targets ---------------------------------- */ $valkey_socket_path = '/run/valkey/valkey.sock'; $valkey_host = '127.0.0.1'; $valkey_port = 6379; $valkey_pass_file = '/data/conf/valkey/pass.inc'; /* ---------------- Timeouts & backoff ---------------------------------- */ $connect_timeout_s = 0.2; // short and non-blocking feel $read_timeout_s = 0.2; // keep calls snappy $backoff_ttl_s = 60; // do not retry within this window after a failure $flag_dir_run = '/var/tmp/fpm'; $flag_file_fallback = '/data/conf/arch/valkey.disabled.flag'; // fallback /* ---------------- Optional debug log ---------------------------------- */ // Set to an absolute path to enable lightweight probe logging. // Example: '/var/tmp/fpm/valkey-fallback.log' $redis_debug_log = ''; /* ---------------- Helpers (filesystem only) ---------------------------- */ function _valkey_backoff_flag_path($flag_dir_run, $fallback) { $path = $fallback; if (is_dir($flag_dir_run)) { if (is_writable($flag_dir_run)) { $path = rtrim($flag_dir_run, '/').'/valkey.disabled.flag'; } } return $path; } function _valkey_backoff_is_active($flag_path, $ttl) { $active = FALSE; if (is_file($flag_path)) { $age = time() - @filemtime($flag_path); if ($age >= 0 && $age < $ttl) { $active = TRUE; } } return $active; } function _valkey_backoff_touch($flag_path) { @touch($flag_path); } function _valkey_backoff_clear($flag_path) { if (is_file($flag_path)) { @unlink($flag_path); } } function _valkey_dbg_write($log_path, $line) { if (!empty($log_path)) { $msg = date('c').' '.$line."\n"; @file_put_contents($log_path, $msg, FILE_APPEND); } } /* ------------------- Probe Valkey once with guard --------------------- */ $flag_path = _valkey_backoff_flag_path($flag_dir_run, $flag_file_fallback); $skip_probe = _valkey_backoff_is_active($flag_path, $backoff_ttl_s); if ($use_valkey) { if (!$skip_probe) { if (class_exists('Redis')) { $r = new Redis(); $connected = FALSE; $last_reason = 'init'; // Try socket first. if (!empty($valkey_socket_path) && @is_readable($valkey_socket_path)) { try { $connected = $r->connect($valkey_socket_path); } catch (Exception $e) { $connected = FALSE; $last_reason = 'connect-socket-exception'; } } // Fallback to TCP. if (!$connected) { try { $connected = $r->connect($valkey_host, $valkey_port, $connect_timeout_s); } catch (Exception $e) { $connected = FALSE; $last_reason = 'connect-tcp-exception'; } } if ($connected) { if (defined('Redis::OPT_READ_TIMEOUT')) { $r->setOption(Redis::OPT_READ_TIMEOUT, $read_timeout_s); } // Authenticate if password file exists. $auth_pass = 'isfoobared'; if (is_file($valkey_pass_file)) { $auth_pass = trim((string) @file_get_contents($valkey_pass_file)); } if ($auth_pass !== '') { try { if (!$r->auth($auth_pass)) { $connected = FALSE; $last_reason = 'auth-failed'; } } catch (Exception $e) { $connected = FALSE; $last_reason = 'auth-exception'; } } // Verify ping. if ($connected) { try { $pong = $r->ping(); if ((is_string($pong) && stripos($pong, 'PONG') !== FALSE) || $pong === TRUE) { $valkey_up = TRUE; } else { $valkey_up = FALSE; $last_reason = 'ping-not-ok'; } } catch (Exception $e) { $valkey_up = FALSE; $last_reason = 'ping-exception'; } } if ($valkey_up) { _valkey_backoff_clear($flag_path); _valkey_dbg_write($redis_debug_log, 'VALKEY UP action=clear flag='.$flag_path.' reason=ok'); } else { _valkey_backoff_touch($flag_path); _valkey_dbg_write($redis_debug_log, 'VALKEY DOWN action=touch flag='.$flag_path.' reason='.(string) $last_reason); } try { $r->close(); } catch (Exception $e) { // ignore } } else { _valkey_backoff_touch($flag_path); _valkey_dbg_write($redis_debug_log, 'VALKEY DOWN action=touch flag='.$flag_path.' reason='.(string) $last_reason); } } else { // phpredis extension not available. $valkey_up = FALSE; _valkey_backoff_touch($flag_path); _valkey_dbg_write($redis_debug_log, 'VALKEY DOWN action=touch flag='.$flag_path.' reason=no-phpredis'); } } else { $valkey_up = FALSE; _valkey_dbg_write($redis_debug_log, 'VALKEY SKIP reason=backoff-active flag='.$flag_path); } } /* ---------------- Diagnostics & final guard ---------------------------- */ if (!empty($is_dev)) { if (empty($is_backend)) { if ($use_valkey && $valkey_up) { header('X-Allow-Valkey: YES'); } else { header('X-Allow-Valkey: NO'); } } } if (!empty($is_install)) { $use_valkey = FALSE; } ================================================ FILE: aegir/conf/global/global-if-valkey.inc ================================================ = 6) { $use_valkey = TRUE; } if (isset($_SERVER['SERVER_NAME'])) { if ($all_ini['valkey_cache_disable'] || $all_ini['redis_cache_disable']) { $use_valkey = FALSE; } } if (!$is_bot && isset($_SERVER['REQUEST_URI'])) { if (preg_match("/noredis=1/", $_SERVER['REQUEST_URI'])) { $use_valkey = FALSE; } } /* ---------------- Defaults -------------------------------------------- */ $valkey_up = FALSE; /* ---------------- Connection targets ---------------------------------- */ $valkey_socket_path = '/run/valkey/valkey.sock'; $valkey_host = '127.0.0.1'; $valkey_port = 6379; $valkey_pass_file = '/data/conf/valkey/pass.inc'; /* ---------------- Timeouts & backoff ---------------------------------- */ $connect_timeout_s = 0.2; // short and non-blocking feel $read_timeout_s = 0.2; // keep calls snappy $backoff_ttl_s = 60; // do not retry within this window after a failure $flag_dir_run = '/var/tmp/fpm'; $flag_file_fallback = '/data/conf/arch/valkey.disabled.flag'; // fallback /* ---------------- Optional debug log ---------------------------------- */ // Set to an absolute path to enable lightweight probe logging. // Example: '/var/tmp/fpm/valkey-fallback.log' $redis_debug_log = ''; /* ---------------- Helpers (filesystem only) ---------------------------- */ function _valkey_backoff_flag_path($flag_dir_run, $fallback) { $path = $fallback; if (is_dir($flag_dir_run)) { if (is_writable($flag_dir_run)) { $path = rtrim($flag_dir_run, '/').'/valkey.disabled.flag'; } } return $path; } function _valkey_backoff_is_active($flag_path, $ttl) { $active = FALSE; if (is_file($flag_path)) { $age = time() - @filemtime($flag_path); if ($age >= 0 && $age < $ttl) { $active = TRUE; } } return $active; } function _valkey_backoff_touch($flag_path) { @touch($flag_path); } function _valkey_backoff_clear($flag_path) { if (is_file($flag_path)) { @unlink($flag_path); } } function _valkey_dbg_write($log_path, $line) { if (!empty($log_path)) { $msg = date('c').' '.$line."\n"; @file_put_contents($log_path, $msg, FILE_APPEND); } } /* ------------------- Probe Valkey once with guard --------------------- */ $flag_path = _valkey_backoff_flag_path($flag_dir_run, $flag_file_fallback); $skip_probe = _valkey_backoff_is_active($flag_path, $backoff_ttl_s); if ($use_valkey) { if (!$skip_probe) { if (class_exists('Redis')) { $r = new Redis(); $connected = FALSE; $last_reason = 'init'; // Try socket first. if (!empty($valkey_socket_path) && @is_readable($valkey_socket_path)) { try { $connected = $r->connect($valkey_socket_path); } catch (Exception $e) { $connected = FALSE; $last_reason = 'connect-socket-exception'; } } // Fallback to TCP. if (!$connected) { try { $connected = $r->connect($valkey_host, $valkey_port, $connect_timeout_s); } catch (Exception $e) { $connected = FALSE; $last_reason = 'connect-tcp-exception'; } } if ($connected) { if (defined('Redis::OPT_READ_TIMEOUT')) { $r->setOption(Redis::OPT_READ_TIMEOUT, $read_timeout_s); } // Authenticate if password file exists. $auth_pass = 'isfoobared'; if (is_file($valkey_pass_file)) { $auth_pass = trim((string) @file_get_contents($valkey_pass_file)); } if ($auth_pass !== '') { try { if (!$r->auth($auth_pass)) { $connected = FALSE; $last_reason = 'auth-failed'; } } catch (Exception $e) { $connected = FALSE; $last_reason = 'auth-exception'; } } // Verify ping. if ($connected) { try { $pong = $r->ping(); if ((is_string($pong) && stripos($pong, 'PONG') !== FALSE) || $pong === TRUE) { $valkey_up = TRUE; } else { $valkey_up = FALSE; $last_reason = 'ping-not-ok'; } } catch (Exception $e) { $valkey_up = FALSE; $last_reason = 'ping-exception'; } } if ($valkey_up) { _valkey_backoff_clear($flag_path); _valkey_dbg_write($redis_debug_log, 'VALKEY UP action=clear flag='.$flag_path.' reason=ok'); } else { _valkey_backoff_touch($flag_path); _valkey_dbg_write($redis_debug_log, 'VALKEY DOWN action=touch flag='.$flag_path.' reason='.(string) $last_reason); } try { $r->close(); } catch (Exception $e) { // ignore } } else { _valkey_backoff_touch($flag_path); _valkey_dbg_write($redis_debug_log, 'VALKEY DOWN action=touch flag='.$flag_path.' reason='.(string) $last_reason); } } else { // phpredis extension not available. $valkey_up = FALSE; _valkey_backoff_touch($flag_path); _valkey_dbg_write($redis_debug_log, 'VALKEY DOWN action=touch flag='.$flag_path.' reason=no-phpredis'); } } else { $valkey_up = FALSE; _valkey_dbg_write($redis_debug_log, 'VALKEY SKIP reason=backoff-active flag='.$flag_path); } } /* ---------------- Diagnostics & final guard ---------------------------- */ if (!empty($is_dev)) { if (empty($is_backend)) { if ($use_valkey && $valkey_up) { header('X-Allow-Valkey: YES'); } else { header('X-Allow-Valkey: NO'); } } } if (!empty($is_install)) { $use_valkey = FALSE; } ================================================ FILE: aegir/conf/global/global-ini.inc ================================================ '86400', 'session_gc_eol' => '86400', 'redis_use_modern' => TRUE, 'redis_flush_forced_mode' => TRUE, 'redis_lock_enable' => TRUE, 'redis_path_enable' => TRUE, 'redis_scan_enable' => FALSE, 'redis_cache_disable' => FALSE, 'redis_old_nine_mode' => FALSE, 'redis_old_eight_mode' => FALSE, 'sql_conversion_mode' => FALSE, 'enable_strict_user_register_protection' => FALSE, 'entitycache_dont_enable' => FALSE, 'views_cache_bully_dont_enable' => FALSE, 'views_content_cache_dont_enable' => FALSE, 'autoslave_enable' => FALSE, 'cache_consistent_enable' => FALSE, 'redis_exclude_bins' => FALSE, 'speed_booster_anon_cache_ttl' => FALSE, 'allow_anon_node_add' => FALSE, 'enable_newrelic_integration' => FALSE, 'disable_admin_dos_protection' => FALSE, 'ignore_user_register_protection' => FALSE, 'allow_private_file_downloads' => FALSE, 'server_name_cookie_domain' => FALSE, 'auto_detect_facebook_integration' => TRUE, // For backward compatibility until next release, then FALSE 'auto_detect_domain_access_integration' => TRUE, // For backward compatibility until next release, then FALSE 'advagg_auto_configuration' => FALSE, // Will be set to TRUE in boa_site_control.ini if the module is enabled 'disable_drupal_page_cache' => FALSE, // FALSE for backward compatibility and max performance 'set_composer_manager_vendor_dir' => FALSE, // FALSE by default to not break site installation depending on custom value ); ================================================ FILE: aegir/conf/global/global-main.inc ================================================ = 8) { $settings['reverse_proxy'] = TRUE; $settings['reverse_proxy_header'] = $proxy_header; $settings['reverse_proxy_addresses'] = array($proxy_ip); } } } /** * The nodns protection */ if ($no_dns) { if ($local_req) { // Allow local requests if (!$is_backend && isset($_SERVER['REMOTE_ADDR'])) { header("X-Local-Y: " . $_SERVER['REMOTE_ADDR']); } } else { // Ignore remote requests header('X-Accel-Expires: 60'); header('HTTP/1.0 404 Not Found'); header("Connection: close"); exit; } } /** * The hidden uri protection */ if ($hidden_uri) { if ($local_req) { // Allow local requests to hidden uri if (!$is_backend && isset($_SERVER['REMOTE_ADDR'])) { header("X-Local-URI-Y: " . $_SERVER['REMOTE_ADDR']); } } else { // Ignore remote requests header('X-Accel-Expires: 60'); header('HTTP/1.0 404 Not Found'); header("Connection: close"); exit; } } /** * Use Ægir/BOA specific MAIN_SITE_NAME instead of possibly fake SERVER_NAME */ if (isset($_SERVER['MAIN_SITE_NAME'])) { $_SERVER['SERVER_NAME'] = $_SERVER['MAIN_SITE_NAME']; } /** * Set MAIN_SITE_NAME to match SERVER_NAME, if MAIN_SITE_NAME is not set */ if (!isset($_SERVER['MAIN_SITE_NAME']) && isset($_SERVER['SERVER_NAME'])) { $_SERVER['MAIN_SITE_NAME'] = $_SERVER['SERVER_NAME']; } /** * Required for proper Valkey/Redis support on command line / via Drush */ if (isset($_SERVER['HTTP_HOST']) && !isset($_SERVER['SERVER_NAME'])) { $_SERVER['SERVER_NAME'] = $_SERVER['HTTP_HOST']; } /** * Force backward compatible SERVER_SOFTWARE */ if (!$is_backend) { if (isset($_SERVER['SERVER_SOFTWARE']) && !preg_match("/ApacheSolarisNginx/i", $_SERVER['SERVER_SOFTWARE'])) { $_SERVER['SERVER_SOFTWARE'] = 'ApacheSolarisNginx/1.29.8'; } } /** * Early bots redirect on protected URLs */ if (!$is_backend) { if (isset($_SERVER['HTTP_HOST']) && $is_bot) { if (preg_match("/(?:^tmp\.|\.test\.|\.tmp\.)/i", $_SERVER['HTTP_HOST'])) { // Deny known search bots on ^(tmp|foo.(tmp|test)).domain subdomains header('X-Accel-Expires: 60'); header("Location: http://www.aegirproject.org/", true, 301); exit; } elseif (preg_match("/\.(?:host8|boa|aegir|o8)\.(?:biz|io|cc)$/i", $_SERVER['HTTP_HOST'])) { // Deny known search bots on some protected CI subdomains header('X-Accel-Expires: 60'); header("Location: https://omega8.cc/", true, 301); exit; } } } /** * Disable reporting errors by default - enable later only for foo.dev.domain */ error_reporting(0); /** * Hostmaster specific settings */ if ($conf['install_profile'] == 'hostmaster') { $conf['hosting_require_disable_before_delete'] = 0; $conf['hosting_task_refresh_timeout'] = 5555; $conf['theme_link'] = FALSE; $conf['cache'] = 0; if (!$is_backend && isset($_SERVER['HTTP_USER_AGENT'])) { $conf['environment_indicator_overwrite'] = TRUE; $conf['environment_indicator_overwritten_position'] = 'top'; if (is_readable('/data/conf/development-env.ctrl')) { $conf['environment_indicator_overwritten_name'] = 'Development'; $conf['environment_indicator_overwritten_color'] = '#00AA00'; // Green } elseif (is_readable('/data/conf/staging-env.ctrl')) { $conf['environment_indicator_overwritten_name'] = 'Staging'; $conf['environment_indicator_overwritten_color'] = '#FFCC00'; // Yellow } elseif (is_readable('/data/conf/production-env.ctrl')) { $conf['environment_indicator_overwritten_name'] = 'Production'; $conf['environment_indicator_overwritten_color'] = '#CC0000'; // Red } elseif (is_readable('/data/conf/testing-env.ctrl')) { $conf['environment_indicator_overwritten_name'] = 'Testing'; $conf['environment_indicator_overwritten_color'] = '#FF69B4'; // Hot Pink //$conf['environment_indicator_overwritten_color'] = '#FFC0CB'; // Light Pink } else { $conf['environment_indicator_overwritten_name'] = 'Production'; $conf['environment_indicator_overwritten_color'] = '#CC0000'; // Red } ini_set('session.cookie_lifetime', 0); // Force log-out on browser quit header('X-Accel-Expires: 1'); if (!file_exists('/data/conf/no-https-aegir.inc')) { $request_type = ($_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https' || $_SERVER['HTTPS'] == 'on') ? 'SSL' : 'NONSSL'; if ($request_type != "SSL" && !preg_match("/^\/cron\.php/", $_SERVER['REQUEST_URI'])) { // we force secure connection here header('X-Accel-Expires: 5'); header("Location: https://" . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'], true, 301); exit; } } if (isset($_SERVER['HTTP_HOST']) && preg_match("/\.(?:host8|boa|aegir|o8)\.(?:biz|io|cc)$/i", $_SERVER['HTTP_HOST'])) { if (preg_match("/^\/admin\/user\/user\/create/", $_SERVER['REQUEST_URI']) || preg_match("/^\/node\/add\/server/", $_SERVER['REQUEST_URI']) || preg_match("/^\/node\/(?:1|2|4|5|7|8|10)\/(?:edit|delete)/", $_SERVER['REQUEST_URI'])) { header('X-Accel-Expires: 5'); header("Location: https://" . $_SERVER['HTTP_HOST'] . "/hosting/sites", true, 301); exit; } } } } /** * Optional site and platform level settings defined in the ini files * Note: the site-level ini file takes precedence over platform level ini */ $all_ini = $boa_ini; if (is_readable('sites/all/modules/boa_platform_control.ini')) { $ini_plr_src = 'sites/all/modules/boa_platform_control.ini'; } if ($ini_plr_src) { $usr_plr_ini = array(); $usr_plr_ini = parse_ini_file($ini_plr_src); } if (is_readable('sites/' . $_SERVER['SERVER_NAME'] . '/modules/boa_site_control.ini')) { $ini_loc_src = 'sites/' . $_SERVER['SERVER_NAME'] . '/modules/boa_site_control.ini'; } if ($ini_loc_src) { $usr_loc_ini = array(); $usr_loc_ini = parse_ini_file($ini_loc_src); } if (is_array($usr_plr_ini) && $usr_plr_ini) { $all_ini = array_merge($all_ini, $usr_plr_ini); } if (is_array($usr_loc_ini) && $usr_loc_ini) { $all_ini = array_merge($all_ini, $usr_loc_ini); } /** * Display All Active INI Values on .dev. URL */ if (is_array($all_ini) && $is_dev && !$is_backend) { if ($ini_plr_src) { header("X-Ini-Plr-Src: " . $ini_plr_src); } if ($ini_loc_src) { header("X-Ini-Loc-Src: " . $ini_loc_src); } if (!$ini_plr_src && !$ini_loc_src) { header("X-Ini-Src: BOA-Default"); } header("X-Ini-Valkey-Use-Modern: " . $all_ini['redis_use_modern']); header("X-Ini-Valkey-Flush-Forced-Mode: " . $all_ini['redis_flush_forced_mode']); header("X-Ini-Valkey-Lock-Enable: " . $all_ini['redis_lock_enable']); header("X-Ini-Valkey-Path-Enable: " . $all_ini['redis_path_enable']); header("X-Ini-Valkey-Scan-Enable: " . $all_ini['redis_scan_enable']); header("X-Ini-Valkey-Old-Nine-Mode: " . $all_ini['redis_old_nine_mode']); header("X-Ini-Valkey-Old-Eight-Mode: " . $all_ini['redis_old_eight_mode']); header("X-Ini-Valkey-Cache-Disable: " . $all_ini['redis_cache_disable']); header("X-Ini-Valkey-Exclude-Bins: " . $all_ini['redis_exclude_bins']); header("X-Ini-Speed-Booster-Anon-Cache-Ttl: " . $all_ini['speed_booster_anon_cache_ttl']); header("X-Ini-Allow-Anon-Node-Add: " . $all_ini['allow_anon_node_add']); header("X-Ini-Enable-NewRelic-Integration: " . $all_ini['enable_newrelic_integration']); header("X-Ini-Disable-Admin-Dos-Protection: " . $all_ini['disable_admin_dos_protection']); header("X-Ini-Allow-Private-File-Downloads: " . $all_ini['allow_private_file_downloads']); header("X-Ini-Server-Name-Cookie-Domain: " . $all_ini['server_name_cookie_domain']); header("X-Ini-Auto-Detect-Facebook-Integration: " . $all_ini['auto_detect_facebook_integration']); header("X-Ini-Auto-Detect-Domain-Access-Integration: " . $all_ini['auto_detect_domain_access_integration']); header("X-Ini-Advagg-Auto-Configuration: " . $all_ini['advagg_auto_configuration']); header("X-Ini-Sql-Conversion-Mode: " . $all_ini['sql_conversion_mode']); header("X-Ini-Enable-Strict-User-Register-Protection: " . $all_ini['enable_strict_user_register_protection']); header("X-Ini-Entitycache-Dont-Enable: " . $all_ini['entitycache_dont_enable']); header("X-Ini-Views-Cache-Bully-Dont-Enable: " . $all_ini['views_cache_bully_dont_enable']); header("X-Ini-Views-Content-Cache-Dont-Enable: " . $all_ini['views_content_cache_dont_enable']); header("X-Ini-Ignore-User-Register-Protection: " . $all_ini['ignore_user_register_protection']); header("X-Ini-Session-Cookie-Ttl: " . $all_ini['session_cookie_ttl']); header("X-Ini-Session-Gc-Eol: " . $all_ini['session_gc_eol']); header("X-Ini-Disable-Drupal-Page-Cache: " . $all_ini['disable_drupal_page_cache']); header("X-Ini-Set-Composer-Manager-Vendor-Dir: " . $all_ini['set_composer_manager_vendor_dir']); header("X-Ini-AutoSlave-Enable: " . $all_ini['autoslave_enable']); header("X-Ini-CacheConsistent-Enable: " . $all_ini['cache_consistent_enable']); } ================================================ FILE: aegir/conf/global/global-mode.inc ================================================ getSchemeAndHttpHost(); } catch (\Exception $e) { // Unable to determine URI; proceed without setting it } } } if ($uri) { // Clean the URI by removing the scheme $uri = str_replace(['http://', 'https://'], '', $uri); $this_instance = 'Drush Site: ' . $uri; // Set New Relic transaction name and parameters if command details are available if (isset($command['command']) && isset($command['arguments'])) { $drush_command = array_merge([$command['command']], $command['arguments']); $command_str = implode(' ', $drush_command); // Add custom parameters to New Relic newrelic_add_custom_parameter('Drush command', $command_str); newrelic_name_transaction($command_str); // Indicate that this is a background job newrelic_background_job(TRUE); } } } else { // Non-Drush (web request) context if (isset($_SERVER['SERVER_NAME'])) { $this_instance = 'Web Site: ' . $_SERVER['SERVER_NAME']; // Optionally, indicate this is not a background job // newrelic_background_job(FALSE); } } // Apply the New Relic app name if determined if ($this_instance) { ini_set('newrelic.appname', $this_instance); newrelic_set_appname($this_instance); } } elseif (extension_loaded('newrelic') && empty($all_ini['enable_newrelic_integration'])) { // Disable New Relic auto-RUM and ignore transactions if integration is disabled newrelic_disable_autorum(); newrelic_ignore_apdex(); newrelic_ignore_transaction(); } ================================================ FILE: aegir/conf/global/global-redis.inc ================================================ = 8) { $redis_comprs = TRUE; $redis_dirname = 'redis_eight'; if (!$all_ini['redis_old_eight_mode']) { $redis_dirname = 'redis_compr'; } if ($drupal_core == 10 || $drupal_core == 11) { $redis_new_dirname = 'redis_ten_eleven'; $redis_legacy_dirname = 'redis_nine_ten'; if (is_readable('modules/o_contrib_ten/' . $redis_new_dirname . '/redis.services.yml')) { $redis_dirname = $redis_new_dirname; } elseif (is_readable('modules/o_contrib_ten/' . $redis_legacy_dirname . '/redis.services.yml')) { $redis_dirname = $redis_legacy_dirname; } } elseif ($drupal_core == 9) { $redis_dirname = 'redis_nine_ten'; if ($all_ini['redis_old_nine_mode']) { $redis_dirname = 'redis_compr'; } } } else { $redis_dirname = 'redis_edge'; } if ($is_dev && !$is_backend) { header("X-Redis-Version-Is: Modern"); header("X-Redis-Dir-Is: " . $redis_dirname); } if ($all_ini['redis_flush_forced_mode']) { if ($drupal_core >= 8) { $settings['redis_perm_ttl'] = 86400; // 24 hours max $settings['redis_flush_mode'] = 1; // Redis default is 0 $settings['redis_flush_mode_cache_page'] = 2; // Redis default is 1 $settings['redis_flush_mode_cache_block'] = 2; // Redis default is 1 $settings['redis_flush_mode_cache_menu'] = 2; // Redis default is 0 $settings['redis_flush_mode_cache_metatag'] = 2; // Redis default is 0 } else { $conf['redis_perm_ttl'] = 86400; // 24 hours max $conf['redis_flush_mode'] = 1; // Redis default is 0 $conf['redis_flush_mode_cache_page'] = 2; // Redis default is 1 $conf['redis_flush_mode_cache_block'] = 2; // Redis default is 1 $conf['redis_flush_mode_cache_menu'] = 2; // Redis default is 0 $conf['redis_flush_mode_cache_metatag'] = 2; // Redis default is 0 } // See http://bit.ly/1drmi35 for more information if ($is_dev && !$is_backend) { header("X-Redis-Flush-Forced-Mode: Forced"); } } } else { $redis_dirname = 'redis'; if ($is_dev && !$is_backend) { header("X-Redis-Version-Is: Legacy"); header("X-Redis-Dir-Is: " . $redis_dirname); } } if ($drupal_core >= 8) { if (file_exists('sites/' . $_SERVER['SERVER_NAME'] . '/.redisLegacyOff')) { if ($is_dev && !$is_backend) { header("X-Redis-Off-Ctrl-Exists: .redisLegacyOff"); } } else { if (is_readable('sites/' . $_SERVER['SERVER_NAME'] . '/files/development.services.yml')) { if ($is_dev && !$is_backend) { header("X-Dev-Services-Yml-Is-Readable: development.services.yml"); } } else { if (is_readable('modules/o_contrib_ten')) { if (is_readable('modules/o_contrib_ten/' . $redis_dirname . '/example.services.yml')) { $cache_valkey = TRUE; $example_failover_path = 'modules/o_contrib_ten/' . $redis_dirname . '/example.failover.services.yml'; $example_services_path = 'modules/o_contrib_ten/' . $redis_dirname . '/example.services.yml'; $cache_gzip_path = 'modules/o_contrib_ten/' . $redis_dirname . '/lib/Redis/CacheCompressed.php'; } if (is_readable('modules/o_contrib_ten/' . $redis_dirname . '/redis.services.yml')) { $cache_valkey = TRUE; $redis_services_path = 'modules/o_contrib_ten/' . $redis_dirname . '/redis.services.yml'; if ($is_dev && !$is_backend) { header("X-Redis-Services-Is-Readable: " . $redis_services_path); } } } elseif (is_readable('modules/o_contrib_eleven')) { if (is_readable('modules/o_contrib_eleven/' . $redis_dirname . '/example.services.yml')) { $cache_valkey = TRUE; $example_failover_path = 'modules/o_contrib_eleven/' . $redis_dirname . '/example.failover.services.yml'; $example_services_path = 'modules/o_contrib_eleven/' . $redis_dirname . '/example.services.yml'; $cache_gzip_path = 'modules/o_contrib_eleven/' . $redis_dirname . '/lib/Redis/CacheCompressed.php'; } if (is_readable('modules/o_contrib_eleven/' . $redis_dirname . '/redis.services.yml')) { $cache_valkey = TRUE; $redis_services_path = 'modules/o_contrib_eleven/' . $redis_dirname . '/redis.services.yml'; if ($is_dev && !$is_backend) { header("X-Redis-Services-Is-Readable: " . $redis_services_path); } } } elseif (is_readable('modules/o_contrib_nine')) { if (is_readable('modules/o_contrib_nine/' . $redis_dirname . '/example.services.yml')) { $cache_valkey = TRUE; $example_failover_path = 'modules/o_contrib_nine/' . $redis_dirname . '/example.failover.services.yml'; $example_services_path = 'modules/o_contrib_nine/' . $redis_dirname . '/example.services.yml'; $cache_gzip_path = 'modules/o_contrib_nine/' . $redis_dirname . '/lib/Redis/CacheCompressed.php'; } if (is_readable('modules/o_contrib_nine/' . $redis_dirname . '/redis.services.yml')) { $cache_valkey = TRUE; $redis_services_path = 'modules/o_contrib_nine/' . $redis_dirname . '/redis.services.yml'; if ($is_dev && !$is_backend) { header("X-Redis-Services-Is-Readable: " . $redis_services_path); } } } elseif (is_readable('modules/o_contrib_eight')) { if (is_readable('modules/o_contrib_eight/' . $redis_dirname . '/example.services.yml')) { $cache_valkey = TRUE; $example_services_path = 'modules/o_contrib_eight/' . $redis_dirname . '/example.services.yml'; $cache_gzip_path = 'modules/o_contrib_eight/' . $redis_dirname . '/lib/Redis/CacheCompressed.php'; if ($is_dev && !$is_backend) { header("X-Example-Services-Is-Readable: " . $example_services_path); } } if (is_readable('modules/o_contrib_eight/' . $redis_dirname . '/redis.services.yml')) { $cache_valkey = TRUE; $redis_services_path = 'modules/o_contrib_eight/' . $redis_dirname . '/redis.services.yml'; if ($is_dev && !$is_backend) { header("X-Redis-Services-Is-Readable: " . $redis_services_path); } } } } } } elseif ($drupal_core == 7) { if (is_readable('modules/o_contrib_seven/' . $redis_dirname . '/redis.autoload.inc')) { $cache_valkey = TRUE; $cache_backport = FALSE; $cache_redis_path = 'modules/o_contrib_seven/' . $redis_dirname . '/redis.autoload.inc'; $cache_lock_path = 'modules/o_contrib_seven/' . $redis_dirname . '/redis.lock.inc'; $cache_path_path = 'modules/o_contrib_seven/' . $redis_dirname . '/redis.path.inc'; $cache_gzip_path = 'modules/o_contrib_seven/' . $redis_dirname . '/lib/Redis/CacheCompressed.php'; if ($is_dev && !$is_backend) { header("X-Redis-Autoload-Is-Readable: " . $cache_redis_path); } } if ($all_ini['autoslave_enable']) { if (is_readable('modules/o_contrib_seven/autoslave/autoslave.cache.inc') && is_readable('includes/database/autoslave/database.inc')) { $use_auto_se = TRUE; $gzip_mode = FALSE; $cache_backport = FALSE; $auto_se_path = 'modules/o_contrib_seven/autoslave/autoslave.cache.inc'; if ($is_dev && !$is_backend) { header("X-AutoSlave-Cache-Is-Readable: " . $auto_se_path); } } } if ($all_ini['cache_consistent_enable']) { if (is_readable('modules/o_contrib_seven/cache_consistent/cache_consistent.inc')) { $use_cache_ct = TRUE; $gzip_mode = FALSE; $cache_backport = FALSE; $cache_ct_path = 'modules/o_contrib_seven/cache_consistent/cache_consistent.inc'; if ($is_dev && !$is_backend) { header("X-CacheConsistent-Is-Readable: " . $cache_ct_path); } } } } elseif ($drupal_core == 6) { if (is_readable('modules/o_contrib/cache_backport/cache.inc')) { $cache_backport = TRUE; $cache_backport_path = 'modules/o_contrib/cache_backport/cache.inc'; if ($is_dev && !$is_backend) { header("X-Redis-Cache-Backport-Is-Readable: " . $cache_backport_path); } } if (is_readable('modules/o_contrib/' . $redis_dirname . '/redis.autoload.inc')) { $cache_valkey = TRUE; $cache_redis_path = 'modules/o_contrib/' . $redis_dirname . '/redis.autoload.inc'; $cache_lock_path = 'modules/o_contrib/' . $redis_dirname . '/redis.lock.inc'; $cache_path_path = 'modules/o_contrib/' . $redis_dirname . '/redis.path.inc'; $cache_gzip_path = 'modules/o_contrib/' . $redis_dirname . '/lib/Redis/CacheCompressed.php'; if ($is_dev && !$is_backend) { header("X-Redis-Autoload-Is-Readable: " . $cache_redis_path); } } } if ($cache_valkey) { if ($drupal_core >= 8) { if (is_readable('modules/o_contrib_eleven/' . $redis_dirname . '/redis.services.yml')) { $class_loader->addPsr4('Drupal\\redis\\', 'modules/o_contrib_eleven/' . $redis_dirname . '/src'); } elseif (is_readable('modules/o_contrib_ten/' . $redis_dirname . '/redis.services.yml')) { $class_loader->addPsr4('Drupal\\redis\\', 'modules/o_contrib_ten/' . $redis_dirname . '/src'); } elseif (is_readable('modules/o_contrib_nine/' . $redis_dirname . '/redis.services.yml')) { $class_loader->addPsr4('Drupal\\redis\\', 'modules/o_contrib_nine/' . $redis_dirname . '/src'); } else { $class_loader->addPsr4('Drupal\\redis\\', 'modules/o_contrib_eight/' . $redis_dirname . '/src'); } $settings['redis.connection']['interface'] = 'PhpRedis'; $settings['redis.connection']['host'] = '127.0.0.1'; $settings['redis.connection']['port'] = '6379'; $settings['redis.connection']['password'] = 'isfoobared'; $settings['redis.connection']['base'] = '8'; $settings['cache_prefix'] = $this_prefix; $settings['cache']['default'] = 'cache.backend.redis'; if (!is_readable('/data/conf/clstr.cnf')) { $settings['cache']['bins']['bootstrap'] = 'cache.backend.chainedfast'; $settings['cache']['bins']['discovery'] = 'cache.backend.chainedfast'; $settings['cache']['bins']['config'] = 'cache.backend.chainedfast'; } if (is_readable($example_failover_path)) { $settings['container_yamls'][] = $example_failover_path; $settings['redis.failover'] = TRUE; if ($is_dev && !$is_backend) { header("X-Redis-Failover-Is-Readable: " . $example_failover_path); } } elseif (is_readable($example_services_path)) { $settings['container_yamls'][] = $example_services_path; if ($is_dev && !$is_backend) { header("X-Redis-Example-Is-Readable: " . $example_services_path); } } if (is_readable($redis_services_path)) { $settings['container_yamls'][] = $redis_services_path; if ($is_dev && !$is_backend) { header("X-Redis-Services-Is-Readable: " . $redis_services_path); } } if ($drupal_core <= 10) { $settings['queue_default'] = 'queue.redis_reliable'; } if ($redis_comprs) { $settings['redis_compress_length'] = 100; $settings['redis_compress_level'] = 5; } $settings['cache']['bins']['state'] = 'cache.backend.redis'; $settings['state_cache'] = TRUE; $settings['bootstrap_container_definition'] = [ 'parameters' => [], 'services' => [ 'redis.factory' => [ 'class' => 'Drupal\redis\ClientFactory', ], 'cache.backend.redis' => [ 'class' => 'Drupal\redis\Cache\CacheBackendFactory', 'arguments' => ['@redis.factory', '@cache_tags_provider.container', '@serialization.phpserialize'], ], 'cache.container' => [ 'class' => '\Drupal\redis\Cache\PhpRedis', 'factory' => ['@cache.backend.redis', 'get'], 'arguments' => ['container'], ], 'cache_tags_provider.container' => [ 'class' => 'Drupal\redis\Cache\RedisCacheTagsChecksum', 'arguments' => ['@redis.factory'], ], 'serialization.phpserialize' => [ 'class' => 'Drupal\Component\Serialization\PhpSerialize', ], ], ]; } else { if ($cache_backport) { $conf['cache_inc'] = $cache_backport_path; } if ($all_ini['redis_use_modern']) { if ($all_ini['redis_lock_enable']) { $redis_lock = TRUE; } if ($all_ini['redis_path_enable']) { $redis_path = TRUE; } } if (is_readable($cache_lock_path) && $redis_lock) { $conf['lock_inc'] = $cache_lock_path; if ($is_dev && !$is_backend) { header("X-Redis-Lock-Is-Readable: " . $cache_lock_path); } } if (is_readable($cache_path_path) && $redis_path) { $conf['path_inc'] = $cache_path_path; $conf['path_alias_admin_blacklist'] = FALSE; if ($is_dev && !$is_backend) { header("X-Redis-Path-Is-Readable: " . $cache_path_path); } } if ($all_ini['redis_scan_enable']) { $conf['redis_scan_delete'] = TRUE; $gzip_mode = FALSE; } else { if (is_readable($cache_gzip_path)) { $gzip_mode = TRUE; } else { $gzip_mode = FALSE; } } if ($gzip_mode) { $conf['cache_default_class'] = 'Redis_CacheCompressed'; } else { $conf['cache_default_class'] = 'Redis_Cache'; } $conf['cache_backends'][] = $cache_redis_path; if ($use_auto_se) { $conf['cache_backends'][] = $auto_se_path; $conf['cache_default_class'] = 'AutoslaveCache'; $conf['autoslave_cache_default_class'] = 'Redis_Cache'; } if ($use_cache_ct) { $conf['cache_backends'][] = $cache_ct_path; $conf['cache_default_class'] = 'ConsistentCache'; if (!is_readable('/data/conf/clstr.cnf')) { $conf['cache_class_cache_form'] = 'DrupalDatabaseCache'; $conf['cache_class_cache_bootstrap'] = 'DrupalDatabaseCache'; } $conf['consistent_cache_default_class'] = 'Redis_Cache'; $conf['consistent_cache_default_safe'] = TRUE; $conf['consistent_cache_buffer_mechanism'] = 'ConsistentCacheBuffer'; $conf['consistent_cache_default_strict'] = FALSE; $conf['consistent_cache_strict_cache_bootstrap'] = TRUE; } if (!is_readable('/data/conf/clstr.cnf')) { $conf['cache_class_cache_form'] = 'DrupalDatabaseCache'; $conf['cache_class_cache_bootstrap'] = 'DrupalDatabaseCache'; } $conf['redis_client_interface'] = 'PhpRedis'; $conf['redis_client_host'] = '127.0.0.1'; $conf['redis_client_port'] = '6379'; $conf['redis_client_password'] = 'isfoobared'; $conf['redis_client_base'] = '8'; $conf['cache_prefix'] = $this_prefix; $conf['page_cache_invoke_hooks'] = TRUE; // D7 == Do not use Aggressive Mode $conf['page_cache_without_database'] = FALSE; // D7 == Do not use Aggressive Mode $conf['page_cache_maximum_age'] = 0; // D7 == max-age in the Cache-Control header (ignored by Speed Booster) $conf['page_cache_max_age'] = 0; // D6 == max-age in the Cache-Control header (ignored by Speed Booster) $conf['cache_lifetime'] = 0; // D7 == BOA uses Speed Booster / Nginx micro-caching instead $conf['page_cache_lifetime'] = 0; // D6 == BOA uses Speed Booster / Nginx micro-caching instead } if ($all_ini['redis_exclude_bins'] && !is_readable('/data/conf/clstr.cnf')) { $excludes = array(); $excludes = explode(",", $all_ini['redis_exclude_bins']); foreach ($excludes as $exclude) { $exclude = rtrim($exclude); $exclude = ltrim($exclude); if ($drupal_core >= 8) { $bin_exclude = $exclude; $settings['cache']['bins'][$bin_exclude] = 'cache.backend.database'; } else { $bin_exclude = 'cache_class_' . $exclude; $conf[$bin_exclude] = 'DrupalDatabaseCache'; } if ($is_dev && !$is_backend) { header("X-Ini-Redis-Exclude-Bin-" . $exclude . ": " . $bin_exclude); } } } } } ================================================ FILE: aegir/conf/global/global-settings.inc ================================================ = 11) { // Drupal core Package Manager: prevent Status report "error" about early testing. $settings['testing_package_manager'] = TRUE; } if ($drupal_core >= 8) { // // Drupal 8 behaviour is confusing, because while it is possible // to force settings listed below, they will not be shown in the // site admin area. For example, CSS/JS aggregation checkboxes // will accept on/off changes on form submit, while being silently // overridden here. // $config['image.settings']['allow_insecure_derivatives'] = TRUE; // Not sure if it's a good idea in D8 $config['image.settings']['suppress_itok_output'] = TRUE; // Not sure if it's a good idea in D8 $config['system.cron']['threshold.autorun'] = FALSE; // Disable poormanscron (legacy) $config['system.cron']['threshold']['auto'] = 0; // Disable auto-cron (current) $config['system.logging']['error_level'] = 'hide'; // Disable errors on screen $config['system.performance']['css']['preprocess'] = TRUE; // Enable hardcoded CSS aggregation $config['system.performance']['js']['preprocess'] = TRUE; // Enable hardcoded JS aggregation $config['system.performance']['response.gzip'] = FALSE; // Nginx already compresses everything //$config['system.file']['default_scheme'] = 'public'; // Force public downloads by default } else { if ($backdropcms) { $conf['css_gzip_compression'] = FALSE; // Nginx already compresses everything $conf['js_gzip_compression'] = FALSE; // Nginx already compresses everything $settings['backdrop_drupal_compatibility'] = TRUE; // Enable Drupal backwards compatibility } $conf['page_compression'] = 0; // Nginx already compresses everything $conf['boost_crawl_on_cron'] = 0; // Deny Boost crawler $conf['cron_safe_threshold'] = 0; // Disable poormanscron $conf['preprocess_css'] = 1; // Enable hardcoded CSS aggregation $conf['preprocess_js'] = 1; // Enable hardcoded JS aggregation $conf['file_downloads'] = 1; // Force public downloads by default in D6 $conf['file_default_scheme'] = 'public'; // Force public downloads by default in D7 $conf['error_level'] = 0; // Disable errors on screen $conf['statistics_enable_access_log'] = 0; // Disable access log stats $conf['allow_authorize_operations'] = FALSE; // Disable insecure plugin manager $conf['admin_menu_cache_client'] = FALSE; // Disable caching in admin_menu #442560 $conf['boost_ignore_htaccess_warning'] = 1; // Silence false alarm in boost $conf['expire_flush_front'] = 1; // Default settings for expire module $conf['expire_flush_node_terms'] = 1; // Default settings for expire module $conf['expire_flush_menu_items'] = 0; // Default settings for expire module $conf['expire_flush_cck_references'] = 0; // Default settings for expire module $conf['expire_include_base_url'] = 1; // Default settings for expire module $conf['js_server_software'] = "other"; // Set JS Callback handler server software $conf['video_ffmpeg_instances'] = 1; // Force safe default for ffmpeg $conf['securepages_enable'] = 1; // Force to avoid issues with ssl proxy $conf['less_devel'] = FALSE; // Prevent CSS regeneration on every page load $conf['drupal_http_request_fails'] = FALSE; // Avoid false alarm $conf['image_allow_insecure_derivatives'] = TRUE; // Enable to avoid known issues: https://drupal.org/drupal-7.20-release-notes $conf['theme_cloudy_settings']['omega_rebuild_aggregates'] = FALSE; // Do not allow to turn it on by default $conf['theme_cloudy_settings']['omega_rebuild_theme_registry'] = FALSE; // Do not allow to turn it on by default $update_free_access = FALSE; $conf['webform_table'] = TRUE; // Workaround for SA-CONTRIB-2015-063 https://www.drupal.org/node/2445935 $conf['features_rebuild_on_flush'] = FALSE; // https://michaelshadle.com/2015/04/21/speeding-up-drupal-cache-flushing $conf['entity_rebuild_on_flush'] = FALSE; // http://a-fro.com/speed-up-cache-clearing-on-drupal7 $conf['redis_eval_enabled'] = TRUE; // Use EVAL commands to greatly speed up cache clearing // Enable when https://www.drupal.org/node/2487333 is fixed } /** * Logic for the front-end only */ if (!$is_backend) { if ($is_dev) { // Dev mode switch error_reporting(E_ALL & ~E_NOTICE); ini_set('display_errors', TRUE); ini_set('display_startup_errors', TRUE); ini_set('opcache.revalidate_freq', '0'); if (!$is_backend) { header("X-Opcache-Revalidate-Freq: 0"); } if ($drupal_core >= 8) { unset($config['system.logging']['error_level']); // Stop hardcoding no errors on screen unset($config['system.performance']['cache.page.max_age']); // Stop hardcoding internal page cache unset($config['system.performance']['css']['preprocess']); // Stop hardcoding CSS aggregation unset($config['system.performance']['js']['preprocess']); // Stop hardcoding JS aggregation if (is_readable('sites/' . $_SERVER['SERVER_NAME'] . '/files/development.services.yml')) { // // This file, if exists, disables Redis on the fly! // $settings['container_yamls'][] = 'sites/' . $_SERVER['SERVER_NAME'] . '/files/development.services.yml'; // // The two settings below make sense only if the development.services.yml file // located in the sites/domain/files/ dir contains at least these three lines: // // services: // cache.backend.null: // class: Drupal\Core\Cache\NullBackendFactory // $settings['cache']['bins']['render'] = 'cache.backend.null'; $settings['cache']['bins']['dynamic_page_cache'] = 'cache.backend.null'; // // Warning: you must clear caches via Ægir interface or with Drush // before these lines will start working on .dev. alias without error 500 // saying: You have requested a non-existent service "cache.backend.null" // // To enable Twig debugging add in the development.services.yml file also lines: // // parameters: // twig.config: // debug: true // auto_reload: true // cache: true // // Note that normally you should not disable Twig cache, since auto_reload // is enough for development and debugging, withot slowing down everything; // see also: https://www.drupal.org/node/1903374 // } } else { $conf['xmlsitemap_submit'] = 0; // Disable XML Sitemap for foo.dev.domain $conf['xmlsitemap_update'] = 0; // Disable XML Sitemap for foo.dev.domain unset($conf['cache']); // Stop hardcoding internal page cache unset($conf['error_level']); // Stop hardcoding no errors on screen unset($conf['less_devel']); // Stop hardcoding CSS regeneration on every page load unset($conf['preprocess_css']); // Stop hardcoding CSS aggregation unset($conf['preprocess_js']); // Stop hardcoding JS aggregation unset($conf['theme_cloudy_settings']['omega_rebuild_aggregates']); // Do not force on dev URLs unset($conf['theme_cloudy_settings']['omega_rebuild_theme_registry']); // Do not force on dev URLs } } else { if (preg_match("/^\/civicrm/", $_SERVER['REQUEST_URI'])) { // Force custom opcache TTL for CiviCRM codebase ini_set('opcache.revalidate_freq', '180'); if (!$is_backend) { header("X-Opcache-Revalidate-Freq: 180"); } } else { // Set sane default opcache TTL on non-dev sites ini_set('opcache.revalidate_freq', '60'); if (!$is_backend) { header("X-Opcache-Revalidate-Freq: 60"); } } } } /** * Enable page caching if disable_drupal_page_cache is not set to TRUE, * but only on non-dev URLs and only for the front-end. */ if (!$is_backend && !$is_dev) { if (!$is_bot && $all_ini['disable_drupal_page_cache']) { if ($drupal_core >= 8) { $config['system.performance']['cache.page.max_age'] = 0; } else { $conf['cache'] = 0; } } else { if ($drupal_core >= 8) { $config['system.performance']['cache.page.max_age'] = 60; } else { $conf['cache'] = 1; } } } /** * Disable page caching when Speed Booster is disabled on the fly */ if (!$is_bot && isset($_SERVER['REQUEST_URI']) && preg_match("/nocache=1/", $_SERVER['REQUEST_URI'])) { if ($drupal_core >= 8) { $config['system.performance']['cache.page.max_age'] = 0; } else { $conf['cache'] = 0; } } /** * Session Cookie TTL settings * * Set session cookie lifetime (in seconds), i.e. the time from the session is * created to the cookie expires, i.e. when the browser is expected to discard * the cookie. The value 0 means "until the browser is closed". */ if ($all_ini['session_cookie_ttl']) { ini_set('session.cookie_lifetime', $all_ini['session_cookie_ttl']); } /** * Session Garbage Collector EOL settings * * Set session lifetime (in seconds), i.e. the time from the user's last visit * to the active session may be deleted by the session garbage collector. When * a session is deleted, authenticated users are logged out, and the contents * of the user's $_SESSION variable is discarded. */ if ($all_ini['session_gc_eol']) { ini_set('session.gc_maxlifetime', $all_ini['session_gc_eol']); } /** * Main section starts here */ if (isset($_SERVER['SERVER_NAME']) && $all_ini['allow_private_file_downloads']) { unset($conf['file_downloads']); // Disable hardcoded public downloads for D6 unset($conf['file_default_scheme']); // Disable hardcoded public downloads for D7 //unset($config['system.file']['default_scheme']); // Disable hardcoded public downloads for D8+ if ($is_dev && !$is_backend) { header('X-Is-Cart: YES'); } } if (isset($_SERVER['HTTP_USER_AGENT']) && isset($_SERVER['USER_DEVICE'])) { $this_device = $_SERVER['USER_DEVICE']; } else { $this_device = 'normal'; } /** * Logic for non-dev URLs only */ if (!$is_dev) { if ($all_ini['advagg_auto_configuration']) { if ($drupal_core == 6) { if (is_readable('modules/o_contrib/advagg/advagg_bundler/advagg_bundler.module') || is_readable('sites/all/modules/advagg/advagg_bundler/advagg_bundler.module')) { $conf['preprocess_css'] = 0; // CSS aggregation disabled $conf['preprocess_js'] = 0; // JS aggregation disabled $conf['advagg_aggregate_mode'] = 1; $conf['advagg_async_generation'] = 1; $conf['advagg_checksum_mode'] = "md5"; $conf['advagg_closure'] = 1; $conf['advagg_css_compress_agg_files'] = 1; $conf['advagg_css_compress_compressor_level'] = "sane"; $conf['advagg_css_compress_inline'] = 1; $conf['advagg_css_compressor'] = 2; $conf['advagg_debug'] = 0; $conf['advagg_dir_htaccess'] = 0; $conf['advagg_enabled'] = 1; $conf['advagg_gzip_compression'] = 1; $conf['advagg_js_compress_agg_files'] = 1; $conf['advagg_js_compress_callback'] = 1; $conf['advagg_js_compress_inline'] = 1; $conf['advagg_js_compress_packer_enable'] = 0; $conf['advagg_js_compressor'] = 1; $conf['advagg_page_cache_mode'] = 0; $conf['advagg_rebuild_on_flush'] = 0; $conf['advagg_server_addr'] = "-1"; } } elseif ($drupal_core == 7) { if (is_readable('modules/o_contrib_seven/advagg/advagg_bundler/advagg_bundler.module') || is_readable('sites/all/modules/advagg/advagg_bundler/advagg_bundler.module')) { $conf['advagg_bundler_active'] = 1; $conf['advagg_cache_level'] = 3; $conf['advagg_combine_css_media'] = 0; $conf['advagg_core_groups'] = 0; $conf['advagg_css_compressor'] = 2; $conf['advagg_css_compress_inline'] = 2; $conf['advagg_css_compress_inline_if_not_cacheable'] = 1; $conf['advagg_enabled'] = 1; $conf['advagg_gzip'] = 1; $conf['advagg_ie_css_selector_limiter'] = 1; $conf['advagg_js_compressor'] = 3; $conf['advagg_js_compress_packer'] = 0; $conf['advagg_js_compress_inline'] = 3; $conf['advagg_js_compress_inline_if_not_cacheable'] = 1; $conf['preprocess_css'] = 1; $conf['preprocess_js'] = 1; } } elseif ($drupal_core >= 8) { if (is_readable('modules/o_contrib_eight/advagg/advagg_bundler/advagg_bundler.module') || is_readable('modules/o_contrib_nine/advagg/advagg_bundler/advagg_bundler.module') || is_readable('modules/o_contrib_ten/advagg/advagg_bundler/advagg_bundler.module') || is_readable('modules/o_contrib_eleven/advagg/advagg_bundler/advagg_bundler.module') || is_readable('modules/advagg/advagg_bundler/advagg_bundler.module') || is_readable('sites/all/modules/advagg/advagg_bundler/advagg_bundler.module')) { $config['advagg.settings']['css']['combine_media'] = false; $config['advagg.settings']['css']['ie']['limit_selectors'] = true; $config['advagg.settings']['cache_level'] = 3; $config['advagg.settings']['core_groups'] = false; $config['advagg.settings']['enabled'] = true; $config['advagg_bundler.settings']['active'] = true; $config['advagg_css_minify.settings']['minifier'] = 2; $config['advagg_js_minify.settings']['minifier'] = 3; $config['system.performance']['css']['preprocess'] = true; $config['system.performance']['js']['preprocess'] = true; } } if ($drupal_core == 6 || $drupal_core == 7) { if (is_readable('modules/o_contrib/httprl/httprl.module') || is_readable('modules/o_contrib_seven/httprl/httprl.module')) { $conf['advagg_use_httprl'] = 1; $conf['httprl_background_callback'] = 1; $conf['httprl_connect_timeout'] = 3; $conf['httprl_dns_timeout'] = 3; $conf['httprl_global_timeout'] = "60"; $conf['httprl_server_addr'] = "-1"; $conf['httprl_timeout'] = "10"; $conf['httprl_ttfb_timeout'] = "5"; // $conf['drupal_http_request_function'] = "httprl_override_core"; } } } } ================================================ FILE: aegir/conf/global/global-valkey.inc ================================================ = 8) { $redis_comprs = TRUE; $redis_dirname = 'redis_eight'; if (!$all_ini['redis_old_eight_mode']) { $redis_dirname = 'redis_compr'; } if ($drupal_core == 10 || $drupal_core == 11) { $redis_new_dirname = 'redis_ten_eleven'; $redis_legacy_dirname = 'redis_nine_ten'; if (is_readable('modules/o_contrib_ten/' . $redis_new_dirname . '/redis.services.yml')) { $redis_dirname = $redis_new_dirname; } elseif (is_readable('modules/o_contrib_ten/' . $redis_legacy_dirname . '/redis.services.yml')) { $redis_dirname = $redis_legacy_dirname; } } elseif ($drupal_core == 9) { $redis_dirname = 'redis_nine_ten'; if ($all_ini['redis_old_nine_mode']) { $redis_dirname = 'redis_compr'; } } } else { $redis_dirname = 'redis_edge'; } if ($is_dev && !$is_backend) { header("X-Valkey-Version-Is: Modern"); header("X-Valkey-Dir-Is: " . $redis_dirname); } if ($all_ini['redis_flush_forced_mode']) { if ($drupal_core >= 8) { $settings['redis_perm_ttl'] = 86400; // 24 hours max $settings['redis_flush_mode'] = 1; // Valkey default is 0 $settings['redis_flush_mode_cache_page'] = 2; // Valkey default is 1 $settings['redis_flush_mode_cache_block'] = 2; // Valkey default is 1 $settings['redis_flush_mode_cache_menu'] = 2; // Valkey default is 0 $settings['redis_flush_mode_cache_metatag'] = 2; // Valkey default is 0 } else { $conf['redis_perm_ttl'] = 86400; // 24 hours max $conf['redis_flush_mode'] = 1; // Valkey default is 0 $conf['redis_flush_mode_cache_page'] = 2; // Valkey default is 1 $conf['redis_flush_mode_cache_block'] = 2; // Valkey default is 1 $conf['redis_flush_mode_cache_menu'] = 2; // Valkey default is 0 $conf['redis_flush_mode_cache_metatag'] = 2; // Valkey default is 0 } // See http://bit.ly/1drmi35 for more information if ($is_dev && !$is_backend) { header("X-Valkey-Flush-Forced-Mode: Forced"); } } } else { $redis_dirname = 'redis'; if ($is_dev && !$is_backend) { header("X-Valkey-Version-Is: Legacy"); header("X-Valkey-Dir-Is: " . $redis_dirname); } } if ($drupal_core >= 8) { if (file_exists('sites/' . $_SERVER['SERVER_NAME'] . '/.redisLegacyOff')) { if ($is_dev && !$is_backend) { header("X-Valkey-Off-Ctrl-Exists: .redisLegacyOff"); } } else { if (is_readable('sites/' . $_SERVER['SERVER_NAME'] . '/files/development.services.yml')) { if ($is_dev && !$is_backend) { header("X-Dev-Services-Yml-Is-Readable: development.services.yml"); } } else { if (is_readable('modules/o_contrib_ten')) { if (is_readable('modules/o_contrib_ten/' . $redis_dirname . '/example.services.yml')) { $cache_valkey = TRUE; $example_failover_path = 'modules/o_contrib_ten/' . $redis_dirname . '/example.failover.services.yml'; $example_services_path = 'modules/o_contrib_ten/' . $redis_dirname . '/example.services.yml'; $cache_gzip_path = 'modules/o_contrib_ten/' . $redis_dirname . '/lib/Redis/CacheCompressed.php'; } if (is_readable('modules/o_contrib_ten/' . $redis_dirname . '/redis.services.yml')) { $cache_valkey = TRUE; $redis_services_path = 'modules/o_contrib_ten/' . $redis_dirname . '/redis.services.yml'; if ($is_dev && !$is_backend) { header("X-Valkey-Services-Is-Readable: " . $redis_services_path); } } } elseif (is_readable('modules/o_contrib_eleven')) { if (is_readable('modules/o_contrib_eleven/' . $redis_dirname . '/example.services.yml')) { $cache_valkey = TRUE; $example_failover_path = 'modules/o_contrib_eleven/' . $redis_dirname . '/example.failover.services.yml'; $example_services_path = 'modules/o_contrib_eleven/' . $redis_dirname . '/example.services.yml'; $cache_gzip_path = 'modules/o_contrib_eleven/' . $redis_dirname . '/lib/Redis/CacheCompressed.php'; } if (is_readable('modules/o_contrib_eleven/' . $redis_dirname . '/redis.services.yml')) { $cache_valkey = TRUE; $redis_services_path = 'modules/o_contrib_eleven/' . $redis_dirname . '/redis.services.yml'; if ($is_dev && !$is_backend) { header("X-Valkey-Services-Is-Readable: " . $redis_services_path); } } } elseif (is_readable('modules/o_contrib_nine')) { if (is_readable('modules/o_contrib_nine/' . $redis_dirname . '/example.services.yml')) { $cache_valkey = TRUE; $example_failover_path = 'modules/o_contrib_nine/' . $redis_dirname . '/example.failover.services.yml'; $example_services_path = 'modules/o_contrib_nine/' . $redis_dirname . '/example.services.yml'; $cache_gzip_path = 'modules/o_contrib_nine/' . $redis_dirname . '/lib/Redis/CacheCompressed.php'; } if (is_readable('modules/o_contrib_nine/' . $redis_dirname . '/redis.services.yml')) { $cache_valkey = TRUE; $redis_services_path = 'modules/o_contrib_nine/' . $redis_dirname . '/redis.services.yml'; if ($is_dev && !$is_backend) { header("X-Valkey-Services-Is-Readable: " . $redis_services_path); } } } elseif (is_readable('modules/o_contrib_eight')) { if (is_readable('modules/o_contrib_eight/' . $redis_dirname . '/example.services.yml')) { $cache_valkey = TRUE; $example_services_path = 'modules/o_contrib_eight/' . $redis_dirname . '/example.services.yml'; $cache_gzip_path = 'modules/o_contrib_eight/' . $redis_dirname . '/lib/Redis/CacheCompressed.php'; if ($is_dev && !$is_backend) { header("X-Example-Services-Is-Readable: " . $example_services_path); } } if (is_readable('modules/o_contrib_eight/' . $redis_dirname . '/redis.services.yml')) { $cache_valkey = TRUE; $redis_services_path = 'modules/o_contrib_eight/' . $redis_dirname . '/redis.services.yml'; if ($is_dev && !$is_backend) { header("X-Valkey-Services-Is-Readable: " . $redis_services_path); } } } } } } elseif ($drupal_core == 7) { if (is_readable('modules/o_contrib_seven/' . $redis_dirname . '/redis.autoload.inc')) { $cache_valkey = TRUE; $cache_backport = FALSE; $cache_redis_path = 'modules/o_contrib_seven/' . $redis_dirname . '/redis.autoload.inc'; $cache_lock_path = 'modules/o_contrib_seven/' . $redis_dirname . '/redis.lock.inc'; $cache_path_path = 'modules/o_contrib_seven/' . $redis_dirname . '/redis.path.inc'; $cache_gzip_path = 'modules/o_contrib_seven/' . $redis_dirname . '/lib/Redis/CacheCompressed.php'; if ($is_dev && !$is_backend) { header("X-Valkey-Autoload-Is-Readable: " . $cache_redis_path); } } if ($all_ini['autoslave_enable']) { if (is_readable('modules/o_contrib_seven/autoslave/autoslave.cache.inc') && is_readable('includes/database/autoslave/database.inc')) { $use_auto_se = TRUE; $gzip_mode = FALSE; $cache_backport = FALSE; $auto_se_path = 'modules/o_contrib_seven/autoslave/autoslave.cache.inc'; if ($is_dev && !$is_backend) { header("X-AutoSlave-Cache-Is-Readable: " . $auto_se_path); } } } if ($all_ini['cache_consistent_enable']) { if (is_readable('modules/o_contrib_seven/cache_consistent/cache_consistent.inc')) { $use_cache_ct = TRUE; $gzip_mode = FALSE; $cache_backport = FALSE; $cache_ct_path = 'modules/o_contrib_seven/cache_consistent/cache_consistent.inc'; if ($is_dev && !$is_backend) { header("X-CacheConsistent-Is-Readable: " . $cache_ct_path); } } } } elseif ($drupal_core == 6) { if (is_readable('modules/o_contrib/cache_backport/cache.inc')) { $cache_backport = TRUE; $cache_backport_path = 'modules/o_contrib/cache_backport/cache.inc'; if ($is_dev && !$is_backend) { header("X-Valkey-Cache-Backport-Is-Readable: " . $cache_backport_path); } } if (is_readable('modules/o_contrib/' . $redis_dirname . '/redis.autoload.inc')) { $cache_valkey = TRUE; $cache_redis_path = 'modules/o_contrib/' . $redis_dirname . '/redis.autoload.inc'; $cache_lock_path = 'modules/o_contrib/' . $redis_dirname . '/redis.lock.inc'; $cache_path_path = 'modules/o_contrib/' . $redis_dirname . '/redis.path.inc'; $cache_gzip_path = 'modules/o_contrib/' . $redis_dirname . '/lib/Redis/CacheCompressed.php'; if ($is_dev && !$is_backend) { header("X-Valkey-Autoload-Is-Readable: " . $cache_redis_path); } } } if ($cache_valkey) { if ($drupal_core >= 8) { if (is_readable('modules/o_contrib_eleven/' . $redis_dirname . '/redis.services.yml')) { $class_loader->addPsr4('Drupal\\redis\\', 'modules/o_contrib_eleven/' . $redis_dirname . '/src'); } elseif (is_readable('modules/o_contrib_ten/' . $redis_dirname . '/redis.services.yml')) { $class_loader->addPsr4('Drupal\\redis\\', 'modules/o_contrib_ten/' . $redis_dirname . '/src'); } elseif (is_readable('modules/o_contrib_nine/' . $redis_dirname . '/redis.services.yml')) { $class_loader->addPsr4('Drupal\\redis\\', 'modules/o_contrib_nine/' . $redis_dirname . '/src'); } else { $class_loader->addPsr4('Drupal\\redis\\', 'modules/o_contrib_eight/' . $redis_dirname . '/src'); } $settings['redis.connection']['interface'] = 'PhpRedis'; $settings['redis.connection']['host'] = '127.0.0.1'; $settings['redis.connection']['port'] = '6379'; $settings['redis.connection']['password'] = 'isfoobared'; $settings['redis.connection']['base'] = '8'; $settings['cache_prefix'] = $this_prefix; $settings['cache']['default'] = 'cache.backend.redis'; if (!is_readable('/data/conf/clstr.cnf')) { $settings['cache']['bins']['bootstrap'] = 'cache.backend.chainedfast'; $settings['cache']['bins']['discovery'] = 'cache.backend.chainedfast'; $settings['cache']['bins']['config'] = 'cache.backend.chainedfast'; } if (is_readable($example_failover_path)) { $settings['container_yamls'][] = $example_failover_path; $settings['redis.failover'] = TRUE; if ($is_dev && !$is_backend) { header("X-Valkey-Failover-Is-Readable: " . $example_failover_path); } } elseif (is_readable($example_services_path)) { $settings['container_yamls'][] = $example_services_path; if ($is_dev && !$is_backend) { header("X-Valkey-Example-Is-Readable: " . $example_services_path); } } if (is_readable($redis_services_path)) { $settings['container_yamls'][] = $redis_services_path; if ($is_dev && !$is_backend) { header("X-Valkey-Services-Is-Readable: " . $redis_services_path); } } if ($drupal_core <= 10) { $settings['queue_default'] = 'queue.redis_reliable'; } if ($redis_comprs) { $settings['redis_compress_length'] = 100; $settings['redis_compress_level'] = 5; } $settings['cache']['bins']['state'] = 'cache.backend.redis'; $settings['state_cache'] = TRUE; $settings['bootstrap_container_definition'] = [ 'parameters' => [], 'services' => [ 'redis.factory' => [ 'class' => 'Drupal\redis\ClientFactory', ], 'cache.backend.redis' => [ 'class' => 'Drupal\redis\Cache\CacheBackendFactory', 'arguments' => ['@redis.factory', '@cache_tags_provider.container', '@serialization.phpserialize'], ], 'cache.container' => [ 'class' => '\Drupal\redis\Cache\PhpRedis', 'factory' => ['@cache.backend.redis', 'get'], 'arguments' => ['container'], ], 'cache_tags_provider.container' => [ 'class' => 'Drupal\redis\Cache\RedisCacheTagsChecksum', 'arguments' => ['@redis.factory'], ], 'serialization.phpserialize' => [ 'class' => 'Drupal\Component\Serialization\PhpSerialize', ], ], ]; } else { if ($cache_backport) { $conf['cache_inc'] = $cache_backport_path; } if ($all_ini['redis_use_modern']) { if ($all_ini['redis_lock_enable']) { $redis_lock = TRUE; } if ($all_ini['redis_path_enable']) { $redis_path = TRUE; } } if (is_readable($cache_lock_path) && $redis_lock) { $conf['lock_inc'] = $cache_lock_path; if ($is_dev && !$is_backend) { header("X-Valkey-Lock-Is-Readable: " . $cache_lock_path); } } if (is_readable($cache_path_path) && $redis_path) { $conf['path_inc'] = $cache_path_path; $conf['path_alias_admin_blacklist'] = FALSE; if ($is_dev && !$is_backend) { header("X-Valkey-Path-Is-Readable: " . $cache_path_path); } } if ($all_ini['redis_scan_enable']) { $conf['redis_scan_delete'] = TRUE; $gzip_mode = FALSE; } else { if (is_readable($cache_gzip_path)) { $gzip_mode = TRUE; } else { $gzip_mode = FALSE; } } if ($gzip_mode) { $conf['cache_default_class'] = 'Redis_CacheCompressed'; } else { $conf['cache_default_class'] = 'Redis_Cache'; } $conf['cache_backends'][] = $cache_redis_path; if ($use_auto_se) { $conf['cache_backends'][] = $auto_se_path; $conf['cache_default_class'] = 'AutoslaveCache'; $conf['autoslave_cache_default_class'] = 'Redis_Cache'; } if ($use_cache_ct) { $conf['cache_backends'][] = $cache_ct_path; $conf['cache_default_class'] = 'ConsistentCache'; if (!is_readable('/data/conf/clstr.cnf')) { $conf['cache_class_cache_form'] = 'DrupalDatabaseCache'; $conf['cache_class_cache_bootstrap'] = 'DrupalDatabaseCache'; } $conf['consistent_cache_default_class'] = 'Redis_Cache'; $conf['consistent_cache_default_safe'] = TRUE; $conf['consistent_cache_buffer_mechanism'] = 'ConsistentCacheBuffer'; $conf['consistent_cache_default_strict'] = FALSE; $conf['consistent_cache_strict_cache_bootstrap'] = TRUE; } if (!is_readable('/data/conf/clstr.cnf')) { $conf['cache_class_cache_form'] = 'DrupalDatabaseCache'; $conf['cache_class_cache_bootstrap'] = 'DrupalDatabaseCache'; } $conf['redis_client_interface'] = 'PhpRedis'; $conf['redis_client_host'] = '127.0.0.1'; $conf['redis_client_port'] = '6379'; $conf['redis_client_password'] = 'isfoobared'; $conf['redis_client_base'] = '8'; $conf['cache_prefix'] = $this_prefix; $conf['page_cache_invoke_hooks'] = TRUE; // D7 == Do not use Aggressive Mode $conf['page_cache_without_database'] = FALSE; // D7 == Do not use Aggressive Mode $conf['page_cache_maximum_age'] = 0; // D7 == max-age in the Cache-Control header (ignored by Speed Booster) $conf['page_cache_max_age'] = 0; // D6 == max-age in the Cache-Control header (ignored by Speed Booster) $conf['cache_lifetime'] = 0; // D7 == BOA uses Speed Booster / Nginx micro-caching instead $conf['page_cache_lifetime'] = 0; // D6 == BOA uses Speed Booster / Nginx micro-caching instead } if ($all_ini['redis_exclude_bins'] && !is_readable('/data/conf/clstr.cnf')) { $excludes = array(); $excludes = explode(",", $all_ini['redis_exclude_bins']); foreach ($excludes as $exclude) { $exclude = rtrim($exclude); $exclude = ltrim($exclude); if ($drupal_core >= 8) { $bin_exclude = $exclude; $settings['cache']['bins'][$bin_exclude] = 'cache.backend.database'; } else { $bin_exclude = 'cache_class_' . $exclude; $conf[$bin_exclude] = 'DrupalDatabaseCache'; } if ($is_dev && !$is_backend) { header("X-Ini-Valkey-Exclude-Bin-" . $exclude . ": " . $bin_exclude); } } } } } ================================================ FILE: aegir/conf/global/global.inc ================================================ = 8) { $settings['reverse_proxy'] = TRUE; $settings['reverse_proxy_header'] = $proxy_header; $settings['reverse_proxy_addresses'] = array($proxy_ip); } } } /** * The nodns mode detection */ if (isset($_SERVER['HTTP_HOST']) && (preg_match("/(?:^nodns\.|\.nodns\.)/i", $_SERVER['HTTP_HOST']))) { $no_dns = TRUE; } /** * Local nodns request detection */ if (isset($_SERVER['REMOTE_ADDR']) && (preg_match("/(^127\.0\.0\.1)$/i", $_SERVER['REMOTE_ADDR']) || preg_match("/(^127\.0\.0\.1\, 127\.0\.0\.1)$/i", $_SERVER['REMOTE_ADDR']))) { $local_req = TRUE; } /** * Local path request check */ if (preg_match("/\/api\/hidden\//", $_SERVER['REQUEST_URI'])) { $hidden_uri = TRUE; } /** * The nodns protection */ if ($no_dns) { if ($local_req) { // Allow local requests if (!$is_backend && isset($_SERVER['REMOTE_ADDR'])) { header("X-Local-Y: " . $_SERVER['REMOTE_ADDR']); } } else { // Ignore remote requests header('X-Accel-Expires: 60'); header('HTTP/1.0 404 Not Found'); header("Connection: close"); exit; } } /** * The hidden uri protection */ if ($hidden_uri) { if ($local_req) { // Allow local requests to hidden uri if (!$is_backend && isset($_SERVER['REMOTE_ADDR'])) { header("X-Local-URI-Y: " . $_SERVER['REMOTE_ADDR']); } } else { // Ignore remote requests header('X-Accel-Expires: 60'); header('HTTP/1.0 404 Not Found'); header("Connection: close"); exit; } } /** * Bots protection for all tmp/dev sites - works also for aliases */ if ($is_bot) { if ($is_tmp) { // Ignore known bots header('X-Accel-Expires: 300'); header('HTTP/1.0 404 Not Found'); header("Connection: close"); exit; } } /** * Site cron protection - cron works only for live sites */ if (preg_match("/^\/cron\.php/", $_SERVER['REQUEST_URI']) || preg_match("/^\/cron\//", $_SERVER['REQUEST_URI'])) { if (($is_tmp) || (file_exists('/data/conf/sites-cron-off.ctrl'))) { // Ignore cron requests header('X-Accel-Expires: 300'); header('HTTP/1.0 404 Not Found'); header("Connection: close"); exit; } } /** * Required for proper Valkey support on command line / via Drush */ if (isset($_SERVER['HTTP_HOST']) && !isset($_SERVER['SERVER_NAME'])) { $_SERVER['SERVER_NAME'] = $_SERVER['HTTP_HOST']; } /** * BOA INI defaults */ $boa_ini = array( 'session_cookie_ttl' => '86400', 'session_gc_eol' => '86400', 'redis_use_modern' => TRUE, 'redis_flush_forced_mode' => TRUE, 'redis_lock_enable' => TRUE, 'redis_path_enable' => TRUE, 'redis_scan_enable' => FALSE, 'redis_cache_disable' => FALSE, 'redis_old_nine_mode' => FALSE, 'redis_old_eight_mode' => FALSE, 'sql_conversion_mode' => FALSE, 'enable_strict_user_register_protection' => FALSE, 'entitycache_dont_enable' => FALSE, 'views_cache_bully_dont_enable' => FALSE, 'views_content_cache_dont_enable' => FALSE, 'autoslave_enable' => FALSE, 'cache_consistent_enable' => FALSE, 'redis_exclude_bins' => FALSE, 'speed_booster_anon_cache_ttl' => FALSE, 'allow_anon_node_add' => FALSE, 'enable_newrelic_integration' => FALSE, 'disable_admin_dos_protection' => FALSE, 'ignore_user_register_protection' => FALSE, 'allow_private_file_downloads' => FALSE, 'server_name_cookie_domain' => FALSE, 'auto_detect_facebook_integration' => TRUE, // For backward compatibility until next release, then FALSE 'auto_detect_domain_access_integration' => TRUE, // For backward compatibility until next release, then FALSE 'advagg_auto_configuration' => FALSE, // Will be set to TRUE in boa_site_control.ini if the module is enabled 'disable_drupal_page_cache' => FALSE, // FALSE for backward compatibility and max performance 'set_composer_manager_vendor_dir' => FALSE, // FALSE by default to not break site installation depending on custom value ); /** * Optional system level early overrides */ if (is_readable('/data/conf/settings.global.inc')) { require_once "/data/conf/settings.global.inc"; } /** * Optional site and platform level settings defined in the ini files * Note: the site-level ini file takes precedence over platform level ini */ $all_ini = $boa_ini; if (is_readable('sites/all/modules/boa_platform_control.ini')) { $ini_plr_src = 'sites/all/modules/boa_platform_control.ini'; } if ($ini_plr_src) { $usr_plr_ini = array(); $usr_plr_ini = parse_ini_file($ini_plr_src); } if (is_readable('sites/' . $_SERVER['SERVER_NAME'] . '/modules/boa_site_control.ini')) { $ini_loc_src = 'sites/' . $_SERVER['SERVER_NAME'] . '/modules/boa_site_control.ini'; } if ($ini_loc_src) { $usr_loc_ini = array(); $usr_loc_ini = parse_ini_file($ini_loc_src); } if (is_array($usr_plr_ini) && $usr_plr_ini) { $all_ini = array_merge($all_ini, $usr_plr_ini); } if (is_array($usr_loc_ini) && $usr_loc_ini) { $all_ini = array_merge($all_ini, $usr_loc_ini); } if (is_array($all_ini) && $is_dev && !$is_backend) { if ($ini_plr_src) { header("X-Ini-Plr-Src: " . $ini_plr_src); } if ($ini_loc_src) { header("X-Ini-Loc-Src: " . $ini_loc_src); } if (!$ini_plr_src && !$ini_loc_src) { header("X-Ini-Src: BOA-Default"); } header("X-Ini-Valkey-Use-Modern: " . $all_ini['redis_use_modern']); header("X-Ini-Valkey-Flush-Forced-Mode: " . $all_ini['redis_flush_forced_mode']); header("X-Ini-Valkey-Lock-Enable: " . $all_ini['redis_lock_enable']); header("X-Ini-Valkey-Path-Enable: " . $all_ini['redis_path_enable']); header("X-Ini-Valkey-Scan-Enable: " . $all_ini['redis_scan_enable']); header("X-Ini-Valkey-Old-Nine-Mode: " . $all_ini['redis_old_nine_mode']); header("X-Ini-Valkey-Old-Eight-Mode: " . $all_ini['redis_old_eight_mode']); header("X-Ini-Valkey-Cache-Disable: " . $all_ini['redis_cache_disable']); header("X-Ini-Valkey-Exclude-Bins: " . $all_ini['redis_exclude_bins']); header("X-Ini-Speed-Booster-Anon-Cache-Ttl: " . $all_ini['speed_booster_anon_cache_ttl']); header("X-Ini-Allow-Anon-Node-Add: " . $all_ini['allow_anon_node_add']); header("X-Ini-Enable-NewRelic-Integration: " . $all_ini['enable_newrelic_integration']); header("X-Ini-Disable-Admin-Dos-Protection: " . $all_ini['disable_admin_dos_protection']); header("X-Ini-Allow-Private-File-Downloads: " . $all_ini['allow_private_file_downloads']); header("X-Ini-Server-Name-Cookie-Domain: " . $all_ini['server_name_cookie_domain']); header("X-Ini-Auto-Detect-Facebook-Integration: " . $all_ini['auto_detect_facebook_integration']); header("X-Ini-Auto-Detect-Domain-Access-Integration: " . $all_ini['auto_detect_domain_access_integration']); header("X-Ini-Advagg-Auto-Configuration: " . $all_ini['advagg_auto_configuration']); header("X-Ini-Sql-Conversion-Mode: " . $all_ini['sql_conversion_mode']); header("X-Ini-Enable-Strict-User-Register-Protection: " . $all_ini['enable_strict_user_register_protection']); header("X-Ini-Entitycache-Dont-Enable: " . $all_ini['entitycache_dont_enable']); header("X-Ini-Views-Cache-Bully-Dont-Enable: " . $all_ini['views_cache_bully_dont_enable']); header("X-Ini-Views-Content-Cache-Dont-Enable: " . $all_ini['views_content_cache_dont_enable']); header("X-Ini-Ignore-User-Register-Protection: " . $all_ini['ignore_user_register_protection']); header("X-Ini-Session-Cookie-Ttl: " . $all_ini['session_cookie_ttl']); header("X-Ini-Session-Gc-Eol: " . $all_ini['session_gc_eol']); header("X-Ini-Disable-Drupal-Page-Cache: " . $all_ini['disable_drupal_page_cache']); header("X-Ini-Set-Composer-Manager-Vendor-Dir: " . $all_ini['set_composer_manager_vendor_dir']); header("X-Ini-AutoSlave-Enable: " . $all_ini['autoslave_enable']); header("X-Ini-CacheConsistent-Enable: " . $all_ini['cache_consistent_enable']); } /** * Disable reporting errors by default - enable later only for foo.dev.domain */ error_reporting(0); /** * Forced default settings */ if ($drupal_core >= 11) { // Drupal core Package Manager: prevent Status report "error" about early testing. $settings['testing_package_manager'] = TRUE; } if ($drupal_core >= 8) { // // Drupal 8 behaviour is confusing, because while it is possible // to force settings listed below, they will not be shown in the // site admin area. For example, CSS/JS aggregation checkboxes // will accept on/off changes on form submit, while being silently // overridden here. // $config['image.settings']['allow_insecure_derivatives'] = TRUE; // Not sure if it's a good idea in D8 $config['image.settings']['suppress_itok_output'] = TRUE; // Not sure if it's a good idea in D8 $config['system.cron']['threshold.autorun'] = FALSE; // Disable poormanscron (legacy) $config['system.cron']['threshold']['auto'] = 0; // Disable auto-cron (current) $config['system.logging']['error_level'] = 'hide'; // Disable errors on screen $config['system.performance']['css']['preprocess'] = TRUE; // Enable hardcoded CSS aggregation $config['system.performance']['js']['preprocess'] = TRUE; // Enable hardcoded JS aggregation $config['system.performance']['response.gzip'] = FALSE; // Nginx already compresses everything //$config['system.file']['default_scheme'] = 'public'; // Force public downloads by default } else { if ($backdropcms) { $conf['css_gzip_compression'] = FALSE; // Nginx already compresses everything $conf['js_gzip_compression'] = FALSE; // Nginx already compresses everything $settings['backdrop_drupal_compatibility'] = TRUE; // Enable Drupal backwards compatibility } $conf['page_compression'] = 0; // Nginx already compresses everything $conf['boost_crawl_on_cron'] = 0; // Deny Boost crawler $conf['cron_safe_threshold'] = 0; // Disable poormanscron $conf['preprocess_css'] = 1; // Enable hardcoded CSS aggregation $conf['preprocess_js'] = 1; // Enable hardcoded JS aggregation $conf['file_downloads'] = 1; // Force public downloads by default in D6 $conf['file_default_scheme'] = 'public'; // Force public downloads by default in D7 $conf['error_level'] = 0; // Disable errors on screen $conf['statistics_enable_access_log'] = 0; // Disable access log stats $conf['allow_authorize_operations'] = FALSE; // Disable insecure plugin manager $conf['admin_menu_cache_client'] = FALSE; // Disable caching in admin_menu #442560 $conf['boost_ignore_htaccess_warning'] = 1; // Silence false alarm in boost $conf['expire_flush_front'] = 1; // Default settings for expire module $conf['expire_flush_node_terms'] = 1; // Default settings for expire module $conf['expire_flush_menu_items'] = 0; // Default settings for expire module $conf['expire_flush_cck_references'] = 0; // Default settings for expire module $conf['expire_include_base_url'] = 1; // Default settings for expire module $conf['js_server_software'] = "other"; // Set JS Callback handler server software $conf['video_ffmpeg_instances'] = 1; // Force safe default for ffmpeg $conf['securepages_enable'] = 1; // Force to avoid issues with ssl proxy $conf['less_devel'] = FALSE; // Prevent CSS regeneration on every page load $conf['drupal_http_request_fails'] = FALSE; // Avoid false alarm $conf['image_allow_insecure_derivatives'] = TRUE; // Enable to avoid known issues: https://drupal.org/drupal-7.20-release-notes $conf['theme_cloudy_settings']['omega_rebuild_aggregates'] = FALSE; // Do not allow to turn it on by default $conf['theme_cloudy_settings']['omega_rebuild_theme_registry'] = FALSE; // Do not allow to turn it on by default $update_free_access = FALSE; $conf['webform_table'] = TRUE; // Workaround for SA-CONTRIB-2015-063 https://www.drupal.org/node/2445935 $conf['features_rebuild_on_flush'] = FALSE; // https://michaelshadle.com/2015/04/21/speeding-up-drupal-cache-flushing $conf['entity_rebuild_on_flush'] = FALSE; // http://a-fro.com/speed-up-cache-clearing-on-drupal7 $conf['redis_eval_enabled'] = TRUE; // Use EVAL commands to greatly speed up cache clearing // Enable when https://www.drupal.org/node/2487333 is fixed } /** * Logic for the front-end only */ if (!$is_backend) { if (isset($_SERVER['HTTP_HOST']) && $is_bot) { if (preg_match("/(?:^tmp\.|\.test\.|\.tmp\.)/i", $_SERVER['HTTP_HOST'])) { // Deny known search bots on ^(tmp|foo.(tmp|test)).domain subdomains header('X-Accel-Expires: 60'); header("Location: http://www.aegirproject.org/", true, 301); exit; } elseif (preg_match("/\.(?:host8|boa|aegir|o8)\.(?:biz|io|cc)$/i", $_SERVER['HTTP_HOST'])) { // Deny known search bots on some protected CI subdomains header('X-Accel-Expires: 60'); header("Location: https://omega8.cc/", true, 301); exit; } } if ($is_dev) { // Dev mode switch error_reporting(E_ALL & ~E_NOTICE); ini_set('display_errors', TRUE); ini_set('display_startup_errors', TRUE); ini_set('opcache.revalidate_freq', '0'); if (!$is_backend) { header("X-Opcache-Revalidate-Freq: 0"); } if ($drupal_core >= 8) { unset($config['system.logging']['error_level']); // Stop hardcoding no errors on screen unset($config['system.performance']['cache.page.max_age']); // Stop hardcoding internal page cache unset($config['system.performance']['css']['preprocess']); // Stop hardcoding CSS aggregation unset($config['system.performance']['js']['preprocess']); // Stop hardcoding JS aggregation if (is_readable('sites/' . $_SERVER['SERVER_NAME'] . '/files/development.services.yml')) { // // This file, if exists, disables Valkey on the fly! // $settings['container_yamls'][] = 'sites/' . $_SERVER['SERVER_NAME'] . '/files/development.services.yml'; // // The two settings below make sense only if the development.services.yml file // located in the sites/domain/files/ dir contains at least these three lines: // // services: // cache.backend.null: // class: Drupal\Core\Cache\NullBackendFactory // $settings['cache']['bins']['render'] = 'cache.backend.null'; $settings['cache']['bins']['dynamic_page_cache'] = 'cache.backend.null'; // // Warning: you must clear caches via Ægir interface or with Drush // before these lines will start working on .dev. alias without error 500 // saying: You have requested a non-existent service "cache.backend.null" // // To enable Twig debugging add in the development.services.yml file also lines: // // parameters: // twig.config: // debug: true // auto_reload: true // cache: true // // Note that normally you should not disable Twig cache, since auto_reload // is enough for development and debugging, withot slowing down everything; // see also: https://www.drupal.org/node/1903374 // } } else { $conf['xmlsitemap_submit'] = 0; // Disable XML Sitemap for foo.dev.domain $conf['xmlsitemap_update'] = 0; // Disable XML Sitemap for foo.dev.domain unset($conf['cache']); // Stop hardcoding internal page cache unset($conf['error_level']); // Stop hardcoding no errors on screen unset($conf['less_devel']); // Stop hardcoding CSS regeneration on every page load unset($conf['preprocess_css']); // Stop hardcoding CSS aggregation unset($conf['preprocess_js']); // Stop hardcoding JS aggregation unset($conf['theme_cloudy_settings']['omega_rebuild_aggregates']); // Do not force on dev URLs unset($conf['theme_cloudy_settings']['omega_rebuild_theme_registry']); // Do not force on dev URLs } } else { if (preg_match("/^\/civicrm/", $_SERVER['REQUEST_URI'])) { // Force custom opcache TTL for CiviCRM codebase ini_set('opcache.revalidate_freq', '180'); if (!$is_backend) { header("X-Opcache-Revalidate-Freq: 180"); } } else { // Set sane default opcache TTL on non-dev sites ini_set('opcache.revalidate_freq', '60'); if (!$is_backend) { header("X-Opcache-Revalidate-Freq: 60"); } } } } /** * Enable page caching if disable_drupal_page_cache is not set to TRUE, * but only on non-dev URLs and only for the front-end. */ if (!$is_backend && !$is_dev) { if (!$is_bot && $all_ini['disable_drupal_page_cache']) { if ($drupal_core >= 8) { $config['system.performance']['cache.page.max_age'] = 0; } else { $conf['cache'] = 0; } } else { if ($drupal_core >= 8) { $config['system.performance']['cache.page.max_age'] = 60; } else { $conf['cache'] = 1; } } } /** * Disable page caching when Speed Booster is disabled on the fly */ if (!$is_bot && isset($_SERVER['REQUEST_URI']) && preg_match("/nocache=1/", $_SERVER['REQUEST_URI'])) { if ($drupal_core >= 8) { $config['system.performance']['cache.page.max_age'] = 0; } else { $conf['cache'] = 0; } } /** * Session Cookie TTL settings * * Set session cookie lifetime (in seconds), i.e. the time from the session is * created to the cookie expires, i.e. when the browser is expected to discard * the cookie. The value 0 means "until the browser is closed". */ ini_set('session.cookie_lifetime', $all_ini['session_cookie_ttl']); /** * Session Garbage Collector EOL settings * * Set session lifetime (in seconds), i.e. the time from the user's last visit * to the active session may be deleted by the session garbage collector. When * a session is deleted, authenticated users are logged out, and the contents * of the user's $_SESSION variable is discarded. */ ini_set('session.gc_maxlifetime', $all_ini['session_gc_eol']); /** * Hostmaster specific settings */ if ($conf['install_profile'] == 'hostmaster') { $conf['hosting_require_disable_before_delete'] = 0; $conf['hosting_task_refresh_timeout'] = 5555; $conf['theme_link'] = FALSE; $conf['cache'] = 0; if (!$is_backend && isset($_SERVER['HTTP_USER_AGENT'])) { $conf['environment_indicator_overwrite'] = TRUE; $conf['environment_indicator_overwritten_position'] = 'top'; if (is_readable('/data/conf/development-env.ctrl')) { $conf['environment_indicator_overwritten_name'] = 'Development'; $conf['environment_indicator_overwritten_color'] = '#00AA00'; // Green } elseif (is_readable('/data/conf/staging-env.ctrl')) { $conf['environment_indicator_overwritten_name'] = 'Staging'; $conf['environment_indicator_overwritten_color'] = '#FFCC00'; // Yellow } elseif (is_readable('/data/conf/production-env.ctrl')) { $conf['environment_indicator_overwritten_name'] = 'Production'; $conf['environment_indicator_overwritten_color'] = '#CC0000'; // Red } elseif (is_readable('/data/conf/testing-env.ctrl')) { $conf['environment_indicator_overwritten_name'] = 'Testing'; $conf['environment_indicator_overwritten_color'] = '#FF69B4'; // Hot Pink //$conf['environment_indicator_overwritten_color'] = '#FFC0CB'; // Light Pink } else { $conf['environment_indicator_overwritten_name'] = 'Production'; $conf['environment_indicator_overwritten_color'] = '#CC0000'; // Red } ini_set('session.cookie_lifetime', 0); // Force log-out on browser quit header('X-Accel-Expires: 1'); if (!file_exists('/data/conf/no-https-aegir.inc')) { $request_type = ($_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https' || $_SERVER['HTTPS'] == 'on') ? 'SSL' : 'NONSSL'; if ($request_type != "SSL" && !preg_match("/^\/cron\.php/", $_SERVER['REQUEST_URI'])) { // we force secure connection here header('X-Accel-Expires: 5'); header("Location: https://" . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'], true, 301); exit; } } if (isset($_SERVER['HTTP_HOST']) && preg_match("/\.(?:host8|boa|aegir|o8)\.(?:biz|io|cc)$/i", $_SERVER['HTTP_HOST'])) { if (preg_match("/^\/admin\/user\/user\/create/", $_SERVER['REQUEST_URI']) || preg_match("/^\/node\/add\/server/", $_SERVER['REQUEST_URI']) || preg_match("/^\/node\/(?:1|2|4|5|7|8|10)\/(?:edit|delete)/", $_SERVER['REQUEST_URI'])) { header('X-Accel-Expires: 5'); header("Location: https://" . $_SERVER['HTTP_HOST'] . "/hosting/sites", true, 301); exit; } } } else { $use_valkey = TRUE; } } /** * Main section starts here */ if (isset($_SERVER['SERVER_NAME']) && $all_ini['allow_private_file_downloads']) { unset($conf['file_downloads']); // Disable hardcoded public downloads for D6 unset($conf['file_default_scheme']); // Disable hardcoded public downloads for D7 //unset($config['system.file']['default_scheme']); // Disable hardcoded public downloads for D8+ if ($is_dev && !$is_backend) { header('X-Is-Cart: YES'); } } /* ---------------- Feature switch -------------------------------------- */ if ($drupal_core >= 6) { $use_valkey = TRUE; } if (isset($_SERVER['SERVER_NAME'])) { if ($all_ini['valkey_cache_disable'] || $all_ini['redis_cache_disable']) { $use_valkey = FALSE; } } if (!$is_bot && isset($_SERVER['REQUEST_URI'])) { if (preg_match("/noredis=1/", $_SERVER['REQUEST_URI'])) { $use_valkey = FALSE; } } /* ---------------- Defaults -------------------------------------------- */ $valkey_up = FALSE; /* ---------------- Connection targets ---------------------------------- */ $valkey_socket_path = '/run/valkey/valkey.sock'; $valkey_host = '127.0.0.1'; $valkey_port = 6379; $valkey_pass_file = '/data/conf/valkey/pass.inc'; /* ---------------- Timeouts & backoff ---------------------------------- */ $connect_timeout_s = 0.2; // short and non-blocking feel $read_timeout_s = 0.2; // keep calls snappy $backoff_ttl_s = 60; // do not retry within this window after a failure $flag_dir_run = '/var/tmp/fpm'; $flag_file_fallback = '/data/conf/arch/valkey.disabled.flag'; // fallback /* ---------------- Optional debug log ---------------------------------- */ // Set to an absolute path to enable lightweight probe logging. // Example: '/var/tmp/fpm/valkey-fallback.log' $redis_debug_log = ''; /* ---------------- Helpers (filesystem only) ---------------------------- */ function _valkey_backoff_flag_path($flag_dir_run, $fallback) { $path = $fallback; if (is_dir($flag_dir_run)) { if (is_writable($flag_dir_run)) { $path = rtrim($flag_dir_run, '/').'/valkey.disabled.flag'; } } return $path; } function _valkey_backoff_is_active($flag_path, $ttl) { $active = FALSE; if (is_file($flag_path)) { $age = time() - @filemtime($flag_path); if ($age >= 0 && $age < $ttl) { $active = TRUE; } } return $active; } function _valkey_backoff_touch($flag_path) { @touch($flag_path); } function _valkey_backoff_clear($flag_path) { if (is_file($flag_path)) { @unlink($flag_path); } } function _valkey_dbg_write($log_path, $line) { if (!empty($log_path)) { $msg = date('c').' '.$line."\n"; @file_put_contents($log_path, $msg, FILE_APPEND); } } /* ------------------- Probe Valkey once with guard --------------------- */ $flag_path = _valkey_backoff_flag_path($flag_dir_run, $flag_file_fallback); $skip_probe = _valkey_backoff_is_active($flag_path, $backoff_ttl_s); if ($use_valkey) { if (!$skip_probe) { if (class_exists('Redis')) { $r = new Redis(); $connected = FALSE; $last_reason = 'init'; // Try socket first. if (!empty($valkey_socket_path) && @is_readable($valkey_socket_path)) { try { $connected = $r->connect($valkey_socket_path); } catch (Exception $e) { $connected = FALSE; $last_reason = 'connect-socket-exception'; } } // Fallback to TCP. if (!$connected) { try { $connected = $r->connect($valkey_host, $valkey_port, $connect_timeout_s); } catch (Exception $e) { $connected = FALSE; $last_reason = 'connect-tcp-exception'; } } if ($connected) { if (defined('Redis::OPT_READ_TIMEOUT')) { $r->setOption(Redis::OPT_READ_TIMEOUT, $read_timeout_s); } // Authenticate if password file exists. $auth_pass = 'isfoobared'; if (is_file($valkey_pass_file)) { $auth_pass = trim((string) @file_get_contents($valkey_pass_file)); } if ($auth_pass !== '') { try { if (!$r->auth($auth_pass)) { $connected = FALSE; $last_reason = 'auth-failed'; } } catch (Exception $e) { $connected = FALSE; $last_reason = 'auth-exception'; } } // Verify ping. if ($connected) { try { $pong = $r->ping(); if ((is_string($pong) && stripos($pong, 'PONG') !== FALSE) || $pong === TRUE) { $valkey_up = TRUE; } else { $valkey_up = FALSE; $last_reason = 'ping-not-ok'; } } catch (Exception $e) { $valkey_up = FALSE; $last_reason = 'ping-exception'; } } if ($valkey_up) { _valkey_backoff_clear($flag_path); _valkey_dbg_write($redis_debug_log, 'VALKEY UP action=clear flag='.$flag_path.' reason=ok'); } else { _valkey_backoff_touch($flag_path); _valkey_dbg_write($redis_debug_log, 'VALKEY DOWN action=touch flag='.$flag_path.' reason='.(string) $last_reason); } try { $r->close(); } catch (Exception $e) { // ignore } } else { _valkey_backoff_touch($flag_path); _valkey_dbg_write($redis_debug_log, 'VALKEY DOWN action=touch flag='.$flag_path.' reason='.(string) $last_reason); } } else { // phpredis extension not available. $valkey_up = FALSE; _valkey_backoff_touch($flag_path); _valkey_dbg_write($redis_debug_log, 'VALKEY DOWN action=touch flag='.$flag_path.' reason=no-phpredis'); } } else { $valkey_up = FALSE; _valkey_dbg_write($redis_debug_log, 'VALKEY SKIP reason=backoff-active flag='.$flag_path); } } /* ---------------- Diagnostics & final guard ---------------------------- */ if (!empty($is_dev)) { if (empty($is_backend)) { if ($use_valkey && $valkey_up) { header('X-Allow-Valkey: YES'); } else { header('X-Allow-Valkey: NO'); } } } if (!empty($is_install)) { $use_valkey = FALSE; } if ($all_ini['auto_detect_domain_access_integration']) { if (is_readable('sites/all/modules/domain/settings.inc')) { $da_inc = 'sites/all/modules/domain/settings.inc'; } elseif (is_readable('sites/all/modules/contrib/domain/settings.inc')) { $da_inc = 'sites/all/modules/contrib/domain/settings.inc'; } elseif (is_readable('profiles/' . $conf['install_profile'] . '/modules/domain/settings.inc')) { $da_inc = 'profiles/' . $conf['install_profile'] . '/modules/domain/settings.inc'; } elseif (is_readable('profiles/' . $conf['install_profile'] . '/modules/contrib/domain/settings.inc')) { $da_inc = 'profiles/' . $conf['install_profile'] . '/modules/contrib/domain/settings.inc'; } } /** * Activate mail_safety for sites-cron-off on the fly */ if (is_readable('/data/conf/sites-cron-off.ctrl')) { if ($drupal_core >= 8) { $config['automated_cron.settings']['interval'] = 0; $config['mail_safety.settings']['default_mail_address'] = ''; $config['mail_safety.settings']['enabled'] = TRUE; $config['mail_safety.settings']['send_mail_to_dashboard'] = TRUE; $config['mail_safety.settings']['send_mail_to_default_mail'] = FALSE; $config['scheduler.settings']['lightweight_cron_access_key'] = ''; $config['simple_cron.settings']['interval'] = 0; $config['system.cron']['key'] = ''; $config['system.cron']['last'] = 0; $config['system.cron']['threshold']['auto'] = 0; $config['ultimate_cron.job.cron_queue']['status'] = FALSE; $config['ultimate_cron.settings']['scheduler'] = 'never'; } else { $conf['mail_safety_enabled'] = TRUE; $conf['mail_safety_send_mail_to_dashboard'] = TRUE; } } /** * Use site specific composer_manager dir */ if ($all_ini['set_composer_manager_vendor_dir'] && !$is_install) { if ($drupal_core >= 8) { $config['composer_manager.settings']['vendor_dir'] = 'sites/' . $_SERVER['SERVER_NAME'] . '/vendor'; } else { $conf['composer_manager_vendor_dir'] = 'sites/' . $_SERVER['SERVER_NAME'] . '/vendor'; } } if (!empty($is_install)) { $da_inc = FALSE; } if (isset($_SERVER['HTTP_USER_AGENT']) && isset($_SERVER['USER_DEVICE'])) { $this_device = $_SERVER['USER_DEVICE']; } else { $this_device = 'normal'; } /** * Logic for non-dev URLs only */ if (!$is_dev) { if ($all_ini['advagg_auto_configuration']) { if ($drupal_core == 6) { if (is_readable('modules/o_contrib/advagg/advagg_bundler/advagg_bundler.module') || is_readable('sites/all/modules/advagg/advagg_bundler/advagg_bundler.module')) { $conf['preprocess_css'] = 0; // CSS aggregation disabled $conf['preprocess_js'] = 0; // JS aggregation disabled $conf['advagg_aggregate_mode'] = 1; $conf['advagg_async_generation'] = 1; $conf['advagg_checksum_mode'] = "md5"; $conf['advagg_closure'] = 1; $conf['advagg_css_compress_agg_files'] = 1; $conf['advagg_css_compress_compressor_level'] = "sane"; $conf['advagg_css_compress_inline'] = 1; $conf['advagg_css_compressor'] = 2; $conf['advagg_debug'] = 0; $conf['advagg_dir_htaccess'] = 0; $conf['advagg_enabled'] = 1; $conf['advagg_gzip_compression'] = 1; $conf['advagg_js_compress_agg_files'] = 1; $conf['advagg_js_compress_callback'] = 1; $conf['advagg_js_compress_inline'] = 1; $conf['advagg_js_compress_packer_enable'] = 0; $conf['advagg_js_compressor'] = 1; $conf['advagg_page_cache_mode'] = 0; $conf['advagg_rebuild_on_flush'] = 0; $conf['advagg_server_addr'] = "-1"; } } elseif ($drupal_core == 7) { if (is_readable('modules/o_contrib_seven/advagg/advagg_bundler/advagg_bundler.module') || is_readable('sites/all/modules/advagg/advagg_bundler/advagg_bundler.module')) { $conf['advagg_bundler_active'] = 1; $conf['advagg_cache_level'] = 3; $conf['advagg_combine_css_media'] = 0; $conf['advagg_core_groups'] = 0; $conf['advagg_css_compressor'] = 2; $conf['advagg_css_compress_inline'] = 2; $conf['advagg_css_compress_inline_if_not_cacheable'] = 1; $conf['advagg_enabled'] = 1; $conf['advagg_gzip'] = 1; $conf['advagg_ie_css_selector_limiter'] = 1; $conf['advagg_js_compressor'] = 3; $conf['advagg_js_compress_packer'] = 0; $conf['advagg_js_compress_inline'] = 3; $conf['advagg_js_compress_inline_if_not_cacheable'] = 1; $conf['preprocess_css'] = 1; $conf['preprocess_js'] = 1; } } elseif ($drupal_core >= 8) { if (is_readable('modules/o_contrib_eight/advagg/advagg_bundler/advagg_bundler.module') || is_readable('modules/o_contrib_nine/advagg/advagg_bundler/advagg_bundler.module') || is_readable('modules/o_contrib_ten/advagg/advagg_bundler/advagg_bundler.module') || is_readable('modules/o_contrib_eleven/advagg/advagg_bundler/advagg_bundler.module') || is_readable('modules/advagg/advagg_bundler/advagg_bundler.module') || is_readable('sites/all/modules/advagg/advagg_bundler/advagg_bundler.module')) { $config['advagg.settings']['css']['combine_media'] = false; $config['advagg.settings']['css']['ie']['limit_selectors'] = true; $config['advagg.settings']['cache_level'] = 3; $config['advagg.settings']['core_groups'] = false; $config['advagg.settings']['enabled'] = true; $config['advagg_bundler.settings']['active'] = true; $config['advagg_css_minify.settings']['minifier'] = 2; $config['advagg_js_minify.settings']['minifier'] = 3; $config['system.performance']['css']['preprocess'] = true; $config['system.performance']['js']['preprocess'] = true; } } if ($drupal_core == 6 || $drupal_core == 7) { if (is_readable('modules/o_contrib/httprl/httprl.module') || is_readable('modules/o_contrib_seven/httprl/httprl.module')) { $conf['advagg_use_httprl'] = 1; $conf['httprl_background_callback'] = 1; $conf['httprl_connect_timeout'] = 3; $conf['httprl_dns_timeout'] = 3; $conf['httprl_global_timeout'] = "60"; $conf['httprl_server_addr'] = "-1"; $conf['httprl_timeout'] = "10"; $conf['httprl_ttfb_timeout'] = "5"; // $conf['drupal_http_request_function'] = "httprl_override_core"; } } } } /** * More logic for the front-end only */ if (!$is_backend && isset($_SERVER['HTTP_HOST']) && isset($_SERVER['SERVER_NAME'])) { if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) || isset($_SERVER['HTTPS'])) { $conf['https'] = TRUE; $request_type = ($_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https' || $_SERVER['HTTPS'] == 'on') ? 'SSL' : 'NONSSL'; if ($request_type == "SSL") { // we check for secure connection to set correct base_url $base_url = 'https://' . $_SERVER['HTTP_HOST']; if ($conf['install_profile'] != 'hostmaster') { $_SERVER['HTTPS'] = 'on'; if ($drupal_core >= 7) { ini_set('session.cookie_secure', TRUE); if ($is_dev) { header('X-Cookie-Sec: YES'); } } } if ($is_dev) { header('X-Local-Proto: https'); } } else { if ($site_subdir && $raw_host) { $base_url = 'http://' . $raw_host . '/' . $site_subdir; } else { $base_url = 'http://' . $_SERVER['HTTP_HOST']; } } } else { if ($site_subdir && $raw_host) { $base_url = 'http://' . $raw_host . '/' . $site_subdir; } else { $base_url = 'http://' . $_SERVER['HTTP_HOST']; } } if ($base_url && $is_dev) { header("X-Base-Url: " . $base_url); } if ($site_subdir && $is_dev) { header("X-Site-Subdir: " . $site_subdir); } if ($all_ini['server_name_cookie_domain']) { $domain = '.' . preg_replace('`^www\.`', '', $_SERVER['SERVER_NAME']); } elseif ($site_subdir && isset($_SERVER['RAW_HOST'])) { $domain = '.' . preg_replace('`^www\.`', '', $_SERVER['RAW_HOST']); } else { $domain = '.' . preg_replace('`^www\.`', '', $_SERVER['HTTP_HOST']); } $domain = str_replace('..', '.', $domain); if (count(explode('.', $domain)) > 2 && !is_numeric(str_replace('.', '', $domain))) { ini_set('session.cookie_domain', $domain); $cookie_domain = $domain; header("X-Cookie-Domain: " . $cookie_domain); } $this_prefix = preg_replace('`^www\.`', '', $_SERVER['SERVER_NAME']) . '_z_'; if ($is_dev) { header("X-Valkey-Prefix: " . $this_prefix); } if (isset($_SERVER['REQUEST_TIME']) && isset($_SERVER['REMOTE_ADDR']) && isset($_SERVER['HTTP_USER_AGENT']) && !preg_match("/^\/esi\//", $_SERVER['REQUEST_URI'])) { // Determine if the site is running on HTTPS $request_type = 'NONSSL'; if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) || isset($_SERVER['HTTPS'])) { $request_type = ($_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https' || $_SERVER['HTTPS'] == 'on') ? 'SSL' : 'NONSSL'; } if ($request_type == "SSL") { $is_https = TRUE; if ($is_dev) { header('X-Request-Type:' . $request_type); } } else { $is_https = FALSE; if ($is_dev) { header('X-Request-Type:' . $request_type); } } // Create a unique identifier for the request $identity = $_SERVER['REQUEST_TIME'] . $_SERVER['REMOTE_ADDR'] . $_SERVER['SERVER_NAME'] . $_SERVER['HTTP_USER_AGENT']; $identity = 'BD' . md5($identity); if ($is_dev) { header('X-Identity:' . $identity); } if ($drupal_core >= 8) { // Check if the user is logged in by looking for the session cookie. // The session cookie name starts with "SESS" or "SSESS" followed by a hash. // This check is not site specific in Drupal 8+ like it is in Drupal 7 // or Drupal 6, but should be sufficient for the intended use case below. $cookie_prefix = ini_get('session.cookie_secure') ? 'SSESS' : 'SESS'; $is_logged_in = FALSE; foreach ($_COOKIE as $key => $value) { if (strpos($key, $cookie_prefix) == 0) { $is_logged_in = TRUE; break; } } if ($is_dev) { header('X-Cookie-Prefix-A:' . $cookie_prefix); header('X-Is-Logged-In-A:' . $is_logged_in); } } elseif ($drupal_core == 7) { // For Drupal 7 use sha256 hash and cookie prefix based on session.cookie_secure $cookie_prefix = ini_get('session.cookie_secure') ? 'SSESS' : 'SESS'; $test_sess_name = $cookie_prefix . substr(hash('sha256', $cookie_domain), 0, 32); if ($is_dev) { header('X-Cookie-Prefix-B:' . $cookie_prefix); header('X-Test-Sess-Name-B:' . $test_sess_name); } } else { // For Drupal 6 use md5 hash and SESS prefix only $cookie_prefix = 'SESS'; $test_sess_name = $cookie_prefix . md5($cookie_domain); if ($is_dev) { header('X-Cookie-Prefix-C:' . $cookie_prefix); header('X-Test-Sess-Name-C:' . $test_sess_name); } } // Check if the session cookie is present if (isset($_COOKIE[$test_sess_name]) || $is_logged_in) { $is_anon = 'LOGGED'; } else { $is_anon = 'ANONYMOUS'; } if ($is_dev) { header('X-Is-Anon:' . $is_anon); } // Redirect not logged in visitors to homepage to protect admin URLs from bots if ($is_anon == 'ANONYMOUS') { if (preg_match("/\/(?:node\/[0-9]+\/edit|node\/add)/", $_SERVER['REQUEST_URI'])) { if (empty($all_ini['allow_anon_node_add'])) { header("Location: " . $base_url . "/", true, 301); exit; } } if (preg_match("/^\/(?:[a-z]{2}\/)?(?:admin|logout|privatemsg|approve)/", $_SERVER['REQUEST_URI'])) { if (empty($all_ini['disable_admin_dos_protection'])) { header("Location: " . $base_url . "/", true, 301); exit; } } } // Additional logic for caching or other needs if ($is_anon == 'ANONYMOUS' && !empty($all_ini['speed_booster_anon_cache_ttl']) && preg_match("/^[0-9]{2,}$/", $all_ini['speed_booster_anon_cache_ttl'])) { if ($all_ini['speed_booster_anon_cache_ttl'] > 10) { $expire_in_seconds = $all_ini['speed_booster_anon_cache_ttl']; header('X-Limit-Booster:' . $all_ini['speed_booster_anon_cache_ttl']); } } // Prevent turning the feature server site into a spam machine // Disable self-registration also on hostmaster if ($conf['install_profile'] == 'feature_server' || $conf['install_profile'] == 'hostmaster') { $conf['user_register'] = 0; // Force "Only site administrators can create new user accounts" } if (!$is_bot && !$high_traffic) { if (preg_match("/^\/(?:[a-z]{2}\/)?(?:admin|cart|checkout|logout|privatemsg)/", $_SERVER['REQUEST_URI']) || preg_match("/\/(?:node\/[0-9]+\/edit|node\/add|comment\/reply|approve|ajax_comments|commerce_currency_select)/", $_SERVER['REQUEST_URI']) || preg_match("/(?:^dev\.|\.dev\.|\.devel\.)/", $_SERVER['HTTP_HOST'])) { $expire_in_seconds = '1'; header('X-Limit-Booster: 1'); } if (isset($_SERVER['REQUEST_URI']) && preg_match("/(?:x-progress-id|ahah|progress\/|autocomplete|ajax|batch|js\/.*)/i", $_SERVER['REQUEST_URI'])) { $expire_in_seconds = '0'; if ($is_dev) { header('X-Skip-Booster: AjaxRU'); } } if (isset($_SERVER['QUERY_STRING']) && preg_match("/(?:x-progress-id|ahah|progress\/|autocomplete|ajax|batch|js\/.*)/i", $_SERVER['QUERY_STRING'])) { $expire_in_seconds = '0'; if ($is_dev) { header('X-Skip-Booster: AjaxQS'); } } if (isset($_SERVER['REQUEST_METHOD']) && $_SERVER['REQUEST_METHOD'] == 'POST') { if (!isset($_COOKIE['NoCacheID'])) { $lifetime = '15'; setcookie('NoCacheID', 'POST' . $identity, $_SERVER['REQUEST_TIME'] + $lifetime, '/', $cookie_domain); } $expire_in_seconds = '0'; if ($is_dev) { header('X-Skip-Booster: PostRM'); } } } if ($is_bot) { if (!preg_match("/Pingdom/i", $_SERVER['HTTP_USER_AGENT']) && !preg_match("/(?:rss|feed)/i", $_SERVER['REQUEST_URI'])) { $expire_in_seconds = '3600'; if ($is_dev) { header('X-Bot-Booster: 3600'); } } } if ($conf['install_profile'] != 'hostmaster' && ($expire_in_seconds > -1)) { header("X-Accel-Expires: " . $expire_in_seconds); if ($expire_in_seconds > -1 && $expire_in_seconds < 2) { $conf['cache'] = 0; // Disable page caching on the fly } } } } /** * Support files/styles with short URIs also for files not generated yet */ if (preg_match("/^\/files\/styles\//", $_SERVER['REQUEST_URI'])) { header("Location: " . $base_url . "/sites/" . $_SERVER['SERVER_NAME'] . $_SERVER['REQUEST_URI'], true, 301); exit; } /** * Optional system level overrides */ if (is_readable('/data/conf/override.global.inc')) { require_once "/data/conf/override.global.inc"; } /** * Use Redis caching and lock support only for d6 and d7 profiles */ if ($valkey_up && $use_valkey && !$custom_cache) { $cache_backport = FALSE; $cache_valkey = FALSE; $all_ini['redis_use_modern'] = TRUE; if ($all_ini['redis_use_modern']) { if ($drupal_core >= 8) { $redis_comprs = TRUE; $redis_dirname = 'redis_eight'; if (!$all_ini['redis_old_eight_mode']) { $redis_dirname = 'redis_compr'; } if ($drupal_core == 10 || $drupal_core == 11) { $redis_new_dirname = 'redis_ten_eleven'; $redis_legacy_dirname = 'redis_nine_ten'; if (is_readable('modules/o_contrib_ten/' . $redis_new_dirname . '/redis.services.yml')) { $redis_dirname = $redis_new_dirname; } elseif (is_readable('modules/o_contrib_ten/' . $redis_legacy_dirname . '/redis.services.yml')) { $redis_dirname = $redis_legacy_dirname; } } elseif ($drupal_core == 9) { $redis_dirname = 'redis_nine_ten'; if ($all_ini['redis_old_nine_mode']) { $redis_dirname = 'redis_compr'; } } } else { $redis_dirname = 'redis_edge'; } if ($is_dev && !$is_backend) { header("X-Valkey-Version-Is: Modern"); header("X-Valkey-Dir-Is: " . $redis_dirname); } if ($all_ini['redis_flush_forced_mode']) { if ($drupal_core >= 8) { $settings['redis_perm_ttl'] = 86400; // 24 hours max $settings['redis_flush_mode'] = 1; // Valkey default is 0 $settings['redis_flush_mode_cache_page'] = 2; // Valkey default is 1 $settings['redis_flush_mode_cache_block'] = 2; // Valkey default is 1 $settings['redis_flush_mode_cache_menu'] = 2; // Valkey default is 0 $settings['redis_flush_mode_cache_metatag'] = 2; // Valkey default is 0 } else { $conf['redis_perm_ttl'] = 86400; // 24 hours max $conf['redis_flush_mode'] = 1; // Valkey default is 0 $conf['redis_flush_mode_cache_page'] = 2; // Valkey default is 1 $conf['redis_flush_mode_cache_block'] = 2; // Valkey default is 1 $conf['redis_flush_mode_cache_menu'] = 2; // Valkey default is 0 $conf['redis_flush_mode_cache_metatag'] = 2; // Valkey default is 0 } // See http://bit.ly/1drmi35 for more information if ($is_dev && !$is_backend) { header("X-Valkey-Flush-Forced-Mode: Forced"); } } } else { $redis_dirname = 'redis'; if ($is_dev && !$is_backend) { header("X-Valkey-Version-Is: Legacy"); header("X-Valkey-Dir-Is: " . $redis_dirname); } } if ($drupal_core >= 8) { if (file_exists('sites/' . $_SERVER['SERVER_NAME'] . '/.redisLegacyOff')) { if ($is_dev && !$is_backend) { header("X-Valkey-Off-Ctrl-Exists: .redisLegacyOff"); } } else { if (is_readable('sites/' . $_SERVER['SERVER_NAME'] . '/files/development.services.yml')) { if ($is_dev && !$is_backend) { header("X-Dev-Services-Yml-Is-Readable: development.services.yml"); } } else { if (is_readable('modules/o_contrib_ten')) { if (is_readable('modules/o_contrib_ten/' . $redis_dirname . '/example.services.yml')) { $cache_valkey = TRUE; $example_failover_path = 'modules/o_contrib_ten/' . $redis_dirname . '/example.failover.services.yml'; $example_services_path = 'modules/o_contrib_ten/' . $redis_dirname . '/example.services.yml'; $cache_gzip_path = 'modules/o_contrib_ten/' . $redis_dirname . '/lib/Redis/CacheCompressed.php'; } if (is_readable('modules/o_contrib_ten/' . $redis_dirname . '/redis.services.yml')) { $cache_valkey = TRUE; $redis_services_path = 'modules/o_contrib_ten/' . $redis_dirname . '/redis.services.yml'; if ($is_dev && !$is_backend) { header("X-Valkey-Services-Is-Readable: " . $redis_services_path); } } } elseif (is_readable('modules/o_contrib_eleven')) { if (is_readable('modules/o_contrib_eleven/' . $redis_dirname . '/example.services.yml')) { $cache_valkey = TRUE; $example_failover_path = 'modules/o_contrib_eleven/' . $redis_dirname . '/example.failover.services.yml'; $example_services_path = 'modules/o_contrib_eleven/' . $redis_dirname . '/example.services.yml'; $cache_gzip_path = 'modules/o_contrib_eleven/' . $redis_dirname . '/lib/Redis/CacheCompressed.php'; } if (is_readable('modules/o_contrib_eleven/' . $redis_dirname . '/redis.services.yml')) { $cache_valkey = TRUE; $redis_services_path = 'modules/o_contrib_eleven/' . $redis_dirname . '/redis.services.yml'; if ($is_dev && !$is_backend) { header("X-Valkey-Services-Is-Readable: " . $redis_services_path); } } } elseif (is_readable('modules/o_contrib_nine')) { if (is_readable('modules/o_contrib_nine/' . $redis_dirname . '/example.services.yml')) { $cache_valkey = TRUE; $example_failover_path = 'modules/o_contrib_nine/' . $redis_dirname . '/example.failover.services.yml'; $example_services_path = 'modules/o_contrib_nine/' . $redis_dirname . '/example.services.yml'; $cache_gzip_path = 'modules/o_contrib_nine/' . $redis_dirname . '/lib/Redis/CacheCompressed.php'; } if (is_readable('modules/o_contrib_nine/' . $redis_dirname . '/redis.services.yml')) { $cache_valkey = TRUE; $redis_services_path = 'modules/o_contrib_nine/' . $redis_dirname . '/redis.services.yml'; if ($is_dev && !$is_backend) { header("X-Valkey-Services-Is-Readable: " . $redis_services_path); } } } elseif (is_readable('modules/o_contrib_eight')) { if (is_readable('modules/o_contrib_eight/' . $redis_dirname . '/example.services.yml')) { $cache_valkey = TRUE; $example_services_path = 'modules/o_contrib_eight/' . $redis_dirname . '/example.services.yml'; $cache_gzip_path = 'modules/o_contrib_eight/' . $redis_dirname . '/lib/Redis/CacheCompressed.php'; if ($is_dev && !$is_backend) { header("X-Example-Services-Is-Readable: " . $example_services_path); } } if (is_readable('modules/o_contrib_eight/' . $redis_dirname . '/redis.services.yml')) { $cache_valkey = TRUE; $redis_services_path = 'modules/o_contrib_eight/' . $redis_dirname . '/redis.services.yml'; if ($is_dev && !$is_backend) { header("X-Valkey-Services-Is-Readable: " . $redis_services_path); } } } } } } elseif ($drupal_core == 7) { if (is_readable('modules/o_contrib_seven/' . $redis_dirname . '/redis.autoload.inc')) { $cache_valkey = TRUE; $cache_backport = FALSE; $cache_redis_path = 'modules/o_contrib_seven/' . $redis_dirname . '/redis.autoload.inc'; $cache_lock_path = 'modules/o_contrib_seven/' . $redis_dirname . '/redis.lock.inc'; $cache_path_path = 'modules/o_contrib_seven/' . $redis_dirname . '/redis.path.inc'; $cache_gzip_path = 'modules/o_contrib_seven/' . $redis_dirname . '/lib/Redis/CacheCompressed.php'; if ($is_dev && !$is_backend) { header("X-Valkey-Autoload-Is-Readable: " . $cache_redis_path); } } if ($all_ini['autoslave_enable']) { if (is_readable('modules/o_contrib_seven/autoslave/autoslave.cache.inc') && is_readable('includes/database/autoslave/database.inc')) { $use_auto_se = TRUE; $gzip_mode = FALSE; $cache_backport = FALSE; $auto_se_path = 'modules/o_contrib_seven/autoslave/autoslave.cache.inc'; if ($is_dev && !$is_backend) { header("X-AutoSlave-Cache-Is-Readable: " . $auto_se_path); } } } if ($all_ini['cache_consistent_enable']) { if (is_readable('modules/o_contrib_seven/cache_consistent/cache_consistent.inc')) { $use_cache_ct = TRUE; $gzip_mode = FALSE; $cache_backport = FALSE; $cache_ct_path = 'modules/o_contrib_seven/cache_consistent/cache_consistent.inc'; if ($is_dev && !$is_backend) { header("X-CacheConsistent-Is-Readable: " . $cache_ct_path); } } } } elseif ($drupal_core == 6) { if (is_readable('modules/o_contrib/cache_backport/cache.inc')) { $cache_backport = TRUE; $cache_backport_path = 'modules/o_contrib/cache_backport/cache.inc'; if ($is_dev && !$is_backend) { header("X-Valkey-Cache-Backport-Is-Readable: " . $cache_backport_path); } } if (is_readable('modules/o_contrib/' . $redis_dirname . '/redis.autoload.inc')) { $cache_valkey = TRUE; $cache_redis_path = 'modules/o_contrib/' . $redis_dirname . '/redis.autoload.inc'; $cache_lock_path = 'modules/o_contrib/' . $redis_dirname . '/redis.lock.inc'; $cache_path_path = 'modules/o_contrib/' . $redis_dirname . '/redis.path.inc'; $cache_gzip_path = 'modules/o_contrib/' . $redis_dirname . '/lib/Redis/CacheCompressed.php'; if ($is_dev && !$is_backend) { header("X-Valkey-Autoload-Is-Readable: " . $cache_redis_path); } } } if ($cache_valkey) { if ($drupal_core >= 8) { if (is_readable('modules/o_contrib_eleven/' . $redis_dirname . '/redis.services.yml')) { $class_loader->addPsr4('Drupal\\redis\\', 'modules/o_contrib_eleven/' . $redis_dirname . '/src'); } elseif (is_readable('modules/o_contrib_ten/' . $redis_dirname . '/redis.services.yml')) { $class_loader->addPsr4('Drupal\\redis\\', 'modules/o_contrib_ten/' . $redis_dirname . '/src'); } elseif (is_readable('modules/o_contrib_nine/' . $redis_dirname . '/redis.services.yml')) { $class_loader->addPsr4('Drupal\\redis\\', 'modules/o_contrib_nine/' . $redis_dirname . '/src'); } else { $class_loader->addPsr4('Drupal\\redis\\', 'modules/o_contrib_eight/' . $redis_dirname . '/src'); } $settings['redis.connection']['interface'] = 'PhpRedis'; $settings['redis.connection']['host'] = '127.0.0.1'; $settings['redis.connection']['port'] = '6379'; $settings['redis.connection']['password'] = 'isfoobared'; $settings['redis.connection']['base'] = '8'; $settings['cache_prefix'] = $this_prefix; $settings['cache']['default'] = 'cache.backend.redis'; if (!is_readable('/data/conf/clstr.cnf')) { $settings['cache']['bins']['bootstrap'] = 'cache.backend.chainedfast'; $settings['cache']['bins']['discovery'] = 'cache.backend.chainedfast'; $settings['cache']['bins']['config'] = 'cache.backend.chainedfast'; } $settings['container_yamls'][] = $example_services_path; $settings['container_yamls'][] = $redis_services_path; if ($drupal_core <= 10) { $settings['queue_default'] = 'queue.redis_reliable'; } if ($redis_comprs) { $settings['redis_compress_length'] = 100; $settings['redis_compress_level'] = 5; } $settings['cache']['bins']['state'] = 'cache.backend.redis'; $settings['state_cache'] = TRUE; $settings['bootstrap_container_definition'] = [ 'parameters' => [], 'services' => [ 'redis.factory' => [ 'class' => 'Drupal\redis\ClientFactory', ], 'cache.backend.redis' => [ 'class' => 'Drupal\redis\Cache\CacheBackendFactory', 'arguments' => ['@redis.factory', '@cache_tags_provider.container', '@serialization.phpserialize'], ], 'cache.container' => [ 'class' => '\Drupal\redis\Cache\PhpRedis', 'factory' => ['@cache.backend.redis', 'get'], 'arguments' => ['container'], ], 'cache_tags_provider.container' => [ 'class' => 'Drupal\redis\Cache\RedisCacheTagsChecksum', 'arguments' => ['@redis.factory'], ], 'serialization.phpserialize' => [ 'class' => 'Drupal\Component\Serialization\PhpSerialize', ], ], ]; } else { if ($cache_backport) { $conf['cache_inc'] = $cache_backport_path; } if ($all_ini['redis_use_modern']) { if ($all_ini['redis_lock_enable']) { $redis_lock = TRUE; } if ($all_ini['redis_path_enable']) { $redis_path = TRUE; } } if (is_readable($cache_lock_path) && $redis_lock) { $conf['lock_inc'] = $cache_lock_path; if ($is_dev && !$is_backend) { header("X-Valkey-Lock-Is-Readable: " . $cache_lock_path); } } if (is_readable($cache_path_path) && $redis_path) { $conf['path_inc'] = $cache_path_path; $conf['path_alias_admin_blacklist'] = FALSE; if ($is_dev && !$is_backend) { header("X-Valkey-Path-Is-Readable: " . $cache_path_path); } } if ($all_ini['redis_scan_enable']) { $conf['redis_scan_delete'] = TRUE; $gzip_mode = FALSE; } else { if (is_readable($cache_gzip_path)) { $gzip_mode = TRUE; } else { $gzip_mode = FALSE; } } if ($gzip_mode) { $conf['cache_default_class'] = 'Redis_CacheCompressed'; } else { $conf['cache_default_class'] = 'Redis_Cache'; } $conf['cache_backends'][] = $cache_redis_path; if ($use_auto_se) { $conf['cache_backends'][] = $auto_se_path; $conf['cache_default_class'] = 'AutoslaveCache'; $conf['autoslave_cache_default_class'] = 'Redis_Cache'; } if ($use_cache_ct) { $conf['cache_backends'][] = $cache_ct_path; $conf['cache_default_class'] = 'ConsistentCache'; if (!is_readable('/data/conf/clstr.cnf')) { $conf['cache_class_cache_form'] = 'DrupalDatabaseCache'; $conf['cache_class_cache_bootstrap'] = 'DrupalDatabaseCache'; } $conf['consistent_cache_default_class'] = 'Redis_Cache'; $conf['consistent_cache_default_safe'] = TRUE; $conf['consistent_cache_buffer_mechanism'] = 'ConsistentCacheBuffer'; $conf['consistent_cache_default_strict'] = FALSE; $conf['consistent_cache_strict_cache_bootstrap'] = TRUE; } if (!is_readable('/data/conf/clstr.cnf')) { $conf['cache_class_cache_form'] = 'DrupalDatabaseCache'; $conf['cache_class_cache_bootstrap'] = 'DrupalDatabaseCache'; } $conf['redis_client_interface'] = 'PhpRedis'; $conf['redis_client_host'] = '127.0.0.1'; $conf['redis_client_port'] = '6379'; $conf['redis_client_password'] = 'isfoobared'; $conf['redis_client_base'] = '8'; $conf['cache_prefix'] = $this_prefix; $conf['page_cache_invoke_hooks'] = TRUE; // D7 == Do not use Aggressive Mode $conf['page_cache_without_database'] = FALSE; // D7 == Do not use Aggressive Mode $conf['page_cache_maximum_age'] = 0; // D7 == max-age in the Cache-Control header (ignored by Speed Booster) $conf['page_cache_max_age'] = 0; // D6 == max-age in the Cache-Control header (ignored by Speed Booster) $conf['cache_lifetime'] = 0; // D7 == BOA uses Speed Booster / Nginx micro-caching instead $conf['page_cache_lifetime'] = 0; // D6 == BOA uses Speed Booster / Nginx micro-caching instead } if ($all_ini['redis_exclude_bins'] && !is_readable('/data/conf/clstr.cnf')) { $excludes = array(); $excludes = explode(",", $all_ini['redis_exclude_bins']); foreach ($excludes as $exclude) { $exclude = rtrim($exclude); $exclude = ltrim($exclude); if ($drupal_core >= 8) { $bin_exclude = $exclude; $settings['cache']['bins'][$bin_exclude] = 'cache.backend.database'; } else { $bin_exclude = 'cache_class_' . $exclude; $conf[$bin_exclude] = 'DrupalDatabaseCache'; } if ($is_dev && !$is_backend) { header("X-Ini-Valkey-Exclude-Bin-" . $exclude . ": " . $bin_exclude); } } } } } /** * Drupal for Facebook (fb) * * Important: * Facebook client libraries will not work properly if arg_separator.output is not & * The default value is &. Change this in settings.php. Make the value "&" * https://drupal.org/node/205476 */ if (!$custom_fb && $all_ini['auto_detect_facebook_integration']) { if (is_readable('sites/all/modules/fb/fb_settings.inc')) { ini_set('arg_separator.output', '&'); require_once "sites/all/modules/fb/fb_settings.inc"; $conf['fb_api_file'] = "sites/all/modules/fb/facebook-platform/php/facebook.php"; } elseif (is_readable('sites/all/modules/contrib/fb/fb_settings.inc')) { ini_set('arg_separator.output', '&'); require_once "sites/all/modules/contrib/fb/fb_settings.inc"; $conf['fb_api_file'] = "sites/all/modules/contrib/fb/facebook-platform/php/facebook.php"; } elseif (is_readable('profiles/' . $conf['install_profile'] . '/modules/fb/fb_settings.inc')) { ini_set('arg_separator.output', '&'); require_once 'profiles/' . $conf['install_profile'] . '/modules/fb/fb_settings.inc'; $conf['fb_api_file'] = 'profiles/' . $conf['install_profile'] . '/modules/fb/facebook-platform/php/facebook.php'; } elseif (is_readable('profiles/' . $conf['install_profile'] . '/modules/contrib/fb/fb_settings.inc')) { ini_set('arg_separator.output', '&'); require_once 'profiles/' . $conf['install_profile'] . '/modules/contrib/fb/fb_settings.inc'; $conf['fb_api_file'] = 'profiles/' . $conf['install_profile'] . '/modules/contrib/fb/facebook-platform/php/facebook.php'; } } /** * Domain module */ if (!$custom_da) { if ($da_inc) { require_once($da_inc); } } /** * New Relic Integration for Drupal with Drush Compatibility (8, 12, 13) * * Supports background jobs and sets appropriate New Relic parameters. */ if (extension_loaded('newrelic') && !empty($all_ini['enable_newrelic_integration'])) { $this_instance = FALSE; if ($is_backend) { $uri = FALSE; // Check if drush_get_context exists (Drush 8) if (function_exists('drush_get_context')) { // Drush 8 context retrieval $context = drush_get_context(); if (isset($context['DRUSH_URI'])) { $uri = $context['DRUSH_URI']; } elseif (isset($context['DRUSH_DRUPAL_SITE'])) { $uri = $context['DRUSH_DRUPAL_SITE']; } } else { // Drush 9+ context retrieval // Attempt to retrieve URI from environment variables or Drush services // Drush commands can pass the URI as an environment variable or argument // Example: Using environment variable (you might need to set this in Drush commands) if (isset($_SERVER['DRUSH_URI'])) { $uri = $_SERVER['DRUSH_URI']; } elseif (isset($_SERVER['DRUPAL_SITE_URI'])) { $uri = $_SERVER['DRUPAL_SITE_URI']; } else { // Fallback: Attempt to determine URI using Drupal APIs // Note: In Drush context, some Drupal services might not be fully bootstrapped try { $request = \Drupal::request(); $uri = $request->getSchemeAndHttpHost(); } catch (\Exception $e) { // Unable to determine URI; proceed without setting it } } } if ($uri) { // Clean the URI by removing the scheme $uri = str_replace(['http://', 'https://'], '', $uri); $this_instance = 'Drush Site: ' . $uri; // Set New Relic transaction name and parameters if command details are available if (isset($command['command']) && isset($command['arguments'])) { $drush_command = array_merge([$command['command']], $command['arguments']); $command_str = implode(' ', $drush_command); // Add custom parameters to New Relic newrelic_add_custom_parameter('Drush command', $command_str); newrelic_name_transaction($command_str); // Indicate that this is a background job newrelic_background_job(TRUE); } } } else { // Non-Drush (web request) context if (isset($_SERVER['SERVER_NAME'])) { $this_instance = 'Web Site: ' . $_SERVER['SERVER_NAME']; // Optionally, indicate this is not a background job // newrelic_background_job(FALSE); } } // Apply the New Relic app name if determined if ($this_instance) { ini_set('newrelic.appname', $this_instance); newrelic_set_appname($this_instance); } } elseif (extension_loaded('newrelic') && empty($all_ini['enable_newrelic_integration'])) { // Disable New Relic auto-RUM and ignore transactions if integration is disabled newrelic_disable_autorum(); newrelic_ignore_apdex(); newrelic_ignore_transaction(); } /** * Unset config arrays on non-dev URLs */ if (!$is_dev) { unset($boa_ini); unset($usr_plr_ini); unset($usr_loc_ini); unset($all_ini); } ================================================ FILE: aegir/conf/global/override.global.inc ================================================ "$IFSTATE" ; then log_failure_msg "can't initialise $IFSTATE" exit 1 fi fi } check_network_file_systems() { [ -e /proc/mounts ] || return 0 if [ -e /etc/iscsi/iscsi.initramfs ]; then log_warning_msg "not deconfiguring network interfaces: iSCSI root is mounted." exit 0 fi while read DEV MTPT FSTYPE REST; do case $DEV in /dev/nbd*|/dev/nd[a-z]*|/dev/etherd/e*|curlftpfs*) log_warning_msg "not deconfiguring network interfaces: network devices still mounted." exit 0 ;; esac case $FSTYPE in nfs|nfs4|smbfs|ncp|ncpfs|cifs|coda|ocfs2|gfs|pvfs|pvfs2|fuse.httpfs|fuse.curlftpfs) log_warning_msg "not deconfiguring network interfaces: network file systems still mounted." exit 0 ;; esac done < /proc/mounts } check_network_swap() { [ -e /proc/swaps ] || return 0 while read DEV MTPT FSTYPE REST; do case $DEV in /dev/nbd*|/dev/nd[a-z]*|/dev/etherd/e*) log_warning_msg "not deconfiguring network interfaces: network swap still mounted." exit 0 ;; esac done < /proc/swaps } ifup_hotplug () { if [ -d /sys/class/net ] then ifaces=$(for iface in $(ifquery --list --allow=hotplug) do link=${iface%%:*} link=${link%%.*} if [ -e "/sys/class/net/$link" ] && ! ifquery --state "$iface" >/dev/null then echo "$iface" fi done) if [ -n "$ifaces" ] then ifup $ifaces "$@" || true fi fi } case "$1" in start) process_options check_ifstate if [ "$CONFIGURE_INTERFACES" = no ] then log_action_msg "Not configuring network interfaces, see /etc/default/networking" exit 0 fi set -f exclusions=$(process_exclusions) log_action_begin_msg "Configuring network interfaces" if [ -x "$(command -v udevadm)" ]; then if [ -n "$(ifquery --list --exclude=lo)" ] || [ -n "$(ifquery --list --allow=hotplug)" ]; then udevadm settle || true fi fi if ifup -a $exclusions $verbose && ifup_hotplug $exclusions $verbose then log_action_end_msg $? else log_action_end_msg $? fi ;; stop) check_network_file_systems check_network_swap log_action_begin_msg "Deconfiguring network interfaces" if ifdown -a --exclude=lo $verbose; then log_action_end_msg $? else log_action_end_msg $? fi ;; reload) process_options log_action_begin_msg "Reloading network interfaces configuration" state=$(ifquery --state) ifdown -a --exclude=lo $verbose || true if ifup --exclude=lo $state $verbose ; then log_action_end_msg $? else log_action_end_msg $? fi ;; force-reload|restart) process_options log_warning_msg "Running $0 $1 is deprecated because it may not re-enable some interfaces" log_action_begin_msg "Reconfiguring network interfaces" ifdown -a --exclude=lo $verbose || true set -f exclusions=$(process_exclusions) if ifup -a --exclude=lo $exclusions $verbose && ifup_hotplug $exclusions $verbose then log_action_end_msg $? else log_action_end_msg $? fi ;; *) echo "Usage: /etc/init.d/networking {start|stop|reload|restart|force-reload}" exit 1 ;; esac exit 0 # vim: noet ts=8 ================================================ FILE: aegir/conf/nginx/fastcgi_params.txt ================================================ fastcgi_param QUERY_STRING $query_string; fastcgi_param REQUEST_METHOD $request_method; fastcgi_param CONTENT_TYPE $content_type; fastcgi_param CONTENT_LENGTH $content_length; fastcgi_param SCRIPT_FILENAME $request_filename; fastcgi_param SCRIPT_NAME $fastcgi_script_name; fastcgi_param REQUEST_URI $request_uri; fastcgi_param DOCUMENT_URI $document_uri; fastcgi_param DOCUMENT_ROOT $document_root; fastcgi_param SERVER_PROTOCOL $server_protocol; fastcgi_param GATEWAY_INTERFACE CGI/1.1; fastcgi_param SERVER_SOFTWARE ApacheSolarisNginx/$nginx_version; fastcgi_param REMOTE_ADDR $remote_addr; fastcgi_param REMOTE_PORT $remote_port; fastcgi_param SERVER_ADDR $server_addr; fastcgi_param SERVER_PORT $server_port; fastcgi_param SERVER_NAME $server_name; # BOA specific fastcgi_param USER_DEVICE $device; fastcgi_param GEOIP_COUNTRY_CODE $geoip_country_code; fastcgi_param GEOIP_COUNTRY_CODE3 $geoip_country_code3; fastcgi_param GEOIP_COUNTRY_NAME $geoip_country_name; fastcgi_param HTTPS $https; # PHP only, required if PHP was built with --enable-force-cgi-redirect fastcgi_param REDIRECT_STATUS 200; # Block https://httpoxy.org/ attacks. fastcgi_param HTTP_PROXY ""; ================================================ FILE: aegir/conf/nginx/mime.types ================================================ types { application/atom+xml atom; application/iphone pxl ipa; application/java-archive jar war ear; application/javascript js; application/json json; application/mac-binhex40 hqx; application/msword doc; application/octet-stream bin exe dll; application/octet-stream deb; application/octet-stream dmg; application/octet-stream iso img; application/octet-stream msi msp msm; application/octet-stream safariextz; application/ogg ogx; application/pdf pdf; application/postscript ps eps ai; application/rss+xml rss; application/rtf rtf; application/vnd.android.package-archive apk; application/vnd.google-earth.kml+xml kml; application/vnd.google-earth.kmz kmz; application/vnd.ms-excel xls; application/vnd.ms-fontobject eot; application/vnd.ms-powerpoint ppt; application/vnd.oasis.opendocument.chart odc; application/vnd.oasis.opendocument.chart-template otc; application/vnd.oasis.opendocument.database odb; application/vnd.oasis.opendocument.formula odf; application/vnd.oasis.opendocument.formula-template odft; application/vnd.oasis.opendocument.graphics odg; application/vnd.oasis.opendocument.graphics-template otg; application/vnd.oasis.opendocument.image odi; application/vnd.oasis.opendocument.image-template oti; application/vnd.oasis.opendocument.presentation odp; application/vnd.oasis.opendocument.presentation-template otp; application/vnd.oasis.opendocument.spreadsheet ods; application/vnd.oasis.opendocument.spreadsheet-template ots; application/vnd.oasis.opendocument.text odt; application/vnd.oasis.opendocument.text-master otm; application/vnd.oasis.opendocument.text-template ott; application/vnd.oasis.opendocument.text-web oth; application/vnd.openofficeorg.extension oxt; application/vnd.openxmlformats-officedocument.presentationml.presentation pptx; application/vnd.openxmlformats-officedocument.presentationml.slide sldx; application/vnd.openxmlformats-officedocument.presentationml.slideshow ppsx; application/vnd.openxmlformats-officedocument.presentationml.template potx; application/vnd.openxmlformats-officedocument.spreadsheetml.sheet xlsx; application/vnd.openxmlformats-officedocument.spreadsheetml.template xltx; application/vnd.openxmlformats-officedocument.wordprocessingml.document docx; application/vnd.openxmlformats-officedocument.wordprocessingml.template dotx; application/vnd.sun.xml.calc sxc; application/vnd.sun.xml.calc.template stc; application/vnd.sun.xml.draw sxd; application/vnd.sun.xml.draw.template std; application/vnd.sun.xml.impress sxi; application/vnd.sun.xml.impress.template sti; application/vnd.sun.xml.math sxm; application/vnd.sun.xml.writer sxw; application/vnd.sun.xml.writer.global sxg; application/vnd.sun.xml.writer.template stw; application/vnd.wap.wmlc wmlc; application/x-7z-compressed 7z; application/x-bittorrent torrent; application/x-chrome-extension crx; application/x-cocoa cco; application/x-font-ttf ttc ttf; application/x-h5p h5p; application/x-java-archive-diff jardiff; application/x-java-jnlp-file jnlp; application/x-makeself run; application/x-opera-extension oex; application/x-perl pl pm; application/x-pilot prc pdb; application/x-rar-compressed rar; application/x-redhat-package-manager rpm; application/x-sea sea; application/x-shockwave-flash swf; application/x-stuffit sit; application/x-tcl tcl tk; application/x-web-app-manifest+json webapp; application/x-x509-ca-cert der pem crt; application/x-xpinstall xpi; application/xhtml+xml xhtml; application/xml rdf; application/zip zip; audio/midi mid midi kar; audio/mp4 aac f4a f4b m4a; audio/mpeg mp3; audio/ogg oga ogg; audio/x-realaudio ra; audio/x-wav wav; font/opentype otf; font/woff woff; font/woff2 woff2; image/bmp bmp; image/gif gif; image/jpeg jpeg jpg; image/png png; image/svg+xml svg svgz; image/tiff tif tiff; image/vnd.wap.wbmp wbmp; image/webp webp; image/x-icon ico; image/x-jng jng; text/cache-manifest manifest appcache; text/css css; text/html html htm shtml; text/mathml mml; text/plain txt; text/vnd.sun.j2me.app-descriptor jad; text/vnd.wap.wml wml; text/vtt vtt; text/x-component htc; text/x-vcard vcf; text/xml xml; video/3gpp 3gpp 3gp; video/mp4 mp4 m4v f4v f4p; video/mpeg mpeg mpg; video/ogg ogv; video/quicktime mov; video/webm webm; video/x-flv flv; video/x-mng mng; video/x-ms-asf asx asf; video/x-ms-wmv wmv; video/x-msvideo avi; } ================================================ FILE: aegir/conf/nginx/nginx ================================================ #!/bin/bash ### BEGIN INIT INFO # Provides: nginx # Required-Start: $remote_fs $syslog # Required-Stop: $remote_fs $syslog # Default-Start: 2 3 4 5 # Default-Stop: 0 1 6 # Short-Description: nginx init.d dash script for Debian or other *nix. # Description: nginx init.d dash script for Debian or other *nix. ### END INIT INFO #------------------------------------------------------------------------------ # nginx - this Debian Almquist shell (dash) script, starts and stops the nginx # daemon for Ubuntu and other *nix releases. # # description: Nginx is an HTTP(S) server, HTTP(S) reverse \ # proxy and IMAP/POP3 proxy server. This \ # script will manage the initiation of the \ # server and it's process state. # # processname: nginx # config: /etc/nginx/nginx.conf # pidfile: /run/nginx.pid # Provides: nginx # # Author: Jason Giedymin # . # # Version: 3.5.1 11-NOV-2013 jason.giedymin AT gmail.com # Notes: nginx init.d dash script for Ubuntu. # Tested with: Ubuntu 13.10, nginx-1.4.3 # # This script's project home is: # http://github.com/JasonGiedymin/nginx-init-ubuntu # # Modified by: Barracuda Team # #------------------------------------------------------------------------------ # MIT X11 License #------------------------------------------------------------------------------ # # Copyright (c) 2008-2013 Jason Giedymin, http://jasongiedymin.com # # Permission is hereby granted, free of charge, to any person obtaining # a copy of this software and associated documentation files (the # "Software"), to deal in the Software without restriction, including # without limitation the rights to use, copy, modify, merge, publish, # distribute, sublicense, and/or sell copies of the Software, and to # permit persons to whom the Software is furnished to do so, subject to # the following conditions: # # The above copyright notice and this permission notice shall be # included in all copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, # EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF # MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND # NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE # LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION # OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION # WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. #------------------------------------------------------------------------------ #------------------------------------------------------------------------------ # Functions #------------------------------------------------------------------------------ LSB_FUNC=/lib/lsb/init-functions # Test that init functions exists test -r $LSB_FUNC || { echo "$0: Cannot find $LSB_FUNC! Script exiting." 1>&2 exit 5 } . $LSB_FUNC #------------------------------------------------------------------------------ # Consts #------------------------------------------------------------------------------ PATH=/usr/local/bin:/usr/local/sbin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin:/usr/libexec DAEMON=/usr/sbin/nginx PS="nginx" PIDNAME="nginx" #lets you do $PS-slave PIDFILE=$PIDNAME.pid #pid file PIDSPATH=/run #default pid location, you should change it DESCRIPTION="Nginx Server..." RUNAS=root #user to run as SCRIPT_OK=0 #ala error codes SCRIPT_ERROR=1 #ala error codes TRUE=1 #boolean FALSE=0 #boolean lockfile=/var/lock/subsys/nginx NGINX_CONF_FILE="/etc/nginx/nginx.conf" #------------------------------------------------------------------------------ # Simple Tests #------------------------------------------------------------------------------ # Test if nginx is a file and executable test -x $DAEMON || { echo "$0: You don't have permissions to execute nginx." 1>&2 exit 4 } # Include nginx defaults if available if [ -f /etc/default/nginx ]; then . /etc/default/nginx fi #------------------------------------------------------------------------------ # Functions #------------------------------------------------------------------------------ # Load kTLS module only if it is not already loaded _load_ktls_module() { if ! lsmod 2>/dev/null | awk '{print $1}' | grep -qx "tls"; then if [ -e "/lib/modules/$(uname -r)/kernel/net/tls/tls.ko" ] \ || modinfo tls >/dev/null 2>&1; then modprobe -q tls >/dev/null 2>&1 || true grep -qxF "tls" /etc/modules 2>/dev/null || printf '%s\n' "tls" >> /etc/modules fi fi } setFilePerms(){ if [ -f $PIDSPATH/$PIDFILE ]; then chmod 400 $PIDSPATH/$PIDFILE fi } configtest() { $DAEMON -t -c $NGINX_CONF_FILE } getPSCount() { return `pgrep -f $PS | wc -l` } isRunning() { if [ $1 ]; then pidof_daemon $1 PID=$? if [ $PID -gt 0 ]; then return 1 else return 0 fi else pidof_daemon PID=$? if [ $PID -gt 0 ]; then return 1 else return 0 fi fi } #courtesy of php-fpm wait_for_pid() { try=0 while test $try -lt 35; do case "$1" in 'created') if [ -f "$2" ]; then try='' break fi ;; 'removed') if [ ! -f "$2" ]; then try='' break fi ;; esac try=`expr $try + 1` sleep 1 done } status(){ isRunning isAlive=$? if [ "${isAlive}" -eq $TRUE ]; then log_warning_msg "$DESCRIPTION found running with processes: `pidof $PS`" rc=0 else log_warning_msg "$DESCRIPTION is NOT running." rc=3 fi return } removePIDFile(){ if [ $1 ]; then if [ -f $1 ]; then rm -f $1 fi else #Do default removal if [ -f $PIDSPATH/$PIDFILE ]; then rm -f $PIDSPATH/$PIDFILE fi fi } start() { log_daemon_msg "Starting $DESCRIPTION" _load_ktls_module isRunning isAlive=$? if [ "${isAlive}" -eq $TRUE ]; then log_end_msg $SCRIPT_ERROR rc=0 else # Check if the ULIMIT is set in /etc/default/nginx if [ -n "$ULIMIT" ]; then # Set the ulimits ulimit $ULIMIT fi start-stop-daemon --start --quiet --chuid \ $RUNAS --pidfile $PIDSPATH/$PIDFILE --exec $DAEMON \ -- -c $NGINX_CONF_FILE setFilePerms log_end_msg $SCRIPT_OK rc=0 fi return } stop() { log_daemon_msg "Stopping $DESCRIPTION" isRunning isAlive=$? if [ "${isAlive}" -eq $TRUE ]; then start-stop-daemon --stop --quiet --pidfile $PIDSPATH/$PIDFILE wait_for_pid 'removed' $PIDSPATH/$PIDFILE if [ -n "$try" ]; then log_end_msg $SCRIPT_ERROR rc=0 # lsb states 1, but under status it is 2 (which is more prescriptive). Deferring to standard. else removePIDFile log_end_msg $SCRIPT_OK rc=0 fi else log_end_msg $SCRIPT_ERROR rc=7 fi return } reload() { configtest || return $? log_daemon_msg "Reloading (via HUP) $DESCRIPTION" isRunning if [ $? -eq $TRUE ]; then kill -HUP `cat $PIDSPATH/$PIDFILE` log_end_msg $SCRIPT_OK rc=0 else log_end_msg $SCRIPT_ERROR rc=7 fi return } quietupgrade() { log_daemon_msg "Performing Quiet Upgrade $DESCRIPTION" isRunning isAlive=$? if [ "${isAlive}" -eq $TRUE ]; then kill -USR2 `cat $PIDSPATH/$PIDFILE` kill -WINCH `cat $PIDSPATH/$PIDFILE.oldbin` isRunning isAlive=$? if [ "${isAlive}" -eq $TRUE ]; then kill -QUIT `cat $PIDSPATH/$PIDFILE.oldbin` wait_for_pid 'removed' $PIDSPATH/$PIDFILE.oldbin removePIDFile $PIDSPATH/$PIDFILE.oldbin log_end_msg $SCRIPT_OK rc=0 else log_end_msg $SCRIPT_ERROR log_daemon_msg "ERROR! Reverting back to original $DESCRIPTION" kill -HUP `cat $PIDSPATH/$PIDFILE` kill -TERM `cat $PIDSPATH/$PIDFILE.oldbin` kill -QUIT `cat $PIDSPATH/$PIDFILE.oldbin` wait_for_pid 'removed' $PIDSPATH/$PIDFILE.oldbin removePIDFile $PIDSPATH/$PIDFILE.oldbin log_end_msg $SCRIPT_OK rc=0 fi else log_end_msg $SCRIPT_ERROR rc=7 fi return } terminate() { log_daemon_msg "Force terminating (via KILL) $DESCRIPTION" PIDS=`pidof $PS` || true [ -e $PIDSPATH/$PIDFILE ] && PIDS2=`cat $PIDSPATH/$PIDFILE` for i in $PIDS; do if [ "$i" = "$PIDS2" ]; then kill $i wait_for_pid 'removed' $PIDSPATH/$PIDFILE removePIDFile fi done log_end_msg $SCRIPT_OK rc=0 } destroy() { log_daemon_msg "Force terminating and may include self (via KILLALL) $DESCRIPTION" killall $PS -q >> /dev/null 2>&1 log_end_msg $SCRIPT_OK rc=0 } pidof_daemon() { PIDS=`pidof $PS` || true [ -e $PIDSPATH/$PIDFILE ] && PIDS2=`cat $PIDSPATH/$PIDFILE` for i in $PIDS; do if [ "$i" = "$PIDS2" ]; then return 1 fi done return 0 } action="$1" case "$1" in start) start ;; stop) stop ;; restart|force-reload) stop # if [ $rc -ne 0 ]; then # script_exit # fi sleep 1 start ;; reload) $1 ;; status) status ;; configtest) $1 ;; quietupgrade) $1 ;; terminate) $1 ;; destroy) $1 ;; *) FULLPATH=/etc/init.d/$PS echo "Usage: $FULLPATH {start|stop|restart|force-reload|status|configtest|quietupgrade|terminate|destroy}" echo " The 'destroy' command should only be used as a last resort." exit 3 ;; esac exit $rc ================================================ FILE: aegir/conf/nginx/nginx-squeeze-init ================================================ #!/bin/bash ### BEGIN INIT INFO # Provides: nginx # Required-Start: $local_fs $remote_fs $network $syslog # Required-Stop: $local_fs $remote_fs $network $syslog # Default-Start: 2 3 4 5 # Default-Stop: 0 1 6 # Short-Description: starts the nginx web server # Description: starts nginx using start-stop-daemon ### END INIT INFO PATH=/usr/local/bin:/usr/local/sbin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin:/usr/libexec DAEMON=/usr/sbin/nginx NAME=nginx DESC=nginx # Include nginx defaults if available if [ -f /etc/default/nginx ]; then . /etc/default/nginx fi test -x $DAEMON || exit 0 . /lib/lsb/init-functions test_nginx_config() { if $DAEMON -t $DAEMON_OPTS >/dev/null 2>&1; then return 0 else $DAEMON -t $DAEMON_OPTS return $? fi } case "$1" in start) echo -n "Starting $DESC: " test_nginx_config # Check if the ULIMIT is set in /etc/default/nginx if [ -n "$ULIMIT" ]; then # Set the ulimits ulimit $ULIMIT fi start-stop-daemon --start --quiet --pidfile /run/$NAME.pid \ --exec $DAEMON -- $DAEMON_OPTS || true echo "$NAME." ;; stop) echo -n "Stopping $DESC: " start-stop-daemon --stop --quiet --pidfile /run/$NAME.pid \ --exec $DAEMON || true echo "$NAME." ;; restart|force-reload) echo -n "Restarting $DESC: " start-stop-daemon --stop --quiet --pidfile \ /run/$NAME.pid --exec $DAEMON || true sleep 1 test_nginx_config start-stop-daemon --start --quiet --pidfile \ /run/$NAME.pid --exec $DAEMON -- $DAEMON_OPTS || true echo "$NAME." ;; reload) echo -n "Reloading $DESC configuration: " test_nginx_config start-stop-daemon --stop --signal HUP --quiet --pidfile /run/$NAME.pid \ --exec $DAEMON || true echo "$NAME." ;; configtest|testconfig) echo -n "Testing $DESC configuration: " if test_nginx_config; then echo "$NAME." else exit $? fi ;; status) status_of_proc -p /run/$NAME.pid "$DAEMON" nginx && exit 0 || exit $? ;; *) echo "Usage: $NAME {start|stop|restart|reload|force-reload|status|configtest}" >&2 exit 1 ;; esac exit 0 ================================================ FILE: aegir/conf/nginx/nginx.conf ================================================ # Nginx web server main configuration file: /etc/nginx/nginx.conf # user www-data; worker_processes auto; pid /run/nginx.pid; events { multi_accept on; worker_connections 20000; } http { default_type application/octet-stream; gzip on; gzip_disable "msie6"; keepalive_timeout 70; sendfile on; tcp_nodelay on; tcp_nopush on; keepalive_requests 99999; types_hash_max_size 8192; include /etc/nginx/mime.types; include /etc/nginx/conf.d/*.conf; include /etc/nginx/sites-enabled/*; } ================================================ FILE: aegir/conf/nginx/nginx_compact_include.conf ================================================ ####################################################### ### nginx compact basic configuration start ####################################################### ### ### Deny crawlers. ### if ($is_crawler) { return 444; } ### ### Include high load protection config if exists. ### include /data/conf/nginx_high_load.c*; ### ### Catch all unspecified requests. ### location / { try_files $uri @dynamic; } ### ### Send all not cached requests to php-fpm with clean URLs support. ### location @dynamic { rewrite ^/(.*)$ /index.php last; } ### ### Send all non-static requests to php-fpm. ### location ~ \.php$ { try_files $uri =404; ### check for existence of php file first fastcgi_pass 127.0.0.1:9090; } ### ### Serve & no-log static files & images directly. ### location ~* ^.+\.(?:css|js|htc|xml|jpe?g|gif|png|ico|webp|bmp|svg|swf|pdf|docx?|xlsx?|tiff?|txt|rtf|vcard|vcf|cgi|bat|pl|dll|aspx?|class|otf|ttf|woff2?|eot|less)$ { access_log off; log_not_found off; expires 30d; try_files $uri =404; } ### ### Serve & log bigger media/static/archive files directly. ### location ~* ^.+\.(?:avi|mpe?g|mov|wmv|mp3|ogg|ogv|wav|midi|zip|tar|t?gz|rar|dmg|exe|apk|pxl|ipa)$ { expires 30d; try_files $uri =404; } ### ### Pseudo-streaming server-side support for Flash Video (FLV) files. ### location ~* ^.+\.flv$ { flv; expires 30d; try_files $uri =404; } ### ### Pseudo-streaming server-side support for H.264/AAC files. ### location ~* ^.+\.(?:mp4|m4a)$ { mp4; mp4_buffer_size 1m; mp4_max_buffer_size 5m; expires 30d; try_files $uri =404; } ####################################################### ### nginx compact basic configuration end ####################################################### ================================================ FILE: aegir/conf/nginx/nginx_high_load_off.conf ================================================ ### ### Only allowed crawlers under high load. ### if ($deny_on_high_load) { return 503; } ================================================ FILE: aegir/conf/nginx/nginx_speed_purge.conf ================================================ ### ### Support for https://drupal.org/project/purge module. ### server { listen 127.0.0.1:8888; server_name _; limit_conn limreq 8888; access_log /var/log/nginx/speed_purge.log main buffer=32k; allow 127.0.0.1; deny all; root /var/www/nginx-default; index index.html index.htm; server_name_in_redirect off; location / { try_files $uri =404; } location ~ /purge-([a-z\-]*)(/.*) { fastcgi_cache_purge speed $1$host$request_method$2; log_not_found off; } } ================================================ FILE: aegir/conf/nginx/nginx_sql_adminer.conf ================================================ ### ### Adminer SQL Manager Redirect to HTTPS. ### server { listen 127.0.0.1:80; server_name adminer_name; # Disable access logs for this server block access_log off; log_not_found off; return 301 https://$host$request_uri; } ### ### Adminer SQL Manager HTTPS Only. ### server { include fastcgi_params; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_param HTTPS on; limit_conn limreq 555; listen 127.0.0.1:443 ssl; http2 on; server_name adminer_name; root /var/www/adminer; index index.php index.html; ssl_dhparam /etc/ssl/private/nginx-wild-ssl.dhp; ssl_certificate /etc/ssl/private/nginx-wild-ssl.crt; ssl_certificate_key /etc/ssl/private/nginx-wild-ssl.key; ssl_session_timeout 5m; if ($is_crawler) { return 444; } include /var/aegir/config/includes/ip_access/sqladmin*; include /var/aegir/config/includes/nginx_compact_include.conf; } ================================================ FILE: aegir/conf/nginx/nginx_sql_buddy.conf ================================================ ### ### SQL Buddy Manager Redirect to HTTPS. ### server { listen 127.0.0.1:80; server_name buddy_name; # Disable access logs for this server block access_log off; log_not_found off; return 301 https://$host$request_uri; } ### ### SQL Buddy Manager HTTPS Only. ### server { include fastcgi_params; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_param HTTPS on; limit_conn limreq 555; listen 127.0.0.1:443 ssl; http2 on; server_name buddy_name; root /var/www/sqlbuddy; index index.php index.html; ssl_dhparam /etc/ssl/private/nginx-wild-ssl.dhp; ssl_certificate /etc/ssl/private/nginx-wild-ssl.crt; ssl_certificate_key /etc/ssl/private/nginx-wild-ssl.key; ssl_session_timeout 5m; if ($is_crawler) { return 444; } include /var/aegir/config/includes/ip_access/sqladmin*; include /var/aegir/config/includes/nginx_compact_include.conf; } ================================================ FILE: aegir/conf/nginx/nginx_sql_cgp.conf ================================================ ### ### Collectd Graph Panel Redirect to HTTPS. ### server { listen 127.0.0.1:80; server_name cgp_name; # Disable access logs for this server block access_log off; log_not_found off; return 301 https://$host$request_uri; } ### ### Collectd Graph Panel HTTPS Only. ### server { include fastcgi_params; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_param HTTPS on; limit_conn limreq 555; listen 127.0.0.1:443 ssl; http2 on; server_name cgp_name; root /var/www/cgp; index index.php index.html; ssl_dhparam /etc/ssl/private/nginx-wild-ssl.dhp; ssl_certificate /etc/ssl/private/nginx-wild-ssl.crt; ssl_certificate_key /etc/ssl/private/nginx-wild-ssl.key; ssl_session_timeout 5m; if ($is_crawler) { return 444; } include /var/aegir/config/includes/ip_access/sqladmin*; include /var/aegir/config/includes/nginx_compact_include.conf; } ================================================ FILE: aegir/conf/nginx/nginx_sql_chive.conf ================================================ ### ### Chive SQL Manager Redirect to HTTPS. ### server { listen 127.0.0.1:80; server_name chive_name; # Disable access logs for this server block access_log off; log_not_found off; return 301 https://$host$request_uri; } ### ### Chive SQL Manager HTTPS Only. ### server { include fastcgi_params; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_param HTTPS on; limit_conn limreq 555; listen 127.0.0.1:443 ssl; http2 on; server_name chive_name; root /var/www/chive; index index.php index.html; ssl_dhparam /etc/ssl/private/nginx-wild-ssl.dhp; ssl_certificate /etc/ssl/private/nginx-wild-ssl.crt; ssl_certificate_key /etc/ssl/private/nginx-wild-ssl.key; ssl_session_timeout 5m; if ($is_crawler) { return 444; } include /var/aegir/config/includes/ip_access/sqladmin*; include /var/aegir/config/includes/nginx_compact_include.conf; } ================================================ FILE: aegir/conf/nginx/nginx_wild_ssl.conf ================================================ ### /var/aegir/config/server_master/nginx/pre.d/nginx_wild_ssl.conf upstream nginx_http { server 127.0.0.1:80; } server { listen 127.0.0.1:443 ssl; listen 127.0.0.1:443 quic reuseport; http2 on; http3 on; http3_hq on; server_name _; ssl_dhparam /etc/ssl/private/nginx-wild-ssl.dhp; ssl_certificate /etc/ssl/private/nginx-wild-ssl.crt; ssl_certificate_key /etc/ssl/private/nginx-wild-ssl.key; ssl_session_timeout 5m; ssl_conf_command Options KTLS; access_log off; log_not_found off; ### ### Deny known crawlers. ### if ($is_crawler) { return 444; } location / { proxy_pass http://nginx_http; proxy_redirect off; gzip_vary off; proxy_buffering off; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-By $server_addr:$server_port; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Local-Proxy $scheme; proxy_set_header X-Forwarded-Proto $scheme; proxy_pass_header Set-Cookie; proxy_pass_header Cookie; proxy_pass_header X-Accel-Expires; proxy_pass_header X-Accel-Redirect; proxy_pass_header X-This-Proto; proxy_connect_timeout 180; proxy_send_timeout 180; proxy_read_timeout 180; } } ================================================ FILE: aegir/conf/php/fpm-pool-common-legacy.conf ================================================ group = www-data listen.owner = www-data listen.group = www-data listen.mode = 0660 listen.allowed_clients = 127.0.0.1 pm = ondemand pm.process_idle_timeout = 10s pm.max_requests = 5000 pm.status_path = /fpm-status ping.path = /fpm-ping ping.response = pong slowlog = /var/log/php/fpm-$pool-slow.log request_slowlog_timeout = 90s listen.backlog = 65535 env[HOSTNAME] = $HOSTNAME env[PATH] = /usr/local/bin:/usr/bin:/bin php_admin_value[default_socket_timeout] = 180 php_admin_value[max_execution_time] = 180 php_admin_value[max_input_time] = 180 php_admin_value[memory_limit] = 395M php_admin_value[opcache.error_log] = /var/log/php/opcache-$pool-error.log php_admin_value[opcache.log_verbosity_level] = 1 php_admin_flag[apc.enabled] = on ================================================ FILE: aegir/conf/php/fpm-pool-common-modern.conf ================================================ group = www-data listen.owner = www-data listen.group = www-data listen.mode = 0660 listen.allowed_clients = 127.0.0.1 pm = ondemand pm.process_idle_timeout = 10s pm.max_requests = 5000 pm.status_path = /fpm-status ping.path = /fpm-ping ping.response = pong slowlog = /var/log/php/fpm-$pool-slow.log request_slowlog_timeout = 90s listen.backlog = 65535 env[HOSTNAME] = $HOSTNAME env[PATH] = /usr/local/bin:/usr/bin:/bin php_admin_value[default_socket_timeout] = 180 php_admin_value[max_execution_time] = 180 php_admin_value[max_input_time] = 180 php_admin_value[memory_limit] = 395M php_admin_value[opcache.error_log] = /var/log/php/opcache-$pool-error.log php_admin_value[opcache.log_verbosity_level] = 1 php_admin_flag[apc.enabled] = on ================================================ FILE: aegir/conf/php/fpm-pool-common.conf ================================================ group = www-data listen.owner = www-data listen.group = www-data listen.mode = 0660 listen.allowed_clients = 127.0.0.1 pm = ondemand pm.process_idle_timeout = 10s pm.max_requests = 5000 pm.status_path = /fpm-status ping.path = /fpm-ping ping.response = pong slowlog = /var/log/php/fpm-$pool-slow.log request_slowlog_timeout = 90s listen.backlog = 65535 env[HOSTNAME] = $HOSTNAME env[PATH] = /usr/local/bin:/usr/bin:/bin php_admin_value[default_socket_timeout] = 180 php_admin_value[max_execution_time] = 180 php_admin_value[max_input_time] = 180 php_admin_value[memory_limit] = 395M php_admin_value[opcache.error_log] = /var/log/php/opcache-$pool-error.log php_admin_value[opcache.log_verbosity_level] = 1 php_admin_flag[apc.enabled] = on ================================================ FILE: aegir/conf/php/fpm-pool-foo-multi.conf ================================================ [THISPOOL] prefix = /data/disk/foo user = $pool.web listen = /run/$pool.fpm.socket include = /opt/etc/fpm/fpm-pool-common.conf pm.max_children = 8 request_terminate_timeout = 180s php_admin_value[sys_temp_dir] = "/home/foo.web/.tmp" php_admin_value[upload_tmp_dir] = "/home/foo.web/.tmp" php_admin_value[soap.wsdl_cache_dir] = "/home/foo.web/.tmp" php_admin_value[session.save_path] = "/home/foo.web/.tmp" php_admin_value[uploadprogress.file.contents_template] = "/home/foo.web/.tmp/upload_contents_%s" php_admin_value[uploadprogress.file.filename_template] = "/home/foo.web/.tmp/upt_%s.txt" env[TMP] = /home/foo.web/.tmp env[TMPDIR] = /home/foo.web/.tmp env[TEMP] = /home/foo.web/.tmp php_admin_value[open_basedir] = ".:/data/disk/foo/distro:/data/disk/foo/static:/data/disk/foo/aegir:/data/disk/foo/platforms:/data/disk/foo/backup-exports:/home/foo.web/.tmp:/home/foo.web/.aws:/data/all:/data/disk/all:/data/conf:/var/second/foo:/mnt:/srv:/hdd:/usr/bin:/usr/local/bin:/opt/tika:/opt/tika7:/opt/tika8:/opt/tika9:/opt/php56:/opt/php70:/opt/php71:/opt/php72:/opt/php73:/opt/php74:/opt/php80:/opt/php81:/opt/php82:/opt/php83:/opt/php84:/opt/php85:/dev/urandom:/var/tmp/fpm:/var/www/phpcache/foo" php_admin_value[disable_functions] = "passthru,disk_free_space,disk_total_space,diskfreespace,dl,get_current_user,getlastmo,getmygid,getmyinode,getmypid,getmyuid,ini_restore,link,pfsockopen,posix_getlogin,posix_getpwnam,posix_getpwuid,posix_getrlimit,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_ttyname,posix_uname,proc_nice,proc_terminate,show_source,symlink,opcache_reset" php_admin_value[newrelic.license] = "" php_admin_value[newrelic.enabled] = "false" ================================================ FILE: aegir/conf/php/fpm-pool-foo.conf ================================================ [foo] prefix = /data/disk/foo user = $pool.web listen = /run/$pool.fpm.socket include = /opt/etc/fpm/fpm-pool-common.conf pm.max_children = 8 request_terminate_timeout = 180s php_admin_value[sys_temp_dir] = "/home/foo.web/.tmp" php_admin_value[upload_tmp_dir] = "/home/foo.web/.tmp" php_admin_value[soap.wsdl_cache_dir] = "/home/foo.web/.tmp" php_admin_value[session.save_path] = "/home/foo.web/.tmp" php_admin_value[uploadprogress.file.contents_template] = "/home/foo.web/.tmp/upload_contents_%s" php_admin_value[uploadprogress.file.filename_template] = "/home/foo.web/.tmp/upt_%s.txt" env[TMP] = /home/foo.web/.tmp env[TMPDIR] = /home/foo.web/.tmp env[TEMP] = /home/foo.web/.tmp php_admin_value[open_basedir] = ".:/data/disk/foo/distro:/data/disk/foo/static:/data/disk/foo/aegir:/data/disk/foo/platforms:/data/disk/foo/backup-exports:/home/foo.web/.tmp:/home/foo.web/.aws:/data/all:/data/disk/all:/data/conf:/var/second/foo:/mnt:/srv:/hdd:/usr/bin:/usr/local/bin:/opt/tika:/opt/tika7:/opt/tika8:/opt/tika9:/opt/php56:/opt/php70:/opt/php71:/opt/php72:/opt/php73:/opt/php74:/opt/php80:/opt/php81:/opt/php82:/opt/php83:/opt/php84:/opt/php85:/dev/urandom:/var/tmp/fpm:/var/www/phpcache/foo" php_admin_value[disable_functions] = "passthru,disk_free_space,disk_total_space,diskfreespace,dl,get_current_user,getlastmo,getmygid,getmyinode,getmypid,getmyuid,ini_restore,link,pfsockopen,posix_getlogin,posix_getpwnam,posix_getpwuid,posix_getrlimit,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_ttyname,posix_uname,proc_nice,proc_terminate,show_source,symlink,opcache_reset" php_admin_value[newrelic.license] = "" php_admin_value[newrelic.enabled] = "false" ================================================ FILE: aegir/conf/php/fpm56-pool-www.conf ================================================ [www56] prefix = /var/www/$pool user = $pool listen = /run/$pool.fpm.socket include = /opt/etc/fpm/fpm-pool-common-legacy.conf pm.max_children = 8 request_terminate_timeout = 180s php_admin_value[sys_temp_dir] = "/tmp" php_admin_value[upload_tmp_dir] = "/tmp" php_admin_value[soap.wsdl_cache_dir] = "/tmp" php_admin_value[session.save_path] = "/tmp" env[TMP] = /tmp env[TMPDIR] = /tmp env[TEMP] = /tmp php_admin_value[disable_functions] = "passthru,disk_free_space,disk_total_space,diskfreespace,dl,get_current_user,getlastmo,getmygid,getmyinode,getmypid,getmyuid,ini_restore,link,pfsockopen,posix_getlogin,posix_getpwnam,posix_getpwuid,posix_getrlimit,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_ttyname,posix_uname,proc_nice,proc_terminate,show_source,symlink,opcache_reset" ================================================ FILE: aegir/conf/php/fpm70-pool-www.conf ================================================ [www70] prefix = /var/www/$pool user = $pool listen = /run/$pool.fpm.socket include = /opt/etc/fpm/fpm-pool-common-legacy.conf pm.max_children = 8 request_terminate_timeout = 180s php_admin_value[sys_temp_dir] = "/tmp" php_admin_value[upload_tmp_dir] = "/tmp" php_admin_value[soap.wsdl_cache_dir] = "/tmp" php_admin_value[session.save_path] = "/tmp" env[TMP] = /tmp env[TMPDIR] = /tmp env[TEMP] = /tmp php_admin_value[disable_functions] = "passthru,disk_free_space,disk_total_space,diskfreespace,dl,get_current_user,getlastmo,getmygid,getmyinode,getmypid,getmyuid,ini_restore,link,pfsockopen,posix_getlogin,posix_getpwnam,posix_getpwuid,posix_getrlimit,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_ttyname,posix_uname,proc_nice,proc_terminate,show_source,symlink,opcache_reset" php_admin_value[newrelic.license] = "" php_admin_value[newrelic.enabled] = "false" ================================================ FILE: aegir/conf/php/fpm71-pool-www.conf ================================================ [www71] prefix = /var/www/$pool user = $pool listen = /run/$pool.fpm.socket include = /opt/etc/fpm/fpm-pool-common-legacy.conf pm.max_children = 8 request_terminate_timeout = 180s php_admin_value[sys_temp_dir] = "/tmp" php_admin_value[upload_tmp_dir] = "/tmp" php_admin_value[soap.wsdl_cache_dir] = "/tmp" php_admin_value[session.save_path] = "/tmp" env[TMP] = /tmp env[TMPDIR] = /tmp env[TEMP] = /tmp php_admin_value[disable_functions] = "passthru,disk_free_space,disk_total_space,diskfreespace,dl,get_current_user,getlastmo,getmygid,getmyinode,getmypid,getmyuid,ini_restore,link,pfsockopen,posix_getlogin,posix_getpwnam,posix_getpwuid,posix_getrlimit,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_ttyname,posix_uname,proc_nice,proc_terminate,show_source,symlink,opcache_reset" php_admin_value[newrelic.license] = "" php_admin_value[newrelic.enabled] = "false" ================================================ FILE: aegir/conf/php/fpm72-pool-www.conf ================================================ [www72] prefix = /var/www/$pool user = $pool listen = /run/$pool.fpm.socket include = /opt/etc/fpm/fpm-pool-common-legacy.conf pm.max_children = 8 request_terminate_timeout = 180s php_admin_value[sys_temp_dir] = "/tmp" php_admin_value[upload_tmp_dir] = "/tmp" php_admin_value[soap.wsdl_cache_dir] = "/tmp" php_admin_value[session.save_path] = "/tmp" env[TMP] = /tmp env[TMPDIR] = /tmp env[TEMP] = /tmp php_admin_value[disable_functions] = "passthru,disk_free_space,disk_total_space,diskfreespace,dl,get_current_user,getlastmo,getmygid,getmyinode,getmypid,getmyuid,ini_restore,link,pfsockopen,posix_getlogin,posix_getpwnam,posix_getpwuid,posix_getrlimit,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_ttyname,posix_uname,proc_nice,proc_terminate,show_source,symlink,opcache_reset" php_admin_value[newrelic.license] = "" php_admin_value[newrelic.enabled] = "false" ================================================ FILE: aegir/conf/php/fpm73-pool-www.conf ================================================ [www73] prefix = /var/www/$pool user = $pool listen = /run/$pool.fpm.socket include = /opt/etc/fpm/fpm-pool-common-legacy.conf pm.max_children = 8 request_terminate_timeout = 180s php_admin_value[sys_temp_dir] = "/tmp" php_admin_value[upload_tmp_dir] = "/tmp" php_admin_value[soap.wsdl_cache_dir] = "/tmp" php_admin_value[session.save_path] = "/tmp" env[TMP] = /tmp env[TMPDIR] = /tmp env[TEMP] = /tmp php_admin_value[disable_functions] = "passthru,disk_free_space,disk_total_space,diskfreespace,dl,get_current_user,getlastmo,getmygid,getmyinode,getmypid,getmyuid,ini_restore,link,pfsockopen,posix_getlogin,posix_getpwnam,posix_getpwuid,posix_getrlimit,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_ttyname,posix_uname,proc_nice,proc_terminate,show_source,symlink,opcache_reset" php_admin_value[newrelic.license] = "" php_admin_value[newrelic.enabled] = "false" ================================================ FILE: aegir/conf/php/fpm74-pool-www.conf ================================================ [www74] prefix = /var/www/$pool user = $pool listen = /run/$pool.fpm.socket include = /opt/etc/fpm/fpm-pool-common-legacy.conf pm.max_children = 8 request_terminate_timeout = 180s php_admin_value[sys_temp_dir] = "/tmp" php_admin_value[upload_tmp_dir] = "/tmp" php_admin_value[soap.wsdl_cache_dir] = "/tmp" php_admin_value[session.save_path] = "/tmp" env[TMP] = /tmp env[TMPDIR] = /tmp env[TEMP] = /tmp php_admin_value[disable_functions] = "passthru,disk_free_space,disk_total_space,diskfreespace,dl,get_current_user,getlastmo,getmygid,getmyinode,getmypid,getmyuid,ini_restore,link,pfsockopen,posix_getlogin,posix_getpwnam,posix_getpwuid,posix_getrlimit,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_ttyname,posix_uname,proc_nice,proc_terminate,show_source,symlink,opcache_reset" php_admin_value[newrelic.license] = "" php_admin_value[newrelic.enabled] = "false" ================================================ FILE: aegir/conf/php/fpm80-pool-www.conf ================================================ [www80] prefix = /var/www/$pool user = $pool listen = /run/$pool.fpm.socket include = /opt/etc/fpm/fpm-pool-common.conf pm.max_children = 8 request_terminate_timeout = 180s php_admin_value[sys_temp_dir] = "/tmp" php_admin_value[upload_tmp_dir] = "/tmp" php_admin_value[soap.wsdl_cache_dir] = "/tmp" php_admin_value[session.save_path] = "/tmp" env[TMP] = /tmp env[TMPDIR] = /tmp env[TEMP] = /tmp php_admin_value[disable_functions] = "passthru,disk_free_space,disk_total_space,diskfreespace,dl,get_current_user,getlastmo,getmygid,getmyinode,getmypid,getmyuid,ini_restore,link,pfsockopen,posix_getlogin,posix_getpwnam,posix_getpwuid,posix_getrlimit,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_ttyname,posix_uname,proc_nice,proc_terminate,show_source,symlink,opcache_reset" php_admin_value[newrelic.license] = "" php_admin_value[newrelic.enabled] = "false" ================================================ FILE: aegir/conf/php/fpm81-pool-www.conf ================================================ [www81] prefix = /var/www/$pool user = $pool listen = /run/$pool.fpm.socket include = /opt/etc/fpm/fpm-pool-common.conf pm.max_children = 8 request_terminate_timeout = 180s php_admin_value[sys_temp_dir] = "/tmp" php_admin_value[upload_tmp_dir] = "/tmp" php_admin_value[soap.wsdl_cache_dir] = "/tmp" php_admin_value[session.save_path] = "/tmp" env[TMP] = /tmp env[TMPDIR] = /tmp env[TEMP] = /tmp php_admin_value[disable_functions] = "passthru,disk_free_space,disk_total_space,diskfreespace,dl,get_current_user,getlastmo,getmygid,getmyinode,getmypid,getmyuid,ini_restore,link,pfsockopen,posix_getlogin,posix_getpwnam,posix_getpwuid,posix_getrlimit,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_ttyname,posix_uname,proc_nice,proc_terminate,show_source,symlink,opcache_reset" php_admin_value[newrelic.license] = "" php_admin_value[newrelic.enabled] = "false" ================================================ FILE: aegir/conf/php/fpm82-pool-www.conf ================================================ [www82] prefix = /var/www/$pool user = $pool listen = /run/$pool.fpm.socket include = /opt/etc/fpm/fpm-pool-common.conf pm.max_children = 8 request_terminate_timeout = 180s php_admin_value[sys_temp_dir] = "/tmp" php_admin_value[upload_tmp_dir] = "/tmp" php_admin_value[soap.wsdl_cache_dir] = "/tmp" php_admin_value[session.save_path] = "/tmp" env[TMP] = /tmp env[TMPDIR] = /tmp env[TEMP] = /tmp php_admin_value[disable_functions] = "passthru,disk_free_space,disk_total_space,diskfreespace,dl,get_current_user,getlastmo,getmygid,getmyinode,getmypid,getmyuid,ini_restore,link,pfsockopen,posix_getlogin,posix_getpwnam,posix_getpwuid,posix_getrlimit,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_ttyname,posix_uname,proc_nice,proc_terminate,show_source,symlink,opcache_reset" php_admin_value[newrelic.license] = "" php_admin_value[newrelic.enabled] = "false" ================================================ FILE: aegir/conf/php/fpm83-pool-www.conf ================================================ [www83] prefix = /var/www/$pool user = $pool listen = /run/$pool.fpm.socket include = /opt/etc/fpm/fpm-pool-common.conf pm.max_children = 8 request_terminate_timeout = 180s php_admin_value[sys_temp_dir] = "/tmp" php_admin_value[upload_tmp_dir] = "/tmp" php_admin_value[soap.wsdl_cache_dir] = "/tmp" php_admin_value[session.save_path] = "/tmp" env[TMP] = /tmp env[TMPDIR] = /tmp env[TEMP] = /tmp php_admin_value[disable_functions] = "passthru,disk_free_space,disk_total_space,diskfreespace,dl,get_current_user,getlastmo,getmygid,getmyinode,getmypid,getmyuid,ini_restore,link,pfsockopen,posix_getlogin,posix_getpwnam,posix_getpwuid,posix_getrlimit,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_ttyname,posix_uname,proc_nice,proc_terminate,show_source,symlink,opcache_reset" php_admin_value[newrelic.license] = "" php_admin_value[newrelic.enabled] = "false" ================================================ FILE: aegir/conf/php/fpm84-pool-www.conf ================================================ [www84] prefix = /var/www/$pool user = $pool listen = /run/$pool.fpm.socket include = /opt/etc/fpm/fpm-pool-common.conf pm.max_children = 8 request_terminate_timeout = 180s php_admin_value[sys_temp_dir] = "/tmp" php_admin_value[upload_tmp_dir] = "/tmp" php_admin_value[soap.wsdl_cache_dir] = "/tmp" php_admin_value[session.save_path] = "/tmp" env[TMP] = /tmp env[TMPDIR] = /tmp env[TEMP] = /tmp php_admin_value[disable_functions] = "passthru,disk_free_space,disk_total_space,diskfreespace,dl,get_current_user,getlastmo,getmygid,getmyinode,getmypid,getmyuid,ini_restore,link,pfsockopen,posix_getlogin,posix_getpwnam,posix_getpwuid,posix_getrlimit,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_ttyname,posix_uname,proc_nice,proc_terminate,show_source,symlink,opcache_reset" php_admin_value[newrelic.license] = "" php_admin_value[newrelic.enabled] = "false" ================================================ FILE: aegir/conf/php/fpm85-pool-www.conf ================================================ [www85] prefix = /var/www/$pool user = $pool listen = /run/$pool.fpm.socket include = /opt/etc/fpm/fpm-pool-common.conf pm.max_children = 8 request_terminate_timeout = 180s php_admin_value[sys_temp_dir] = "/tmp" php_admin_value[upload_tmp_dir] = "/tmp" php_admin_value[soap.wsdl_cache_dir] = "/tmp" php_admin_value[session.save_path] = "/tmp" env[TMP] = /tmp env[TMPDIR] = /tmp env[TEMP] = /tmp php_admin_value[disable_functions] = "passthru,disk_free_space,disk_total_space,diskfreespace,dl,get_current_user,getlastmo,getmygid,getmyinode,getmypid,getmyuid,ini_restore,link,pfsockopen,posix_getlogin,posix_getpwnam,posix_getpwuid,posix_getrlimit,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_ttyname,posix_uname,proc_nice,proc_terminate,show_source,symlink,opcache_reset" php_admin_value[newrelic.license] = "" php_admin_value[newrelic.enabled] = "false" ================================================ FILE: aegir/conf/php/newrelic.ini ================================================ ; New Relic extension=newrelic.so [newrelic] newrelic.enabled=true newrelic.license = "REPLACE_WITH_REAL_KEY" newrelic.logfile = "/var/log/newrelic/php_agent.log" newrelic.loglevel = "error" newrelic.appname = "Other Tasks" newrelic.daemon.logfile = "/var/log/newrelic/newrelic-daemon.log" newrelic.daemon.loglevel = "error" newrelic.daemon.pidfile = "/run/newrelic-daemon.pid" newrelic.daemon.dont_launch = 3 ================================================ FILE: aegir/conf/php/php56-cli.ini ================================================ [PHP] ;;;;;;;;;;;;;;;;;;; ; About php.ini ; ;;;;;;;;;;;;;;;;;;; ; PHP's initialization file, generally called php.ini, is responsible for ; configuring many of the aspects of PHP's behavior. ; PHP attempts to find and load this configuration from a number of locations. ; The following is a summary of its search order: ; 1. SAPI module specific location. ; 2. The PHPRC environment variable. (As of PHP 5.2.0) ; 3. A number of predefined registry keys on Windows (As of PHP 5.2.0) ; 4. Current working directory (except CLI) ; 5. The web server's directory (for SAPI modules), or directory of PHP ; (otherwise in Windows) ; 6. The directory from the --with-config-file-path compile time option, or the ; Windows directory (C:\windows or C:\winnt) ; See the PHP docs for more specific information. ; http://php.net/configuration.file ; The syntax of the file is extremely simple. Whitespace and lines ; beginning with a semicolon are silently ignored (as you probably guessed). ; Section headers (e.g. [Foo]) are also silently ignored, even though ; they might mean something in the future. ; Directives following the section heading [PATH=/www/mysite] only ; apply to PHP files in the /www/mysite directory. Directives ; following the section heading [HOST=www.example.com] only apply to ; PHP files served from www.example.com. Directives set in these ; special sections cannot be overridden by user-defined INI files or ; at runtime. Currently, [PATH=] and [HOST=] sections only work under ; CGI/FastCGI. ; http://php.net/ini.sections ; Directives are specified using the following syntax: ; directive = value ; Directive names are *case sensitive* - foo=bar is different from FOO=bar. ; Directives are variables used to configure PHP or PHP extensions. ; There is no name validation. If PHP can't find an expected ; directive because it is not set or is mistyped, a default value will be used. ; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one ; of the INI constants (On, Off, True, False, Yes, No and None) or an expression ; (e.g. E_ALL & ~E_NOTICE), a quoted string ("bar"), or a reference to a ; previously set variable or directive (e.g. ${foo}) ; Expressions in the INI file are limited to bitwise operators and parentheses: ; | bitwise OR ; ^ bitwise XOR ; & bitwise AND ; ~ bitwise NOT ; ! boolean NOT ; Boolean flags can be turned on using the values 1, On, True or Yes. ; They can be turned off using the values 0, Off, False or No. ; An empty string can be denoted by simply not writing anything after the equal ; sign, or by using the None keyword: ; foo = ; sets foo to an empty string ; foo = None ; sets foo to an empty string ; foo = "None" ; sets foo to the string 'None' ; If you use constants in your value, and these constants belong to a ; dynamically loaded extension (either a PHP extension or a Zend extension), ; you may only use these constants *after* the line that loads the extension. ;;;;;;;;;;;;;;;;;;; ; About this file ; ;;;;;;;;;;;;;;;;;;; ; PHP comes packaged with two INI files. One that is recommended to be used ; in production environments and one that is recommended to be used in ; development environments. ; php.ini-production contains settings which hold security, performance and ; best practices at its core. But please be aware, these settings may break ; compatibility with older or less security conscience applications. We ; recommending using the production ini in production and testing environments. ; php.ini-development is very similar to its production variant, except it is ; much more verbose when it comes to errors. We recommend using the ; development version only in development environments, as errors shown to ; application users can inadvertently leak otherwise secure information. ; This is php.ini-production INI file. ;;;;;;;;;;;;;;;;;;; ; Quick Reference ; ;;;;;;;;;;;;;;;;;;; ; The following are all the settings which are different in either the production ; or development versions of the INIs with respect to PHP's default behavior. ; Please see the actual settings later in the document for more details as to why ; we recommend these changes in PHP's behavior. display_errors = Off ; Default Value: On ; Development Value: On ; Production Value: Off ; display_startup_errors ; Default Value: Off ; Development Value: On ; Production Value: Off ; error_reporting ; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; html_errors ; Default Value: On ; Development Value: On ; Production value: On ; log_errors ; Default Value: Off ; Development Value: On ; Production Value: On ; max_input_time ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; output_buffering ; Default Value: Off ; Development Value: 4096 ; Production Value: 4096 ; register_argc_argv ; Default Value: On ; Development Value: Off ; Production Value: Off ; request_order ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; session.gc_divisor ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; session.hash_bits_per_character ; Default Value: 4 ; Development Value: 5 ; Production Value: 5 ; short_open_tag ; Default Value: On ; Development Value: Off ; Production Value: Off ; track_errors ; Default Value: Off ; Development Value: On ; Production Value: Off ; url_rewriter.tags ; Default Value: "a=href,area=href,frame=src,form=,fieldset=" ; Development Value: "a=href,area=href,frame=src,input=src,form=fakeentry" ; Production Value: "a=href,area=href,frame=src,input=src,form=fakeentry" ; variables_order ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS" ;;;;;;;;;;;;;;;;;;;; ; php.ini Options ; ;;;;;;;;;;;;;;;;;;;; ; Name for user-defined php.ini (.htaccess) files. Default is ".user.ini" ;user_ini.filename = ".user.ini" ; To disable this feature set this option to empty value user_ini.filename = ; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes) ;user_ini.cache_ttl = 300 ;;;;;;;;;;;;;;;;;;;; ; Language Options ; ;;;;;;;;;;;;;;;;;;;; ; Enable the PHP scripting language engine under Apache. ; http://php.net/engine engine = On ; This directive determines whether or not PHP will recognize code between ; tags as PHP source which should be processed as such. It is ; generally recommended that should be used and that this feature ; should be disabled, as enabling it may result in issues when generating XML ; documents, however this remains supported for backward compatibility reasons. ; Note that this directive does not control the tags. ; http://php.net/asp-tags asp_tags = Off ; The number of significant digits displayed in floating point numbers. ; http://php.net/precision precision = 14 ; Output buffering is a mechanism for controlling how much output data ; (excluding headers and cookies) PHP should keep internally before pushing that ; data to the client. If your application's output exceeds this setting, PHP ; will send that data in chunks of roughly the size you specify. ; Turning on this setting and managing its maximum buffer size can yield some ; interesting side-effects depending on your application and web server. ; You may be able to send headers and cookies after you've already sent output ; through print or echo. You also may see performance benefits if your server is ; emitting less packets due to buffered output versus PHP streaming the output ; as it gets it. On production servers, 4096 bytes is a good setting for performance ; reasons. ; Note: Output buffering can also be controlled via Output Buffering Control ; functions. ; Possible Values: ; On = Enabled and buffer is unlimited. (Use with caution) ; Off = Disabled ; Integer = Enables the buffer and sets its maximum size in bytes. ; Note: This directive is hardcoded to Off for the CLI SAPI ; Default Value: Off ; Development Value: 4096 ; Production Value: 4096 ; http://php.net/output-buffering output_buffering = 4096 ; You can redirect all of the output of your scripts to a function. For ; example, if you set output_handler to "mb_output_handler", character ; encoding will be transparently converted to the specified encoding. ; Setting any output handler automatically turns on output buffering. ; Note: People who wrote portable scripts should not depend on this ini ; directive. Instead, explicitly set the output handler using ob_start(). ; Using this ini directive may cause problems unless you know what script ; is doing. ; Note: You cannot use both "mb_output_handler" with "ob_iconv_handler" ; and you cannot use both "ob_gzhandler" and "zlib.output_compression". ; Note: output_handler must be empty if this is set 'On' !!!! ; Instead you must use zlib.output_handler. ; http://php.net/output-handler ;output_handler = ; Transparent output compression using the zlib library ; Valid values for this option are 'off', 'on', or a specific buffer size ; to be used for compression (default is 4KB) ; Note: Resulting chunk size may vary due to nature of compression. PHP ; outputs chunks that are few hundreds bytes each as a result of ; compression. If you prefer a larger chunk size for better ; performance, enable output_buffering in addition. ; Note: You need to use zlib.output_handler instead of the standard ; output_handler, or otherwise the output will be corrupted. ; http://php.net/zlib.output-compression zlib.output_compression = Off ; http://php.net/zlib.output-compression-level ;zlib.output_compression_level = -1 ; You cannot specify additional output handlers if zlib.output_compression ; is activated here. This setting does the same as output_handler but in ; a different order. ; http://php.net/zlib.output-handler ;zlib.output_handler = ; Implicit flush tells PHP to tell the output layer to flush itself ; automatically after every output block. This is equivalent to calling the ; PHP function flush() after each and every call to print() or echo() and each ; and every HTML block. Turning this option on has serious performance ; implications and is generally recommended for debugging purposes only. ; http://php.net/implicit-flush ; Note: This directive is hardcoded to On for the CLI SAPI implicit_flush = Off ; The unserialize callback function will be called (with the undefined class' ; name as parameter), if the unserializer finds an undefined class ; which should be instantiated. A warning appears if the specified function is ; not defined, or if the function doesn't include/implement the missing class. ; So only set this entry, if you really want to implement such a ; callback-function. unserialize_callback_func = ; When floats & doubles are serialized store serialize_precision significant ; digits after the floating point. The default value ensures that when floats ; are decoded with unserialize, the data will remain the same. serialize_precision = 17 ; open_basedir, if set, limits all file operations to the defined directory ; and below. This directive makes most sense if used in a per-directory ; or per-virtualhost web server configuration file. ; http://php.net/open-basedir ;open_basedir = ; This directive allows you to disable certain functions for security reasons. ; It receives a comma-delimited list of function names. ; http://php.net/disable-functions disable_functions = ; This directive allows you to disable certain classes for security reasons. ; It receives a comma-delimited list of class names. ; http://php.net/disable-classes disable_classes = ; Colors for Syntax Highlighting mode. Anything that's acceptable in ; would work. ; http://php.net/syntax-highlighting ;highlight.string = #DD0000 ;highlight.comment = #FF9900 ;highlight.keyword = #007700 ;highlight.default = #0000BB ;highlight.html = #000000 ; If enabled, the request will be allowed to complete even if the user aborts ; the request. Consider enabling it if executing long requests, which may end up ; being interrupted by the user or a browser timing out. PHP's default behavior ; is to disable this feature. ; http://php.net/ignore-user-abort ;ignore_user_abort = On ; Determines the size of the realpath cache to be used by PHP. This value should ; be increased on systems where PHP opens many files to reflect the quantity of ; the file operations performed. ; http://php.net/realpath-cache-size realpath_cache_size=64M ; Duration of time, in seconds for which to cache realpath information for a given ; file or directory. For systems with rarely changing files, consider increasing this ; value. ; http://php.net/realpath-cache-ttl realpath_cache_ttl=5 ; Enables or disables the circular reference collector. ; http://php.net/zend.enable-gc zend.enable_gc = On ; If enabled, scripts may be written in encodings that are incompatible with ; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such ; encodings. To use this feature, mbstring extension must be enabled. ; Default: Off ;zend.multibyte = Off ; Allows to set the default encoding for the scripts. This value will be used ; unless "declare(encoding=...)" directive appears at the top of the script. ; Only affects if zend.multibyte is set. ; Default: "" ;zend.script_encoding = ;;;;;;;;;;;;;;;;; ; Miscellaneous ; ;;;;;;;;;;;;;;;;; ; Decides whether PHP may expose the fact that it is installed on the server ; (e.g. by adding its signature to the Web server header). It is no security ; threat in any way, but it makes it possible to determine whether you use PHP ; on your server or not. ; http://php.net/expose-php expose_php = On ;;;;;;;;;;;;;;;;;;; ; Resource Limits ; ;;;;;;;;;;;;;;;;;;; ; Maximum execution time of each script, in seconds ; http://php.net/max-execution-time ; Note: This directive is hardcoded to 0 for the CLI SAPI max_execution_time = 3600 ; Maximum amount of time each script may spend parsing request data. It's a good ; idea to limit this time on productions servers in order to eliminate unexpectedly ; long running scripts. ; Note: This directive is hardcoded to -1 for the CLI SAPI ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; http://php.net/max-input-time max_input_time = 3600 ; Maximum input variable nesting level ; http://php.net/max-input-nesting-level ;max_input_nesting_level = 64 ; How many GET/POST/COOKIE input variables may be accepted max_input_vars = 9999 ; Maximum amount of memory a script may consume (128MB) ; http://php.net/memory-limit memory_limit = 395M ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; Error handling and logging ; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; This directive informs PHP of which errors, warnings and notices you would like ; it to take action for. The recommended way of setting values for this ; directive is through the use of the error level constants and bitwise ; operators. The error level constants are below here for convenience as well as ; some common settings and their meanings. ; By default, PHP is set to take action on all errors, notices and warnings EXCEPT ; those related to E_NOTICE and E_STRICT, which together cover best practices and ; recommended coding standards in PHP. For performance reasons, this is the ; recommend error reporting setting. Your production server shouldn't be wasting ; resources complaining about best practices and coding standards. That's what ; development servers and development settings are for. ; Note: The php.ini-development file has this setting as E_ALL. This ; means it pretty much reports everything which is exactly what you want during ; development and early testing. ; ; Error Level Constants: ; E_ALL - All errors and warnings (includes E_STRICT as of PHP 5.4.0) ; E_ERROR - fatal run-time errors ; E_RECOVERABLE_ERROR - almost fatal run-time errors ; E_WARNING - run-time warnings (non-fatal errors) ; E_PARSE - compile-time parse errors ; E_NOTICE - run-time notices (these are warnings which often result ; from a bug in your code, but it's possible that it was ; intentional (e.g., using an uninitialized variable and ; relying on the fact it is automatically initialized to an ; empty string) ; E_STRICT - run-time notices, enable to have PHP suggest changes ; to your code which will ensure the best interoperability ; and forward compatibility of your code ; E_CORE_ERROR - fatal errors that occur during PHP's initial startup ; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's ; initial startup ; E_COMPILE_ERROR - fatal compile-time errors ; E_COMPILE_WARNING - compile-time warnings (non-fatal errors) ; E_USER_ERROR - user-generated error message ; E_USER_WARNING - user-generated warning message ; E_USER_NOTICE - user-generated notice message ; E_DEPRECATED - warn about code that will not work in future versions ; of PHP ; E_USER_DEPRECATED - user-generated deprecation warnings ; ; Common Values: ; E_ALL (Show all errors, warnings and notices including coding standards.) ; E_ALL & ~E_NOTICE (Show all errors, except for notices) ; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.) ; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors) ; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; http://php.net/error-reporting error_reporting = 1 ; This directive controls whether or not and where PHP will output errors, ; notices and warnings too. Error output is very useful during development, but ; it could be very dangerous in production environments. Depending on the code ; which is triggering the error, sensitive information could potentially leak ; out of your application such as database usernames and passwords or worse. ; For production environments, we recommend logging errors rather than ; sending them to STDOUT. ; Possible Values: ; Off = Do not display any errors ; stderr = Display errors to STDERR (affects only CGI/CLI binaries!) ; On or stdout = Display errors to STDOUT ; Default Value: On ; Development Value: On ; Production Value: Off ; http://php.net/display-errors display_errors = Off ; The display of errors which occur during PHP's startup sequence are handled ; separately from display_errors. PHP's default behavior is to suppress those ; errors from clients. Turning the display of startup errors on can be useful in ; debugging configuration problems. We strongly recommend you ; set this to 'off' for production servers. ; Default Value: Off ; Development Value: On ; Production Value: Off ; http://php.net/display-startup-errors display_startup_errors = Off ; Besides displaying errors, PHP can also log errors to locations such as a ; server-specific log, STDERR, or a location specified by the error_log ; directive found below. While errors should not be displayed on productions ; servers they should still be monitored and logging is a great way to do that. ; Default Value: Off ; Development Value: On ; Production Value: On ; http://php.net/log-errors log_errors = On ; Set maximum length of log_errors. In error_log information about the source is ; added. The default is 1024 and 0 allows to not apply any maximum length at all. ; http://php.net/log-errors-max-len log_errors_max_len = 1024 ; Do not log repeated messages. Repeated errors must occur in same file on same ; line unless ignore_repeated_source is set true. ; http://php.net/ignore-repeated-errors ignore_repeated_errors = Off ; Ignore source of message when ignoring repeated messages. When this setting ; is On you will not log errors with repeated messages from different files or ; source lines. ; http://php.net/ignore-repeated-source ignore_repeated_source = Off ; If this parameter is set to Off, then memory leaks will not be shown (on ; stdout or in the log). This has only effect in a debug compile, and if ; error reporting includes E_WARNING in the allowed list ; http://php.net/report-memleaks report_memleaks = On ; This setting is on by default. ;report_zend_debug = 0 ; Store the last error/warning message in $php_errormsg (boolean). Setting this value ; to On can assist in debugging and is appropriate for development servers. It should ; however be disabled on production servers. ; Default Value: Off ; Development Value: On ; Production Value: Off ; http://php.net/track-errors track_errors = Off ; Turn off normal error reporting and emit XML-RPC error XML ; http://php.net/xmlrpc-errors ;xmlrpc_errors = 0 ; An XML-RPC faultCode ;xmlrpc_error_number = 0 ; When PHP displays or logs an error, it has the capability of formatting the ; error message as HTML for easier reading. This directive controls whether ; the error message is formatted as HTML or not. ; Note: This directive is hardcoded to Off for the CLI SAPI ; Default Value: On ; Development Value: On ; Production value: On ; http://php.net/html-errors html_errors = Off ; If html_errors is set to On *and* docref_root is not empty, then PHP ; produces clickable error messages that direct to a page describing the error ; or function causing the error in detail. ; You can download a copy of the PHP manual from http://php.net/docs ; and change docref_root to the base URL of your local copy including the ; leading '/'. You must also specify the file extension being used including ; the dot. PHP's default behavior is to leave these settings empty, in which ; case no links to documentation are generated. ; Note: Never use this feature for production boxes. ; http://php.net/docref-root ; Examples ;docref_root = "/phpmanual/" ; http://php.net/docref-ext ;docref_ext = .html ; String to output before an error message. PHP's default behavior is to leave ; this setting blank. ; http://php.net/error-prepend-string ; Example: ;error_prepend_string = "" ; String to output after an error message. PHP's default behavior is to leave ; this setting blank. ; http://php.net/error-append-string ; Example: ;error_append_string = "" ; Log errors to specified file. PHP's default behavior is to leave this value ; empty. ; http://php.net/error-log ; Example: ;error_log = php_errors.log ; Log errors to syslog (Event Log on Windows). ;error_log = syslog error_log = /var/log/php/error_log_cli_56 ;windows.show_crt_warning ; Default value: 0 ; Development value: 0 ; Production value: 0 ;;;;;;;;;;;;;;;;; ; Data Handling ; ;;;;;;;;;;;;;;;;; ; The separator used in PHP generated URLs to separate arguments. ; PHP's default setting is "&". ; http://php.net/arg-separator.output ; Example: ;arg_separator.output = "&" ; List of separator(s) used by PHP to parse input URLs into variables. ; PHP's default setting is "&". ; NOTE: Every character in this directive is considered as separator! ; http://php.net/arg-separator.input ; Example: ;arg_separator.input = ";&" ; This directive determines which super global arrays are registered when PHP ; starts up. G,P,C,E & S are abbreviations for the following respective super ; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty ; paid for the registration of these arrays and because ENV is not as commonly ; used as the others, ENV is not recommended on productions servers. You ; can still get access to the environment variables through getenv() should you ; need to. ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS"; ; http://php.net/variables-order variables_order = "GPCS" ; This directive determines which super global data (G,P & C) should be ; registered into the super global array REQUEST. If so, it also determines ; the order in which that data is registered. The values for this directive ; are specified in the same manner as the variables_order directive, ; EXCEPT one. Leaving this value empty will cause PHP to use the value set ; in the variables_order directive. It does not mean it will leave the super ; globals array REQUEST empty. ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; http://php.net/request-order request_order = "GP" ; This directive determines whether PHP registers $argv & $argc each time it ; runs. $argv contains an array of all the arguments passed to PHP when a script ; is invoked. $argc contains an integer representing the number of arguments ; that were passed when the script was invoked. These arrays are extremely ; useful when running scripts from the command line. When this directive is ; enabled, registering these variables consumes CPU cycles and memory each time ; a script is executed. For performance reasons, this feature should be disabled ; on production servers. ; Note: This directive is hardcoded to On for the CLI SAPI ; Default Value: On ; Development Value: Off ; Production Value: Off ; http://php.net/register-argc-argv register_argc_argv = Off ; When enabled, the ENV, REQUEST and SERVER variables are created when they're ; first used (Just In Time) instead of when the script starts. If these ; variables are not used within a script, having this directive on will result ; in a performance gain. The PHP directive register_argc_argv must be disabled ; for this directive to have any affect. ; http://php.net/auto-globals-jit auto_globals_jit = On ; Whether PHP will read the POST data. ; This option is enabled by default. ; Most likely, you won't want to disable this option globally. It causes $_POST ; and $_FILES to always be empty; the only way you will be able to read the ; POST data will be through the php://input stream wrapper. This can be useful ; to proxy requests or to process the POST data in a memory efficient fashion. ; http://php.net/enable-post-data-reading ;enable_post_data_reading = Off ; Maximum size of POST data that PHP will accept. ; Its value may be 0 to disable the limit. It is ignored if POST data reading ; is disabled through enable_post_data_reading. ; http://php.net/post-max-size post_max_size = 350M ; Automatically add files before PHP document. ; http://php.net/auto-prepend-file auto_prepend_file = ; Automatically add files after PHP document. ; http://php.net/auto-append-file auto_append_file = ; By default, PHP will output a character encoding using ; the Content-type: header. To disable sending of the charset, simply ; set it to be empty. ; ; PHP's built-in default is text/html ; http://php.net/default-mimetype default_mimetype = "text/html" ; PHP's default character set is set to UTF-8. ; http://php.net/default-charset default_charset = "UTF-8" ; PHP internal character encoding is set to empty. ; If empty, default_charset is used. ; http://php.net/internal-encoding ;internal_encoding = ; PHP input character encoding is set to empty. ; If empty, default_charset is used. ; http://php.net/input-encoding ;input_encoding = ; PHP output character encoding is set to empty. ; If empty, default_charset is used. ; mbstring or iconv output handler is used. ; See also output_buffer. ; http://php.net/output-encoding ;output_encoding = ; Always populate the $HTTP_RAW_POST_DATA variable. PHP's default behavior is ; to disable this feature and it will be removed in a future version. ; If post reading is disabled through enable_post_data_reading, ; $HTTP_RAW_POST_DATA is *NOT* populated. ; http://php.net/always-populate-raw-post-data always_populate_raw_post_data = -1 ;;;;;;;;;;;;;;;;;;;;;;;;; ; Paths and Directories ; ;;;;;;;;;;;;;;;;;;;;;;;;; ; UNIX: "/path1:/path2" ;include_path = ".:/php/includes" ; ; Windows: "\path1;\path2" ;include_path = ".;c:\php\includes" ; ; PHP's default setting for include_path is ".;/path/to/php/pear" ; http://php.net/include-path include_path = ".:/opt/php56/lib/php" ; The root of the PHP pages, used only if nonempty. ; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root ; if you are running php as a CGI under any web server (other than IIS) ; see documentation for security issues. The alternate is to use the ; cgi.force_redirect configuration below ; http://php.net/doc-root doc_root = ; The directory under which PHP opens the script using /~username used only ; if nonempty. ; http://php.net/user-dir user_dir = ; Directory in which the loadable extensions (modules) reside. ; http://php.net/extension-dir ; extension_dir = "./" ; On windows: ; extension_dir = "ext" extension_dir = "/opt/php56/lib/php/extensions/no-debug-non-zts-20131226/" ; Directory where the temporary files should be placed. ; Defaults to the system default (see sys_get_temp_dir) sys_temp_dir = "/tmp" ; Whether or not to enable the dl() function. The dl() function does NOT work ; properly in multithreaded servers, such as IIS or Zeus, and is automatically ; disabled on them. ; http://php.net/enable-dl enable_dl = Off ; cgi.force_redirect is necessary to provide security running PHP as a CGI under ; most web servers. Left undefined, PHP turns this on by default. You can ; turn it off here AT YOUR OWN RISK ; **You CAN safely turn this off for IIS, in fact, you MUST.** ; http://php.net/cgi.force-redirect ;cgi.force_redirect = 1 ; if cgi.nph is enabled it will force cgi to always sent Status: 200 with ; every request. PHP's default behavior is to disable this feature. ;cgi.nph = 1 ; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape ; (iPlanet) web servers, you MAY need to set an environment variable name that PHP ; will look for to know it is OK to continue execution. Setting this variable MAY ; cause security issues, KNOW WHAT YOU ARE DOING FIRST. ; http://php.net/cgi.redirect-status-env ;cgi.redirect_status_env = ; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's ; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok ; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting ; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting ; of zero causes PHP to behave as before. Default is 1. You should fix your scripts ; to use SCRIPT_FILENAME rather than PATH_TRANSLATED. ; http://php.net/cgi.fix-pathinfo ;cgi.fix_pathinfo=1 ; FastCGI under IIS (on WINNT based OS) supports the ability to impersonate ; security tokens of the calling client. This allows IIS to define the ; security context that the request runs under. mod_fastcgi under Apache ; does not currently support this feature (03/17/2002) ; Set to 1 if running under IIS. Default is zero. ; http://php.net/fastcgi.impersonate ;fastcgi.impersonate = 1 ; Disable logging through FastCGI connection. PHP's default behavior is to enable ; this feature. ;fastcgi.logging = 0 ; cgi.rfc2616_headers configuration option tells PHP what type of headers to ; use when sending HTTP response code. If set to 0, PHP sends Status: header that ; is supported by Apache. When this option is set to 1, PHP will send ; RFC2616 compliant header. ; Default is zero. ; http://php.net/cgi.rfc2616-headers ;cgi.rfc2616_headers = 0 ;;;;;;;;;;;;;;;; ; File Uploads ; ;;;;;;;;;;;;;;;; ; Whether to allow HTTP file uploads. ; http://php.net/file-uploads file_uploads = On ; Temporary directory for HTTP uploaded files (will use system default if not ; specified). ; http://php.net/upload-tmp-dir upload_tmp_dir = /tmp ; Maximum allowed size for uploaded files. ; http://php.net/upload-max-filesize upload_max_filesize = 325M ; Maximum number of files that can be uploaded via a single request max_file_uploads = 50 ;;;;;;;;;;;;;;;;;; ; Fopen wrappers ; ;;;;;;;;;;;;;;;;;; ; Whether to allow the treatment of URLs (like http:// or ftp://) as files. ; http://php.net/allow-url-fopen allow_url_fopen = On ; Whether to allow include/require to open URLs (like http:// or ftp://) as files. ; http://php.net/allow-url-include allow_url_include = Off ; Define the anonymous ftp password (your email address). PHP's default setting ; for this is empty. ; http://php.net/from ;from="john@doe.com" ; Define the User-Agent string. PHP's default setting for this is empty. ; http://php.net/user-agent ;user_agent="PHP" ; Default timeout for socket based streams (seconds) ; http://php.net/default-socket-timeout default_socket_timeout = 3600 ; If your scripts have to deal with files from Macintosh systems, ; or you are running on a Mac and need to deal with files from ; unix or win32 systems, setting this flag will cause PHP to ; automatically detect the EOL character in those files so that ; fgets() and file() will work regardless of the source of the file. ; http://php.net/auto-detect-line-endings auto_detect_line_endings = On ;;;;;;;;;;;;;;;;;;;;;; ; Dynamic Extensions ; ;;;;;;;;;;;;;;;;;;;;;; ; If you wish to have an extension loaded automatically, use the following ; syntax: ; ; extension=modulename.extension ; ; For example, on Windows: ; ; extension=msql.dll ; ; ... or under UNIX: ; ; extension=msql.so ; ; ... or with a path: ; ; extension=/path/to/extension/msql.so ; ; If you only provide the name of the extension, PHP will look for it in its ; default extension directory. ; ; Windows Extensions ; Note that ODBC support is built in, so no dll is needed for it. ; Note that many DLL files are located in the extensions/ (PHP 4) ext/ (PHP 5) ; extension folders as well as the separate PECL DLL download (PHP 5). ; Be sure to appropriately set the extension_dir directive. ; ;extension=php_bz2.dll ;extension=php_curl.dll ;extension=php_fileinfo.dll ;extension=php_gd2.dll ;extension=php_gettext.dll ;extension=php_gmp.dll ;extension=php_intl.dll ;extension=php_imap.dll ;extension=php_interbase.dll ;extension=php_ldap.dll ;extension=php_mbstring.dll ;extension=php_exif.dll ; Must be after mbstring as it depends on it ;extension=php_mysql.dll ;extension=php_mysqli.dll ;extension=php_oci8_12c.dll ; Use with Oracle Database 12c Instant Client ;extension=php_openssl.dll ;extension=php_pdo_firebird.dll ;extension=php_pdo_mysql.dll ;extension=php_pdo_oci.dll ;extension=php_pdo_odbc.dll ;extension=php_pdo_pgsql.dll ;extension=php_pdo_sqlite.dll ;extension=php_pgsql.dll ;extension=php_pspell.dll ;extension=php_shmop.dll ; The MIBS data available in the PHP distribution must be installed. ; See http://www.php.net/manual/en/snmp.installation.php ;extension=php_snmp.dll ;extension=php_soap.dll ;extension=php_sockets.dll ;extension=php_sqlite3.dll ;extension=php_sybase_ct.dll ;extension=php_tidy.dll ;extension=php_xmlrpc.dll ;extension=php_xsl.dll ;;;;;;;;;;;;;;;;;;; ; Module Settings ; ;;;;;;;;;;;;;;;;;;; [CLI Server] ; Whether the CLI web server uses ANSI color coding in its terminal output. cli_server.color = On [Date] ; Defines the default timezone used by the date functions ; http://php.net/date.timezone date.timezone = "UTC" ; http://php.net/date.default-latitude ;date.default_latitude = 31.7667 ; http://php.net/date.default-longitude ;date.default_longitude = 35.2333 ; http://php.net/date.sunrise-zenith ;date.sunrise_zenith = 90.583333 ; http://php.net/date.sunset-zenith ;date.sunset_zenith = 90.583333 [filter] ; http://php.net/filter.default ;filter.default = unsafe_raw ; http://php.net/filter.default-flags ;filter.default_flags = [iconv] ; Use of this INI entry is deprecated, use global input_encoding instead. ; If empty, default_charset or input_encoding or iconv.input_encoding is used. ; The precedence is: default_charset < intput_encoding < iconv.input_encoding ;iconv.input_encoding = ; Use of this INI entry is deprecated, use global internal_encoding instead. ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;iconv.internal_encoding = ; Use of this INI entry is deprecated, use global output_encoding instead. ; If empty, default_charset or output_encoding or iconv.output_encoding is used. ; The precedence is: default_charset < output_encoding < iconv.output_encoding ; To use an output encoding conversion, iconv's output handler must be set ; otherwise output encoding conversion cannot be performed. ;iconv.output_encoding = [intl] ;intl.default_locale = ; This directive allows you to produce PHP errors when some error ; happens within intl functions. The value is the level of the error produced. ; Default is 0, which does not produce any errors. ;intl.error_level = E_WARNING [sqlite] ; http://php.net/sqlite.assoc-case ;sqlite.assoc_case = 0 [sqlite3] ;sqlite3.extension_dir = [Pcre] ;PCRE library backtracking limit. ; http://php.net/pcre.backtrack-limit ;pcre.backtrack_limit=100000 ;PCRE library recursion limit. ;Please note that if you set this value to a high number you may consume all ;the available process stack and eventually crash PHP (due to reaching the ;stack size limit imposed by the Operating System). ; http://php.net/pcre.recursion-limit ;pcre.recursion_limit=100000 [Pdo] ; Whether to pool ODBC connections. Can be one of "strict", "relaxed" or "off" ; http://php.net/pdo-odbc.connection-pooling ;pdo_odbc.connection_pooling=strict ;pdo_odbc.db2_instance_name [Pdo_mysql] ; If mysqlnd is used: Number of cache slots for the internal result set cache ; http://php.net/pdo_mysql.cache_size pdo_mysql.cache_size = 2000 ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. ; http://php.net/pdo_mysql.default-socket pdo_mysql.default_socket= [Phar] ; http://php.net/phar.readonly ;phar.readonly = On ; http://php.net/phar.require-hash ;phar.require_hash = On ;phar.cache_list = [mail function] ; For Win32 only. ; http://php.net/smtp ;SMTP = localhost ; http://php.net/smtp-port ;smtp_port = 25 ; For Win32 only. ; http://php.net/sendmail-from ;sendmail_from = me@example.com ; For Unix only. You may supply arguments as well (default: "sendmail -t -i"). ; http://php.net/sendmail-path sendmail_path = /usr/sbin/sendmail -t -i ; Force the addition of the specified parameters to be passed as extra parameters ; to the sendmail binary. These parameters will always replace the value of ; the 5th parameter to mail(). ;mail.force_extra_parameters = ; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename mail.add_x_header = Off ; The path to a log file that will log all mail() calls. Log entries include ; the full path of the script, line number, To address and headers. ;mail.log = ; Log mail to syslog (Event Log on Windows). ;mail.log = syslog [SQL] ; http://php.net/sql.safe-mode sql.safe_mode = Off [ODBC] ; http://php.net/odbc.default-db ;odbc.default_db = Not yet implemented ; http://php.net/odbc.default-user ;odbc.default_user = Not yet implemented ; http://php.net/odbc.default-pw ;odbc.default_pw = Not yet implemented ; Controls the ODBC cursor model. ; Default: SQL_CURSOR_STATIC (default). ;odbc.default_cursortype ; Allow or prevent persistent links. ; http://php.net/odbc.allow-persistent odbc.allow_persistent = On ; Check that a connection is still valid before reuse. ; http://php.net/odbc.check-persistent odbc.check_persistent = On ; Maximum number of persistent links. -1 means no limit. ; http://php.net/odbc.max-persistent odbc.max_persistent = -1 ; Maximum number of links (persistent + non-persistent). -1 means no limit. ; http://php.net/odbc.max-links odbc.max_links = -1 ; Handling of LONG fields. Returns number of bytes to variables. 0 means ; passthru. ; http://php.net/odbc.defaultlrl odbc.defaultlrl = 4096 ; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char. ; See the documentation on odbc_binmode and odbc_longreadlen for an explanation ; of odbc.defaultlrl and odbc.defaultbinmode ; http://php.net/odbc.defaultbinmode odbc.defaultbinmode = 1 ;birdstep.max_links = -1 [Interbase] ; Allow or prevent persistent links. ibase.allow_persistent = 1 ; Maximum number of persistent links. -1 means no limit. ibase.max_persistent = -1 ; Maximum number of links (persistent + non-persistent). -1 means no limit. ibase.max_links = -1 ; Default database name for ibase_connect(). ;ibase.default_db = ; Default username for ibase_connect(). ;ibase.default_user = ; Default password for ibase_connect(). ;ibase.default_password = ; Default charset for ibase_connect(). ;ibase.default_charset = ; Default timestamp format. ibase.timestampformat = "%Y-%m-%d %H:%M:%S" ; Default date format. ibase.dateformat = "%Y-%m-%d" ; Default time format. ibase.timeformat = "%H:%M:%S" [MySQL] ; Allow accessing, from PHP's perspective, local files with LOAD DATA statements ; http://php.net/mysql.allow_local_infile mysql.allow_local_infile = On ; Allow or prevent persistent links. ; http://php.net/mysql.allow-persistent mysql.allow_persistent = On ; If mysqlnd is used: Number of cache slots for the internal result set cache ; http://php.net/mysql.cache_size mysql.cache_size = 2000 ; Maximum number of persistent links. -1 means no limit. ; http://php.net/mysql.max-persistent mysql.max_persistent = -1 ; Maximum number of links (persistent + non-persistent). -1 means no limit. ; http://php.net/mysql.max-links mysql.max_links = -1 ; Default port number for mysql_connect(). If unset, mysql_connect() will use ; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the ; compile-time value defined MYSQL_PORT (in that order). Win32 will only look ; at MYSQL_PORT. ; http://php.net/mysql.default-port mysql.default_port = ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. ; http://php.net/mysql.default-socket mysql.default_socket = ; Default host for mysql_connect() (doesn't apply in safe mode). ; http://php.net/mysql.default-host mysql.default_host = ; Default user for mysql_connect() (doesn't apply in safe mode). ; http://php.net/mysql.default-user mysql.default_user = ; Default password for mysql_connect() (doesn't apply in safe mode). ; Note that this is generally a *bad* idea to store passwords in this file. ; *Any* user with PHP access can run 'echo get_cfg_var("mysql.default_password") ; and reveal this password! And of course, any users with read access to this ; file will be able to reveal the password as well. ; http://php.net/mysql.default-password mysql.default_password = ; Maximum time (in seconds) for connect timeout. -1 means no limit ; http://php.net/mysql.connect-timeout mysql.connect_timeout = 60 ; Trace mode. When trace_mode is active (=On), warnings for table/index scans and ; SQL-Errors will be displayed. ; http://php.net/mysql.trace-mode mysql.trace_mode = Off [MySQLi] ; Maximum number of persistent links. -1 means no limit. ; http://php.net/mysqli.max-persistent mysqli.max_persistent = -1 ; Allow accessing, from PHP's perspective, local files with LOAD DATA statements ; http://php.net/mysqli.allow_local_infile ;mysqli.allow_local_infile = On ; Allow or prevent persistent links. ; http://php.net/mysqli.allow-persistent mysqli.allow_persistent = On ; Maximum number of links. -1 means no limit. ; http://php.net/mysqli.max-links mysqli.max_links = -1 ; If mysqlnd is used: Number of cache slots for the internal result set cache ; http://php.net/mysqli.cache_size mysqli.cache_size = 2000 ; Default port number for mysqli_connect(). If unset, mysqli_connect() will use ; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the ; compile-time value defined MYSQL_PORT (in that order). Win32 will only look ; at MYSQL_PORT. ; http://php.net/mysqli.default-port mysqli.default_port = 3306 ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. ; http://php.net/mysqli.default-socket mysqli.default_socket = ; Default host for mysql_connect() (doesn't apply in safe mode). ; http://php.net/mysqli.default-host mysqli.default_host = ; Default user for mysql_connect() (doesn't apply in safe mode). ; http://php.net/mysqli.default-user mysqli.default_user = ; Default password for mysqli_connect() (doesn't apply in safe mode). ; Note that this is generally a *bad* idea to store passwords in this file. ; *Any* user with PHP access can run 'echo get_cfg_var("mysqli.default_pw") ; and reveal this password! And of course, any users with read access to this ; file will be able to reveal the password as well. ; http://php.net/mysqli.default-pw mysqli.default_pw = ; Allow or prevent reconnect mysqli.reconnect = Off [mysqlnd] ; Enable / Disable collection of general statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. ; http://php.net/mysqlnd.collect_statistics mysqlnd.collect_statistics = 0 ; Enable / Disable collection of memory usage statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. ; http://php.net/mysqlnd.collect_memory_statistics mysqlnd.collect_memory_statistics = 0 ; Size of a pre-allocated buffer used when sending commands to MySQL in bytes. ; http://php.net/mysqlnd.net_cmd_buffer_size mysqlnd.net_cmd_buffer_size = 8192 ; Size of a pre-allocated buffer used for reading data sent by the server in ; bytes. ; http://php.net/mysqlnd.net_read_buffer_size mysqlnd.net_read_buffer_size = 131072 [OCI8] ; Connection: Enables privileged connections using external ; credentials (OCI_SYSOPER, OCI_SYSDBA) ; http://php.net/oci8.privileged-connect ;oci8.privileged_connect = Off ; Connection: The maximum number of persistent OCI8 connections per ; process. Using -1 means no limit. ; http://php.net/oci8.max-persistent ;oci8.max_persistent = -1 ; Connection: The maximum number of seconds a process is allowed to ; maintain an idle persistent connection. Using -1 means idle ; persistent connections will be maintained forever. ; http://php.net/oci8.persistent-timeout ;oci8.persistent_timeout = -1 ; Connection: The number of seconds that must pass before issuing a ; ping during oci_pconnect() to check the connection validity. When ; set to 0, each oci_pconnect() will cause a ping. Using -1 disables ; pings completely. ; http://php.net/oci8.ping-interval ;oci8.ping_interval = 60 ; Connection: Set this to a user chosen connection class to be used ; for all pooled server requests with Oracle 11g Database Resident ; Connection Pooling (DRCP). To use DRCP, this value should be set to ; the same string for all web servers running the same application, ; the database pool must be configured, and the connection string must ; specify to use a pooled server. ;oci8.connection_class = ; High Availability: Using On lets PHP receive Fast Application ; Notification (FAN) events generated when a database node fails. The ; database must also be configured to post FAN events. ;oci8.events = Off ; Tuning: This option enables statement caching, and specifies how ; many statements to cache. Using 0 disables statement caching. ; http://php.net/oci8.statement-cache-size ;oci8.statement_cache_size = 20 ; Tuning: Enables statement prefetching and sets the default number of ; rows that will be fetched automatically after statement execution. ; http://php.net/oci8.default-prefetch ;oci8.default_prefetch = 100 ; Compatibility. Using On means oci_close() will not close ; oci_connect() and oci_new_connect() connections. ; http://php.net/oci8.old-oci-close-semantics ;oci8.old_oci_close_semantics = Off [PostgreSQL] ; Allow or prevent persistent links. ; http://php.net/pgsql.allow-persistent pgsql.allow_persistent = On ; Detect broken persistent links always with pg_pconnect(). ; Auto reset feature requires a little overheads. ; http://php.net/pgsql.auto-reset-persistent pgsql.auto_reset_persistent = Off ; Maximum number of persistent links. -1 means no limit. ; http://php.net/pgsql.max-persistent pgsql.max_persistent = -1 ; Maximum number of links (persistent+non persistent). -1 means no limit. ; http://php.net/pgsql.max-links pgsql.max_links = -1 ; Ignore PostgreSQL backends Notice message or not. ; Notice message logging require a little overheads. ; http://php.net/pgsql.ignore-notice pgsql.ignore_notice = 0 ; Log PostgreSQL backends Notice message or not. ; Unless pgsql.ignore_notice=0, module cannot log notice message. ; http://php.net/pgsql.log-notice pgsql.log_notice = 0 [Sybase-CT] ; Allow or prevent persistent links. ; http://php.net/sybct.allow-persistent sybct.allow_persistent = On ; Maximum number of persistent links. -1 means no limit. ; http://php.net/sybct.max-persistent sybct.max_persistent = -1 ; Maximum number of links (persistent + non-persistent). -1 means no limit. ; http://php.net/sybct.max-links sybct.max_links = -1 ; Minimum server message severity to display. ; http://php.net/sybct.min-server-severity sybct.min_server_severity = 10 ; Minimum client message severity to display. ; http://php.net/sybct.min-client-severity sybct.min_client_severity = 10 ; Set per-context timeout ; http://php.net/sybct.timeout ;sybct.timeout= ;sybct.packet_size ; The maximum time in seconds to wait for a connection attempt to succeed before returning failure. ; Default: one minute ;sybct.login_timeout= ; The name of the host you claim to be connecting from, for display by sp_who. ; Default: none ;sybct.hostname= ; Allows you to define how often deadlocks are to be retried. -1 means "forever". ; Default: 0 ;sybct.deadlock_retry_count= [bcmath] ; Number of decimal digits for all bcmath functions. ; http://php.net/bcmath.scale bcmath.scale = 0 [browscap] ; http://php.net/browscap ;browscap = extra/browscap.ini [Session] ; Handler used to store/retrieve data. ; http://php.net/session.save-handler session.save_handler = files ; Argument passed to save_handler. In the case of files, this is the path ; where data files are stored. Note: Windows users have to change this ; variable in order to use PHP's session functions. ; ; The path can be defined as: ; ; session.save_path = "N;/path" ; ; where N is an integer. Instead of storing all the session files in ; /path, what this will do is use subdirectories N-levels deep, and ; store the session data in those directories. This is useful if ; your OS has problems with many files in one directory, and is ; a more efficient layout for servers that handle many sessions. ; ; NOTE 1: PHP will not create this directory structure automatically. ; You can use the script in the ext/session dir for that purpose. ; NOTE 2: See the section on garbage collection below if you choose to ; use subdirectories for session storage ; ; The file storage module creates files using mode 600 by default. ; You can change that by using ; ; session.save_path = "N;MODE;/path" ; ; where MODE is the octal representation of the mode. Note that this ; does not overwrite the process's umask. ; http://php.net/session.save-path session.save_path = "/opt/tmp" ; Whether to use strict session mode. ; Strict session mode does not accept uninitialized session ID and regenerate ; session ID if browser sends uninitialized session ID. Strict mode protects ; applications from session fixation via session adoption vulnerability. It is ; disabled by default for maximum compatibility, but enabling it is encouraged. ; https://wiki.php.net/rfc/strict_sessions session.use_strict_mode = 0 ; Whether to use cookies. ; http://php.net/session.use-cookies session.use_cookies = 1 ; http://php.net/session.cookie-secure ;session.cookie_secure = ; This option forces PHP to fetch and use a cookie for storing and maintaining ; the session id. We encourage this operation as it's very helpful in combating ; session hijacking when not specifying and managing your own session id. It is ; not the be-all and end-all of session hijacking defense, but it's a good start. ; http://php.net/session.use-only-cookies session.use_only_cookies = 1 ; Name of the session (used as cookie name). ; http://php.net/session.name session.name = PHPSESSID ; Initialize session on request startup. ; http://php.net/session.auto-start session.auto_start = 0 ; Lifetime in seconds of cookie or, if 0, until browser is restarted. ; http://php.net/session.cookie-lifetime session.cookie_lifetime = 0 ; The path for which the cookie is valid. ; http://php.net/session.cookie-path session.cookie_path = / ; The domain for which the cookie is valid. ; http://php.net/session.cookie-domain session.cookie_domain = ; Whether or not to add the httpOnly flag to the cookie, which makes it inaccessible to browser scripting languages such as JavaScript. ; http://php.net/session.cookie-httponly session.cookie_httponly = 1 ; Handler used to serialize data. php is the standard serializer of PHP. ; http://php.net/session.serialize-handler session.serialize_handler = php ; Defines the probability that the 'garbage collection' process is started ; on every session initialization. The probability is calculated by using ; gc_probability/gc_divisor. Where session.gc_probability is the numerator ; and gc_divisor is the denominator in the equation. Setting this value to 1 ; when the session.gc_divisor value is 100 will give you approximately a 1% chance ; the gc will run on any give request. ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; http://php.net/session.gc-probability session.gc_probability = 1 ; Defines the probability that the 'garbage collection' process is started on every ; session initialization. The probability is calculated by using the following equation: ; gc_probability/gc_divisor. Where session.gc_probability is the numerator and ; session.gc_divisor is the denominator in the equation. Setting this value to 1 ; when the session.gc_divisor value is 100 will give you approximately a 1% chance ; the gc will run on any give request. Increasing this value to 1000 will give you ; a 0.1% chance the gc will run on any give request. For high volume production servers, ; this is a more efficient approach. ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; http://php.net/session.gc-divisor session.gc_divisor = 1000 ; After this number of seconds, stored data will be seen as 'garbage' and ; cleaned up by the garbage collection process. ; http://php.net/session.gc-maxlifetime session.gc_maxlifetime = 1440 ; NOTE: If you are using the subdirectory option for storing session files ; (see session.save_path above), then garbage collection does *not* ; happen automatically. You will need to do your own garbage ; collection through a shell script, cron entry, or some other method. ; For example, the following script would is the equivalent of ; setting session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes): ; find /path/to/sessions -cmin +24 -type f | xargs rm ; Check HTTP Referer to invalidate externally stored URLs containing ids. ; HTTP_REFERER has to contain this substring for the session to be ; considered as valid. ; http://php.net/session.referer-check session.referer_check = ; How many bytes to read from the file. ; http://php.net/session.entropy-length session.entropy_length = 32 ; Specified here to create the session id. ; http://php.net/session.entropy-file ; Defaults to /dev/urandom ; On systems that don't have /dev/urandom but do have /dev/arandom, this will default to /dev/arandom ; If neither are found at compile time, the default is no entropy file. ; On windows, setting the entropy_length setting will activate the ; Windows random source (using the CryptoAPI) session.entropy_file = /dev/urandom ; Set to {nocache,private,public,} to determine HTTP caching aspects ; or leave this empty to avoid sending anti-caching headers. ; http://php.net/session.cache-limiter session.cache_limiter = nocache ; Document expires after n minutes. ; http://php.net/session.cache-expire session.cache_expire = 180 ; trans sid support is disabled by default. ; Use of trans sid may risk your users' security. ; Use this option with caution. ; - User may send URL contains active session ID ; to other person via. email/irc/etc. ; - URL that contains active session ID may be stored ; in publicly accessible computer. ; - User may access your site with the same session ID ; always using URL stored in browser's history or bookmarks. ; http://php.net/session.use-trans-sid session.use_trans_sid = 0 ; Select a hash function for use in generating session ids. ; Possible Values ; 0 (MD5 128 bits) ; 1 (SHA-1 160 bits) ; This option may also be set to the name of any hash function supported by ; the hash extension. A list of available hashes is returned by the hash_algos() ; function. ; http://php.net/session.hash-function session.hash_function = 0 ; Define how many bits are stored in each character when converting ; the binary hash data to something readable. ; Possible values: ; 4 (4 bits: 0-9, a-f) ; 5 (5 bits: 0-9, a-v) ; 6 (6 bits: 0-9, a-z, A-Z, "-", ",") ; Default Value: 4 ; Development Value: 5 ; Production Value: 5 ; http://php.net/session.hash-bits-per-character session.hash_bits_per_character = 5 ; The URL rewriter will look for URLs in a defined set of HTML tags. ; form/fieldset are special; if you include them here, the rewriter will ; add a hidden field with the info which is otherwise appended ; to URLs. If you want XHTML conformity, remove the form entry. ; Note that all valid entries require a "=", even if no value follows. ; Default Value: "a=href,area=href,frame=src,form=,fieldset=" ; Development Value: "a=href,area=href,frame=src,input=src,form=fakeentry" ; Production Value: "a=href,area=href,frame=src,input=src,form=fakeentry" ; http://php.net/url-rewriter.tags url_rewriter.tags = "a=href,area=href,frame=src,input=src,form=fakeentry" ; Enable upload progress tracking in $_SESSION ; Default Value: On ; Development Value: On ; Production Value: On ; http://php.net/session.upload-progress.enabled ;session.upload_progress.enabled = On ; Cleanup the progress information as soon as all POST data has been read ; (i.e. upload completed). ; Default Value: On ; Development Value: On ; Production Value: On ; http://php.net/session.upload-progress.cleanup ;session.upload_progress.cleanup = On ; A prefix used for the upload progress key in $_SESSION ; Default Value: "upload_progress_" ; Development Value: "upload_progress_" ; Production Value: "upload_progress_" ; http://php.net/session.upload-progress.prefix ;session.upload_progress.prefix = "upload_progress_" ; The index name (concatenated with the prefix) in $_SESSION ; containing the upload progress information ; Default Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Development Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Production Value: "PHP_SESSION_UPLOAD_PROGRESS" ; http://php.net/session.upload-progress.name ;session.upload_progress.name = "PHP_SESSION_UPLOAD_PROGRESS" ; How frequently the upload progress should be updated. ; Given either in percentages (per-file), or in bytes ; Default Value: "1%" ; Development Value: "1%" ; Production Value: "1%" ; http://php.net/session.upload-progress.freq ;session.upload_progress.freq = "1%" ; The minimum delay between updates, in seconds ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; http://php.net/session.upload-progress.min-freq ;session.upload_progress.min_freq = "1" [MSSQL] ; Allow or prevent persistent links. mssql.allow_persistent = On ; Maximum number of persistent links. -1 means no limit. mssql.max_persistent = -1 ; Maximum number of links (persistent+non persistent). -1 means no limit. mssql.max_links = -1 ; Minimum error severity to display. mssql.min_error_severity = 10 ; Minimum message severity to display. mssql.min_message_severity = 10 ; Compatibility mode with old versions of PHP 3.0. mssql.compatibility_mode = Off ; Connect timeout ;mssql.connect_timeout = 5 ; Query timeout ;mssql.timeout = 60 ; Valid range 0 - 2147483647. Default = 4096. ;mssql.textlimit = 4096 ; Valid range 0 - 2147483647. Default = 4096. ;mssql.textsize = 4096 ; Limits the number of records in each batch. 0 = all records in one batch. ;mssql.batchsize = 0 ; Specify how datetime and datetim4 columns are returned ; On => Returns data converted to SQL server settings ; Off => Returns values as YYYY-MM-DD hh:mm:ss ;mssql.datetimeconvert = On ; Use NT authentication when connecting to the server mssql.secure_connection = Off ; Specify max number of processes. -1 = library default ; msdlib defaults to 25 ; FreeTDS defaults to 4096 ;mssql.max_procs = -1 ; Specify client character set. ; If empty or not set the client charset from freetds.conf is used ; This is only used when compiled with FreeTDS ;mssql.charset = "ISO-8859-1" [Assertion] ; Assert(expr); active by default. ; http://php.net/assert.active ;assert.active = On ; Issue a PHP warning for each failed assertion. ; http://php.net/assert.warning ;assert.warning = On ; Don't bail out by default. ; http://php.net/assert.bail ;assert.bail = Off ; User-function to be called if an assertion fails. ; http://php.net/assert.callback ;assert.callback = 0 ; Eval the expression with current error_reporting(). Set to true if you want ; error_reporting(0) around the eval(). ; http://php.net/assert.quiet-eval ;assert.quiet_eval = 0 [COM] ; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs ; http://php.net/com.typelib-file ;com.typelib_file = ; allow Distributed-COM calls ; http://php.net/com.allow-dcom ;com.allow_dcom = true ; autoregister constants of a components typlib on com_load() ; http://php.net/com.autoregister-typelib ;com.autoregister_typelib = true ; register constants casesensitive ; http://php.net/com.autoregister-casesensitive ;com.autoregister_casesensitive = false ; show warnings on duplicate constant registrations ; http://php.net/com.autoregister-verbose ;com.autoregister_verbose = true ; The default character set code-page to use when passing strings to and from COM objects. ; Default: system ANSI code page ;com.code_page= [mbstring] ; language for internal character representation. ; This affects mb_send_mail() and mbstrig.detect_order. ; http://php.net/mbstring.language ;mbstring.language = Japanese ; Use of this INI entry is deprecated, use global internal_encoding instead. ; internal/script encoding. ; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*) ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;mbstring.internal_encoding = ; Use of this INI entry is deprecated, use global input_encoding instead. ; http input encoding. ; mbstring.encoding_traslation = On is needed to use this setting. ; If empty, default_charset or input_encoding or mbstring.input is used. ; The precedence is: default_charset < intput_encoding < mbsting.http_input ; http://php.net/mbstring.http-input ;mbstring.http_input = ; Use of this INI entry is deprecated, use global output_encoding instead. ; http output encoding. ; mb_output_handler must be registered as output buffer to function. ; If empty, default_charset or output_encoding or mbstring.http_output is used. ; The precedence is: default_charset < output_encoding < mbstring.http_output ; To use an output encoding conversion, mbstring's output handler must be set ; otherwise output encoding conversion cannot be performed. ; http://php.net/mbstring.http-output ;mbstring.http_output = ; enable automatic encoding translation according to ; mbstring.internal_encoding setting. Input chars are ; converted to internal encoding by setting this to On. ; Note: Do _not_ use automatic encoding translation for ; portable libs/applications. ; http://php.net/mbstring.encoding-translation ;mbstring.encoding_translation = Off ; automatic encoding detection order. ; "auto" detect order is changed according to mbstring.language ; http://php.net/mbstring.detect-order ;mbstring.detect_order = auto ; substitute_character used when character cannot be converted ; one from another ; http://php.net/mbstring.substitute-character ;mbstring.substitute_character = none ; overload(replace) single byte functions by mbstring functions. ; mail(), ereg(), etc are overloaded by mb_send_mail(), mb_ereg(), ; etc. Possible values are 0,1,2,4 or combination of them. ; For example, 7 for overload everything. ; 0: No overload ; 1: Overload mail() function ; 2: Overload str*() functions ; 4: Overload ereg*() functions ; http://php.net/mbstring.func-overload ;mbstring.func_overload = 0 ; enable strict encoding detection. ; Default: Off ;mbstring.strict_detection = On ; This directive specifies the regex pattern of content types for which mb_output_handler() ; is activated. ; Default: mbstring.http_output_conv_mimetype=^(text/|application/xhtml\+xml) ;mbstring.http_output_conv_mimetype= [gd] ; Tell the jpeg decode to ignore warnings and try to create ; a gd image. The warning will then be displayed as notices ; disabled by default ; http://php.net/gd.jpeg-ignore-warning ;gd.jpeg_ignore_warning = 0 [exif] ; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS. ; With mbstring support this will automatically be converted into the encoding ; given by corresponding encode setting. When empty mbstring.internal_encoding ; is used. For the decode settings you can distinguish between motorola and ; intel byte order. A decode setting cannot be empty. ; http://php.net/exif.encode-unicode ;exif.encode_unicode = ISO-8859-15 ; http://php.net/exif.decode-unicode-motorola ;exif.decode_unicode_motorola = UCS-2BE ; http://php.net/exif.decode-unicode-intel ;exif.decode_unicode_intel = UCS-2LE ; http://php.net/exif.encode-jis ;exif.encode_jis = ; http://php.net/exif.decode-jis-motorola ;exif.decode_jis_motorola = JIS ; http://php.net/exif.decode-jis-intel ;exif.decode_jis_intel = JIS [Tidy] ; The path to a default tidy configuration file to use when using tidy ; http://php.net/tidy.default-config ;tidy.default_config = /usr/local/lib/php/default.tcfg ; Should tidy clean and repair output automatically? ; WARNING: Do not use this option if you are generating non-html content ; such as dynamic images ; http://php.net/tidy.clean-output tidy.clean_output = Off [soap] ; Enables or disables WSDL caching feature. ; http://php.net/soap.wsdl-cache-enabled soap.wsdl_cache_enabled=1 ; Sets the directory name where SOAP extension will put cache files. ; http://php.net/soap.wsdl-cache-dir soap.wsdl_cache_dir="/tmp" ; (time to live) Sets the number of second while cached file will be used ; instead of original one. ; http://php.net/soap.wsdl-cache-ttl soap.wsdl_cache_ttl=86400 ; Sets the size of the cache limit. (Max. number of WSDL files to cache) soap.wsdl_cache_limit = 5 [sysvshm] ; A default size of the shared memory segment ;sysvshm.init_mem = 10000 [ldap] ; Sets the maximum number of open links or -1 for unlimited. ldap.max_links = -1 [mcrypt] ; For more information about mcrypt settings see http://php.net/mcrypt-module-open ; Directory where to load mcrypt algorithms ; Default: Compiled in into libmcrypt (usually /usr/local/lib/libmcrypt) ;mcrypt.algorithms_dir= ; Directory where to load mcrypt modes ; Default: Compiled in into libmcrypt (usually /usr/local/lib/libmcrypt) ;mcrypt.modes_dir= [dba] ;dba.default_handler= [opcache] ; Determines if Zend OPCache is enabled ;opcache.enable=0 ; Determines if Zend OPCache is enabled for the CLI version of PHP ;opcache.enable_cli=0 ; The OPcache shared memory storage size. ;opcache.memory_consumption=64 ; The amount of memory for interned strings in Mbytes. ;opcache.interned_strings_buffer=4 ; The maximum number of keys (scripts) in the OPcache hash table. ; Only numbers between 200 and 100000 are allowed. ;opcache.max_accelerated_files=2000 ; The maximum percentage of "wasted" memory until a restart is scheduled. ;opcache.max_wasted_percentage=5 ; When this directive is enabled, the OPcache appends the current working ; directory to the script key, thus eliminating possible collisions between ; files with the same name (basename). Disabling the directive improves ; performance, but may break existing applications. ;opcache.use_cwd=1 ; When disabled, you must reset the OPcache manually or restart the ; webserver for changes to the filesystem to take effect. ;opcache.validate_timestamps=1 ; How often (in seconds) to check file timestamps for changes to the shared ; memory storage allocation. ("1" means validate once per second, but only ; once per request. "0" means always validate) ;opcache.revalidate_freq=2 ; Enables or disables file search in include_path optimization ;opcache.revalidate_path=0 ; If disabled, all PHPDoc comments are dropped from the code to reduce the ; size of the optimized code. ;opcache.save_comments=1 ; If disabled, PHPDoc comments are not loaded from SHM, so "Doc Comments" ; may be always stored (save_comments=1), but not loaded by applications ; that don't need them anyway. ;opcache.load_comments=1 ; If enabled, a fast shutdown sequence is used for the accelerated code ;opcache.fast_shutdown=0 ; Allow file existence override (file_exists, etc.) performance feature. ;opcache.enable_file_override=0 ; A bitmask, where each bit enables or disables the appropriate OPcache ; passes ;opcache.optimization_level=0xffffffff ;opcache.inherited_hack=1 ;opcache.dups_fix=0 ; The location of the OPcache blacklist file (wildcards allowed). ; Each OPcache blacklist file is a text file that holds the names of files ; that should not be accelerated. The file format is to add each filename ; to a new line. The filename may be a full path or just a file prefix ; (i.e., /var/www/x blacklists all the files and directories in /var/www ; that start with 'x'). Line starting with a ; are ignored (comments). ;opcache.blacklist_filename= ; Allows exclusion of large files from being cached. By default all files ; are cached. ;opcache.max_file_size=0 ; Check the cache checksum each N requests. ; The default value of "0" means that the checks are disabled. ;opcache.consistency_checks=0 ; How long to wait (in seconds) for a scheduled restart to begin if the cache ; is not being accessed. ;opcache.force_restart_timeout=180 ; OPcache error_log file name. Empty string assumes "stderr". ;opcache.error_log= ; All OPcache errors go to the Web server log. ; By default, only fatal errors (level 0) or errors (level 1) are logged. ; You can also enable warnings (level 2), info messages (level 3) or ; debug messages (level 4). ;opcache.log_verbosity_level=1 ; Preferred Shared Memory back-end. Leave empty and let the system decide. ;opcache.preferred_memory_model= ; Protect the shared memory from unexpected writing during script execution. ; Useful for internal debugging only. ;opcache.protect_memory=0 [curl] ; A default value for the CURLOPT_CAINFO option. This is required to be an ; absolute path. ;curl.cainfo = [openssl] ; The location of a Certificate Authority (CA) file on the local filesystem ; to use when verifying the identity of SSL/TLS peers. Most users should ; not specify a value for this directive as PHP will attempt to use the ; OS-managed cert stores in its absence. If specified, this value may still ; be overridden on a per-stream basis via the "cafile" SSL stream context ; option. ;openssl.cafile= ; If openssl.cafile is not specified or if the CA file is not found, the ; directory pointed to by openssl.capath is searched for a suitable ; certificate. This value must be a correctly hashed certificate directory. ; Most users should not specify a value for this directive as PHP will ; attempt to use the OS-managed cert stores in its absence. If specified, ; this value may still be overridden on a per-stream basis via the "capath" ; SSL stream context option. ;openssl.capath= ; Local Variables: ; tab-width: 4 ; End: [Zend] zend_extension="/usr/local/ioncube/ioncube_loader_lin_5.6.so" ; fix for segfaults auto_globals_jit = Off cgi.fix_pathinfo = 1 mbstring.http_input = "pass" mbstring.http_output = "pass" mbstring.encoding_translation = 0 ; Enable Extensions extension=uploadprogress.so extension=imagick.so extension=jsmin.so extension=redis.so ================================================ FILE: aegir/conf/php/php56-fpm ================================================ #!/bin/bash ### BEGIN INIT INFO # Provides: php56-fpm # Required-Start: $remote_fs $network # Required-Stop: $remote_fs $network # Default-Start: 2 3 4 5 # Default-Stop: 0 1 6 # Short-Description: starts php56-fpm # Description: starts the PHP FastCGI Process Manager daemon ### END INIT INFO prefix=/opt/php56 exec_prefix=${prefix} php_fpm_BIN=/opt/php56/sbin/php-fpm php_fpm_CONF=/opt/php56/etc/php56-fpm.conf php_fpm_PID=/run/php56-fpm.pid php_opts="--fpm-config $php_fpm_CONF --pid $php_fpm_PID -c /opt/php56/etc/php56.ini" wait_for_pid() { try=0 while test $try -lt 5; do case "$1" in 'created') if [ -f "$2" ]; then try='' break fi ;; 'removed') if [ ! -f "$2" ]; then try='' break fi ;; esac echo -n . try=`expr $try + 1` sleep 1 done } case "$1" in start) echo -n "Starting php56-fpm..." $php_fpm_BIN --daemonize $php_opts if [ "$?" != 0 ]; then echo " failed" exit 1 fi wait_for_pid created $php_fpm_PID if [ -n "$try" ]; then echo " failed" exit 1 else echo " done" fi ;; stop) echo -n "Gracefully shutting down php56-fpm..." if [ ! -r $php_fpm_PID ]; then echo "warning, no pid file found - php56-fpm is not running ?" exit 1 fi kill -QUIT `cat $php_fpm_PID` wait_for_pid removed $php_fpm_PID if [ -n "$try" ]; then echo " failed. Use force-quit" exit 1 else echo " done" fi ;; status) if [ ! -r $php_fpm_PID ]; then echo "php56-fpm is stopped" exit 0 fi PID=`cat $php_fpm_PID` if ps -p $PID | grep -q $PID; then echo "php56-fpm (pid $PID) is running..." else echo "php56-fpm dead but pid file exists" fi ;; force-quit) echo -n "Terminating php56-fpm..." if [ ! -r $php_fpm_PID ]; then echo "warning, no pid file found - php56-fpm is not running ?" exit 1 fi kill -TERM `cat $php_fpm_PID` wait_for_pid removed $php_fpm_PID if [ -n "$try" ]; then echo " failed" exit 1 else echo " done" fi ;; restart) $0 stop $0 start ;; reload) echo -n "Reloading service php56-fpm..." if [ ! -r $php_fpm_PID ]; then echo "warning, no pid file found - php56-fpm is not running ?" exit 1 fi kill -USR2 `cat $php_fpm_PID` echo " done" ;; *) echo "Usage: $0 {start|stop|force-quit|restart|reload|status}" exit 1 ;; esac ================================================ FILE: aegir/conf/php/php56-fpm.conf ================================================ ;;;;;;;;;;;;;;;;;;;;; ; FPM Configuration ; ;;;;;;;;;;;;;;;;;;;;; ; All relative paths in this configuration file are relative to PHP's install ; prefix (/opt/php56). This prefix can be dynamically changed by using the ; '-p' argument from the command line. ; Include one or more files. If glob(3) exists, it is used to include a bunch of ; files from a glob(3) pattern. This directive can be used everywhere in the ; file. ; Relative path can also be used. They will be prefixed by: ; - the global prefix if it's been set (-p argument) ; - /opt/php56 otherwise ;include=etc/fpm.d/*.conf ;;;;;;;;;;;;;;;;;; ; Global Options ; ;;;;;;;;;;;;;;;;;; [global] ; Pid file ; Note: the default prefix is /opt/php56/var ; Default Value: none pid = /run/php56-fpm.pid ; Error log file ; If it's set to "syslog", log is sent to syslogd instead of being written ; in a local file. ; Note: the default prefix is /opt/php56/var ; Default Value: log/php-fpm.log error_log = /var/log/php/php56-fpm-error.log ; syslog_facility is used to specify what type of program is logging the ; message. This lets syslogd specify that messages from different facilities ; will be handled differently. ; See syslog(3) for possible values (ex daemon equiv LOG_DAEMON) ; Default Value: daemon syslog.facility = daemon ; syslog_ident is prepended to every message. If you have multiple FPM ; instances running on the same server, you can change the default value ; which must suit common needs. ; Default Value: php-fpm syslog.ident = php56-fpm ; Log level ; Possible Values: alert, error, warning, notice, debug ; Default Value: notice log_level = warning ; If this number of child processes exit with SIGSEGV or SIGBUS within the time ; interval set by emergency_restart_interval then FPM will restart. A value ; of '0' means 'Off'. ; Default Value: 0 emergency_restart_threshold = 5 ; Interval of time used by emergency_restart_interval to determine when ; a graceful restart will be initiated. This can be useful to work around ; accidental corruptions in an accelerator's shared memory. ; Available Units: s(econds), m(inutes), h(ours), or d(ays) ; Default Unit: seconds ; Default Value: 0 emergency_restart_interval = 1m ; Time limit for child processes to wait for a reaction on signals from master. ; Available units: s(econds), m(inutes), h(ours), or d(ays) ; Default Unit: seconds ; Default Value: 0 process_control_timeout = 5s ; The maximum number of processes FPM will fork. This has been design to control ; the global number of processes when using dynamic PM within a lot of pools. ; Use it with caution. ; Note: A value of 0 indicates no limit ; Default Value: 0 process.max = 0 ; Specify the nice(2) priority to apply to the master process (only if set) ; The value can vary from -19 (highest priority) to 20 (lower priority) ; Note: - It will only work if the FPM master process is launched as root ; - The pool process will inherit the master process priority ; unless it specified otherwise ; Default Value: no set ; process.priority = -19 ; Send FPM to background. Set to 'no' to keep FPM in foreground for debugging. ; Default Value: yes daemonize = yes ; Set open file descriptor rlimit for the master process. ; Default Value: system defined value ;rlimit_files = 1024 ; Set max core size rlimit for the master process. ; Possible Values: 'unlimited' or an integer greater or equal to 0 ; Default Value: system defined value ;rlimit_core = 0 ; Specify the event mechanism FPM will use. The following is available: ; - select (any POSIX os) ; - poll (any POSIX os) ; - epoll (linux >= 2.5.44) ; - kqueue (FreeBSD >= 4.1, OpenBSD >= 2.9, NetBSD >= 2.0) ; - /dev/poll (Solaris >= 7) ; - port (Solaris >= 10) ; Default Value: not set (auto detection) ;events.mechanism = epoll ;;;;;;;;;;;;;;;;;;;; ; Pool Definitions ; ;;;;;;;;;;;;;;;;;;;; ; Multiple pools of child processes may be started with different listening ; ports and different management options. The name of the pool will be ; used in logs and stats. There is no limitation on the number of pools which ; FPM can handle. Your system will tell you anyway :) include = /opt/php56/etc/pool.d/*.conf ================================================ FILE: aegir/conf/php/php56.ini ================================================ [PHP] ;;;;;;;;;;;;;;;;;;; ; About php.ini ; ;;;;;;;;;;;;;;;;;;; ; PHP's initialization file, generally called php.ini, is responsible for ; configuring many of the aspects of PHP's behavior. ; PHP attempts to find and load this configuration from a number of locations. ; The following is a summary of its search order: ; 1. SAPI module specific location. ; 2. The PHPRC environment variable. (As of PHP 5.2.0) ; 3. A number of predefined registry keys on Windows (As of PHP 5.2.0) ; 4. Current working directory (except CLI) ; 5. The web server's directory (for SAPI modules), or directory of PHP ; (otherwise in Windows) ; 6. The directory from the --with-config-file-path compile time option, or the ; Windows directory (C:\windows or C:\winnt) ; See the PHP docs for more specific information. ; http://php.net/configuration.file ; The syntax of the file is extremely simple. Whitespace and lines ; beginning with a semicolon are silently ignored (as you probably guessed). ; Section headers (e.g. [Foo]) are also silently ignored, even though ; they might mean something in the future. ; Directives following the section heading [PATH=/www/mysite] only ; apply to PHP files in the /www/mysite directory. Directives ; following the section heading [HOST=www.example.com] only apply to ; PHP files served from www.example.com. Directives set in these ; special sections cannot be overridden by user-defined INI files or ; at runtime. Currently, [PATH=] and [HOST=] sections only work under ; CGI/FastCGI. ; http://php.net/ini.sections ; Directives are specified using the following syntax: ; directive = value ; Directive names are *case sensitive* - foo=bar is different from FOO=bar. ; Directives are variables used to configure PHP or PHP extensions. ; There is no name validation. If PHP can't find an expected ; directive because it is not set or is mistyped, a default value will be used. ; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one ; of the INI constants (On, Off, True, False, Yes, No and None) or an expression ; (e.g. E_ALL & ~E_NOTICE), a quoted string ("bar"), or a reference to a ; previously set variable or directive (e.g. ${foo}) ; Expressions in the INI file are limited to bitwise operators and parentheses: ; | bitwise OR ; ^ bitwise XOR ; & bitwise AND ; ~ bitwise NOT ; ! boolean NOT ; Boolean flags can be turned on using the values 1, On, True or Yes. ; They can be turned off using the values 0, Off, False or No. ; An empty string can be denoted by simply not writing anything after the equal ; sign, or by using the None keyword: ; foo = ; sets foo to an empty string ; foo = None ; sets foo to an empty string ; foo = "None" ; sets foo to the string 'None' ; If you use constants in your value, and these constants belong to a ; dynamically loaded extension (either a PHP extension or a Zend extension), ; you may only use these constants *after* the line that loads the extension. ;;;;;;;;;;;;;;;;;;; ; About this file ; ;;;;;;;;;;;;;;;;;;; ; PHP comes packaged with two INI files. One that is recommended to be used ; in production environments and one that is recommended to be used in ; development environments. ; php.ini-production contains settings which hold security, performance and ; best practices at its core. But please be aware, these settings may break ; compatibility with older or less security conscience applications. We ; recommending using the production ini in production and testing environments. ; php.ini-development is very similar to its production variant, except it is ; much more verbose when it comes to errors. We recommend using the ; development version only in development environments, as errors shown to ; application users can inadvertently leak otherwise secure information. ; This is php.ini-production INI file. ;;;;;;;;;;;;;;;;;;; ; Quick Reference ; ;;;;;;;;;;;;;;;;;;; ; The following are all the settings which are different in either the production ; or development versions of the INIs with respect to PHP's default behavior. ; Please see the actual settings later in the document for more details as to why ; we recommend these changes in PHP's behavior. display_errors = Off ; Default Value: On ; Development Value: On ; Production Value: Off ; display_startup_errors ; Default Value: Off ; Development Value: On ; Production Value: Off ; error_reporting ; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; html_errors ; Default Value: On ; Development Value: On ; Production value: On ; log_errors ; Default Value: Off ; Development Value: On ; Production Value: On ; max_input_time ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; output_buffering ; Default Value: Off ; Development Value: 4096 ; Production Value: 4096 ; register_argc_argv ; Default Value: On ; Development Value: Off ; Production Value: Off ; request_order ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; session.gc_divisor ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; session.hash_bits_per_character ; Default Value: 4 ; Development Value: 5 ; Production Value: 5 ; short_open_tag ; Default Value: On ; Development Value: Off ; Production Value: Off ; track_errors ; Default Value: Off ; Development Value: On ; Production Value: Off ; url_rewriter.tags ; Default Value: "a=href,area=href,frame=src,form=,fieldset=" ; Development Value: "a=href,area=href,frame=src,input=src,form=fakeentry" ; Production Value: "a=href,area=href,frame=src,input=src,form=fakeentry" ; variables_order ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS" ;;;;;;;;;;;;;;;;;;;; ; php.ini Options ; ;;;;;;;;;;;;;;;;;;;; ; Name for user-defined php.ini (.htaccess) files. Default is ".user.ini" ;user_ini.filename = ".user.ini" ; To disable this feature set this option to empty value user_ini.filename = ; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes) ;user_ini.cache_ttl = 300 ;;;;;;;;;;;;;;;;;;;; ; Language Options ; ;;;;;;;;;;;;;;;;;;;; ; Enable the PHP scripting language engine under Apache. ; http://php.net/engine engine = On ; This directive determines whether or not PHP will recognize code between ; tags as PHP source which should be processed as such. It is ; generally recommended that should be used and that this feature ; should be disabled, as enabling it may result in issues when generating XML ; documents, however this remains supported for backward compatibility reasons. ; Note that this directive does not control the tags. ; http://php.net/asp-tags asp_tags = Off ; The number of significant digits displayed in floating point numbers. ; http://php.net/precision precision = 14 ; Output buffering is a mechanism for controlling how much output data ; (excluding headers and cookies) PHP should keep internally before pushing that ; data to the client. If your application's output exceeds this setting, PHP ; will send that data in chunks of roughly the size you specify. ; Turning on this setting and managing its maximum buffer size can yield some ; interesting side-effects depending on your application and web server. ; You may be able to send headers and cookies after you've already sent output ; through print or echo. You also may see performance benefits if your server is ; emitting less packets due to buffered output versus PHP streaming the output ; as it gets it. On production servers, 4096 bytes is a good setting for performance ; reasons. ; Note: Output buffering can also be controlled via Output Buffering Control ; functions. ; Possible Values: ; On = Enabled and buffer is unlimited. (Use with caution) ; Off = Disabled ; Integer = Enables the buffer and sets its maximum size in bytes. ; Note: This directive is hardcoded to Off for the CLI SAPI ; Default Value: Off ; Development Value: 4096 ; Production Value: 4096 ; http://php.net/output-buffering output_buffering = 4096 ; You can redirect all of the output of your scripts to a function. For ; example, if you set output_handler to "mb_output_handler", character ; encoding will be transparently converted to the specified encoding. ; Setting any output handler automatically turns on output buffering. ; Note: People who wrote portable scripts should not depend on this ini ; directive. Instead, explicitly set the output handler using ob_start(). ; Using this ini directive may cause problems unless you know what script ; is doing. ; Note: You cannot use both "mb_output_handler" with "ob_iconv_handler" ; and you cannot use both "ob_gzhandler" and "zlib.output_compression". ; Note: output_handler must be empty if this is set 'On' !!!! ; Instead you must use zlib.output_handler. ; http://php.net/output-handler ;output_handler = ; Transparent output compression using the zlib library ; Valid values for this option are 'off', 'on', or a specific buffer size ; to be used for compression (default is 4KB) ; Note: Resulting chunk size may vary due to nature of compression. PHP ; outputs chunks that are few hundreds bytes each as a result of ; compression. If you prefer a larger chunk size for better ; performance, enable output_buffering in addition. ; Note: You need to use zlib.output_handler instead of the standard ; output_handler, or otherwise the output will be corrupted. ; http://php.net/zlib.output-compression zlib.output_compression = Off ; http://php.net/zlib.output-compression-level ;zlib.output_compression_level = -1 ; You cannot specify additional output handlers if zlib.output_compression ; is activated here. This setting does the same as output_handler but in ; a different order. ; http://php.net/zlib.output-handler ;zlib.output_handler = ; Implicit flush tells PHP to tell the output layer to flush itself ; automatically after every output block. This is equivalent to calling the ; PHP function flush() after each and every call to print() or echo() and each ; and every HTML block. Turning this option on has serious performance ; implications and is generally recommended for debugging purposes only. ; http://php.net/implicit-flush ; Note: This directive is hardcoded to On for the CLI SAPI implicit_flush = Off ; The unserialize callback function will be called (with the undefined class' ; name as parameter), if the unserializer finds an undefined class ; which should be instantiated. A warning appears if the specified function is ; not defined, or if the function doesn't include/implement the missing class. ; So only set this entry, if you really want to implement such a ; callback-function. unserialize_callback_func = ; When floats & doubles are serialized store serialize_precision significant ; digits after the floating point. The default value ensures that when floats ; are decoded with unserialize, the data will remain the same. serialize_precision = 17 ; open_basedir, if set, limits all file operations to the defined directory ; and below. This directive makes most sense if used in a per-directory ; or per-virtualhost web server configuration file. ; http://php.net/open-basedir open_basedir = ".:/data:/mnt:/srv:/hdd:/opt/tmp:/tmp:/usr:/var/aegir:/var/lib/collectd:/var/lib/nginx:/var/www:/var/second:/usr/bin:/usr/local/bin:/opt/tika:/opt/tika7:/opt/tika8:/opt/tika9:/opt/php56:/dev/urandom" ; This directive allows you to disable certain functions for security reasons. ; It receives a comma-delimited list of function names. ; http://php.net/disable-functions disable_functions = "disk_free_space,disk_total_space,diskfreespace,dl,get_current_user,getlastmo,getmygid,getmyinode,getmypid,getmyuid,ini_restore,link,pfsockopen,posix_getlogin,posix_getpwnam,posix_getpwuid,posix_getrlimit,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_ttyname,posix_uname,proc_nice,proc_terminate,show_source,symlink,opcache_reset" ; This directive allows you to disable certain classes for security reasons. ; It receives a comma-delimited list of class names. ; http://php.net/disable-classes disable_classes = ; Colors for Syntax Highlighting mode. Anything that's acceptable in ; would work. ; http://php.net/syntax-highlighting ;highlight.string = #DD0000 ;highlight.comment = #FF9900 ;highlight.keyword = #007700 ;highlight.default = #0000BB ;highlight.html = #000000 ; If enabled, the request will be allowed to complete even if the user aborts ; the request. Consider enabling it if executing long requests, which may end up ; being interrupted by the user or a browser timing out. PHP's default behavior ; is to disable this feature. ; http://php.net/ignore-user-abort ;ignore_user_abort = On ; Determines the size of the realpath cache to be used by PHP. This value should ; be increased on systems where PHP opens many files to reflect the quantity of ; the file operations performed. ; http://php.net/realpath-cache-size realpath_cache_size=64M ; Duration of time, in seconds for which to cache realpath information for a given ; file or directory. For systems with rarely changing files, consider increasing this ; value. ; http://php.net/realpath-cache-ttl realpath_cache_ttl=180 ; Enables or disables the circular reference collector. ; http://php.net/zend.enable-gc zend.enable_gc = On ; If enabled, scripts may be written in encodings that are incompatible with ; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such ; encodings. To use this feature, mbstring extension must be enabled. ; Default: Off ;zend.multibyte = Off ; Allows to set the default encoding for the scripts. This value will be used ; unless "declare(encoding=...)" directive appears at the top of the script. ; Only affects if zend.multibyte is set. ; Default: "" ;zend.script_encoding = ;;;;;;;;;;;;;;;;; ; Miscellaneous ; ;;;;;;;;;;;;;;;;; ; Decides whether PHP may expose the fact that it is installed on the server ; (e.g. by adding its signature to the Web server header). It is no security ; threat in any way, but it makes it possible to determine whether you use PHP ; on your server or not. ; http://php.net/expose-php expose_php = On ;;;;;;;;;;;;;;;;;;; ; Resource Limits ; ;;;;;;;;;;;;;;;;;;; ; Maximum execution time of each script, in seconds ; http://php.net/max-execution-time ; Note: This directive is hardcoded to 0 for the CLI SAPI max_execution_time = 180 ; Maximum amount of time each script may spend parsing request data. It's a good ; idea to limit this time on productions servers in order to eliminate unexpectedly ; long running scripts. ; Note: This directive is hardcoded to -1 for the CLI SAPI ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; http://php.net/max-input-time max_input_time = 180 ; Maximum input variable nesting level ; http://php.net/max-input-nesting-level ;max_input_nesting_level = 64 ; How many GET/POST/COOKIE input variables may be accepted max_input_vars = 9999 ; Maximum amount of memory a script may consume (128MB) ; http://php.net/memory-limit memory_limit = 395M ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; Error handling and logging ; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; This directive informs PHP of which errors, warnings and notices you would like ; it to take action for. The recommended way of setting values for this ; directive is through the use of the error level constants and bitwise ; operators. The error level constants are below here for convenience as well as ; some common settings and their meanings. ; By default, PHP is set to take action on all errors, notices and warnings EXCEPT ; those related to E_NOTICE and E_STRICT, which together cover best practices and ; recommended coding standards in PHP. For performance reasons, this is the ; recommend error reporting setting. Your production server shouldn't be wasting ; resources complaining about best practices and coding standards. That's what ; development servers and development settings are for. ; Note: The php.ini-development file has this setting as E_ALL. This ; means it pretty much reports everything which is exactly what you want during ; development and early testing. ; ; Error Level Constants: ; E_ALL - All errors and warnings (includes E_STRICT as of PHP 5.4.0) ; E_ERROR - fatal run-time errors ; E_RECOVERABLE_ERROR - almost fatal run-time errors ; E_WARNING - run-time warnings (non-fatal errors) ; E_PARSE - compile-time parse errors ; E_NOTICE - run-time notices (these are warnings which often result ; from a bug in your code, but it's possible that it was ; intentional (e.g., using an uninitialized variable and ; relying on the fact it is automatically initialized to an ; empty string) ; E_STRICT - run-time notices, enable to have PHP suggest changes ; to your code which will ensure the best interoperability ; and forward compatibility of your code ; E_CORE_ERROR - fatal errors that occur during PHP's initial startup ; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's ; initial startup ; E_COMPILE_ERROR - fatal compile-time errors ; E_COMPILE_WARNING - compile-time warnings (non-fatal errors) ; E_USER_ERROR - user-generated error message ; E_USER_WARNING - user-generated warning message ; E_USER_NOTICE - user-generated notice message ; E_DEPRECATED - warn about code that will not work in future versions ; of PHP ; E_USER_DEPRECATED - user-generated deprecation warnings ; ; Common Values: ; E_ALL (Show all errors, warnings and notices including coding standards.) ; E_ALL & ~E_NOTICE (Show all errors, except for notices) ; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.) ; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors) ; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; http://php.net/error-reporting error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT ; This directive controls whether or not and where PHP will output errors, ; notices and warnings too. Error output is very useful during development, but ; it could be very dangerous in production environments. Depending on the code ; which is triggering the error, sensitive information could potentially leak ; out of your application such as database usernames and passwords or worse. ; For production environments, we recommend logging errors rather than ; sending them to STDOUT. ; Possible Values: ; Off = Do not display any errors ; stderr = Display errors to STDERR (affects only CGI/CLI binaries!) ; On or stdout = Display errors to STDOUT ; Default Value: On ; Development Value: On ; Production Value: Off ; http://php.net/display-errors display_errors = Off ; The display of errors which occur during PHP's startup sequence are handled ; separately from display_errors. PHP's default behavior is to suppress those ; errors from clients. Turning the display of startup errors on can be useful in ; debugging configuration problems. We strongly recommend you ; set this to 'off' for production servers. ; Default Value: Off ; Development Value: On ; Production Value: Off ; http://php.net/display-startup-errors display_startup_errors = Off ; Besides displaying errors, PHP can also log errors to locations such as a ; server-specific log, STDERR, or a location specified by the error_log ; directive found below. While errors should not be displayed on productions ; servers they should still be monitored and logging is a great way to do that. ; Default Value: Off ; Development Value: On ; Production Value: On ; http://php.net/log-errors log_errors = On ; Set maximum length of log_errors. In error_log information about the source is ; added. The default is 1024 and 0 allows to not apply any maximum length at all. ; http://php.net/log-errors-max-len log_errors_max_len = 1024 ; Do not log repeated messages. Repeated errors must occur in same file on same ; line unless ignore_repeated_source is set true. ; http://php.net/ignore-repeated-errors ignore_repeated_errors = Off ; Ignore source of message when ignoring repeated messages. When this setting ; is On you will not log errors with repeated messages from different files or ; source lines. ; http://php.net/ignore-repeated-source ignore_repeated_source = Off ; If this parameter is set to Off, then memory leaks will not be shown (on ; stdout or in the log). This has only effect in a debug compile, and if ; error reporting includes E_WARNING in the allowed list ; http://php.net/report-memleaks report_memleaks = On ; This setting is on by default. ;report_zend_debug = 0 ; Store the last error/warning message in $php_errormsg (boolean). Setting this value ; to On can assist in debugging and is appropriate for development servers. It should ; however be disabled on production servers. ; Default Value: Off ; Development Value: On ; Production Value: Off ; http://php.net/track-errors track_errors = Off ; Turn off normal error reporting and emit XML-RPC error XML ; http://php.net/xmlrpc-errors ;xmlrpc_errors = 0 ; An XML-RPC faultCode ;xmlrpc_error_number = 0 ; When PHP displays or logs an error, it has the capability of formatting the ; error message as HTML for easier reading. This directive controls whether ; the error message is formatted as HTML or not. ; Note: This directive is hardcoded to Off for the CLI SAPI ; Default Value: On ; Development Value: On ; Production value: On ; http://php.net/html-errors html_errors = Off ; If html_errors is set to On *and* docref_root is not empty, then PHP ; produces clickable error messages that direct to a page describing the error ; or function causing the error in detail. ; You can download a copy of the PHP manual from http://php.net/docs ; and change docref_root to the base URL of your local copy including the ; leading '/'. You must also specify the file extension being used including ; the dot. PHP's default behavior is to leave these settings empty, in which ; case no links to documentation are generated. ; Note: Never use this feature for production boxes. ; http://php.net/docref-root ; Examples ;docref_root = "/phpmanual/" ; http://php.net/docref-ext ;docref_ext = .html ; String to output before an error message. PHP's default behavior is to leave ; this setting blank. ; http://php.net/error-prepend-string ; Example: ;error_prepend_string = "" ; String to output after an error message. PHP's default behavior is to leave ; this setting blank. ; http://php.net/error-append-string ; Example: ;error_append_string = "" ; Log errors to specified file. PHP's default behavior is to leave this value ; empty. ; http://php.net/error-log ; Example: ;error_log = php_errors.log ; Log errors to syslog (Event Log on Windows). ;error_log = syslog error_log = /var/log/php/error_log_56 ;windows.show_crt_warning ; Default value: 0 ; Development value: 0 ; Production value: 0 ;;;;;;;;;;;;;;;;; ; Data Handling ; ;;;;;;;;;;;;;;;;; ; The separator used in PHP generated URLs to separate arguments. ; PHP's default setting is "&". ; http://php.net/arg-separator.output ; Example: ;arg_separator.output = "&" ; List of separator(s) used by PHP to parse input URLs into variables. ; PHP's default setting is "&". ; NOTE: Every character in this directive is considered as separator! ; http://php.net/arg-separator.input ; Example: ;arg_separator.input = ";&" ; This directive determines which super global arrays are registered when PHP ; starts up. G,P,C,E & S are abbreviations for the following respective super ; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty ; paid for the registration of these arrays and because ENV is not as commonly ; used as the others, ENV is not recommended on productions servers. You ; can still get access to the environment variables through getenv() should you ; need to. ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS"; ; http://php.net/variables-order variables_order = "GPCS" ; This directive determines which super global data (G,P & C) should be ; registered into the super global array REQUEST. If so, it also determines ; the order in which that data is registered. The values for this directive ; are specified in the same manner as the variables_order directive, ; EXCEPT one. Leaving this value empty will cause PHP to use the value set ; in the variables_order directive. It does not mean it will leave the super ; globals array REQUEST empty. ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; http://php.net/request-order request_order = "GP" ; This directive determines whether PHP registers $argv & $argc each time it ; runs. $argv contains an array of all the arguments passed to PHP when a script ; is invoked. $argc contains an integer representing the number of arguments ; that were passed when the script was invoked. These arrays are extremely ; useful when running scripts from the command line. When this directive is ; enabled, registering these variables consumes CPU cycles and memory each time ; a script is executed. For performance reasons, this feature should be disabled ; on production servers. ; Note: This directive is hardcoded to On for the CLI SAPI ; Default Value: On ; Development Value: Off ; Production Value: Off ; http://php.net/register-argc-argv register_argc_argv = Off ; When enabled, the ENV, REQUEST and SERVER variables are created when they're ; first used (Just In Time) instead of when the script starts. If these ; variables are not used within a script, having this directive on will result ; in a performance gain. The PHP directive register_argc_argv must be disabled ; for this directive to have any affect. ; http://php.net/auto-globals-jit auto_globals_jit = On ; Whether PHP will read the POST data. ; This option is enabled by default. ; Most likely, you won't want to disable this option globally. It causes $_POST ; and $_FILES to always be empty; the only way you will be able to read the ; POST data will be through the php://input stream wrapper. This can be useful ; to proxy requests or to process the POST data in a memory efficient fashion. ; http://php.net/enable-post-data-reading ;enable_post_data_reading = Off ; Maximum size of POST data that PHP will accept. ; Its value may be 0 to disable the limit. It is ignored if POST data reading ; is disabled through enable_post_data_reading. ; http://php.net/post-max-size post_max_size = 350M ; Automatically add files before PHP document. ; http://php.net/auto-prepend-file auto_prepend_file = ; Automatically add files after PHP document. ; http://php.net/auto-append-file auto_append_file = ; By default, PHP will output a character encoding using ; the Content-type: header. To disable sending of the charset, simply ; set it to be empty. ; ; PHP's built-in default is text/html ; http://php.net/default-mimetype default_mimetype = "text/html" ; PHP's default character set is set to UTF-8. ; http://php.net/default-charset default_charset = "UTF-8" ; PHP internal character encoding is set to empty. ; If empty, default_charset is used. ; http://php.net/internal-encoding ;internal_encoding = ; PHP input character encoding is set to empty. ; If empty, default_charset is used. ; http://php.net/input-encoding ;input_encoding = ; PHP output character encoding is set to empty. ; If empty, default_charset is used. ; mbstring or iconv output handler is used. ; See also output_buffer. ; http://php.net/output-encoding ;output_encoding = ; Always populate the $HTTP_RAW_POST_DATA variable. PHP's default behavior is ; to disable this feature and it will be removed in a future version. ; If post reading is disabled through enable_post_data_reading, ; $HTTP_RAW_POST_DATA is *NOT* populated. ; http://php.net/always-populate-raw-post-data always_populate_raw_post_data = -1 ;;;;;;;;;;;;;;;;;;;;;;;;; ; Paths and Directories ; ;;;;;;;;;;;;;;;;;;;;;;;;; ; UNIX: "/path1:/path2" ;include_path = ".:/php/includes" ; ; Windows: "\path1;\path2" ;include_path = ".;c:\php\includes" ; ; PHP's default setting for include_path is ".;/path/to/php/pear" ; http://php.net/include-path include_path = ".:/opt/php56/lib/php" ; The root of the PHP pages, used only if nonempty. ; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root ; if you are running php as a CGI under any web server (other than IIS) ; see documentation for security issues. The alternate is to use the ; cgi.force_redirect configuration below ; http://php.net/doc-root doc_root = ; The directory under which PHP opens the script using /~username used only ; if nonempty. ; http://php.net/user-dir user_dir = ; Directory in which the loadable extensions (modules) reside. ; http://php.net/extension-dir ; extension_dir = "./" ; On windows: ; extension_dir = "ext" extension_dir = "/opt/php56/lib/php/extensions/no-debug-non-zts-20131226/" ; Directory where the temporary files should be placed. ; Defaults to the system default (see sys_get_temp_dir) sys_temp_dir = "/tmp" ; Whether or not to enable the dl() function. The dl() function does NOT work ; properly in multithreaded servers, such as IIS or Zeus, and is automatically ; disabled on them. ; http://php.net/enable-dl enable_dl = Off ; cgi.force_redirect is necessary to provide security running PHP as a CGI under ; most web servers. Left undefined, PHP turns this on by default. You can ; turn it off here AT YOUR OWN RISK ; **You CAN safely turn this off for IIS, in fact, you MUST.** ; http://php.net/cgi.force-redirect ;cgi.force_redirect = 1 ; if cgi.nph is enabled it will force cgi to always sent Status: 200 with ; every request. PHP's default behavior is to disable this feature. ;cgi.nph = 1 ; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape ; (iPlanet) web servers, you MAY need to set an environment variable name that PHP ; will look for to know it is OK to continue execution. Setting this variable MAY ; cause security issues, KNOW WHAT YOU ARE DOING FIRST. ; http://php.net/cgi.redirect-status-env ;cgi.redirect_status_env = ; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's ; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok ; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting ; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting ; of zero causes PHP to behave as before. Default is 1. You should fix your scripts ; to use SCRIPT_FILENAME rather than PATH_TRANSLATED. ; http://php.net/cgi.fix-pathinfo ;cgi.fix_pathinfo=1 ; FastCGI under IIS (on WINNT based OS) supports the ability to impersonate ; security tokens of the calling client. This allows IIS to define the ; security context that the request runs under. mod_fastcgi under Apache ; does not currently support this feature (03/17/2002) ; Set to 1 if running under IIS. Default is zero. ; http://php.net/fastcgi.impersonate ;fastcgi.impersonate = 1 ; Disable logging through FastCGI connection. PHP's default behavior is to enable ; this feature. ;fastcgi.logging = 0 ; cgi.rfc2616_headers configuration option tells PHP what type of headers to ; use when sending HTTP response code. If set to 0, PHP sends Status: header that ; is supported by Apache. When this option is set to 1, PHP will send ; RFC2616 compliant header. ; Default is zero. ; http://php.net/cgi.rfc2616-headers ;cgi.rfc2616_headers = 0 ;;;;;;;;;;;;;;;; ; File Uploads ; ;;;;;;;;;;;;;;;; ; Whether to allow HTTP file uploads. ; http://php.net/file-uploads file_uploads = On ; Temporary directory for HTTP uploaded files (will use system default if not ; specified). ; http://php.net/upload-tmp-dir upload_tmp_dir = /tmp ; Maximum allowed size for uploaded files. ; http://php.net/upload-max-filesize upload_max_filesize = 325M ; Maximum number of files that can be uploaded via a single request max_file_uploads = 50 ;;;;;;;;;;;;;;;;;; ; Fopen wrappers ; ;;;;;;;;;;;;;;;;;; ; Whether to allow the treatment of URLs (like http:// or ftp://) as files. ; http://php.net/allow-url-fopen allow_url_fopen = On ; Whether to allow include/require to open URLs (like http:// or ftp://) as files. ; http://php.net/allow-url-include allow_url_include = Off ; Define the anonymous ftp password (your email address). PHP's default setting ; for this is empty. ; http://php.net/from ;from="john@doe.com" ; Define the User-Agent string. PHP's default setting for this is empty. ; http://php.net/user-agent ;user_agent="PHP" ; Default timeout for socket based streams (seconds) ; http://php.net/default-socket-timeout default_socket_timeout = 180 ; If your scripts have to deal with files from Macintosh systems, ; or you are running on a Mac and need to deal with files from ; unix or win32 systems, setting this flag will cause PHP to ; automatically detect the EOL character in those files so that ; fgets() and file() will work regardless of the source of the file. ; http://php.net/auto-detect-line-endings auto_detect_line_endings = On ;;;;;;;;;;;;;;;;;;;;;; ; Dynamic Extensions ; ;;;;;;;;;;;;;;;;;;;;;; ; If you wish to have an extension loaded automatically, use the following ; syntax: ; ; extension=modulename.extension ; ; For example, on Windows: ; ; extension=msql.dll ; ; ... or under UNIX: ; ; extension=msql.so ; ; ... or with a path: ; ; extension=/path/to/extension/msql.so ; ; If you only provide the name of the extension, PHP will look for it in its ; default extension directory. ; ; Windows Extensions ; Note that ODBC support is built in, so no dll is needed for it. ; Note that many DLL files are located in the extensions/ (PHP 4) ext/ (PHP 5) ; extension folders as well as the separate PECL DLL download (PHP 5). ; Be sure to appropriately set the extension_dir directive. ; ;extension=php_bz2.dll ;extension=php_curl.dll ;extension=php_fileinfo.dll ;extension=php_gd2.dll ;extension=php_gettext.dll ;extension=php_gmp.dll ;extension=php_intl.dll ;extension=php_imap.dll ;extension=php_interbase.dll ;extension=php_ldap.dll ;extension=php_mbstring.dll ;extension=php_exif.dll ; Must be after mbstring as it depends on it ;extension=php_mysql.dll ;extension=php_mysqli.dll ;extension=php_oci8_12c.dll ; Use with Oracle Database 12c Instant Client ;extension=php_openssl.dll ;extension=php_pdo_firebird.dll ;extension=php_pdo_mysql.dll ;extension=php_pdo_oci.dll ;extension=php_pdo_odbc.dll ;extension=php_pdo_pgsql.dll ;extension=php_pdo_sqlite.dll ;extension=php_pgsql.dll ;extension=php_pspell.dll ;extension=php_shmop.dll ; The MIBS data available in the PHP distribution must be installed. ; See http://www.php.net/manual/en/snmp.installation.php ;extension=php_snmp.dll ;extension=php_soap.dll ;extension=php_sockets.dll ;extension=php_sqlite3.dll ;extension=php_sybase_ct.dll ;extension=php_tidy.dll ;extension=php_xmlrpc.dll ;extension=php_xsl.dll ;;;;;;;;;;;;;;;;;;; ; Module Settings ; ;;;;;;;;;;;;;;;;;;; [CLI Server] ; Whether the CLI web server uses ANSI color coding in its terminal output. cli_server.color = On [Date] ; Defines the default timezone used by the date functions ; http://php.net/date.timezone date.timezone = "UTC" ; http://php.net/date.default-latitude ;date.default_latitude = 31.7667 ; http://php.net/date.default-longitude ;date.default_longitude = 35.2333 ; http://php.net/date.sunrise-zenith ;date.sunrise_zenith = 90.583333 ; http://php.net/date.sunset-zenith ;date.sunset_zenith = 90.583333 [filter] ; http://php.net/filter.default ;filter.default = unsafe_raw ; http://php.net/filter.default-flags ;filter.default_flags = [iconv] ; Use of this INI entry is deprecated, use global input_encoding instead. ; If empty, default_charset or input_encoding or iconv.input_encoding is used. ; The precedence is: default_charset < intput_encoding < iconv.input_encoding ;iconv.input_encoding = ; Use of this INI entry is deprecated, use global internal_encoding instead. ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;iconv.internal_encoding = ; Use of this INI entry is deprecated, use global output_encoding instead. ; If empty, default_charset or output_encoding or iconv.output_encoding is used. ; The precedence is: default_charset < output_encoding < iconv.output_encoding ; To use an output encoding conversion, iconv's output handler must be set ; otherwise output encoding conversion cannot be performed. ;iconv.output_encoding = [intl] ;intl.default_locale = ; This directive allows you to produce PHP errors when some error ; happens within intl functions. The value is the level of the error produced. ; Default is 0, which does not produce any errors. ;intl.error_level = E_WARNING [sqlite] ; http://php.net/sqlite.assoc-case ;sqlite.assoc_case = 0 [sqlite3] ;sqlite3.extension_dir = [Pcre] ;PCRE library backtracking limit. ; http://php.net/pcre.backtrack-limit ;pcre.backtrack_limit=100000 ;PCRE library recursion limit. ;Please note that if you set this value to a high number you may consume all ;the available process stack and eventually crash PHP (due to reaching the ;stack size limit imposed by the Operating System). ; http://php.net/pcre.recursion-limit ;pcre.recursion_limit=100000 [Pdo] ; Whether to pool ODBC connections. Can be one of "strict", "relaxed" or "off" ; http://php.net/pdo-odbc.connection-pooling ;pdo_odbc.connection_pooling=strict ;pdo_odbc.db2_instance_name [Pdo_mysql] ; If mysqlnd is used: Number of cache slots for the internal result set cache ; http://php.net/pdo_mysql.cache_size pdo_mysql.cache_size = 2000 ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. ; http://php.net/pdo_mysql.default-socket pdo_mysql.default_socket= [Phar] ; http://php.net/phar.readonly ;phar.readonly = On ; http://php.net/phar.require-hash ;phar.require_hash = On ;phar.cache_list = [mail function] ; For Win32 only. ; http://php.net/smtp ;SMTP = localhost ; http://php.net/smtp-port ;smtp_port = 25 ; For Win32 only. ; http://php.net/sendmail-from ;sendmail_from = me@example.com ; For Unix only. You may supply arguments as well (default: "sendmail -t -i"). ; http://php.net/sendmail-path sendmail_path = /usr/sbin/sendmail -t -i ; Force the addition of the specified parameters to be passed as extra parameters ; to the sendmail binary. These parameters will always replace the value of ; the 5th parameter to mail(). ;mail.force_extra_parameters = ; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename mail.add_x_header = Off ; The path to a log file that will log all mail() calls. Log entries include ; the full path of the script, line number, To address and headers. ;mail.log = ; Log mail to syslog (Event Log on Windows). ;mail.log = syslog [SQL] ; http://php.net/sql.safe-mode sql.safe_mode = Off [ODBC] ; http://php.net/odbc.default-db ;odbc.default_db = Not yet implemented ; http://php.net/odbc.default-user ;odbc.default_user = Not yet implemented ; http://php.net/odbc.default-pw ;odbc.default_pw = Not yet implemented ; Controls the ODBC cursor model. ; Default: SQL_CURSOR_STATIC (default). ;odbc.default_cursortype ; Allow or prevent persistent links. ; http://php.net/odbc.allow-persistent odbc.allow_persistent = On ; Check that a connection is still valid before reuse. ; http://php.net/odbc.check-persistent odbc.check_persistent = On ; Maximum number of persistent links. -1 means no limit. ; http://php.net/odbc.max-persistent odbc.max_persistent = -1 ; Maximum number of links (persistent + non-persistent). -1 means no limit. ; http://php.net/odbc.max-links odbc.max_links = -1 ; Handling of LONG fields. Returns number of bytes to variables. 0 means ; passthru. ; http://php.net/odbc.defaultlrl odbc.defaultlrl = 4096 ; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char. ; See the documentation on odbc_binmode and odbc_longreadlen for an explanation ; of odbc.defaultlrl and odbc.defaultbinmode ; http://php.net/odbc.defaultbinmode odbc.defaultbinmode = 1 ;birdstep.max_links = -1 [Interbase] ; Allow or prevent persistent links. ibase.allow_persistent = 1 ; Maximum number of persistent links. -1 means no limit. ibase.max_persistent = -1 ; Maximum number of links (persistent + non-persistent). -1 means no limit. ibase.max_links = -1 ; Default database name for ibase_connect(). ;ibase.default_db = ; Default username for ibase_connect(). ;ibase.default_user = ; Default password for ibase_connect(). ;ibase.default_password = ; Default charset for ibase_connect(). ;ibase.default_charset = ; Default timestamp format. ibase.timestampformat = "%Y-%m-%d %H:%M:%S" ; Default date format. ibase.dateformat = "%Y-%m-%d" ; Default time format. ibase.timeformat = "%H:%M:%S" [MySQL] ; Allow accessing, from PHP's perspective, local files with LOAD DATA statements ; http://php.net/mysql.allow_local_infile mysql.allow_local_infile = On ; Allow or prevent persistent links. ; http://php.net/mysql.allow-persistent mysql.allow_persistent = On ; If mysqlnd is used: Number of cache slots for the internal result set cache ; http://php.net/mysql.cache_size mysql.cache_size = 2000 ; Maximum number of persistent links. -1 means no limit. ; http://php.net/mysql.max-persistent mysql.max_persistent = -1 ; Maximum number of links (persistent + non-persistent). -1 means no limit. ; http://php.net/mysql.max-links mysql.max_links = -1 ; Default port number for mysql_connect(). If unset, mysql_connect() will use ; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the ; compile-time value defined MYSQL_PORT (in that order). Win32 will only look ; at MYSQL_PORT. ; http://php.net/mysql.default-port mysql.default_port = ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. ; http://php.net/mysql.default-socket mysql.default_socket = ; Default host for mysql_connect() (doesn't apply in safe mode). ; http://php.net/mysql.default-host mysql.default_host = ; Default user for mysql_connect() (doesn't apply in safe mode). ; http://php.net/mysql.default-user mysql.default_user = ; Default password for mysql_connect() (doesn't apply in safe mode). ; Note that this is generally a *bad* idea to store passwords in this file. ; *Any* user with PHP access can run 'echo get_cfg_var("mysql.default_password") ; and reveal this password! And of course, any users with read access to this ; file will be able to reveal the password as well. ; http://php.net/mysql.default-password mysql.default_password = ; Maximum time (in seconds) for connect timeout. -1 means no limit ; http://php.net/mysql.connect-timeout mysql.connect_timeout = 60 ; Trace mode. When trace_mode is active (=On), warnings for table/index scans and ; SQL-Errors will be displayed. ; http://php.net/mysql.trace-mode mysql.trace_mode = Off [MySQLi] ; Maximum number of persistent links. -1 means no limit. ; http://php.net/mysqli.max-persistent mysqli.max_persistent = -1 ; Allow accessing, from PHP's perspective, local files with LOAD DATA statements ; http://php.net/mysqli.allow_local_infile ;mysqli.allow_local_infile = On ; Allow or prevent persistent links. ; http://php.net/mysqli.allow-persistent mysqli.allow_persistent = On ; Maximum number of links. -1 means no limit. ; http://php.net/mysqli.max-links mysqli.max_links = -1 ; If mysqlnd is used: Number of cache slots for the internal result set cache ; http://php.net/mysqli.cache_size mysqli.cache_size = 2000 ; Default port number for mysqli_connect(). If unset, mysqli_connect() will use ; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the ; compile-time value defined MYSQL_PORT (in that order). Win32 will only look ; at MYSQL_PORT. ; http://php.net/mysqli.default-port mysqli.default_port = 3306 ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. ; http://php.net/mysqli.default-socket mysqli.default_socket = ; Default host for mysql_connect() (doesn't apply in safe mode). ; http://php.net/mysqli.default-host mysqli.default_host = ; Default user for mysql_connect() (doesn't apply in safe mode). ; http://php.net/mysqli.default-user mysqli.default_user = ; Default password for mysqli_connect() (doesn't apply in safe mode). ; Note that this is generally a *bad* idea to store passwords in this file. ; *Any* user with PHP access can run 'echo get_cfg_var("mysqli.default_pw") ; and reveal this password! And of course, any users with read access to this ; file will be able to reveal the password as well. ; http://php.net/mysqli.default-pw mysqli.default_pw = ; Allow or prevent reconnect mysqli.reconnect = Off [mysqlnd] ; Enable / Disable collection of general statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. ; http://php.net/mysqlnd.collect_statistics mysqlnd.collect_statistics = 0 ; Enable / Disable collection of memory usage statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. ; http://php.net/mysqlnd.collect_memory_statistics mysqlnd.collect_memory_statistics = 0 ; Size of a pre-allocated buffer used when sending commands to MySQL in bytes. ; http://php.net/mysqlnd.net_cmd_buffer_size mysqlnd.net_cmd_buffer_size = 8192 ; Size of a pre-allocated buffer used for reading data sent by the server in ; bytes. ; http://php.net/mysqlnd.net_read_buffer_size mysqlnd.net_read_buffer_size = 131072 [OCI8] ; Connection: Enables privileged connections using external ; credentials (OCI_SYSOPER, OCI_SYSDBA) ; http://php.net/oci8.privileged-connect ;oci8.privileged_connect = Off ; Connection: The maximum number of persistent OCI8 connections per ; process. Using -1 means no limit. ; http://php.net/oci8.max-persistent ;oci8.max_persistent = -1 ; Connection: The maximum number of seconds a process is allowed to ; maintain an idle persistent connection. Using -1 means idle ; persistent connections will be maintained forever. ; http://php.net/oci8.persistent-timeout ;oci8.persistent_timeout = -1 ; Connection: The number of seconds that must pass before issuing a ; ping during oci_pconnect() to check the connection validity. When ; set to 0, each oci_pconnect() will cause a ping. Using -1 disables ; pings completely. ; http://php.net/oci8.ping-interval ;oci8.ping_interval = 60 ; Connection: Set this to a user chosen connection class to be used ; for all pooled server requests with Oracle 11g Database Resident ; Connection Pooling (DRCP). To use DRCP, this value should be set to ; the same string for all web servers running the same application, ; the database pool must be configured, and the connection string must ; specify to use a pooled server. ;oci8.connection_class = ; High Availability: Using On lets PHP receive Fast Application ; Notification (FAN) events generated when a database node fails. The ; database must also be configured to post FAN events. ;oci8.events = Off ; Tuning: This option enables statement caching, and specifies how ; many statements to cache. Using 0 disables statement caching. ; http://php.net/oci8.statement-cache-size ;oci8.statement_cache_size = 20 ; Tuning: Enables statement prefetching and sets the default number of ; rows that will be fetched automatically after statement execution. ; http://php.net/oci8.default-prefetch ;oci8.default_prefetch = 100 ; Compatibility. Using On means oci_close() will not close ; oci_connect() and oci_new_connect() connections. ; http://php.net/oci8.old-oci-close-semantics ;oci8.old_oci_close_semantics = Off [PostgreSQL] ; Allow or prevent persistent links. ; http://php.net/pgsql.allow-persistent pgsql.allow_persistent = On ; Detect broken persistent links always with pg_pconnect(). ; Auto reset feature requires a little overheads. ; http://php.net/pgsql.auto-reset-persistent pgsql.auto_reset_persistent = Off ; Maximum number of persistent links. -1 means no limit. ; http://php.net/pgsql.max-persistent pgsql.max_persistent = -1 ; Maximum number of links (persistent+non persistent). -1 means no limit. ; http://php.net/pgsql.max-links pgsql.max_links = -1 ; Ignore PostgreSQL backends Notice message or not. ; Notice message logging require a little overheads. ; http://php.net/pgsql.ignore-notice pgsql.ignore_notice = 0 ; Log PostgreSQL backends Notice message or not. ; Unless pgsql.ignore_notice=0, module cannot log notice message. ; http://php.net/pgsql.log-notice pgsql.log_notice = 0 [Sybase-CT] ; Allow or prevent persistent links. ; http://php.net/sybct.allow-persistent sybct.allow_persistent = On ; Maximum number of persistent links. -1 means no limit. ; http://php.net/sybct.max-persistent sybct.max_persistent = -1 ; Maximum number of links (persistent + non-persistent). -1 means no limit. ; http://php.net/sybct.max-links sybct.max_links = -1 ; Minimum server message severity to display. ; http://php.net/sybct.min-server-severity sybct.min_server_severity = 10 ; Minimum client message severity to display. ; http://php.net/sybct.min-client-severity sybct.min_client_severity = 10 ; Set per-context timeout ; http://php.net/sybct.timeout ;sybct.timeout= ;sybct.packet_size ; The maximum time in seconds to wait for a connection attempt to succeed before returning failure. ; Default: one minute ;sybct.login_timeout= ; The name of the host you claim to be connecting from, for display by sp_who. ; Default: none ;sybct.hostname= ; Allows you to define how often deadlocks are to be retried. -1 means "forever". ; Default: 0 ;sybct.deadlock_retry_count= [bcmath] ; Number of decimal digits for all bcmath functions. ; http://php.net/bcmath.scale bcmath.scale = 0 [browscap] ; http://php.net/browscap ;browscap = extra/browscap.ini [Session] ; Handler used to store/retrieve data. ; http://php.net/session.save-handler session.save_handler = files ; Argument passed to save_handler. In the case of files, this is the path ; where data files are stored. Note: Windows users have to change this ; variable in order to use PHP's session functions. ; ; The path can be defined as: ; ; session.save_path = "N;/path" ; ; where N is an integer. Instead of storing all the session files in ; /path, what this will do is use subdirectories N-levels deep, and ; store the session data in those directories. This is useful if ; your OS has problems with many files in one directory, and is ; a more efficient layout for servers that handle many sessions. ; ; NOTE 1: PHP will not create this directory structure automatically. ; You can use the script in the ext/session dir for that purpose. ; NOTE 2: See the section on garbage collection below if you choose to ; use subdirectories for session storage ; ; The file storage module creates files using mode 600 by default. ; You can change that by using ; ; session.save_path = "N;MODE;/path" ; ; where MODE is the octal representation of the mode. Note that this ; does not overwrite the process's umask. ; http://php.net/session.save-path session.save_path = "/opt/tmp" ; Whether to use strict session mode. ; Strict session mode does not accept uninitialized session ID and regenerate ; session ID if browser sends uninitialized session ID. Strict mode protects ; applications from session fixation via session adoption vulnerability. It is ; disabled by default for maximum compatibility, but enabling it is encouraged. ; https://wiki.php.net/rfc/strict_sessions session.use_strict_mode = 0 ; Whether to use cookies. ; http://php.net/session.use-cookies session.use_cookies = 1 ; http://php.net/session.cookie-secure ;session.cookie_secure = ; This option forces PHP to fetch and use a cookie for storing and maintaining ; the session id. We encourage this operation as it's very helpful in combating ; session hijacking when not specifying and managing your own session id. It is ; not the be-all and end-all of session hijacking defense, but it's a good start. ; http://php.net/session.use-only-cookies session.use_only_cookies = 1 ; Name of the session (used as cookie name). ; http://php.net/session.name session.name = PHPSESSID ; Initialize session on request startup. ; http://php.net/session.auto-start session.auto_start = 0 ; Lifetime in seconds of cookie or, if 0, until browser is restarted. ; http://php.net/session.cookie-lifetime session.cookie_lifetime = 0 ; The path for which the cookie is valid. ; http://php.net/session.cookie-path session.cookie_path = / ; The domain for which the cookie is valid. ; http://php.net/session.cookie-domain session.cookie_domain = ; Whether or not to add the httpOnly flag to the cookie, which makes it inaccessible to browser scripting languages such as JavaScript. ; http://php.net/session.cookie-httponly session.cookie_httponly = 1 ; Handler used to serialize data. php is the standard serializer of PHP. ; http://php.net/session.serialize-handler session.serialize_handler = php ; Defines the probability that the 'garbage collection' process is started ; on every session initialization. The probability is calculated by using ; gc_probability/gc_divisor. Where session.gc_probability is the numerator ; and gc_divisor is the denominator in the equation. Setting this value to 1 ; when the session.gc_divisor value is 100 will give you approximately a 1% chance ; the gc will run on any give request. ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; http://php.net/session.gc-probability session.gc_probability = 1 ; Defines the probability that the 'garbage collection' process is started on every ; session initialization. The probability is calculated by using the following equation: ; gc_probability/gc_divisor. Where session.gc_probability is the numerator and ; session.gc_divisor is the denominator in the equation. Setting this value to 1 ; when the session.gc_divisor value is 100 will give you approximately a 1% chance ; the gc will run on any give request. Increasing this value to 1000 will give you ; a 0.1% chance the gc will run on any give request. For high volume production servers, ; this is a more efficient approach. ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; http://php.net/session.gc-divisor session.gc_divisor = 1000 ; After this number of seconds, stored data will be seen as 'garbage' and ; cleaned up by the garbage collection process. ; http://php.net/session.gc-maxlifetime session.gc_maxlifetime = 1440 ; NOTE: If you are using the subdirectory option for storing session files ; (see session.save_path above), then garbage collection does *not* ; happen automatically. You will need to do your own garbage ; collection through a shell script, cron entry, or some other method. ; For example, the following script would is the equivalent of ; setting session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes): ; find /path/to/sessions -cmin +24 -type f | xargs rm ; Check HTTP Referer to invalidate externally stored URLs containing ids. ; HTTP_REFERER has to contain this substring for the session to be ; considered as valid. ; http://php.net/session.referer-check session.referer_check = ; How many bytes to read from the file. ; http://php.net/session.entropy-length session.entropy_length = 32 ; Specified here to create the session id. ; http://php.net/session.entropy-file ; Defaults to /dev/urandom ; On systems that don't have /dev/urandom but do have /dev/arandom, this will default to /dev/arandom ; If neither are found at compile time, the default is no entropy file. ; On windows, setting the entropy_length setting will activate the ; Windows random source (using the CryptoAPI) session.entropy_file = /dev/urandom ; Set to {nocache,private,public,} to determine HTTP caching aspects ; or leave this empty to avoid sending anti-caching headers. ; http://php.net/session.cache-limiter session.cache_limiter = nocache ; Document expires after n minutes. ; http://php.net/session.cache-expire session.cache_expire = 180 ; trans sid support is disabled by default. ; Use of trans sid may risk your users' security. ; Use this option with caution. ; - User may send URL contains active session ID ; to other person via. email/irc/etc. ; - URL that contains active session ID may be stored ; in publicly accessible computer. ; - User may access your site with the same session ID ; always using URL stored in browser's history or bookmarks. ; http://php.net/session.use-trans-sid session.use_trans_sid = 0 ; Select a hash function for use in generating session ids. ; Possible Values ; 0 (MD5 128 bits) ; 1 (SHA-1 160 bits) ; This option may also be set to the name of any hash function supported by ; the hash extension. A list of available hashes is returned by the hash_algos() ; function. ; http://php.net/session.hash-function session.hash_function = 0 ; Define how many bits are stored in each character when converting ; the binary hash data to something readable. ; Possible values: ; 4 (4 bits: 0-9, a-f) ; 5 (5 bits: 0-9, a-v) ; 6 (6 bits: 0-9, a-z, A-Z, "-", ",") ; Default Value: 4 ; Development Value: 5 ; Production Value: 5 ; http://php.net/session.hash-bits-per-character session.hash_bits_per_character = 5 ; The URL rewriter will look for URLs in a defined set of HTML tags. ; form/fieldset are special; if you include them here, the rewriter will ; add a hidden field with the info which is otherwise appended ; to URLs. If you want XHTML conformity, remove the form entry. ; Note that all valid entries require a "=", even if no value follows. ; Default Value: "a=href,area=href,frame=src,form=,fieldset=" ; Development Value: "a=href,area=href,frame=src,input=src,form=fakeentry" ; Production Value: "a=href,area=href,frame=src,input=src,form=fakeentry" ; http://php.net/url-rewriter.tags url_rewriter.tags = "a=href,area=href,frame=src,input=src,form=fakeentry" ; Enable upload progress tracking in $_SESSION ; Default Value: On ; Development Value: On ; Production Value: On ; http://php.net/session.upload-progress.enabled ;session.upload_progress.enabled = On ; Cleanup the progress information as soon as all POST data has been read ; (i.e. upload completed). ; Default Value: On ; Development Value: On ; Production Value: On ; http://php.net/session.upload-progress.cleanup ;session.upload_progress.cleanup = On ; A prefix used for the upload progress key in $_SESSION ; Default Value: "upload_progress_" ; Development Value: "upload_progress_" ; Production Value: "upload_progress_" ; http://php.net/session.upload-progress.prefix ;session.upload_progress.prefix = "upload_progress_" ; The index name (concatenated with the prefix) in $_SESSION ; containing the upload progress information ; Default Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Development Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Production Value: "PHP_SESSION_UPLOAD_PROGRESS" ; http://php.net/session.upload-progress.name ;session.upload_progress.name = "PHP_SESSION_UPLOAD_PROGRESS" ; How frequently the upload progress should be updated. ; Given either in percentages (per-file), or in bytes ; Default Value: "1%" ; Development Value: "1%" ; Production Value: "1%" ; http://php.net/session.upload-progress.freq ;session.upload_progress.freq = "1%" ; The minimum delay between updates, in seconds ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; http://php.net/session.upload-progress.min-freq ;session.upload_progress.min_freq = "1" [MSSQL] ; Allow or prevent persistent links. mssql.allow_persistent = On ; Maximum number of persistent links. -1 means no limit. mssql.max_persistent = -1 ; Maximum number of links (persistent+non persistent). -1 means no limit. mssql.max_links = -1 ; Minimum error severity to display. mssql.min_error_severity = 10 ; Minimum message severity to display. mssql.min_message_severity = 10 ; Compatibility mode with old versions of PHP 3.0. mssql.compatibility_mode = Off ; Connect timeout ;mssql.connect_timeout = 5 ; Query timeout ;mssql.timeout = 60 ; Valid range 0 - 2147483647. Default = 4096. ;mssql.textlimit = 4096 ; Valid range 0 - 2147483647. Default = 4096. ;mssql.textsize = 4096 ; Limits the number of records in each batch. 0 = all records in one batch. ;mssql.batchsize = 0 ; Specify how datetime and datetim4 columns are returned ; On => Returns data converted to SQL server settings ; Off => Returns values as YYYY-MM-DD hh:mm:ss ;mssql.datetimeconvert = On ; Use NT authentication when connecting to the server mssql.secure_connection = Off ; Specify max number of processes. -1 = library default ; msdlib defaults to 25 ; FreeTDS defaults to 4096 ;mssql.max_procs = -1 ; Specify client character set. ; If empty or not set the client charset from freetds.conf is used ; This is only used when compiled with FreeTDS ;mssql.charset = "ISO-8859-1" [Assertion] ; Assert(expr); active by default. ; http://php.net/assert.active ;assert.active = On ; Issue a PHP warning for each failed assertion. ; http://php.net/assert.warning ;assert.warning = On ; Don't bail out by default. ; http://php.net/assert.bail ;assert.bail = Off ; User-function to be called if an assertion fails. ; http://php.net/assert.callback ;assert.callback = 0 ; Eval the expression with current error_reporting(). Set to true if you want ; error_reporting(0) around the eval(). ; http://php.net/assert.quiet-eval ;assert.quiet_eval = 0 [COM] ; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs ; http://php.net/com.typelib-file ;com.typelib_file = ; allow Distributed-COM calls ; http://php.net/com.allow-dcom ;com.allow_dcom = true ; autoregister constants of a components typlib on com_load() ; http://php.net/com.autoregister-typelib ;com.autoregister_typelib = true ; register constants casesensitive ; http://php.net/com.autoregister-casesensitive ;com.autoregister_casesensitive = false ; show warnings on duplicate constant registrations ; http://php.net/com.autoregister-verbose ;com.autoregister_verbose = true ; The default character set code-page to use when passing strings to and from COM objects. ; Default: system ANSI code page ;com.code_page= [mbstring] ; language for internal character representation. ; This affects mb_send_mail() and mbstrig.detect_order. ; http://php.net/mbstring.language ;mbstring.language = Japanese ; Use of this INI entry is deprecated, use global internal_encoding instead. ; internal/script encoding. ; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*) ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;mbstring.internal_encoding = ; Use of this INI entry is deprecated, use global input_encoding instead. ; http input encoding. ; mbstring.encoding_traslation = On is needed to use this setting. ; If empty, default_charset or input_encoding or mbstring.input is used. ; The precedence is: default_charset < intput_encoding < mbsting.http_input ; http://php.net/mbstring.http-input ;mbstring.http_input = ; Use of this INI entry is deprecated, use global output_encoding instead. ; http output encoding. ; mb_output_handler must be registered as output buffer to function. ; If empty, default_charset or output_encoding or mbstring.http_output is used. ; The precedence is: default_charset < output_encoding < mbstring.http_output ; To use an output encoding conversion, mbstring's output handler must be set ; otherwise output encoding conversion cannot be performed. ; http://php.net/mbstring.http-output ;mbstring.http_output = ; enable automatic encoding translation according to ; mbstring.internal_encoding setting. Input chars are ; converted to internal encoding by setting this to On. ; Note: Do _not_ use automatic encoding translation for ; portable libs/applications. ; http://php.net/mbstring.encoding-translation ;mbstring.encoding_translation = Off ; automatic encoding detection order. ; "auto" detect order is changed according to mbstring.language ; http://php.net/mbstring.detect-order ;mbstring.detect_order = auto ; substitute_character used when character cannot be converted ; one from another ; http://php.net/mbstring.substitute-character ;mbstring.substitute_character = none ; overload(replace) single byte functions by mbstring functions. ; mail(), ereg(), etc are overloaded by mb_send_mail(), mb_ereg(), ; etc. Possible values are 0,1,2,4 or combination of them. ; For example, 7 for overload everything. ; 0: No overload ; 1: Overload mail() function ; 2: Overload str*() functions ; 4: Overload ereg*() functions ; http://php.net/mbstring.func-overload ;mbstring.func_overload = 0 ; enable strict encoding detection. ; Default: Off ;mbstring.strict_detection = On ; This directive specifies the regex pattern of content types for which mb_output_handler() ; is activated. ; Default: mbstring.http_output_conv_mimetype=^(text/|application/xhtml\+xml) ;mbstring.http_output_conv_mimetype= [gd] ; Tell the jpeg decode to ignore warnings and try to create ; a gd image. The warning will then be displayed as notices ; disabled by default ; http://php.net/gd.jpeg-ignore-warning ;gd.jpeg_ignore_warning = 0 [exif] ; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS. ; With mbstring support this will automatically be converted into the encoding ; given by corresponding encode setting. When empty mbstring.internal_encoding ; is used. For the decode settings you can distinguish between motorola and ; intel byte order. A decode setting cannot be empty. ; http://php.net/exif.encode-unicode ;exif.encode_unicode = ISO-8859-15 ; http://php.net/exif.decode-unicode-motorola ;exif.decode_unicode_motorola = UCS-2BE ; http://php.net/exif.decode-unicode-intel ;exif.decode_unicode_intel = UCS-2LE ; http://php.net/exif.encode-jis ;exif.encode_jis = ; http://php.net/exif.decode-jis-motorola ;exif.decode_jis_motorola = JIS ; http://php.net/exif.decode-jis-intel ;exif.decode_jis_intel = JIS [Tidy] ; The path to a default tidy configuration file to use when using tidy ; http://php.net/tidy.default-config ;tidy.default_config = /usr/local/lib/php/default.tcfg ; Should tidy clean and repair output automatically? ; WARNING: Do not use this option if you are generating non-html content ; such as dynamic images ; http://php.net/tidy.clean-output tidy.clean_output = Off [soap] ; Enables or disables WSDL caching feature. ; http://php.net/soap.wsdl-cache-enabled soap.wsdl_cache_enabled=1 ; Sets the directory name where SOAP extension will put cache files. ; http://php.net/soap.wsdl-cache-dir soap.wsdl_cache_dir="/tmp" ; (time to live) Sets the number of second while cached file will be used ; instead of original one. ; http://php.net/soap.wsdl-cache-ttl soap.wsdl_cache_ttl=86400 ; Sets the size of the cache limit. (Max. number of WSDL files to cache) soap.wsdl_cache_limit = 5 [sysvshm] ; A default size of the shared memory segment ;sysvshm.init_mem = 10000 [ldap] ; Sets the maximum number of open links or -1 for unlimited. ldap.max_links = -1 [mcrypt] ; For more information about mcrypt settings see http://php.net/mcrypt-module-open ; Directory where to load mcrypt algorithms ; Default: Compiled in into libmcrypt (usually /usr/local/lib/libmcrypt) ;mcrypt.algorithms_dir= ; Directory where to load mcrypt modes ; Default: Compiled in into libmcrypt (usually /usr/local/lib/libmcrypt) ;mcrypt.modes_dir= [dba] ;dba.default_handler= [opcache] ; Determines if Zend OPCache is enabled ;opcache.enable=0 ; Determines if Zend OPCache is enabled for the CLI version of PHP ;opcache.enable_cli=0 ; The OPcache shared memory storage size. ;opcache.memory_consumption=64 ; The amount of memory for interned strings in Mbytes. ;opcache.interned_strings_buffer=4 ; The maximum number of keys (scripts) in the OPcache hash table. ; Only numbers between 200 and 100000 are allowed. ;opcache.max_accelerated_files=2000 ; The maximum percentage of "wasted" memory until a restart is scheduled. ;opcache.max_wasted_percentage=5 ; When this directive is enabled, the OPcache appends the current working ; directory to the script key, thus eliminating possible collisions between ; files with the same name (basename). Disabling the directive improves ; performance, but may break existing applications. ;opcache.use_cwd=1 ; When disabled, you must reset the OPcache manually or restart the ; webserver for changes to the filesystem to take effect. ;opcache.validate_timestamps=1 ; How often (in seconds) to check file timestamps for changes to the shared ; memory storage allocation. ("1" means validate once per second, but only ; once per request. "0" means always validate) ;opcache.revalidate_freq=2 ; Enables or disables file search in include_path optimization ;opcache.revalidate_path=0 ; If disabled, all PHPDoc comments are dropped from the code to reduce the ; size of the optimized code. ;opcache.save_comments=1 ; If disabled, PHPDoc comments are not loaded from SHM, so "Doc Comments" ; may be always stored (save_comments=1), but not loaded by applications ; that don't need them anyway. ;opcache.load_comments=1 ; If enabled, a fast shutdown sequence is used for the accelerated code ;opcache.fast_shutdown=0 ; Allow file existence override (file_exists, etc.) performance feature. ;opcache.enable_file_override=0 ; A bitmask, where each bit enables or disables the appropriate OPcache ; passes ;opcache.optimization_level=0xffffffff ;opcache.inherited_hack=1 ;opcache.dups_fix=0 ; The location of the OPcache blacklist file (wildcards allowed). ; Each OPcache blacklist file is a text file that holds the names of files ; that should not be accelerated. The file format is to add each filename ; to a new line. The filename may be a full path or just a file prefix ; (i.e., /var/www/x blacklists all the files and directories in /var/www ; that start with 'x'). Line starting with a ; are ignored (comments). ;opcache.blacklist_filename= ; Allows exclusion of large files from being cached. By default all files ; are cached. ;opcache.max_file_size=0 ; Check the cache checksum each N requests. ; The default value of "0" means that the checks are disabled. ;opcache.consistency_checks=0 ; How long to wait (in seconds) for a scheduled restart to begin if the cache ; is not being accessed. ;opcache.force_restart_timeout=180 ; OPcache error_log file name. Empty string assumes "stderr". ;opcache.error_log= ; All OPcache errors go to the Web server log. ; By default, only fatal errors (level 0) or errors (level 1) are logged. ; You can also enable warnings (level 2), info messages (level 3) or ; debug messages (level 4). ;opcache.log_verbosity_level=1 ; Preferred Shared Memory back-end. Leave empty and let the system decide. ;opcache.preferred_memory_model= ; Protect the shared memory from unexpected writing during script execution. ; Useful for internal debugging only. ;opcache.protect_memory=0 [curl] ; A default value for the CURLOPT_CAINFO option. This is required to be an ; absolute path. ;curl.cainfo = [openssl] ; The location of a Certificate Authority (CA) file on the local filesystem ; to use when verifying the identity of SSL/TLS peers. Most users should ; not specify a value for this directive as PHP will attempt to use the ; OS-managed cert stores in its absence. If specified, this value may still ; be overridden on a per-stream basis via the "cafile" SSL stream context ; option. ;openssl.cafile= ; If openssl.cafile is not specified or if the CA file is not found, the ; directory pointed to by openssl.capath is searched for a suitable ; certificate. This value must be a correctly hashed certificate directory. ; Most users should not specify a value for this directive as PHP will ; attempt to use the OS-managed cert stores in its absence. If specified, ; this value may still be overridden on a per-stream basis via the "capath" ; SSL stream context option. ;openssl.capath= ; Local Variables: ; tab-width: 4 ; End: [Zend] zend_extension="/usr/local/ioncube/ioncube_loader_lin_5.6.so" ; fix for segfaults auto_globals_jit = Off cgi.fix_pathinfo = 1 mbstring.http_input = "pass" mbstring.http_output = "pass" mbstring.encoding_translation = 0 ; Enable Extensions extension=uploadprogress.so extension=imagick.so extension=jsmin.so extension=redis.so ================================================ FILE: aegir/conf/php/php70-cli.ini ================================================ [PHP] ;;;;;;;;;;;;;;;;;;; ; About php.ini ; ;;;;;;;;;;;;;;;;;;; ; PHP's initialization file, generally called php.ini, is responsible for ; configuring many of the aspects of PHP's behavior. ; PHP attempts to find and load this configuration from a number of locations. ; The following is a summary of its search order: ; 1. SAPI module specific location. ; 2. The PHPRC environment variable. (As of PHP 5.2.0) ; 3. A number of predefined registry keys on Windows (As of PHP 5.2.0) ; 4. Current working directory (except CLI) ; 5. The web server's directory (for SAPI modules), or directory of PHP ; (otherwise in Windows) ; 6. The directory from the --with-config-file-path compile time option, or the ; Windows directory (C:\windows or C:\winnt) ; See the PHP docs for more specific information. ; http://php.net/configuration.file ; The syntax of the file is extremely simple. Whitespace and lines ; beginning with a semicolon are silently ignored (as you probably guessed). ; Section headers (e.g. [Foo]) are also silently ignored, even though ; they might mean something in the future. ; Directives following the section heading [PATH=/www/mysite] only ; apply to PHP files in the /www/mysite directory. Directives ; following the section heading [HOST=www.example.com] only apply to ; PHP files served from www.example.com. Directives set in these ; special sections cannot be overridden by user-defined INI files or ; at runtime. Currently, [PATH=] and [HOST=] sections only work under ; CGI/FastCGI. ; http://php.net/ini.sections ; Directives are specified using the following syntax: ; directive = value ; Directive names are *case sensitive* - foo=bar is different from FOO=bar. ; Directives are variables used to configure PHP or PHP extensions. ; There is no name validation. If PHP can't find an expected ; directive because it is not set or is mistyped, a default value will be used. ; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one ; of the INI constants (On, Off, True, False, Yes, No and None) or an expression ; (e.g. E_ALL & ~E_NOTICE), a quoted string ("bar"), or a reference to a ; previously set variable or directive (e.g. ${foo}) ; Expressions in the INI file are limited to bitwise operators and parentheses: ; | bitwise OR ; ^ bitwise XOR ; & bitwise AND ; ~ bitwise NOT ; ! boolean NOT ; Boolean flags can be turned on using the values 1, On, True or Yes. ; They can be turned off using the values 0, Off, False or No. ; An empty string can be denoted by simply not writing anything after the equal ; sign, or by using the None keyword: ; foo = ; sets foo to an empty string ; foo = None ; sets foo to an empty string ; foo = "None" ; sets foo to the string 'None' ; If you use constants in your value, and these constants belong to a ; dynamically loaded extension (either a PHP extension or a Zend extension), ; you may only use these constants *after* the line that loads the extension. ;;;;;;;;;;;;;;;;;;; ; About this file ; ;;;;;;;;;;;;;;;;;;; ; PHP comes packaged with two INI files. One that is recommended to be used ; in production environments and one that is recommended to be used in ; development environments. ; php.ini-production contains settings which hold security, performance and ; best practices at its core. But please be aware, these settings may break ; compatibility with older or less security conscience applications. We ; recommending using the production ini in production and testing environments. ; php.ini-development is very similar to its production variant, except it is ; much more verbose when it comes to errors. We recommend using the ; development version only in development environments, as errors shown to ; application users can inadvertently leak otherwise secure information. ; This is php.ini-production INI file. ;;;;;;;;;;;;;;;;;;; ; Quick Reference ; ;;;;;;;;;;;;;;;;;;; ; The following are all the settings which are different in either the production ; or development versions of the INIs with respect to PHP's default behavior. ; Please see the actual settings later in the document for more details as to why ; we recommend these changes in PHP's behavior. display_errors = Off ; Default Value: On ; Development Value: On ; Production Value: Off ; display_startup_errors ; Default Value: Off ; Development Value: On ; Production Value: Off ; error_reporting ; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; html_errors ; Default Value: On ; Development Value: On ; Production value: On ; log_errors ; Default Value: Off ; Development Value: On ; Production Value: On ; max_input_time ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; output_buffering ; Default Value: Off ; Development Value: 4096 ; Production Value: 4096 ; register_argc_argv ; Default Value: On ; Development Value: Off ; Production Value: Off ; request_order ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; session.gc_divisor ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; session.hash_bits_per_character ; Default Value: 4 ; Development Value: 5 ; Production Value: 5 ; short_open_tag ; Default Value: On ; Development Value: Off ; Production Value: Off ; track_errors ; Default Value: Off ; Development Value: On ; Production Value: Off ; url_rewriter.tags ; Default Value: "a=href,area=href,frame=src,form=,fieldset=" ; Development Value: "a=href,area=href,frame=src,input=src,form=fakeentry" ; Production Value: "a=href,area=href,frame=src,input=src,form=fakeentry" ; variables_order ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS" ;;;;;;;;;;;;;;;;;;;; ; php.ini Options ; ;;;;;;;;;;;;;;;;;;;; ; Name for user-defined php.ini (.htaccess) files. Default is ".user.ini" ;user_ini.filename = ".user.ini" ; To disable this feature set this option to empty value user_ini.filename = ; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes) ;user_ini.cache_ttl = 300 ;;;;;;;;;;;;;;;;;;;; ; Language Options ; ;;;;;;;;;;;;;;;;;;;; ; Enable the PHP scripting language engine under Apache. ; http://php.net/engine engine = On ; This directive determines whether or not PHP will recognize code between ; tags as PHP source which should be processed as such. It is ; generally recommended that should be used and that this feature ; should be disabled, as enabling it may result in issues when generating XML ; documents, however this remains supported for backward compatibility reasons. ; Note that this directive does not control the would work. ; http://php.net/syntax-highlighting ;highlight.string = #DD0000 ;highlight.comment = #FF9900 ;highlight.keyword = #007700 ;highlight.default = #0000BB ;highlight.html = #000000 ; If enabled, the request will be allowed to complete even if the user aborts ; the request. Consider enabling it if executing long requests, which may end up ; being interrupted by the user or a browser timing out. PHP's default behavior ; is to disable this feature. ; http://php.net/ignore-user-abort ;ignore_user_abort = On ; Determines the size of the realpath cache to be used by PHP. This value should ; be increased on systems where PHP opens many files to reflect the quantity of ; the file operations performed. ; http://php.net/realpath-cache-size realpath_cache_size=64M ; Duration of time, in seconds for which to cache realpath information for a given ; file or directory. For systems with rarely changing files, consider increasing this ; value. ; http://php.net/realpath-cache-ttl realpath_cache_ttl=5 ; Enables or disables the circular reference collector. ; http://php.net/zend.enable-gc zend.enable_gc = On ; If enabled, scripts may be written in encodings that are incompatible with ; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such ; encodings. To use this feature, mbstring extension must be enabled. ; Default: Off ;zend.multibyte = Off ; Allows to set the default encoding for the scripts. This value will be used ; unless "declare(encoding=...)" directive appears at the top of the script. ; Only affects if zend.multibyte is set. ; Default: "" ;zend.script_encoding = ;;;;;;;;;;;;;;;;; ; Miscellaneous ; ;;;;;;;;;;;;;;;;; ; Decides whether PHP may expose the fact that it is installed on the server ; (e.g. by adding its signature to the Web server header). It is no security ; threat in any way, but it makes it possible to determine whether you use PHP ; on your server or not. ; http://php.net/expose-php expose_php = On ;;;;;;;;;;;;;;;;;;; ; Resource Limits ; ;;;;;;;;;;;;;;;;;;; ; Maximum execution time of each script, in seconds ; http://php.net/max-execution-time ; Note: This directive is hardcoded to 0 for the CLI SAPI max_execution_time = 3600 ; Maximum amount of time each script may spend parsing request data. It's a good ; idea to limit this time on productions servers in order to eliminate unexpectedly ; long running scripts. ; Note: This directive is hardcoded to -1 for the CLI SAPI ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; http://php.net/max-input-time max_input_time = 3600 ; Maximum input variable nesting level ; http://php.net/max-input-nesting-level ;max_input_nesting_level = 64 ; How many GET/POST/COOKIE input variables may be accepted max_input_vars = 9999 ; Maximum amount of memory a script may consume (128MB) ; http://php.net/memory-limit memory_limit = 395M ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; Error handling and logging ; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; This directive informs PHP of which errors, warnings and notices you would like ; it to take action for. The recommended way of setting values for this ; directive is through the use of the error level constants and bitwise ; operators. The error level constants are below here for convenience as well as ; some common settings and their meanings. ; By default, PHP is set to take action on all errors, notices and warnings EXCEPT ; those related to E_NOTICE and E_STRICT, which together cover best practices and ; recommended coding standards in PHP. For performance reasons, this is the ; recommend error reporting setting. Your production server shouldn't be wasting ; resources complaining about best practices and coding standards. That's what ; development servers and development settings are for. ; Note: The php.ini-development file has this setting as E_ALL. This ; means it pretty much reports everything which is exactly what you want during ; development and early testing. ; ; Error Level Constants: ; E_ALL - All errors and warnings (includes E_STRICT as of PHP 5.4.0) ; E_ERROR - fatal run-time errors ; E_RECOVERABLE_ERROR - almost fatal run-time errors ; E_WARNING - run-time warnings (non-fatal errors) ; E_PARSE - compile-time parse errors ; E_NOTICE - run-time notices (these are warnings which often result ; from a bug in your code, but it's possible that it was ; intentional (e.g., using an uninitialized variable and ; relying on the fact it is automatically initialized to an ; empty string) ; E_STRICT - run-time notices, enable to have PHP suggest changes ; to your code which will ensure the best interoperability ; and forward compatibility of your code ; E_CORE_ERROR - fatal errors that occur during PHP's initial startup ; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's ; initial startup ; E_COMPILE_ERROR - fatal compile-time errors ; E_COMPILE_WARNING - compile-time warnings (non-fatal errors) ; E_USER_ERROR - user-generated error message ; E_USER_WARNING - user-generated warning message ; E_USER_NOTICE - user-generated notice message ; E_DEPRECATED - warn about code that will not work in future versions ; of PHP ; E_USER_DEPRECATED - user-generated deprecation warnings ; ; Common Values: ; E_ALL (Show all errors, warnings and notices including coding standards.) ; E_ALL & ~E_NOTICE (Show all errors, except for notices) ; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.) ; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors) ; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; http://php.net/error-reporting error_reporting = 1 ; This directive controls whether or not and where PHP will output errors, ; notices and warnings too. Error output is very useful during development, but ; it could be very dangerous in production environments. Depending on the code ; which is triggering the error, sensitive information could potentially leak ; out of your application such as database usernames and passwords or worse. ; For production environments, we recommend logging errors rather than ; sending them to STDOUT. ; Possible Values: ; Off = Do not display any errors ; stderr = Display errors to STDERR (affects only CGI/CLI binaries!) ; On or stdout = Display errors to STDOUT ; Default Value: On ; Development Value: On ; Production Value: Off ; http://php.net/display-errors display_errors = Off ; The display of errors which occur during PHP's startup sequence are handled ; separately from display_errors. PHP's default behavior is to suppress those ; errors from clients. Turning the display of startup errors on can be useful in ; debugging configuration problems. We strongly recommend you ; set this to 'off' for production servers. ; Default Value: Off ; Development Value: On ; Production Value: Off ; http://php.net/display-startup-errors display_startup_errors = Off ; Besides displaying errors, PHP can also log errors to locations such as a ; server-specific log, STDERR, or a location specified by the error_log ; directive found below. While errors should not be displayed on productions ; servers they should still be monitored and logging is a great way to do that. ; Default Value: Off ; Development Value: On ; Production Value: On ; http://php.net/log-errors log_errors = On ; Set maximum length of log_errors. In error_log information about the source is ; added. The default is 1024 and 0 allows to not apply any maximum length at all. ; http://php.net/log-errors-max-len log_errors_max_len = 1024 ; Do not log repeated messages. Repeated errors must occur in same file on same ; line unless ignore_repeated_source is set true. ; http://php.net/ignore-repeated-errors ignore_repeated_errors = Off ; Ignore source of message when ignoring repeated messages. When this setting ; is On you will not log errors with repeated messages from different files or ; source lines. ; http://php.net/ignore-repeated-source ignore_repeated_source = Off ; If this parameter is set to Off, then memory leaks will not be shown (on ; stdout or in the log). This has only effect in a debug compile, and if ; error reporting includes E_WARNING in the allowed list ; http://php.net/report-memleaks report_memleaks = On ; This setting is on by default. ;report_zend_debug = 0 ; Store the last error/warning message in $php_errormsg (boolean). Setting this value ; to On can assist in debugging and is appropriate for development servers. It should ; however be disabled on production servers. ; Default Value: Off ; Development Value: On ; Production Value: Off ; http://php.net/track-errors track_errors = Off ; Turn off normal error reporting and emit XML-RPC error XML ; http://php.net/xmlrpc-errors ;xmlrpc_errors = 0 ; An XML-RPC faultCode ;xmlrpc_error_number = 0 ; When PHP displays or logs an error, it has the capability of formatting the ; error message as HTML for easier reading. This directive controls whether ; the error message is formatted as HTML or not. ; Note: This directive is hardcoded to Off for the CLI SAPI ; Default Value: On ; Development Value: On ; Production value: On ; http://php.net/html-errors html_errors = Off ; If html_errors is set to On *and* docref_root is not empty, then PHP ; produces clickable error messages that direct to a page describing the error ; or function causing the error in detail. ; You can download a copy of the PHP manual from http://php.net/docs ; and change docref_root to the base URL of your local copy including the ; leading '/'. You must also specify the file extension being used including ; the dot. PHP's default behavior is to leave these settings empty, in which ; case no links to documentation are generated. ; Note: Never use this feature for production boxes. ; http://php.net/docref-root ; Examples ;docref_root = "/phpmanual/" ; http://php.net/docref-ext ;docref_ext = .html ; String to output before an error message. PHP's default behavior is to leave ; this setting blank. ; http://php.net/error-prepend-string ; Example: ;error_prepend_string = "" ; String to output after an error message. PHP's default behavior is to leave ; this setting blank. ; http://php.net/error-append-string ; Example: ;error_append_string = "" ; Log errors to specified file. PHP's default behavior is to leave this value ; empty. ; http://php.net/error-log ; Example: ;error_log = php_errors.log ; Log errors to syslog (Event Log on Windows). ;error_log = syslog error_log = /var/log/php/error_log_cli_70 ;windows.show_crt_warning ; Default value: 0 ; Development value: 0 ; Production value: 0 ;;;;;;;;;;;;;;;;; ; Data Handling ; ;;;;;;;;;;;;;;;;; ; The separator used in PHP generated URLs to separate arguments. ; PHP's default setting is "&". ; http://php.net/arg-separator.output ; Example: ;arg_separator.output = "&" ; List of separator(s) used by PHP to parse input URLs into variables. ; PHP's default setting is "&". ; NOTE: Every character in this directive is considered as separator! ; http://php.net/arg-separator.input ; Example: ;arg_separator.input = ";&" ; This directive determines which super global arrays are registered when PHP ; starts up. G,P,C,E & S are abbreviations for the following respective super ; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty ; paid for the registration of these arrays and because ENV is not as commonly ; used as the others, ENV is not recommended on productions servers. You ; can still get access to the environment variables through getenv() should you ; need to. ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS"; ; http://php.net/variables-order variables_order = "GPCS" ; This directive determines which super global data (G,P & C) should be ; registered into the super global array REQUEST. If so, it also determines ; the order in which that data is registered. The values for this directive ; are specified in the same manner as the variables_order directive, ; EXCEPT one. Leaving this value empty will cause PHP to use the value set ; in the variables_order directive. It does not mean it will leave the super ; globals array REQUEST empty. ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; http://php.net/request-order request_order = "GP" ; This directive determines whether PHP registers $argv & $argc each time it ; runs. $argv contains an array of all the arguments passed to PHP when a script ; is invoked. $argc contains an integer representing the number of arguments ; that were passed when the script was invoked. These arrays are extremely ; useful when running scripts from the command line. When this directive is ; enabled, registering these variables consumes CPU cycles and memory each time ; a script is executed. For performance reasons, this feature should be disabled ; on production servers. ; Note: This directive is hardcoded to On for the CLI SAPI ; Default Value: On ; Development Value: Off ; Production Value: Off ; http://php.net/register-argc-argv register_argc_argv = Off ; When enabled, the ENV, REQUEST and SERVER variables are created when they're ; first used (Just In Time) instead of when the script starts. If these ; variables are not used within a script, having this directive on will result ; in a performance gain. The PHP directive register_argc_argv must be disabled ; for this directive to have any affect. ; http://php.net/auto-globals-jit auto_globals_jit = On ; Whether PHP will read the POST data. ; This option is enabled by default. ; Most likely, you won't want to disable this option globally. It causes $_POST ; and $_FILES to always be empty; the only way you will be able to read the ; POST data will be through the php://input stream wrapper. This can be useful ; to proxy requests or to process the POST data in a memory efficient fashion. ; http://php.net/enable-post-data-reading ;enable_post_data_reading = Off ; Maximum size of POST data that PHP will accept. ; Its value may be 0 to disable the limit. It is ignored if POST data reading ; is disabled through enable_post_data_reading. ; http://php.net/post-max-size post_max_size = 350M ; Automatically add files before PHP document. ; http://php.net/auto-prepend-file auto_prepend_file = ; Automatically add files after PHP document. ; http://php.net/auto-append-file auto_append_file = ; By default, PHP will output a media type using the Content-Type header. To ; disable this, simply set it to be empty. ; ; PHP's built-in default media type is set to text/html. ; http://php.net/default-mimetype default_mimetype = "text/html" ; PHP's default character set is set to UTF-8. ; http://php.net/default-charset default_charset = "UTF-8" ; PHP internal character encoding is set to empty. ; If empty, default_charset is used. ; http://php.net/internal-encoding ;internal_encoding = ; PHP input character encoding is set to empty. ; If empty, default_charset is used. ; http://php.net/input-encoding ;input_encoding = ; PHP output character encoding is set to empty. ; If empty, default_charset is used. ; mbstring or iconv output handler is used. ; See also output_buffer. ; http://php.net/output-encoding ;output_encoding = ;;;;;;;;;;;;;;;;;;;;;;;;; ; Paths and Directories ; ;;;;;;;;;;;;;;;;;;;;;;;;; ; UNIX: "/path1:/path2" ;include_path = ".:/php/includes" ; ; Windows: "\path1;\path2" ;include_path = ".;c:\php\includes" ; ; PHP's default setting for include_path is ".;/path/to/php/pear" ; http://php.net/include-path include_path = ".:/opt/php70/lib/php" ; The root of the PHP pages, used only if nonempty. ; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root ; if you are running php as a CGI under any web server (other than IIS) ; see documentation for security issues. The alternate is to use the ; cgi.force_redirect configuration below ; http://php.net/doc-root doc_root = ; The directory under which PHP opens the script using /~username used only ; if nonempty. ; http://php.net/user-dir user_dir = ; Directory in which the loadable extensions (modules) reside. ; http://php.net/extension-dir ; extension_dir = "./" ; On windows: ; extension_dir = "ext" extension_dir = "/opt/php70/lib/php/extensions/no-debug-non-zts-20151012/" ; Directory where the temporary files should be placed. ; Defaults to the system default (see sys_get_temp_dir) sys_temp_dir = "/tmp" ; Whether or not to enable the dl() function. The dl() function does NOT work ; properly in multithreaded servers, such as IIS or Zeus, and is automatically ; disabled on them. ; http://php.net/enable-dl enable_dl = Off ; cgi.force_redirect is necessary to provide security running PHP as a CGI under ; most web servers. Left undefined, PHP turns this on by default. You can ; turn it off here AT YOUR OWN RISK ; **You CAN safely turn this off for IIS, in fact, you MUST.** ; http://php.net/cgi.force-redirect ;cgi.force_redirect = 1 ; if cgi.nph is enabled it will force cgi to always sent Status: 200 with ; every request. PHP's default behavior is to disable this feature. ;cgi.nph = 1 ; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape ; (iPlanet) web servers, you MAY need to set an environment variable name that PHP ; will look for to know it is OK to continue execution. Setting this variable MAY ; cause security issues, KNOW WHAT YOU ARE DOING FIRST. ; http://php.net/cgi.redirect-status-env ;cgi.redirect_status_env = ; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's ; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok ; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting ; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting ; of zero causes PHP to behave as before. Default is 1. You should fix your scripts ; to use SCRIPT_FILENAME rather than PATH_TRANSLATED. ; http://php.net/cgi.fix-pathinfo ;cgi.fix_pathinfo=1 ; FastCGI under IIS (on WINNT based OS) supports the ability to impersonate ; security tokens of the calling client. This allows IIS to define the ; security context that the request runs under. mod_fastcgi under Apache ; does not currently support this feature (03/17/2002) ; Set to 1 if running under IIS. Default is zero. ; http://php.net/fastcgi.impersonate ;fastcgi.impersonate = 1 ; Disable logging through FastCGI connection. PHP's default behavior is to enable ; this feature. ;fastcgi.logging = 0 ; cgi.rfc2616_headers configuration option tells PHP what type of headers to ; use when sending HTTP response code. If set to 0, PHP sends Status: header that ; is supported by Apache. When this option is set to 1, PHP will send ; RFC2616 compliant header. ; Default is zero. ; http://php.net/cgi.rfc2616-headers ;cgi.rfc2616_headers = 0 ;;;;;;;;;;;;;;;; ; File Uploads ; ;;;;;;;;;;;;;;;; ; Whether to allow HTTP file uploads. ; http://php.net/file-uploads file_uploads = On ; Temporary directory for HTTP uploaded files (will use system default if not ; specified). ; http://php.net/upload-tmp-dir upload_tmp_dir = /tmp ; Maximum allowed size for uploaded files. ; http://php.net/upload-max-filesize upload_max_filesize = 325M ; Maximum number of files that can be uploaded via a single request max_file_uploads = 50 ;;;;;;;;;;;;;;;;;; ; Fopen wrappers ; ;;;;;;;;;;;;;;;;;; ; Whether to allow the treatment of URLs (like http:// or ftp://) as files. ; http://php.net/allow-url-fopen allow_url_fopen = On ; Whether to allow include/require to open URLs (like http:// or ftp://) as files. ; http://php.net/allow-url-include allow_url_include = Off ; Define the anonymous ftp password (your email address). PHP's default setting ; for this is empty. ; http://php.net/from ;from="john@doe.com" ; Define the User-Agent string. PHP's default setting for this is empty. ; http://php.net/user-agent ;user_agent="PHP" ; Default timeout for socket based streams (seconds) ; http://php.net/default-socket-timeout default_socket_timeout = 3600 ; If your scripts have to deal with files from Macintosh systems, ; or you are running on a Mac and need to deal with files from ; unix or win32 systems, setting this flag will cause PHP to ; automatically detect the EOL character in those files so that ; fgets() and file() will work regardless of the source of the file. ; http://php.net/auto-detect-line-endings auto_detect_line_endings = On ;;;;;;;;;;;;;;;;;;;;;; ; Dynamic Extensions ; ;;;;;;;;;;;;;;;;;;;;;; ; If you wish to have an extension loaded automatically, use the following ; syntax: ; ; extension=modulename.extension ; ; For example, on Windows: ; ; extension=msql.dll ; ; ... or under UNIX: ; ; extension=msql.so ; ; ... or with a path: ; ; extension=/path/to/extension/msql.so ; ; If you only provide the name of the extension, PHP will look for it in its ; default extension directory. ; ; Windows Extensions ; Note that ODBC support is built in, so no dll is needed for it. ; Note that many DLL files are located in the extensions/ (PHP 4) ext/ (PHP 5+) ; extension folders as well as the separate PECL DLL download (PHP 5+). ; Be sure to appropriately set the extension_dir directive. ; ;extension=php_bz2.dll ;extension=php_curl.dll ;extension=php_fileinfo.dll ;extension=php_gd2.dll ;extension=php_gettext.dll ;extension=php_gmp.dll ;extension=php_intl.dll ;extension=php_imap.dll ;extension=php_interbase.dll ;extension=php_ldap.dll ;extension=php_mbstring.dll ;extension=php_exif.dll ; Must be after mbstring as it depends on it ;extension=php_mysqli.dll ;extension=php_oci8_12c.dll ; Use with Oracle Database 12c Instant Client ;extension=php_openssl.dll ;extension=php_pdo_firebird.dll ;extension=php_pdo_mysql.dll ;extension=php_pdo_oci.dll ;extension=php_pdo_odbc.dll ;extension=php_pdo_pgsql.dll ;extension=php_pdo_sqlite.dll ;extension=php_pgsql.dll ;extension=php_shmop.dll ; The MIBS data available in the PHP distribution must be installed. ; See http://www.php.net/manual/en/snmp.installation.php ;extension=php_snmp.dll ;extension=php_soap.dll ;extension=php_sockets.dll ;extension=php_sqlite3.dll ;extension=php_tidy.dll ;extension=php_xmlrpc.dll ;extension=php_xsl.dll ;;;;;;;;;;;;;;;;;;; ; Module Settings ; ;;;;;;;;;;;;;;;;;;; [CLI Server] ; Whether the CLI web server uses ANSI color coding in its terminal output. cli_server.color = On [Date] ; Defines the default timezone used by the date functions ; http://php.net/date.timezone date.timezone = "UTC" ; http://php.net/date.default-latitude ;date.default_latitude = 31.7667 ; http://php.net/date.default-longitude ;date.default_longitude = 35.2333 ; http://php.net/date.sunrise-zenith ;date.sunrise_zenith = 90.583333 ; http://php.net/date.sunset-zenith ;date.sunset_zenith = 90.583333 [filter] ; http://php.net/filter.default ;filter.default = unsafe_raw ; http://php.net/filter.default-flags ;filter.default_flags = [iconv] ; Use of this INI entry is deprecated, use global input_encoding instead. ; If empty, default_charset or input_encoding or iconv.input_encoding is used. ; The precedence is: default_charset < intput_encoding < iconv.input_encoding ;iconv.input_encoding = ; Use of this INI entry is deprecated, use global internal_encoding instead. ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;iconv.internal_encoding = ; Use of this INI entry is deprecated, use global output_encoding instead. ; If empty, default_charset or output_encoding or iconv.output_encoding is used. ; The precedence is: default_charset < output_encoding < iconv.output_encoding ; To use an output encoding conversion, iconv's output handler must be set ; otherwise output encoding conversion cannot be performed. ;iconv.output_encoding = [intl] ;intl.default_locale = ; This directive allows you to produce PHP errors when some error ; happens within intl functions. The value is the level of the error produced. ; Default is 0, which does not produce any errors. ;intl.error_level = E_WARNING [sqlite3] ;sqlite3.extension_dir = [Pcre] ;PCRE library backtracking limit. ; http://php.net/pcre.backtrack-limit ;pcre.backtrack_limit=100000 ;PCRE library recursion limit. ;Please note that if you set this value to a high number you may consume all ;the available process stack and eventually crash PHP (due to reaching the ;stack size limit imposed by the Operating System). ; http://php.net/pcre.recursion-limit ;pcre.recursion_limit=100000 ;Enables or disables JIT compilation of patterns. This requires the PCRE ;library to be compiled with JIT support. ;pcre.jit=1 [Pdo] ; Whether to pool ODBC connections. Can be one of "strict", "relaxed" or "off" ; http://php.net/pdo-odbc.connection-pooling ;pdo_odbc.connection_pooling=strict ;pdo_odbc.db2_instance_name [Pdo_mysql] ; If mysqlnd is used: Number of cache slots for the internal result set cache ; http://php.net/pdo_mysql.cache_size pdo_mysql.cache_size = 2000 ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. ; http://php.net/pdo_mysql.default-socket pdo_mysql.default_socket= [Phar] ; http://php.net/phar.readonly ;phar.readonly = On ; http://php.net/phar.require-hash ;phar.require_hash = On ;phar.cache_list = [mail function] ; For Win32 only. ; http://php.net/smtp ;SMTP = localhost ; http://php.net/smtp-port ;smtp_port = 25 ; For Win32 only. ; http://php.net/sendmail-from ;sendmail_from = me@example.com ; For Unix only. You may supply arguments as well (default: "sendmail -t -i"). ; http://php.net/sendmail-path sendmail_path = /usr/sbin/sendmail -t -i ; Force the addition of the specified parameters to be passed as extra parameters ; to the sendmail binary. These parameters will always replace the value of ; the 5th parameter to mail(). ;mail.force_extra_parameters = ; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename mail.add_x_header = Off ; The path to a log file that will log all mail() calls. Log entries include ; the full path of the script, line number, To address and headers. ;mail.log = ; Log mail to syslog (Event Log on Windows). ;mail.log = syslog [SQL] ; http://php.net/sql.safe-mode sql.safe_mode = Off [ODBC] ; http://php.net/odbc.default-db ;odbc.default_db = Not yet implemented ; http://php.net/odbc.default-user ;odbc.default_user = Not yet implemented ; http://php.net/odbc.default-pw ;odbc.default_pw = Not yet implemented ; Controls the ODBC cursor model. ; Default: SQL_CURSOR_STATIC (default). ;odbc.default_cursortype ; Allow or prevent persistent links. ; http://php.net/odbc.allow-persistent odbc.allow_persistent = On ; Check that a connection is still valid before reuse. ; http://php.net/odbc.check-persistent odbc.check_persistent = On ; Maximum number of persistent links. -1 means no limit. ; http://php.net/odbc.max-persistent odbc.max_persistent = -1 ; Maximum number of links (persistent + non-persistent). -1 means no limit. ; http://php.net/odbc.max-links odbc.max_links = -1 ; Handling of LONG fields. Returns number of bytes to variables. 0 means ; passthru. ; http://php.net/odbc.defaultlrl odbc.defaultlrl = 4096 ; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char. ; See the documentation on odbc_binmode and odbc_longreadlen for an explanation ; of odbc.defaultlrl and odbc.defaultbinmode ; http://php.net/odbc.defaultbinmode odbc.defaultbinmode = 1 ;birdstep.max_links = -1 [Interbase] ; Allow or prevent persistent links. ibase.allow_persistent = 1 ; Maximum number of persistent links. -1 means no limit. ibase.max_persistent = -1 ; Maximum number of links (persistent + non-persistent). -1 means no limit. ibase.max_links = -1 ; Default database name for ibase_connect(). ;ibase.default_db = ; Default username for ibase_connect(). ;ibase.default_user = ; Default password for ibase_connect(). ;ibase.default_password = ; Default charset for ibase_connect(). ;ibase.default_charset = ; Default timestamp format. ibase.timestampformat = "%Y-%m-%d %H:%M:%S" ; Default date format. ibase.dateformat = "%Y-%m-%d" ; Default time format. ibase.timeformat = "%H:%M:%S" [MySQLi] ; Maximum number of persistent links. -1 means no limit. ; http://php.net/mysqli.max-persistent mysqli.max_persistent = -1 ; Allow accessing, from PHP's perspective, local files with LOAD DATA statements ; http://php.net/mysqli.allow_local_infile ;mysqli.allow_local_infile = On ; Allow or prevent persistent links. ; http://php.net/mysqli.allow-persistent mysqli.allow_persistent = On ; Maximum number of links. -1 means no limit. ; http://php.net/mysqli.max-links mysqli.max_links = -1 ; If mysqlnd is used: Number of cache slots for the internal result set cache ; http://php.net/mysqli.cache_size mysqli.cache_size = 2000 ; Default port number for mysqli_connect(). If unset, mysqli_connect() will use ; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the ; compile-time value defined MYSQL_PORT (in that order). Win32 will only look ; at MYSQL_PORT. ; http://php.net/mysqli.default-port mysqli.default_port = 3306 ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. ; http://php.net/mysqli.default-socket mysqli.default_socket = ; Default host for mysql_connect() (doesn't apply in safe mode). ; http://php.net/mysqli.default-host mysqli.default_host = ; Default user for mysql_connect() (doesn't apply in safe mode). ; http://php.net/mysqli.default-user mysqli.default_user = ; Default password for mysqli_connect() (doesn't apply in safe mode). ; Note that this is generally a *bad* idea to store passwords in this file. ; *Any* user with PHP access can run 'echo get_cfg_var("mysqli.default_pw") ; and reveal this password! And of course, any users with read access to this ; file will be able to reveal the password as well. ; http://php.net/mysqli.default-pw mysqli.default_pw = ; Allow or prevent reconnect mysqli.reconnect = Off [mysqlnd] ; Enable / Disable collection of general statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. ; http://php.net/mysqlnd.collect_statistics mysqlnd.collect_statistics = 0 ; Enable / Disable collection of memory usage statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. ; http://php.net/mysqlnd.collect_memory_statistics mysqlnd.collect_memory_statistics = 0 ; Size of a pre-allocated buffer used when sending commands to MySQL in bytes. ; http://php.net/mysqlnd.net_cmd_buffer_size mysqlnd.net_cmd_buffer_size = 8192 ; Size of a pre-allocated buffer used for reading data sent by the server in ; bytes. ; http://php.net/mysqlnd.net_read_buffer_size mysqlnd.net_read_buffer_size = 131072 [OCI8] ; Connection: Enables privileged connections using external ; credentials (OCI_SYSOPER, OCI_SYSDBA) ; http://php.net/oci8.privileged-connect ;oci8.privileged_connect = Off ; Connection: The maximum number of persistent OCI8 connections per ; process. Using -1 means no limit. ; http://php.net/oci8.max-persistent ;oci8.max_persistent = -1 ; Connection: The maximum number of seconds a process is allowed to ; maintain an idle persistent connection. Using -1 means idle ; persistent connections will be maintained forever. ; http://php.net/oci8.persistent-timeout ;oci8.persistent_timeout = -1 ; Connection: The number of seconds that must pass before issuing a ; ping during oci_pconnect() to check the connection validity. When ; set to 0, each oci_pconnect() will cause a ping. Using -1 disables ; pings completely. ; http://php.net/oci8.ping-interval ;oci8.ping_interval = 60 ; Connection: Set this to a user chosen connection class to be used ; for all pooled server requests with Oracle 11g Database Resident ; Connection Pooling (DRCP). To use DRCP, this value should be set to ; the same string for all web servers running the same application, ; the database pool must be configured, and the connection string must ; specify to use a pooled server. ;oci8.connection_class = ; High Availability: Using On lets PHP receive Fast Application ; Notification (FAN) events generated when a database node fails. The ; database must also be configured to post FAN events. ;oci8.events = Off ; Tuning: This option enables statement caching, and specifies how ; many statements to cache. Using 0 disables statement caching. ; http://php.net/oci8.statement-cache-size ;oci8.statement_cache_size = 20 ; Tuning: Enables statement prefetching and sets the default number of ; rows that will be fetched automatically after statement execution. ; http://php.net/oci8.default-prefetch ;oci8.default_prefetch = 100 ; Compatibility. Using On means oci_close() will not close ; oci_connect() and oci_new_connect() connections. ; http://php.net/oci8.old-oci-close-semantics ;oci8.old_oci_close_semantics = Off [PostgreSQL] ; Allow or prevent persistent links. ; http://php.net/pgsql.allow-persistent pgsql.allow_persistent = On ; Detect broken persistent links always with pg_pconnect(). ; Auto reset feature requires a little overheads. ; http://php.net/pgsql.auto-reset-persistent pgsql.auto_reset_persistent = Off ; Maximum number of persistent links. -1 means no limit. ; http://php.net/pgsql.max-persistent pgsql.max_persistent = -1 ; Maximum number of links (persistent+non persistent). -1 means no limit. ; http://php.net/pgsql.max-links pgsql.max_links = -1 ; Ignore PostgreSQL backends Notice message or not. ; Notice message logging require a little overheads. ; http://php.net/pgsql.ignore-notice pgsql.ignore_notice = 0 ; Log PostgreSQL backends Notice message or not. ; Unless pgsql.ignore_notice=0, module cannot log notice message. ; http://php.net/pgsql.log-notice pgsql.log_notice = 0 [bcmath] ; Number of decimal digits for all bcmath functions. ; http://php.net/bcmath.scale bcmath.scale = 0 [browscap] ; http://php.net/browscap ;browscap = extra/browscap.ini [Session] ; Handler used to store/retrieve data. ; http://php.net/session.save-handler session.save_handler = files ; Argument passed to save_handler. In the case of files, this is the path ; where data files are stored. Note: Windows users have to change this ; variable in order to use PHP's session functions. ; ; The path can be defined as: ; ; session.save_path = "N;/path" ; ; where N is an integer. Instead of storing all the session files in ; /path, what this will do is use subdirectories N-levels deep, and ; store the session data in those directories. This is useful if ; your OS has problems with many files in one directory, and is ; a more efficient layout for servers that handle many sessions. ; ; NOTE 1: PHP will not create this directory structure automatically. ; You can use the script in the ext/session dir for that purpose. ; NOTE 2: See the section on garbage collection below if you choose to ; use subdirectories for session storage ; ; The file storage module creates files using mode 600 by default. ; You can change that by using ; ; session.save_path = "N;MODE;/path" ; ; where MODE is the octal representation of the mode. Note that this ; does not overwrite the process's umask. ; http://php.net/session.save-path session.save_path = "/opt/tmp" ; Whether to use strict session mode. ; Strict session mode does not accept uninitialized session ID and regenerate ; session ID if browser sends uninitialized session ID. Strict mode protects ; applications from session fixation via session adoption vulnerability. It is ; disabled by default for maximum compatibility, but enabling it is encouraged. ; https://wiki.php.net/rfc/strict_sessions session.use_strict_mode = 0 ; Whether to use cookies. ; http://php.net/session.use-cookies session.use_cookies = 1 ; http://php.net/session.cookie-secure ;session.cookie_secure = ; This option forces PHP to fetch and use a cookie for storing and maintaining ; the session id. We encourage this operation as it's very helpful in combating ; session hijacking when not specifying and managing your own session id. It is ; not the be-all and end-all of session hijacking defense, but it's a good start. ; http://php.net/session.use-only-cookies session.use_only_cookies = 1 ; Name of the session (used as cookie name). ; http://php.net/session.name session.name = PHPSESSID ; Initialize session on request startup. ; http://php.net/session.auto-start session.auto_start = 0 ; Lifetime in seconds of cookie or, if 0, until browser is restarted. ; http://php.net/session.cookie-lifetime session.cookie_lifetime = 0 ; The path for which the cookie is valid. ; http://php.net/session.cookie-path session.cookie_path = / ; The domain for which the cookie is valid. ; http://php.net/session.cookie-domain session.cookie_domain = ; Whether or not to add the httpOnly flag to the cookie, which makes it inaccessible to browser scripting languages such as JavaScript. ; http://php.net/session.cookie-httponly session.cookie_httponly = 1 ; Handler used to serialize data. php is the standard serializer of PHP. ; http://php.net/session.serialize-handler session.serialize_handler = php ; Defines the probability that the 'garbage collection' process is started ; on every session initialization. The probability is calculated by using ; gc_probability/gc_divisor. Where session.gc_probability is the numerator ; and gc_divisor is the denominator in the equation. Setting this value to 1 ; when the session.gc_divisor value is 100 will give you approximately a 1% chance ; the gc will run on any give request. ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; http://php.net/session.gc-probability session.gc_probability = 1 ; Defines the probability that the 'garbage collection' process is started on every ; session initialization. The probability is calculated by using the following equation: ; gc_probability/gc_divisor. Where session.gc_probability is the numerator and ; session.gc_divisor is the denominator in the equation. Setting this value to 1 ; when the session.gc_divisor value is 100 will give you approximately a 1% chance ; the gc will run on any give request. Increasing this value to 1000 will give you ; a 0.1% chance the gc will run on any give request. For high volume production servers, ; this is a more efficient approach. ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; http://php.net/session.gc-divisor session.gc_divisor = 1000 ; After this number of seconds, stored data will be seen as 'garbage' and ; cleaned up by the garbage collection process. ; http://php.net/session.gc-maxlifetime session.gc_maxlifetime = 1440 ; NOTE: If you are using the subdirectory option for storing session files ; (see session.save_path above), then garbage collection does *not* ; happen automatically. You will need to do your own garbage ; collection through a shell script, cron entry, or some other method. ; For example, the following script would is the equivalent of ; setting session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes): ; find /path/to/sessions -cmin +24 -type f | xargs rm ; Check HTTP Referer to invalidate externally stored URLs containing ids. ; HTTP_REFERER has to contain this substring for the session to be ; considered as valid. ; http://php.net/session.referer-check session.referer_check = ; How many bytes to read from the file. ; http://php.net/session.entropy-length session.entropy_length = 32 ; Specified here to create the session id. ; http://php.net/session.entropy-file ; Defaults to /dev/urandom ; On systems that don't have /dev/urandom but do have /dev/arandom, this will default to /dev/arandom ; If neither are found at compile time, the default is no entropy file. ; On windows, setting the entropy_length setting will activate the ; Windows random source (using the CryptoAPI) session.entropy_file = /dev/urandom ; Set to {nocache,private,public,} to determine HTTP caching aspects ; or leave this empty to avoid sending anti-caching headers. ; http://php.net/session.cache-limiter session.cache_limiter = nocache ; Document expires after n minutes. ; http://php.net/session.cache-expire session.cache_expire = 180 ; trans sid support is disabled by default. ; Use of trans sid may risk your users' security. ; Use this option with caution. ; - User may send URL contains active session ID ; to other person via. email/irc/etc. ; - URL that contains active session ID may be stored ; in publicly accessible computer. ; - User may access your site with the same session ID ; always using URL stored in browser's history or bookmarks. ; http://php.net/session.use-trans-sid session.use_trans_sid = 0 ; Select a hash function for use in generating session ids. ; Possible Values ; 0 (MD5 128 bits) ; 1 (SHA-1 160 bits) ; This option may also be set to the name of any hash function supported by ; the hash extension. A list of available hashes is returned by the hash_algos() ; function. ; http://php.net/session.hash-function session.hash_function = 0 ; Define how many bits are stored in each character when converting ; the binary hash data to something readable. ; Possible values: ; 4 (4 bits: 0-9, a-f) ; 5 (5 bits: 0-9, a-v) ; 6 (6 bits: 0-9, a-z, A-Z, "-", ",") ; Default Value: 4 ; Development Value: 5 ; Production Value: 5 ; http://php.net/session.hash-bits-per-character session.hash_bits_per_character = 5 ; The URL rewriter will look for URLs in a defined set of HTML tags. ; form/fieldset are special; if you include them here, the rewriter will ; add a hidden field with the info which is otherwise appended ; to URLs. If you want XHTML conformity, remove the form entry. ; Note that all valid entries require a "=", even if no value follows. ; Default Value: "a=href,area=href,frame=src,form=,fieldset=" ; Development Value: "a=href,area=href,frame=src,input=src,form=fakeentry" ; Production Value: "a=href,area=href,frame=src,input=src,form=fakeentry" ; http://php.net/url-rewriter.tags url_rewriter.tags = "a=href,area=href,frame=src,input=src,form=fakeentry" ; Enable upload progress tracking in $_SESSION ; Default Value: On ; Development Value: On ; Production Value: On ; http://php.net/session.upload-progress.enabled ;session.upload_progress.enabled = On ; Cleanup the progress information as soon as all POST data has been read ; (i.e. upload completed). ; Default Value: On ; Development Value: On ; Production Value: On ; http://php.net/session.upload-progress.cleanup ;session.upload_progress.cleanup = On ; A prefix used for the upload progress key in $_SESSION ; Default Value: "upload_progress_" ; Development Value: "upload_progress_" ; Production Value: "upload_progress_" ; http://php.net/session.upload-progress.prefix ;session.upload_progress.prefix = "upload_progress_" ; The index name (concatenated with the prefix) in $_SESSION ; containing the upload progress information ; Default Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Development Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Production Value: "PHP_SESSION_UPLOAD_PROGRESS" ; http://php.net/session.upload-progress.name ;session.upload_progress.name = "PHP_SESSION_UPLOAD_PROGRESS" ; How frequently the upload progress should be updated. ; Given either in percentages (per-file), or in bytes ; Default Value: "1%" ; Development Value: "1%" ; Production Value: "1%" ; http://php.net/session.upload-progress.freq ;session.upload_progress.freq = "1%" ; The minimum delay between updates, in seconds ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; http://php.net/session.upload-progress.min-freq ;session.upload_progress.min_freq = "1" ; Only write session data when session data is changed. Enabled by default. ; http://php.net/session.lazy-write ;session.lazy_write = On [Assertion] ; Switch whether to compile assertions at all (to have no overhead at run-time) ; -1: Do not compile at all ; 0: Jump over assertion at run-time ; 1: Execute assertions ; Changing from or to a negative value is only possible in php.ini! (For turning assertions on and off at run-time, see assert.active, when zend.assertions = 1) ; Default Value: 1 ; Development Value: 1 ; Production Value: -1 ; http://php.net/zend.assertions zend.assertions = -1 ; Assert(expr); active by default. ; http://php.net/assert.active ;assert.active = On ; Throw an AssertationException on failed assertions ; http://php.net/assert.exception ;assert.exception = On ; Issue a PHP warning for each failed assertion. (Overridden by assert.exception if active) ; http://php.net/assert.warning ;assert.warning = On ; Don't bail out by default. ; http://php.net/assert.bail ;assert.bail = Off ; User-function to be called if an assertion fails. ; http://php.net/assert.callback ;assert.callback = 0 ; Eval the expression with current error_reporting(). Set to true if you want ; error_reporting(0) around the eval(). ; http://php.net/assert.quiet-eval ;assert.quiet_eval = 0 [COM] ; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs ; http://php.net/com.typelib-file ;com.typelib_file = ; allow Distributed-COM calls ; http://php.net/com.allow-dcom ;com.allow_dcom = true ; autoregister constants of a components typlib on com_load() ; http://php.net/com.autoregister-typelib ;com.autoregister_typelib = true ; register constants casesensitive ; http://php.net/com.autoregister-casesensitive ;com.autoregister_casesensitive = false ; show warnings on duplicate constant registrations ; http://php.net/com.autoregister-verbose ;com.autoregister_verbose = true ; The default character set code-page to use when passing strings to and from COM objects. ; Default: system ANSI code page ;com.code_page= [mbstring] ; language for internal character representation. ; This affects mb_send_mail() and mbstring.detect_order. ; http://php.net/mbstring.language ;mbstring.language = Japanese ; Use of this INI entry is deprecated, use global internal_encoding instead. ; internal/script encoding. ; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*) ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;mbstring.internal_encoding = ; Use of this INI entry is deprecated, use global input_encoding instead. ; http input encoding. ; mbstring.encoding_traslation = On is needed to use this setting. ; If empty, default_charset or input_encoding or mbstring.input is used. ; The precedence is: default_charset < intput_encoding < mbsting.http_input ; http://php.net/mbstring.http-input ;mbstring.http_input = ; Use of this INI entry is deprecated, use global output_encoding instead. ; http output encoding. ; mb_output_handler must be registered as output buffer to function. ; If empty, default_charset or output_encoding or mbstring.http_output is used. ; The precedence is: default_charset < output_encoding < mbstring.http_output ; To use an output encoding conversion, mbstring's output handler must be set ; otherwise output encoding conversion cannot be performed. ; http://php.net/mbstring.http-output ;mbstring.http_output = ; enable automatic encoding translation according to ; mbstring.internal_encoding setting. Input chars are ; converted to internal encoding by setting this to On. ; Note: Do _not_ use automatic encoding translation for ; portable libs/applications. ; http://php.net/mbstring.encoding-translation ;mbstring.encoding_translation = Off ; automatic encoding detection order. ; "auto" detect order is changed according to mbstring.language ; http://php.net/mbstring.detect-order ;mbstring.detect_order = auto ; substitute_character used when character cannot be converted ; one from another ; http://php.net/mbstring.substitute-character ;mbstring.substitute_character = none ; overload(replace) single byte functions by mbstring functions. ; mail(), ereg(), etc are overloaded by mb_send_mail(), mb_ereg(), ; etc. Possible values are 0,1,2,4 or combination of them. ; For example, 7 for overload everything. ; 0: No overload ; 1: Overload mail() function ; 2: Overload str*() functions ; 4: Overload ereg*() functions ; http://php.net/mbstring.func-overload ;mbstring.func_overload = 0 ; enable strict encoding detection. ; Default: Off ;mbstring.strict_detection = On ; This directive specifies the regex pattern of content types for which mb_output_handler() ; is activated. ; Default: mbstring.http_output_conv_mimetype=^(text/|application/xhtml\+xml) ;mbstring.http_output_conv_mimetype= [gd] ; Tell the jpeg decode to ignore warnings and try to create ; a gd image. The warning will then be displayed as notices ; disabled by default ; http://php.net/gd.jpeg-ignore-warning ;gd.jpeg_ignore_warning = 0 [exif] ; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS. ; With mbstring support this will automatically be converted into the encoding ; given by corresponding encode setting. When empty mbstring.internal_encoding ; is used. For the decode settings you can distinguish between motorola and ; intel byte order. A decode setting cannot be empty. ; http://php.net/exif.encode-unicode ;exif.encode_unicode = ISO-8859-15 ; http://php.net/exif.decode-unicode-motorola ;exif.decode_unicode_motorola = UCS-2BE ; http://php.net/exif.decode-unicode-intel ;exif.decode_unicode_intel = UCS-2LE ; http://php.net/exif.encode-jis ;exif.encode_jis = ; http://php.net/exif.decode-jis-motorola ;exif.decode_jis_motorola = JIS ; http://php.net/exif.decode-jis-intel ;exif.decode_jis_intel = JIS [Tidy] ; The path to a default tidy configuration file to use when using tidy ; http://php.net/tidy.default-config ;tidy.default_config = /usr/local/lib/php/default.tcfg ; Should tidy clean and repair output automatically? ; WARNING: Do not use this option if you are generating non-html content ; such as dynamic images ; http://php.net/tidy.clean-output tidy.clean_output = Off [soap] ; Enables or disables WSDL caching feature. ; http://php.net/soap.wsdl-cache-enabled soap.wsdl_cache_enabled=1 ; Sets the directory name where SOAP extension will put cache files. ; http://php.net/soap.wsdl-cache-dir soap.wsdl_cache_dir="/tmp" ; (time to live) Sets the number of second while cached file will be used ; instead of original one. ; http://php.net/soap.wsdl-cache-ttl soap.wsdl_cache_ttl=86400 ; Sets the size of the cache limit. (Max. number of WSDL files to cache) soap.wsdl_cache_limit = 5 [sysvshm] ; A default size of the shared memory segment ;sysvshm.init_mem = 10000 [ldap] ; Sets the maximum number of open links or -1 for unlimited. ldap.max_links = -1 [mcrypt] ; For more information about mcrypt settings see http://php.net/mcrypt-module-open ; Directory where to load mcrypt algorithms ; Default: Compiled in into libmcrypt (usually /usr/local/lib/libmcrypt) ;mcrypt.algorithms_dir= ; Directory where to load mcrypt modes ; Default: Compiled in into libmcrypt (usually /usr/local/lib/libmcrypt) ;mcrypt.modes_dir= [dba] ;dba.default_handler= [opcache] ; Determines if Zend OPCache is enabled ;opcache.enable=0 ; Determines if Zend OPCache is enabled for the CLI version of PHP ;opcache.enable_cli=0 ; The OPcache shared memory storage size. ;opcache.memory_consumption=64 ; The amount of memory for interned strings in Mbytes. ;opcache.interned_strings_buffer=4 ; The maximum number of keys (scripts) in the OPcache hash table. ; Only numbers between 200 and 100000 are allowed. ;opcache.max_accelerated_files=2000 ; The maximum percentage of "wasted" memory until a restart is scheduled. ;opcache.max_wasted_percentage=5 ; When this directive is enabled, the OPcache appends the current working ; directory to the script key, thus eliminating possible collisions between ; files with the same name (basename). Disabling the directive improves ; performance, but may break existing applications. ;opcache.use_cwd=1 ; When disabled, you must reset the OPcache manually or restart the ; webserver for changes to the filesystem to take effect. ;opcache.validate_timestamps=1 ; How often (in seconds) to check file timestamps for changes to the shared ; memory storage allocation. ("1" means validate once per second, but only ; once per request. "0" means always validate) ;opcache.revalidate_freq=2 ; Enables or disables file search in include_path optimization ;opcache.revalidate_path=0 ; If disabled, all PHPDoc comments are dropped from the code to reduce the ; size of the optimized code. ;opcache.save_comments=1 ; If enabled, a fast shutdown sequence is used for the accelerated code ;opcache.fast_shutdown=0 ; Allow file existence override (file_exists, etc.) performance feature. ;opcache.enable_file_override=0 ; A bitmask, where each bit enables or disables the appropriate OPcache ; passes ;opcache.optimization_level=0xffffffff ;opcache.inherited_hack=1 ;opcache.dups_fix=0 ; The location of the OPcache blacklist file (wildcards allowed). ; Each OPcache blacklist file is a text file that holds the names of files ; that should not be accelerated. The file format is to add each filename ; to a new line. The filename may be a full path or just a file prefix ; (i.e., /var/www/x blacklists all the files and directories in /var/www ; that start with 'x'). Line starting with a ; are ignored (comments). ;opcache.blacklist_filename= ; Allows exclusion of large files from being cached. By default all files ; are cached. ;opcache.max_file_size=0 ; Check the cache checksum each N requests. ; The default value of "0" means that the checks are disabled. ;opcache.consistency_checks=0 ; How long to wait (in seconds) for a scheduled restart to begin if the cache ; is not being accessed. ;opcache.force_restart_timeout=180 ; OPcache error_log file name. Empty string assumes "stderr". ;opcache.error_log= ; All OPcache errors go to the Web server log. ; By default, only fatal errors (level 0) or errors (level 1) are logged. ; You can also enable warnings (level 2), info messages (level 3) or ; debug messages (level 4). ;opcache.log_verbosity_level=1 ; Preferred Shared Memory back-end. Leave empty and let the system decide. ;opcache.preferred_memory_model= ; Protect the shared memory from unexpected writing during script execution. ; Useful for internal debugging only. ;opcache.protect_memory=0 ; Allows calling OPcache API functions only from PHP scripts which path is ; started from specified string. The default "" means no restriction ;opcache.restrict_api= ; Mapping base of shared memory segments (for Windows only). All the PHP ; processes have to map shared memory into the same address space. This ; directive allows to manually fix the "Unable to reattach to base address" ; errors. ;opcache.mmap_base= ; Enables and sets the second level cache directory. ; It should improve performance when SHM memory is full, at server restart or ; SHM reset. The default "" disables file based caching. ;opcache.file_cache= ; Enables or disables opcode caching in shared memory. ;opcache.file_cache_only=0 ; Enables or disables checksum validation when script loaded from file cache. ;opcache.file_cache_consistency_checks=1 ; Enables or disables copying of PHP code (text segment) into HUGE PAGES. ; This should improve performance, but requires appropriate OS configuration. ;opcache.huge_code_pages=0 [curl] ; A default value for the CURLOPT_CAINFO option. This is required to be an ; absolute path. ;curl.cainfo = [openssl] ; The location of a Certificate Authority (CA) file on the local filesystem ; to use when verifying the identity of SSL/TLS peers. Most users should ; not specify a value for this directive as PHP will attempt to use the ; OS-managed cert stores in its absence. If specified, this value may still ; be overridden on a per-stream basis via the "cafile" SSL stream context ; option. ;openssl.cafile= ; If openssl.cafile is not specified or if the CA file is not found, the ; directory pointed to by openssl.capath is searched for a suitable ; certificate. This value must be a correctly hashed certificate directory. ; Most users should not specify a value for this directive as PHP will ; attempt to use the OS-managed cert stores in its absence. If specified, ; this value may still be overridden on a per-stream basis via the "capath" ; SSL stream context option. ;openssl.capath= ; Local Variables: ; tab-width: 4 ; End: [Zend] zend_extension="/usr/local/ioncube/ioncube_loader_lin_7.0.so" ; fix for segfaults auto_globals_jit = Off cgi.fix_pathinfo = 1 mbstring.http_input = "pass" mbstring.http_output = "pass" mbstring.encoding_translation = 0 ; Enable Extensions extension=uploadprogress.so extension=imagick.so extension=jsmin.so extension=redis.so ================================================ FILE: aegir/conf/php/php70-fpm ================================================ #!/bin/bash ### BEGIN INIT INFO # Provides: php70-fpm # Required-Start: $remote_fs $network # Required-Stop: $remote_fs $network # Default-Start: 2 3 4 5 # Default-Stop: 0 1 6 # Short-Description: starts php70-fpm # Description: starts the PHP FastCGI Process Manager daemon ### END INIT INFO prefix=/opt/php70 exec_prefix=${prefix} php_fpm_BIN=/opt/php70/sbin/php-fpm php_fpm_CONF=/opt/php70/etc/php70-fpm.conf php_fpm_PID=/run/php70-fpm.pid php_opts="--fpm-config $php_fpm_CONF --pid $php_fpm_PID -c /opt/php70/etc/php70.ini" wait_for_pid() { try=0 while test $try -lt 5; do case "$1" in 'created') if [ -f "$2" ]; then try='' break fi ;; 'removed') if [ ! -f "$2" ]; then try='' break fi ;; esac echo -n . try=`expr $try + 1` sleep 1 done } case "$1" in start) echo -n "Starting php70-fpm..." $php_fpm_BIN --daemonize $php_opts if [ "$?" != 0 ]; then echo " failed" exit 1 fi wait_for_pid created $php_fpm_PID if [ -n "$try" ]; then echo " failed" exit 1 else echo " done" fi ;; stop) echo -n "Gracefully shutting down php70-fpm..." if [ ! -r $php_fpm_PID ]; then echo "warning, no pid file found - php70-fpm is not running ?" exit 1 fi kill -QUIT `cat $php_fpm_PID` wait_for_pid removed $php_fpm_PID if [ -n "$try" ]; then echo " failed. Use force-quit" exit 1 else echo " done" fi ;; status) if [ ! -r $php_fpm_PID ]; then echo "php70-fpm is stopped" exit 0 fi PID=`cat $php_fpm_PID` if ps -p $PID | grep -q $PID; then echo "php70-fpm (pid $PID) is running..." else echo "php70-fpm dead but pid file exists" fi ;; force-quit) echo -n "Terminating php70-fpm..." if [ ! -r $php_fpm_PID ]; then echo "warning, no pid file found - php70-fpm is not running ?" exit 1 fi kill -TERM `cat $php_fpm_PID` wait_for_pid removed $php_fpm_PID if [ -n "$try" ]; then echo " failed" exit 1 else echo " done" fi ;; restart) $0 stop $0 start ;; reload) echo -n "Reloading service php70-fpm..." if [ ! -r $php_fpm_PID ]; then echo "warning, no pid file found - php70-fpm is not running ?" exit 1 fi kill -USR2 `cat $php_fpm_PID` echo " done" ;; configtest) $php_fpm_BIN -t ;; *) echo "Usage: $0 {start|stop|force-quit|restart|reload|status|configtest}" exit 1 ;; esac ================================================ FILE: aegir/conf/php/php70-fpm.conf ================================================ ;;;;;;;;;;;;;;;;;;;;; ; FPM Configuration ; ;;;;;;;;;;;;;;;;;;;;; ; All relative paths in this configuration file are relative to PHP's install ; prefix (/opt/php70). This prefix can be dynamically changed by using the ; '-p' argument from the command line. ; Include one or more files. If glob(3) exists, it is used to include a bunch of ; files from a glob(3) pattern. This directive can be used everywhere in the ; file. ; Relative path can also be used. They will be prefixed by: ; - the global prefix if it's been set (-p argument) ; - /opt/php70 otherwise ;include=etc/fpm.d/*.conf ;;;;;;;;;;;;;;;;;; ; Global Options ; ;;;;;;;;;;;;;;;;;; [global] ; Pid file ; Note: the default prefix is /opt/php70/var ; Default Value: none pid = /run/php70-fpm.pid ; Error log file ; If it's set to "syslog", log is sent to syslogd instead of being written ; in a local file. ; Note: the default prefix is /opt/php70/var ; Default Value: log/php-fpm.log error_log = /var/log/php/php70-fpm-error.log ; syslog_facility is used to specify what type of program is logging the ; message. This lets syslogd specify that messages from different facilities ; will be handled differently. ; See syslog(3) for possible values (ex daemon equiv LOG_DAEMON) ; Default Value: daemon syslog.facility = daemon ; syslog_ident is prepended to every message. If you have multiple FPM ; instances running on the same server, you can change the default value ; which must suit common needs. ; Default Value: php-fpm syslog.ident = php70-fpm ; Log level ; Possible Values: alert, error, warning, notice, debug ; Default Value: notice log_level = warning ; If this number of child processes exit with SIGSEGV or SIGBUS within the time ; interval set by emergency_restart_interval then FPM will restart. A value ; of '0' means 'Off'. ; Default Value: 0 emergency_restart_threshold = 5 ; Interval of time used by emergency_restart_interval to determine when ; a graceful restart will be initiated. This can be useful to work around ; accidental corruptions in an accelerator's shared memory. ; Available Units: s(econds), m(inutes), h(ours), or d(ays) ; Default Unit: seconds ; Default Value: 0 emergency_restart_interval = 1m ; Time limit for child processes to wait for a reaction on signals from master. ; Available units: s(econds), m(inutes), h(ours), or d(ays) ; Default Unit: seconds ; Default Value: 0 process_control_timeout = 5s ; The maximum number of processes FPM will fork. This has been design to control ; the global number of processes when using dynamic PM within a lot of pools. ; Use it with caution. ; Note: A value of 0 indicates no limit ; Default Value: 0 process.max = 0 ; Specify the nice(2) priority to apply to the master process (only if set) ; The value can vary from -19 (highest priority) to 20 (lower priority) ; Note: - It will only work if the FPM master process is launched as root ; - The pool process will inherit the master process priority ; unless it specified otherwise ; Default Value: no set ; process.priority = -19 ; Send FPM to background. Set to 'no' to keep FPM in foreground for debugging. ; Default Value: yes daemonize = yes ; Set open file descriptor rlimit for the master process. ; Default Value: system defined value ;rlimit_files = 1024 ; Set max core size rlimit for the master process. ; Possible Values: 'unlimited' or an integer greater or equal to 0 ; Default Value: system defined value ;rlimit_core = 0 ; Specify the event mechanism FPM will use. The following is available: ; - select (any POSIX os) ; - poll (any POSIX os) ; - epoll (linux >= 2.5.44) ; - kqueue (FreeBSD >= 4.1, OpenBSD >= 2.9, NetBSD >= 2.0) ; - /dev/poll (Solaris >= 7) ; - port (Solaris >= 10) ; Default Value: not set (auto detection) ;events.mechanism = epoll ;;;;;;;;;;;;;;;;;;;; ; Pool Definitions ; ;;;;;;;;;;;;;;;;;;;; ; Multiple pools of child processes may be started with different listening ; ports and different management options. The name of the pool will be ; used in logs and stats. There is no limitation on the number of pools which ; FPM can handle. Your system will tell you anyway :) include = /opt/php70/etc/pool.d/*.conf ================================================ FILE: aegir/conf/php/php70.ini ================================================ [PHP] ;;;;;;;;;;;;;;;;;;; ; About php.ini ; ;;;;;;;;;;;;;;;;;;; ; PHP's initialization file, generally called php.ini, is responsible for ; configuring many of the aspects of PHP's behavior. ; PHP attempts to find and load this configuration from a number of locations. ; The following is a summary of its search order: ; 1. SAPI module specific location. ; 2. The PHPRC environment variable. (As of PHP 5.2.0) ; 3. A number of predefined registry keys on Windows (As of PHP 5.2.0) ; 4. Current working directory (except CLI) ; 5. The web server's directory (for SAPI modules), or directory of PHP ; (otherwise in Windows) ; 6. The directory from the --with-config-file-path compile time option, or the ; Windows directory (C:\windows or C:\winnt) ; See the PHP docs for more specific information. ; http://php.net/configuration.file ; The syntax of the file is extremely simple. Whitespace and lines ; beginning with a semicolon are silently ignored (as you probably guessed). ; Section headers (e.g. [Foo]) are also silently ignored, even though ; they might mean something in the future. ; Directives following the section heading [PATH=/www/mysite] only ; apply to PHP files in the /www/mysite directory. Directives ; following the section heading [HOST=www.example.com] only apply to ; PHP files served from www.example.com. Directives set in these ; special sections cannot be overridden by user-defined INI files or ; at runtime. Currently, [PATH=] and [HOST=] sections only work under ; CGI/FastCGI. ; http://php.net/ini.sections ; Directives are specified using the following syntax: ; directive = value ; Directive names are *case sensitive* - foo=bar is different from FOO=bar. ; Directives are variables used to configure PHP or PHP extensions. ; There is no name validation. If PHP can't find an expected ; directive because it is not set or is mistyped, a default value will be used. ; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one ; of the INI constants (On, Off, True, False, Yes, No and None) or an expression ; (e.g. E_ALL & ~E_NOTICE), a quoted string ("bar"), or a reference to a ; previously set variable or directive (e.g. ${foo}) ; Expressions in the INI file are limited to bitwise operators and parentheses: ; | bitwise OR ; ^ bitwise XOR ; & bitwise AND ; ~ bitwise NOT ; ! boolean NOT ; Boolean flags can be turned on using the values 1, On, True or Yes. ; They can be turned off using the values 0, Off, False or No. ; An empty string can be denoted by simply not writing anything after the equal ; sign, or by using the None keyword: ; foo = ; sets foo to an empty string ; foo = None ; sets foo to an empty string ; foo = "None" ; sets foo to the string 'None' ; If you use constants in your value, and these constants belong to a ; dynamically loaded extension (either a PHP extension or a Zend extension), ; you may only use these constants *after* the line that loads the extension. ;;;;;;;;;;;;;;;;;;; ; About this file ; ;;;;;;;;;;;;;;;;;;; ; PHP comes packaged with two INI files. One that is recommended to be used ; in production environments and one that is recommended to be used in ; development environments. ; php.ini-production contains settings which hold security, performance and ; best practices at its core. But please be aware, these settings may break ; compatibility with older or less security conscience applications. We ; recommending using the production ini in production and testing environments. ; php.ini-development is very similar to its production variant, except it is ; much more verbose when it comes to errors. We recommend using the ; development version only in development environments, as errors shown to ; application users can inadvertently leak otherwise secure information. ; This is php.ini-production INI file. ;;;;;;;;;;;;;;;;;;; ; Quick Reference ; ;;;;;;;;;;;;;;;;;;; ; The following are all the settings which are different in either the production ; or development versions of the INIs with respect to PHP's default behavior. ; Please see the actual settings later in the document for more details as to why ; we recommend these changes in PHP's behavior. display_errors = Off ; Default Value: On ; Development Value: On ; Production Value: Off ; display_startup_errors ; Default Value: Off ; Development Value: On ; Production Value: Off ; error_reporting ; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; html_errors ; Default Value: On ; Development Value: On ; Production value: On ; log_errors ; Default Value: Off ; Development Value: On ; Production Value: On ; max_input_time ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; output_buffering ; Default Value: Off ; Development Value: 4096 ; Production Value: 4096 ; register_argc_argv ; Default Value: On ; Development Value: Off ; Production Value: Off ; request_order ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; session.gc_divisor ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; session.hash_bits_per_character ; Default Value: 4 ; Development Value: 5 ; Production Value: 5 ; short_open_tag ; Default Value: On ; Development Value: Off ; Production Value: Off ; track_errors ; Default Value: Off ; Development Value: On ; Production Value: Off ; url_rewriter.tags ; Default Value: "a=href,area=href,frame=src,form=,fieldset=" ; Development Value: "a=href,area=href,frame=src,input=src,form=fakeentry" ; Production Value: "a=href,area=href,frame=src,input=src,form=fakeentry" ; variables_order ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS" ;;;;;;;;;;;;;;;;;;;; ; php.ini Options ; ;;;;;;;;;;;;;;;;;;;; ; Name for user-defined php.ini (.htaccess) files. Default is ".user.ini" ;user_ini.filename = ".user.ini" ; To disable this feature set this option to empty value user_ini.filename = ; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes) ;user_ini.cache_ttl = 300 ;;;;;;;;;;;;;;;;;;;; ; Language Options ; ;;;;;;;;;;;;;;;;;;;; ; Enable the PHP scripting language engine under Apache. ; http://php.net/engine engine = On ; This directive determines whether or not PHP will recognize code between ; tags as PHP source which should be processed as such. It is ; generally recommended that should be used and that this feature ; should be disabled, as enabling it may result in issues when generating XML ; documents, however this remains supported for backward compatibility reasons. ; Note that this directive does not control the would work. ; http://php.net/syntax-highlighting ;highlight.string = #DD0000 ;highlight.comment = #FF9900 ;highlight.keyword = #007700 ;highlight.default = #0000BB ;highlight.html = #000000 ; If enabled, the request will be allowed to complete even if the user aborts ; the request. Consider enabling it if executing long requests, which may end up ; being interrupted by the user or a browser timing out. PHP's default behavior ; is to disable this feature. ; http://php.net/ignore-user-abort ;ignore_user_abort = On ; Determines the size of the realpath cache to be used by PHP. This value should ; be increased on systems where PHP opens many files to reflect the quantity of ; the file operations performed. ; http://php.net/realpath-cache-size realpath_cache_size=64M ; Duration of time, in seconds for which to cache realpath information for a given ; file or directory. For systems with rarely changing files, consider increasing this ; value. ; http://php.net/realpath-cache-ttl realpath_cache_ttl=180 ; Enables or disables the circular reference collector. ; http://php.net/zend.enable-gc zend.enable_gc = On ; If enabled, scripts may be written in encodings that are incompatible with ; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such ; encodings. To use this feature, mbstring extension must be enabled. ; Default: Off ;zend.multibyte = Off ; Allows to set the default encoding for the scripts. This value will be used ; unless "declare(encoding=...)" directive appears at the top of the script. ; Only affects if zend.multibyte is set. ; Default: "" ;zend.script_encoding = ;;;;;;;;;;;;;;;;; ; Miscellaneous ; ;;;;;;;;;;;;;;;;; ; Decides whether PHP may expose the fact that it is installed on the server ; (e.g. by adding its signature to the Web server header). It is no security ; threat in any way, but it makes it possible to determine whether you use PHP ; on your server or not. ; http://php.net/expose-php expose_php = On ;;;;;;;;;;;;;;;;;;; ; Resource Limits ; ;;;;;;;;;;;;;;;;;;; ; Maximum execution time of each script, in seconds ; http://php.net/max-execution-time ; Note: This directive is hardcoded to 0 for the CLI SAPI max_execution_time = 180 ; Maximum amount of time each script may spend parsing request data. It's a good ; idea to limit this time on productions servers in order to eliminate unexpectedly ; long running scripts. ; Note: This directive is hardcoded to -1 for the CLI SAPI ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; http://php.net/max-input-time max_input_time = 180 ; Maximum input variable nesting level ; http://php.net/max-input-nesting-level ;max_input_nesting_level = 64 ; How many GET/POST/COOKIE input variables may be accepted max_input_vars = 9999 ; Maximum amount of memory a script may consume (128MB) ; http://php.net/memory-limit memory_limit = 395M ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; Error handling and logging ; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; This directive informs PHP of which errors, warnings and notices you would like ; it to take action for. The recommended way of setting values for this ; directive is through the use of the error level constants and bitwise ; operators. The error level constants are below here for convenience as well as ; some common settings and their meanings. ; By default, PHP is set to take action on all errors, notices and warnings EXCEPT ; those related to E_NOTICE and E_STRICT, which together cover best practices and ; recommended coding standards in PHP. For performance reasons, this is the ; recommend error reporting setting. Your production server shouldn't be wasting ; resources complaining about best practices and coding standards. That's what ; development servers and development settings are for. ; Note: The php.ini-development file has this setting as E_ALL. This ; means it pretty much reports everything which is exactly what you want during ; development and early testing. ; ; Error Level Constants: ; E_ALL - All errors and warnings (includes E_STRICT as of PHP 5.4.0) ; E_ERROR - fatal run-time errors ; E_RECOVERABLE_ERROR - almost fatal run-time errors ; E_WARNING - run-time warnings (non-fatal errors) ; E_PARSE - compile-time parse errors ; E_NOTICE - run-time notices (these are warnings which often result ; from a bug in your code, but it's possible that it was ; intentional (e.g., using an uninitialized variable and ; relying on the fact it is automatically initialized to an ; empty string) ; E_STRICT - run-time notices, enable to have PHP suggest changes ; to your code which will ensure the best interoperability ; and forward compatibility of your code ; E_CORE_ERROR - fatal errors that occur during PHP's initial startup ; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's ; initial startup ; E_COMPILE_ERROR - fatal compile-time errors ; E_COMPILE_WARNING - compile-time warnings (non-fatal errors) ; E_USER_ERROR - user-generated error message ; E_USER_WARNING - user-generated warning message ; E_USER_NOTICE - user-generated notice message ; E_DEPRECATED - warn about code that will not work in future versions ; of PHP ; E_USER_DEPRECATED - user-generated deprecation warnings ; ; Common Values: ; E_ALL (Show all errors, warnings and notices including coding standards.) ; E_ALL & ~E_NOTICE (Show all errors, except for notices) ; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.) ; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors) ; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; http://php.net/error-reporting error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT ; This directive controls whether or not and where PHP will output errors, ; notices and warnings too. Error output is very useful during development, but ; it could be very dangerous in production environments. Depending on the code ; which is triggering the error, sensitive information could potentially leak ; out of your application such as database usernames and passwords or worse. ; For production environments, we recommend logging errors rather than ; sending them to STDOUT. ; Possible Values: ; Off = Do not display any errors ; stderr = Display errors to STDERR (affects only CGI/CLI binaries!) ; On or stdout = Display errors to STDOUT ; Default Value: On ; Development Value: On ; Production Value: Off ; http://php.net/display-errors display_errors = Off ; The display of errors which occur during PHP's startup sequence are handled ; separately from display_errors. PHP's default behavior is to suppress those ; errors from clients. Turning the display of startup errors on can be useful in ; debugging configuration problems. We strongly recommend you ; set this to 'off' for production servers. ; Default Value: Off ; Development Value: On ; Production Value: Off ; http://php.net/display-startup-errors display_startup_errors = Off ; Besides displaying errors, PHP can also log errors to locations such as a ; server-specific log, STDERR, or a location specified by the error_log ; directive found below. While errors should not be displayed on productions ; servers they should still be monitored and logging is a great way to do that. ; Default Value: Off ; Development Value: On ; Production Value: On ; http://php.net/log-errors log_errors = On ; Set maximum length of log_errors. In error_log information about the source is ; added. The default is 1024 and 0 allows to not apply any maximum length at all. ; http://php.net/log-errors-max-len log_errors_max_len = 1024 ; Do not log repeated messages. Repeated errors must occur in same file on same ; line unless ignore_repeated_source is set true. ; http://php.net/ignore-repeated-errors ignore_repeated_errors = Off ; Ignore source of message when ignoring repeated messages. When this setting ; is On you will not log errors with repeated messages from different files or ; source lines. ; http://php.net/ignore-repeated-source ignore_repeated_source = Off ; If this parameter is set to Off, then memory leaks will not be shown (on ; stdout or in the log). This has only effect in a debug compile, and if ; error reporting includes E_WARNING in the allowed list ; http://php.net/report-memleaks report_memleaks = On ; This setting is on by default. ;report_zend_debug = 0 ; Store the last error/warning message in $php_errormsg (boolean). Setting this value ; to On can assist in debugging and is appropriate for development servers. It should ; however be disabled on production servers. ; Default Value: Off ; Development Value: On ; Production Value: Off ; http://php.net/track-errors track_errors = Off ; Turn off normal error reporting and emit XML-RPC error XML ; http://php.net/xmlrpc-errors ;xmlrpc_errors = 0 ; An XML-RPC faultCode ;xmlrpc_error_number = 0 ; When PHP displays or logs an error, it has the capability of formatting the ; error message as HTML for easier reading. This directive controls whether ; the error message is formatted as HTML or not. ; Note: This directive is hardcoded to Off for the CLI SAPI ; Default Value: On ; Development Value: On ; Production value: On ; http://php.net/html-errors html_errors = Off ; If html_errors is set to On *and* docref_root is not empty, then PHP ; produces clickable error messages that direct to a page describing the error ; or function causing the error in detail. ; You can download a copy of the PHP manual from http://php.net/docs ; and change docref_root to the base URL of your local copy including the ; leading '/'. You must also specify the file extension being used including ; the dot. PHP's default behavior is to leave these settings empty, in which ; case no links to documentation are generated. ; Note: Never use this feature for production boxes. ; http://php.net/docref-root ; Examples ;docref_root = "/phpmanual/" ; http://php.net/docref-ext ;docref_ext = .html ; String to output before an error message. PHP's default behavior is to leave ; this setting blank. ; http://php.net/error-prepend-string ; Example: ;error_prepend_string = "" ; String to output after an error message. PHP's default behavior is to leave ; this setting blank. ; http://php.net/error-append-string ; Example: ;error_append_string = "" ; Log errors to specified file. PHP's default behavior is to leave this value ; empty. ; http://php.net/error-log ; Example: ;error_log = php_errors.log ; Log errors to syslog (Event Log on Windows). ;error_log = syslog error_log = /var/log/php/error_log_70 ;windows.show_crt_warning ; Default value: 0 ; Development value: 0 ; Production value: 0 ;;;;;;;;;;;;;;;;; ; Data Handling ; ;;;;;;;;;;;;;;;;; ; The separator used in PHP generated URLs to separate arguments. ; PHP's default setting is "&". ; http://php.net/arg-separator.output ; Example: ;arg_separator.output = "&" ; List of separator(s) used by PHP to parse input URLs into variables. ; PHP's default setting is "&". ; NOTE: Every character in this directive is considered as separator! ; http://php.net/arg-separator.input ; Example: ;arg_separator.input = ";&" ; This directive determines which super global arrays are registered when PHP ; starts up. G,P,C,E & S are abbreviations for the following respective super ; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty ; paid for the registration of these arrays and because ENV is not as commonly ; used as the others, ENV is not recommended on productions servers. You ; can still get access to the environment variables through getenv() should you ; need to. ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS"; ; http://php.net/variables-order variables_order = "GPCS" ; This directive determines which super global data (G,P & C) should be ; registered into the super global array REQUEST. If so, it also determines ; the order in which that data is registered. The values for this directive ; are specified in the same manner as the variables_order directive, ; EXCEPT one. Leaving this value empty will cause PHP to use the value set ; in the variables_order directive. It does not mean it will leave the super ; globals array REQUEST empty. ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; http://php.net/request-order request_order = "GP" ; This directive determines whether PHP registers $argv & $argc each time it ; runs. $argv contains an array of all the arguments passed to PHP when a script ; is invoked. $argc contains an integer representing the number of arguments ; that were passed when the script was invoked. These arrays are extremely ; useful when running scripts from the command line. When this directive is ; enabled, registering these variables consumes CPU cycles and memory each time ; a script is executed. For performance reasons, this feature should be disabled ; on production servers. ; Note: This directive is hardcoded to On for the CLI SAPI ; Default Value: On ; Development Value: Off ; Production Value: Off ; http://php.net/register-argc-argv register_argc_argv = Off ; When enabled, the ENV, REQUEST and SERVER variables are created when they're ; first used (Just In Time) instead of when the script starts. If these ; variables are not used within a script, having this directive on will result ; in a performance gain. The PHP directive register_argc_argv must be disabled ; for this directive to have any affect. ; http://php.net/auto-globals-jit auto_globals_jit = On ; Whether PHP will read the POST data. ; This option is enabled by default. ; Most likely, you won't want to disable this option globally. It causes $_POST ; and $_FILES to always be empty; the only way you will be able to read the ; POST data will be through the php://input stream wrapper. This can be useful ; to proxy requests or to process the POST data in a memory efficient fashion. ; http://php.net/enable-post-data-reading ;enable_post_data_reading = Off ; Maximum size of POST data that PHP will accept. ; Its value may be 0 to disable the limit. It is ignored if POST data reading ; is disabled through enable_post_data_reading. ; http://php.net/post-max-size post_max_size = 350M ; Automatically add files before PHP document. ; http://php.net/auto-prepend-file auto_prepend_file = ; Automatically add files after PHP document. ; http://php.net/auto-append-file auto_append_file = ; By default, PHP will output a media type using the Content-Type header. To ; disable this, simply set it to be empty. ; ; PHP's built-in default media type is set to text/html. ; http://php.net/default-mimetype default_mimetype = "text/html" ; PHP's default character set is set to UTF-8. ; http://php.net/default-charset default_charset = "UTF-8" ; PHP internal character encoding is set to empty. ; If empty, default_charset is used. ; http://php.net/internal-encoding ;internal_encoding = ; PHP input character encoding is set to empty. ; If empty, default_charset is used. ; http://php.net/input-encoding ;input_encoding = ; PHP output character encoding is set to empty. ; If empty, default_charset is used. ; mbstring or iconv output handler is used. ; See also output_buffer. ; http://php.net/output-encoding ;output_encoding = ;;;;;;;;;;;;;;;;;;;;;;;;; ; Paths and Directories ; ;;;;;;;;;;;;;;;;;;;;;;;;; ; UNIX: "/path1:/path2" ;include_path = ".:/php/includes" ; ; Windows: "\path1;\path2" ;include_path = ".;c:\php\includes" ; ; PHP's default setting for include_path is ".;/path/to/php/pear" ; http://php.net/include-path include_path = ".:/opt/php70/lib/php" ; The root of the PHP pages, used only if nonempty. ; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root ; if you are running php as a CGI under any web server (other than IIS) ; see documentation for security issues. The alternate is to use the ; cgi.force_redirect configuration below ; http://php.net/doc-root doc_root = ; The directory under which PHP opens the script using /~username used only ; if nonempty. ; http://php.net/user-dir user_dir = ; Directory in which the loadable extensions (modules) reside. ; http://php.net/extension-dir ; extension_dir = "./" ; On windows: ; extension_dir = "ext" extension_dir = "/opt/php70/lib/php/extensions/no-debug-non-zts-20151012/" ; Directory where the temporary files should be placed. ; Defaults to the system default (see sys_get_temp_dir) sys_temp_dir = "/tmp" ; Whether or not to enable the dl() function. The dl() function does NOT work ; properly in multithreaded servers, such as IIS or Zeus, and is automatically ; disabled on them. ; http://php.net/enable-dl enable_dl = Off ; cgi.force_redirect is necessary to provide security running PHP as a CGI under ; most web servers. Left undefined, PHP turns this on by default. You can ; turn it off here AT YOUR OWN RISK ; **You CAN safely turn this off for IIS, in fact, you MUST.** ; http://php.net/cgi.force-redirect ;cgi.force_redirect = 1 ; if cgi.nph is enabled it will force cgi to always sent Status: 200 with ; every request. PHP's default behavior is to disable this feature. ;cgi.nph = 1 ; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape ; (iPlanet) web servers, you MAY need to set an environment variable name that PHP ; will look for to know it is OK to continue execution. Setting this variable MAY ; cause security issues, KNOW WHAT YOU ARE DOING FIRST. ; http://php.net/cgi.redirect-status-env ;cgi.redirect_status_env = ; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's ; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok ; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting ; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting ; of zero causes PHP to behave as before. Default is 1. You should fix your scripts ; to use SCRIPT_FILENAME rather than PATH_TRANSLATED. ; http://php.net/cgi.fix-pathinfo ;cgi.fix_pathinfo=1 ; FastCGI under IIS (on WINNT based OS) supports the ability to impersonate ; security tokens of the calling client. This allows IIS to define the ; security context that the request runs under. mod_fastcgi under Apache ; does not currently support this feature (03/17/2002) ; Set to 1 if running under IIS. Default is zero. ; http://php.net/fastcgi.impersonate ;fastcgi.impersonate = 1 ; Disable logging through FastCGI connection. PHP's default behavior is to enable ; this feature. ;fastcgi.logging = 0 ; cgi.rfc2616_headers configuration option tells PHP what type of headers to ; use when sending HTTP response code. If set to 0, PHP sends Status: header that ; is supported by Apache. When this option is set to 1, PHP will send ; RFC2616 compliant header. ; Default is zero. ; http://php.net/cgi.rfc2616-headers ;cgi.rfc2616_headers = 0 ;;;;;;;;;;;;;;;; ; File Uploads ; ;;;;;;;;;;;;;;;; ; Whether to allow HTTP file uploads. ; http://php.net/file-uploads file_uploads = On ; Temporary directory for HTTP uploaded files (will use system default if not ; specified). ; http://php.net/upload-tmp-dir upload_tmp_dir = /tmp ; Maximum allowed size for uploaded files. ; http://php.net/upload-max-filesize upload_max_filesize = 325M ; Maximum number of files that can be uploaded via a single request max_file_uploads = 50 ;;;;;;;;;;;;;;;;;; ; Fopen wrappers ; ;;;;;;;;;;;;;;;;;; ; Whether to allow the treatment of URLs (like http:// or ftp://) as files. ; http://php.net/allow-url-fopen allow_url_fopen = On ; Whether to allow include/require to open URLs (like http:// or ftp://) as files. ; http://php.net/allow-url-include allow_url_include = Off ; Define the anonymous ftp password (your email address). PHP's default setting ; for this is empty. ; http://php.net/from ;from="john@doe.com" ; Define the User-Agent string. PHP's default setting for this is empty. ; http://php.net/user-agent ;user_agent="PHP" ; Default timeout for socket based streams (seconds) ; http://php.net/default-socket-timeout default_socket_timeout = 180 ; If your scripts have to deal with files from Macintosh systems, ; or you are running on a Mac and need to deal with files from ; unix or win32 systems, setting this flag will cause PHP to ; automatically detect the EOL character in those files so that ; fgets() and file() will work regardless of the source of the file. ; http://php.net/auto-detect-line-endings auto_detect_line_endings = On ;;;;;;;;;;;;;;;;;;;;;; ; Dynamic Extensions ; ;;;;;;;;;;;;;;;;;;;;;; ; If you wish to have an extension loaded automatically, use the following ; syntax: ; ; extension=modulename.extension ; ; For example, on Windows: ; ; extension=msql.dll ; ; ... or under UNIX: ; ; extension=msql.so ; ; ... or with a path: ; ; extension=/path/to/extension/msql.so ; ; If you only provide the name of the extension, PHP will look for it in its ; default extension directory. ; ; Windows Extensions ; Note that ODBC support is built in, so no dll is needed for it. ; Note that many DLL files are located in the extensions/ (PHP 4) ext/ (PHP 5+) ; extension folders as well as the separate PECL DLL download (PHP 5+). ; Be sure to appropriately set the extension_dir directive. ; ;extension=php_bz2.dll ;extension=php_curl.dll ;extension=php_fileinfo.dll ;extension=php_gd2.dll ;extension=php_gettext.dll ;extension=php_gmp.dll ;extension=php_intl.dll ;extension=php_imap.dll ;extension=php_interbase.dll ;extension=php_ldap.dll ;extension=php_mbstring.dll ;extension=php_exif.dll ; Must be after mbstring as it depends on it ;extension=php_mysqli.dll ;extension=php_oci8_12c.dll ; Use with Oracle Database 12c Instant Client ;extension=php_openssl.dll ;extension=php_pdo_firebird.dll ;extension=php_pdo_mysql.dll ;extension=php_pdo_oci.dll ;extension=php_pdo_odbc.dll ;extension=php_pdo_pgsql.dll ;extension=php_pdo_sqlite.dll ;extension=php_pgsql.dll ;extension=php_shmop.dll ; The MIBS data available in the PHP distribution must be installed. ; See http://www.php.net/manual/en/snmp.installation.php ;extension=php_snmp.dll ;extension=php_soap.dll ;extension=php_sockets.dll ;extension=php_sqlite3.dll ;extension=php_tidy.dll ;extension=php_xmlrpc.dll ;extension=php_xsl.dll ;;;;;;;;;;;;;;;;;;; ; Module Settings ; ;;;;;;;;;;;;;;;;;;; [CLI Server] ; Whether the CLI web server uses ANSI color coding in its terminal output. cli_server.color = On [Date] ; Defines the default timezone used by the date functions ; http://php.net/date.timezone date.timezone = "UTC" ; http://php.net/date.default-latitude ;date.default_latitude = 31.7667 ; http://php.net/date.default-longitude ;date.default_longitude = 35.2333 ; http://php.net/date.sunrise-zenith ;date.sunrise_zenith = 90.583333 ; http://php.net/date.sunset-zenith ;date.sunset_zenith = 90.583333 [filter] ; http://php.net/filter.default ;filter.default = unsafe_raw ; http://php.net/filter.default-flags ;filter.default_flags = [iconv] ; Use of this INI entry is deprecated, use global input_encoding instead. ; If empty, default_charset or input_encoding or iconv.input_encoding is used. ; The precedence is: default_charset < intput_encoding < iconv.input_encoding ;iconv.input_encoding = ; Use of this INI entry is deprecated, use global internal_encoding instead. ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;iconv.internal_encoding = ; Use of this INI entry is deprecated, use global output_encoding instead. ; If empty, default_charset or output_encoding or iconv.output_encoding is used. ; The precedence is: default_charset < output_encoding < iconv.output_encoding ; To use an output encoding conversion, iconv's output handler must be set ; otherwise output encoding conversion cannot be performed. ;iconv.output_encoding = [intl] ;intl.default_locale = ; This directive allows you to produce PHP errors when some error ; happens within intl functions. The value is the level of the error produced. ; Default is 0, which does not produce any errors. ;intl.error_level = E_WARNING [sqlite3] ;sqlite3.extension_dir = [Pcre] ;PCRE library backtracking limit. ; http://php.net/pcre.backtrack-limit ;pcre.backtrack_limit=100000 ;PCRE library recursion limit. ;Please note that if you set this value to a high number you may consume all ;the available process stack and eventually crash PHP (due to reaching the ;stack size limit imposed by the Operating System). ; http://php.net/pcre.recursion-limit ;pcre.recursion_limit=100000 ;Enables or disables JIT compilation of patterns. This requires the PCRE ;library to be compiled with JIT support. ;pcre.jit=1 [Pdo] ; Whether to pool ODBC connections. Can be one of "strict", "relaxed" or "off" ; http://php.net/pdo-odbc.connection-pooling ;pdo_odbc.connection_pooling=strict ;pdo_odbc.db2_instance_name [Pdo_mysql] ; If mysqlnd is used: Number of cache slots for the internal result set cache ; http://php.net/pdo_mysql.cache_size pdo_mysql.cache_size = 2000 ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. ; http://php.net/pdo_mysql.default-socket pdo_mysql.default_socket= [Phar] ; http://php.net/phar.readonly ;phar.readonly = On ; http://php.net/phar.require-hash ;phar.require_hash = On ;phar.cache_list = [mail function] ; For Win32 only. ; http://php.net/smtp ;SMTP = localhost ; http://php.net/smtp-port ;smtp_port = 25 ; For Win32 only. ; http://php.net/sendmail-from ;sendmail_from = me@example.com ; For Unix only. You may supply arguments as well (default: "sendmail -t -i"). ; http://php.net/sendmail-path sendmail_path = /usr/sbin/sendmail -t -i ; Force the addition of the specified parameters to be passed as extra parameters ; to the sendmail binary. These parameters will always replace the value of ; the 5th parameter to mail(). ;mail.force_extra_parameters = ; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename mail.add_x_header = Off ; The path to a log file that will log all mail() calls. Log entries include ; the full path of the script, line number, To address and headers. ;mail.log = ; Log mail to syslog (Event Log on Windows). ;mail.log = syslog [SQL] ; http://php.net/sql.safe-mode sql.safe_mode = Off [ODBC] ; http://php.net/odbc.default-db ;odbc.default_db = Not yet implemented ; http://php.net/odbc.default-user ;odbc.default_user = Not yet implemented ; http://php.net/odbc.default-pw ;odbc.default_pw = Not yet implemented ; Controls the ODBC cursor model. ; Default: SQL_CURSOR_STATIC (default). ;odbc.default_cursortype ; Allow or prevent persistent links. ; http://php.net/odbc.allow-persistent odbc.allow_persistent = On ; Check that a connection is still valid before reuse. ; http://php.net/odbc.check-persistent odbc.check_persistent = On ; Maximum number of persistent links. -1 means no limit. ; http://php.net/odbc.max-persistent odbc.max_persistent = -1 ; Maximum number of links (persistent + non-persistent). -1 means no limit. ; http://php.net/odbc.max-links odbc.max_links = -1 ; Handling of LONG fields. Returns number of bytes to variables. 0 means ; passthru. ; http://php.net/odbc.defaultlrl odbc.defaultlrl = 4096 ; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char. ; See the documentation on odbc_binmode and odbc_longreadlen for an explanation ; of odbc.defaultlrl and odbc.defaultbinmode ; http://php.net/odbc.defaultbinmode odbc.defaultbinmode = 1 ;birdstep.max_links = -1 [Interbase] ; Allow or prevent persistent links. ibase.allow_persistent = 1 ; Maximum number of persistent links. -1 means no limit. ibase.max_persistent = -1 ; Maximum number of links (persistent + non-persistent). -1 means no limit. ibase.max_links = -1 ; Default database name for ibase_connect(). ;ibase.default_db = ; Default username for ibase_connect(). ;ibase.default_user = ; Default password for ibase_connect(). ;ibase.default_password = ; Default charset for ibase_connect(). ;ibase.default_charset = ; Default timestamp format. ibase.timestampformat = "%Y-%m-%d %H:%M:%S" ; Default date format. ibase.dateformat = "%Y-%m-%d" ; Default time format. ibase.timeformat = "%H:%M:%S" [MySQLi] ; Maximum number of persistent links. -1 means no limit. ; http://php.net/mysqli.max-persistent mysqli.max_persistent = -1 ; Allow accessing, from PHP's perspective, local files with LOAD DATA statements ; http://php.net/mysqli.allow_local_infile ;mysqli.allow_local_infile = On ; Allow or prevent persistent links. ; http://php.net/mysqli.allow-persistent mysqli.allow_persistent = On ; Maximum number of links. -1 means no limit. ; http://php.net/mysqli.max-links mysqli.max_links = -1 ; If mysqlnd is used: Number of cache slots for the internal result set cache ; http://php.net/mysqli.cache_size mysqli.cache_size = 2000 ; Default port number for mysqli_connect(). If unset, mysqli_connect() will use ; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the ; compile-time value defined MYSQL_PORT (in that order). Win32 will only look ; at MYSQL_PORT. ; http://php.net/mysqli.default-port mysqli.default_port = 3306 ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. ; http://php.net/mysqli.default-socket mysqli.default_socket = ; Default host for mysql_connect() (doesn't apply in safe mode). ; http://php.net/mysqli.default-host mysqli.default_host = ; Default user for mysql_connect() (doesn't apply in safe mode). ; http://php.net/mysqli.default-user mysqli.default_user = ; Default password for mysqli_connect() (doesn't apply in safe mode). ; Note that this is generally a *bad* idea to store passwords in this file. ; *Any* user with PHP access can run 'echo get_cfg_var("mysqli.default_pw") ; and reveal this password! And of course, any users with read access to this ; file will be able to reveal the password as well. ; http://php.net/mysqli.default-pw mysqli.default_pw = ; Allow or prevent reconnect mysqli.reconnect = Off [mysqlnd] ; Enable / Disable collection of general statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. ; http://php.net/mysqlnd.collect_statistics mysqlnd.collect_statistics = 0 ; Enable / Disable collection of memory usage statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. ; http://php.net/mysqlnd.collect_memory_statistics mysqlnd.collect_memory_statistics = 0 ; Size of a pre-allocated buffer used when sending commands to MySQL in bytes. ; http://php.net/mysqlnd.net_cmd_buffer_size mysqlnd.net_cmd_buffer_size = 8192 ; Size of a pre-allocated buffer used for reading data sent by the server in ; bytes. ; http://php.net/mysqlnd.net_read_buffer_size mysqlnd.net_read_buffer_size = 131072 [OCI8] ; Connection: Enables privileged connections using external ; credentials (OCI_SYSOPER, OCI_SYSDBA) ; http://php.net/oci8.privileged-connect ;oci8.privileged_connect = Off ; Connection: The maximum number of persistent OCI8 connections per ; process. Using -1 means no limit. ; http://php.net/oci8.max-persistent ;oci8.max_persistent = -1 ; Connection: The maximum number of seconds a process is allowed to ; maintain an idle persistent connection. Using -1 means idle ; persistent connections will be maintained forever. ; http://php.net/oci8.persistent-timeout ;oci8.persistent_timeout = -1 ; Connection: The number of seconds that must pass before issuing a ; ping during oci_pconnect() to check the connection validity. When ; set to 0, each oci_pconnect() will cause a ping. Using -1 disables ; pings completely. ; http://php.net/oci8.ping-interval ;oci8.ping_interval = 60 ; Connection: Set this to a user chosen connection class to be used ; for all pooled server requests with Oracle 11g Database Resident ; Connection Pooling (DRCP). To use DRCP, this value should be set to ; the same string for all web servers running the same application, ; the database pool must be configured, and the connection string must ; specify to use a pooled server. ;oci8.connection_class = ; High Availability: Using On lets PHP receive Fast Application ; Notification (FAN) events generated when a database node fails. The ; database must also be configured to post FAN events. ;oci8.events = Off ; Tuning: This option enables statement caching, and specifies how ; many statements to cache. Using 0 disables statement caching. ; http://php.net/oci8.statement-cache-size ;oci8.statement_cache_size = 20 ; Tuning: Enables statement prefetching and sets the default number of ; rows that will be fetched automatically after statement execution. ; http://php.net/oci8.default-prefetch ;oci8.default_prefetch = 100 ; Compatibility. Using On means oci_close() will not close ; oci_connect() and oci_new_connect() connections. ; http://php.net/oci8.old-oci-close-semantics ;oci8.old_oci_close_semantics = Off [PostgreSQL] ; Allow or prevent persistent links. ; http://php.net/pgsql.allow-persistent pgsql.allow_persistent = On ; Detect broken persistent links always with pg_pconnect(). ; Auto reset feature requires a little overheads. ; http://php.net/pgsql.auto-reset-persistent pgsql.auto_reset_persistent = Off ; Maximum number of persistent links. -1 means no limit. ; http://php.net/pgsql.max-persistent pgsql.max_persistent = -1 ; Maximum number of links (persistent+non persistent). -1 means no limit. ; http://php.net/pgsql.max-links pgsql.max_links = -1 ; Ignore PostgreSQL backends Notice message or not. ; Notice message logging require a little overheads. ; http://php.net/pgsql.ignore-notice pgsql.ignore_notice = 0 ; Log PostgreSQL backends Notice message or not. ; Unless pgsql.ignore_notice=0, module cannot log notice message. ; http://php.net/pgsql.log-notice pgsql.log_notice = 0 [bcmath] ; Number of decimal digits for all bcmath functions. ; http://php.net/bcmath.scale bcmath.scale = 0 [browscap] ; http://php.net/browscap ;browscap = extra/browscap.ini [Session] ; Handler used to store/retrieve data. ; http://php.net/session.save-handler session.save_handler = files ; Argument passed to save_handler. In the case of files, this is the path ; where data files are stored. Note: Windows users have to change this ; variable in order to use PHP's session functions. ; ; The path can be defined as: ; ; session.save_path = "N;/path" ; ; where N is an integer. Instead of storing all the session files in ; /path, what this will do is use subdirectories N-levels deep, and ; store the session data in those directories. This is useful if ; your OS has problems with many files in one directory, and is ; a more efficient layout for servers that handle many sessions. ; ; NOTE 1: PHP will not create this directory structure automatically. ; You can use the script in the ext/session dir for that purpose. ; NOTE 2: See the section on garbage collection below if you choose to ; use subdirectories for session storage ; ; The file storage module creates files using mode 600 by default. ; You can change that by using ; ; session.save_path = "N;MODE;/path" ; ; where MODE is the octal representation of the mode. Note that this ; does not overwrite the process's umask. ; http://php.net/session.save-path session.save_path = "/opt/tmp" ; Whether to use strict session mode. ; Strict session mode does not accept uninitialized session ID and regenerate ; session ID if browser sends uninitialized session ID. Strict mode protects ; applications from session fixation via session adoption vulnerability. It is ; disabled by default for maximum compatibility, but enabling it is encouraged. ; https://wiki.php.net/rfc/strict_sessions session.use_strict_mode = 0 ; Whether to use cookies. ; http://php.net/session.use-cookies session.use_cookies = 1 ; http://php.net/session.cookie-secure ;session.cookie_secure = ; This option forces PHP to fetch and use a cookie for storing and maintaining ; the session id. We encourage this operation as it's very helpful in combating ; session hijacking when not specifying and managing your own session id. It is ; not the be-all and end-all of session hijacking defense, but it's a good start. ; http://php.net/session.use-only-cookies session.use_only_cookies = 1 ; Name of the session (used as cookie name). ; http://php.net/session.name session.name = PHPSESSID ; Initialize session on request startup. ; http://php.net/session.auto-start session.auto_start = 0 ; Lifetime in seconds of cookie or, if 0, until browser is restarted. ; http://php.net/session.cookie-lifetime session.cookie_lifetime = 0 ; The path for which the cookie is valid. ; http://php.net/session.cookie-path session.cookie_path = / ; The domain for which the cookie is valid. ; http://php.net/session.cookie-domain session.cookie_domain = ; Whether or not to add the httpOnly flag to the cookie, which makes it inaccessible to browser scripting languages such as JavaScript. ; http://php.net/session.cookie-httponly session.cookie_httponly = 1 ; Handler used to serialize data. php is the standard serializer of PHP. ; http://php.net/session.serialize-handler session.serialize_handler = php ; Defines the probability that the 'garbage collection' process is started ; on every session initialization. The probability is calculated by using ; gc_probability/gc_divisor. Where session.gc_probability is the numerator ; and gc_divisor is the denominator in the equation. Setting this value to 1 ; when the session.gc_divisor value is 100 will give you approximately a 1% chance ; the gc will run on any give request. ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; http://php.net/session.gc-probability session.gc_probability = 1 ; Defines the probability that the 'garbage collection' process is started on every ; session initialization. The probability is calculated by using the following equation: ; gc_probability/gc_divisor. Where session.gc_probability is the numerator and ; session.gc_divisor is the denominator in the equation. Setting this value to 1 ; when the session.gc_divisor value is 100 will give you approximately a 1% chance ; the gc will run on any give request. Increasing this value to 1000 will give you ; a 0.1% chance the gc will run on any give request. For high volume production servers, ; this is a more efficient approach. ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; http://php.net/session.gc-divisor session.gc_divisor = 1000 ; After this number of seconds, stored data will be seen as 'garbage' and ; cleaned up by the garbage collection process. ; http://php.net/session.gc-maxlifetime session.gc_maxlifetime = 1440 ; NOTE: If you are using the subdirectory option for storing session files ; (see session.save_path above), then garbage collection does *not* ; happen automatically. You will need to do your own garbage ; collection through a shell script, cron entry, or some other method. ; For example, the following script would is the equivalent of ; setting session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes): ; find /path/to/sessions -cmin +24 -type f | xargs rm ; Check HTTP Referer to invalidate externally stored URLs containing ids. ; HTTP_REFERER has to contain this substring for the session to be ; considered as valid. ; http://php.net/session.referer-check session.referer_check = ; How many bytes to read from the file. ; http://php.net/session.entropy-length session.entropy_length = 32 ; Specified here to create the session id. ; http://php.net/session.entropy-file ; Defaults to /dev/urandom ; On systems that don't have /dev/urandom but do have /dev/arandom, this will default to /dev/arandom ; If neither are found at compile time, the default is no entropy file. ; On windows, setting the entropy_length setting will activate the ; Windows random source (using the CryptoAPI) session.entropy_file = /dev/urandom ; Set to {nocache,private,public,} to determine HTTP caching aspects ; or leave this empty to avoid sending anti-caching headers. ; http://php.net/session.cache-limiter session.cache_limiter = nocache ; Document expires after n minutes. ; http://php.net/session.cache-expire session.cache_expire = 180 ; trans sid support is disabled by default. ; Use of trans sid may risk your users' security. ; Use this option with caution. ; - User may send URL contains active session ID ; to other person via. email/irc/etc. ; - URL that contains active session ID may be stored ; in publicly accessible computer. ; - User may access your site with the same session ID ; always using URL stored in browser's history or bookmarks. ; http://php.net/session.use-trans-sid session.use_trans_sid = 0 ; Select a hash function for use in generating session ids. ; Possible Values ; 0 (MD5 128 bits) ; 1 (SHA-1 160 bits) ; This option may also be set to the name of any hash function supported by ; the hash extension. A list of available hashes is returned by the hash_algos() ; function. ; http://php.net/session.hash-function session.hash_function = 0 ; Define how many bits are stored in each character when converting ; the binary hash data to something readable. ; Possible values: ; 4 (4 bits: 0-9, a-f) ; 5 (5 bits: 0-9, a-v) ; 6 (6 bits: 0-9, a-z, A-Z, "-", ",") ; Default Value: 4 ; Development Value: 5 ; Production Value: 5 ; http://php.net/session.hash-bits-per-character session.hash_bits_per_character = 5 ; The URL rewriter will look for URLs in a defined set of HTML tags. ; form/fieldset are special; if you include them here, the rewriter will ; add a hidden field with the info which is otherwise appended ; to URLs. If you want XHTML conformity, remove the form entry. ; Note that all valid entries require a "=", even if no value follows. ; Default Value: "a=href,area=href,frame=src,form=,fieldset=" ; Development Value: "a=href,area=href,frame=src,input=src,form=fakeentry" ; Production Value: "a=href,area=href,frame=src,input=src,form=fakeentry" ; http://php.net/url-rewriter.tags url_rewriter.tags = "a=href,area=href,frame=src,input=src,form=fakeentry" ; Enable upload progress tracking in $_SESSION ; Default Value: On ; Development Value: On ; Production Value: On ; http://php.net/session.upload-progress.enabled ;session.upload_progress.enabled = On ; Cleanup the progress information as soon as all POST data has been read ; (i.e. upload completed). ; Default Value: On ; Development Value: On ; Production Value: On ; http://php.net/session.upload-progress.cleanup ;session.upload_progress.cleanup = On ; A prefix used for the upload progress key in $_SESSION ; Default Value: "upload_progress_" ; Development Value: "upload_progress_" ; Production Value: "upload_progress_" ; http://php.net/session.upload-progress.prefix ;session.upload_progress.prefix = "upload_progress_" ; The index name (concatenated with the prefix) in $_SESSION ; containing the upload progress information ; Default Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Development Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Production Value: "PHP_SESSION_UPLOAD_PROGRESS" ; http://php.net/session.upload-progress.name ;session.upload_progress.name = "PHP_SESSION_UPLOAD_PROGRESS" ; How frequently the upload progress should be updated. ; Given either in percentages (per-file), or in bytes ; Default Value: "1%" ; Development Value: "1%" ; Production Value: "1%" ; http://php.net/session.upload-progress.freq ;session.upload_progress.freq = "1%" ; The minimum delay between updates, in seconds ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; http://php.net/session.upload-progress.min-freq ;session.upload_progress.min_freq = "1" ; Only write session data when session data is changed. Enabled by default. ; http://php.net/session.lazy-write ;session.lazy_write = On [Assertion] ; Switch whether to compile assertions at all (to have no overhead at run-time) ; -1: Do not compile at all ; 0: Jump over assertion at run-time ; 1: Execute assertions ; Changing from or to a negative value is only possible in php.ini! (For turning assertions on and off at run-time, see assert.active, when zend.assertions = 1) ; Default Value: 1 ; Development Value: 1 ; Production Value: -1 ; http://php.net/zend.assertions zend.assertions = -1 ; Assert(expr); active by default. ; http://php.net/assert.active ;assert.active = On ; Throw an AssertationException on failed assertions ; http://php.net/assert.exception ;assert.exception = On ; Issue a PHP warning for each failed assertion. (Overridden by assert.exception if active) ; http://php.net/assert.warning ;assert.warning = On ; Don't bail out by default. ; http://php.net/assert.bail ;assert.bail = Off ; User-function to be called if an assertion fails. ; http://php.net/assert.callback ;assert.callback = 0 ; Eval the expression with current error_reporting(). Set to true if you want ; error_reporting(0) around the eval(). ; http://php.net/assert.quiet-eval ;assert.quiet_eval = 0 [COM] ; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs ; http://php.net/com.typelib-file ;com.typelib_file = ; allow Distributed-COM calls ; http://php.net/com.allow-dcom ;com.allow_dcom = true ; autoregister constants of a components typlib on com_load() ; http://php.net/com.autoregister-typelib ;com.autoregister_typelib = true ; register constants casesensitive ; http://php.net/com.autoregister-casesensitive ;com.autoregister_casesensitive = false ; show warnings on duplicate constant registrations ; http://php.net/com.autoregister-verbose ;com.autoregister_verbose = true ; The default character set code-page to use when passing strings to and from COM objects. ; Default: system ANSI code page ;com.code_page= [mbstring] ; language for internal character representation. ; This affects mb_send_mail() and mbstring.detect_order. ; http://php.net/mbstring.language ;mbstring.language = Japanese ; Use of this INI entry is deprecated, use global internal_encoding instead. ; internal/script encoding. ; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*) ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;mbstring.internal_encoding = ; Use of this INI entry is deprecated, use global input_encoding instead. ; http input encoding. ; mbstring.encoding_traslation = On is needed to use this setting. ; If empty, default_charset or input_encoding or mbstring.input is used. ; The precedence is: default_charset < intput_encoding < mbsting.http_input ; http://php.net/mbstring.http-input ;mbstring.http_input = ; Use of this INI entry is deprecated, use global output_encoding instead. ; http output encoding. ; mb_output_handler must be registered as output buffer to function. ; If empty, default_charset or output_encoding or mbstring.http_output is used. ; The precedence is: default_charset < output_encoding < mbstring.http_output ; To use an output encoding conversion, mbstring's output handler must be set ; otherwise output encoding conversion cannot be performed. ; http://php.net/mbstring.http-output ;mbstring.http_output = ; enable automatic encoding translation according to ; mbstring.internal_encoding setting. Input chars are ; converted to internal encoding by setting this to On. ; Note: Do _not_ use automatic encoding translation for ; portable libs/applications. ; http://php.net/mbstring.encoding-translation ;mbstring.encoding_translation = Off ; automatic encoding detection order. ; "auto" detect order is changed according to mbstring.language ; http://php.net/mbstring.detect-order ;mbstring.detect_order = auto ; substitute_character used when character cannot be converted ; one from another ; http://php.net/mbstring.substitute-character ;mbstring.substitute_character = none ; overload(replace) single byte functions by mbstring functions. ; mail(), ereg(), etc are overloaded by mb_send_mail(), mb_ereg(), ; etc. Possible values are 0,1,2,4 or combination of them. ; For example, 7 for overload everything. ; 0: No overload ; 1: Overload mail() function ; 2: Overload str*() functions ; 4: Overload ereg*() functions ; http://php.net/mbstring.func-overload ;mbstring.func_overload = 0 ; enable strict encoding detection. ; Default: Off ;mbstring.strict_detection = On ; This directive specifies the regex pattern of content types for which mb_output_handler() ; is activated. ; Default: mbstring.http_output_conv_mimetype=^(text/|application/xhtml\+xml) ;mbstring.http_output_conv_mimetype= [gd] ; Tell the jpeg decode to ignore warnings and try to create ; a gd image. The warning will then be displayed as notices ; disabled by default ; http://php.net/gd.jpeg-ignore-warning ;gd.jpeg_ignore_warning = 0 [exif] ; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS. ; With mbstring support this will automatically be converted into the encoding ; given by corresponding encode setting. When empty mbstring.internal_encoding ; is used. For the decode settings you can distinguish between motorola and ; intel byte order. A decode setting cannot be empty. ; http://php.net/exif.encode-unicode ;exif.encode_unicode = ISO-8859-15 ; http://php.net/exif.decode-unicode-motorola ;exif.decode_unicode_motorola = UCS-2BE ; http://php.net/exif.decode-unicode-intel ;exif.decode_unicode_intel = UCS-2LE ; http://php.net/exif.encode-jis ;exif.encode_jis = ; http://php.net/exif.decode-jis-motorola ;exif.decode_jis_motorola = JIS ; http://php.net/exif.decode-jis-intel ;exif.decode_jis_intel = JIS [Tidy] ; The path to a default tidy configuration file to use when using tidy ; http://php.net/tidy.default-config ;tidy.default_config = /usr/local/lib/php/default.tcfg ; Should tidy clean and repair output automatically? ; WARNING: Do not use this option if you are generating non-html content ; such as dynamic images ; http://php.net/tidy.clean-output tidy.clean_output = Off [soap] ; Enables or disables WSDL caching feature. ; http://php.net/soap.wsdl-cache-enabled soap.wsdl_cache_enabled=1 ; Sets the directory name where SOAP extension will put cache files. ; http://php.net/soap.wsdl-cache-dir soap.wsdl_cache_dir="/tmp" ; (time to live) Sets the number of second while cached file will be used ; instead of original one. ; http://php.net/soap.wsdl-cache-ttl soap.wsdl_cache_ttl=86400 ; Sets the size of the cache limit. (Max. number of WSDL files to cache) soap.wsdl_cache_limit = 5 [sysvshm] ; A default size of the shared memory segment ;sysvshm.init_mem = 10000 [ldap] ; Sets the maximum number of open links or -1 for unlimited. ldap.max_links = -1 [mcrypt] ; For more information about mcrypt settings see http://php.net/mcrypt-module-open ; Directory where to load mcrypt algorithms ; Default: Compiled in into libmcrypt (usually /usr/local/lib/libmcrypt) ;mcrypt.algorithms_dir= ; Directory where to load mcrypt modes ; Default: Compiled in into libmcrypt (usually /usr/local/lib/libmcrypt) ;mcrypt.modes_dir= [dba] ;dba.default_handler= [opcache] ; Determines if Zend OPCache is enabled ;opcache.enable=0 ; Determines if Zend OPCache is enabled for the CLI version of PHP ;opcache.enable_cli=0 ; The OPcache shared memory storage size. ;opcache.memory_consumption=64 ; The amount of memory for interned strings in Mbytes. ;opcache.interned_strings_buffer=4 ; The maximum number of keys (scripts) in the OPcache hash table. ; Only numbers between 200 and 100000 are allowed. ;opcache.max_accelerated_files=2000 ; The maximum percentage of "wasted" memory until a restart is scheduled. ;opcache.max_wasted_percentage=5 ; When this directive is enabled, the OPcache appends the current working ; directory to the script key, thus eliminating possible collisions between ; files with the same name (basename). Disabling the directive improves ; performance, but may break existing applications. ;opcache.use_cwd=1 ; When disabled, you must reset the OPcache manually or restart the ; webserver for changes to the filesystem to take effect. ;opcache.validate_timestamps=1 ; How often (in seconds) to check file timestamps for changes to the shared ; memory storage allocation. ("1" means validate once per second, but only ; once per request. "0" means always validate) ;opcache.revalidate_freq=2 ; Enables or disables file search in include_path optimization ;opcache.revalidate_path=0 ; If disabled, all PHPDoc comments are dropped from the code to reduce the ; size of the optimized code. ;opcache.save_comments=1 ; If enabled, a fast shutdown sequence is used for the accelerated code ;opcache.fast_shutdown=0 ; Allow file existence override (file_exists, etc.) performance feature. ;opcache.enable_file_override=0 ; A bitmask, where each bit enables or disables the appropriate OPcache ; passes ;opcache.optimization_level=0xffffffff ;opcache.inherited_hack=1 ;opcache.dups_fix=0 ; The location of the OPcache blacklist file (wildcards allowed). ; Each OPcache blacklist file is a text file that holds the names of files ; that should not be accelerated. The file format is to add each filename ; to a new line. The filename may be a full path or just a file prefix ; (i.e., /var/www/x blacklists all the files and directories in /var/www ; that start with 'x'). Line starting with a ; are ignored (comments). ;opcache.blacklist_filename= ; Allows exclusion of large files from being cached. By default all files ; are cached. ;opcache.max_file_size=0 ; Check the cache checksum each N requests. ; The default value of "0" means that the checks are disabled. ;opcache.consistency_checks=0 ; How long to wait (in seconds) for a scheduled restart to begin if the cache ; is not being accessed. ;opcache.force_restart_timeout=180 ; OPcache error_log file name. Empty string assumes "stderr". ;opcache.error_log= ; All OPcache errors go to the Web server log. ; By default, only fatal errors (level 0) or errors (level 1) are logged. ; You can also enable warnings (level 2), info messages (level 3) or ; debug messages (level 4). ;opcache.log_verbosity_level=1 ; Preferred Shared Memory back-end. Leave empty and let the system decide. ;opcache.preferred_memory_model= ; Protect the shared memory from unexpected writing during script execution. ; Useful for internal debugging only. ;opcache.protect_memory=0 ; Allows calling OPcache API functions only from PHP scripts which path is ; started from specified string. The default "" means no restriction ;opcache.restrict_api= ; Mapping base of shared memory segments (for Windows only). All the PHP ; processes have to map shared memory into the same address space. This ; directive allows to manually fix the "Unable to reattach to base address" ; errors. ;opcache.mmap_base= ; Enables and sets the second level cache directory. ; It should improve performance when SHM memory is full, at server restart or ; SHM reset. The default "" disables file based caching. ;opcache.file_cache= ; Enables or disables opcode caching in shared memory. ;opcache.file_cache_only=0 ; Enables or disables checksum validation when script loaded from file cache. ;opcache.file_cache_consistency_checks=1 ; Enables or disables copying of PHP code (text segment) into HUGE PAGES. ; This should improve performance, but requires appropriate OS configuration. ;opcache.huge_code_pages=0 [curl] ; A default value for the CURLOPT_CAINFO option. This is required to be an ; absolute path. ;curl.cainfo = [openssl] ; The location of a Certificate Authority (CA) file on the local filesystem ; to use when verifying the identity of SSL/TLS peers. Most users should ; not specify a value for this directive as PHP will attempt to use the ; OS-managed cert stores in its absence. If specified, this value may still ; be overridden on a per-stream basis via the "cafile" SSL stream context ; option. ;openssl.cafile= ; If openssl.cafile is not specified or if the CA file is not found, the ; directory pointed to by openssl.capath is searched for a suitable ; certificate. This value must be a correctly hashed certificate directory. ; Most users should not specify a value for this directive as PHP will ; attempt to use the OS-managed cert stores in its absence. If specified, ; this value may still be overridden on a per-stream basis via the "capath" ; SSL stream context option. ;openssl.capath= ; Local Variables: ; tab-width: 4 ; End: [Zend] zend_extension="/usr/local/ioncube/ioncube_loader_lin_7.0.so" ; fix for segfaults auto_globals_jit = Off cgi.fix_pathinfo = 1 mbstring.http_input = "pass" mbstring.http_output = "pass" mbstring.encoding_translation = 0 ; Enable Extensions extension=uploadprogress.so extension=imagick.so extension=jsmin.so extension=redis.so ; APCu extension=apcu.so apc.enable_cli=1 apc.gc_ttl=300 apc.shm_segments=1 apc.shm_size=256M apc.slam_defense=0 apc.ttl=0 ; ================================================ FILE: aegir/conf/php/php71-cli.ini ================================================ [PHP] ;;;;;;;;;;;;;;;;;;; ; About php.ini ; ;;;;;;;;;;;;;;;;;;; ; PHP's initialization file, generally called php.ini, is responsible for ; configuring many of the aspects of PHP's behavior. ; PHP attempts to find and load this configuration from a number of locations. ; The following is a summary of its search order: ; 1. SAPI module specific location. ; 2. The PHPRC environment variable. (As of PHP 5.2.0) ; 3. A number of predefined registry keys on Windows (As of PHP 5.2.0) ; 4. Current working directory (except CLI) ; 5. The web server's directory (for SAPI modules), or directory of PHP ; (otherwise in Windows) ; 6. The directory from the --with-config-file-path compile time option, or the ; Windows directory (C:\windows or C:\winnt) ; See the PHP docs for more specific information. ; http://php.net/configuration.file ; The syntax of the file is extremely simple. Whitespace and lines ; beginning with a semicolon are silently ignored (as you probably guessed). ; Section headers (e.g. [Foo]) are also silently ignored, even though ; they might mean something in the future. ; Directives following the section heading [PATH=/www/mysite] only ; apply to PHP files in the /www/mysite directory. Directives ; following the section heading [HOST=www.example.com] only apply to ; PHP files served from www.example.com. Directives set in these ; special sections cannot be overridden by user-defined INI files or ; at runtime. Currently, [PATH=] and [HOST=] sections only work under ; CGI/FastCGI. ; http://php.net/ini.sections ; Directives are specified using the following syntax: ; directive = value ; Directive names are *case sensitive* - foo=bar is different from FOO=bar. ; Directives are variables used to configure PHP or PHP extensions. ; There is no name validation. If PHP can't find an expected ; directive because it is not set or is mistyped, a default value will be used. ; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one ; of the INI constants (On, Off, True, False, Yes, No and None) or an expression ; (e.g. E_ALL & ~E_NOTICE), a quoted string ("bar"), or a reference to a ; previously set variable or directive (e.g. ${foo}) ; Expressions in the INI file are limited to bitwise operators and parentheses: ; | bitwise OR ; ^ bitwise XOR ; & bitwise AND ; ~ bitwise NOT ; ! boolean NOT ; Boolean flags can be turned on using the values 1, On, True or Yes. ; They can be turned off using the values 0, Off, False or No. ; An empty string can be denoted by simply not writing anything after the equal ; sign, or by using the None keyword: ; foo = ; sets foo to an empty string ; foo = None ; sets foo to an empty string ; foo = "None" ; sets foo to the string 'None' ; If you use constants in your value, and these constants belong to a ; dynamically loaded extension (either a PHP extension or a Zend extension), ; you may only use these constants *after* the line that loads the extension. ;;;;;;;;;;;;;;;;;;; ; About this file ; ;;;;;;;;;;;;;;;;;;; ; PHP comes packaged with two INI files. One that is recommended to be used ; in production environments and one that is recommended to be used in ; development environments. ; php.ini-production contains settings which hold security, performance and ; best practices at its core. But please be aware, these settings may break ; compatibility with older or less security conscience applications. We ; recommending using the production ini in production and testing environments. ; php.ini-development is very similar to its production variant, except it is ; much more verbose when it comes to errors. We recommend using the ; development version only in development environments, as errors shown to ; application users can inadvertently leak otherwise secure information. ; This is php.ini-production INI file. ;;;;;;;;;;;;;;;;;;; ; Quick Reference ; ;;;;;;;;;;;;;;;;;;; ; The following are all the settings which are different in either the production ; or development versions of the INIs with respect to PHP's default behavior. ; Please see the actual settings later in the document for more details as to why ; we recommend these changes in PHP's behavior. display_errors = Off ; Default Value: On ; Development Value: On ; Production Value: Off ; display_startup_errors ; Default Value: Off ; Development Value: On ; Production Value: Off ; error_reporting ; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; html_errors ; Default Value: On ; Development Value: On ; Production value: On ; log_errors ; Default Value: Off ; Development Value: On ; Production Value: On ; max_input_time ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; output_buffering ; Default Value: Off ; Development Value: 4096 ; Production Value: 4096 ; register_argc_argv ; Default Value: On ; Development Value: Off ; Production Value: Off ; request_order ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; session.gc_divisor ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; session.sid_bits_per_character ; Default Value: 4 ; Development Value: 5 ; Production Value: 5 ; short_open_tag ; Default Value: On ; Development Value: Off ; Production Value: Off ; track_errors ; Default Value: Off ; Development Value: On ; Production Value: Off ; variables_order ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS" ;;;;;;;;;;;;;;;;;;;; ; php.ini Options ; ;;;;;;;;;;;;;;;;;;;; ; Name for user-defined php.ini (.htaccess) files. Default is ".user.ini" ;user_ini.filename = ".user.ini" ; To disable this feature set this option to empty value user_ini.filename = ; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes) ;user_ini.cache_ttl = 300 ;;;;;;;;;;;;;;;;;;;; ; Language Options ; ;;;;;;;;;;;;;;;;;;;; ; Enable the PHP scripting language engine under Apache. ; http://php.net/engine engine = On ; This directive determines whether or not PHP will recognize code between ; tags as PHP source which should be processed as such. It is ; generally recommended that should be used and that this feature ; should be disabled, as enabling it may result in issues when generating XML ; documents, however this remains supported for backward compatibility reasons. ; Note that this directive does not control the would work. ; http://php.net/syntax-highlighting ;highlight.string = #DD0000 ;highlight.comment = #FF9900 ;highlight.keyword = #007700 ;highlight.default = #0000BB ;highlight.html = #000000 ; If enabled, the request will be allowed to complete even if the user aborts ; the request. Consider enabling it if executing long requests, which may end up ; being interrupted by the user or a browser timing out. PHP's default behavior ; is to disable this feature. ; http://php.net/ignore-user-abort ;ignore_user_abort = On ; Determines the size of the realpath cache to be used by PHP. This value should ; be increased on systems where PHP opens many files to reflect the quantity of ; the file operations performed. ; http://php.net/realpath-cache-size realpath_cache_size=64M ; Duration of time, in seconds for which to cache realpath information for a given ; file or directory. For systems with rarely changing files, consider increasing this ; value. ; http://php.net/realpath-cache-ttl realpath_cache_ttl=5 ; Enables or disables the circular reference collector. ; http://php.net/zend.enable-gc zend.enable_gc = On ; If enabled, scripts may be written in encodings that are incompatible with ; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such ; encodings. To use this feature, mbstring extension must be enabled. ; Default: Off ;zend.multibyte = Off ; Allows to set the default encoding for the scripts. This value will be used ; unless "declare(encoding=...)" directive appears at the top of the script. ; Only affects if zend.multibyte is set. ; Default: "" ;zend.script_encoding = ;;;;;;;;;;;;;;;;; ; Miscellaneous ; ;;;;;;;;;;;;;;;;; ; Decides whether PHP may expose the fact that it is installed on the server ; (e.g. by adding its signature to the Web server header). It is no security ; threat in any way, but it makes it possible to determine whether you use PHP ; on your server or not. ; http://php.net/expose-php expose_php = On ;;;;;;;;;;;;;;;;;;; ; Resource Limits ; ;;;;;;;;;;;;;;;;;;; ; Maximum execution time of each script, in seconds ; http://php.net/max-execution-time ; Note: This directive is hardcoded to 0 for the CLI SAPI max_execution_time = 3600 ; Maximum amount of time each script may spend parsing request data. It's a good ; idea to limit this time on productions servers in order to eliminate unexpectedly ; long running scripts. ; Note: This directive is hardcoded to -1 for the CLI SAPI ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; http://php.net/max-input-time max_input_time = 3600 ; Maximum input variable nesting level ; http://php.net/max-input-nesting-level ;max_input_nesting_level = 64 ; How many GET/POST/COOKIE input variables may be accepted max_input_vars = 9999 ; Maximum amount of memory a script may consume (128MB) ; http://php.net/memory-limit memory_limit = 395M ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; Error handling and logging ; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; This directive informs PHP of which errors, warnings and notices you would like ; it to take action for. The recommended way of setting values for this ; directive is through the use of the error level constants and bitwise ; operators. The error level constants are below here for convenience as well as ; some common settings and their meanings. ; By default, PHP is set to take action on all errors, notices and warnings EXCEPT ; those related to E_NOTICE and E_STRICT, which together cover best practices and ; recommended coding standards in PHP. For performance reasons, this is the ; recommend error reporting setting. Your production server shouldn't be wasting ; resources complaining about best practices and coding standards. That's what ; development servers and development settings are for. ; Note: The php.ini-development file has this setting as E_ALL. This ; means it pretty much reports everything which is exactly what you want during ; development and early testing. ; ; Error Level Constants: ; E_ALL - All errors and warnings (includes E_STRICT as of PHP 5.4.0) ; E_ERROR - fatal run-time errors ; E_RECOVERABLE_ERROR - almost fatal run-time errors ; E_WARNING - run-time warnings (non-fatal errors) ; E_PARSE - compile-time parse errors ; E_NOTICE - run-time notices (these are warnings which often result ; from a bug in your code, but it's possible that it was ; intentional (e.g., using an uninitialized variable and ; relying on the fact it is automatically initialized to an ; empty string) ; E_STRICT - run-time notices, enable to have PHP suggest changes ; to your code which will ensure the best interoperability ; and forward compatibility of your code ; E_CORE_ERROR - fatal errors that occur during PHP's initial startup ; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's ; initial startup ; E_COMPILE_ERROR - fatal compile-time errors ; E_COMPILE_WARNING - compile-time warnings (non-fatal errors) ; E_USER_ERROR - user-generated error message ; E_USER_WARNING - user-generated warning message ; E_USER_NOTICE - user-generated notice message ; E_DEPRECATED - warn about code that will not work in future versions ; of PHP ; E_USER_DEPRECATED - user-generated deprecation warnings ; ; Common Values: ; E_ALL (Show all errors, warnings and notices including coding standards.) ; E_ALL & ~E_NOTICE (Show all errors, except for notices) ; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.) ; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors) ; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; http://php.net/error-reporting error_reporting = 1 ; This directive controls whether or not and where PHP will output errors, ; notices and warnings too. Error output is very useful during development, but ; it could be very dangerous in production environments. Depending on the code ; which is triggering the error, sensitive information could potentially leak ; out of your application such as database usernames and passwords or worse. ; For production environments, we recommend logging errors rather than ; sending them to STDOUT. ; Possible Values: ; Off = Do not display any errors ; stderr = Display errors to STDERR (affects only CGI/CLI binaries!) ; On or stdout = Display errors to STDOUT ; Default Value: On ; Development Value: On ; Production Value: Off ; http://php.net/display-errors display_errors = Off ; The display of errors which occur during PHP's startup sequence are handled ; separately from display_errors. PHP's default behavior is to suppress those ; errors from clients. Turning the display of startup errors on can be useful in ; debugging configuration problems. We strongly recommend you ; set this to 'off' for production servers. ; Default Value: Off ; Development Value: On ; Production Value: Off ; http://php.net/display-startup-errors display_startup_errors = Off ; Besides displaying errors, PHP can also log errors to locations such as a ; server-specific log, STDERR, or a location specified by the error_log ; directive found below. While errors should not be displayed on productions ; servers they should still be monitored and logging is a great way to do that. ; Default Value: Off ; Development Value: On ; Production Value: On ; http://php.net/log-errors log_errors = On ; Set maximum length of log_errors. In error_log information about the source is ; added. The default is 1024 and 0 allows to not apply any maximum length at all. ; http://php.net/log-errors-max-len log_errors_max_len = 1024 ; Do not log repeated messages. Repeated errors must occur in same file on same ; line unless ignore_repeated_source is set true. ; http://php.net/ignore-repeated-errors ignore_repeated_errors = Off ; Ignore source of message when ignoring repeated messages. When this setting ; is On you will not log errors with repeated messages from different files or ; source lines. ; http://php.net/ignore-repeated-source ignore_repeated_source = Off ; If this parameter is set to Off, then memory leaks will not be shown (on ; stdout or in the log). This has only effect in a debug compile, and if ; error reporting includes E_WARNING in the allowed list ; http://php.net/report-memleaks report_memleaks = On ; This setting is on by default. ;report_zend_debug = 0 ; Store the last error/warning message in $php_errormsg (boolean). Setting this value ; to On can assist in debugging and is appropriate for development servers. It should ; however be disabled on production servers. ; Default Value: Off ; Development Value: On ; Production Value: Off ; http://php.net/track-errors track_errors = Off ; Turn off normal error reporting and emit XML-RPC error XML ; http://php.net/xmlrpc-errors ;xmlrpc_errors = 0 ; An XML-RPC faultCode ;xmlrpc_error_number = 0 ; When PHP displays or logs an error, it has the capability of formatting the ; error message as HTML for easier reading. This directive controls whether ; the error message is formatted as HTML or not. ; Note: This directive is hardcoded to Off for the CLI SAPI ; Default Value: On ; Development Value: On ; Production value: On ; http://php.net/html-errors html_errors = Off ; If html_errors is set to On *and* docref_root is not empty, then PHP ; produces clickable error messages that direct to a page describing the error ; or function causing the error in detail. ; You can download a copy of the PHP manual from http://php.net/docs ; and change docref_root to the base URL of your local copy including the ; leading '/'. You must also specify the file extension being used including ; the dot. PHP's default behavior is to leave these settings empty, in which ; case no links to documentation are generated. ; Note: Never use this feature for production boxes. ; http://php.net/docref-root ; Examples ;docref_root = "/phpmanual/" ; http://php.net/docref-ext ;docref_ext = .html ; String to output before an error message. PHP's default behavior is to leave ; this setting blank. ; http://php.net/error-prepend-string ; Example: ;error_prepend_string = "" ; String to output after an error message. PHP's default behavior is to leave ; this setting blank. ; http://php.net/error-append-string ; Example: ;error_append_string = "" ; Log errors to specified file. PHP's default behavior is to leave this value ; empty. ; http://php.net/error-log ; Example: ;error_log = php_errors.log ; Log errors to syslog (Event Log on Windows). ;error_log = syslog error_log = /var/log/php/error_log_cli_71 ;windows.show_crt_warning ; Default value: 0 ; Development value: 0 ; Production value: 0 ;;;;;;;;;;;;;;;;; ; Data Handling ; ;;;;;;;;;;;;;;;;; ; The separator used in PHP generated URLs to separate arguments. ; PHP's default setting is "&". ; http://php.net/arg-separator.output ; Example: ;arg_separator.output = "&" ; List of separator(s) used by PHP to parse input URLs into variables. ; PHP's default setting is "&". ; NOTE: Every character in this directive is considered as separator! ; http://php.net/arg-separator.input ; Example: ;arg_separator.input = ";&" ; This directive determines which super global arrays are registered when PHP ; starts up. G,P,C,E & S are abbreviations for the following respective super ; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty ; paid for the registration of these arrays and because ENV is not as commonly ; used as the others, ENV is not recommended on productions servers. You ; can still get access to the environment variables through getenv() should you ; need to. ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS"; ; http://php.net/variables-order variables_order = "GPCS" ; This directive determines which super global data (G,P & C) should be ; registered into the super global array REQUEST. If so, it also determines ; the order in which that data is registered. The values for this directive ; are specified in the same manner as the variables_order directive, ; EXCEPT one. Leaving this value empty will cause PHP to use the value set ; in the variables_order directive. It does not mean it will leave the super ; globals array REQUEST empty. ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; http://php.net/request-order request_order = "GP" ; This directive determines whether PHP registers $argv & $argc each time it ; runs. $argv contains an array of all the arguments passed to PHP when a script ; is invoked. $argc contains an integer representing the number of arguments ; that were passed when the script was invoked. These arrays are extremely ; useful when running scripts from the command line. When this directive is ; enabled, registering these variables consumes CPU cycles and memory each time ; a script is executed. For performance reasons, this feature should be disabled ; on production servers. ; Note: This directive is hardcoded to On for the CLI SAPI ; Default Value: On ; Development Value: Off ; Production Value: Off ; http://php.net/register-argc-argv register_argc_argv = Off ; When enabled, the ENV, REQUEST and SERVER variables are created when they're ; first used (Just In Time) instead of when the script starts. If these ; variables are not used within a script, having this directive on will result ; in a performance gain. The PHP directive register_argc_argv must be disabled ; for this directive to have any affect. ; http://php.net/auto-globals-jit auto_globals_jit = On ; Whether PHP will read the POST data. ; This option is enabled by default. ; Most likely, you won't want to disable this option globally. It causes $_POST ; and $_FILES to always be empty; the only way you will be able to read the ; POST data will be through the php://input stream wrapper. This can be useful ; to proxy requests or to process the POST data in a memory efficient fashion. ; http://php.net/enable-post-data-reading ;enable_post_data_reading = Off ; Maximum size of POST data that PHP will accept. ; Its value may be 0 to disable the limit. It is ignored if POST data reading ; is disabled through enable_post_data_reading. ; http://php.net/post-max-size post_max_size = 350M ; Automatically add files before PHP document. ; http://php.net/auto-prepend-file auto_prepend_file = ; Automatically add files after PHP document. ; http://php.net/auto-append-file auto_append_file = ; By default, PHP will output a media type using the Content-Type header. To ; disable this, simply set it to be empty. ; ; PHP's built-in default media type is set to text/html. ; http://php.net/default-mimetype default_mimetype = "text/html" ; PHP's default character set is set to UTF-8. ; http://php.net/default-charset default_charset = "UTF-8" ; PHP internal character encoding is set to empty. ; If empty, default_charset is used. ; http://php.net/internal-encoding ;internal_encoding = ; PHP input character encoding is set to empty. ; If empty, default_charset is used. ; http://php.net/input-encoding ;input_encoding = ; PHP output character encoding is set to empty. ; If empty, default_charset is used. ; See also output_buffer. ; http://php.net/output-encoding ;output_encoding = ;;;;;;;;;;;;;;;;;;;;;;;;; ; Paths and Directories ; ;;;;;;;;;;;;;;;;;;;;;;;;; ; UNIX: "/path1:/path2" ;include_path = ".:/php/includes" ; ; Windows: "\path1;\path2" ;include_path = ".;c:\php\includes" ; ; PHP's default setting for include_path is ".;/path/to/php/pear" ; http://php.net/include-path include_path = ".:/opt/php71/lib/php" ; The root of the PHP pages, used only if nonempty. ; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root ; if you are running php as a CGI under any web server (other than IIS) ; see documentation for security issues. The alternate is to use the ; cgi.force_redirect configuration below ; http://php.net/doc-root doc_root = ; The directory under which PHP opens the script using /~username used only ; if nonempty. ; http://php.net/user-dir user_dir = ; Directory in which the loadable extensions (modules) reside. ; http://php.net/extension-dir ; extension_dir = "./" ; On windows: ; extension_dir = "ext" extension_dir = "/opt/php71/lib/php/extensions/no-debug-non-zts-20160303/" ; Directory where the temporary files should be placed. ; Defaults to the system default (see sys_get_temp_dir) sys_temp_dir = "/tmp" ; Whether or not to enable the dl() function. The dl() function does NOT work ; properly in multithreaded servers, such as IIS or Zeus, and is automatically ; disabled on them. ; http://php.net/enable-dl enable_dl = Off ; cgi.force_redirect is necessary to provide security running PHP as a CGI under ; most web servers. Left undefined, PHP turns this on by default. You can ; turn it off here AT YOUR OWN RISK ; **You CAN safely turn this off for IIS, in fact, you MUST.** ; http://php.net/cgi.force-redirect ;cgi.force_redirect = 1 ; if cgi.nph is enabled it will force cgi to always sent Status: 200 with ; every request. PHP's default behavior is to disable this feature. ;cgi.nph = 1 ; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape ; (iPlanet) web servers, you MAY need to set an environment variable name that PHP ; will look for to know it is OK to continue execution. Setting this variable MAY ; cause security issues, KNOW WHAT YOU ARE DOING FIRST. ; http://php.net/cgi.redirect-status-env ;cgi.redirect_status_env = ; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's ; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok ; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting ; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting ; of zero causes PHP to behave as before. Default is 1. You should fix your scripts ; to use SCRIPT_FILENAME rather than PATH_TRANSLATED. ; http://php.net/cgi.fix-pathinfo ;cgi.fix_pathinfo=1 ; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside ; of the web tree and people will not be able to circumvent .htaccess security. ; http://php.net/cgi.dicard-path ;cgi.discard_path=1 ; FastCGI under IIS (on WINNT based OS) supports the ability to impersonate ; security tokens of the calling client. This allows IIS to define the ; security context that the request runs under. mod_fastcgi under Apache ; does not currently support this feature (03/17/2002) ; Set to 1 if running under IIS. Default is zero. ; http://php.net/fastcgi.impersonate ;fastcgi.impersonate = 1 ; Disable logging through FastCGI connection. PHP's default behavior is to enable ; this feature. ;fastcgi.logging = 0 ; cgi.rfc2616_headers configuration option tells PHP what type of headers to ; use when sending HTTP response code. If set to 0, PHP sends Status: header that ; is supported by Apache. When this option is set to 1, PHP will send ; RFC2616 compliant header. ; Default is zero. ; http://php.net/cgi.rfc2616-headers ;cgi.rfc2616_headers = 0 ; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #! ; (shebang) at the top of the running script. This line might be needed if the ; script support running both as stand-alone script and via PHP CGI<. PHP in CGI ; mode skips this line and ignores its content if this directive is turned on. ; http://php.net/cgi.check-shebang-line ;cgi.check_shebang_line=1 ;;;;;;;;;;;;;;;; ; File Uploads ; ;;;;;;;;;;;;;;;; ; Whether to allow HTTP file uploads. ; http://php.net/file-uploads file_uploads = On ; Temporary directory for HTTP uploaded files (will use system default if not ; specified). ; http://php.net/upload-tmp-dir upload_tmp_dir = /tmp ; Maximum allowed size for uploaded files. ; http://php.net/upload-max-filesize upload_max_filesize = 325M ; Maximum number of files that can be uploaded via a single request max_file_uploads = 50 ;;;;;;;;;;;;;;;;;; ; Fopen wrappers ; ;;;;;;;;;;;;;;;;;; ; Whether to allow the treatment of URLs (like http:// or ftp://) as files. ; http://php.net/allow-url-fopen allow_url_fopen = On ; Whether to allow include/require to open URLs (like http:// or ftp://) as files. ; http://php.net/allow-url-include allow_url_include = Off ; Define the anonymous ftp password (your email address). PHP's default setting ; for this is empty. ; http://php.net/from ;from="john@doe.com" ; Define the User-Agent string. PHP's default setting for this is empty. ; http://php.net/user-agent ;user_agent="PHP" ; Default timeout for socket based streams (seconds) ; http://php.net/default-socket-timeout default_socket_timeout = 3600 ; If your scripts have to deal with files from Macintosh systems, ; or you are running on a Mac and need to deal with files from ; unix or win32 systems, setting this flag will cause PHP to ; automatically detect the EOL character in those files so that ; fgets() and file() will work regardless of the source of the file. ; http://php.net/auto-detect-line-endings auto_detect_line_endings = On ;;;;;;;;;;;;;;;;;;;;;; ; Dynamic Extensions ; ;;;;;;;;;;;;;;;;;;;;;; ; If you wish to have an extension loaded automatically, use the following ; syntax: ; ; extension=modulename.extension ; ; For example, on Windows: ; ; extension=msql.dll ; ; ... or under UNIX: ; ; extension=msql.so ; ; ... or with a path: ; ; extension=/path/to/extension/msql.so ; ; If you only provide the name of the extension, PHP will look for it in its ; default extension directory. ; ; Windows Extensions ; Note that many DLL files are located in the extensions/ (PHP 4) ext/ (PHP 5+) ; extension folders as well as the separate PECL DLL download (PHP 5+). ; Be sure to appropriately set the extension_dir directive. ; ;extension=php_bz2.dll ;extension=php_curl.dll ;extension=php_fileinfo.dll ;extension=php_ftp.dll ;extension=php_gd2.dll ;extension=php_gettext.dll ;extension=php_gmp.dll ;extension=php_intl.dll ;extension=php_imap.dll ;extension=php_interbase.dll ;extension=php_ldap.dll ;extension=php_mbstring.dll ;extension=php_exif.dll ; Must be after mbstring as it depends on it ;extension=php_mysqli.dll ;extension=php_oci8_12c.dll ; Use with Oracle Database 12c Instant Client ;extension=php_odbc.dll ;extension=php_openssl.dll ;extension=php_pdo_firebird.dll ;extension=php_pdo_mysql.dll ;extension=php_pdo_oci.dll ;extension=php_pdo_odbc.dll ;extension=php_pdo_pgsql.dll ;extension=php_pdo_sqlite.dll ;extension=php_pgsql.dll ;extension=php_shmop.dll ; The MIBS data available in the PHP distribution must be installed. ; See http://www.php.net/manual/en/snmp.installation.php ;extension=php_snmp.dll ;extension=php_soap.dll ;extension=php_sockets.dll ;extension=php_sqlite3.dll ;extension=php_tidy.dll ;extension=php_xmlrpc.dll ;extension=php_xsl.dll ;;;;;;;;;;;;;;;;;;; ; Module Settings ; ;;;;;;;;;;;;;;;;;;; [CLI Server] ; Whether the CLI web server uses ANSI color coding in its terminal output. cli_server.color = On [Date] ; Defines the default timezone used by the date functions ; http://php.net/date.timezone date.timezone = "UTC" ; http://php.net/date.default-latitude ;date.default_latitude = 31.7667 ; http://php.net/date.default-longitude ;date.default_longitude = 35.2333 ; http://php.net/date.sunrise-zenith ;date.sunrise_zenith = 90.583333 ; http://php.net/date.sunset-zenith ;date.sunset_zenith = 90.583333 [filter] ; http://php.net/filter.default ;filter.default = unsafe_raw ; http://php.net/filter.default-flags ;filter.default_flags = [iconv] ; Use of this INI entry is deprecated, use global input_encoding instead. ; If empty, default_charset or input_encoding or iconv.input_encoding is used. ; The precedence is: default_charset < intput_encoding < iconv.input_encoding ;iconv.input_encoding = ; Use of this INI entry is deprecated, use global internal_encoding instead. ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;iconv.internal_encoding = ; Use of this INI entry is deprecated, use global output_encoding instead. ; If empty, default_charset or output_encoding or iconv.output_encoding is used. ; The precedence is: default_charset < output_encoding < iconv.output_encoding ; To use an output encoding conversion, iconv's output handler must be set ; otherwise output encoding conversion cannot be performed. ;iconv.output_encoding = [intl] ;intl.default_locale = ; This directive allows you to produce PHP errors when some error ; happens within intl functions. The value is the level of the error produced. ; Default is 0, which does not produce any errors. ;intl.error_level = E_WARNING ;intl.use_exceptions = 0 [sqlite3] ;sqlite3.extension_dir = [Pcre] ;PCRE library backtracking limit. ; http://php.net/pcre.backtrack-limit ;pcre.backtrack_limit=100000 ;PCRE library recursion limit. ;Please note that if you set this value to a high number you may consume all ;the available process stack and eventually crash PHP (due to reaching the ;stack size limit imposed by the Operating System). ; http://php.net/pcre.recursion-limit ;pcre.recursion_limit=100000 ;Enables or disables JIT compilation of patterns. This requires the PCRE ;library to be compiled with JIT support. ;pcre.jit=1 [Pdo] ; Whether to pool ODBC connections. Can be one of "strict", "relaxed" or "off" ; http://php.net/pdo-odbc.connection-pooling ;pdo_odbc.connection_pooling=strict ;pdo_odbc.db2_instance_name [Pdo_mysql] ; If mysqlnd is used: Number of cache slots for the internal result set cache ; http://php.net/pdo_mysql.cache_size pdo_mysql.cache_size = 2000 ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. ; http://php.net/pdo_mysql.default-socket pdo_mysql.default_socket= [Phar] ; http://php.net/phar.readonly ;phar.readonly = On ; http://php.net/phar.require-hash ;phar.require_hash = On ;phar.cache_list = [mail function] ; For Win32 only. ; http://php.net/smtp ;SMTP = localhost ; http://php.net/smtp-port ;smtp_port = 25 ; For Win32 only. ; http://php.net/sendmail-from ;sendmail_from = me@example.com ; For Unix only. You may supply arguments as well (default: "sendmail -t -i"). ; http://php.net/sendmail-path sendmail_path = /usr/sbin/sendmail -t -i ; Force the addition of the specified parameters to be passed as extra parameters ; to the sendmail binary. These parameters will always replace the value of ; the 5th parameter to mail(). ;mail.force_extra_parameters = ; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename mail.add_x_header = Off ; The path to a log file that will log all mail() calls. Log entries include ; the full path of the script, line number, To address and headers. ;mail.log = ; Log mail to syslog (Event Log on Windows). ;mail.log = syslog [SQL] ; http://php.net/sql.safe-mode sql.safe_mode = Off [ODBC] ; http://php.net/odbc.default-db ;odbc.default_db = Not yet implemented ; http://php.net/odbc.default-user ;odbc.default_user = Not yet implemented ; http://php.net/odbc.default-pw ;odbc.default_pw = Not yet implemented ; Controls the ODBC cursor model. ; Default: SQL_CURSOR_STATIC (default). ;odbc.default_cursortype ; Allow or prevent persistent links. ; http://php.net/odbc.allow-persistent odbc.allow_persistent = On ; Check that a connection is still valid before reuse. ; http://php.net/odbc.check-persistent odbc.check_persistent = On ; Maximum number of persistent links. -1 means no limit. ; http://php.net/odbc.max-persistent odbc.max_persistent = -1 ; Maximum number of links (persistent + non-persistent). -1 means no limit. ; http://php.net/odbc.max-links odbc.max_links = -1 ; Handling of LONG fields. Returns number of bytes to variables. 0 means ; passthru. ; http://php.net/odbc.defaultlrl odbc.defaultlrl = 4096 ; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char. ; See the documentation on odbc_binmode and odbc_longreadlen for an explanation ; of odbc.defaultlrl and odbc.defaultbinmode ; http://php.net/odbc.defaultbinmode odbc.defaultbinmode = 1 ;birdstep.max_links = -1 [Interbase] ; Allow or prevent persistent links. ibase.allow_persistent = 1 ; Maximum number of persistent links. -1 means no limit. ibase.max_persistent = -1 ; Maximum number of links (persistent + non-persistent). -1 means no limit. ibase.max_links = -1 ; Default database name for ibase_connect(). ;ibase.default_db = ; Default username for ibase_connect(). ;ibase.default_user = ; Default password for ibase_connect(). ;ibase.default_password = ; Default charset for ibase_connect(). ;ibase.default_charset = ; Default timestamp format. ibase.timestampformat = "%Y-%m-%d %H:%M:%S" ; Default date format. ibase.dateformat = "%Y-%m-%d" ; Default time format. ibase.timeformat = "%H:%M:%S" [MySQLi] ; Maximum number of persistent links. -1 means no limit. ; http://php.net/mysqli.max-persistent mysqli.max_persistent = -1 ; Allow accessing, from PHP's perspective, local files with LOAD DATA statements ; http://php.net/mysqli.allow_local_infile ;mysqli.allow_local_infile = On ; Allow or prevent persistent links. ; http://php.net/mysqli.allow-persistent mysqli.allow_persistent = On ; Maximum number of links. -1 means no limit. ; http://php.net/mysqli.max-links mysqli.max_links = -1 ; If mysqlnd is used: Number of cache slots for the internal result set cache ; http://php.net/mysqli.cache_size mysqli.cache_size = 2000 ; Default port number for mysqli_connect(). If unset, mysqli_connect() will use ; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the ; compile-time value defined MYSQL_PORT (in that order). Win32 will only look ; at MYSQL_PORT. ; http://php.net/mysqli.default-port mysqli.default_port = 3306 ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. ; http://php.net/mysqli.default-socket mysqli.default_socket = ; Default host for mysql_connect() (doesn't apply in safe mode). ; http://php.net/mysqli.default-host mysqli.default_host = ; Default user for mysql_connect() (doesn't apply in safe mode). ; http://php.net/mysqli.default-user mysqli.default_user = ; Default password for mysqli_connect() (doesn't apply in safe mode). ; Note that this is generally a *bad* idea to store passwords in this file. ; *Any* user with PHP access can run 'echo get_cfg_var("mysqli.default_pw") ; and reveal this password! And of course, any users with read access to this ; file will be able to reveal the password as well. ; http://php.net/mysqli.default-pw mysqli.default_pw = ; Allow or prevent reconnect mysqli.reconnect = Off [mysqlnd] ; Enable / Disable collection of general statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. ; http://php.net/mysqlnd.collect_statistics mysqlnd.collect_statistics = 0 ; Enable / Disable collection of memory usage statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. ; http://php.net/mysqlnd.collect_memory_statistics mysqlnd.collect_memory_statistics = 0 ; Records communication from all extensions using mysqlnd to the specified log ; file. ; http://php.net/mysqlnd.debug ;mysqlnd.debug = ; Defines which queries will be logged. ; http://php.net/mysqlnd.log_mask ;mysqlnd.log_mask = 0 ; Default size of the mysqlnd memory pool, which is used by result sets. ; http://php.net/mysqlnd.mempool_default_size mysqlnd.mempool_default_size = 64000 ; Size of a pre-allocated buffer used when sending commands to MySQL in bytes. ; http://php.net/mysqlnd.net_cmd_buffer_size mysqlnd.net_cmd_buffer_size = 8192 ; Size of a pre-allocated buffer used for reading data sent by the server in ; bytes. ; http://php.net/mysqlnd.net_read_buffer_size mysqlnd.net_read_buffer_size = 131072 ; Timeout for network requests in seconds. ; http://php.net/mysqlnd.net_read_timeout ;mysqlnd.net_read_timeout = 31536000 ; SHA-256 Authentication Plugin related. File with the MySQL server public RSA ; key. ; http://php.net/mysqlnd.sha256_server_public_key ;mysqlnd.sha256_server_public_key = [OCI8] ; Connection: Enables privileged connections using external ; credentials (OCI_SYSOPER, OCI_SYSDBA) ; http://php.net/oci8.privileged-connect ;oci8.privileged_connect = Off ; Connection: The maximum number of persistent OCI8 connections per ; process. Using -1 means no limit. ; http://php.net/oci8.max-persistent ;oci8.max_persistent = -1 ; Connection: The maximum number of seconds a process is allowed to ; maintain an idle persistent connection. Using -1 means idle ; persistent connections will be maintained forever. ; http://php.net/oci8.persistent-timeout ;oci8.persistent_timeout = -1 ; Connection: The number of seconds that must pass before issuing a ; ping during oci_pconnect() to check the connection validity. When ; set to 0, each oci_pconnect() will cause a ping. Using -1 disables ; pings completely. ; http://php.net/oci8.ping-interval ;oci8.ping_interval = 60 ; Connection: Set this to a user chosen connection class to be used ; for all pooled server requests with Oracle 11g Database Resident ; Connection Pooling (DRCP). To use DRCP, this value should be set to ; the same string for all web servers running the same application, ; the database pool must be configured, and the connection string must ; specify to use a pooled server. ;oci8.connection_class = ; High Availability: Using On lets PHP receive Fast Application ; Notification (FAN) events generated when a database node fails. The ; database must also be configured to post FAN events. ;oci8.events = Off ; Tuning: This option enables statement caching, and specifies how ; many statements to cache. Using 0 disables statement caching. ; http://php.net/oci8.statement-cache-size ;oci8.statement_cache_size = 20 ; Tuning: Enables statement prefetching and sets the default number of ; rows that will be fetched automatically after statement execution. ; http://php.net/oci8.default-prefetch ;oci8.default_prefetch = 100 ; Compatibility. Using On means oci_close() will not close ; oci_connect() and oci_new_connect() connections. ; http://php.net/oci8.old-oci-close-semantics ;oci8.old_oci_close_semantics = Off [PostgreSQL] ; Allow or prevent persistent links. ; http://php.net/pgsql.allow-persistent pgsql.allow_persistent = On ; Detect broken persistent links always with pg_pconnect(). ; Auto reset feature requires a little overheads. ; http://php.net/pgsql.auto-reset-persistent pgsql.auto_reset_persistent = Off ; Maximum number of persistent links. -1 means no limit. ; http://php.net/pgsql.max-persistent pgsql.max_persistent = -1 ; Maximum number of links (persistent+non persistent). -1 means no limit. ; http://php.net/pgsql.max-links pgsql.max_links = -1 ; Ignore PostgreSQL backends Notice message or not. ; Notice message logging require a little overheads. ; http://php.net/pgsql.ignore-notice pgsql.ignore_notice = 0 ; Log PostgreSQL backends Notice message or not. ; Unless pgsql.ignore_notice=0, module cannot log notice message. ; http://php.net/pgsql.log-notice pgsql.log_notice = 0 [bcmath] ; Number of decimal digits for all bcmath functions. ; http://php.net/bcmath.scale bcmath.scale = 0 [browscap] ; http://php.net/browscap ;browscap = extra/browscap.ini [Session] ; Handler used to store/retrieve data. ; http://php.net/session.save-handler session.save_handler = files ; Argument passed to save_handler. In the case of files, this is the path ; where data files are stored. Note: Windows users have to change this ; variable in order to use PHP's session functions. ; ; The path can be defined as: ; ; session.save_path = "N;/path" ; ; where N is an integer. Instead of storing all the session files in ; /path, what this will do is use subdirectories N-levels deep, and ; store the session data in those directories. This is useful if ; your OS has problems with many files in one directory, and is ; a more efficient layout for servers that handle many sessions. ; ; NOTE 1: PHP will not create this directory structure automatically. ; You can use the script in the ext/session dir for that purpose. ; NOTE 2: See the section on garbage collection below if you choose to ; use subdirectories for session storage ; ; The file storage module creates files using mode 600 by default. ; You can change that by using ; ; session.save_path = "N;MODE;/path" ; ; where MODE is the octal representation of the mode. Note that this ; does not overwrite the process's umask. ; http://php.net/session.save-path session.save_path = "/opt/tmp" ; Whether to use strict session mode. ; Strict session mode does not accept uninitialized session ID and regenerate ; session ID if browser sends uninitialized session ID. Strict mode protects ; applications from session fixation via session adoption vulnerability. It is ; disabled by default for maximum compatibility, but enabling it is encouraged. ; https://wiki.php.net/rfc/strict_sessions session.use_strict_mode = 0 ; Whether to use cookies. ; http://php.net/session.use-cookies session.use_cookies = 1 ; http://php.net/session.cookie-secure ;session.cookie_secure = ; This option forces PHP to fetch and use a cookie for storing and maintaining ; the session id. We encourage this operation as it's very helpful in combating ; session hijacking when not specifying and managing your own session id. It is ; not the be-all and end-all of session hijacking defense, but it's a good start. ; http://php.net/session.use-only-cookies session.use_only_cookies = 1 ; Name of the session (used as cookie name). ; http://php.net/session.name session.name = PHPSESSID ; Initialize session on request startup. ; http://php.net/session.auto-start session.auto_start = 0 ; Lifetime in seconds of cookie or, if 0, until browser is restarted. ; http://php.net/session.cookie-lifetime session.cookie_lifetime = 0 ; The path for which the cookie is valid. ; http://php.net/session.cookie-path session.cookie_path = / ; The domain for which the cookie is valid. ; http://php.net/session.cookie-domain session.cookie_domain = ; Whether or not to add the httpOnly flag to the cookie, which makes it inaccessible to browser scripting languages such as JavaScript. ; http://php.net/session.cookie-httponly session.cookie_httponly = 1 ; Handler used to serialize data. php is the standard serializer of PHP. ; http://php.net/session.serialize-handler session.serialize_handler = php ; Defines the probability that the 'garbage collection' process is started ; on every session initialization. The probability is calculated by using ; gc_probability/gc_divisor. Where session.gc_probability is the numerator ; and gc_divisor is the denominator in the equation. Setting this value to 1 ; when the session.gc_divisor value is 100 will give you approximately a 1% chance ; the gc will run on any give request. ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; http://php.net/session.gc-probability session.gc_probability = 1 ; Defines the probability that the 'garbage collection' process is started on every ; session initialization. The probability is calculated by using the following equation: ; gc_probability/gc_divisor. Where session.gc_probability is the numerator and ; session.gc_divisor is the denominator in the equation. Setting this value to 1 ; when the session.gc_divisor value is 100 will give you approximately a 1% chance ; the gc will run on any give request. Increasing this value to 1000 will give you ; a 0.1% chance the gc will run on any give request. For high volume production servers, ; this is a more efficient approach. ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; http://php.net/session.gc-divisor session.gc_divisor = 1000 ; After this number of seconds, stored data will be seen as 'garbage' and ; cleaned up by the garbage collection process. ; http://php.net/session.gc-maxlifetime session.gc_maxlifetime = 1440 ; NOTE: If you are using the subdirectory option for storing session files ; (see session.save_path above), then garbage collection does *not* ; happen automatically. You will need to do your own garbage ; collection through a shell script, cron entry, or some other method. ; For example, the following script would is the equivalent of ; setting session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes): ; find /path/to/sessions -cmin +24 -type f | xargs rm ; Check HTTP Referer to invalidate externally stored URLs containing ids. ; HTTP_REFERER has to contain this substring for the session to be ; considered as valid. ; http://php.net/session.referer-check session.referer_check = ; Set to {nocache,private,public,} to determine HTTP caching aspects ; or leave this empty to avoid sending anti-caching headers. ; http://php.net/session.cache-limiter session.cache_limiter = nocache ; Document expires after n minutes. ; http://php.net/session.cache-expire session.cache_expire = 180 ; trans sid support is disabled by default. ; Use of trans sid may risk your users' security. ; Use this option with caution. ; - User may send URL contains active session ID ; to other person via. email/irc/etc. ; - URL that contains active session ID may be stored ; in publicly accessible computer. ; - User may access your site with the same session ID ; always using URL stored in browser's history or bookmarks. ; http://php.net/session.use-trans-sid session.use_trans_sid = 0 ; Set session ID character length. This value could be between 22 to 256. ; Shorter length than default is supported only for compatibility reason. ; Users should use 32 or more chars. ; http://php.net/session.sid-length ; Default Value: 32 ; Development Value: 26 ; Production Value: 26 session.sid_length = 26 ; The URL rewriter will look for URLs in a defined set of HTML tags. ;
is special; if you include them here, the rewriter will ; add a hidden field with the info which is otherwise appended ; to URLs. tag's action attribute URL will not be modified ; unless it is specified. ; Note that all valid entries require a "=", even if no value follows. ; Default Value: "a=href,area=href,frame=src,form=" ; Development Value: "a=href,area=href,frame=src,form=" ; Production Value: "a=href,area=href,frame=src,form=" ; http://php.net/url-rewriter.tags session.trans_sid_tags = "a=href,area=href,frame=src,form=" ; URL rewriter does not rewrite absolute URLs by default. ; To enable rewrites for absolute pathes, target hosts must be specified ; at RUNTIME. i.e. use ini_set() ; tags is special. PHP will check action attribute's URL regardless ; of session.trans_sid_tags setting. ; If no host is defined, HTTP_HOST will be used for allowed host. ; Example value: php.net,www.php.net,wiki.php.net ; Use "," for multiple hosts. No spaces are allowed. ; Default Value: "" ; Development Value: "" ; Production Value: "" ;session.trans_sid_hosts="" ; Define how many bits are stored in each character when converting ; the binary hash data to something readable. ; Possible values: ; 4 (4 bits: 0-9, a-f) ; 5 (5 bits: 0-9, a-v) ; 6 (6 bits: 0-9, a-z, A-Z, "-", ",") ; Default Value: 4 ; Development Value: 5 ; Production Value: 5 ; http://php.net/session.hash-bits-per-character session.sid_bits_per_character = 5 ; Enable upload progress tracking in $_SESSION ; Default Value: On ; Development Value: On ; Production Value: On ; http://php.net/session.upload-progress.enabled ;session.upload_progress.enabled = On ; Cleanup the progress information as soon as all POST data has been read ; (i.e. upload completed). ; Default Value: On ; Development Value: On ; Production Value: On ; http://php.net/session.upload-progress.cleanup ;session.upload_progress.cleanup = On ; A prefix used for the upload progress key in $_SESSION ; Default Value: "upload_progress_" ; Development Value: "upload_progress_" ; Production Value: "upload_progress_" ; http://php.net/session.upload-progress.prefix ;session.upload_progress.prefix = "upload_progress_" ; The index name (concatenated with the prefix) in $_SESSION ; containing the upload progress information ; Default Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Development Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Production Value: "PHP_SESSION_UPLOAD_PROGRESS" ; http://php.net/session.upload-progress.name ;session.upload_progress.name = "PHP_SESSION_UPLOAD_PROGRESS" ; How frequently the upload progress should be updated. ; Given either in percentages (per-file), or in bytes ; Default Value: "1%" ; Development Value: "1%" ; Production Value: "1%" ; http://php.net/session.upload-progress.freq ;session.upload_progress.freq = "1%" ; The minimum delay between updates, in seconds ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; http://php.net/session.upload-progress.min-freq ;session.upload_progress.min_freq = "1" ; Only write session data when session data is changed. Enabled by default. ; http://php.net/session.lazy-write ;session.lazy_write = On [Assertion] ; Switch whether to compile assertions at all (to have no overhead at run-time) ; -1: Do not compile at all ; 0: Jump over assertion at run-time ; 1: Execute assertions ; Changing from or to a negative value is only possible in php.ini! (For turning assertions on and off at run-time, see assert.active, when zend.assertions = 1) ; Default Value: 1 ; Development Value: 1 ; Production Value: -1 ; http://php.net/zend.assertions zend.assertions = -1 ; Assert(expr); active by default. ; http://php.net/assert.active ;assert.active = On ; Throw an AssertationException on failed assertions ; http://php.net/assert.exception ;assert.exception = On ; Issue a PHP warning for each failed assertion. (Overridden by assert.exception if active) ; http://php.net/assert.warning ;assert.warning = On ; Don't bail out by default. ; http://php.net/assert.bail ;assert.bail = Off ; User-function to be called if an assertion fails. ; http://php.net/assert.callback ;assert.callback = 0 ; Eval the expression with current error_reporting(). Set to true if you want ; error_reporting(0) around the eval(). ; http://php.net/assert.quiet-eval ;assert.quiet_eval = 0 [COM] ; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs ; http://php.net/com.typelib-file ;com.typelib_file = ; allow Distributed-COM calls ; http://php.net/com.allow-dcom ;com.allow_dcom = true ; autoregister constants of a components typlib on com_load() ; http://php.net/com.autoregister-typelib ;com.autoregister_typelib = true ; register constants casesensitive ; http://php.net/com.autoregister-casesensitive ;com.autoregister_casesensitive = false ; show warnings on duplicate constant registrations ; http://php.net/com.autoregister-verbose ;com.autoregister_verbose = true ; The default character set code-page to use when passing strings to and from COM objects. ; Default: system ANSI code page ;com.code_page= [mbstring] ; language for internal character representation. ; This affects mb_send_mail() and mbstring.detect_order. ; http://php.net/mbstring.language ;mbstring.language = Japanese ; Use of this INI entry is deprecated, use global internal_encoding instead. ; internal/script encoding. ; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*) ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;mbstring.internal_encoding = ; Use of this INI entry is deprecated, use global input_encoding instead. ; http input encoding. ; mbstring.encoding_traslation = On is needed to use this setting. ; If empty, default_charset or input_encoding or mbstring.input is used. ; The precedence is: default_charset < intput_encoding < mbsting.http_input ; http://php.net/mbstring.http-input ;mbstring.http_input = ; Use of this INI entry is deprecated, use global output_encoding instead. ; http output encoding. ; mb_output_handler must be registered as output buffer to function. ; If empty, default_charset or output_encoding or mbstring.http_output is used. ; The precedence is: default_charset < output_encoding < mbstring.http_output ; To use an output encoding conversion, mbstring's output handler must be set ; otherwise output encoding conversion cannot be performed. ; http://php.net/mbstring.http-output ;mbstring.http_output = ; enable automatic encoding translation according to ; mbstring.internal_encoding setting. Input chars are ; converted to internal encoding by setting this to On. ; Note: Do _not_ use automatic encoding translation for ; portable libs/applications. ; http://php.net/mbstring.encoding-translation ;mbstring.encoding_translation = Off ; automatic encoding detection order. ; "auto" detect order is changed according to mbstring.language ; http://php.net/mbstring.detect-order ;mbstring.detect_order = auto ; substitute_character used when character cannot be converted ; one from another ; http://php.net/mbstring.substitute-character ;mbstring.substitute_character = none ; overload(replace) single byte functions by mbstring functions. ; mail(), ereg(), etc are overloaded by mb_send_mail(), mb_ereg(), ; etc. Possible values are 0,1,2,4 or combination of them. ; For example, 7 for overload everything. ; 0: No overload ; 1: Overload mail() function ; 2: Overload str*() functions ; 4: Overload ereg*() functions ; http://php.net/mbstring.func-overload ;mbstring.func_overload = 0 ; enable strict encoding detection. ; Default: Off ;mbstring.strict_detection = On ; This directive specifies the regex pattern of content types for which mb_output_handler() ; is activated. ; Default: mbstring.http_output_conv_mimetype=^(text/|application/xhtml\+xml) ;mbstring.http_output_conv_mimetype= [gd] ; Tell the jpeg decode to ignore warnings and try to create ; a gd image. The warning will then be displayed as notices ; disabled by default ; http://php.net/gd.jpeg-ignore-warning ;gd.jpeg_ignore_warning = 1 [exif] ; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS. ; With mbstring support this will automatically be converted into the encoding ; given by corresponding encode setting. When empty mbstring.internal_encoding ; is used. For the decode settings you can distinguish between motorola and ; intel byte order. A decode setting cannot be empty. ; http://php.net/exif.encode-unicode ;exif.encode_unicode = ISO-8859-15 ; http://php.net/exif.decode-unicode-motorola ;exif.decode_unicode_motorola = UCS-2BE ; http://php.net/exif.decode-unicode-intel ;exif.decode_unicode_intel = UCS-2LE ; http://php.net/exif.encode-jis ;exif.encode_jis = ; http://php.net/exif.decode-jis-motorola ;exif.decode_jis_motorola = JIS ; http://php.net/exif.decode-jis-intel ;exif.decode_jis_intel = JIS [Tidy] ; The path to a default tidy configuration file to use when using tidy ; http://php.net/tidy.default-config ;tidy.default_config = /usr/local/lib/php/default.tcfg ; Should tidy clean and repair output automatically? ; WARNING: Do not use this option if you are generating non-html content ; such as dynamic images ; http://php.net/tidy.clean-output tidy.clean_output = Off [soap] ; Enables or disables WSDL caching feature. ; http://php.net/soap.wsdl-cache-enabled soap.wsdl_cache_enabled=1 ; Sets the directory name where SOAP extension will put cache files. ; http://php.net/soap.wsdl-cache-dir soap.wsdl_cache_dir="/tmp" ; (time to live) Sets the number of second while cached file will be used ; instead of original one. ; http://php.net/soap.wsdl-cache-ttl soap.wsdl_cache_ttl=86400 ; Sets the size of the cache limit. (Max. number of WSDL files to cache) soap.wsdl_cache_limit = 5 [sysvshm] ; A default size of the shared memory segment ;sysvshm.init_mem = 10000 [ldap] ; Sets the maximum number of open links or -1 for unlimited. ldap.max_links = -1 [mcrypt] ; For more information about mcrypt settings see http://php.net/mcrypt-module-open ; Directory where to load mcrypt algorithms ; Default: Compiled in into libmcrypt (usually /usr/local/lib/libmcrypt) ;mcrypt.algorithms_dir= ; Directory where to load mcrypt modes ; Default: Compiled in into libmcrypt (usually /usr/local/lib/libmcrypt) ;mcrypt.modes_dir= [dba] ;dba.default_handler= [opcache] ; Determines if Zend OPCache is enabled ;opcache.enable=0 ; Determines if Zend OPCache is enabled for the CLI version of PHP ;opcache.enable_cli=0 ; The OPcache shared memory storage size. ;opcache.memory_consumption=128 ; The amount of memory for interned strings in Mbytes. ;opcache.interned_strings_buffer=8 ; The maximum number of keys (scripts) in the OPcache hash table. ; Only numbers between 200 and 1000000 are allowed. ;opcache.max_accelerated_files=10000 ; The maximum percentage of "wasted" memory until a restart is scheduled. ;opcache.max_wasted_percentage=5 ; When this directive is enabled, the OPcache appends the current working ; directory to the script key, thus eliminating possible collisions between ; files with the same name (basename). Disabling the directive improves ; performance, but may break existing applications. ;opcache.use_cwd=1 ; When disabled, you must reset the OPcache manually or restart the ; webserver for changes to the filesystem to take effect. ;opcache.validate_timestamps=1 ; How often (in seconds) to check file timestamps for changes to the shared ; memory storage allocation. ("1" means validate once per second, but only ; once per request. "0" means always validate) ;opcache.revalidate_freq=2 ; Enables or disables file search in include_path optimization ;opcache.revalidate_path=0 ; If disabled, all PHPDoc comments are dropped from the code to reduce the ; size of the optimized code. ;opcache.save_comments=1 ; If enabled, a fast shutdown sequence is used for the accelerated code ; Depending on the used Memory Manager this may cause some incompatibilities. ;opcache.fast_shutdown=0 ; Allow file existence override (file_exists, etc.) performance feature. ;opcache.enable_file_override=0 ; A bitmask, where each bit enables or disables the appropriate OPcache ; passes ;opcache.optimization_level=0xffffffff ;opcache.inherited_hack=1 ;opcache.dups_fix=0 ; The location of the OPcache blacklist file (wildcards allowed). ; Each OPcache blacklist file is a text file that holds the names of files ; that should not be accelerated. The file format is to add each filename ; to a new line. The filename may be a full path or just a file prefix ; (i.e., /var/www/x blacklists all the files and directories in /var/www ; that start with 'x'). Line starting with a ; are ignored (comments). ;opcache.blacklist_filename= ; Allows exclusion of large files from being cached. By default all files ; are cached. ;opcache.max_file_size=0 ; Check the cache checksum each N requests. ; The default value of "0" means that the checks are disabled. ;opcache.consistency_checks=0 ; How long to wait (in seconds) for a scheduled restart to begin if the cache ; is not being accessed. ;opcache.force_restart_timeout=180 ; OPcache error_log file name. Empty string assumes "stderr". ;opcache.error_log= ; All OPcache errors go to the Web server log. ; By default, only fatal errors (level 0) or errors (level 1) are logged. ; You can also enable warnings (level 2), info messages (level 3) or ; debug messages (level 4). ;opcache.log_verbosity_level=1 ; Preferred Shared Memory back-end. Leave empty and let the system decide. ;opcache.preferred_memory_model= ; Protect the shared memory from unexpected writing during script execution. ; Useful for internal debugging only. ;opcache.protect_memory=0 ; Allows calling OPcache API functions only from PHP scripts which path is ; started from specified string. The default "" means no restriction ;opcache.restrict_api= ; Mapping base of shared memory segments (for Windows only). All the PHP ; processes have to map shared memory into the same address space. This ; directive allows to manually fix the "Unable to reattach to base address" ; errors. ;opcache.mmap_base= ; Enables and sets the second level cache directory. ; It should improve performance when SHM memory is full, at server restart or ; SHM reset. The default "" disables file based caching. ;opcache.file_cache= ; Enables or disables opcode caching in shared memory. ;opcache.file_cache_only=0 ; Enables or disables checksum validation when script loaded from file cache. ;opcache.file_cache_consistency_checks=1 ; Implies opcache.file_cache_only=1 for a certain process that failed to ; reattach to the shared memory (for Windows only). Explicitly enabled file ; cache is required. ;opcache.file_cache_fallback=1 ; Enables or disables copying of PHP code (text segment) into HUGE PAGES. ; This should improve performance, but requires appropriate OS configuration. ;opcache.huge_code_pages=0 ; Validate cached file permissions. ;opcache.validate_permission=0 ; Prevent name collisions in chroot'ed environment. ;opcache.validate_root=0 ; If specified, it produces opcode dumps for debugging different stages of ; optimizations. ;opcache.opt_debug_level=0 [curl] ; A default value for the CURLOPT_CAINFO option. This is required to be an ; absolute path. ;curl.cainfo = [openssl] ; The location of a Certificate Authority (CA) file on the local filesystem ; to use when verifying the identity of SSL/TLS peers. Most users should ; not specify a value for this directive as PHP will attempt to use the ; OS-managed cert stores in its absence. If specified, this value may still ; be overridden on a per-stream basis via the "cafile" SSL stream context ; option. ;openssl.cafile= ; If openssl.cafile is not specified or if the CA file is not found, the ; directory pointed to by openssl.capath is searched for a suitable ; certificate. This value must be a correctly hashed certificate directory. ; Most users should not specify a value for this directive as PHP will ; attempt to use the OS-managed cert stores in its absence. If specified, ; this value may still be overridden on a per-stream basis via the "capath" ; SSL stream context option. ;openssl.capath= ; Local Variables: ; tab-width: 4 ; End: [Zend] zend_extension="/usr/local/ioncube/ioncube_loader_lin_7.1.so" ; fix for segfaults auto_globals_jit = Off cgi.fix_pathinfo = 1 mbstring.http_input = "pass" mbstring.http_output = "pass" mbstring.encoding_translation = 0 ; Enable Extensions extension=uploadprogress.so extension=imagick.so extension=jsmin.so extension=redis.so ================================================ FILE: aegir/conf/php/php71-fpm ================================================ #!/bin/bash ### BEGIN INIT INFO # Provides: php71-fpm # Required-Start: $remote_fs $network # Required-Stop: $remote_fs $network # Default-Start: 2 3 4 5 # Default-Stop: 0 1 6 # Short-Description: starts php71-fpm # Description: starts the PHP FastCGI Process Manager daemon ### END INIT INFO prefix=/opt/php71 exec_prefix=${prefix} php_fpm_BIN=/opt/php71/sbin/php-fpm php_fpm_CONF=/opt/php71/etc/php71-fpm.conf php_fpm_PID=/run/php71-fpm.pid php_opts="--fpm-config $php_fpm_CONF --pid $php_fpm_PID -c /opt/php71/etc/php71.ini" wait_for_pid() { try=0 while test $try -lt 5; do case "$1" in 'created') if [ -f "$2" ]; then try='' break fi ;; 'removed') if [ ! -f "$2" ]; then try='' break fi ;; esac echo -n . try=`expr $try + 1` sleep 1 done } case "$1" in start) echo -n "Starting php71-fpm..." $php_fpm_BIN --daemonize $php_opts if [ "$?" != 0 ]; then echo " failed" exit 1 fi wait_for_pid created $php_fpm_PID if [ -n "$try" ]; then echo " failed" exit 1 else echo " done" fi ;; stop) echo -n "Gracefully shutting down php71-fpm..." if [ ! -r $php_fpm_PID ]; then echo "warning, no pid file found - php71-fpm is not running ?" exit 1 fi kill -QUIT `cat $php_fpm_PID` wait_for_pid removed $php_fpm_PID if [ -n "$try" ]; then echo " failed. Use force-quit" exit 1 else echo " done" fi ;; status) if [ ! -r $php_fpm_PID ]; then echo "php71-fpm is stopped" exit 0 fi PID=`cat $php_fpm_PID` if ps -p $PID | grep -q $PID; then echo "php71-fpm (pid $PID) is running..." else echo "php71-fpm dead but pid file exists" fi ;; force-quit) echo -n "Terminating php71-fpm..." if [ ! -r $php_fpm_PID ]; then echo "warning, no pid file found - php71-fpm is not running ?" exit 1 fi kill -TERM `cat $php_fpm_PID` wait_for_pid removed $php_fpm_PID if [ -n "$try" ]; then echo " failed" exit 1 else echo " done" fi ;; restart) $0 stop $0 start ;; reload) echo -n "Reloading service php71-fpm..." if [ ! -r $php_fpm_PID ]; then echo "warning, no pid file found - php71-fpm is not running ?" exit 1 fi kill -USR2 `cat $php_fpm_PID` echo " done" ;; configtest) $php_fpm_BIN -t ;; *) echo "Usage: $0 {start|stop|force-quit|restart|reload|status|configtest}" exit 1 ;; esac ================================================ FILE: aegir/conf/php/php71-fpm.conf ================================================ ;;;;;;;;;;;;;;;;;;;;; ; FPM Configuration ; ;;;;;;;;;;;;;;;;;;;;; ; All relative paths in this configuration file are relative to PHP's install ; prefix (/opt/php71). This prefix can be dynamically changed by using the ; '-p' argument from the command line. ; Include one or more files. If glob(3) exists, it is used to include a bunch of ; files from a glob(3) pattern. This directive can be used everywhere in the ; file. ; Relative path can also be used. They will be prefixed by: ; - the global prefix if it's been set (-p argument) ; - /opt/php71 otherwise ;include=etc/fpm.d/*.conf ;;;;;;;;;;;;;;;;;; ; Global Options ; ;;;;;;;;;;;;;;;;;; [global] ; Pid file ; Note: the default prefix is /opt/php71/var ; Default Value: none pid = /run/php71-fpm.pid ; Error log file ; If it's set to "syslog", log is sent to syslogd instead of being written ; in a local file. ; Note: the default prefix is /opt/php71/var ; Default Value: log/php-fpm.log error_log = /var/log/php/php71-fpm-error.log ; syslog_facility is used to specify what type of program is logging the ; message. This lets syslogd specify that messages from different facilities ; will be handled differently. ; See syslog(3) for possible values (ex daemon equiv LOG_DAEMON) ; Default Value: daemon syslog.facility = daemon ; syslog_ident is prepended to every message. If you have multiple FPM ; instances running on the same server, you can change the default value ; which must suit common needs. ; Default Value: php-fpm syslog.ident = php71-fpm ; Log level ; Possible Values: alert, error, warning, notice, debug ; Default Value: notice log_level = warning ; If this number of child processes exit with SIGSEGV or SIGBUS within the time ; interval set by emergency_restart_interval then FPM will restart. A value ; of '0' means 'Off'. ; Default Value: 0 emergency_restart_threshold = 5 ; Interval of time used by emergency_restart_interval to determine when ; a graceful restart will be initiated. This can be useful to work around ; accidental corruptions in an accelerator's shared memory. ; Available Units: s(econds), m(inutes), h(ours), or d(ays) ; Default Unit: seconds ; Default Value: 0 emergency_restart_interval = 1m ; Time limit for child processes to wait for a reaction on signals from master. ; Available units: s(econds), m(inutes), h(ours), or d(ays) ; Default Unit: seconds ; Default Value: 0 process_control_timeout = 5s ; The maximum number of processes FPM will fork. This has been design to control ; the global number of processes when using dynamic PM within a lot of pools. ; Use it with caution. ; Note: A value of 0 indicates no limit ; Default Value: 0 process.max = 0 ; Specify the nice(2) priority to apply to the master process (only if set) ; The value can vary from -19 (highest priority) to 20 (lower priority) ; Note: - It will only work if the FPM master process is launched as root ; - The pool process will inherit the master process priority ; unless it specified otherwise ; Default Value: no set ; process.priority = -19 ; Send FPM to background. Set to 'no' to keep FPM in foreground for debugging. ; Default Value: yes daemonize = yes ; Set open file descriptor rlimit for the master process. ; Default Value: system defined value ;rlimit_files = 1024 ; Set max core size rlimit for the master process. ; Possible Values: 'unlimited' or an integer greater or equal to 0 ; Default Value: system defined value ;rlimit_core = 0 ; Specify the event mechanism FPM will use. The following is available: ; - select (any POSIX os) ; - poll (any POSIX os) ; - epoll (linux >= 2.5.44) ; - kqueue (FreeBSD >= 4.1, OpenBSD >= 2.9, NetBSD >= 2.0) ; - /dev/poll (Solaris >= 7) ; - port (Solaris >= 10) ; Default Value: not set (auto detection) ;events.mechanism = epoll ;;;;;;;;;;;;;;;;;;;; ; Pool Definitions ; ;;;;;;;;;;;;;;;;;;;; ; Multiple pools of child processes may be started with different listening ; ports and different management options. The name of the pool will be ; used in logs and stats. There is no limitation on the number of pools which ; FPM can handle. Your system will tell you anyway :) include = /opt/php71/etc/pool.d/*.conf ================================================ FILE: aegir/conf/php/php71.ini ================================================ [PHP] ;;;;;;;;;;;;;;;;;;; ; About php.ini ; ;;;;;;;;;;;;;;;;;;; ; PHP's initialization file, generally called php.ini, is responsible for ; configuring many of the aspects of PHP's behavior. ; PHP attempts to find and load this configuration from a number of locations. ; The following is a summary of its search order: ; 1. SAPI module specific location. ; 2. The PHPRC environment variable. (As of PHP 5.2.0) ; 3. A number of predefined registry keys on Windows (As of PHP 5.2.0) ; 4. Current working directory (except CLI) ; 5. The web server's directory (for SAPI modules), or directory of PHP ; (otherwise in Windows) ; 6. The directory from the --with-config-file-path compile time option, or the ; Windows directory (C:\windows or C:\winnt) ; See the PHP docs for more specific information. ; http://php.net/configuration.file ; The syntax of the file is extremely simple. Whitespace and lines ; beginning with a semicolon are silently ignored (as you probably guessed). ; Section headers (e.g. [Foo]) are also silently ignored, even though ; they might mean something in the future. ; Directives following the section heading [PATH=/www/mysite] only ; apply to PHP files in the /www/mysite directory. Directives ; following the section heading [HOST=www.example.com] only apply to ; PHP files served from www.example.com. Directives set in these ; special sections cannot be overridden by user-defined INI files or ; at runtime. Currently, [PATH=] and [HOST=] sections only work under ; CGI/FastCGI. ; http://php.net/ini.sections ; Directives are specified using the following syntax: ; directive = value ; Directive names are *case sensitive* - foo=bar is different from FOO=bar. ; Directives are variables used to configure PHP or PHP extensions. ; There is no name validation. If PHP can't find an expected ; directive because it is not set or is mistyped, a default value will be used. ; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one ; of the INI constants (On, Off, True, False, Yes, No and None) or an expression ; (e.g. E_ALL & ~E_NOTICE), a quoted string ("bar"), or a reference to a ; previously set variable or directive (e.g. ${foo}) ; Expressions in the INI file are limited to bitwise operators and parentheses: ; | bitwise OR ; ^ bitwise XOR ; & bitwise AND ; ~ bitwise NOT ; ! boolean NOT ; Boolean flags can be turned on using the values 1, On, True or Yes. ; They can be turned off using the values 0, Off, False or No. ; An empty string can be denoted by simply not writing anything after the equal ; sign, or by using the None keyword: ; foo = ; sets foo to an empty string ; foo = None ; sets foo to an empty string ; foo = "None" ; sets foo to the string 'None' ; If you use constants in your value, and these constants belong to a ; dynamically loaded extension (either a PHP extension or a Zend extension), ; you may only use these constants *after* the line that loads the extension. ;;;;;;;;;;;;;;;;;;; ; About this file ; ;;;;;;;;;;;;;;;;;;; ; PHP comes packaged with two INI files. One that is recommended to be used ; in production environments and one that is recommended to be used in ; development environments. ; php.ini-production contains settings which hold security, performance and ; best practices at its core. But please be aware, these settings may break ; compatibility with older or less security conscience applications. We ; recommending using the production ini in production and testing environments. ; php.ini-development is very similar to its production variant, except it is ; much more verbose when it comes to errors. We recommend using the ; development version only in development environments, as errors shown to ; application users can inadvertently leak otherwise secure information. ; This is php.ini-production INI file. ;;;;;;;;;;;;;;;;;;; ; Quick Reference ; ;;;;;;;;;;;;;;;;;;; ; The following are all the settings which are different in either the production ; or development versions of the INIs with respect to PHP's default behavior. ; Please see the actual settings later in the document for more details as to why ; we recommend these changes in PHP's behavior. display_errors = Off ; Default Value: On ; Development Value: On ; Production Value: Off ; display_startup_errors ; Default Value: Off ; Development Value: On ; Production Value: Off ; error_reporting ; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; html_errors ; Default Value: On ; Development Value: On ; Production value: On ; log_errors ; Default Value: Off ; Development Value: On ; Production Value: On ; max_input_time ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; output_buffering ; Default Value: Off ; Development Value: 4096 ; Production Value: 4096 ; register_argc_argv ; Default Value: On ; Development Value: Off ; Production Value: Off ; request_order ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; session.gc_divisor ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; session.sid_bits_per_character ; Default Value: 4 ; Development Value: 5 ; Production Value: 5 ; short_open_tag ; Default Value: On ; Development Value: Off ; Production Value: Off ; track_errors ; Default Value: Off ; Development Value: On ; Production Value: Off ; variables_order ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS" ;;;;;;;;;;;;;;;;;;;; ; php.ini Options ; ;;;;;;;;;;;;;;;;;;;; ; Name for user-defined php.ini (.htaccess) files. Default is ".user.ini" ;user_ini.filename = ".user.ini" ; To disable this feature set this option to empty value user_ini.filename = ; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes) ;user_ini.cache_ttl = 300 ;;;;;;;;;;;;;;;;;;;; ; Language Options ; ;;;;;;;;;;;;;;;;;;;; ; Enable the PHP scripting language engine under Apache. ; http://php.net/engine engine = On ; This directive determines whether or not PHP will recognize code between ; tags as PHP source which should be processed as such. It is ; generally recommended that should be used and that this feature ; should be disabled, as enabling it may result in issues when generating XML ; documents, however this remains supported for backward compatibility reasons. ; Note that this directive does not control the would work. ; http://php.net/syntax-highlighting ;highlight.string = #DD0000 ;highlight.comment = #FF9900 ;highlight.keyword = #007700 ;highlight.default = #0000BB ;highlight.html = #000000 ; If enabled, the request will be allowed to complete even if the user aborts ; the request. Consider enabling it if executing long requests, which may end up ; being interrupted by the user or a browser timing out. PHP's default behavior ; is to disable this feature. ; http://php.net/ignore-user-abort ;ignore_user_abort = On ; Determines the size of the realpath cache to be used by PHP. This value should ; be increased on systems where PHP opens many files to reflect the quantity of ; the file operations performed. ; http://php.net/realpath-cache-size realpath_cache_size=64M ; Duration of time, in seconds for which to cache realpath information for a given ; file or directory. For systems with rarely changing files, consider increasing this ; value. ; http://php.net/realpath-cache-ttl realpath_cache_ttl=180 ; Enables or disables the circular reference collector. ; http://php.net/zend.enable-gc zend.enable_gc = On ; If enabled, scripts may be written in encodings that are incompatible with ; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such ; encodings. To use this feature, mbstring extension must be enabled. ; Default: Off ;zend.multibyte = Off ; Allows to set the default encoding for the scripts. This value will be used ; unless "declare(encoding=...)" directive appears at the top of the script. ; Only affects if zend.multibyte is set. ; Default: "" ;zend.script_encoding = ;;;;;;;;;;;;;;;;; ; Miscellaneous ; ;;;;;;;;;;;;;;;;; ; Decides whether PHP may expose the fact that it is installed on the server ; (e.g. by adding its signature to the Web server header). It is no security ; threat in any way, but it makes it possible to determine whether you use PHP ; on your server or not. ; http://php.net/expose-php expose_php = On ;;;;;;;;;;;;;;;;;;; ; Resource Limits ; ;;;;;;;;;;;;;;;;;;; ; Maximum execution time of each script, in seconds ; http://php.net/max-execution-time ; Note: This directive is hardcoded to 0 for the CLI SAPI max_execution_time = 180 ; Maximum amount of time each script may spend parsing request data. It's a good ; idea to limit this time on productions servers in order to eliminate unexpectedly ; long running scripts. ; Note: This directive is hardcoded to -1 for the CLI SAPI ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; http://php.net/max-input-time max_input_time = 180 ; Maximum input variable nesting level ; http://php.net/max-input-nesting-level ;max_input_nesting_level = 64 ; How many GET/POST/COOKIE input variables may be accepted max_input_vars = 9999 ; Maximum amount of memory a script may consume (128MB) ; http://php.net/memory-limit memory_limit = 395M ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; Error handling and logging ; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; This directive informs PHP of which errors, warnings and notices you would like ; it to take action for. The recommended way of setting values for this ; directive is through the use of the error level constants and bitwise ; operators. The error level constants are below here for convenience as well as ; some common settings and their meanings. ; By default, PHP is set to take action on all errors, notices and warnings EXCEPT ; those related to E_NOTICE and E_STRICT, which together cover best practices and ; recommended coding standards in PHP. For performance reasons, this is the ; recommend error reporting setting. Your production server shouldn't be wasting ; resources complaining about best practices and coding standards. That's what ; development servers and development settings are for. ; Note: The php.ini-development file has this setting as E_ALL. This ; means it pretty much reports everything which is exactly what you want during ; development and early testing. ; ; Error Level Constants: ; E_ALL - All errors and warnings (includes E_STRICT as of PHP 5.4.0) ; E_ERROR - fatal run-time errors ; E_RECOVERABLE_ERROR - almost fatal run-time errors ; E_WARNING - run-time warnings (non-fatal errors) ; E_PARSE - compile-time parse errors ; E_NOTICE - run-time notices (these are warnings which often result ; from a bug in your code, but it's possible that it was ; intentional (e.g., using an uninitialized variable and ; relying on the fact it is automatically initialized to an ; empty string) ; E_STRICT - run-time notices, enable to have PHP suggest changes ; to your code which will ensure the best interoperability ; and forward compatibility of your code ; E_CORE_ERROR - fatal errors that occur during PHP's initial startup ; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's ; initial startup ; E_COMPILE_ERROR - fatal compile-time errors ; E_COMPILE_WARNING - compile-time warnings (non-fatal errors) ; E_USER_ERROR - user-generated error message ; E_USER_WARNING - user-generated warning message ; E_USER_NOTICE - user-generated notice message ; E_DEPRECATED - warn about code that will not work in future versions ; of PHP ; E_USER_DEPRECATED - user-generated deprecation warnings ; ; Common Values: ; E_ALL (Show all errors, warnings and notices including coding standards.) ; E_ALL & ~E_NOTICE (Show all errors, except for notices) ; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.) ; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors) ; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; http://php.net/error-reporting error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT ; This directive controls whether or not and where PHP will output errors, ; notices and warnings too. Error output is very useful during development, but ; it could be very dangerous in production environments. Depending on the code ; which is triggering the error, sensitive information could potentially leak ; out of your application such as database usernames and passwords or worse. ; For production environments, we recommend logging errors rather than ; sending them to STDOUT. ; Possible Values: ; Off = Do not display any errors ; stderr = Display errors to STDERR (affects only CGI/CLI binaries!) ; On or stdout = Display errors to STDOUT ; Default Value: On ; Development Value: On ; Production Value: Off ; http://php.net/display-errors display_errors = Off ; The display of errors which occur during PHP's startup sequence are handled ; separately from display_errors. PHP's default behavior is to suppress those ; errors from clients. Turning the display of startup errors on can be useful in ; debugging configuration problems. We strongly recommend you ; set this to 'off' for production servers. ; Default Value: Off ; Development Value: On ; Production Value: Off ; http://php.net/display-startup-errors display_startup_errors = Off ; Besides displaying errors, PHP can also log errors to locations such as a ; server-specific log, STDERR, or a location specified by the error_log ; directive found below. While errors should not be displayed on productions ; servers they should still be monitored and logging is a great way to do that. ; Default Value: Off ; Development Value: On ; Production Value: On ; http://php.net/log-errors log_errors = On ; Set maximum length of log_errors. In error_log information about the source is ; added. The default is 1024 and 0 allows to not apply any maximum length at all. ; http://php.net/log-errors-max-len log_errors_max_len = 1024 ; Do not log repeated messages. Repeated errors must occur in same file on same ; line unless ignore_repeated_source is set true. ; http://php.net/ignore-repeated-errors ignore_repeated_errors = Off ; Ignore source of message when ignoring repeated messages. When this setting ; is On you will not log errors with repeated messages from different files or ; source lines. ; http://php.net/ignore-repeated-source ignore_repeated_source = Off ; If this parameter is set to Off, then memory leaks will not be shown (on ; stdout or in the log). This has only effect in a debug compile, and if ; error reporting includes E_WARNING in the allowed list ; http://php.net/report-memleaks report_memleaks = On ; This setting is on by default. ;report_zend_debug = 0 ; Store the last error/warning message in $php_errormsg (boolean). Setting this value ; to On can assist in debugging and is appropriate for development servers. It should ; however be disabled on production servers. ; Default Value: Off ; Development Value: On ; Production Value: Off ; http://php.net/track-errors track_errors = Off ; Turn off normal error reporting and emit XML-RPC error XML ; http://php.net/xmlrpc-errors ;xmlrpc_errors = 0 ; An XML-RPC faultCode ;xmlrpc_error_number = 0 ; When PHP displays or logs an error, it has the capability of formatting the ; error message as HTML for easier reading. This directive controls whether ; the error message is formatted as HTML or not. ; Note: This directive is hardcoded to Off for the CLI SAPI ; Default Value: On ; Development Value: On ; Production value: On ; http://php.net/html-errors html_errors = Off ; If html_errors is set to On *and* docref_root is not empty, then PHP ; produces clickable error messages that direct to a page describing the error ; or function causing the error in detail. ; You can download a copy of the PHP manual from http://php.net/docs ; and change docref_root to the base URL of your local copy including the ; leading '/'. You must also specify the file extension being used including ; the dot. PHP's default behavior is to leave these settings empty, in which ; case no links to documentation are generated. ; Note: Never use this feature for production boxes. ; http://php.net/docref-root ; Examples ;docref_root = "/phpmanual/" ; http://php.net/docref-ext ;docref_ext = .html ; String to output before an error message. PHP's default behavior is to leave ; this setting blank. ; http://php.net/error-prepend-string ; Example: ;error_prepend_string = "" ; String to output after an error message. PHP's default behavior is to leave ; this setting blank. ; http://php.net/error-append-string ; Example: ;error_append_string = "" ; Log errors to specified file. PHP's default behavior is to leave this value ; empty. ; http://php.net/error-log ; Example: ;error_log = php_errors.log ; Log errors to syslog (Event Log on Windows). ;error_log = syslog error_log = /var/log/php/error_log_71 ;windows.show_crt_warning ; Default value: 0 ; Development value: 0 ; Production value: 0 ;;;;;;;;;;;;;;;;; ; Data Handling ; ;;;;;;;;;;;;;;;;; ; The separator used in PHP generated URLs to separate arguments. ; PHP's default setting is "&". ; http://php.net/arg-separator.output ; Example: ;arg_separator.output = "&" ; List of separator(s) used by PHP to parse input URLs into variables. ; PHP's default setting is "&". ; NOTE: Every character in this directive is considered as separator! ; http://php.net/arg-separator.input ; Example: ;arg_separator.input = ";&" ; This directive determines which super global arrays are registered when PHP ; starts up. G,P,C,E & S are abbreviations for the following respective super ; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty ; paid for the registration of these arrays and because ENV is not as commonly ; used as the others, ENV is not recommended on productions servers. You ; can still get access to the environment variables through getenv() should you ; need to. ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS"; ; http://php.net/variables-order variables_order = "GPCS" ; This directive determines which super global data (G,P & C) should be ; registered into the super global array REQUEST. If so, it also determines ; the order in which that data is registered. The values for this directive ; are specified in the same manner as the variables_order directive, ; EXCEPT one. Leaving this value empty will cause PHP to use the value set ; in the variables_order directive. It does not mean it will leave the super ; globals array REQUEST empty. ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; http://php.net/request-order request_order = "GP" ; This directive determines whether PHP registers $argv & $argc each time it ; runs. $argv contains an array of all the arguments passed to PHP when a script ; is invoked. $argc contains an integer representing the number of arguments ; that were passed when the script was invoked. These arrays are extremely ; useful when running scripts from the command line. When this directive is ; enabled, registering these variables consumes CPU cycles and memory each time ; a script is executed. For performance reasons, this feature should be disabled ; on production servers. ; Note: This directive is hardcoded to On for the CLI SAPI ; Default Value: On ; Development Value: Off ; Production Value: Off ; http://php.net/register-argc-argv register_argc_argv = Off ; When enabled, the ENV, REQUEST and SERVER variables are created when they're ; first used (Just In Time) instead of when the script starts. If these ; variables are not used within a script, having this directive on will result ; in a performance gain. The PHP directive register_argc_argv must be disabled ; for this directive to have any affect. ; http://php.net/auto-globals-jit auto_globals_jit = On ; Whether PHP will read the POST data. ; This option is enabled by default. ; Most likely, you won't want to disable this option globally. It causes $_POST ; and $_FILES to always be empty; the only way you will be able to read the ; POST data will be through the php://input stream wrapper. This can be useful ; to proxy requests or to process the POST data in a memory efficient fashion. ; http://php.net/enable-post-data-reading ;enable_post_data_reading = Off ; Maximum size of POST data that PHP will accept. ; Its value may be 0 to disable the limit. It is ignored if POST data reading ; is disabled through enable_post_data_reading. ; http://php.net/post-max-size post_max_size = 350M ; Automatically add files before PHP document. ; http://php.net/auto-prepend-file auto_prepend_file = ; Automatically add files after PHP document. ; http://php.net/auto-append-file auto_append_file = ; By default, PHP will output a media type using the Content-Type header. To ; disable this, simply set it to be empty. ; ; PHP's built-in default media type is set to text/html. ; http://php.net/default-mimetype default_mimetype = "text/html" ; PHP's default character set is set to UTF-8. ; http://php.net/default-charset default_charset = "UTF-8" ; PHP internal character encoding is set to empty. ; If empty, default_charset is used. ; http://php.net/internal-encoding ;internal_encoding = ; PHP input character encoding is set to empty. ; If empty, default_charset is used. ; http://php.net/input-encoding ;input_encoding = ; PHP output character encoding is set to empty. ; If empty, default_charset is used. ; See also output_buffer. ; http://php.net/output-encoding ;output_encoding = ;;;;;;;;;;;;;;;;;;;;;;;;; ; Paths and Directories ; ;;;;;;;;;;;;;;;;;;;;;;;;; ; UNIX: "/path1:/path2" ;include_path = ".:/php/includes" ; ; Windows: "\path1;\path2" ;include_path = ".;c:\php\includes" ; ; PHP's default setting for include_path is ".;/path/to/php/pear" ; http://php.net/include-path include_path = ".:/opt/php71/lib/php" ; The root of the PHP pages, used only if nonempty. ; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root ; if you are running php as a CGI under any web server (other than IIS) ; see documentation for security issues. The alternate is to use the ; cgi.force_redirect configuration below ; http://php.net/doc-root doc_root = ; The directory under which PHP opens the script using /~username used only ; if nonempty. ; http://php.net/user-dir user_dir = ; Directory in which the loadable extensions (modules) reside. ; http://php.net/extension-dir ; extension_dir = "./" ; On windows: ; extension_dir = "ext" extension_dir = "/opt/php71/lib/php/extensions/no-debug-non-zts-20160303/" ; Directory where the temporary files should be placed. ; Defaults to the system default (see sys_get_temp_dir) sys_temp_dir = "/tmp" ; Whether or not to enable the dl() function. The dl() function does NOT work ; properly in multithreaded servers, such as IIS or Zeus, and is automatically ; disabled on them. ; http://php.net/enable-dl enable_dl = Off ; cgi.force_redirect is necessary to provide security running PHP as a CGI under ; most web servers. Left undefined, PHP turns this on by default. You can ; turn it off here AT YOUR OWN RISK ; **You CAN safely turn this off for IIS, in fact, you MUST.** ; http://php.net/cgi.force-redirect ;cgi.force_redirect = 1 ; if cgi.nph is enabled it will force cgi to always sent Status: 200 with ; every request. PHP's default behavior is to disable this feature. ;cgi.nph = 1 ; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape ; (iPlanet) web servers, you MAY need to set an environment variable name that PHP ; will look for to know it is OK to continue execution. Setting this variable MAY ; cause security issues, KNOW WHAT YOU ARE DOING FIRST. ; http://php.net/cgi.redirect-status-env ;cgi.redirect_status_env = ; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's ; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok ; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting ; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting ; of zero causes PHP to behave as before. Default is 1. You should fix your scripts ; to use SCRIPT_FILENAME rather than PATH_TRANSLATED. ; http://php.net/cgi.fix-pathinfo ;cgi.fix_pathinfo=1 ; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside ; of the web tree and people will not be able to circumvent .htaccess security. ; http://php.net/cgi.dicard-path ;cgi.discard_path=1 ; FastCGI under IIS (on WINNT based OS) supports the ability to impersonate ; security tokens of the calling client. This allows IIS to define the ; security context that the request runs under. mod_fastcgi under Apache ; does not currently support this feature (03/17/2002) ; Set to 1 if running under IIS. Default is zero. ; http://php.net/fastcgi.impersonate ;fastcgi.impersonate = 1 ; Disable logging through FastCGI connection. PHP's default behavior is to enable ; this feature. ;fastcgi.logging = 0 ; cgi.rfc2616_headers configuration option tells PHP what type of headers to ; use when sending HTTP response code. If set to 0, PHP sends Status: header that ; is supported by Apache. When this option is set to 1, PHP will send ; RFC2616 compliant header. ; Default is zero. ; http://php.net/cgi.rfc2616-headers ;cgi.rfc2616_headers = 0 ; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #! ; (shebang) at the top of the running script. This line might be needed if the ; script support running both as stand-alone script and via PHP CGI<. PHP in CGI ; mode skips this line and ignores its content if this directive is turned on. ; http://php.net/cgi.check-shebang-line ;cgi.check_shebang_line=1 ;;;;;;;;;;;;;;;; ; File Uploads ; ;;;;;;;;;;;;;;;; ; Whether to allow HTTP file uploads. ; http://php.net/file-uploads file_uploads = On ; Temporary directory for HTTP uploaded files (will use system default if not ; specified). ; http://php.net/upload-tmp-dir upload_tmp_dir = /tmp ; Maximum allowed size for uploaded files. ; http://php.net/upload-max-filesize upload_max_filesize = 325M ; Maximum number of files that can be uploaded via a single request max_file_uploads = 50 ;;;;;;;;;;;;;;;;;; ; Fopen wrappers ; ;;;;;;;;;;;;;;;;;; ; Whether to allow the treatment of URLs (like http:// or ftp://) as files. ; http://php.net/allow-url-fopen allow_url_fopen = On ; Whether to allow include/require to open URLs (like http:// or ftp://) as files. ; http://php.net/allow-url-include allow_url_include = Off ; Define the anonymous ftp password (your email address). PHP's default setting ; for this is empty. ; http://php.net/from ;from="john@doe.com" ; Define the User-Agent string. PHP's default setting for this is empty. ; http://php.net/user-agent ;user_agent="PHP" ; Default timeout for socket based streams (seconds) ; http://php.net/default-socket-timeout default_socket_timeout = 180 ; If your scripts have to deal with files from Macintosh systems, ; or you are running on a Mac and need to deal with files from ; unix or win32 systems, setting this flag will cause PHP to ; automatically detect the EOL character in those files so that ; fgets() and file() will work regardless of the source of the file. ; http://php.net/auto-detect-line-endings auto_detect_line_endings = On ;;;;;;;;;;;;;;;;;;;;;; ; Dynamic Extensions ; ;;;;;;;;;;;;;;;;;;;;;; ; If you wish to have an extension loaded automatically, use the following ; syntax: ; ; extension=modulename.extension ; ; For example, on Windows: ; ; extension=msql.dll ; ; ... or under UNIX: ; ; extension=msql.so ; ; ... or with a path: ; ; extension=/path/to/extension/msql.so ; ; If you only provide the name of the extension, PHP will look for it in its ; default extension directory. ; ; Windows Extensions ; Note that many DLL files are located in the extensions/ (PHP 4) ext/ (PHP 5+) ; extension folders as well as the separate PECL DLL download (PHP 5+). ; Be sure to appropriately set the extension_dir directive. ; ;extension=php_bz2.dll ;extension=php_curl.dll ;extension=php_fileinfo.dll ;extension=php_ftp.dll ;extension=php_gd2.dll ;extension=php_gettext.dll ;extension=php_gmp.dll ;extension=php_intl.dll ;extension=php_imap.dll ;extension=php_interbase.dll ;extension=php_ldap.dll ;extension=php_mbstring.dll ;extension=php_exif.dll ; Must be after mbstring as it depends on it ;extension=php_mysqli.dll ;extension=php_oci8_12c.dll ; Use with Oracle Database 12c Instant Client ;extension=php_odbc.dll ;extension=php_openssl.dll ;extension=php_pdo_firebird.dll ;extension=php_pdo_mysql.dll ;extension=php_pdo_oci.dll ;extension=php_pdo_odbc.dll ;extension=php_pdo_pgsql.dll ;extension=php_pdo_sqlite.dll ;extension=php_pgsql.dll ;extension=php_shmop.dll ; The MIBS data available in the PHP distribution must be installed. ; See http://www.php.net/manual/en/snmp.installation.php ;extension=php_snmp.dll ;extension=php_soap.dll ;extension=php_sockets.dll ;extension=php_sqlite3.dll ;extension=php_tidy.dll ;extension=php_xmlrpc.dll ;extension=php_xsl.dll ;;;;;;;;;;;;;;;;;;; ; Module Settings ; ;;;;;;;;;;;;;;;;;;; [CLI Server] ; Whether the CLI web server uses ANSI color coding in its terminal output. cli_server.color = On [Date] ; Defines the default timezone used by the date functions ; http://php.net/date.timezone date.timezone = "UTC" ; http://php.net/date.default-latitude ;date.default_latitude = 31.7667 ; http://php.net/date.default-longitude ;date.default_longitude = 35.2333 ; http://php.net/date.sunrise-zenith ;date.sunrise_zenith = 90.583333 ; http://php.net/date.sunset-zenith ;date.sunset_zenith = 90.583333 [filter] ; http://php.net/filter.default ;filter.default = unsafe_raw ; http://php.net/filter.default-flags ;filter.default_flags = [iconv] ; Use of this INI entry is deprecated, use global input_encoding instead. ; If empty, default_charset or input_encoding or iconv.input_encoding is used. ; The precedence is: default_charset < intput_encoding < iconv.input_encoding ;iconv.input_encoding = ; Use of this INI entry is deprecated, use global internal_encoding instead. ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;iconv.internal_encoding = ; Use of this INI entry is deprecated, use global output_encoding instead. ; If empty, default_charset or output_encoding or iconv.output_encoding is used. ; The precedence is: default_charset < output_encoding < iconv.output_encoding ; To use an output encoding conversion, iconv's output handler must be set ; otherwise output encoding conversion cannot be performed. ;iconv.output_encoding = [intl] ;intl.default_locale = ; This directive allows you to produce PHP errors when some error ; happens within intl functions. The value is the level of the error produced. ; Default is 0, which does not produce any errors. ;intl.error_level = E_WARNING ;intl.use_exceptions = 0 [sqlite3] ;sqlite3.extension_dir = [Pcre] ;PCRE library backtracking limit. ; http://php.net/pcre.backtrack-limit ;pcre.backtrack_limit=100000 ;PCRE library recursion limit. ;Please note that if you set this value to a high number you may consume all ;the available process stack and eventually crash PHP (due to reaching the ;stack size limit imposed by the Operating System). ; http://php.net/pcre.recursion-limit ;pcre.recursion_limit=100000 ;Enables or disables JIT compilation of patterns. This requires the PCRE ;library to be compiled with JIT support. ;pcre.jit=1 [Pdo] ; Whether to pool ODBC connections. Can be one of "strict", "relaxed" or "off" ; http://php.net/pdo-odbc.connection-pooling ;pdo_odbc.connection_pooling=strict ;pdo_odbc.db2_instance_name [Pdo_mysql] ; If mysqlnd is used: Number of cache slots for the internal result set cache ; http://php.net/pdo_mysql.cache_size pdo_mysql.cache_size = 2000 ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. ; http://php.net/pdo_mysql.default-socket pdo_mysql.default_socket= [Phar] ; http://php.net/phar.readonly ;phar.readonly = On ; http://php.net/phar.require-hash ;phar.require_hash = On ;phar.cache_list = [mail function] ; For Win32 only. ; http://php.net/smtp ;SMTP = localhost ; http://php.net/smtp-port ;smtp_port = 25 ; For Win32 only. ; http://php.net/sendmail-from ;sendmail_from = me@example.com ; For Unix only. You may supply arguments as well (default: "sendmail -t -i"). ; http://php.net/sendmail-path sendmail_path = /usr/sbin/sendmail -t -i ; Force the addition of the specified parameters to be passed as extra parameters ; to the sendmail binary. These parameters will always replace the value of ; the 5th parameter to mail(). ;mail.force_extra_parameters = ; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename mail.add_x_header = Off ; The path to a log file that will log all mail() calls. Log entries include ; the full path of the script, line number, To address and headers. ;mail.log = ; Log mail to syslog (Event Log on Windows). ;mail.log = syslog [SQL] ; http://php.net/sql.safe-mode sql.safe_mode = Off [ODBC] ; http://php.net/odbc.default-db ;odbc.default_db = Not yet implemented ; http://php.net/odbc.default-user ;odbc.default_user = Not yet implemented ; http://php.net/odbc.default-pw ;odbc.default_pw = Not yet implemented ; Controls the ODBC cursor model. ; Default: SQL_CURSOR_STATIC (default). ;odbc.default_cursortype ; Allow or prevent persistent links. ; http://php.net/odbc.allow-persistent odbc.allow_persistent = On ; Check that a connection is still valid before reuse. ; http://php.net/odbc.check-persistent odbc.check_persistent = On ; Maximum number of persistent links. -1 means no limit. ; http://php.net/odbc.max-persistent odbc.max_persistent = -1 ; Maximum number of links (persistent + non-persistent). -1 means no limit. ; http://php.net/odbc.max-links odbc.max_links = -1 ; Handling of LONG fields. Returns number of bytes to variables. 0 means ; passthru. ; http://php.net/odbc.defaultlrl odbc.defaultlrl = 4096 ; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char. ; See the documentation on odbc_binmode and odbc_longreadlen for an explanation ; of odbc.defaultlrl and odbc.defaultbinmode ; http://php.net/odbc.defaultbinmode odbc.defaultbinmode = 1 ;birdstep.max_links = -1 [Interbase] ; Allow or prevent persistent links. ibase.allow_persistent = 1 ; Maximum number of persistent links. -1 means no limit. ibase.max_persistent = -1 ; Maximum number of links (persistent + non-persistent). -1 means no limit. ibase.max_links = -1 ; Default database name for ibase_connect(). ;ibase.default_db = ; Default username for ibase_connect(). ;ibase.default_user = ; Default password for ibase_connect(). ;ibase.default_password = ; Default charset for ibase_connect(). ;ibase.default_charset = ; Default timestamp format. ibase.timestampformat = "%Y-%m-%d %H:%M:%S" ; Default date format. ibase.dateformat = "%Y-%m-%d" ; Default time format. ibase.timeformat = "%H:%M:%S" [MySQLi] ; Maximum number of persistent links. -1 means no limit. ; http://php.net/mysqli.max-persistent mysqli.max_persistent = -1 ; Allow accessing, from PHP's perspective, local files with LOAD DATA statements ; http://php.net/mysqli.allow_local_infile ;mysqli.allow_local_infile = On ; Allow or prevent persistent links. ; http://php.net/mysqli.allow-persistent mysqli.allow_persistent = On ; Maximum number of links. -1 means no limit. ; http://php.net/mysqli.max-links mysqli.max_links = -1 ; If mysqlnd is used: Number of cache slots for the internal result set cache ; http://php.net/mysqli.cache_size mysqli.cache_size = 2000 ; Default port number for mysqli_connect(). If unset, mysqli_connect() will use ; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the ; compile-time value defined MYSQL_PORT (in that order). Win32 will only look ; at MYSQL_PORT. ; http://php.net/mysqli.default-port mysqli.default_port = 3306 ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. ; http://php.net/mysqli.default-socket mysqli.default_socket = ; Default host for mysql_connect() (doesn't apply in safe mode). ; http://php.net/mysqli.default-host mysqli.default_host = ; Default user for mysql_connect() (doesn't apply in safe mode). ; http://php.net/mysqli.default-user mysqli.default_user = ; Default password for mysqli_connect() (doesn't apply in safe mode). ; Note that this is generally a *bad* idea to store passwords in this file. ; *Any* user with PHP access can run 'echo get_cfg_var("mysqli.default_pw") ; and reveal this password! And of course, any users with read access to this ; file will be able to reveal the password as well. ; http://php.net/mysqli.default-pw mysqli.default_pw = ; Allow or prevent reconnect mysqli.reconnect = Off [mysqlnd] ; Enable / Disable collection of general statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. ; http://php.net/mysqlnd.collect_statistics mysqlnd.collect_statistics = 0 ; Enable / Disable collection of memory usage statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. ; http://php.net/mysqlnd.collect_memory_statistics mysqlnd.collect_memory_statistics = 0 ; Records communication from all extensions using mysqlnd to the specified log ; file. ; http://php.net/mysqlnd.debug ;mysqlnd.debug = ; Defines which queries will be logged. ; http://php.net/mysqlnd.log_mask ;mysqlnd.log_mask = 0 ; Default size of the mysqlnd memory pool, which is used by result sets. ; http://php.net/mysqlnd.mempool_default_size mysqlnd.mempool_default_size = 64000 ; Size of a pre-allocated buffer used when sending commands to MySQL in bytes. ; http://php.net/mysqlnd.net_cmd_buffer_size mysqlnd.net_cmd_buffer_size = 8192 ; Size of a pre-allocated buffer used for reading data sent by the server in ; bytes. ; http://php.net/mysqlnd.net_read_buffer_size mysqlnd.net_read_buffer_size = 131072 ; Timeout for network requests in seconds. ; http://php.net/mysqlnd.net_read_timeout ;mysqlnd.net_read_timeout = 31536000 ; SHA-256 Authentication Plugin related. File with the MySQL server public RSA ; key. ; http://php.net/mysqlnd.sha256_server_public_key ;mysqlnd.sha256_server_public_key = [OCI8] ; Connection: Enables privileged connections using external ; credentials (OCI_SYSOPER, OCI_SYSDBA) ; http://php.net/oci8.privileged-connect ;oci8.privileged_connect = Off ; Connection: The maximum number of persistent OCI8 connections per ; process. Using -1 means no limit. ; http://php.net/oci8.max-persistent ;oci8.max_persistent = -1 ; Connection: The maximum number of seconds a process is allowed to ; maintain an idle persistent connection. Using -1 means idle ; persistent connections will be maintained forever. ; http://php.net/oci8.persistent-timeout ;oci8.persistent_timeout = -1 ; Connection: The number of seconds that must pass before issuing a ; ping during oci_pconnect() to check the connection validity. When ; set to 0, each oci_pconnect() will cause a ping. Using -1 disables ; pings completely. ; http://php.net/oci8.ping-interval ;oci8.ping_interval = 60 ; Connection: Set this to a user chosen connection class to be used ; for all pooled server requests with Oracle 11g Database Resident ; Connection Pooling (DRCP). To use DRCP, this value should be set to ; the same string for all web servers running the same application, ; the database pool must be configured, and the connection string must ; specify to use a pooled server. ;oci8.connection_class = ; High Availability: Using On lets PHP receive Fast Application ; Notification (FAN) events generated when a database node fails. The ; database must also be configured to post FAN events. ;oci8.events = Off ; Tuning: This option enables statement caching, and specifies how ; many statements to cache. Using 0 disables statement caching. ; http://php.net/oci8.statement-cache-size ;oci8.statement_cache_size = 20 ; Tuning: Enables statement prefetching and sets the default number of ; rows that will be fetched automatically after statement execution. ; http://php.net/oci8.default-prefetch ;oci8.default_prefetch = 100 ; Compatibility. Using On means oci_close() will not close ; oci_connect() and oci_new_connect() connections. ; http://php.net/oci8.old-oci-close-semantics ;oci8.old_oci_close_semantics = Off [PostgreSQL] ; Allow or prevent persistent links. ; http://php.net/pgsql.allow-persistent pgsql.allow_persistent = On ; Detect broken persistent links always with pg_pconnect(). ; Auto reset feature requires a little overheads. ; http://php.net/pgsql.auto-reset-persistent pgsql.auto_reset_persistent = Off ; Maximum number of persistent links. -1 means no limit. ; http://php.net/pgsql.max-persistent pgsql.max_persistent = -1 ; Maximum number of links (persistent+non persistent). -1 means no limit. ; http://php.net/pgsql.max-links pgsql.max_links = -1 ; Ignore PostgreSQL backends Notice message or not. ; Notice message logging require a little overheads. ; http://php.net/pgsql.ignore-notice pgsql.ignore_notice = 0 ; Log PostgreSQL backends Notice message or not. ; Unless pgsql.ignore_notice=0, module cannot log notice message. ; http://php.net/pgsql.log-notice pgsql.log_notice = 0 [bcmath] ; Number of decimal digits for all bcmath functions. ; http://php.net/bcmath.scale bcmath.scale = 0 [browscap] ; http://php.net/browscap ;browscap = extra/browscap.ini [Session] ; Handler used to store/retrieve data. ; http://php.net/session.save-handler session.save_handler = files ; Argument passed to save_handler. In the case of files, this is the path ; where data files are stored. Note: Windows users have to change this ; variable in order to use PHP's session functions. ; ; The path can be defined as: ; ; session.save_path = "N;/path" ; ; where N is an integer. Instead of storing all the session files in ; /path, what this will do is use subdirectories N-levels deep, and ; store the session data in those directories. This is useful if ; your OS has problems with many files in one directory, and is ; a more efficient layout for servers that handle many sessions. ; ; NOTE 1: PHP will not create this directory structure automatically. ; You can use the script in the ext/session dir for that purpose. ; NOTE 2: See the section on garbage collection below if you choose to ; use subdirectories for session storage ; ; The file storage module creates files using mode 600 by default. ; You can change that by using ; ; session.save_path = "N;MODE;/path" ; ; where MODE is the octal representation of the mode. Note that this ; does not overwrite the process's umask. ; http://php.net/session.save-path session.save_path = "/opt/tmp" ; Whether to use strict session mode. ; Strict session mode does not accept uninitialized session ID and regenerate ; session ID if browser sends uninitialized session ID. Strict mode protects ; applications from session fixation via session adoption vulnerability. It is ; disabled by default for maximum compatibility, but enabling it is encouraged. ; https://wiki.php.net/rfc/strict_sessions session.use_strict_mode = 0 ; Whether to use cookies. ; http://php.net/session.use-cookies session.use_cookies = 1 ; http://php.net/session.cookie-secure ;session.cookie_secure = ; This option forces PHP to fetch and use a cookie for storing and maintaining ; the session id. We encourage this operation as it's very helpful in combating ; session hijacking when not specifying and managing your own session id. It is ; not the be-all and end-all of session hijacking defense, but it's a good start. ; http://php.net/session.use-only-cookies session.use_only_cookies = 1 ; Name of the session (used as cookie name). ; http://php.net/session.name session.name = PHPSESSID ; Initialize session on request startup. ; http://php.net/session.auto-start session.auto_start = 0 ; Lifetime in seconds of cookie or, if 0, until browser is restarted. ; http://php.net/session.cookie-lifetime session.cookie_lifetime = 0 ; The path for which the cookie is valid. ; http://php.net/session.cookie-path session.cookie_path = / ; The domain for which the cookie is valid. ; http://php.net/session.cookie-domain session.cookie_domain = ; Whether or not to add the httpOnly flag to the cookie, which makes it inaccessible to browser scripting languages such as JavaScript. ; http://php.net/session.cookie-httponly session.cookie_httponly = 1 ; Handler used to serialize data. php is the standard serializer of PHP. ; http://php.net/session.serialize-handler session.serialize_handler = php ; Defines the probability that the 'garbage collection' process is started ; on every session initialization. The probability is calculated by using ; gc_probability/gc_divisor. Where session.gc_probability is the numerator ; and gc_divisor is the denominator in the equation. Setting this value to 1 ; when the session.gc_divisor value is 100 will give you approximately a 1% chance ; the gc will run on any give request. ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; http://php.net/session.gc-probability session.gc_probability = 1 ; Defines the probability that the 'garbage collection' process is started on every ; session initialization. The probability is calculated by using the following equation: ; gc_probability/gc_divisor. Where session.gc_probability is the numerator and ; session.gc_divisor is the denominator in the equation. Setting this value to 1 ; when the session.gc_divisor value is 100 will give you approximately a 1% chance ; the gc will run on any give request. Increasing this value to 1000 will give you ; a 0.1% chance the gc will run on any give request. For high volume production servers, ; this is a more efficient approach. ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; http://php.net/session.gc-divisor session.gc_divisor = 1000 ; After this number of seconds, stored data will be seen as 'garbage' and ; cleaned up by the garbage collection process. ; http://php.net/session.gc-maxlifetime session.gc_maxlifetime = 1440 ; NOTE: If you are using the subdirectory option for storing session files ; (see session.save_path above), then garbage collection does *not* ; happen automatically. You will need to do your own garbage ; collection through a shell script, cron entry, or some other method. ; For example, the following script would is the equivalent of ; setting session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes): ; find /path/to/sessions -cmin +24 -type f | xargs rm ; Check HTTP Referer to invalidate externally stored URLs containing ids. ; HTTP_REFERER has to contain this substring for the session to be ; considered as valid. ; http://php.net/session.referer-check session.referer_check = ; Set to {nocache,private,public,} to determine HTTP caching aspects ; or leave this empty to avoid sending anti-caching headers. ; http://php.net/session.cache-limiter session.cache_limiter = nocache ; Document expires after n minutes. ; http://php.net/session.cache-expire session.cache_expire = 180 ; trans sid support is disabled by default. ; Use of trans sid may risk your users' security. ; Use this option with caution. ; - User may send URL contains active session ID ; to other person via. email/irc/etc. ; - URL that contains active session ID may be stored ; in publicly accessible computer. ; - User may access your site with the same session ID ; always using URL stored in browser's history or bookmarks. ; http://php.net/session.use-trans-sid session.use_trans_sid = 0 ; Set session ID character length. This value could be between 22 to 256. ; Shorter length than default is supported only for compatibility reason. ; Users should use 32 or more chars. ; http://php.net/session.sid-length ; Default Value: 32 ; Development Value: 26 ; Production Value: 26 session.sid_length = 26 ; The URL rewriter will look for URLs in a defined set of HTML tags. ; is special; if you include them here, the rewriter will ; add a hidden field with the info which is otherwise appended ; to URLs. tag's action attribute URL will not be modified ; unless it is specified. ; Note that all valid entries require a "=", even if no value follows. ; Default Value: "a=href,area=href,frame=src,form=" ; Development Value: "a=href,area=href,frame=src,form=" ; Production Value: "a=href,area=href,frame=src,form=" ; http://php.net/url-rewriter.tags session.trans_sid_tags = "a=href,area=href,frame=src,form=" ; URL rewriter does not rewrite absolute URLs by default. ; To enable rewrites for absolute pathes, target hosts must be specified ; at RUNTIME. i.e. use ini_set() ; tags is special. PHP will check action attribute's URL regardless ; of session.trans_sid_tags setting. ; If no host is defined, HTTP_HOST will be used for allowed host. ; Example value: php.net,www.php.net,wiki.php.net ; Use "," for multiple hosts. No spaces are allowed. ; Default Value: "" ; Development Value: "" ; Production Value: "" ;session.trans_sid_hosts="" ; Define how many bits are stored in each character when converting ; the binary hash data to something readable. ; Possible values: ; 4 (4 bits: 0-9, a-f) ; 5 (5 bits: 0-9, a-v) ; 6 (6 bits: 0-9, a-z, A-Z, "-", ",") ; Default Value: 4 ; Development Value: 5 ; Production Value: 5 ; http://php.net/session.hash-bits-per-character session.sid_bits_per_character = 5 ; Enable upload progress tracking in $_SESSION ; Default Value: On ; Development Value: On ; Production Value: On ; http://php.net/session.upload-progress.enabled ;session.upload_progress.enabled = On ; Cleanup the progress information as soon as all POST data has been read ; (i.e. upload completed). ; Default Value: On ; Development Value: On ; Production Value: On ; http://php.net/session.upload-progress.cleanup ;session.upload_progress.cleanup = On ; A prefix used for the upload progress key in $_SESSION ; Default Value: "upload_progress_" ; Development Value: "upload_progress_" ; Production Value: "upload_progress_" ; http://php.net/session.upload-progress.prefix ;session.upload_progress.prefix = "upload_progress_" ; The index name (concatenated with the prefix) in $_SESSION ; containing the upload progress information ; Default Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Development Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Production Value: "PHP_SESSION_UPLOAD_PROGRESS" ; http://php.net/session.upload-progress.name ;session.upload_progress.name = "PHP_SESSION_UPLOAD_PROGRESS" ; How frequently the upload progress should be updated. ; Given either in percentages (per-file), or in bytes ; Default Value: "1%" ; Development Value: "1%" ; Production Value: "1%" ; http://php.net/session.upload-progress.freq ;session.upload_progress.freq = "1%" ; The minimum delay between updates, in seconds ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; http://php.net/session.upload-progress.min-freq ;session.upload_progress.min_freq = "1" ; Only write session data when session data is changed. Enabled by default. ; http://php.net/session.lazy-write ;session.lazy_write = On [Assertion] ; Switch whether to compile assertions at all (to have no overhead at run-time) ; -1: Do not compile at all ; 0: Jump over assertion at run-time ; 1: Execute assertions ; Changing from or to a negative value is only possible in php.ini! (For turning assertions on and off at run-time, see assert.active, when zend.assertions = 1) ; Default Value: 1 ; Development Value: 1 ; Production Value: -1 ; http://php.net/zend.assertions zend.assertions = -1 ; Assert(expr); active by default. ; http://php.net/assert.active ;assert.active = On ; Throw an AssertationException on failed assertions ; http://php.net/assert.exception ;assert.exception = On ; Issue a PHP warning for each failed assertion. (Overridden by assert.exception if active) ; http://php.net/assert.warning ;assert.warning = On ; Don't bail out by default. ; http://php.net/assert.bail ;assert.bail = Off ; User-function to be called if an assertion fails. ; http://php.net/assert.callback ;assert.callback = 0 ; Eval the expression with current error_reporting(). Set to true if you want ; error_reporting(0) around the eval(). ; http://php.net/assert.quiet-eval ;assert.quiet_eval = 0 [COM] ; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs ; http://php.net/com.typelib-file ;com.typelib_file = ; allow Distributed-COM calls ; http://php.net/com.allow-dcom ;com.allow_dcom = true ; autoregister constants of a components typlib on com_load() ; http://php.net/com.autoregister-typelib ;com.autoregister_typelib = true ; register constants casesensitive ; http://php.net/com.autoregister-casesensitive ;com.autoregister_casesensitive = false ; show warnings on duplicate constant registrations ; http://php.net/com.autoregister-verbose ;com.autoregister_verbose = true ; The default character set code-page to use when passing strings to and from COM objects. ; Default: system ANSI code page ;com.code_page= [mbstring] ; language for internal character representation. ; This affects mb_send_mail() and mbstring.detect_order. ; http://php.net/mbstring.language ;mbstring.language = Japanese ; Use of this INI entry is deprecated, use global internal_encoding instead. ; internal/script encoding. ; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*) ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;mbstring.internal_encoding = ; Use of this INI entry is deprecated, use global input_encoding instead. ; http input encoding. ; mbstring.encoding_traslation = On is needed to use this setting. ; If empty, default_charset or input_encoding or mbstring.input is used. ; The precedence is: default_charset < intput_encoding < mbsting.http_input ; http://php.net/mbstring.http-input ;mbstring.http_input = ; Use of this INI entry is deprecated, use global output_encoding instead. ; http output encoding. ; mb_output_handler must be registered as output buffer to function. ; If empty, default_charset or output_encoding or mbstring.http_output is used. ; The precedence is: default_charset < output_encoding < mbstring.http_output ; To use an output encoding conversion, mbstring's output handler must be set ; otherwise output encoding conversion cannot be performed. ; http://php.net/mbstring.http-output ;mbstring.http_output = ; enable automatic encoding translation according to ; mbstring.internal_encoding setting. Input chars are ; converted to internal encoding by setting this to On. ; Note: Do _not_ use automatic encoding translation for ; portable libs/applications. ; http://php.net/mbstring.encoding-translation ;mbstring.encoding_translation = Off ; automatic encoding detection order. ; "auto" detect order is changed according to mbstring.language ; http://php.net/mbstring.detect-order ;mbstring.detect_order = auto ; substitute_character used when character cannot be converted ; one from another ; http://php.net/mbstring.substitute-character ;mbstring.substitute_character = none ; overload(replace) single byte functions by mbstring functions. ; mail(), ereg(), etc are overloaded by mb_send_mail(), mb_ereg(), ; etc. Possible values are 0,1,2,4 or combination of them. ; For example, 7 for overload everything. ; 0: No overload ; 1: Overload mail() function ; 2: Overload str*() functions ; 4: Overload ereg*() functions ; http://php.net/mbstring.func-overload ;mbstring.func_overload = 0 ; enable strict encoding detection. ; Default: Off ;mbstring.strict_detection = On ; This directive specifies the regex pattern of content types for which mb_output_handler() ; is activated. ; Default: mbstring.http_output_conv_mimetype=^(text/|application/xhtml\+xml) ;mbstring.http_output_conv_mimetype= [gd] ; Tell the jpeg decode to ignore warnings and try to create ; a gd image. The warning will then be displayed as notices ; disabled by default ; http://php.net/gd.jpeg-ignore-warning ;gd.jpeg_ignore_warning = 1 [exif] ; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS. ; With mbstring support this will automatically be converted into the encoding ; given by corresponding encode setting. When empty mbstring.internal_encoding ; is used. For the decode settings you can distinguish between motorola and ; intel byte order. A decode setting cannot be empty. ; http://php.net/exif.encode-unicode ;exif.encode_unicode = ISO-8859-15 ; http://php.net/exif.decode-unicode-motorola ;exif.decode_unicode_motorola = UCS-2BE ; http://php.net/exif.decode-unicode-intel ;exif.decode_unicode_intel = UCS-2LE ; http://php.net/exif.encode-jis ;exif.encode_jis = ; http://php.net/exif.decode-jis-motorola ;exif.decode_jis_motorola = JIS ; http://php.net/exif.decode-jis-intel ;exif.decode_jis_intel = JIS [Tidy] ; The path to a default tidy configuration file to use when using tidy ; http://php.net/tidy.default-config ;tidy.default_config = /usr/local/lib/php/default.tcfg ; Should tidy clean and repair output automatically? ; WARNING: Do not use this option if you are generating non-html content ; such as dynamic images ; http://php.net/tidy.clean-output tidy.clean_output = Off [soap] ; Enables or disables WSDL caching feature. ; http://php.net/soap.wsdl-cache-enabled soap.wsdl_cache_enabled=1 ; Sets the directory name where SOAP extension will put cache files. ; http://php.net/soap.wsdl-cache-dir soap.wsdl_cache_dir="/tmp" ; (time to live) Sets the number of second while cached file will be used ; instead of original one. ; http://php.net/soap.wsdl-cache-ttl soap.wsdl_cache_ttl=86400 ; Sets the size of the cache limit. (Max. number of WSDL files to cache) soap.wsdl_cache_limit = 5 [sysvshm] ; A default size of the shared memory segment ;sysvshm.init_mem = 10000 [ldap] ; Sets the maximum number of open links or -1 for unlimited. ldap.max_links = -1 [mcrypt] ; For more information about mcrypt settings see http://php.net/mcrypt-module-open ; Directory where to load mcrypt algorithms ; Default: Compiled in into libmcrypt (usually /usr/local/lib/libmcrypt) ;mcrypt.algorithms_dir= ; Directory where to load mcrypt modes ; Default: Compiled in into libmcrypt (usually /usr/local/lib/libmcrypt) ;mcrypt.modes_dir= [dba] ;dba.default_handler= [opcache] ; Determines if Zend OPCache is enabled ;opcache.enable=1 ; Determines if Zend OPCache is enabled for the CLI version of PHP ;opcache.enable_cli=0 ; The OPcache shared memory storage size. ;opcache.memory_consumption=128 ; The amount of memory for interned strings in Mbytes. ;opcache.interned_strings_buffer=8 ; The maximum number of keys (scripts) in the OPcache hash table. ; Only numbers between 200 and 1000000 are allowed. ;opcache.max_accelerated_files=10000 ; The maximum percentage of "wasted" memory until a restart is scheduled. ;opcache.max_wasted_percentage=5 ; When this directive is enabled, the OPcache appends the current working ; directory to the script key, thus eliminating possible collisions between ; files with the same name (basename). Disabling the directive improves ; performance, but may break existing applications. ;opcache.use_cwd=1 ; When disabled, you must reset the OPcache manually or restart the ; webserver for changes to the filesystem to take effect. ;opcache.validate_timestamps=1 ; How often (in seconds) to check file timestamps for changes to the shared ; memory storage allocation. ("1" means validate once per second, but only ; once per request. "0" means always validate) ;opcache.revalidate_freq=2 ; Enables or disables file search in include_path optimization ;opcache.revalidate_path=0 ; If disabled, all PHPDoc comments are dropped from the code to reduce the ; size of the optimized code. ;opcache.save_comments=1 ; If enabled, a fast shutdown sequence is used for the accelerated code ; Depending on the used Memory Manager this may cause some incompatibilities. ;opcache.fast_shutdown=0 ; Allow file existence override (file_exists, etc.) performance feature. ;opcache.enable_file_override=0 ; A bitmask, where each bit enables or disables the appropriate OPcache ; passes ;opcache.optimization_level=0xffffffff ;opcache.inherited_hack=1 ;opcache.dups_fix=0 ; The location of the OPcache blacklist file (wildcards allowed). ; Each OPcache blacklist file is a text file that holds the names of files ; that should not be accelerated. The file format is to add each filename ; to a new line. The filename may be a full path or just a file prefix ; (i.e., /var/www/x blacklists all the files and directories in /var/www ; that start with 'x'). Line starting with a ; are ignored (comments). ;opcache.blacklist_filename= ; Allows exclusion of large files from being cached. By default all files ; are cached. ;opcache.max_file_size=0 ; Check the cache checksum each N requests. ; The default value of "0" means that the checks are disabled. ;opcache.consistency_checks=0 ; How long to wait (in seconds) for a scheduled restart to begin if the cache ; is not being accessed. ;opcache.force_restart_timeout=180 ; OPcache error_log file name. Empty string assumes "stderr". ;opcache.error_log= ; All OPcache errors go to the Web server log. ; By default, only fatal errors (level 0) or errors (level 1) are logged. ; You can also enable warnings (level 2), info messages (level 3) or ; debug messages (level 4). ;opcache.log_verbosity_level=1 ; Preferred Shared Memory back-end. Leave empty and let the system decide. ;opcache.preferred_memory_model= ; Protect the shared memory from unexpected writing during script execution. ; Useful for internal debugging only. ;opcache.protect_memory=0 ; Allows calling OPcache API functions only from PHP scripts which path is ; started from specified string. The default "" means no restriction ;opcache.restrict_api= ; Mapping base of shared memory segments (for Windows only). All the PHP ; processes have to map shared memory into the same address space. This ; directive allows to manually fix the "Unable to reattach to base address" ; errors. ;opcache.mmap_base= ; Enables and sets the second level cache directory. ; It should improve performance when SHM memory is full, at server restart or ; SHM reset. The default "" disables file based caching. ;opcache.file_cache= ; Enables or disables opcode caching in shared memory. ;opcache.file_cache_only=0 ; Enables or disables checksum validation when script loaded from file cache. ;opcache.file_cache_consistency_checks=1 ; Implies opcache.file_cache_only=1 for a certain process that failed to ; reattach to the shared memory (for Windows only). Explicitly enabled file ; cache is required. ;opcache.file_cache_fallback=1 ; Enables or disables copying of PHP code (text segment) into HUGE PAGES. ; This should improve performance, but requires appropriate OS configuration. ;opcache.huge_code_pages=0 ; Validate cached file permissions. ;opcache.validate_permission=0 ; Prevent name collisions in chroot'ed environment. ;opcache.validate_root=0 ; If specified, it produces opcode dumps for debugging different stages of ; optimizations. ;opcache.opt_debug_level=0 [curl] ; A default value for the CURLOPT_CAINFO option. This is required to be an ; absolute path. ;curl.cainfo = [openssl] ; The location of a Certificate Authority (CA) file on the local filesystem ; to use when verifying the identity of SSL/TLS peers. Most users should ; not specify a value for this directive as PHP will attempt to use the ; OS-managed cert stores in its absence. If specified, this value may still ; be overridden on a per-stream basis via the "cafile" SSL stream context ; option. ;openssl.cafile= ; If openssl.cafile is not specified or if the CA file is not found, the ; directory pointed to by openssl.capath is searched for a suitable ; certificate. This value must be a correctly hashed certificate directory. ; Most users should not specify a value for this directive as PHP will ; attempt to use the OS-managed cert stores in its absence. If specified, ; this value may still be overridden on a per-stream basis via the "capath" ; SSL stream context option. ;openssl.capath= ; Local Variables: ; tab-width: 4 ; End: [Zend] zend_extension="/usr/local/ioncube/ioncube_loader_lin_7.1.so" ; fix for segfaults auto_globals_jit = Off cgi.fix_pathinfo = 1 mbstring.http_input = "pass" mbstring.http_output = "pass" mbstring.encoding_translation = 0 ; Enable Extensions extension=uploadprogress.so extension=imagick.so extension=jsmin.so extension=redis.so ; APCu extension=apcu.so apc.enable_cli=1 apc.gc_ttl=300 apc.shm_segments=1 apc.shm_size=256M apc.slam_defense=0 apc.ttl=0 ; ================================================ FILE: aegir/conf/php/php72-cli.ini ================================================ [PHP] ;;;;;;;;;;;;;;;;;;; ; About php.ini ; ;;;;;;;;;;;;;;;;;;; ; PHP's initialization file, generally called php.ini, is responsible for ; configuring many of the aspects of PHP's behavior. ; PHP attempts to find and load this configuration from a number of locations. ; The following is a summary of its search order: ; 1. SAPI module specific location. ; 2. The PHPRC environment variable. (As of PHP 5.2.0) ; 3. A number of predefined registry keys on Windows (As of PHP 5.2.0) ; 4. Current working directory (except CLI) ; 5. The web server's directory (for SAPI modules), or directory of PHP ; (otherwise in Windows) ; 6. The directory from the --with-config-file-path compile time option, or the ; Windows directory (C:\windows or C:\winnt) ; See the PHP docs for more specific information. ; http://php.net/configuration.file ; The syntax of the file is extremely simple. Whitespace and lines ; beginning with a semicolon are silently ignored (as you probably guessed). ; Section headers (e.g. [Foo]) are also silently ignored, even though ; they might mean something in the future. ; Directives following the section heading [PATH=/www/mysite] only ; apply to PHP files in the /www/mysite directory. Directives ; following the section heading [HOST=www.example.com] only apply to ; PHP files served from www.example.com. Directives set in these ; special sections cannot be overridden by user-defined INI files or ; at runtime. Currently, [PATH=] and [HOST=] sections only work under ; CGI/FastCGI. ; http://php.net/ini.sections ; Directives are specified using the following syntax: ; directive = value ; Directive names are *case sensitive* - foo=bar is different from FOO=bar. ; Directives are variables used to configure PHP or PHP extensions. ; There is no name validation. If PHP can't find an expected ; directive because it is not set or is mistyped, a default value will be used. ; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one ; of the INI constants (On, Off, True, False, Yes, No and None) or an expression ; (e.g. E_ALL & ~E_NOTICE), a quoted string ("bar"), or a reference to a ; previously set variable or directive (e.g. ${foo}) ; Expressions in the INI file are limited to bitwise operators and parentheses: ; | bitwise OR ; ^ bitwise XOR ; & bitwise AND ; ~ bitwise NOT ; ! boolean NOT ; Boolean flags can be turned on using the values 1, On, True or Yes. ; They can be turned off using the values 0, Off, False or No. ; An empty string can be denoted by simply not writing anything after the equal ; sign, or by using the None keyword: ; foo = ; sets foo to an empty string ; foo = None ; sets foo to an empty string ; foo = "None" ; sets foo to the string 'None' ; If you use constants in your value, and these constants belong to a ; dynamically loaded extension (either a PHP extension or a Zend extension), ; you may only use these constants *after* the line that loads the extension. ;;;;;;;;;;;;;;;;;;; ; About this file ; ;;;;;;;;;;;;;;;;;;; ; PHP comes packaged with two INI files. One that is recommended to be used ; in production environments and one that is recommended to be used in ; development environments. ; php.ini-production contains settings which hold security, performance and ; best practices at its core. But please be aware, these settings may break ; compatibility with older or less security conscience applications. We ; recommending using the production ini in production and testing environments. ; php.ini-development is very similar to its production variant, except it is ; much more verbose when it comes to errors. We recommend using the ; development version only in development environments, as errors shown to ; application users can inadvertently leak otherwise secure information. ; This is php.ini-production INI file. ;;;;;;;;;;;;;;;;;;; ; Quick Reference ; ;;;;;;;;;;;;;;;;;;; ; The following are all the settings which are different in either the production ; or development versions of the INIs with respect to PHP's default behavior. ; Please see the actual settings later in the document for more details as to why ; we recommend these changes in PHP's behavior. display_errors = Off ; Default Value: On ; Development Value: On ; Production Value: Off ; display_startup_errors ; Default Value: Off ; Development Value: On ; Production Value: Off ; error_reporting ; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; html_errors ; Default Value: On ; Development Value: On ; Production value: On ; log_errors ; Default Value: Off ; Development Value: On ; Production Value: On ; max_input_time ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; output_buffering ; Default Value: Off ; Development Value: 4096 ; Production Value: 4096 ; register_argc_argv ; Default Value: On ; Development Value: Off ; Production Value: Off ; request_order ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; session.gc_divisor ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; session.sid_bits_per_character ; Default Value: 4 ; Development Value: 5 ; Production Value: 5 ; short_open_tag ; Default Value: On ; Development Value: Off ; Production Value: Off ; track_errors ; Default Value: Off ; Development Value: On ; Production Value: Off ; variables_order ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS" ;;;;;;;;;;;;;;;;;;;; ; php.ini Options ; ;;;;;;;;;;;;;;;;;;;; ; Name for user-defined php.ini (.htaccess) files. Default is ".user.ini" ;user_ini.filename = ".user.ini" ; To disable this feature set this option to empty value user_ini.filename = ; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes) ;user_ini.cache_ttl = 300 ;;;;;;;;;;;;;;;;;;;; ; Language Options ; ;;;;;;;;;;;;;;;;;;;; ; Enable the PHP scripting language engine under Apache. ; http://php.net/engine engine = On ; This directive determines whether or not PHP will recognize code between ; tags as PHP source which should be processed as such. It is ; generally recommended that should be used and that this feature ; should be disabled, as enabling it may result in issues when generating XML ; documents, however this remains supported for backward compatibility reasons. ; Note that this directive does not control the would work. ; http://php.net/syntax-highlighting ;highlight.string = #DD0000 ;highlight.comment = #FF9900 ;highlight.keyword = #007700 ;highlight.default = #0000BB ;highlight.html = #000000 ; If enabled, the request will be allowed to complete even if the user aborts ; the request. Consider enabling it if executing long requests, which may end up ; being interrupted by the user or a browser timing out. PHP's default behavior ; is to disable this feature. ; http://php.net/ignore-user-abort ;ignore_user_abort = On ; Determines the size of the realpath cache to be used by PHP. This value should ; be increased on systems where PHP opens many files to reflect the quantity of ; the file operations performed. ; http://php.net/realpath-cache-size realpath_cache_size=64M ; Duration of time, in seconds for which to cache realpath information for a given ; file or directory. For systems with rarely changing files, consider increasing this ; value. ; http://php.net/realpath-cache-ttl realpath_cache_ttl=5 ; Enables or disables the circular reference collector. ; http://php.net/zend.enable-gc zend.enable_gc = On ; If enabled, scripts may be written in encodings that are incompatible with ; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such ; encodings. To use this feature, mbstring extension must be enabled. ; Default: Off ;zend.multibyte = Off ; Allows to set the default encoding for the scripts. This value will be used ; unless "declare(encoding=...)" directive appears at the top of the script. ; Only affects if zend.multibyte is set. ; Default: "" ;zend.script_encoding = ;;;;;;;;;;;;;;;;; ; Miscellaneous ; ;;;;;;;;;;;;;;;;; ; Decides whether PHP may expose the fact that it is installed on the server ; (e.g. by adding its signature to the Web server header). It is no security ; threat in any way, but it makes it possible to determine whether you use PHP ; on your server or not. ; http://php.net/expose-php expose_php = On ;;;;;;;;;;;;;;;;;;; ; Resource Limits ; ;;;;;;;;;;;;;;;;;;; ; Maximum execution time of each script, in seconds ; http://php.net/max-execution-time ; Note: This directive is hardcoded to 0 for the CLI SAPI max_execution_time = 3600 ; Maximum amount of time each script may spend parsing request data. It's a good ; idea to limit this time on productions servers in order to eliminate unexpectedly ; long running scripts. ; Note: This directive is hardcoded to -1 for the CLI SAPI ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; http://php.net/max-input-time max_input_time = 3600 ; Maximum input variable nesting level ; http://php.net/max-input-nesting-level ;max_input_nesting_level = 64 ; How many GET/POST/COOKIE input variables may be accepted max_input_vars = 9999 ; Maximum amount of memory a script may consume (128MB) ; http://php.net/memory-limit memory_limit = 395M ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; Error handling and logging ; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; This directive informs PHP of which errors, warnings and notices you would like ; it to take action for. The recommended way of setting values for this ; directive is through the use of the error level constants and bitwise ; operators. The error level constants are below here for convenience as well as ; some common settings and their meanings. ; By default, PHP is set to take action on all errors, notices and warnings EXCEPT ; those related to E_NOTICE and E_STRICT, which together cover best practices and ; recommended coding standards in PHP. For performance reasons, this is the ; recommend error reporting setting. Your production server shouldn't be wasting ; resources complaining about best practices and coding standards. That's what ; development servers and development settings are for. ; Note: The php.ini-development file has this setting as E_ALL. This ; means it pretty much reports everything which is exactly what you want during ; development and early testing. ; ; Error Level Constants: ; E_ALL - All errors and warnings (includes E_STRICT as of PHP 5.4.0) ; E_ERROR - fatal run-time errors ; E_RECOVERABLE_ERROR - almost fatal run-time errors ; E_WARNING - run-time warnings (non-fatal errors) ; E_PARSE - compile-time parse errors ; E_NOTICE - run-time notices (these are warnings which often result ; from a bug in your code, but it's possible that it was ; intentional (e.g., using an uninitialized variable and ; relying on the fact it is automatically initialized to an ; empty string) ; E_STRICT - run-time notices, enable to have PHP suggest changes ; to your code which will ensure the best interoperability ; and forward compatibility of your code ; E_CORE_ERROR - fatal errors that occur during PHP's initial startup ; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's ; initial startup ; E_COMPILE_ERROR - fatal compile-time errors ; E_COMPILE_WARNING - compile-time warnings (non-fatal errors) ; E_USER_ERROR - user-generated error message ; E_USER_WARNING - user-generated warning message ; E_USER_NOTICE - user-generated notice message ; E_DEPRECATED - warn about code that will not work in future versions ; of PHP ; E_USER_DEPRECATED - user-generated deprecation warnings ; ; Common Values: ; E_ALL (Show all errors, warnings and notices including coding standards.) ; E_ALL & ~E_NOTICE (Show all errors, except for notices) ; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.) ; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors) ; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; http://php.net/error-reporting error_reporting = 1 ; This directive controls whether or not and where PHP will output errors, ; notices and warnings too. Error output is very useful during development, but ; it could be very dangerous in production environments. Depending on the code ; which is triggering the error, sensitive information could potentially leak ; out of your application such as database usernames and passwords or worse. ; For production environments, we recommend logging errors rather than ; sending them to STDOUT. ; Possible Values: ; Off = Do not display any errors ; stderr = Display errors to STDERR (affects only CGI/CLI binaries!) ; On or stdout = Display errors to STDOUT ; Default Value: On ; Development Value: On ; Production Value: Off ; http://php.net/display-errors display_errors = Off ; The display of errors which occur during PHP's startup sequence are handled ; separately from display_errors. PHP's default behavior is to suppress those ; errors from clients. Turning the display of startup errors on can be useful in ; debugging configuration problems. We strongly recommend you ; set this to 'off' for production servers. ; Default Value: Off ; Development Value: On ; Production Value: Off ; http://php.net/display-startup-errors display_startup_errors = Off ; Besides displaying errors, PHP can also log errors to locations such as a ; server-specific log, STDERR, or a location specified by the error_log ; directive found below. While errors should not be displayed on productions ; servers they should still be monitored and logging is a great way to do that. ; Default Value: Off ; Development Value: On ; Production Value: On ; http://php.net/log-errors log_errors = On ; Set maximum length of log_errors. In error_log information about the source is ; added. The default is 1024 and 0 allows to not apply any maximum length at all. ; http://php.net/log-errors-max-len log_errors_max_len = 1024 ; Do not log repeated messages. Repeated errors must occur in same file on same ; line unless ignore_repeated_source is set true. ; http://php.net/ignore-repeated-errors ignore_repeated_errors = Off ; Ignore source of message when ignoring repeated messages. When this setting ; is On you will not log errors with repeated messages from different files or ; source lines. ; http://php.net/ignore-repeated-source ignore_repeated_source = Off ; If this parameter is set to Off, then memory leaks will not be shown (on ; stdout or in the log). This has only effect in a debug compile, and if ; error reporting includes E_WARNING in the allowed list ; http://php.net/report-memleaks report_memleaks = On ; This setting is on by default. ;report_zend_debug = 0 ; Store the last error/warning message in $php_errormsg (boolean). Setting this value ; to On can assist in debugging and is appropriate for development servers. It should ; however be disabled on production servers. ; This directive is DEPRECATED. ; Default Value: Off ; Development Value: Off ; Production Value: Off ; http://php.net/track-errors ;track_errors = Off ; Turn off normal error reporting and emit XML-RPC error XML ; http://php.net/xmlrpc-errors ;xmlrpc_errors = 0 ; An XML-RPC faultCode ;xmlrpc_error_number = 0 ; When PHP displays or logs an error, it has the capability of formatting the ; error message as HTML for easier reading. This directive controls whether ; the error message is formatted as HTML or not. ; Note: This directive is hardcoded to Off for the CLI SAPI ; Default Value: On ; Development Value: On ; Production value: On ; http://php.net/html-errors html_errors = Off ; If html_errors is set to On *and* docref_root is not empty, then PHP ; produces clickable error messages that direct to a page describing the error ; or function causing the error in detail. ; You can download a copy of the PHP manual from http://php.net/docs ; and change docref_root to the base URL of your local copy including the ; leading '/'. You must also specify the file extension being used including ; the dot. PHP's default behavior is to leave these settings empty, in which ; case no links to documentation are generated. ; Note: Never use this feature for production boxes. ; http://php.net/docref-root ; Examples ;docref_root = "/phpmanual/" ; http://php.net/docref-ext ;docref_ext = .html ; String to output before an error message. PHP's default behavior is to leave ; this setting blank. ; http://php.net/error-prepend-string ; Example: ;error_prepend_string = "" ; String to output after an error message. PHP's default behavior is to leave ; this setting blank. ; http://php.net/error-append-string ; Example: ;error_append_string = "" ; Log errors to specified file. PHP's default behavior is to leave this value ; empty. ; http://php.net/error-log ; Example: ;error_log = php_errors.log ; Log errors to syslog (Event Log on Windows). ;error_log = syslog error_log = /var/log/php/error_log_cli_72 ;windows.show_crt_warning ; Default value: 0 ; Development value: 0 ; Production value: 0 ;;;;;;;;;;;;;;;;; ; Data Handling ; ;;;;;;;;;;;;;;;;; ; The separator used in PHP generated URLs to separate arguments. ; PHP's default setting is "&". ; http://php.net/arg-separator.output ; Example: ;arg_separator.output = "&" ; List of separator(s) used by PHP to parse input URLs into variables. ; PHP's default setting is "&". ; NOTE: Every character in this directive is considered as separator! ; http://php.net/arg-separator.input ; Example: ;arg_separator.input = ";&" ; This directive determines which super global arrays are registered when PHP ; starts up. G,P,C,E & S are abbreviations for the following respective super ; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty ; paid for the registration of these arrays and because ENV is not as commonly ; used as the others, ENV is not recommended on productions servers. You ; can still get access to the environment variables through getenv() should you ; need to. ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS"; ; http://php.net/variables-order variables_order = "GPCS" ; This directive determines which super global data (G,P & C) should be ; registered into the super global array REQUEST. If so, it also determines ; the order in which that data is registered. The values for this directive ; are specified in the same manner as the variables_order directive, ; EXCEPT one. Leaving this value empty will cause PHP to use the value set ; in the variables_order directive. It does not mean it will leave the super ; globals array REQUEST empty. ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; http://php.net/request-order request_order = "GP" ; This directive determines whether PHP registers $argv & $argc each time it ; runs. $argv contains an array of all the arguments passed to PHP when a script ; is invoked. $argc contains an integer representing the number of arguments ; that were passed when the script was invoked. These arrays are extremely ; useful when running scripts from the command line. When this directive is ; enabled, registering these variables consumes CPU cycles and memory each time ; a script is executed. For performance reasons, this feature should be disabled ; on production servers. ; Note: This directive is hardcoded to On for the CLI SAPI ; Default Value: On ; Development Value: Off ; Production Value: Off ; http://php.net/register-argc-argv register_argc_argv = Off ; When enabled, the ENV, REQUEST and SERVER variables are created when they're ; first used (Just In Time) instead of when the script starts. If these ; variables are not used within a script, having this directive on will result ; in a performance gain. The PHP directive register_argc_argv must be disabled ; for this directive to have any affect. ; http://php.net/auto-globals-jit auto_globals_jit = On ; Whether PHP will read the POST data. ; This option is enabled by default. ; Most likely, you won't want to disable this option globally. It causes $_POST ; and $_FILES to always be empty; the only way you will be able to read the ; POST data will be through the php://input stream wrapper. This can be useful ; to proxy requests or to process the POST data in a memory efficient fashion. ; http://php.net/enable-post-data-reading ;enable_post_data_reading = Off ; Maximum size of POST data that PHP will accept. ; Its value may be 0 to disable the limit. It is ignored if POST data reading ; is disabled through enable_post_data_reading. ; http://php.net/post-max-size post_max_size = 350M ; Automatically add files before PHP document. ; http://php.net/auto-prepend-file auto_prepend_file = ; Automatically add files after PHP document. ; http://php.net/auto-append-file auto_append_file = ; By default, PHP will output a media type using the Content-Type header. To ; disable this, simply set it to be empty. ; ; PHP's built-in default media type is set to text/html. ; http://php.net/default-mimetype default_mimetype = "text/html" ; PHP's default character set is set to UTF-8. ; http://php.net/default-charset default_charset = "UTF-8" ; PHP internal character encoding is set to empty. ; If empty, default_charset is used. ; http://php.net/internal-encoding ;internal_encoding = ; PHP input character encoding is set to empty. ; If empty, default_charset is used. ; http://php.net/input-encoding ;input_encoding = ; PHP output character encoding is set to empty. ; If empty, default_charset is used. ; See also output_buffer. ; http://php.net/output-encoding ;output_encoding = ;;;;;;;;;;;;;;;;;;;;;;;;; ; Paths and Directories ; ;;;;;;;;;;;;;;;;;;;;;;;;; ; UNIX: "/path1:/path2" ;include_path = ".:/php/includes" ; ; Windows: "\path1;\path2" ;include_path = ".;c:\php\includes" ; ; PHP's default setting for include_path is ".;/path/to/php/pear" ; http://php.net/include-path include_path = ".:/opt/php72/lib/php" ; The root of the PHP pages, used only if nonempty. ; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root ; if you are running php as a CGI under any web server (other than IIS) ; see documentation for security issues. The alternate is to use the ; cgi.force_redirect configuration below ; http://php.net/doc-root doc_root = ; The directory under which PHP opens the script using /~username used only ; if nonempty. ; http://php.net/user-dir user_dir = ; Directory in which the loadable extensions (modules) reside. ; http://php.net/extension-dir ; extension_dir = "./" ; On windows: ; extension_dir = "ext" extension_dir = "/opt/php72/lib/php/extensions/no-debug-non-zts-20170718/" ; Directory where the temporary files should be placed. ; Defaults to the system default (see sys_get_temp_dir) sys_temp_dir = "/tmp" ; Whether or not to enable the dl() function. The dl() function does NOT work ; properly in multithreaded servers, such as IIS or Zeus, and is automatically ; disabled on them. ; http://php.net/enable-dl enable_dl = Off ; cgi.force_redirect is necessary to provide security running PHP as a CGI under ; most web servers. Left undefined, PHP turns this on by default. You can ; turn it off here AT YOUR OWN RISK ; **You CAN safely turn this off for IIS, in fact, you MUST.** ; http://php.net/cgi.force-redirect ;cgi.force_redirect = 1 ; if cgi.nph is enabled it will force cgi to always sent Status: 200 with ; every request. PHP's default behavior is to disable this feature. ;cgi.nph = 1 ; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape ; (iPlanet) web servers, you MAY need to set an environment variable name that PHP ; will look for to know it is OK to continue execution. Setting this variable MAY ; cause security issues, KNOW WHAT YOU ARE DOING FIRST. ; http://php.net/cgi.redirect-status-env ;cgi.redirect_status_env = ; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's ; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok ; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting ; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting ; of zero causes PHP to behave as before. Default is 1. You should fix your scripts ; to use SCRIPT_FILENAME rather than PATH_TRANSLATED. ; http://php.net/cgi.fix-pathinfo ;cgi.fix_pathinfo=1 ; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside ; of the web tree and people will not be able to circumvent .htaccess security. ; http://php.net/cgi.dicard-path ;cgi.discard_path=1 ; FastCGI under IIS (on WINNT based OS) supports the ability to impersonate ; security tokens of the calling client. This allows IIS to define the ; security context that the request runs under. mod_fastcgi under Apache ; does not currently support this feature (03/17/2002) ; Set to 1 if running under IIS. Default is zero. ; http://php.net/fastcgi.impersonate ;fastcgi.impersonate = 1 ; Disable logging through FastCGI connection. PHP's default behavior is to enable ; this feature. ;fastcgi.logging = 0 ; cgi.rfc2616_headers configuration option tells PHP what type of headers to ; use when sending HTTP response code. If set to 0, PHP sends Status: header that ; is supported by Apache. When this option is set to 1, PHP will send ; RFC2616 compliant header. ; Default is zero. ; http://php.net/cgi.rfc2616-headers ;cgi.rfc2616_headers = 0 ; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #! ; (shebang) at the top of the running script. This line might be needed if the ; script support running both as stand-alone script and via PHP CGI<. PHP in CGI ; mode skips this line and ignores its content if this directive is turned on. ; http://php.net/cgi.check-shebang-line ;cgi.check_shebang_line=1 ;;;;;;;;;;;;;;;; ; File Uploads ; ;;;;;;;;;;;;;;;; ; Whether to allow HTTP file uploads. ; http://php.net/file-uploads file_uploads = On ; Temporary directory for HTTP uploaded files (will use system default if not ; specified). ; http://php.net/upload-tmp-dir upload_tmp_dir = /tmp ; Maximum allowed size for uploaded files. ; http://php.net/upload-max-filesize upload_max_filesize = 325M ; Maximum number of files that can be uploaded via a single request max_file_uploads = 50 ;;;;;;;;;;;;;;;;;; ; Fopen wrappers ; ;;;;;;;;;;;;;;;;;; ; Whether to allow the treatment of URLs (like http:// or ftp://) as files. ; http://php.net/allow-url-fopen allow_url_fopen = On ; Whether to allow include/require to open URLs (like http:// or ftp://) as files. ; http://php.net/allow-url-include allow_url_include = Off ; Define the anonymous ftp password (your email address). PHP's default setting ; for this is empty. ; http://php.net/from ;from="john@doe.com" ; Define the User-Agent string. PHP's default setting for this is empty. ; http://php.net/user-agent ;user_agent="PHP" ; Default timeout for socket based streams (seconds) ; http://php.net/default-socket-timeout default_socket_timeout = 3600 ; If your scripts have to deal with files from Macintosh systems, ; or you are running on a Mac and need to deal with files from ; unix or win32 systems, setting this flag will cause PHP to ; automatically detect the EOL character in those files so that ; fgets() and file() will work regardless of the source of the file. ; http://php.net/auto-detect-line-endings auto_detect_line_endings = On ;;;;;;;;;;;;;;;;;;;;;; ; Dynamic Extensions ; ;;;;;;;;;;;;;;;;;;;;;; ; If you wish to have an extension loaded automatically, use the following ; syntax: ; ; extension=modulename ; ; For example: ; ; extension=mysqli ; ; When the extension library to load is not located in the default extension ; directory, You may specify an absolute path to the library file: ; ; extension=/path/to/extension/mysqli.so ; ; Note : The syntax used in previous PHP versions ('extension=.so' and ; 'extension='php_.dll') is supported for legacy reasons and may be ; deprecated in a future PHP major version. So, when it is possible, please ; move to the new ('extension=) syntax. ; ; Notes for Windows environments : ; ; - Many DLL files are located in the extensions/ (PHP 4) or ext/ (PHP 5+) ; extension folders as well as the separate PECL DLL download (PHP 5+). ; Be sure to appropriately set the extension_dir directive. ; ;extension=bz2 ;extension=curl ;extension=fileinfo ;extension=gd2 ;extension=gettext ;extension=gmp ;extension=intl ;extension=imap ;extension=interbase ;extension=ldap ;extension=mbstring ;extension=exif ; Must be after mbstring as it depends on it ;extension=mysqli ;extension=oci8_12c ; Use with Oracle Database 12c Instant Client ;extension=odbc ;extension=openssl ;extension=pdo_firebird ;extension=pdo_mysql ;extension=pdo_oci ;extension=pdo_odbc ;extension=pdo_pgsql ;extension=pdo_sqlite ;extension=pgsql ;extension=shmop ; The MIBS data available in the PHP distribution must be installed. ; See http://www.php.net/manual/en/snmp.installation.php ;extension=snmp ;extension=soap ;extension=sockets ;extension=sqlite3 ;extension=tidy ;extension=xmlrpc ;extension=xsl ;;;;;;;;;;;;;;;;;;; ; Module Settings ; ;;;;;;;;;;;;;;;;;;; [CLI Server] ; Whether the CLI web server uses ANSI color coding in its terminal output. cli_server.color = On [Date] ; Defines the default timezone used by the date functions ; http://php.net/date.timezone date.timezone = "UTC" ; http://php.net/date.default-latitude ;date.default_latitude = 31.7667 ; http://php.net/date.default-longitude ;date.default_longitude = 35.2333 ; http://php.net/date.sunrise-zenith ;date.sunrise_zenith = 90.583333 ; http://php.net/date.sunset-zenith ;date.sunset_zenith = 90.583333 [filter] ; http://php.net/filter.default ;filter.default = unsafe_raw ; http://php.net/filter.default-flags ;filter.default_flags = [iconv] ; Use of this INI entry is deprecated, use global input_encoding instead. ; If empty, default_charset or input_encoding or iconv.input_encoding is used. ; The precedence is: default_charset < intput_encoding < iconv.input_encoding ;iconv.input_encoding = ; Use of this INI entry is deprecated, use global internal_encoding instead. ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;iconv.internal_encoding = ; Use of this INI entry is deprecated, use global output_encoding instead. ; If empty, default_charset or output_encoding or iconv.output_encoding is used. ; The precedence is: default_charset < output_encoding < iconv.output_encoding ; To use an output encoding conversion, iconv's output handler must be set ; otherwise output encoding conversion cannot be performed. ;iconv.output_encoding = [intl] ;intl.default_locale = ; This directive allows you to produce PHP errors when some error ; happens within intl functions. The value is the level of the error produced. ; Default is 0, which does not produce any errors. ;intl.error_level = E_WARNING ;intl.use_exceptions = 0 [sqlite3] ;sqlite3.extension_dir = [Pcre] ;PCRE library backtracking limit. ; http://php.net/pcre.backtrack-limit ;pcre.backtrack_limit=100000 ;PCRE library recursion limit. ;Please note that if you set this value to a high number you may consume all ;the available process stack and eventually crash PHP (due to reaching the ;stack size limit imposed by the Operating System). ; http://php.net/pcre.recursion-limit ;pcre.recursion_limit=100000 ;Enables or disables JIT compilation of patterns. This requires the PCRE ;library to be compiled with JIT support. ;pcre.jit=1 [Pdo] ; Whether to pool ODBC connections. Can be one of "strict", "relaxed" or "off" ; http://php.net/pdo-odbc.connection-pooling ;pdo_odbc.connection_pooling=strict ;pdo_odbc.db2_instance_name [Pdo_mysql] ; If mysqlnd is used: Number of cache slots for the internal result set cache ; http://php.net/pdo_mysql.cache_size pdo_mysql.cache_size = 2000 ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. ; http://php.net/pdo_mysql.default-socket pdo_mysql.default_socket= [Phar] ; http://php.net/phar.readonly ;phar.readonly = On ; http://php.net/phar.require-hash ;phar.require_hash = On ;phar.cache_list = [mail function] ; For Win32 only. ; http://php.net/smtp ;SMTP = localhost ; http://php.net/smtp-port ;smtp_port = 25 ; For Win32 only. ; http://php.net/sendmail-from ;sendmail_from = me@example.com ; For Unix only. You may supply arguments as well (default: "sendmail -t -i"). ; http://php.net/sendmail-path sendmail_path = /usr/sbin/sendmail -t -i ; Force the addition of the specified parameters to be passed as extra parameters ; to the sendmail binary. These parameters will always replace the value of ; the 5th parameter to mail(). ;mail.force_extra_parameters = ; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename mail.add_x_header = Off ; The path to a log file that will log all mail() calls. Log entries include ; the full path of the script, line number, To address and headers. ;mail.log = ; Log mail to syslog (Event Log on Windows). ;mail.log = syslog [ODBC] ; http://php.net/odbc.default-db ;odbc.default_db = Not yet implemented ; http://php.net/odbc.default-user ;odbc.default_user = Not yet implemented ; http://php.net/odbc.default-pw ;odbc.default_pw = Not yet implemented ; Controls the ODBC cursor model. ; Default: SQL_CURSOR_STATIC (default). ;odbc.default_cursortype ; Allow or prevent persistent links. ; http://php.net/odbc.allow-persistent odbc.allow_persistent = On ; Check that a connection is still valid before reuse. ; http://php.net/odbc.check-persistent odbc.check_persistent = On ; Maximum number of persistent links. -1 means no limit. ; http://php.net/odbc.max-persistent odbc.max_persistent = -1 ; Maximum number of links (persistent + non-persistent). -1 means no limit. ; http://php.net/odbc.max-links odbc.max_links = -1 ; Handling of LONG fields. Returns number of bytes to variables. 0 means ; passthru. ; http://php.net/odbc.defaultlrl odbc.defaultlrl = 4096 ; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char. ; See the documentation on odbc_binmode and odbc_longreadlen for an explanation ; of odbc.defaultlrl and odbc.defaultbinmode ; http://php.net/odbc.defaultbinmode odbc.defaultbinmode = 1 ;birdstep.max_links = -1 [Interbase] ; Allow or prevent persistent links. ibase.allow_persistent = 1 ; Maximum number of persistent links. -1 means no limit. ibase.max_persistent = -1 ; Maximum number of links (persistent + non-persistent). -1 means no limit. ibase.max_links = -1 ; Default database name for ibase_connect(). ;ibase.default_db = ; Default username for ibase_connect(). ;ibase.default_user = ; Default password for ibase_connect(). ;ibase.default_password = ; Default charset for ibase_connect(). ;ibase.default_charset = ; Default timestamp format. ibase.timestampformat = "%Y-%m-%d %H:%M:%S" ; Default date format. ibase.dateformat = "%Y-%m-%d" ; Default time format. ibase.timeformat = "%H:%M:%S" [MySQLi] ; Maximum number of persistent links. -1 means no limit. ; http://php.net/mysqli.max-persistent mysqli.max_persistent = -1 ; Allow accessing, from PHP's perspective, local files with LOAD DATA statements ; http://php.net/mysqli.allow_local_infile ;mysqli.allow_local_infile = On ; Allow or prevent persistent links. ; http://php.net/mysqli.allow-persistent mysqli.allow_persistent = On ; Maximum number of links. -1 means no limit. ; http://php.net/mysqli.max-links mysqli.max_links = -1 ; If mysqlnd is used: Number of cache slots for the internal result set cache ; http://php.net/mysqli.cache_size mysqli.cache_size = 2000 ; Default port number for mysqli_connect(). If unset, mysqli_connect() will use ; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the ; compile-time value defined MYSQL_PORT (in that order). Win32 will only look ; at MYSQL_PORT. ; http://php.net/mysqli.default-port mysqli.default_port = 3306 ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. ; http://php.net/mysqli.default-socket mysqli.default_socket = ; Default host for mysql_connect() (doesn't apply in safe mode). ; http://php.net/mysqli.default-host mysqli.default_host = ; Default user for mysql_connect() (doesn't apply in safe mode). ; http://php.net/mysqli.default-user mysqli.default_user = ; Default password for mysqli_connect() (doesn't apply in safe mode). ; Note that this is generally a *bad* idea to store passwords in this file. ; *Any* user with PHP access can run 'echo get_cfg_var("mysqli.default_pw") ; and reveal this password! And of course, any users with read access to this ; file will be able to reveal the password as well. ; http://php.net/mysqli.default-pw mysqli.default_pw = ; Allow or prevent reconnect mysqli.reconnect = Off [mysqlnd] ; Enable / Disable collection of general statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. ; http://php.net/mysqlnd.collect_statistics mysqlnd.collect_statistics = 0 ; Enable / Disable collection of memory usage statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. ; http://php.net/mysqlnd.collect_memory_statistics mysqlnd.collect_memory_statistics = 0 ; Records communication from all extensions using mysqlnd to the specified log ; file. ; http://php.net/mysqlnd.debug ;mysqlnd.debug = ; Defines which queries will be logged. ; http://php.net/mysqlnd.log_mask ;mysqlnd.log_mask = 0 ; Default size of the mysqlnd memory pool, which is used by result sets. ; http://php.net/mysqlnd.mempool_default_size mysqlnd.mempool_default_size = 64000 ; Size of a pre-allocated buffer used when sending commands to MySQL in bytes. ; http://php.net/mysqlnd.net_cmd_buffer_size mysqlnd.net_cmd_buffer_size = 8192 ; Size of a pre-allocated buffer used for reading data sent by the server in ; bytes. ; http://php.net/mysqlnd.net_read_buffer_size mysqlnd.net_read_buffer_size = 131072 ; Timeout for network requests in seconds. ; http://php.net/mysqlnd.net_read_timeout ;mysqlnd.net_read_timeout = 31536000 ; SHA-256 Authentication Plugin related. File with the MySQL server public RSA ; key. ; http://php.net/mysqlnd.sha256_server_public_key ;mysqlnd.sha256_server_public_key = [OCI8] ; Connection: Enables privileged connections using external ; credentials (OCI_SYSOPER, OCI_SYSDBA) ; http://php.net/oci8.privileged-connect ;oci8.privileged_connect = Off ; Connection: The maximum number of persistent OCI8 connections per ; process. Using -1 means no limit. ; http://php.net/oci8.max-persistent ;oci8.max_persistent = -1 ; Connection: The maximum number of seconds a process is allowed to ; maintain an idle persistent connection. Using -1 means idle ; persistent connections will be maintained forever. ; http://php.net/oci8.persistent-timeout ;oci8.persistent_timeout = -1 ; Connection: The number of seconds that must pass before issuing a ; ping during oci_pconnect() to check the connection validity. When ; set to 0, each oci_pconnect() will cause a ping. Using -1 disables ; pings completely. ; http://php.net/oci8.ping-interval ;oci8.ping_interval = 60 ; Connection: Set this to a user chosen connection class to be used ; for all pooled server requests with Oracle 11g Database Resident ; Connection Pooling (DRCP). To use DRCP, this value should be set to ; the same string for all web servers running the same application, ; the database pool must be configured, and the connection string must ; specify to use a pooled server. ;oci8.connection_class = ; High Availability: Using On lets PHP receive Fast Application ; Notification (FAN) events generated when a database node fails. The ; database must also be configured to post FAN events. ;oci8.events = Off ; Tuning: This option enables statement caching, and specifies how ; many statements to cache. Using 0 disables statement caching. ; http://php.net/oci8.statement-cache-size ;oci8.statement_cache_size = 20 ; Tuning: Enables statement prefetching and sets the default number of ; rows that will be fetched automatically after statement execution. ; http://php.net/oci8.default-prefetch ;oci8.default_prefetch = 100 ; Compatibility. Using On means oci_close() will not close ; oci_connect() and oci_new_connect() connections. ; http://php.net/oci8.old-oci-close-semantics ;oci8.old_oci_close_semantics = Off [PostgreSQL] ; Allow or prevent persistent links. ; http://php.net/pgsql.allow-persistent pgsql.allow_persistent = On ; Detect broken persistent links always with pg_pconnect(). ; Auto reset feature requires a little overheads. ; http://php.net/pgsql.auto-reset-persistent pgsql.auto_reset_persistent = Off ; Maximum number of persistent links. -1 means no limit. ; http://php.net/pgsql.max-persistent pgsql.max_persistent = -1 ; Maximum number of links (persistent+non persistent). -1 means no limit. ; http://php.net/pgsql.max-links pgsql.max_links = -1 ; Ignore PostgreSQL backends Notice message or not. ; Notice message logging require a little overheads. ; http://php.net/pgsql.ignore-notice pgsql.ignore_notice = 0 ; Log PostgreSQL backends Notice message or not. ; Unless pgsql.ignore_notice=0, module cannot log notice message. ; http://php.net/pgsql.log-notice pgsql.log_notice = 0 [bcmath] ; Number of decimal digits for all bcmath functions. ; http://php.net/bcmath.scale bcmath.scale = 0 [browscap] ; http://php.net/browscap ;browscap = extra/browscap.ini [Session] ; Handler used to store/retrieve data. ; http://php.net/session.save-handler session.save_handler = files ; Argument passed to save_handler. In the case of files, this is the path ; where data files are stored. Note: Windows users have to change this ; variable in order to use PHP's session functions. ; ; The path can be defined as: ; ; session.save_path = "N;/path" ; ; where N is an integer. Instead of storing all the session files in ; /path, what this will do is use subdirectories N-levels deep, and ; store the session data in those directories. This is useful if ; your OS has problems with many files in one directory, and is ; a more efficient layout for servers that handle many sessions. ; ; NOTE 1: PHP will not create this directory structure automatically. ; You can use the script in the ext/session dir for that purpose. ; NOTE 2: See the section on garbage collection below if you choose to ; use subdirectories for session storage ; ; The file storage module creates files using mode 600 by default. ; You can change that by using ; ; session.save_path = "N;MODE;/path" ; ; where MODE is the octal representation of the mode. Note that this ; does not overwrite the process's umask. ; http://php.net/session.save-path session.save_path = "/opt/tmp" ; Whether to use strict session mode. ; Strict session mode does not accept uninitialized session ID and regenerate ; session ID if browser sends uninitialized session ID. Strict mode protects ; applications from session fixation via session adoption vulnerability. It is ; disabled by default for maximum compatibility, but enabling it is encouraged. ; https://wiki.php.net/rfc/strict_sessions session.use_strict_mode = 0 ; Whether to use cookies. ; http://php.net/session.use-cookies session.use_cookies = 1 ; http://php.net/session.cookie-secure ;session.cookie_secure = ; This option forces PHP to fetch and use a cookie for storing and maintaining ; the session id. We encourage this operation as it's very helpful in combating ; session hijacking when not specifying and managing your own session id. It is ; not the be-all and end-all of session hijacking defense, but it's a good start. ; http://php.net/session.use-only-cookies session.use_only_cookies = 1 ; Name of the session (used as cookie name). ; http://php.net/session.name session.name = PHPSESSID ; Initialize session on request startup. ; http://php.net/session.auto-start session.auto_start = 0 ; Lifetime in seconds of cookie or, if 0, until browser is restarted. ; http://php.net/session.cookie-lifetime session.cookie_lifetime = 0 ; The path for which the cookie is valid. ; http://php.net/session.cookie-path session.cookie_path = / ; The domain for which the cookie is valid. ; http://php.net/session.cookie-domain session.cookie_domain = ; Whether or not to add the httpOnly flag to the cookie, which makes it inaccessible to browser scripting languages such as JavaScript. ; http://php.net/session.cookie-httponly session.cookie_httponly = 1 ; Handler used to serialize data. php is the standard serializer of PHP. ; http://php.net/session.serialize-handler session.serialize_handler = php ; Defines the probability that the 'garbage collection' process is started ; on every session initialization. The probability is calculated by using ; gc_probability/gc_divisor. Where session.gc_probability is the numerator ; and gc_divisor is the denominator in the equation. Setting this value to 1 ; when the session.gc_divisor value is 100 will give you approximately a 1% chance ; the gc will run on any give request. ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; http://php.net/session.gc-probability session.gc_probability = 1 ; Defines the probability that the 'garbage collection' process is started on every ; session initialization. The probability is calculated by using the following equation: ; gc_probability/gc_divisor. Where session.gc_probability is the numerator and ; session.gc_divisor is the denominator in the equation. Setting this value to 1 ; when the session.gc_divisor value is 100 will give you approximately a 1% chance ; the gc will run on any give request. Increasing this value to 1000 will give you ; a 0.1% chance the gc will run on any give request. For high volume production servers, ; this is a more efficient approach. ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; http://php.net/session.gc-divisor session.gc_divisor = 1000 ; After this number of seconds, stored data will be seen as 'garbage' and ; cleaned up by the garbage collection process. ; http://php.net/session.gc-maxlifetime session.gc_maxlifetime = 1440 ; NOTE: If you are using the subdirectory option for storing session files ; (see session.save_path above), then garbage collection does *not* ; happen automatically. You will need to do your own garbage ; collection through a shell script, cron entry, or some other method. ; For example, the following script would is the equivalent of ; setting session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes): ; find /path/to/sessions -cmin +24 -type f | xargs rm ; Check HTTP Referer to invalidate externally stored URLs containing ids. ; HTTP_REFERER has to contain this substring for the session to be ; considered as valid. ; http://php.net/session.referer-check session.referer_check = ; Set to {nocache,private,public,} to determine HTTP caching aspects ; or leave this empty to avoid sending anti-caching headers. ; http://php.net/session.cache-limiter session.cache_limiter = nocache ; Document expires after n minutes. ; http://php.net/session.cache-expire session.cache_expire = 180 ; trans sid support is disabled by default. ; Use of trans sid may risk your users' security. ; Use this option with caution. ; - User may send URL contains active session ID ; to other person via. email/irc/etc. ; - URL that contains active session ID may be stored ; in publicly accessible computer. ; - User may access your site with the same session ID ; always using URL stored in browser's history or bookmarks. ; http://php.net/session.use-trans-sid session.use_trans_sid = 0 ; Set session ID character length. This value could be between 22 to 256. ; Shorter length than default is supported only for compatibility reason. ; Users should use 32 or more chars. ; http://php.net/session.sid-length ; Default Value: 32 ; Development Value: 26 ; Production Value: 26 session.sid_length = 26 ; The URL rewriter will look for URLs in a defined set of HTML tags. ; is special; if you include them here, the rewriter will ; add a hidden field with the info which is otherwise appended ; to URLs. tag's action attribute URL will not be modified ; unless it is specified. ; Note that all valid entries require a "=", even if no value follows. ; Default Value: "a=href,area=href,frame=src,form=" ; Development Value: "a=href,area=href,frame=src,form=" ; Production Value: "a=href,area=href,frame=src,form=" ; http://php.net/url-rewriter.tags session.trans_sid_tags = "a=href,area=href,frame=src,form=" ; URL rewriter does not rewrite absolute URLs by default. ; To enable rewrites for absolute pathes, target hosts must be specified ; at RUNTIME. i.e. use ini_set() ; tags is special. PHP will check action attribute's URL regardless ; of session.trans_sid_tags setting. ; If no host is defined, HTTP_HOST will be used for allowed host. ; Example value: php.net,www.php.net,wiki.php.net ; Use "," for multiple hosts. No spaces are allowed. ; Default Value: "" ; Development Value: "" ; Production Value: "" ;session.trans_sid_hosts="" ; Define how many bits are stored in each character when converting ; the binary hash data to something readable. ; Possible values: ; 4 (4 bits: 0-9, a-f) ; 5 (5 bits: 0-9, a-v) ; 6 (6 bits: 0-9, a-z, A-Z, "-", ",") ; Default Value: 4 ; Development Value: 5 ; Production Value: 5 ; http://php.net/session.hash-bits-per-character session.sid_bits_per_character = 5 ; Enable upload progress tracking in $_SESSION ; Default Value: On ; Development Value: On ; Production Value: On ; http://php.net/session.upload-progress.enabled ;session.upload_progress.enabled = On ; Cleanup the progress information as soon as all POST data has been read ; (i.e. upload completed). ; Default Value: On ; Development Value: On ; Production Value: On ; http://php.net/session.upload-progress.cleanup ;session.upload_progress.cleanup = On ; A prefix used for the upload progress key in $_SESSION ; Default Value: "upload_progress_" ; Development Value: "upload_progress_" ; Production Value: "upload_progress_" ; http://php.net/session.upload-progress.prefix ;session.upload_progress.prefix = "upload_progress_" ; The index name (concatenated with the prefix) in $_SESSION ; containing the upload progress information ; Default Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Development Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Production Value: "PHP_SESSION_UPLOAD_PROGRESS" ; http://php.net/session.upload-progress.name ;session.upload_progress.name = "PHP_SESSION_UPLOAD_PROGRESS" ; How frequently the upload progress should be updated. ; Given either in percentages (per-file), or in bytes ; Default Value: "1%" ; Development Value: "1%" ; Production Value: "1%" ; http://php.net/session.upload-progress.freq ;session.upload_progress.freq = "1%" ; The minimum delay between updates, in seconds ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; http://php.net/session.upload-progress.min-freq ;session.upload_progress.min_freq = "1" ; Only write session data when session data is changed. Enabled by default. ; http://php.net/session.lazy-write ;session.lazy_write = On [Assertion] ; Switch whether to compile assertions at all (to have no overhead at run-time) ; -1: Do not compile at all ; 0: Jump over assertion at run-time ; 1: Execute assertions ; Changing from or to a negative value is only possible in php.ini! (For turning assertions on and off at run-time, see assert.active, when zend.assertions = 1) ; Default Value: 1 ; Development Value: 1 ; Production Value: -1 ; http://php.net/zend.assertions zend.assertions = -1 ; Assert(expr); active by default. ; http://php.net/assert.active ;assert.active = On ; Throw an AssertationException on failed assertions ; http://php.net/assert.exception ;assert.exception = On ; Issue a PHP warning for each failed assertion. (Overridden by assert.exception if active) ; http://php.net/assert.warning ;assert.warning = On ; Don't bail out by default. ; http://php.net/assert.bail ;assert.bail = Off ; User-function to be called if an assertion fails. ; http://php.net/assert.callback ;assert.callback = 0 ; Eval the expression with current error_reporting(). Set to true if you want ; error_reporting(0) around the eval(). ; http://php.net/assert.quiet-eval ;assert.quiet_eval = 0 [COM] ; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs ; http://php.net/com.typelib-file ;com.typelib_file = ; allow Distributed-COM calls ; http://php.net/com.allow-dcom ;com.allow_dcom = true ; autoregister constants of a components typlib on com_load() ; http://php.net/com.autoregister-typelib ;com.autoregister_typelib = true ; register constants casesensitive ; http://php.net/com.autoregister-casesensitive ;com.autoregister_casesensitive = false ; show warnings on duplicate constant registrations ; http://php.net/com.autoregister-verbose ;com.autoregister_verbose = true ; The default character set code-page to use when passing strings to and from COM objects. ; Default: system ANSI code page ;com.code_page= [mbstring] ; language for internal character representation. ; This affects mb_send_mail() and mbstring.detect_order. ; http://php.net/mbstring.language ;mbstring.language = Japanese ; Use of this INI entry is deprecated, use global internal_encoding instead. ; internal/script encoding. ; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*) ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;mbstring.internal_encoding = ; Use of this INI entry is deprecated, use global input_encoding instead. ; http input encoding. ; mbstring.encoding_traslation = On is needed to use this setting. ; If empty, default_charset or input_encoding or mbstring.input is used. ; The precedence is: default_charset < intput_encoding < mbsting.http_input ; http://php.net/mbstring.http-input ;mbstring.http_input = ; Use of this INI entry is deprecated, use global output_encoding instead. ; http output encoding. ; mb_output_handler must be registered as output buffer to function. ; If empty, default_charset or output_encoding or mbstring.http_output is used. ; The precedence is: default_charset < output_encoding < mbstring.http_output ; To use an output encoding conversion, mbstring's output handler must be set ; otherwise output encoding conversion cannot be performed. ; http://php.net/mbstring.http-output ;mbstring.http_output = ; enable automatic encoding translation according to ; mbstring.internal_encoding setting. Input chars are ; converted to internal encoding by setting this to On. ; Note: Do _not_ use automatic encoding translation for ; portable libs/applications. ; http://php.net/mbstring.encoding-translation ;mbstring.encoding_translation = Off ; automatic encoding detection order. ; "auto" detect order is changed according to mbstring.language ; http://php.net/mbstring.detect-order ;mbstring.detect_order = auto ; substitute_character used when character cannot be converted ; one from another ; http://php.net/mbstring.substitute-character ;mbstring.substitute_character = none ; overload(replace) single byte functions by mbstring functions. ; mail(), ereg(), etc are overloaded by mb_send_mail(), mb_ereg(), ; etc. Possible values are 0,1,2,4 or combination of them. ; For example, 7 for overload everything. ; 0: No overload ; 1: Overload mail() function ; 2: Overload str*() functions ; 4: Overload ereg*() functions ; http://php.net/mbstring.func-overload ;mbstring.func_overload = 0 ; enable strict encoding detection. ; Default: Off ;mbstring.strict_detection = On ; This directive specifies the regex pattern of content types for which mb_output_handler() ; is activated. ; Default: mbstring.http_output_conv_mimetype=^(text/|application/xhtml\+xml) ;mbstring.http_output_conv_mimetype= [gd] ; Tell the jpeg decode to ignore warnings and try to create ; a gd image. The warning will then be displayed as notices ; disabled by default ; http://php.net/gd.jpeg-ignore-warning ;gd.jpeg_ignore_warning = 1 [exif] ; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS. ; With mbstring support this will automatically be converted into the encoding ; given by corresponding encode setting. When empty mbstring.internal_encoding ; is used. For the decode settings you can distinguish between motorola and ; intel byte order. A decode setting cannot be empty. ; http://php.net/exif.encode-unicode ;exif.encode_unicode = ISO-8859-15 ; http://php.net/exif.decode-unicode-motorola ;exif.decode_unicode_motorola = UCS-2BE ; http://php.net/exif.decode-unicode-intel ;exif.decode_unicode_intel = UCS-2LE ; http://php.net/exif.encode-jis ;exif.encode_jis = ; http://php.net/exif.decode-jis-motorola ;exif.decode_jis_motorola = JIS ; http://php.net/exif.decode-jis-intel ;exif.decode_jis_intel = JIS [Tidy] ; The path to a default tidy configuration file to use when using tidy ; http://php.net/tidy.default-config ;tidy.default_config = /usr/local/lib/php/default.tcfg ; Should tidy clean and repair output automatically? ; WARNING: Do not use this option if you are generating non-html content ; such as dynamic images ; http://php.net/tidy.clean-output tidy.clean_output = Off [soap] ; Enables or disables WSDL caching feature. ; http://php.net/soap.wsdl-cache-enabled soap.wsdl_cache_enabled=1 ; Sets the directory name where SOAP extension will put cache files. ; http://php.net/soap.wsdl-cache-dir soap.wsdl_cache_dir="/tmp" ; (time to live) Sets the number of second while cached file will be used ; instead of original one. ; http://php.net/soap.wsdl-cache-ttl soap.wsdl_cache_ttl=86400 ; Sets the size of the cache limit. (Max. number of WSDL files to cache) soap.wsdl_cache_limit = 5 [sysvshm] ; A default size of the shared memory segment ;sysvshm.init_mem = 10000 [ldap] ; Sets the maximum number of open links or -1 for unlimited. ldap.max_links = -1 [dba] ;dba.default_handler= [opcache] ; Determines if Zend OPCache is enabled ;opcache.enable=0 ; Determines if Zend OPCache is enabled for the CLI version of PHP ;opcache.enable_cli=0 ; The OPcache shared memory storage size. ;opcache.memory_consumption=128 ; The amount of memory for interned strings in Mbytes. ;opcache.interned_strings_buffer=8 ; The maximum number of keys (scripts) in the OPcache hash table. ; Only numbers between 200 and 1000000 are allowed. ;opcache.max_accelerated_files=10000 ; The maximum percentage of "wasted" memory until a restart is scheduled. ;opcache.max_wasted_percentage=5 ; When this directive is enabled, the OPcache appends the current working ; directory to the script key, thus eliminating possible collisions between ; files with the same name (basename). Disabling the directive improves ; performance, but may break existing applications. ;opcache.use_cwd=1 ; When disabled, you must reset the OPcache manually or restart the ; webserver for changes to the filesystem to take effect. ;opcache.validate_timestamps=1 ; How often (in seconds) to check file timestamps for changes to the shared ; memory storage allocation. ("1" means validate once per second, but only ; once per request. "0" means always validate) ;opcache.revalidate_freq=2 ; Enables or disables file search in include_path optimization ;opcache.revalidate_path=0 ; If disabled, all PHPDoc comments are dropped from the code to reduce the ; size of the optimized code. ;opcache.save_comments=1 ; Allow file existence override (file_exists, etc.) performance feature. ;opcache.enable_file_override=0 ; A bitmask, where each bit enables or disables the appropriate OPcache ; passes ;opcache.optimization_level=0xffffffff ;opcache.inherited_hack=1 ;opcache.dups_fix=0 ; The location of the OPcache blacklist file (wildcards allowed). ; Each OPcache blacklist file is a text file that holds the names of files ; that should not be accelerated. The file format is to add each filename ; to a new line. The filename may be a full path or just a file prefix ; (i.e., /var/www/x blacklists all the files and directories in /var/www ; that start with 'x'). Line starting with a ; are ignored (comments). ;opcache.blacklist_filename= ; Allows exclusion of large files from being cached. By default all files ; are cached. ;opcache.max_file_size=0 ; Check the cache checksum each N requests. ; The default value of "0" means that the checks are disabled. ;opcache.consistency_checks=0 ; How long to wait (in seconds) for a scheduled restart to begin if the cache ; is not being accessed. ;opcache.force_restart_timeout=180 ; OPcache error_log file name. Empty string assumes "stderr". ;opcache.error_log= ; All OPcache errors go to the Web server log. ; By default, only fatal errors (level 0) or errors (level 1) are logged. ; You can also enable warnings (level 2), info messages (level 3) or ; debug messages (level 4). ;opcache.log_verbosity_level=1 ; Preferred Shared Memory back-end. Leave empty and let the system decide. ;opcache.preferred_memory_model= ; Protect the shared memory from unexpected writing during script execution. ; Useful for internal debugging only. ;opcache.protect_memory=0 ; Allows calling OPcache API functions only from PHP scripts which path is ; started from specified string. The default "" means no restriction ;opcache.restrict_api= ; Mapping base of shared memory segments (for Windows only). All the PHP ; processes have to map shared memory into the same address space. This ; directive allows to manually fix the "Unable to reattach to base address" ; errors. ;opcache.mmap_base= ; Enables and sets the second level cache directory. ; It should improve performance when SHM memory is full, at server restart or ; SHM reset. The default "" disables file based caching. ;opcache.file_cache= ; Enables or disables opcode caching in shared memory. ;opcache.file_cache_only=0 ; Enables or disables checksum validation when script loaded from file cache. ;opcache.file_cache_consistency_checks=1 ; Implies opcache.file_cache_only=1 for a certain process that failed to ; reattach to the shared memory (for Windows only). Explicitly enabled file ; cache is required. ;opcache.file_cache_fallback=1 ; Enables or disables copying of PHP code (text segment) into HUGE PAGES. ; This should improve performance, but requires appropriate OS configuration. ;opcache.huge_code_pages=0 ; Validate cached file permissions. ;opcache.validate_permission=0 ; Prevent name collisions in chroot'ed environment. ;opcache.validate_root=0 ; If specified, it produces opcode dumps for debugging different stages of ; optimizations. ;opcache.opt_debug_level=0 [curl] ; A default value for the CURLOPT_CAINFO option. This is required to be an ; absolute path. ;curl.cainfo = [openssl] ; The location of a Certificate Authority (CA) file on the local filesystem ; to use when verifying the identity of SSL/TLS peers. Most users should ; not specify a value for this directive as PHP will attempt to use the ; OS-managed cert stores in its absence. If specified, this value may still ; be overridden on a per-stream basis via the "cafile" SSL stream context ; option. ;openssl.cafile= ; If openssl.cafile is not specified or if the CA file is not found, the ; directory pointed to by openssl.capath is searched for a suitable ; certificate. This value must be a correctly hashed certificate directory. ; Most users should not specify a value for this directive as PHP will ; attempt to use the OS-managed cert stores in its absence. If specified, ; this value may still be overridden on a per-stream basis via the "capath" ; SSL stream context option. ;openssl.capath= ; Local Variables: ; tab-width: 4 ; End: [Zend] zend_extension="/usr/local/ioncube/ioncube_loader_lin_7.2.so" ; fix for segfaults auto_globals_jit = Off cgi.fix_pathinfo = 1 mbstring.http_input = "pass" mbstring.http_output = "pass" mbstring.encoding_translation = 0 ; Enable Extensions extension=uploadprogress.so extension=imagick.so extension=jsmin.so extension=redis.so ================================================ FILE: aegir/conf/php/php72-fpm ================================================ #!/bin/bash ### BEGIN INIT INFO # Provides: php72-fpm # Required-Start: $remote_fs $network # Required-Stop: $remote_fs $network # Default-Start: 2 3 4 5 # Default-Stop: 0 1 6 # Short-Description: starts php72-fpm # Description: starts the PHP FastCGI Process Manager daemon ### END INIT INFO prefix=/opt/php72 exec_prefix=${prefix} php_fpm_BIN=/opt/php72/sbin/php-fpm php_fpm_CONF=/opt/php72/etc/php72-fpm.conf php_fpm_PID=/run/php72-fpm.pid php_opts="--fpm-config $php_fpm_CONF --pid $php_fpm_PID -c /opt/php72/etc/php72.ini" wait_for_pid() { try=0 while test $try -lt 5; do case "$1" in 'created') if [ -f "$2" ]; then try='' break fi ;; 'removed') if [ ! -f "$2" ]; then try='' break fi ;; esac echo -n . try=`expr $try + 1` sleep 1 done } case "$1" in start) echo -n "Starting php72-fpm..." $php_fpm_BIN --daemonize $php_opts if [ "$?" != 0 ]; then echo " failed" exit 1 fi wait_for_pid created $php_fpm_PID if [ -n "$try" ]; then echo " failed" exit 1 else echo " done" fi ;; stop) echo -n "Gracefully shutting down php72-fpm..." if [ ! -r $php_fpm_PID ]; then echo "warning, no pid file found - php72-fpm is not running ?" exit 1 fi kill -QUIT `cat $php_fpm_PID` wait_for_pid removed $php_fpm_PID if [ -n "$try" ]; then echo " failed. Use force-quit" exit 1 else echo " done" fi ;; status) if [ ! -r $php_fpm_PID ]; then echo "php72-fpm is stopped" exit 0 fi PID=`cat $php_fpm_PID` if ps -p $PID | grep -q $PID; then echo "php72-fpm (pid $PID) is running..." else echo "php72-fpm dead but pid file exists" fi ;; force-quit) echo -n "Terminating php72-fpm..." if [ ! -r $php_fpm_PID ]; then echo "warning, no pid file found - php72-fpm is not running ?" exit 1 fi kill -TERM `cat $php_fpm_PID` wait_for_pid removed $php_fpm_PID if [ -n "$try" ]; then echo " failed" exit 1 else echo " done" fi ;; restart) $0 stop $0 start ;; reload) echo -n "Reloading service php72-fpm..." if [ ! -r $php_fpm_PID ]; then echo "warning, no pid file found - php72-fpm is not running ?" exit 1 fi kill -USR2 `cat $php_fpm_PID` echo " done" ;; configtest) $php_fpm_BIN -t ;; *) echo "Usage: $0 {start|stop|force-quit|restart|reload|status|configtest}" exit 1 ;; esac ================================================ FILE: aegir/conf/php/php72-fpm.conf ================================================ ;;;;;;;;;;;;;;;;;;;;; ; FPM Configuration ; ;;;;;;;;;;;;;;;;;;;;; ; All relative paths in this configuration file are relative to PHP's install ; prefix (/opt/php72). This prefix can be dynamically changed by using the ; '-p' argument from the command line. ; Include one or more files. If glob(3) exists, it is used to include a bunch of ; files from a glob(3) pattern. This directive can be used everywhere in the ; file. ; Relative path can also be used. They will be prefixed by: ; - the global prefix if it's been set (-p argument) ; - /opt/php72 otherwise ;include=etc/fpm.d/*.conf ;;;;;;;;;;;;;;;;;; ; Global Options ; ;;;;;;;;;;;;;;;;;; [global] ; Pid file ; Note: the default prefix is /opt/php72/var ; Default Value: none pid = /run/php72-fpm.pid ; Error log file ; If it's set to "syslog", log is sent to syslogd instead of being written ; in a local file. ; Note: the default prefix is /opt/php72/var ; Default Value: log/php-fpm.log error_log = /var/log/php/php72-fpm-error.log ; syslog_facility is used to specify what type of program is logging the ; message. This lets syslogd specify that messages from different facilities ; will be handled differently. ; See syslog(3) for possible values (ex daemon equiv LOG_DAEMON) ; Default Value: daemon syslog.facility = daemon ; syslog_ident is prepended to every message. If you have multiple FPM ; instances running on the same server, you can change the default value ; which must suit common needs. ; Default Value: php-fpm syslog.ident = php72-fpm ; Log level ; Possible Values: alert, error, warning, notice, debug ; Default Value: notice log_level = warning ; If this number of child processes exit with SIGSEGV or SIGBUS within the time ; interval set by emergency_restart_interval then FPM will restart. A value ; of '0' means 'Off'. ; Default Value: 0 emergency_restart_threshold = 5 ; Interval of time used by emergency_restart_interval to determine when ; a graceful restart will be initiated. This can be useful to work around ; accidental corruptions in an accelerator's shared memory. ; Available Units: s(econds), m(inutes), h(ours), or d(ays) ; Default Unit: seconds ; Default Value: 0 emergency_restart_interval = 1m ; Time limit for child processes to wait for a reaction on signals from master. ; Available units: s(econds), m(inutes), h(ours), or d(ays) ; Default Unit: seconds ; Default Value: 0 process_control_timeout = 5s ; The maximum number of processes FPM will fork. This has been design to control ; the global number of processes when using dynamic PM within a lot of pools. ; Use it with caution. ; Note: A value of 0 indicates no limit ; Default Value: 0 process.max = 0 ; Specify the nice(2) priority to apply to the master process (only if set) ; The value can vary from -19 (highest priority) to 20 (lower priority) ; Note: - It will only work if the FPM master process is launched as root ; - The pool process will inherit the master process priority ; unless it specified otherwise ; Default Value: no set ; process.priority = -19 ; Send FPM to background. Set to 'no' to keep FPM in foreground for debugging. ; Default Value: yes daemonize = yes ; Set open file descriptor rlimit for the master process. ; Default Value: system defined value ;rlimit_files = 1024 ; Set max core size rlimit for the master process. ; Possible Values: 'unlimited' or an integer greater or equal to 0 ; Default Value: system defined value ;rlimit_core = 0 ; Specify the event mechanism FPM will use. The following is available: ; - select (any POSIX os) ; - poll (any POSIX os) ; - epoll (linux >= 2.5.44) ; - kqueue (FreeBSD >= 4.1, OpenBSD >= 2.9, NetBSD >= 2.0) ; - /dev/poll (Solaris >= 7) ; - port (Solaris >= 10) ; Default Value: not set (auto detection) ;events.mechanism = epoll ;;;;;;;;;;;;;;;;;;;; ; Pool Definitions ; ;;;;;;;;;;;;;;;;;;;; ; Multiple pools of child processes may be started with different listening ; ports and different management options. The name of the pool will be ; used in logs and stats. There is no limitation on the number of pools which ; FPM can handle. Your system will tell you anyway :) include = /opt/php72/etc/pool.d/*.conf ================================================ FILE: aegir/conf/php/php72.ini ================================================ [PHP] ;;;;;;;;;;;;;;;;;;; ; About php.ini ; ;;;;;;;;;;;;;;;;;;; ; PHP's initialization file, generally called php.ini, is responsible for ; configuring many of the aspects of PHP's behavior. ; PHP attempts to find and load this configuration from a number of locations. ; The following is a summary of its search order: ; 1. SAPI module specific location. ; 2. The PHPRC environment variable. (As of PHP 5.2.0) ; 3. A number of predefined registry keys on Windows (As of PHP 5.2.0) ; 4. Current working directory (except CLI) ; 5. The web server's directory (for SAPI modules), or directory of PHP ; (otherwise in Windows) ; 6. The directory from the --with-config-file-path compile time option, or the ; Windows directory (C:\windows or C:\winnt) ; See the PHP docs for more specific information. ; http://php.net/configuration.file ; The syntax of the file is extremely simple. Whitespace and lines ; beginning with a semicolon are silently ignored (as you probably guessed). ; Section headers (e.g. [Foo]) are also silently ignored, even though ; they might mean something in the future. ; Directives following the section heading [PATH=/www/mysite] only ; apply to PHP files in the /www/mysite directory. Directives ; following the section heading [HOST=www.example.com] only apply to ; PHP files served from www.example.com. Directives set in these ; special sections cannot be overridden by user-defined INI files or ; at runtime. Currently, [PATH=] and [HOST=] sections only work under ; CGI/FastCGI. ; http://php.net/ini.sections ; Directives are specified using the following syntax: ; directive = value ; Directive names are *case sensitive* - foo=bar is different from FOO=bar. ; Directives are variables used to configure PHP or PHP extensions. ; There is no name validation. If PHP can't find an expected ; directive because it is not set or is mistyped, a default value will be used. ; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one ; of the INI constants (On, Off, True, False, Yes, No and None) or an expression ; (e.g. E_ALL & ~E_NOTICE), a quoted string ("bar"), or a reference to a ; previously set variable or directive (e.g. ${foo}) ; Expressions in the INI file are limited to bitwise operators and parentheses: ; | bitwise OR ; ^ bitwise XOR ; & bitwise AND ; ~ bitwise NOT ; ! boolean NOT ; Boolean flags can be turned on using the values 1, On, True or Yes. ; They can be turned off using the values 0, Off, False or No. ; An empty string can be denoted by simply not writing anything after the equal ; sign, or by using the None keyword: ; foo = ; sets foo to an empty string ; foo = None ; sets foo to an empty string ; foo = "None" ; sets foo to the string 'None' ; If you use constants in your value, and these constants belong to a ; dynamically loaded extension (either a PHP extension or a Zend extension), ; you may only use these constants *after* the line that loads the extension. ;;;;;;;;;;;;;;;;;;; ; About this file ; ;;;;;;;;;;;;;;;;;;; ; PHP comes packaged with two INI files. One that is recommended to be used ; in production environments and one that is recommended to be used in ; development environments. ; php.ini-production contains settings which hold security, performance and ; best practices at its core. But please be aware, these settings may break ; compatibility with older or less security conscience applications. We ; recommending using the production ini in production and testing environments. ; php.ini-development is very similar to its production variant, except it is ; much more verbose when it comes to errors. We recommend using the ; development version only in development environments, as errors shown to ; application users can inadvertently leak otherwise secure information. ; This is php.ini-production INI file. ;;;;;;;;;;;;;;;;;;; ; Quick Reference ; ;;;;;;;;;;;;;;;;;;; ; The following are all the settings which are different in either the production ; or development versions of the INIs with respect to PHP's default behavior. ; Please see the actual settings later in the document for more details as to why ; we recommend these changes in PHP's behavior. display_errors = Off ; Default Value: On ; Development Value: On ; Production Value: Off ; display_startup_errors ; Default Value: Off ; Development Value: On ; Production Value: Off ; error_reporting ; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; html_errors ; Default Value: On ; Development Value: On ; Production value: On ; log_errors ; Default Value: Off ; Development Value: On ; Production Value: On ; max_input_time ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; output_buffering ; Default Value: Off ; Development Value: 4096 ; Production Value: 4096 ; register_argc_argv ; Default Value: On ; Development Value: Off ; Production Value: Off ; request_order ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; session.gc_divisor ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; session.sid_bits_per_character ; Default Value: 4 ; Development Value: 5 ; Production Value: 5 ; short_open_tag ; Default Value: On ; Development Value: Off ; Production Value: Off ; track_errors ; Default Value: Off ; Development Value: On ; Production Value: Off ; variables_order ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS" ;;;;;;;;;;;;;;;;;;;; ; php.ini Options ; ;;;;;;;;;;;;;;;;;;;; ; Name for user-defined php.ini (.htaccess) files. Default is ".user.ini" ;user_ini.filename = ".user.ini" ; To disable this feature set this option to empty value user_ini.filename = ; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes) ;user_ini.cache_ttl = 300 ;;;;;;;;;;;;;;;;;;;; ; Language Options ; ;;;;;;;;;;;;;;;;;;;; ; Enable the PHP scripting language engine under Apache. ; http://php.net/engine engine = On ; This directive determines whether or not PHP will recognize code between ; tags as PHP source which should be processed as such. It is ; generally recommended that should be used and that this feature ; should be disabled, as enabling it may result in issues when generating XML ; documents, however this remains supported for backward compatibility reasons. ; Note that this directive does not control the would work. ; http://php.net/syntax-highlighting ;highlight.string = #DD0000 ;highlight.comment = #FF9900 ;highlight.keyword = #007700 ;highlight.default = #0000BB ;highlight.html = #000000 ; If enabled, the request will be allowed to complete even if the user aborts ; the request. Consider enabling it if executing long requests, which may end up ; being interrupted by the user or a browser timing out. PHP's default behavior ; is to disable this feature. ; http://php.net/ignore-user-abort ;ignore_user_abort = On ; Determines the size of the realpath cache to be used by PHP. This value should ; be increased on systems where PHP opens many files to reflect the quantity of ; the file operations performed. ; http://php.net/realpath-cache-size realpath_cache_size=64M ; Duration of time, in seconds for which to cache realpath information for a given ; file or directory. For systems with rarely changing files, consider increasing this ; value. ; http://php.net/realpath-cache-ttl realpath_cache_ttl=180 ; Enables or disables the circular reference collector. ; http://php.net/zend.enable-gc zend.enable_gc = On ; If enabled, scripts may be written in encodings that are incompatible with ; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such ; encodings. To use this feature, mbstring extension must be enabled. ; Default: Off ;zend.multibyte = Off ; Allows to set the default encoding for the scripts. This value will be used ; unless "declare(encoding=...)" directive appears at the top of the script. ; Only affects if zend.multibyte is set. ; Default: "" ;zend.script_encoding = ;;;;;;;;;;;;;;;;; ; Miscellaneous ; ;;;;;;;;;;;;;;;;; ; Decides whether PHP may expose the fact that it is installed on the server ; (e.g. by adding its signature to the Web server header). It is no security ; threat in any way, but it makes it possible to determine whether you use PHP ; on your server or not. ; http://php.net/expose-php expose_php = On ;;;;;;;;;;;;;;;;;;; ; Resource Limits ; ;;;;;;;;;;;;;;;;;;; ; Maximum execution time of each script, in seconds ; http://php.net/max-execution-time ; Note: This directive is hardcoded to 0 for the CLI SAPI max_execution_time = 180 ; Maximum amount of time each script may spend parsing request data. It's a good ; idea to limit this time on productions servers in order to eliminate unexpectedly ; long running scripts. ; Note: This directive is hardcoded to -1 for the CLI SAPI ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; http://php.net/max-input-time max_input_time = 180 ; Maximum input variable nesting level ; http://php.net/max-input-nesting-level ;max_input_nesting_level = 64 ; How many GET/POST/COOKIE input variables may be accepted max_input_vars = 9999 ; Maximum amount of memory a script may consume (128MB) ; http://php.net/memory-limit memory_limit = 395M ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; Error handling and logging ; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; This directive informs PHP of which errors, warnings and notices you would like ; it to take action for. The recommended way of setting values for this ; directive is through the use of the error level constants and bitwise ; operators. The error level constants are below here for convenience as well as ; some common settings and their meanings. ; By default, PHP is set to take action on all errors, notices and warnings EXCEPT ; those related to E_NOTICE and E_STRICT, which together cover best practices and ; recommended coding standards in PHP. For performance reasons, this is the ; recommend error reporting setting. Your production server shouldn't be wasting ; resources complaining about best practices and coding standards. That's what ; development servers and development settings are for. ; Note: The php.ini-development file has this setting as E_ALL. This ; means it pretty much reports everything which is exactly what you want during ; development and early testing. ; ; Error Level Constants: ; E_ALL - All errors and warnings (includes E_STRICT as of PHP 5.4.0) ; E_ERROR - fatal run-time errors ; E_RECOVERABLE_ERROR - almost fatal run-time errors ; E_WARNING - run-time warnings (non-fatal errors) ; E_PARSE - compile-time parse errors ; E_NOTICE - run-time notices (these are warnings which often result ; from a bug in your code, but it's possible that it was ; intentional (e.g., using an uninitialized variable and ; relying on the fact it is automatically initialized to an ; empty string) ; E_STRICT - run-time notices, enable to have PHP suggest changes ; to your code which will ensure the best interoperability ; and forward compatibility of your code ; E_CORE_ERROR - fatal errors that occur during PHP's initial startup ; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's ; initial startup ; E_COMPILE_ERROR - fatal compile-time errors ; E_COMPILE_WARNING - compile-time warnings (non-fatal errors) ; E_USER_ERROR - user-generated error message ; E_USER_WARNING - user-generated warning message ; E_USER_NOTICE - user-generated notice message ; E_DEPRECATED - warn about code that will not work in future versions ; of PHP ; E_USER_DEPRECATED - user-generated deprecation warnings ; ; Common Values: ; E_ALL (Show all errors, warnings and notices including coding standards.) ; E_ALL & ~E_NOTICE (Show all errors, except for notices) ; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.) ; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors) ; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; http://php.net/error-reporting error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT ; This directive controls whether or not and where PHP will output errors, ; notices and warnings too. Error output is very useful during development, but ; it could be very dangerous in production environments. Depending on the code ; which is triggering the error, sensitive information could potentially leak ; out of your application such as database usernames and passwords or worse. ; For production environments, we recommend logging errors rather than ; sending them to STDOUT. ; Possible Values: ; Off = Do not display any errors ; stderr = Display errors to STDERR (affects only CGI/CLI binaries!) ; On or stdout = Display errors to STDOUT ; Default Value: On ; Development Value: On ; Production Value: Off ; http://php.net/display-errors display_errors = Off ; The display of errors which occur during PHP's startup sequence are handled ; separately from display_errors. PHP's default behavior is to suppress those ; errors from clients. Turning the display of startup errors on can be useful in ; debugging configuration problems. We strongly recommend you ; set this to 'off' for production servers. ; Default Value: Off ; Development Value: On ; Production Value: Off ; http://php.net/display-startup-errors display_startup_errors = Off ; Besides displaying errors, PHP can also log errors to locations such as a ; server-specific log, STDERR, or a location specified by the error_log ; directive found below. While errors should not be displayed on productions ; servers they should still be monitored and logging is a great way to do that. ; Default Value: Off ; Development Value: On ; Production Value: On ; http://php.net/log-errors log_errors = On ; Set maximum length of log_errors. In error_log information about the source is ; added. The default is 1024 and 0 allows to not apply any maximum length at all. ; http://php.net/log-errors-max-len log_errors_max_len = 1024 ; Do not log repeated messages. Repeated errors must occur in same file on same ; line unless ignore_repeated_source is set true. ; http://php.net/ignore-repeated-errors ignore_repeated_errors = Off ; Ignore source of message when ignoring repeated messages. When this setting ; is On you will not log errors with repeated messages from different files or ; source lines. ; http://php.net/ignore-repeated-source ignore_repeated_source = Off ; If this parameter is set to Off, then memory leaks will not be shown (on ; stdout or in the log). This has only effect in a debug compile, and if ; error reporting includes E_WARNING in the allowed list ; http://php.net/report-memleaks report_memleaks = On ; This setting is on by default. ;report_zend_debug = 0 ; Store the last error/warning message in $php_errormsg (boolean). Setting this value ; to On can assist in debugging and is appropriate for development servers. It should ; however be disabled on production servers. ; This directive is DEPRECATED. ; Default Value: Off ; Development Value: Off ; Production Value: Off ; http://php.net/track-errors ;track_errors = Off ; Turn off normal error reporting and emit XML-RPC error XML ; http://php.net/xmlrpc-errors ;xmlrpc_errors = 0 ; An XML-RPC faultCode ;xmlrpc_error_number = 0 ; When PHP displays or logs an error, it has the capability of formatting the ; error message as HTML for easier reading. This directive controls whether ; the error message is formatted as HTML or not. ; Note: This directive is hardcoded to Off for the CLI SAPI ; Default Value: On ; Development Value: On ; Production value: On ; http://php.net/html-errors html_errors = Off ; If html_errors is set to On *and* docref_root is not empty, then PHP ; produces clickable error messages that direct to a page describing the error ; or function causing the error in detail. ; You can download a copy of the PHP manual from http://php.net/docs ; and change docref_root to the base URL of your local copy including the ; leading '/'. You must also specify the file extension being used including ; the dot. PHP's default behavior is to leave these settings empty, in which ; case no links to documentation are generated. ; Note: Never use this feature for production boxes. ; http://php.net/docref-root ; Examples ;docref_root = "/phpmanual/" ; http://php.net/docref-ext ;docref_ext = .html ; String to output before an error message. PHP's default behavior is to leave ; this setting blank. ; http://php.net/error-prepend-string ; Example: ;error_prepend_string = "" ; String to output after an error message. PHP's default behavior is to leave ; this setting blank. ; http://php.net/error-append-string ; Example: ;error_append_string = "" ; Log errors to specified file. PHP's default behavior is to leave this value ; empty. ; http://php.net/error-log ; Example: ;error_log = php_errors.log ; Log errors to syslog (Event Log on Windows). ;error_log = syslog error_log = /var/log/php/error_log_72 ;windows.show_crt_warning ; Default value: 0 ; Development value: 0 ; Production value: 0 ;;;;;;;;;;;;;;;;; ; Data Handling ; ;;;;;;;;;;;;;;;;; ; The separator used in PHP generated URLs to separate arguments. ; PHP's default setting is "&". ; http://php.net/arg-separator.output ; Example: ;arg_separator.output = "&" ; List of separator(s) used by PHP to parse input URLs into variables. ; PHP's default setting is "&". ; NOTE: Every character in this directive is considered as separator! ; http://php.net/arg-separator.input ; Example: ;arg_separator.input = ";&" ; This directive determines which super global arrays are registered when PHP ; starts up. G,P,C,E & S are abbreviations for the following respective super ; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty ; paid for the registration of these arrays and because ENV is not as commonly ; used as the others, ENV is not recommended on productions servers. You ; can still get access to the environment variables through getenv() should you ; need to. ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS"; ; http://php.net/variables-order variables_order = "GPCS" ; This directive determines which super global data (G,P & C) should be ; registered into the super global array REQUEST. If so, it also determines ; the order in which that data is registered. The values for this directive ; are specified in the same manner as the variables_order directive, ; EXCEPT one. Leaving this value empty will cause PHP to use the value set ; in the variables_order directive. It does not mean it will leave the super ; globals array REQUEST empty. ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; http://php.net/request-order request_order = "GP" ; This directive determines whether PHP registers $argv & $argc each time it ; runs. $argv contains an array of all the arguments passed to PHP when a script ; is invoked. $argc contains an integer representing the number of arguments ; that were passed when the script was invoked. These arrays are extremely ; useful when running scripts from the command line. When this directive is ; enabled, registering these variables consumes CPU cycles and memory each time ; a script is executed. For performance reasons, this feature should be disabled ; on production servers. ; Note: This directive is hardcoded to On for the CLI SAPI ; Default Value: On ; Development Value: Off ; Production Value: Off ; http://php.net/register-argc-argv register_argc_argv = Off ; When enabled, the ENV, REQUEST and SERVER variables are created when they're ; first used (Just In Time) instead of when the script starts. If these ; variables are not used within a script, having this directive on will result ; in a performance gain. The PHP directive register_argc_argv must be disabled ; for this directive to have any affect. ; http://php.net/auto-globals-jit auto_globals_jit = On ; Whether PHP will read the POST data. ; This option is enabled by default. ; Most likely, you won't want to disable this option globally. It causes $_POST ; and $_FILES to always be empty; the only way you will be able to read the ; POST data will be through the php://input stream wrapper. This can be useful ; to proxy requests or to process the POST data in a memory efficient fashion. ; http://php.net/enable-post-data-reading ;enable_post_data_reading = Off ; Maximum size of POST data that PHP will accept. ; Its value may be 0 to disable the limit. It is ignored if POST data reading ; is disabled through enable_post_data_reading. ; http://php.net/post-max-size post_max_size = 350M ; Automatically add files before PHP document. ; http://php.net/auto-prepend-file auto_prepend_file = ; Automatically add files after PHP document. ; http://php.net/auto-append-file auto_append_file = ; By default, PHP will output a media type using the Content-Type header. To ; disable this, simply set it to be empty. ; ; PHP's built-in default media type is set to text/html. ; http://php.net/default-mimetype default_mimetype = "text/html" ; PHP's default character set is set to UTF-8. ; http://php.net/default-charset default_charset = "UTF-8" ; PHP internal character encoding is set to empty. ; If empty, default_charset is used. ; http://php.net/internal-encoding ;internal_encoding = ; PHP input character encoding is set to empty. ; If empty, default_charset is used. ; http://php.net/input-encoding ;input_encoding = ; PHP output character encoding is set to empty. ; If empty, default_charset is used. ; See also output_buffer. ; http://php.net/output-encoding ;output_encoding = ;;;;;;;;;;;;;;;;;;;;;;;;; ; Paths and Directories ; ;;;;;;;;;;;;;;;;;;;;;;;;; ; UNIX: "/path1:/path2" ;include_path = ".:/php/includes" ; ; Windows: "\path1;\path2" ;include_path = ".;c:\php\includes" ; ; PHP's default setting for include_path is ".;/path/to/php/pear" ; http://php.net/include-path include_path = ".:/opt/php72/lib/php" ; The root of the PHP pages, used only if nonempty. ; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root ; if you are running php as a CGI under any web server (other than IIS) ; see documentation for security issues. The alternate is to use the ; cgi.force_redirect configuration below ; http://php.net/doc-root doc_root = ; The directory under which PHP opens the script using /~username used only ; if nonempty. ; http://php.net/user-dir user_dir = ; Directory in which the loadable extensions (modules) reside. ; http://php.net/extension-dir ; extension_dir = "./" ; On windows: ; extension_dir = "ext" extension_dir = "/opt/php72/lib/php/extensions/no-debug-non-zts-20170718/" ; Directory where the temporary files should be placed. ; Defaults to the system default (see sys_get_temp_dir) sys_temp_dir = "/tmp" ; Whether or not to enable the dl() function. The dl() function does NOT work ; properly in multithreaded servers, such as IIS or Zeus, and is automatically ; disabled on them. ; http://php.net/enable-dl enable_dl = Off ; cgi.force_redirect is necessary to provide security running PHP as a CGI under ; most web servers. Left undefined, PHP turns this on by default. You can ; turn it off here AT YOUR OWN RISK ; **You CAN safely turn this off for IIS, in fact, you MUST.** ; http://php.net/cgi.force-redirect ;cgi.force_redirect = 1 ; if cgi.nph is enabled it will force cgi to always sent Status: 200 with ; every request. PHP's default behavior is to disable this feature. ;cgi.nph = 1 ; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape ; (iPlanet) web servers, you MAY need to set an environment variable name that PHP ; will look for to know it is OK to continue execution. Setting this variable MAY ; cause security issues, KNOW WHAT YOU ARE DOING FIRST. ; http://php.net/cgi.redirect-status-env ;cgi.redirect_status_env = ; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's ; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok ; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting ; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting ; of zero causes PHP to behave as before. Default is 1. You should fix your scripts ; to use SCRIPT_FILENAME rather than PATH_TRANSLATED. ; http://php.net/cgi.fix-pathinfo ;cgi.fix_pathinfo=1 ; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside ; of the web tree and people will not be able to circumvent .htaccess security. ; http://php.net/cgi.dicard-path ;cgi.discard_path=1 ; FastCGI under IIS (on WINNT based OS) supports the ability to impersonate ; security tokens of the calling client. This allows IIS to define the ; security context that the request runs under. mod_fastcgi under Apache ; does not currently support this feature (03/17/2002) ; Set to 1 if running under IIS. Default is zero. ; http://php.net/fastcgi.impersonate ;fastcgi.impersonate = 1 ; Disable logging through FastCGI connection. PHP's default behavior is to enable ; this feature. ;fastcgi.logging = 0 ; cgi.rfc2616_headers configuration option tells PHP what type of headers to ; use when sending HTTP response code. If set to 0, PHP sends Status: header that ; is supported by Apache. When this option is set to 1, PHP will send ; RFC2616 compliant header. ; Default is zero. ; http://php.net/cgi.rfc2616-headers ;cgi.rfc2616_headers = 0 ; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #! ; (shebang) at the top of the running script. This line might be needed if the ; script support running both as stand-alone script and via PHP CGI<. PHP in CGI ; mode skips this line and ignores its content if this directive is turned on. ; http://php.net/cgi.check-shebang-line ;cgi.check_shebang_line=1 ;;;;;;;;;;;;;;;; ; File Uploads ; ;;;;;;;;;;;;;;;; ; Whether to allow HTTP file uploads. ; http://php.net/file-uploads file_uploads = On ; Temporary directory for HTTP uploaded files (will use system default if not ; specified). ; http://php.net/upload-tmp-dir upload_tmp_dir = /tmp ; Maximum allowed size for uploaded files. ; http://php.net/upload-max-filesize upload_max_filesize = 325M ; Maximum number of files that can be uploaded via a single request max_file_uploads = 50 ;;;;;;;;;;;;;;;;;; ; Fopen wrappers ; ;;;;;;;;;;;;;;;;;; ; Whether to allow the treatment of URLs (like http:// or ftp://) as files. ; http://php.net/allow-url-fopen allow_url_fopen = On ; Whether to allow include/require to open URLs (like http:// or ftp://) as files. ; http://php.net/allow-url-include allow_url_include = Off ; Define the anonymous ftp password (your email address). PHP's default setting ; for this is empty. ; http://php.net/from ;from="john@doe.com" ; Define the User-Agent string. PHP's default setting for this is empty. ; http://php.net/user-agent ;user_agent="PHP" ; Default timeout for socket based streams (seconds) ; http://php.net/default-socket-timeout default_socket_timeout = 180 ; If your scripts have to deal with files from Macintosh systems, ; or you are running on a Mac and need to deal with files from ; unix or win32 systems, setting this flag will cause PHP to ; automatically detect the EOL character in those files so that ; fgets() and file() will work regardless of the source of the file. ; http://php.net/auto-detect-line-endings auto_detect_line_endings = On ;;;;;;;;;;;;;;;;;;;;;; ; Dynamic Extensions ; ;;;;;;;;;;;;;;;;;;;;;; ; If you wish to have an extension loaded automatically, use the following ; syntax: ; ; extension=modulename ; ; For example: ; ; extension=mysqli ; ; When the extension library to load is not located in the default extension ; directory, You may specify an absolute path to the library file: ; ; extension=/path/to/extension/mysqli.so ; ; Note : The syntax used in previous PHP versions ('extension=.so' and ; 'extension='php_.dll') is supported for legacy reasons and may be ; deprecated in a future PHP major version. So, when it is possible, please ; move to the new ('extension=) syntax. ; ; Notes for Windows environments : ; ; - Many DLL files are located in the extensions/ (PHP 4) or ext/ (PHP 5+) ; extension folders as well as the separate PECL DLL download (PHP 5+). ; Be sure to appropriately set the extension_dir directive. ; ;extension=bz2 ;extension=curl ;extension=fileinfo ;extension=gd2 ;extension=gettext ;extension=gmp ;extension=intl ;extension=imap ;extension=interbase ;extension=ldap ;extension=mbstring ;extension=exif ; Must be after mbstring as it depends on it ;extension=mysqli ;extension=oci8_12c ; Use with Oracle Database 12c Instant Client ;extension=odbc ;extension=openssl ;extension=pdo_firebird ;extension=pdo_mysql ;extension=pdo_oci ;extension=pdo_odbc ;extension=pdo_pgsql ;extension=pdo_sqlite ;extension=pgsql ;extension=shmop ; The MIBS data available in the PHP distribution must be installed. ; See http://www.php.net/manual/en/snmp.installation.php ;extension=snmp ;extension=soap ;extension=sockets ;extension=sqlite3 ;extension=tidy ;extension=xmlrpc ;extension=xsl ;;;;;;;;;;;;;;;;;;; ; Module Settings ; ;;;;;;;;;;;;;;;;;;; [CLI Server] ; Whether the CLI web server uses ANSI color coding in its terminal output. cli_server.color = On [Date] ; Defines the default timezone used by the date functions ; http://php.net/date.timezone date.timezone = "UTC" ; http://php.net/date.default-latitude ;date.default_latitude = 31.7667 ; http://php.net/date.default-longitude ;date.default_longitude = 35.2333 ; http://php.net/date.sunrise-zenith ;date.sunrise_zenith = 90.583333 ; http://php.net/date.sunset-zenith ;date.sunset_zenith = 90.583333 [filter] ; http://php.net/filter.default ;filter.default = unsafe_raw ; http://php.net/filter.default-flags ;filter.default_flags = [iconv] ; Use of this INI entry is deprecated, use global input_encoding instead. ; If empty, default_charset or input_encoding or iconv.input_encoding is used. ; The precedence is: default_charset < intput_encoding < iconv.input_encoding ;iconv.input_encoding = ; Use of this INI entry is deprecated, use global internal_encoding instead. ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;iconv.internal_encoding = ; Use of this INI entry is deprecated, use global output_encoding instead. ; If empty, default_charset or output_encoding or iconv.output_encoding is used. ; The precedence is: default_charset < output_encoding < iconv.output_encoding ; To use an output encoding conversion, iconv's output handler must be set ; otherwise output encoding conversion cannot be performed. ;iconv.output_encoding = [intl] ;intl.default_locale = ; This directive allows you to produce PHP errors when some error ; happens within intl functions. The value is the level of the error produced. ; Default is 0, which does not produce any errors. ;intl.error_level = E_WARNING ;intl.use_exceptions = 0 [sqlite3] ;sqlite3.extension_dir = [Pcre] ;PCRE library backtracking limit. ; http://php.net/pcre.backtrack-limit ;pcre.backtrack_limit=100000 ;PCRE library recursion limit. ;Please note that if you set this value to a high number you may consume all ;the available process stack and eventually crash PHP (due to reaching the ;stack size limit imposed by the Operating System). ; http://php.net/pcre.recursion-limit ;pcre.recursion_limit=100000 ;Enables or disables JIT compilation of patterns. This requires the PCRE ;library to be compiled with JIT support. ;pcre.jit=1 [Pdo] ; Whether to pool ODBC connections. Can be one of "strict", "relaxed" or "off" ; http://php.net/pdo-odbc.connection-pooling ;pdo_odbc.connection_pooling=strict ;pdo_odbc.db2_instance_name [Pdo_mysql] ; If mysqlnd is used: Number of cache slots for the internal result set cache ; http://php.net/pdo_mysql.cache_size pdo_mysql.cache_size = 2000 ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. ; http://php.net/pdo_mysql.default-socket pdo_mysql.default_socket= [Phar] ; http://php.net/phar.readonly ;phar.readonly = On ; http://php.net/phar.require-hash ;phar.require_hash = On ;phar.cache_list = [mail function] ; For Win32 only. ; http://php.net/smtp ;SMTP = localhost ; http://php.net/smtp-port ;smtp_port = 25 ; For Win32 only. ; http://php.net/sendmail-from ;sendmail_from = me@example.com ; For Unix only. You may supply arguments as well (default: "sendmail -t -i"). ; http://php.net/sendmail-path sendmail_path = /usr/sbin/sendmail -t -i ; Force the addition of the specified parameters to be passed as extra parameters ; to the sendmail binary. These parameters will always replace the value of ; the 5th parameter to mail(). ;mail.force_extra_parameters = ; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename mail.add_x_header = Off ; The path to a log file that will log all mail() calls. Log entries include ; the full path of the script, line number, To address and headers. ;mail.log = ; Log mail to syslog (Event Log on Windows). ;mail.log = syslog [ODBC] ; http://php.net/odbc.default-db ;odbc.default_db = Not yet implemented ; http://php.net/odbc.default-user ;odbc.default_user = Not yet implemented ; http://php.net/odbc.default-pw ;odbc.default_pw = Not yet implemented ; Controls the ODBC cursor model. ; Default: SQL_CURSOR_STATIC (default). ;odbc.default_cursortype ; Allow or prevent persistent links. ; http://php.net/odbc.allow-persistent odbc.allow_persistent = On ; Check that a connection is still valid before reuse. ; http://php.net/odbc.check-persistent odbc.check_persistent = On ; Maximum number of persistent links. -1 means no limit. ; http://php.net/odbc.max-persistent odbc.max_persistent = -1 ; Maximum number of links (persistent + non-persistent). -1 means no limit. ; http://php.net/odbc.max-links odbc.max_links = -1 ; Handling of LONG fields. Returns number of bytes to variables. 0 means ; passthru. ; http://php.net/odbc.defaultlrl odbc.defaultlrl = 4096 ; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char. ; See the documentation on odbc_binmode and odbc_longreadlen for an explanation ; of odbc.defaultlrl and odbc.defaultbinmode ; http://php.net/odbc.defaultbinmode odbc.defaultbinmode = 1 ;birdstep.max_links = -1 [Interbase] ; Allow or prevent persistent links. ibase.allow_persistent = 1 ; Maximum number of persistent links. -1 means no limit. ibase.max_persistent = -1 ; Maximum number of links (persistent + non-persistent). -1 means no limit. ibase.max_links = -1 ; Default database name for ibase_connect(). ;ibase.default_db = ; Default username for ibase_connect(). ;ibase.default_user = ; Default password for ibase_connect(). ;ibase.default_password = ; Default charset for ibase_connect(). ;ibase.default_charset = ; Default timestamp format. ibase.timestampformat = "%Y-%m-%d %H:%M:%S" ; Default date format. ibase.dateformat = "%Y-%m-%d" ; Default time format. ibase.timeformat = "%H:%M:%S" [MySQLi] ; Maximum number of persistent links. -1 means no limit. ; http://php.net/mysqli.max-persistent mysqli.max_persistent = -1 ; Allow accessing, from PHP's perspective, local files with LOAD DATA statements ; http://php.net/mysqli.allow_local_infile ;mysqli.allow_local_infile = On ; Allow or prevent persistent links. ; http://php.net/mysqli.allow-persistent mysqli.allow_persistent = On ; Maximum number of links. -1 means no limit. ; http://php.net/mysqli.max-links mysqli.max_links = -1 ; If mysqlnd is used: Number of cache slots for the internal result set cache ; http://php.net/mysqli.cache_size mysqli.cache_size = 2000 ; Default port number for mysqli_connect(). If unset, mysqli_connect() will use ; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the ; compile-time value defined MYSQL_PORT (in that order). Win32 will only look ; at MYSQL_PORT. ; http://php.net/mysqli.default-port mysqli.default_port = 3306 ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. ; http://php.net/mysqli.default-socket mysqli.default_socket = ; Default host for mysql_connect() (doesn't apply in safe mode). ; http://php.net/mysqli.default-host mysqli.default_host = ; Default user for mysql_connect() (doesn't apply in safe mode). ; http://php.net/mysqli.default-user mysqli.default_user = ; Default password for mysqli_connect() (doesn't apply in safe mode). ; Note that this is generally a *bad* idea to store passwords in this file. ; *Any* user with PHP access can run 'echo get_cfg_var("mysqli.default_pw") ; and reveal this password! And of course, any users with read access to this ; file will be able to reveal the password as well. ; http://php.net/mysqli.default-pw mysqli.default_pw = ; Allow or prevent reconnect mysqli.reconnect = Off [mysqlnd] ; Enable / Disable collection of general statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. ; http://php.net/mysqlnd.collect_statistics mysqlnd.collect_statistics = 0 ; Enable / Disable collection of memory usage statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. ; http://php.net/mysqlnd.collect_memory_statistics mysqlnd.collect_memory_statistics = 0 ; Records communication from all extensions using mysqlnd to the specified log ; file. ; http://php.net/mysqlnd.debug ;mysqlnd.debug = ; Defines which queries will be logged. ; http://php.net/mysqlnd.log_mask ;mysqlnd.log_mask = 0 ; Default size of the mysqlnd memory pool, which is used by result sets. ; http://php.net/mysqlnd.mempool_default_size mysqlnd.mempool_default_size = 64000 ; Size of a pre-allocated buffer used when sending commands to MySQL in bytes. ; http://php.net/mysqlnd.net_cmd_buffer_size mysqlnd.net_cmd_buffer_size = 8192 ; Size of a pre-allocated buffer used for reading data sent by the server in ; bytes. ; http://php.net/mysqlnd.net_read_buffer_size mysqlnd.net_read_buffer_size = 131072 ; Timeout for network requests in seconds. ; http://php.net/mysqlnd.net_read_timeout ;mysqlnd.net_read_timeout = 31536000 ; SHA-256 Authentication Plugin related. File with the MySQL server public RSA ; key. ; http://php.net/mysqlnd.sha256_server_public_key ;mysqlnd.sha256_server_public_key = [OCI8] ; Connection: Enables privileged connections using external ; credentials (OCI_SYSOPER, OCI_SYSDBA) ; http://php.net/oci8.privileged-connect ;oci8.privileged_connect = Off ; Connection: The maximum number of persistent OCI8 connections per ; process. Using -1 means no limit. ; http://php.net/oci8.max-persistent ;oci8.max_persistent = -1 ; Connection: The maximum number of seconds a process is allowed to ; maintain an idle persistent connection. Using -1 means idle ; persistent connections will be maintained forever. ; http://php.net/oci8.persistent-timeout ;oci8.persistent_timeout = -1 ; Connection: The number of seconds that must pass before issuing a ; ping during oci_pconnect() to check the connection validity. When ; set to 0, each oci_pconnect() will cause a ping. Using -1 disables ; pings completely. ; http://php.net/oci8.ping-interval ;oci8.ping_interval = 60 ; Connection: Set this to a user chosen connection class to be used ; for all pooled server requests with Oracle 11g Database Resident ; Connection Pooling (DRCP). To use DRCP, this value should be set to ; the same string for all web servers running the same application, ; the database pool must be configured, and the connection string must ; specify to use a pooled server. ;oci8.connection_class = ; High Availability: Using On lets PHP receive Fast Application ; Notification (FAN) events generated when a database node fails. The ; database must also be configured to post FAN events. ;oci8.events = Off ; Tuning: This option enables statement caching, and specifies how ; many statements to cache. Using 0 disables statement caching. ; http://php.net/oci8.statement-cache-size ;oci8.statement_cache_size = 20 ; Tuning: Enables statement prefetching and sets the default number of ; rows that will be fetched automatically after statement execution. ; http://php.net/oci8.default-prefetch ;oci8.default_prefetch = 100 ; Compatibility. Using On means oci_close() will not close ; oci_connect() and oci_new_connect() connections. ; http://php.net/oci8.old-oci-close-semantics ;oci8.old_oci_close_semantics = Off [PostgreSQL] ; Allow or prevent persistent links. ; http://php.net/pgsql.allow-persistent pgsql.allow_persistent = On ; Detect broken persistent links always with pg_pconnect(). ; Auto reset feature requires a little overheads. ; http://php.net/pgsql.auto-reset-persistent pgsql.auto_reset_persistent = Off ; Maximum number of persistent links. -1 means no limit. ; http://php.net/pgsql.max-persistent pgsql.max_persistent = -1 ; Maximum number of links (persistent+non persistent). -1 means no limit. ; http://php.net/pgsql.max-links pgsql.max_links = -1 ; Ignore PostgreSQL backends Notice message or not. ; Notice message logging require a little overheads. ; http://php.net/pgsql.ignore-notice pgsql.ignore_notice = 0 ; Log PostgreSQL backends Notice message or not. ; Unless pgsql.ignore_notice=0, module cannot log notice message. ; http://php.net/pgsql.log-notice pgsql.log_notice = 0 [bcmath] ; Number of decimal digits for all bcmath functions. ; http://php.net/bcmath.scale bcmath.scale = 0 [browscap] ; http://php.net/browscap ;browscap = extra/browscap.ini [Session] ; Handler used to store/retrieve data. ; http://php.net/session.save-handler session.save_handler = files ; Argument passed to save_handler. In the case of files, this is the path ; where data files are stored. Note: Windows users have to change this ; variable in order to use PHP's session functions. ; ; The path can be defined as: ; ; session.save_path = "N;/path" ; ; where N is an integer. Instead of storing all the session files in ; /path, what this will do is use subdirectories N-levels deep, and ; store the session data in those directories. This is useful if ; your OS has problems with many files in one directory, and is ; a more efficient layout for servers that handle many sessions. ; ; NOTE 1: PHP will not create this directory structure automatically. ; You can use the script in the ext/session dir for that purpose. ; NOTE 2: See the section on garbage collection below if you choose to ; use subdirectories for session storage ; ; The file storage module creates files using mode 600 by default. ; You can change that by using ; ; session.save_path = "N;MODE;/path" ; ; where MODE is the octal representation of the mode. Note that this ; does not overwrite the process's umask. ; http://php.net/session.save-path session.save_path = "/opt/tmp" ; Whether to use strict session mode. ; Strict session mode does not accept uninitialized session ID and regenerate ; session ID if browser sends uninitialized session ID. Strict mode protects ; applications from session fixation via session adoption vulnerability. It is ; disabled by default for maximum compatibility, but enabling it is encouraged. ; https://wiki.php.net/rfc/strict_sessions session.use_strict_mode = 0 ; Whether to use cookies. ; http://php.net/session.use-cookies session.use_cookies = 1 ; http://php.net/session.cookie-secure ;session.cookie_secure = ; This option forces PHP to fetch and use a cookie for storing and maintaining ; the session id. We encourage this operation as it's very helpful in combating ; session hijacking when not specifying and managing your own session id. It is ; not the be-all and end-all of session hijacking defense, but it's a good start. ; http://php.net/session.use-only-cookies session.use_only_cookies = 1 ; Name of the session (used as cookie name). ; http://php.net/session.name session.name = PHPSESSID ; Initialize session on request startup. ; http://php.net/session.auto-start session.auto_start = 0 ; Lifetime in seconds of cookie or, if 0, until browser is restarted. ; http://php.net/session.cookie-lifetime session.cookie_lifetime = 0 ; The path for which the cookie is valid. ; http://php.net/session.cookie-path session.cookie_path = / ; The domain for which the cookie is valid. ; http://php.net/session.cookie-domain session.cookie_domain = ; Whether or not to add the httpOnly flag to the cookie, which makes it inaccessible to browser scripting languages such as JavaScript. ; http://php.net/session.cookie-httponly session.cookie_httponly = 1 ; Handler used to serialize data. php is the standard serializer of PHP. ; http://php.net/session.serialize-handler session.serialize_handler = php ; Defines the probability that the 'garbage collection' process is started ; on every session initialization. The probability is calculated by using ; gc_probability/gc_divisor. Where session.gc_probability is the numerator ; and gc_divisor is the denominator in the equation. Setting this value to 1 ; when the session.gc_divisor value is 100 will give you approximately a 1% chance ; the gc will run on any give request. ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; http://php.net/session.gc-probability session.gc_probability = 1 ; Defines the probability that the 'garbage collection' process is started on every ; session initialization. The probability is calculated by using the following equation: ; gc_probability/gc_divisor. Where session.gc_probability is the numerator and ; session.gc_divisor is the denominator in the equation. Setting this value to 1 ; when the session.gc_divisor value is 100 will give you approximately a 1% chance ; the gc will run on any give request. Increasing this value to 1000 will give you ; a 0.1% chance the gc will run on any give request. For high volume production servers, ; this is a more efficient approach. ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; http://php.net/session.gc-divisor session.gc_divisor = 1000 ; After this number of seconds, stored data will be seen as 'garbage' and ; cleaned up by the garbage collection process. ; http://php.net/session.gc-maxlifetime session.gc_maxlifetime = 1440 ; NOTE: If you are using the subdirectory option for storing session files ; (see session.save_path above), then garbage collection does *not* ; happen automatically. You will need to do your own garbage ; collection through a shell script, cron entry, or some other method. ; For example, the following script would is the equivalent of ; setting session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes): ; find /path/to/sessions -cmin +24 -type f | xargs rm ; Check HTTP Referer to invalidate externally stored URLs containing ids. ; HTTP_REFERER has to contain this substring for the session to be ; considered as valid. ; http://php.net/session.referer-check session.referer_check = ; Set to {nocache,private,public,} to determine HTTP caching aspects ; or leave this empty to avoid sending anti-caching headers. ; http://php.net/session.cache-limiter session.cache_limiter = nocache ; Document expires after n minutes. ; http://php.net/session.cache-expire session.cache_expire = 180 ; trans sid support is disabled by default. ; Use of trans sid may risk your users' security. ; Use this option with caution. ; - User may send URL contains active session ID ; to other person via. email/irc/etc. ; - URL that contains active session ID may be stored ; in publicly accessible computer. ; - User may access your site with the same session ID ; always using URL stored in browser's history or bookmarks. ; http://php.net/session.use-trans-sid session.use_trans_sid = 0 ; Set session ID character length. This value could be between 22 to 256. ; Shorter length than default is supported only for compatibility reason. ; Users should use 32 or more chars. ; http://php.net/session.sid-length ; Default Value: 32 ; Development Value: 26 ; Production Value: 26 session.sid_length = 26 ; The URL rewriter will look for URLs in a defined set of HTML tags. ; is special; if you include them here, the rewriter will ; add a hidden field with the info which is otherwise appended ; to URLs. tag's action attribute URL will not be modified ; unless it is specified. ; Note that all valid entries require a "=", even if no value follows. ; Default Value: "a=href,area=href,frame=src,form=" ; Development Value: "a=href,area=href,frame=src,form=" ; Production Value: "a=href,area=href,frame=src,form=" ; http://php.net/url-rewriter.tags session.trans_sid_tags = "a=href,area=href,frame=src,form=" ; URL rewriter does not rewrite absolute URLs by default. ; To enable rewrites for absolute pathes, target hosts must be specified ; at RUNTIME. i.e. use ini_set() ; tags is special. PHP will check action attribute's URL regardless ; of session.trans_sid_tags setting. ; If no host is defined, HTTP_HOST will be used for allowed host. ; Example value: php.net,www.php.net,wiki.php.net ; Use "," for multiple hosts. No spaces are allowed. ; Default Value: "" ; Development Value: "" ; Production Value: "" ;session.trans_sid_hosts="" ; Define how many bits are stored in each character when converting ; the binary hash data to something readable. ; Possible values: ; 4 (4 bits: 0-9, a-f) ; 5 (5 bits: 0-9, a-v) ; 6 (6 bits: 0-9, a-z, A-Z, "-", ",") ; Default Value: 4 ; Development Value: 5 ; Production Value: 5 ; http://php.net/session.hash-bits-per-character session.sid_bits_per_character = 5 ; Enable upload progress tracking in $_SESSION ; Default Value: On ; Development Value: On ; Production Value: On ; http://php.net/session.upload-progress.enabled ;session.upload_progress.enabled = On ; Cleanup the progress information as soon as all POST data has been read ; (i.e. upload completed). ; Default Value: On ; Development Value: On ; Production Value: On ; http://php.net/session.upload-progress.cleanup ;session.upload_progress.cleanup = On ; A prefix used for the upload progress key in $_SESSION ; Default Value: "upload_progress_" ; Development Value: "upload_progress_" ; Production Value: "upload_progress_" ; http://php.net/session.upload-progress.prefix ;session.upload_progress.prefix = "upload_progress_" ; The index name (concatenated with the prefix) in $_SESSION ; containing the upload progress information ; Default Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Development Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Production Value: "PHP_SESSION_UPLOAD_PROGRESS" ; http://php.net/session.upload-progress.name ;session.upload_progress.name = "PHP_SESSION_UPLOAD_PROGRESS" ; How frequently the upload progress should be updated. ; Given either in percentages (per-file), or in bytes ; Default Value: "1%" ; Development Value: "1%" ; Production Value: "1%" ; http://php.net/session.upload-progress.freq ;session.upload_progress.freq = "1%" ; The minimum delay between updates, in seconds ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; http://php.net/session.upload-progress.min-freq ;session.upload_progress.min_freq = "1" ; Only write session data when session data is changed. Enabled by default. ; http://php.net/session.lazy-write ;session.lazy_write = On [Assertion] ; Switch whether to compile assertions at all (to have no overhead at run-time) ; -1: Do not compile at all ; 0: Jump over assertion at run-time ; 1: Execute assertions ; Changing from or to a negative value is only possible in php.ini! (For turning assertions on and off at run-time, see assert.active, when zend.assertions = 1) ; Default Value: 1 ; Development Value: 1 ; Production Value: -1 ; http://php.net/zend.assertions zend.assertions = -1 ; Assert(expr); active by default. ; http://php.net/assert.active ;assert.active = On ; Throw an AssertationException on failed assertions ; http://php.net/assert.exception ;assert.exception = On ; Issue a PHP warning for each failed assertion. (Overridden by assert.exception if active) ; http://php.net/assert.warning ;assert.warning = On ; Don't bail out by default. ; http://php.net/assert.bail ;assert.bail = Off ; User-function to be called if an assertion fails. ; http://php.net/assert.callback ;assert.callback = 0 ; Eval the expression with current error_reporting(). Set to true if you want ; error_reporting(0) around the eval(). ; http://php.net/assert.quiet-eval ;assert.quiet_eval = 0 [COM] ; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs ; http://php.net/com.typelib-file ;com.typelib_file = ; allow Distributed-COM calls ; http://php.net/com.allow-dcom ;com.allow_dcom = true ; autoregister constants of a components typlib on com_load() ; http://php.net/com.autoregister-typelib ;com.autoregister_typelib = true ; register constants casesensitive ; http://php.net/com.autoregister-casesensitive ;com.autoregister_casesensitive = false ; show warnings on duplicate constant registrations ; http://php.net/com.autoregister-verbose ;com.autoregister_verbose = true ; The default character set code-page to use when passing strings to and from COM objects. ; Default: system ANSI code page ;com.code_page= [mbstring] ; language for internal character representation. ; This affects mb_send_mail() and mbstring.detect_order. ; http://php.net/mbstring.language ;mbstring.language = Japanese ; Use of this INI entry is deprecated, use global internal_encoding instead. ; internal/script encoding. ; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*) ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;mbstring.internal_encoding = ; Use of this INI entry is deprecated, use global input_encoding instead. ; http input encoding. ; mbstring.encoding_traslation = On is needed to use this setting. ; If empty, default_charset or input_encoding or mbstring.input is used. ; The precedence is: default_charset < intput_encoding < mbsting.http_input ; http://php.net/mbstring.http-input ;mbstring.http_input = ; Use of this INI entry is deprecated, use global output_encoding instead. ; http output encoding. ; mb_output_handler must be registered as output buffer to function. ; If empty, default_charset or output_encoding or mbstring.http_output is used. ; The precedence is: default_charset < output_encoding < mbstring.http_output ; To use an output encoding conversion, mbstring's output handler must be set ; otherwise output encoding conversion cannot be performed. ; http://php.net/mbstring.http-output ;mbstring.http_output = ; enable automatic encoding translation according to ; mbstring.internal_encoding setting. Input chars are ; converted to internal encoding by setting this to On. ; Note: Do _not_ use automatic encoding translation for ; portable libs/applications. ; http://php.net/mbstring.encoding-translation ;mbstring.encoding_translation = Off ; automatic encoding detection order. ; "auto" detect order is changed according to mbstring.language ; http://php.net/mbstring.detect-order ;mbstring.detect_order = auto ; substitute_character used when character cannot be converted ; one from another ; http://php.net/mbstring.substitute-character ;mbstring.substitute_character = none ; overload(replace) single byte functions by mbstring functions. ; mail(), ereg(), etc are overloaded by mb_send_mail(), mb_ereg(), ; etc. Possible values are 0,1,2,4 or combination of them. ; For example, 7 for overload everything. ; 0: No overload ; 1: Overload mail() function ; 2: Overload str*() functions ; 4: Overload ereg*() functions ; http://php.net/mbstring.func-overload ;mbstring.func_overload = 0 ; enable strict encoding detection. ; Default: Off ;mbstring.strict_detection = On ; This directive specifies the regex pattern of content types for which mb_output_handler() ; is activated. ; Default: mbstring.http_output_conv_mimetype=^(text/|application/xhtml\+xml) ;mbstring.http_output_conv_mimetype= [gd] ; Tell the jpeg decode to ignore warnings and try to create ; a gd image. The warning will then be displayed as notices ; disabled by default ; http://php.net/gd.jpeg-ignore-warning ;gd.jpeg_ignore_warning = 1 [exif] ; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS. ; With mbstring support this will automatically be converted into the encoding ; given by corresponding encode setting. When empty mbstring.internal_encoding ; is used. For the decode settings you can distinguish between motorola and ; intel byte order. A decode setting cannot be empty. ; http://php.net/exif.encode-unicode ;exif.encode_unicode = ISO-8859-15 ; http://php.net/exif.decode-unicode-motorola ;exif.decode_unicode_motorola = UCS-2BE ; http://php.net/exif.decode-unicode-intel ;exif.decode_unicode_intel = UCS-2LE ; http://php.net/exif.encode-jis ;exif.encode_jis = ; http://php.net/exif.decode-jis-motorola ;exif.decode_jis_motorola = JIS ; http://php.net/exif.decode-jis-intel ;exif.decode_jis_intel = JIS [Tidy] ; The path to a default tidy configuration file to use when using tidy ; http://php.net/tidy.default-config ;tidy.default_config = /usr/local/lib/php/default.tcfg ; Should tidy clean and repair output automatically? ; WARNING: Do not use this option if you are generating non-html content ; such as dynamic images ; http://php.net/tidy.clean-output tidy.clean_output = Off [soap] ; Enables or disables WSDL caching feature. ; http://php.net/soap.wsdl-cache-enabled soap.wsdl_cache_enabled=1 ; Sets the directory name where SOAP extension will put cache files. ; http://php.net/soap.wsdl-cache-dir soap.wsdl_cache_dir="/tmp" ; (time to live) Sets the number of second while cached file will be used ; instead of original one. ; http://php.net/soap.wsdl-cache-ttl soap.wsdl_cache_ttl=86400 ; Sets the size of the cache limit. (Max. number of WSDL files to cache) soap.wsdl_cache_limit = 5 [sysvshm] ; A default size of the shared memory segment ;sysvshm.init_mem = 10000 [ldap] ; Sets the maximum number of open links or -1 for unlimited. ldap.max_links = -1 [dba] ;dba.default_handler= [opcache] ; Determines if Zend OPCache is enabled ;opcache.enable=1 ; Determines if Zend OPCache is enabled for the CLI version of PHP ;opcache.enable_cli=0 ; The OPcache shared memory storage size. ;opcache.memory_consumption=128 ; The amount of memory for interned strings in Mbytes. ;opcache.interned_strings_buffer=8 ; The maximum number of keys (scripts) in the OPcache hash table. ; Only numbers between 200 and 1000000 are allowed. ;opcache.max_accelerated_files=10000 ; The maximum percentage of "wasted" memory until a restart is scheduled. ;opcache.max_wasted_percentage=5 ; When this directive is enabled, the OPcache appends the current working ; directory to the script key, thus eliminating possible collisions between ; files with the same name (basename). Disabling the directive improves ; performance, but may break existing applications. ;opcache.use_cwd=1 ; When disabled, you must reset the OPcache manually or restart the ; webserver for changes to the filesystem to take effect. ;opcache.validate_timestamps=1 ; How often (in seconds) to check file timestamps for changes to the shared ; memory storage allocation. ("1" means validate once per second, but only ; once per request. "0" means always validate) ;opcache.revalidate_freq=2 ; Enables or disables file search in include_path optimization ;opcache.revalidate_path=0 ; If disabled, all PHPDoc comments are dropped from the code to reduce the ; size of the optimized code. ;opcache.save_comments=1 ; Allow file existence override (file_exists, etc.) performance feature. ;opcache.enable_file_override=0 ; A bitmask, where each bit enables or disables the appropriate OPcache ; passes ;opcache.optimization_level=0xffffffff ;opcache.inherited_hack=1 ;opcache.dups_fix=0 ; The location of the OPcache blacklist file (wildcards allowed). ; Each OPcache blacklist file is a text file that holds the names of files ; that should not be accelerated. The file format is to add each filename ; to a new line. The filename may be a full path or just a file prefix ; (i.e., /var/www/x blacklists all the files and directories in /var/www ; that start with 'x'). Line starting with a ; are ignored (comments). ;opcache.blacklist_filename= ; Allows exclusion of large files from being cached. By default all files ; are cached. ;opcache.max_file_size=0 ; Check the cache checksum each N requests. ; The default value of "0" means that the checks are disabled. ;opcache.consistency_checks=0 ; How long to wait (in seconds) for a scheduled restart to begin if the cache ; is not being accessed. ;opcache.force_restart_timeout=180 ; OPcache error_log file name. Empty string assumes "stderr". ;opcache.error_log= ; All OPcache errors go to the Web server log. ; By default, only fatal errors (level 0) or errors (level 1) are logged. ; You can also enable warnings (level 2), info messages (level 3) or ; debug messages (level 4). ;opcache.log_verbosity_level=1 ; Preferred Shared Memory back-end. Leave empty and let the system decide. ;opcache.preferred_memory_model= ; Protect the shared memory from unexpected writing during script execution. ; Useful for internal debugging only. ;opcache.protect_memory=0 ; Allows calling OPcache API functions only from PHP scripts which path is ; started from specified string. The default "" means no restriction ;opcache.restrict_api= ; Mapping base of shared memory segments (for Windows only). All the PHP ; processes have to map shared memory into the same address space. This ; directive allows to manually fix the "Unable to reattach to base address" ; errors. ;opcache.mmap_base= ; Enables and sets the second level cache directory. ; It should improve performance when SHM memory is full, at server restart or ; SHM reset. The default "" disables file based caching. ;opcache.file_cache= ; Enables or disables opcode caching in shared memory. ;opcache.file_cache_only=0 ; Enables or disables checksum validation when script loaded from file cache. ;opcache.file_cache_consistency_checks=1 ; Implies opcache.file_cache_only=1 for a certain process that failed to ; reattach to the shared memory (for Windows only). Explicitly enabled file ; cache is required. ;opcache.file_cache_fallback=1 ; Enables or disables copying of PHP code (text segment) into HUGE PAGES. ; This should improve performance, but requires appropriate OS configuration. ;opcache.huge_code_pages=0 ; Validate cached file permissions. ;opcache.validate_permission=0 ; Prevent name collisions in chroot'ed environment. ;opcache.validate_root=0 ; If specified, it produces opcode dumps for debugging different stages of ; optimizations. ;opcache.opt_debug_level=0 [curl] ; A default value for the CURLOPT_CAINFO option. This is required to be an ; absolute path. ;curl.cainfo = [openssl] ; The location of a Certificate Authority (CA) file on the local filesystem ; to use when verifying the identity of SSL/TLS peers. Most users should ; not specify a value for this directive as PHP will attempt to use the ; OS-managed cert stores in its absence. If specified, this value may still ; be overridden on a per-stream basis via the "cafile" SSL stream context ; option. ;openssl.cafile= ; If openssl.cafile is not specified or if the CA file is not found, the ; directory pointed to by openssl.capath is searched for a suitable ; certificate. This value must be a correctly hashed certificate directory. ; Most users should not specify a value for this directive as PHP will ; attempt to use the OS-managed cert stores in its absence. If specified, ; this value may still be overridden on a per-stream basis via the "capath" ; SSL stream context option. ;openssl.capath= ; Local Variables: ; tab-width: 4 ; End: [Zend] zend_extension="/usr/local/ioncube/ioncube_loader_lin_7.2.so" ; fix for segfaults auto_globals_jit = Off cgi.fix_pathinfo = 1 mbstring.http_input = "pass" mbstring.http_output = "pass" mbstring.encoding_translation = 0 ; Enable Extensions extension=uploadprogress.so extension=imagick.so extension=jsmin.so extension=redis.so ; APCu extension=apcu.so apc.enable_cli=1 apc.gc_ttl=300 apc.shm_segments=1 apc.shm_size=256M apc.slam_defense=0 apc.ttl=0 ; ================================================ FILE: aegir/conf/php/php73-cli.ini ================================================ [PHP] ;;;;;;;;;;;;;;;;;;; ; About php.ini ; ;;;;;;;;;;;;;;;;;;; ; PHP's initialization file, generally called php.ini, is responsible for ; configuring many of the aspects of PHP's behavior. ; PHP attempts to find and load this configuration from a number of locations. ; The following is a summary of its search order: ; 1. SAPI module specific location. ; 2. The PHPRC environment variable. (As of PHP 5.2.0) ; 3. A number of predefined registry keys on Windows (As of PHP 5.2.0) ; 4. Current working directory (except CLI) ; 5. The web server's directory (for SAPI modules), or directory of PHP ; (otherwise in Windows) ; 6. The directory from the --with-config-file-path compile time option, or the ; Windows directory (usually C:\windows) ; See the PHP docs for more specific information. ; http://php.net/configuration.file ; The syntax of the file is extremely simple. Whitespace and lines ; beginning with a semicolon are silently ignored (as you probably guessed). ; Section headers (e.g. [Foo]) are also silently ignored, even though ; they might mean something in the future. ; Directives following the section heading [PATH=/www/mysite] only ; apply to PHP files in the /www/mysite directory. Directives ; following the section heading [HOST=www.example.com] only apply to ; PHP files served from www.example.com. Directives set in these ; special sections cannot be overridden by user-defined INI files or ; at runtime. Currently, [PATH=] and [HOST=] sections only work under ; CGI/FastCGI. ; http://php.net/ini.sections ; Directives are specified using the following syntax: ; directive = value ; Directive names are *case sensitive* - foo=bar is different from FOO=bar. ; Directives are variables used to configure PHP or PHP extensions. ; There is no name validation. If PHP can't find an expected ; directive because it is not set or is mistyped, a default value will be used. ; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one ; of the INI constants (On, Off, True, False, Yes, No and None) or an expression ; (e.g. E_ALL & ~E_NOTICE), a quoted string ("bar"), or a reference to a ; previously set variable or directive (e.g. ${foo}) ; Expressions in the INI file are limited to bitwise operators and parentheses: ; | bitwise OR ; ^ bitwise XOR ; & bitwise AND ; ~ bitwise NOT ; ! boolean NOT ; Boolean flags can be turned on using the values 1, On, True or Yes. ; They can be turned off using the values 0, Off, False or No. ; An empty string can be denoted by simply not writing anything after the equal ; sign, or by using the None keyword: ; foo = ; sets foo to an empty string ; foo = None ; sets foo to an empty string ; foo = "None" ; sets foo to the string 'None' ; If you use constants in your value, and these constants belong to a ; dynamically loaded extension (either a PHP extension or a Zend extension), ; you may only use these constants *after* the line that loads the extension. ;;;;;;;;;;;;;;;;;;; ; About this file ; ;;;;;;;;;;;;;;;;;;; ; PHP comes packaged with two INI files. One that is recommended to be used ; in production environments and one that is recommended to be used in ; development environments. ; php.ini-production contains settings which hold security, performance and ; best practices at its core. But please be aware, these settings may break ; compatibility with older or less security conscience applications. We ; recommending using the production ini in production and testing environments. ; php.ini-development is very similar to its production variant, except it is ; much more verbose when it comes to errors. We recommend using the ; development version only in development environments, as errors shown to ; application users can inadvertently leak otherwise secure information. ; This is the php.ini-production INI file. ;;;;;;;;;;;;;;;;;;; ; Quick Reference ; ;;;;;;;;;;;;;;;;;;; ; The following are all the settings which are different in either the production ; or development versions of the INIs with respect to PHP's default behavior. ; Please see the actual settings later in the document for more details as to why ; we recommend these changes in PHP's behavior. display_errors = Off ; Default Value: On ; Development Value: On ; Production Value: Off ; display_startup_errors ; Default Value: Off ; Development Value: On ; Production Value: Off ; error_reporting ; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; html_errors ; Default Value: On ; Development Value: On ; Production value: On ; log_errors ; Default Value: Off ; Development Value: On ; Production Value: On ; max_input_time ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; output_buffering ; Default Value: Off ; Development Value: 4096 ; Production Value: 4096 ; register_argc_argv ; Default Value: On ; Development Value: Off ; Production Value: Off ; request_order ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; session.gc_divisor ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; session.sid_bits_per_character ; Default Value: 4 ; Development Value: 5 ; Production Value: 5 ; short_open_tag ; Default Value: On ; Development Value: Off ; Production Value: Off ; track_errors ; Default Value: Off ; Development Value: On ; Production Value: Off ; variables_order ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS" ;;;;;;;;;;;;;;;;;;;; ; php.ini Options ; ;;;;;;;;;;;;;;;;;;;; ; Name for user-defined php.ini (.htaccess) files. Default is ".user.ini" ;user_ini.filename = ".user.ini" ; To disable this feature set this option to an empty value user_ini.filename = ; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes) ;user_ini.cache_ttl = 300 ;;;;;;;;;;;;;;;;;;;; ; Language Options ; ;;;;;;;;;;;;;;;;;;;; ; Enable the PHP scripting language engine under Apache. ; http://php.net/engine engine = On ; This directive determines whether or not PHP will recognize code between ; tags as PHP source which should be processed as such. It is ; generally recommended that should be used and that this feature ; should be disabled, as enabling it may result in issues when generating XML ; documents, however this remains supported for backward compatibility reasons. ; Note that this directive does not control the would work. ; http://php.net/syntax-highlighting ;highlight.string = #DD0000 ;highlight.comment = #FF9900 ;highlight.keyword = #007700 ;highlight.default = #0000BB ;highlight.html = #000000 ; If enabled, the request will be allowed to complete even if the user aborts ; the request. Consider enabling it if executing long requests, which may end up ; being interrupted by the user or a browser timing out. PHP's default behavior ; is to disable this feature. ; http://php.net/ignore-user-abort ;ignore_user_abort = On ; Determines the size of the realpath cache to be used by PHP. This value should ; be increased on systems where PHP opens many files to reflect the quantity of ; the file operations performed. ; http://php.net/realpath-cache-size realpath_cache_size=64M ; Duration of time, in seconds for which to cache realpath information for a given ; file or directory. For systems with rarely changing files, consider increasing this ; value. ; http://php.net/realpath-cache-ttl realpath_cache_ttl=5 ; Enables or disables the circular reference collector. ; http://php.net/zend.enable-gc zend.enable_gc = On ; If enabled, scripts may be written in encodings that are incompatible with ; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such ; encodings. To use this feature, mbstring extension must be enabled. ; Default: Off ;zend.multibyte = Off ; Allows to set the default encoding for the scripts. This value will be used ; unless "declare(encoding=...)" directive appears at the top of the script. ; Only affects if zend.multibyte is set. ; Default: "" ;zend.script_encoding = ;;;;;;;;;;;;;;;;; ; Miscellaneous ; ;;;;;;;;;;;;;;;;; ; Decides whether PHP may expose the fact that it is installed on the server ; (e.g. by adding its signature to the Web server header). It is no security ; threat in any way, but it makes it possible to determine whether you use PHP ; on your server or not. ; http://php.net/expose-php expose_php = On ;;;;;;;;;;;;;;;;;;; ; Resource Limits ; ;;;;;;;;;;;;;;;;;;; ; Maximum execution time of each script, in seconds ; http://php.net/max-execution-time ; Note: This directive is hardcoded to 0 for the CLI SAPI max_execution_time = 3600 ; Maximum amount of time each script may spend parsing request data. It's a good ; idea to limit this time on productions servers in order to eliminate unexpectedly ; long running scripts. ; Note: This directive is hardcoded to -1 for the CLI SAPI ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; http://php.net/max-input-time max_input_time = 3600 ; Maximum input variable nesting level ; http://php.net/max-input-nesting-level ;max_input_nesting_level = 64 ; How many GET/POST/COOKIE input variables may be accepted max_input_vars = 9999 ; Maximum amount of memory a script may consume (128MB) ; http://php.net/memory-limit memory_limit = 395M ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; Error handling and logging ; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; This directive informs PHP of which errors, warnings and notices you would like ; it to take action for. The recommended way of setting values for this ; directive is through the use of the error level constants and bitwise ; operators. The error level constants are below here for convenience as well as ; some common settings and their meanings. ; By default, PHP is set to take action on all errors, notices and warnings EXCEPT ; those related to E_NOTICE and E_STRICT, which together cover best practices and ; recommended coding standards in PHP. For performance reasons, this is the ; recommend error reporting setting. Your production server shouldn't be wasting ; resources complaining about best practices and coding standards. That's what ; development servers and development settings are for. ; Note: The php.ini-development file has this setting as E_ALL. This ; means it pretty much reports everything which is exactly what you want during ; development and early testing. ; ; Error Level Constants: ; E_ALL - All errors and warnings (includes E_STRICT as of PHP 5.4.0) ; E_ERROR - fatal run-time errors ; E_RECOVERABLE_ERROR - almost fatal run-time errors ; E_WARNING - run-time warnings (non-fatal errors) ; E_PARSE - compile-time parse errors ; E_NOTICE - run-time notices (these are warnings which often result ; from a bug in your code, but it's possible that it was ; intentional (e.g., using an uninitialized variable and ; relying on the fact it is automatically initialized to an ; empty string) ; E_STRICT - run-time notices, enable to have PHP suggest changes ; to your code which will ensure the best interoperability ; and forward compatibility of your code ; E_CORE_ERROR - fatal errors that occur during PHP's initial startup ; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's ; initial startup ; E_COMPILE_ERROR - fatal compile-time errors ; E_COMPILE_WARNING - compile-time warnings (non-fatal errors) ; E_USER_ERROR - user-generated error message ; E_USER_WARNING - user-generated warning message ; E_USER_NOTICE - user-generated notice message ; E_DEPRECATED - warn about code that will not work in future versions ; of PHP ; E_USER_DEPRECATED - user-generated deprecation warnings ; ; Common Values: ; E_ALL (Show all errors, warnings and notices including coding standards.) ; E_ALL & ~E_NOTICE (Show all errors, except for notices) ; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.) ; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors) ; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; http://php.net/error-reporting error_reporting = 1 ; This directive controls whether or not and where PHP will output errors, ; notices and warnings too. Error output is very useful during development, but ; it could be very dangerous in production environments. Depending on the code ; which is triggering the error, sensitive information could potentially leak ; out of your application such as database usernames and passwords or worse. ; For production environments, we recommend logging errors rather than ; sending them to STDOUT. ; Possible Values: ; Off = Do not display any errors ; stderr = Display errors to STDERR (affects only CGI/CLI binaries!) ; On or stdout = Display errors to STDOUT ; Default Value: On ; Development Value: On ; Production Value: Off ; http://php.net/display-errors display_errors = Off ; The display of errors which occur during PHP's startup sequence are handled ; separately from display_errors. PHP's default behavior is to suppress those ; errors from clients. Turning the display of startup errors on can be useful in ; debugging configuration problems. We strongly recommend you ; set this to 'off' for production servers. ; Default Value: Off ; Development Value: On ; Production Value: Off ; http://php.net/display-startup-errors display_startup_errors = Off ; Besides displaying errors, PHP can also log errors to locations such as a ; server-specific log, STDERR, or a location specified by the error_log ; directive found below. While errors should not be displayed on productions ; servers they should still be monitored and logging is a great way to do that. ; Default Value: Off ; Development Value: On ; Production Value: On ; http://php.net/log-errors log_errors = On ; Set maximum length of log_errors. In error_log information about the source is ; added. The default is 1024 and 0 allows to not apply any maximum length at all. ; http://php.net/log-errors-max-len log_errors_max_len = 1024 ; Do not log repeated messages. Repeated errors must occur in same file on same ; line unless ignore_repeated_source is set true. ; http://php.net/ignore-repeated-errors ignore_repeated_errors = Off ; Ignore source of message when ignoring repeated messages. When this setting ; is On you will not log errors with repeated messages from different files or ; source lines. ; http://php.net/ignore-repeated-source ignore_repeated_source = Off ; If this parameter is set to Off, then memory leaks will not be shown (on ; stdout or in the log). This has only effect in a debug compile, and if ; error reporting includes E_WARNING in the allowed list ; http://php.net/report-memleaks report_memleaks = On ; This setting is on by default. ;report_zend_debug = 0 ; Store the last error/warning message in $php_errormsg (boolean). Setting this value ; to On can assist in debugging and is appropriate for development servers. It should ; however be disabled on production servers. ; This directive is DEPRECATED. ; Default Value: Off ; Development Value: Off ; Production Value: Off ; http://php.net/track-errors ;track_errors = Off ; Turn off normal error reporting and emit XML-RPC error XML ; http://php.net/xmlrpc-errors ;xmlrpc_errors = 0 ; An XML-RPC faultCode ;xmlrpc_error_number = 0 ; When PHP displays or logs an error, it has the capability of formatting the ; error message as HTML for easier reading. This directive controls whether ; the error message is formatted as HTML or not. ; Note: This directive is hardcoded to Off for the CLI SAPI ; Default Value: On ; Development Value: On ; Production value: On ; http://php.net/html-errors html_errors = Off ; If html_errors is set to On *and* docref_root is not empty, then PHP ; produces clickable error messages that direct to a page describing the error ; or function causing the error in detail. ; You can download a copy of the PHP manual from http://php.net/docs ; and change docref_root to the base URL of your local copy including the ; leading '/'. You must also specify the file extension being used including ; the dot. PHP's default behavior is to leave these settings empty, in which ; case no links to documentation are generated. ; Note: Never use this feature for production boxes. ; http://php.net/docref-root ; Examples ;docref_root = "/phpmanual/" ; http://php.net/docref-ext ;docref_ext = .html ; String to output before an error message. PHP's default behavior is to leave ; this setting blank. ; http://php.net/error-prepend-string ; Example: ;error_prepend_string = "" ; String to output after an error message. PHP's default behavior is to leave ; this setting blank. ; http://php.net/error-append-string ; Example: ;error_append_string = "" ; Log errors to specified file. PHP's default behavior is to leave this value ; empty. ; http://php.net/error-log ; Example: ;error_log = php_errors.log ; Log errors to syslog (Event Log on Windows). ;error_log = syslog error_log = /var/log/php/error_log_cli_73 ; The syslog ident is a string which is prepended to every message logged ; to syslog. Only used when error_log is set to syslog. ;syslog.ident = php ; The syslog facility is used to specify what type of program is logging ; the message. Only used when error_log is set to syslog. ;syslog.facility = user ; Set this to disable filtering control characters (the default). ; Some loggers only accept NVT-ASCII, others accept anything that's not ; control characters. If your logger accepts everything, then no filtering ; is needed at all. ; Allowed values are: ; ascii (only base ASCII characters) ; no_ctrl (all characters except control characters) ; all (all characters) ;syslog.filter = ascii ;windows.show_crt_warning ; Default value: 0 ; Development value: 0 ; Production value: 0 ;;;;;;;;;;;;;;;;; ; Data Handling ; ;;;;;;;;;;;;;;;;; ; The separator used in PHP generated URLs to separate arguments. ; PHP's default setting is "&". ; http://php.net/arg-separator.output ; Example: ;arg_separator.output = "&" ; List of separator(s) used by PHP to parse input URLs into variables. ; PHP's default setting is "&". ; NOTE: Every character in this directive is considered as separator! ; http://php.net/arg-separator.input ; Example: ;arg_separator.input = ";&" ; This directive determines which super global arrays are registered when PHP ; starts up. G,P,C,E & S are abbreviations for the following respective super ; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty ; paid for the registration of these arrays and because ENV is not as commonly ; used as the others, ENV is not recommended on productions servers. You ; can still get access to the environment variables through getenv() should you ; need to. ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS"; ; http://php.net/variables-order variables_order = "GPCS" ; This directive determines which super global data (G,P & C) should be ; registered into the super global array REQUEST. If so, it also determines ; the order in which that data is registered. The values for this directive ; are specified in the same manner as the variables_order directive, ; EXCEPT one. Leaving this value empty will cause PHP to use the value set ; in the variables_order directive. It does not mean it will leave the super ; globals array REQUEST empty. ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; http://php.net/request-order request_order = "GP" ; This directive determines whether PHP registers $argv & $argc each time it ; runs. $argv contains an array of all the arguments passed to PHP when a script ; is invoked. $argc contains an integer representing the number of arguments ; that were passed when the script was invoked. These arrays are extremely ; useful when running scripts from the command line. When this directive is ; enabled, registering these variables consumes CPU cycles and memory each time ; a script is executed. For performance reasons, this feature should be disabled ; on production servers. ; Note: This directive is hardcoded to On for the CLI SAPI ; Default Value: On ; Development Value: Off ; Production Value: Off ; http://php.net/register-argc-argv register_argc_argv = Off ; When enabled, the ENV, REQUEST and SERVER variables are created when they're ; first used (Just In Time) instead of when the script starts. If these ; variables are not used within a script, having this directive on will result ; in a performance gain. The PHP directive register_argc_argv must be disabled ; for this directive to have any affect. ; http://php.net/auto-globals-jit auto_globals_jit = On ; Whether PHP will read the POST data. ; This option is enabled by default. ; Most likely, you won't want to disable this option globally. It causes $_POST ; and $_FILES to always be empty; the only way you will be able to read the ; POST data will be through the php://input stream wrapper. This can be useful ; to proxy requests or to process the POST data in a memory efficient fashion. ; http://php.net/enable-post-data-reading ;enable_post_data_reading = Off ; Maximum size of POST data that PHP will accept. ; Its value may be 0 to disable the limit. It is ignored if POST data reading ; is disabled through enable_post_data_reading. ; http://php.net/post-max-size post_max_size = 350M ; Automatically add files before PHP document. ; http://php.net/auto-prepend-file auto_prepend_file = ; Automatically add files after PHP document. ; http://php.net/auto-append-file auto_append_file = ; By default, PHP will output a media type using the Content-Type header. To ; disable this, simply set it to be empty. ; ; PHP's built-in default media type is set to text/html. ; http://php.net/default-mimetype default_mimetype = "text/html" ; PHP's default character set is set to UTF-8. ; http://php.net/default-charset default_charset = "UTF-8" ; PHP internal character encoding is set to empty. ; If empty, default_charset is used. ; http://php.net/internal-encoding ;internal_encoding = ; PHP input character encoding is set to empty. ; If empty, default_charset is used. ; http://php.net/input-encoding ;input_encoding = ; PHP output character encoding is set to empty. ; If empty, default_charset is used. ; See also output_buffer. ; http://php.net/output-encoding ;output_encoding = ;;;;;;;;;;;;;;;;;;;;;;;;; ; Paths and Directories ; ;;;;;;;;;;;;;;;;;;;;;;;;; ; UNIX: "/path1:/path2" ;include_path = ".:/php/includes" ; ; Windows: "\path1;\path2" ;include_path = ".;c:\php\includes" ; ; PHP's default setting for include_path is ".;/path/to/php/pear" ; http://php.net/include-path include_path = ".:/opt/php73/lib/php" ; The root of the PHP pages, used only if nonempty. ; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root ; if you are running php as a CGI under any web server (other than IIS) ; see documentation for security issues. The alternate is to use the ; cgi.force_redirect configuration below ; http://php.net/doc-root doc_root = ; The directory under which PHP opens the script using /~username used only ; if nonempty. ; http://php.net/user-dir user_dir = ; Directory in which the loadable extensions (modules) reside. ; http://php.net/extension-dir ; extension_dir = "./" ; On windows: ; extension_dir = "ext" extension_dir = "/opt/php73/lib/php/extensions/no-debug-non-zts-20180731/" ; Directory where the temporary files should be placed. ; Defaults to the system default (see sys_get_temp_dir) sys_temp_dir = "/tmp" ; Whether or not to enable the dl() function. The dl() function does NOT work ; properly in multithreaded servers, such as IIS or Zeus, and is automatically ; disabled on them. ; http://php.net/enable-dl enable_dl = Off ; cgi.force_redirect is necessary to provide security running PHP as a CGI under ; most web servers. Left undefined, PHP turns this on by default. You can ; turn it off here AT YOUR OWN RISK ; **You CAN safely turn this off for IIS, in fact, you MUST.** ; http://php.net/cgi.force-redirect ;cgi.force_redirect = 1 ; if cgi.nph is enabled it will force cgi to always sent Status: 200 with ; every request. PHP's default behavior is to disable this feature. ;cgi.nph = 1 ; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape ; (iPlanet) web servers, you MAY need to set an environment variable name that PHP ; will look for to know it is OK to continue execution. Setting this variable MAY ; cause security issues, KNOW WHAT YOU ARE DOING FIRST. ; http://php.net/cgi.redirect-status-env ;cgi.redirect_status_env = ; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's ; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok ; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting ; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting ; of zero causes PHP to behave as before. Default is 1. You should fix your scripts ; to use SCRIPT_FILENAME rather than PATH_TRANSLATED. ; http://php.net/cgi.fix-pathinfo ;cgi.fix_pathinfo=1 ; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside ; of the web tree and people will not be able to circumvent .htaccess security. ;cgi.discard_path=1 ; FastCGI under IIS supports the ability to impersonate ; security tokens of the calling client. This allows IIS to define the ; security context that the request runs under. mod_fastcgi under Apache ; does not currently support this feature (03/17/2002) ; Set to 1 if running under IIS. Default is zero. ; http://php.net/fastcgi.impersonate ;fastcgi.impersonate = 1 ; Disable logging through FastCGI connection. PHP's default behavior is to enable ; this feature. ;fastcgi.logging = 0 ; cgi.rfc2616_headers configuration option tells PHP what type of headers to ; use when sending HTTP response code. If set to 0, PHP sends Status: header that ; is supported by Apache. When this option is set to 1, PHP will send ; RFC2616 compliant header. ; Default is zero. ; http://php.net/cgi.rfc2616-headers ;cgi.rfc2616_headers = 0 ; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #! ; (shebang) at the top of the running script. This line might be needed if the ; script support running both as stand-alone script and via PHP CGI<. PHP in CGI ; mode skips this line and ignores its content if this directive is turned on. ; http://php.net/cgi.check-shebang-line ;cgi.check_shebang_line=1 ;;;;;;;;;;;;;;;; ; File Uploads ; ;;;;;;;;;;;;;;;; ; Whether to allow HTTP file uploads. ; http://php.net/file-uploads file_uploads = On ; Temporary directory for HTTP uploaded files (will use system default if not ; specified). ; http://php.net/upload-tmp-dir upload_tmp_dir = /tmp ; Maximum allowed size for uploaded files. ; http://php.net/upload-max-filesize upload_max_filesize = 325M ; Maximum number of files that can be uploaded via a single request max_file_uploads = 50 ;;;;;;;;;;;;;;;;;; ; Fopen wrappers ; ;;;;;;;;;;;;;;;;;; ; Whether to allow the treatment of URLs (like http:// or ftp://) as files. ; http://php.net/allow-url-fopen allow_url_fopen = On ; Whether to allow include/require to open URLs (like http:// or ftp://) as files. ; http://php.net/allow-url-include allow_url_include = Off ; Define the anonymous ftp password (your email address). PHP's default setting ; for this is empty. ; http://php.net/from ;from="john@doe.com" ; Define the User-Agent string. PHP's default setting for this is empty. ; http://php.net/user-agent ;user_agent="PHP" ; Default timeout for socket based streams (seconds) ; http://php.net/default-socket-timeout default_socket_timeout = 3600 ; If your scripts have to deal with files from Macintosh systems, ; or you are running on a Mac and need to deal with files from ; unix or win32 systems, setting this flag will cause PHP to ; automatically detect the EOL character in those files so that ; fgets() and file() will work regardless of the source of the file. ; http://php.net/auto-detect-line-endings auto_detect_line_endings = On ;;;;;;;;;;;;;;;;;;;;;; ; Dynamic Extensions ; ;;;;;;;;;;;;;;;;;;;;;; ; If you wish to have an extension loaded automatically, use the following ; syntax: ; ; extension=modulename ; ; For example: ; ; extension=mysqli ; ; When the extension library to load is not located in the default extension ; directory, You may specify an absolute path to the library file: ; ; extension=/path/to/extension/mysqli.so ; ; Note : The syntax used in previous PHP versions ('extension=.so' and ; 'extension='php_.dll') is supported for legacy reasons and may be ; deprecated in a future PHP major version. So, when it is possible, please ; move to the new ('extension=) syntax. ; ; Notes for Windows environments : ; ; - Many DLL files are located in the extensions/ (PHP 4) or ext/ (PHP 5+) ; extension folders as well as the separate PECL DLL download (PHP 5+). ; Be sure to appropriately set the extension_dir directive. ; ;extension=bz2 ;extension=curl ;extension=fileinfo ;extension=gd2 ;extension=gettext ;extension=gmp ;extension=intl ;extension=imap ;extension=interbase ;extension=ldap ;extension=mbstring ;extension=exif ; Must be after mbstring as it depends on it ;extension=mysqli ;extension=oci8_12c ; Use with Oracle Database 12c Instant Client ;extension=odbc ;extension=openssl ;extension=pdo_firebird ;extension=pdo_mysql ;extension=pdo_oci ;extension=pdo_odbc ;extension=pdo_pgsql ;extension=pdo_sqlite ;extension=pgsql ;extension=shmop ; The MIBS data available in the PHP distribution must be installed. ; See http://www.php.net/manual/en/snmp.installation.php ;extension=snmp ;extension=soap ;extension=sockets ;extension=sodium ;extension=sqlite3 ;extension=tidy ;extension=xmlrpc ;extension=xsl ;;;;;;;;;;;;;;;;;;; ; Module Settings ; ;;;;;;;;;;;;;;;;;;; [CLI Server] ; Whether the CLI web server uses ANSI color coding in its terminal output. cli_server.color = On [Date] ; Defines the default timezone used by the date functions ; http://php.net/date.timezone date.timezone = "UTC" ; http://php.net/date.default-latitude ;date.default_latitude = 31.7667 ; http://php.net/date.default-longitude ;date.default_longitude = 35.2333 ; http://php.net/date.sunrise-zenith ;date.sunrise_zenith = 90.583333 ; http://php.net/date.sunset-zenith ;date.sunset_zenith = 90.583333 [filter] ; http://php.net/filter.default ;filter.default = unsafe_raw ; http://php.net/filter.default-flags ;filter.default_flags = [iconv] ; Use of this INI entry is deprecated, use global input_encoding instead. ; If empty, default_charset or input_encoding or iconv.input_encoding is used. ; The precedence is: default_charset < input_encoding < iconv.input_encoding ;iconv.input_encoding = ; Use of this INI entry is deprecated, use global internal_encoding instead. ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;iconv.internal_encoding = ; Use of this INI entry is deprecated, use global output_encoding instead. ; If empty, default_charset or output_encoding or iconv.output_encoding is used. ; The precedence is: default_charset < output_encoding < iconv.output_encoding ; To use an output encoding conversion, iconv's output handler must be set ; otherwise output encoding conversion cannot be performed. ;iconv.output_encoding = [intl] ;intl.default_locale = ; This directive allows you to produce PHP errors when some error ; happens within intl functions. The value is the level of the error produced. ; Default is 0, which does not produce any errors. ;intl.error_level = E_WARNING ;intl.use_exceptions = 0 [sqlite3] ;sqlite3.extension_dir = [Pcre] ;PCRE library backtracking limit. ; http://php.net/pcre.backtrack-limit ;pcre.backtrack_limit=100000 ;PCRE library recursion limit. ;Please note that if you set this value to a high number you may consume all ;the available process stack and eventually crash PHP (due to reaching the ;stack size limit imposed by the Operating System). ; http://php.net/pcre.recursion-limit ;pcre.recursion_limit=100000 ;Enables or disables JIT compilation of patterns. This requires the PCRE ;library to be compiled with JIT support. ;pcre.jit=1 [Pdo] ; Whether to pool ODBC connections. Can be one of "strict", "relaxed" or "off" ; http://php.net/pdo-odbc.connection-pooling ;pdo_odbc.connection_pooling=strict ;pdo_odbc.db2_instance_name [Pdo_mysql] ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. pdo_mysql.default_socket= [Phar] ; http://php.net/phar.readonly ;phar.readonly = On ; http://php.net/phar.require-hash ;phar.require_hash = On ;phar.cache_list = [mail function] ; For Win32 only. ; http://php.net/smtp ;SMTP = localhost ; http://php.net/smtp-port ;smtp_port = 25 ; For Win32 only. ; http://php.net/sendmail-from ;sendmail_from = me@example.com ; For Unix only. You may supply arguments as well (default: "sendmail -t -i"). ; http://php.net/sendmail-path sendmail_path = /usr/sbin/sendmail -t -i ; Force the addition of the specified parameters to be passed as extra parameters ; to the sendmail binary. These parameters will always replace the value of ; the 5th parameter to mail(). ;mail.force_extra_parameters = ; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename mail.add_x_header = Off ; The path to a log file that will log all mail() calls. Log entries include ; the full path of the script, line number, To address and headers. ;mail.log = ; Log mail to syslog (Event Log on Windows). ;mail.log = syslog [ODBC] ; http://php.net/odbc.default-db ;odbc.default_db = Not yet implemented ; http://php.net/odbc.default-user ;odbc.default_user = Not yet implemented ; http://php.net/odbc.default-pw ;odbc.default_pw = Not yet implemented ; Controls the ODBC cursor model. ; Default: SQL_CURSOR_STATIC (default). ;odbc.default_cursortype ; Allow or prevent persistent links. ; http://php.net/odbc.allow-persistent odbc.allow_persistent = On ; Check that a connection is still valid before reuse. ; http://php.net/odbc.check-persistent odbc.check_persistent = On ; Maximum number of persistent links. -1 means no limit. ; http://php.net/odbc.max-persistent odbc.max_persistent = -1 ; Maximum number of links (persistent + non-persistent). -1 means no limit. ; http://php.net/odbc.max-links odbc.max_links = -1 ; Handling of LONG fields. Returns number of bytes to variables. 0 means ; passthru. ; http://php.net/odbc.defaultlrl odbc.defaultlrl = 4096 ; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char. ; See the documentation on odbc_binmode and odbc_longreadlen for an explanation ; of odbc.defaultlrl and odbc.defaultbinmode ; http://php.net/odbc.defaultbinmode odbc.defaultbinmode = 1 [Interbase] ; Allow or prevent persistent links. ibase.allow_persistent = 1 ; Maximum number of persistent links. -1 means no limit. ibase.max_persistent = -1 ; Maximum number of links (persistent + non-persistent). -1 means no limit. ibase.max_links = -1 ; Default database name for ibase_connect(). ;ibase.default_db = ; Default username for ibase_connect(). ;ibase.default_user = ; Default password for ibase_connect(). ;ibase.default_password = ; Default charset for ibase_connect(). ;ibase.default_charset = ; Default timestamp format. ibase.timestampformat = "%Y-%m-%d %H:%M:%S" ; Default date format. ibase.dateformat = "%Y-%m-%d" ; Default time format. ibase.timeformat = "%H:%M:%S" [MySQLi] ; Maximum number of persistent links. -1 means no limit. ; http://php.net/mysqli.max-persistent mysqli.max_persistent = -1 ; Allow accessing, from PHP's perspective, local files with LOAD DATA statements ; http://php.net/mysqli.allow_local_infile ;mysqli.allow_local_infile = On ; Allow or prevent persistent links. ; http://php.net/mysqli.allow-persistent mysqli.allow_persistent = On ; Maximum number of links. -1 means no limit. ; http://php.net/mysqli.max-links mysqli.max_links = -1 ; Default port number for mysqli_connect(). If unset, mysqli_connect() will use ; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the ; compile-time value defined MYSQL_PORT (in that order). Win32 will only look ; at MYSQL_PORT. ; http://php.net/mysqli.default-port mysqli.default_port = 3306 ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. ; http://php.net/mysqli.default-socket mysqli.default_socket = ; Default host for mysql_connect() (doesn't apply in safe mode). ; http://php.net/mysqli.default-host mysqli.default_host = ; Default user for mysql_connect() (doesn't apply in safe mode). ; http://php.net/mysqli.default-user mysqli.default_user = ; Default password for mysqli_connect() (doesn't apply in safe mode). ; Note that this is generally a *bad* idea to store passwords in this file. ; *Any* user with PHP access can run 'echo get_cfg_var("mysqli.default_pw") ; and reveal this password! And of course, any users with read access to this ; file will be able to reveal the password as well. ; http://php.net/mysqli.default-pw mysqli.default_pw = ; Allow or prevent reconnect mysqli.reconnect = Off [mysqlnd] ; Enable / Disable collection of general statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. mysqlnd.collect_statistics = 0 ; Enable / Disable collection of memory usage statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. mysqlnd.collect_memory_statistics = 0 ; Records communication from all extensions using mysqlnd to the specified log ; file. ; http://php.net/mysqlnd.debug ;mysqlnd.debug = ; Defines which queries will be logged. ;mysqlnd.log_mask = 0 ; Default size of the mysqlnd memory pool, which is used by result sets. mysqlnd.mempool_default_size = 64000 ; Size of a pre-allocated buffer used when sending commands to MySQL in bytes. mysqlnd.net_cmd_buffer_size = 8192 ; Size of a pre-allocated buffer used for reading data sent by the server in ; bytes. mysqlnd.net_read_buffer_size = 131072 ; Timeout for network requests in seconds. ;mysqlnd.net_read_timeout = 31536000 ; SHA-256 Authentication Plugin related. File with the MySQL server public RSA ; key. ;mysqlnd.sha256_server_public_key = [OCI8] ; Connection: Enables privileged connections using external ; credentials (OCI_SYSOPER, OCI_SYSDBA) ; http://php.net/oci8.privileged-connect ;oci8.privileged_connect = Off ; Connection: The maximum number of persistent OCI8 connections per ; process. Using -1 means no limit. ; http://php.net/oci8.max-persistent ;oci8.max_persistent = -1 ; Connection: The maximum number of seconds a process is allowed to ; maintain an idle persistent connection. Using -1 means idle ; persistent connections will be maintained forever. ; http://php.net/oci8.persistent-timeout ;oci8.persistent_timeout = -1 ; Connection: The number of seconds that must pass before issuing a ; ping during oci_pconnect() to check the connection validity. When ; set to 0, each oci_pconnect() will cause a ping. Using -1 disables ; pings completely. ; http://php.net/oci8.ping-interval ;oci8.ping_interval = 60 ; Connection: Set this to a user chosen connection class to be used ; for all pooled server requests with Oracle 11g Database Resident ; Connection Pooling (DRCP). To use DRCP, this value should be set to ; the same string for all web servers running the same application, ; the database pool must be configured, and the connection string must ; specify to use a pooled server. ;oci8.connection_class = ; High Availability: Using On lets PHP receive Fast Application ; Notification (FAN) events generated when a database node fails. The ; database must also be configured to post FAN events. ;oci8.events = Off ; Tuning: This option enables statement caching, and specifies how ; many statements to cache. Using 0 disables statement caching. ; http://php.net/oci8.statement-cache-size ;oci8.statement_cache_size = 20 ; Tuning: Enables statement prefetching and sets the default number of ; rows that will be fetched automatically after statement execution. ; http://php.net/oci8.default-prefetch ;oci8.default_prefetch = 100 ; Compatibility. Using On means oci_close() will not close ; oci_connect() and oci_new_connect() connections. ; http://php.net/oci8.old-oci-close-semantics ;oci8.old_oci_close_semantics = Off [PostgreSQL] ; Allow or prevent persistent links. ; http://php.net/pgsql.allow-persistent pgsql.allow_persistent = On ; Detect broken persistent links always with pg_pconnect(). ; Auto reset feature requires a little overheads. ; http://php.net/pgsql.auto-reset-persistent pgsql.auto_reset_persistent = Off ; Maximum number of persistent links. -1 means no limit. ; http://php.net/pgsql.max-persistent pgsql.max_persistent = -1 ; Maximum number of links (persistent+non persistent). -1 means no limit. ; http://php.net/pgsql.max-links pgsql.max_links = -1 ; Ignore PostgreSQL backends Notice message or not. ; Notice message logging require a little overheads. ; http://php.net/pgsql.ignore-notice pgsql.ignore_notice = 0 ; Log PostgreSQL backends Notice message or not. ; Unless pgsql.ignore_notice=0, module cannot log notice message. ; http://php.net/pgsql.log-notice pgsql.log_notice = 0 [bcmath] ; Number of decimal digits for all bcmath functions. ; http://php.net/bcmath.scale bcmath.scale = 0 [browscap] ; http://php.net/browscap ;browscap = extra/browscap.ini [Session] ; Handler used to store/retrieve data. ; http://php.net/session.save-handler session.save_handler = files ; Argument passed to save_handler. In the case of files, this is the path ; where data files are stored. Note: Windows users have to change this ; variable in order to use PHP's session functions. ; ; The path can be defined as: ; ; session.save_path = "N;/path" ; ; where N is an integer. Instead of storing all the session files in ; /path, what this will do is use subdirectories N-levels deep, and ; store the session data in those directories. This is useful if ; your OS has problems with many files in one directory, and is ; a more efficient layout for servers that handle many sessions. ; ; NOTE 1: PHP will not create this directory structure automatically. ; You can use the script in the ext/session dir for that purpose. ; NOTE 2: See the section on garbage collection below if you choose to ; use subdirectories for session storage ; ; The file storage module creates files using mode 600 by default. ; You can change that by using ; ; session.save_path = "N;MODE;/path" ; ; where MODE is the octal representation of the mode. Note that this ; does not overwrite the process's umask. ; http://php.net/session.save-path session.save_path = "/opt/tmp" ; Whether to use strict session mode. ; Strict session mode does not accept an uninitialized session ID, and ; regenerates the session ID if the browser sends an uninitialized session ID. ; Strict mode protects applications from session fixation via a session adoption ; vulnerability. It is disabled by default for maximum compatibility, but ; enabling it is encouraged. ; https://wiki.php.net/rfc/strict_sessions session.use_strict_mode = 0 ; Whether to use cookies. ; http://php.net/session.use-cookies session.use_cookies = 1 ; http://php.net/session.cookie-secure ;session.cookie_secure = ; This option forces PHP to fetch and use a cookie for storing and maintaining ; the session id. We encourage this operation as it's very helpful in combating ; session hijacking when not specifying and managing your own session id. It is ; not the be-all and end-all of session hijacking defense, but it's a good start. ; http://php.net/session.use-only-cookies session.use_only_cookies = 1 ; Name of the session (used as cookie name). ; http://php.net/session.name session.name = PHPSESSID ; Initialize session on request startup. ; http://php.net/session.auto-start session.auto_start = 0 ; Lifetime in seconds of cookie or, if 0, until browser is restarted. ; http://php.net/session.cookie-lifetime session.cookie_lifetime = 0 ; The path for which the cookie is valid. ; http://php.net/session.cookie-path session.cookie_path = / ; The domain for which the cookie is valid. ; http://php.net/session.cookie-domain session.cookie_domain = ; Whether or not to add the httpOnly flag to the cookie, which makes it ; inaccessible to browser scripting languages such as JavaScript. ; http://php.net/session.cookie-httponly session.cookie_httponly = 1 ; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF) ; Current valid values are "Lax" or "Strict" ; https://tools.ietf.org/html/draft-west-first-party-cookies-07 session.cookie_samesite = ; Handler used to serialize data. php is the standard serializer of PHP. ; http://php.net/session.serialize-handler session.serialize_handler = php ; Defines the probability that the 'garbage collection' process is started ; on every session initialization. The probability is calculated by using ; gc_probability/gc_divisor. Where session.gc_probability is the numerator ; and gc_divisor is the denominator in the equation. Setting this value to 1 ; when the session.gc_divisor value is 100 will give you approximately a 1% chance ; the gc will run on any given request. ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; http://php.net/session.gc-probability session.gc_probability = 1 ; Defines the probability that the 'garbage collection' process is started on every ; session initialization. The probability is calculated by using the following equation: ; gc_probability/gc_divisor. Where session.gc_probability is the numerator and ; session.gc_divisor is the denominator in the equation. Setting this value to 100 ; when the session.gc_probability value is 1 will give you approximately a 1% chance ; the gc will run on any given request. Increasing this value to 1000 will give you ; a 0.1% chance the gc will run on any given request. For high volume production servers, ; this is a more efficient approach. ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; http://php.net/session.gc-divisor session.gc_divisor = 1000 ; After this number of seconds, stored data will be seen as 'garbage' and ; cleaned up by the garbage collection process. ; http://php.net/session.gc-maxlifetime session.gc_maxlifetime = 1440 ; NOTE: If you are using the subdirectory option for storing session files ; (see session.save_path above), then garbage collection does *not* ; happen automatically. You will need to do your own garbage ; collection through a shell script, cron entry, or some other method. ; For example, the following script would is the equivalent of ; setting session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes): ; find /path/to/sessions -cmin +24 -type f | xargs rm ; Check HTTP Referer to invalidate externally stored URLs containing ids. ; HTTP_REFERER has to contain this substring for the session to be ; considered as valid. ; http://php.net/session.referer-check session.referer_check = ; Set to {nocache,private,public,} to determine HTTP caching aspects ; or leave this empty to avoid sending anti-caching headers. ; http://php.net/session.cache-limiter session.cache_limiter = nocache ; Document expires after n minutes. ; http://php.net/session.cache-expire session.cache_expire = 180 ; trans sid support is disabled by default. ; Use of trans sid may risk your users' security. ; Use this option with caution. ; - User may send URL contains active session ID ; to other person via. email/irc/etc. ; - URL that contains active session ID may be stored ; in publicly accessible computer. ; - User may access your site with the same session ID ; always using URL stored in browser's history or bookmarks. ; http://php.net/session.use-trans-sid session.use_trans_sid = 0 ; Set session ID character length. This value could be between 22 to 256. ; Shorter length than default is supported only for compatibility reason. ; Users should use 32 or more chars. ; http://php.net/session.sid-length ; Default Value: 32 ; Development Value: 26 ; Production Value: 26 session.sid_length = 26 ; The URL rewriter will look for URLs in a defined set of HTML tags. ; is special; if you include them here, the rewriter will ; add a hidden field with the info which is otherwise appended ; to URLs. tag's action attribute URL will not be modified ; unless it is specified. ; Note that all valid entries require a "=", even if no value follows. ; Default Value: "a=href,area=href,frame=src,form=" ; Development Value: "a=href,area=href,frame=src,form=" ; Production Value: "a=href,area=href,frame=src,form=" ; http://php.net/url-rewriter.tags session.trans_sid_tags = "a=href,area=href,frame=src,form=" ; URL rewriter does not rewrite absolute URLs by default. ; To enable rewrites for absolute paths, target hosts must be specified ; at RUNTIME. i.e. use ini_set() ; tags is special. PHP will check action attribute's URL regardless ; of session.trans_sid_tags setting. ; If no host is defined, HTTP_HOST will be used for allowed host. ; Example value: php.net,www.php.net,wiki.php.net ; Use "," for multiple hosts. No spaces are allowed. ; Default Value: "" ; Development Value: "" ; Production Value: "" ;session.trans_sid_hosts="" ; Define how many bits are stored in each character when converting ; the binary hash data to something readable. ; Possible values: ; 4 (4 bits: 0-9, a-f) ; 5 (5 bits: 0-9, a-v) ; 6 (6 bits: 0-9, a-z, A-Z, "-", ",") ; Default Value: 4 ; Development Value: 5 ; Production Value: 5 ; http://php.net/session.hash-bits-per-character session.sid_bits_per_character = 5 ; Enable upload progress tracking in $_SESSION ; Default Value: On ; Development Value: On ; Production Value: On ; http://php.net/session.upload-progress.enabled ;session.upload_progress.enabled = On ; Cleanup the progress information as soon as all POST data has been read ; (i.e. upload completed). ; Default Value: On ; Development Value: On ; Production Value: On ; http://php.net/session.upload-progress.cleanup ;session.upload_progress.cleanup = On ; A prefix used for the upload progress key in $_SESSION ; Default Value: "upload_progress_" ; Development Value: "upload_progress_" ; Production Value: "upload_progress_" ; http://php.net/session.upload-progress.prefix ;session.upload_progress.prefix = "upload_progress_" ; The index name (concatenated with the prefix) in $_SESSION ; containing the upload progress information ; Default Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Development Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Production Value: "PHP_SESSION_UPLOAD_PROGRESS" ; http://php.net/session.upload-progress.name ;session.upload_progress.name = "PHP_SESSION_UPLOAD_PROGRESS" ; How frequently the upload progress should be updated. ; Given either in percentages (per-file), or in bytes ; Default Value: "1%" ; Development Value: "1%" ; Production Value: "1%" ; http://php.net/session.upload-progress.freq ;session.upload_progress.freq = "1%" ; The minimum delay between updates, in seconds ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; http://php.net/session.upload-progress.min-freq ;session.upload_progress.min_freq = "1" ; Only write session data when session data is changed. Enabled by default. ; http://php.net/session.lazy-write ;session.lazy_write = On [Assertion] ; Switch whether to compile assertions at all (to have no overhead at run-time) ; -1: Do not compile at all ; 0: Jump over assertion at run-time ; 1: Execute assertions ; Changing from or to a negative value is only possible in php.ini! (For turning assertions on and off at run-time, see assert.active, when zend.assertions = 1) ; Default Value: 1 ; Development Value: 1 ; Production Value: -1 ; http://php.net/zend.assertions zend.assertions = -1 ; Assert(expr); active by default. ; http://php.net/assert.active ;assert.active = On ; Throw an AssertionError on failed assertions ; http://php.net/assert.exception ;assert.exception = On ; Issue a PHP warning for each failed assertion. (Overridden by assert.exception if active) ; http://php.net/assert.warning ;assert.warning = On ; Don't bail out by default. ; http://php.net/assert.bail ;assert.bail = Off ; User-function to be called if an assertion fails. ; http://php.net/assert.callback ;assert.callback = 0 ; Eval the expression with current error_reporting(). Set to true if you want ; error_reporting(0) around the eval(). ; http://php.net/assert.quiet-eval ;assert.quiet_eval = 0 [COM] ; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs ; http://php.net/com.typelib-file ;com.typelib_file = ; allow Distributed-COM calls ; http://php.net/com.allow-dcom ;com.allow_dcom = true ; autoregister constants of a component's typlib on com_load() ; http://php.net/com.autoregister-typelib ;com.autoregister_typelib = true ; register constants casesensitive ; http://php.net/com.autoregister-casesensitive ;com.autoregister_casesensitive = false ; show warnings on duplicate constant registrations ; http://php.net/com.autoregister-verbose ;com.autoregister_verbose = true ; The default character set code-page to use when passing strings to and from COM objects. ; Default: system ANSI code page ;com.code_page= [mbstring] ; language for internal character representation. ; This affects mb_send_mail() and mbstring.detect_order. ; http://php.net/mbstring.language ;mbstring.language = Japanese ; Use of this INI entry is deprecated, use global internal_encoding instead. ; internal/script encoding. ; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*) ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;mbstring.internal_encoding = ; Use of this INI entry is deprecated, use global input_encoding instead. ; http input encoding. ; mbstring.encoding_translation = On is needed to use this setting. ; If empty, default_charset or input_encoding or mbstring.input is used. ; The precedence is: default_charset < input_encoding < mbsting.http_input ; http://php.net/mbstring.http-input ;mbstring.http_input = ; Use of this INI entry is deprecated, use global output_encoding instead. ; http output encoding. ; mb_output_handler must be registered as output buffer to function. ; If empty, default_charset or output_encoding or mbstring.http_output is used. ; The precedence is: default_charset < output_encoding < mbstring.http_output ; To use an output encoding conversion, mbstring's output handler must be set ; otherwise output encoding conversion cannot be performed. ; http://php.net/mbstring.http-output ;mbstring.http_output = ; enable automatic encoding translation according to ; mbstring.internal_encoding setting. Input chars are ; converted to internal encoding by setting this to On. ; Note: Do _not_ use automatic encoding translation for ; portable libs/applications. ; http://php.net/mbstring.encoding-translation ;mbstring.encoding_translation = Off ; automatic encoding detection order. ; "auto" detect order is changed according to mbstring.language ; http://php.net/mbstring.detect-order ;mbstring.detect_order = auto ; substitute_character used when character cannot be converted ; one from another ; http://php.net/mbstring.substitute-character ;mbstring.substitute_character = none ; overload(replace) single byte functions by mbstring functions. ; mail(), ereg(), etc are overloaded by mb_send_mail(), mb_ereg(), ; etc. Possible values are 0,1,2,4 or combination of them. ; For example, 7 for overload everything. ; 0: No overload ; 1: Overload mail() function ; 2: Overload str*() functions ; 4: Overload ereg*() functions ; http://php.net/mbstring.func-overload ;mbstring.func_overload = 0 ; enable strict encoding detection. ; Default: Off ;mbstring.strict_detection = On ; This directive specifies the regex pattern of content types for which mb_output_handler() ; is activated. ; Default: mbstring.http_output_conv_mimetype=^(text/|application/xhtml\+xml) ;mbstring.http_output_conv_mimetype= [gd] ; Tell the jpeg decode to ignore warnings and try to create ; a gd image. The warning will then be displayed as notices ; disabled by default ; http://php.net/gd.jpeg-ignore-warning ;gd.jpeg_ignore_warning = 1 [exif] ; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS. ; With mbstring support this will automatically be converted into the encoding ; given by corresponding encode setting. When empty mbstring.internal_encoding ; is used. For the decode settings you can distinguish between motorola and ; intel byte order. A decode setting cannot be empty. ; http://php.net/exif.encode-unicode ;exif.encode_unicode = ISO-8859-15 ; http://php.net/exif.decode-unicode-motorola ;exif.decode_unicode_motorola = UCS-2BE ; http://php.net/exif.decode-unicode-intel ;exif.decode_unicode_intel = UCS-2LE ; http://php.net/exif.encode-jis ;exif.encode_jis = ; http://php.net/exif.decode-jis-motorola ;exif.decode_jis_motorola = JIS ; http://php.net/exif.decode-jis-intel ;exif.decode_jis_intel = JIS [Tidy] ; The path to a default tidy configuration file to use when using tidy ; http://php.net/tidy.default-config ;tidy.default_config = /usr/local/lib/php/default.tcfg ; Should tidy clean and repair output automatically? ; WARNING: Do not use this option if you are generating non-html content ; such as dynamic images ; http://php.net/tidy.clean-output tidy.clean_output = Off [soap] ; Enables or disables WSDL caching feature. ; http://php.net/soap.wsdl-cache-enabled soap.wsdl_cache_enabled=1 ; Sets the directory name where SOAP extension will put cache files. ; http://php.net/soap.wsdl-cache-dir soap.wsdl_cache_dir="/tmp" ; (time to live) Sets the number of second while cached file will be used ; instead of original one. ; http://php.net/soap.wsdl-cache-ttl soap.wsdl_cache_ttl=86400 ; Sets the size of the cache limit. (Max. number of WSDL files to cache) soap.wsdl_cache_limit = 5 [sysvshm] ; A default size of the shared memory segment ;sysvshm.init_mem = 10000 [ldap] ; Sets the maximum number of open links or -1 for unlimited. ldap.max_links = -1 [dba] ;dba.default_handler= [opcache] ; Determines if Zend OPCache is enabled ;opcache.enable=0 ; Determines if Zend OPCache is enabled for the CLI version of PHP ;opcache.enable_cli=0 ; The OPcache shared memory storage size. ;opcache.memory_consumption=128 ; The amount of memory for interned strings in Mbytes. ;opcache.interned_strings_buffer=8 ; The maximum number of keys (scripts) in the OPcache hash table. ; Only numbers between 200 and 1000000 are allowed. ;opcache.max_accelerated_files=10000 ; The maximum percentage of "wasted" memory until a restart is scheduled. ;opcache.max_wasted_percentage=5 ; When this directive is enabled, the OPcache appends the current working ; directory to the script key, thus eliminating possible collisions between ; files with the same name (basename). Disabling the directive improves ; performance, but may break existing applications. ;opcache.use_cwd=1 ; When disabled, you must reset the OPcache manually or restart the ; webserver for changes to the filesystem to take effect. ;opcache.validate_timestamps=1 ; How often (in seconds) to check file timestamps for changes to the shared ; memory storage allocation. ("1" means validate once per second, but only ; once per request. "0" means always validate) ;opcache.revalidate_freq=2 ; Enables or disables file search in include_path optimization ;opcache.revalidate_path=0 ; If disabled, all PHPDoc comments are dropped from the code to reduce the ; size of the optimized code. ;opcache.save_comments=1 ; Allow file existence override (file_exists, etc.) performance feature. ;opcache.enable_file_override=0 ; A bitmask, where each bit enables or disables the appropriate OPcache ; passes ;opcache.optimization_level=0x7FFFBFFF ;opcache.dups_fix=0 ; The location of the OPcache blacklist file (wildcards allowed). ; Each OPcache blacklist file is a text file that holds the names of files ; that should not be accelerated. The file format is to add each filename ; to a new line. The filename may be a full path or just a file prefix ; (i.e., /var/www/x blacklists all the files and directories in /var/www ; that start with 'x'). Line starting with a ; are ignored (comments). ;opcache.blacklist_filename= ; Allows exclusion of large files from being cached. By default all files ; are cached. ;opcache.max_file_size=0 ; Check the cache checksum each N requests. ; The default value of "0" means that the checks are disabled. ;opcache.consistency_checks=0 ; How long to wait (in seconds) for a scheduled restart to begin if the cache ; is not being accessed. ;opcache.force_restart_timeout=180 ; OPcache error_log file name. Empty string assumes "stderr". ;opcache.error_log= ; All OPcache errors go to the Web server log. ; By default, only fatal errors (level 0) or errors (level 1) are logged. ; You can also enable warnings (level 2), info messages (level 3) or ; debug messages (level 4). ;opcache.log_verbosity_level=1 ; Preferred Shared Memory back-end. Leave empty and let the system decide. ;opcache.preferred_memory_model= ; Protect the shared memory from unexpected writing during script execution. ; Useful for internal debugging only. ;opcache.protect_memory=0 ; Allows calling OPcache API functions only from PHP scripts which path is ; started from specified string. The default "" means no restriction ;opcache.restrict_api= ; Mapping base of shared memory segments (for Windows only). All the PHP ; processes have to map shared memory into the same address space. This ; directive allows to manually fix the "Unable to reattach to base address" ; errors. ;opcache.mmap_base= ; Enables and sets the second level cache directory. ; It should improve performance when SHM memory is full, at server restart or ; SHM reset. The default "" disables file based caching. ;opcache.file_cache= ; Enables or disables opcode caching in shared memory. ;opcache.file_cache_only=0 ; Enables or disables checksum validation when script loaded from file cache. ;opcache.file_cache_consistency_checks=1 ; Implies opcache.file_cache_only=1 for a certain process that failed to ; reattach to the shared memory (for Windows only). Explicitly enabled file ; cache is required. ;opcache.file_cache_fallback=1 ; Enables or disables copying of PHP code (text segment) into HUGE PAGES. ; This should improve performance, but requires appropriate OS configuration. ;opcache.huge_code_pages=0 ; Validate cached file permissions. ;opcache.validate_permission=0 ; Prevent name collisions in chroot'ed environment. ;opcache.validate_root=0 ; If specified, it produces opcode dumps for debugging different stages of ; optimizations. ;opcache.opt_debug_level=0 [curl] ; A default value for the CURLOPT_CAINFO option. This is required to be an ; absolute path. ;curl.cainfo = [openssl] ; The location of a Certificate Authority (CA) file on the local filesystem ; to use when verifying the identity of SSL/TLS peers. Most users should ; not specify a value for this directive as PHP will attempt to use the ; OS-managed cert stores in its absence. If specified, this value may still ; be overridden on a per-stream basis via the "cafile" SSL stream context ; option. ;openssl.cafile= ; If openssl.cafile is not specified or if the CA file is not found, the ; directory pointed to by openssl.capath is searched for a suitable ; certificate. This value must be a correctly hashed certificate directory. ; Most users should not specify a value for this directive as PHP will ; attempt to use the OS-managed cert stores in its absence. If specified, ; this value may still be overridden on a per-stream basis via the "capath" ; SSL stream context option. ;openssl.capath= ; Local Variables: ; tab-width: 4 ; End: [Zend] zend_extension="/usr/local/ioncube/ioncube_loader_lin_7.3.so" ; fix for segfaults auto_globals_jit = Off cgi.fix_pathinfo = 1 mbstring.http_input = "pass" mbstring.http_output = "pass" mbstring.encoding_translation = 0 ; Enable Extensions extension=uploadprogress.so extension=imagick.so extension=jsmin.so extension=redis.so ================================================ FILE: aegir/conf/php/php73-fpm ================================================ #!/bin/bash ### BEGIN INIT INFO # Provides: php73-fpm # Required-Start: $remote_fs $network # Required-Stop: $remote_fs $network # Default-Start: 2 3 4 5 # Default-Stop: 0 1 6 # Short-Description: starts php73-fpm # Description: starts the PHP FastCGI Process Manager daemon ### END INIT INFO prefix=/opt/php73 exec_prefix=${prefix} php_fpm_BIN=/opt/php73/sbin/php-fpm php_fpm_CONF=/opt/php73/etc/php73-fpm.conf php_fpm_PID=/run/php73-fpm.pid php_opts="--fpm-config $php_fpm_CONF --pid $php_fpm_PID -c /opt/php73/etc/php73.ini" wait_for_pid() { try=0 while test $try -lt 5; do case "$1" in 'created') if [ -f "$2" ]; then try='' break fi ;; 'removed') if [ ! -f "$2" ]; then try='' break fi ;; esac echo -n . try=`expr $try + 1` sleep 1 done } case "$1" in start) echo -n "Starting php73-fpm..." $php_fpm_BIN --daemonize $php_opts if [ "$?" != 0 ]; then echo " failed" exit 1 fi wait_for_pid created $php_fpm_PID if [ -n "$try" ]; then echo " failed" exit 1 else echo " done" fi ;; stop) echo -n "Gracefully shutting down php73-fpm..." if [ ! -r $php_fpm_PID ]; then echo "warning, no pid file found - php73-fpm is not running ?" exit 1 fi kill -QUIT `cat $php_fpm_PID` wait_for_pid removed $php_fpm_PID if [ -n "$try" ]; then echo " failed. Use force-quit" exit 1 else echo " done" fi ;; status) if [ ! -r $php_fpm_PID ]; then echo "php73-fpm is stopped" exit 0 fi PID=`cat $php_fpm_PID` if ps -p $PID | grep -q $PID; then echo "php73-fpm (pid $PID) is running..." else echo "php73-fpm dead but pid file exists" fi ;; force-quit) echo -n "Terminating php73-fpm..." if [ ! -r $php_fpm_PID ]; then echo "warning, no pid file found - php73-fpm is not running ?" exit 1 fi kill -TERM `cat $php_fpm_PID` wait_for_pid removed $php_fpm_PID if [ -n "$try" ]; then echo " failed" exit 1 else echo " done" fi ;; restart) $0 stop $0 start ;; reload) echo -n "Reloading service php73-fpm..." if [ ! -r $php_fpm_PID ]; then echo "warning, no pid file found - php73-fpm is not running ?" exit 1 fi kill -USR2 `cat $php_fpm_PID` echo " done" ;; configtest) $php_fpm_BIN -t ;; *) echo "Usage: $0 {start|stop|force-quit|restart|reload|status|configtest}" exit 1 ;; esac ================================================ FILE: aegir/conf/php/php73-fpm.conf ================================================ ;;;;;;;;;;;;;;;;;;;;; ; FPM Configuration ; ;;;;;;;;;;;;;;;;;;;;; ; All relative paths in this configuration file are relative to PHP's install ; prefix (/opt/php73). This prefix can be dynamically changed by using the ; '-p' argument from the command line. ; Include one or more files. If glob(3) exists, it is used to include a bunch of ; files from a glob(3) pattern. This directive can be used everywhere in the ; file. ; Relative path can also be used. They will be prefixed by: ; - the global prefix if it's been set (-p argument) ; - /opt/php73 otherwise ;include=etc/fpm.d/*.conf ;;;;;;;;;;;;;;;;;; ; Global Options ; ;;;;;;;;;;;;;;;;;; [global] ; Pid file ; Note: the default prefix is /opt/php73/var ; Default Value: none pid = /run/php73-fpm.pid ; Error log file ; If it's set to "syslog", log is sent to syslogd instead of being written ; in a local file. ; Note: the default prefix is /opt/php73/var ; Default Value: log/php-fpm.log error_log = /var/log/php/php73-fpm-error.log ; syslog_facility is used to specify what type of program is logging the ; message. This lets syslogd specify that messages from different facilities ; will be handled differently. ; See syslog(3) for possible values (ex daemon equiv LOG_DAEMON) ; Default Value: daemon syslog.facility = daemon ; syslog_ident is prepended to every message. If you have multiple FPM ; instances running on the same server, you can change the default value ; which must suit common needs. ; Default Value: php-fpm syslog.ident = php73-fpm ; Log level ; Possible Values: alert, error, warning, notice, debug ; Default Value: notice log_level = warning ; If this number of child processes exit with SIGSEGV or SIGBUS within the time ; interval set by emergency_restart_interval then FPM will restart. A value ; of '0' means 'Off'. ; Default Value: 0 emergency_restart_threshold = 5 ; Interval of time used by emergency_restart_interval to determine when ; a graceful restart will be initiated. This can be useful to work around ; accidental corruptions in an accelerator's shared memory. ; Available Units: s(econds), m(inutes), h(ours), or d(ays) ; Default Unit: seconds ; Default Value: 0 emergency_restart_interval = 1m ; Time limit for child processes to wait for a reaction on signals from master. ; Available units: s(econds), m(inutes), h(ours), or d(ays) ; Default Unit: seconds ; Default Value: 0 process_control_timeout = 5s ; The maximum number of processes FPM will fork. This has been design to control ; the global number of processes when using dynamic PM within a lot of pools. ; Use it with caution. ; Note: A value of 0 indicates no limit ; Default Value: 0 process.max = 0 ; Specify the nice(2) priority to apply to the master process (only if set) ; The value can vary from -19 (highest priority) to 20 (lower priority) ; Note: - It will only work if the FPM master process is launched as root ; - The pool process will inherit the master process priority ; unless it specified otherwise ; Default Value: no set ; process.priority = -19 ; Send FPM to background. Set to 'no' to keep FPM in foreground for debugging. ; Default Value: yes daemonize = yes ; Set open file descriptor rlimit for the master process. ; Default Value: system defined value ;rlimit_files = 1024 ; Set max core size rlimit for the master process. ; Possible Values: 'unlimited' or an integer greater or equal to 0 ; Default Value: system defined value ;rlimit_core = 0 ; Specify the event mechanism FPM will use. The following is available: ; - select (any POSIX os) ; - poll (any POSIX os) ; - epoll (linux >= 2.5.44) ; - kqueue (FreeBSD >= 4.1, OpenBSD >= 2.9, NetBSD >= 2.0) ; - /dev/poll (Solaris >= 7) ; - port (Solaris >= 10) ; Default Value: not set (auto detection) ;events.mechanism = epoll ;;;;;;;;;;;;;;;;;;;; ; Pool Definitions ; ;;;;;;;;;;;;;;;;;;;; ; Multiple pools of child processes may be started with different listening ; ports and different management options. The name of the pool will be ; used in logs and stats. There is no limitation on the number of pools which ; FPM can handle. Your system will tell you anyway :) include = /opt/php73/etc/pool.d/*.conf ================================================ FILE: aegir/conf/php/php73.ini ================================================ [PHP] ;;;;;;;;;;;;;;;;;;; ; About php.ini ; ;;;;;;;;;;;;;;;;;;; ; PHP's initialization file, generally called php.ini, is responsible for ; configuring many of the aspects of PHP's behavior. ; PHP attempts to find and load this configuration from a number of locations. ; The following is a summary of its search order: ; 1. SAPI module specific location. ; 2. The PHPRC environment variable. (As of PHP 5.2.0) ; 3. A number of predefined registry keys on Windows (As of PHP 5.2.0) ; 4. Current working directory (except CLI) ; 5. The web server's directory (for SAPI modules), or directory of PHP ; (otherwise in Windows) ; 6. The directory from the --with-config-file-path compile time option, or the ; Windows directory (usually C:\windows) ; See the PHP docs for more specific information. ; http://php.net/configuration.file ; The syntax of the file is extremely simple. Whitespace and lines ; beginning with a semicolon are silently ignored (as you probably guessed). ; Section headers (e.g. [Foo]) are also silently ignored, even though ; they might mean something in the future. ; Directives following the section heading [PATH=/www/mysite] only ; apply to PHP files in the /www/mysite directory. Directives ; following the section heading [HOST=www.example.com] only apply to ; PHP files served from www.example.com. Directives set in these ; special sections cannot be overridden by user-defined INI files or ; at runtime. Currently, [PATH=] and [HOST=] sections only work under ; CGI/FastCGI. ; http://php.net/ini.sections ; Directives are specified using the following syntax: ; directive = value ; Directive names are *case sensitive* - foo=bar is different from FOO=bar. ; Directives are variables used to configure PHP or PHP extensions. ; There is no name validation. If PHP can't find an expected ; directive because it is not set or is mistyped, a default value will be used. ; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one ; of the INI constants (On, Off, True, False, Yes, No and None) or an expression ; (e.g. E_ALL & ~E_NOTICE), a quoted string ("bar"), or a reference to a ; previously set variable or directive (e.g. ${foo}) ; Expressions in the INI file are limited to bitwise operators and parentheses: ; | bitwise OR ; ^ bitwise XOR ; & bitwise AND ; ~ bitwise NOT ; ! boolean NOT ; Boolean flags can be turned on using the values 1, On, True or Yes. ; They can be turned off using the values 0, Off, False or No. ; An empty string can be denoted by simply not writing anything after the equal ; sign, or by using the None keyword: ; foo = ; sets foo to an empty string ; foo = None ; sets foo to an empty string ; foo = "None" ; sets foo to the string 'None' ; If you use constants in your value, and these constants belong to a ; dynamically loaded extension (either a PHP extension or a Zend extension), ; you may only use these constants *after* the line that loads the extension. ;;;;;;;;;;;;;;;;;;; ; About this file ; ;;;;;;;;;;;;;;;;;;; ; PHP comes packaged with two INI files. One that is recommended to be used ; in production environments and one that is recommended to be used in ; development environments. ; php.ini-production contains settings which hold security, performance and ; best practices at its core. But please be aware, these settings may break ; compatibility with older or less security conscience applications. We ; recommending using the production ini in production and testing environments. ; php.ini-development is very similar to its production variant, except it is ; much more verbose when it comes to errors. We recommend using the ; development version only in development environments, as errors shown to ; application users can inadvertently leak otherwise secure information. ; This is the php.ini-production INI file. ;;;;;;;;;;;;;;;;;;; ; Quick Reference ; ;;;;;;;;;;;;;;;;;;; ; The following are all the settings which are different in either the production ; or development versions of the INIs with respect to PHP's default behavior. ; Please see the actual settings later in the document for more details as to why ; we recommend these changes in PHP's behavior. display_errors = Off ; Default Value: On ; Development Value: On ; Production Value: Off ; display_startup_errors ; Default Value: Off ; Development Value: On ; Production Value: Off ; error_reporting ; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; html_errors ; Default Value: On ; Development Value: On ; Production value: On ; log_errors ; Default Value: Off ; Development Value: On ; Production Value: On ; max_input_time ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; output_buffering ; Default Value: Off ; Development Value: 4096 ; Production Value: 4096 ; register_argc_argv ; Default Value: On ; Development Value: Off ; Production Value: Off ; request_order ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; session.gc_divisor ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; session.sid_bits_per_character ; Default Value: 4 ; Development Value: 5 ; Production Value: 5 ; short_open_tag ; Default Value: On ; Development Value: Off ; Production Value: Off ; track_errors ; Default Value: Off ; Development Value: On ; Production Value: Off ; variables_order ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS" ;;;;;;;;;;;;;;;;;;;; ; php.ini Options ; ;;;;;;;;;;;;;;;;;;;; ; Name for user-defined php.ini (.htaccess) files. Default is ".user.ini" ;user_ini.filename = ".user.ini" ; To disable this feature set this option to an empty value user_ini.filename = ; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes) ;user_ini.cache_ttl = 300 ;;;;;;;;;;;;;;;;;;;; ; Language Options ; ;;;;;;;;;;;;;;;;;;;; ; Enable the PHP scripting language engine under Apache. ; http://php.net/engine engine = On ; This directive determines whether or not PHP will recognize code between ; tags as PHP source which should be processed as such. It is ; generally recommended that should be used and that this feature ; should be disabled, as enabling it may result in issues when generating XML ; documents, however this remains supported for backward compatibility reasons. ; Note that this directive does not control the would work. ; http://php.net/syntax-highlighting ;highlight.string = #DD0000 ;highlight.comment = #FF9900 ;highlight.keyword = #007700 ;highlight.default = #0000BB ;highlight.html = #000000 ; If enabled, the request will be allowed to complete even if the user aborts ; the request. Consider enabling it if executing long requests, which may end up ; being interrupted by the user or a browser timing out. PHP's default behavior ; is to disable this feature. ; http://php.net/ignore-user-abort ;ignore_user_abort = On ; Determines the size of the realpath cache to be used by PHP. This value should ; be increased on systems where PHP opens many files to reflect the quantity of ; the file operations performed. ; http://php.net/realpath-cache-size realpath_cache_size=64M ; Duration of time, in seconds for which to cache realpath information for a given ; file or directory. For systems with rarely changing files, consider increasing this ; value. ; http://php.net/realpath-cache-ttl realpath_cache_ttl=180 ; Enables or disables the circular reference collector. ; http://php.net/zend.enable-gc zend.enable_gc = On ; If enabled, scripts may be written in encodings that are incompatible with ; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such ; encodings. To use this feature, mbstring extension must be enabled. ; Default: Off ;zend.multibyte = Off ; Allows to set the default encoding for the scripts. This value will be used ; unless "declare(encoding=...)" directive appears at the top of the script. ; Only affects if zend.multibyte is set. ; Default: "" ;zend.script_encoding = ;;;;;;;;;;;;;;;;; ; Miscellaneous ; ;;;;;;;;;;;;;;;;; ; Decides whether PHP may expose the fact that it is installed on the server ; (e.g. by adding its signature to the Web server header). It is no security ; threat in any way, but it makes it possible to determine whether you use PHP ; on your server or not. ; http://php.net/expose-php expose_php = On ;;;;;;;;;;;;;;;;;;; ; Resource Limits ; ;;;;;;;;;;;;;;;;;;; ; Maximum execution time of each script, in seconds ; http://php.net/max-execution-time ; Note: This directive is hardcoded to 0 for the CLI SAPI max_execution_time = 180 ; Maximum amount of time each script may spend parsing request data. It's a good ; idea to limit this time on productions servers in order to eliminate unexpectedly ; long running scripts. ; Note: This directive is hardcoded to -1 for the CLI SAPI ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; http://php.net/max-input-time max_input_time = 180 ; Maximum input variable nesting level ; http://php.net/max-input-nesting-level ;max_input_nesting_level = 64 ; How many GET/POST/COOKIE input variables may be accepted max_input_vars = 9999 ; Maximum amount of memory a script may consume (128MB) ; http://php.net/memory-limit memory_limit = 395M ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; Error handling and logging ; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; This directive informs PHP of which errors, warnings and notices you would like ; it to take action for. The recommended way of setting values for this ; directive is through the use of the error level constants and bitwise ; operators. The error level constants are below here for convenience as well as ; some common settings and their meanings. ; By default, PHP is set to take action on all errors, notices and warnings EXCEPT ; those related to E_NOTICE and E_STRICT, which together cover best practices and ; recommended coding standards in PHP. For performance reasons, this is the ; recommend error reporting setting. Your production server shouldn't be wasting ; resources complaining about best practices and coding standards. That's what ; development servers and development settings are for. ; Note: The php.ini-development file has this setting as E_ALL. This ; means it pretty much reports everything which is exactly what you want during ; development and early testing. ; ; Error Level Constants: ; E_ALL - All errors and warnings (includes E_STRICT as of PHP 5.4.0) ; E_ERROR - fatal run-time errors ; E_RECOVERABLE_ERROR - almost fatal run-time errors ; E_WARNING - run-time warnings (non-fatal errors) ; E_PARSE - compile-time parse errors ; E_NOTICE - run-time notices (these are warnings which often result ; from a bug in your code, but it's possible that it was ; intentional (e.g., using an uninitialized variable and ; relying on the fact it is automatically initialized to an ; empty string) ; E_STRICT - run-time notices, enable to have PHP suggest changes ; to your code which will ensure the best interoperability ; and forward compatibility of your code ; E_CORE_ERROR - fatal errors that occur during PHP's initial startup ; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's ; initial startup ; E_COMPILE_ERROR - fatal compile-time errors ; E_COMPILE_WARNING - compile-time warnings (non-fatal errors) ; E_USER_ERROR - user-generated error message ; E_USER_WARNING - user-generated warning message ; E_USER_NOTICE - user-generated notice message ; E_DEPRECATED - warn about code that will not work in future versions ; of PHP ; E_USER_DEPRECATED - user-generated deprecation warnings ; ; Common Values: ; E_ALL (Show all errors, warnings and notices including coding standards.) ; E_ALL & ~E_NOTICE (Show all errors, except for notices) ; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.) ; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors) ; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; http://php.net/error-reporting error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT ; This directive controls whether or not and where PHP will output errors, ; notices and warnings too. Error output is very useful during development, but ; it could be very dangerous in production environments. Depending on the code ; which is triggering the error, sensitive information could potentially leak ; out of your application such as database usernames and passwords or worse. ; For production environments, we recommend logging errors rather than ; sending them to STDOUT. ; Possible Values: ; Off = Do not display any errors ; stderr = Display errors to STDERR (affects only CGI/CLI binaries!) ; On or stdout = Display errors to STDOUT ; Default Value: On ; Development Value: On ; Production Value: Off ; http://php.net/display-errors display_errors = Off ; The display of errors which occur during PHP's startup sequence are handled ; separately from display_errors. PHP's default behavior is to suppress those ; errors from clients. Turning the display of startup errors on can be useful in ; debugging configuration problems. We strongly recommend you ; set this to 'off' for production servers. ; Default Value: Off ; Development Value: On ; Production Value: Off ; http://php.net/display-startup-errors display_startup_errors = Off ; Besides displaying errors, PHP can also log errors to locations such as a ; server-specific log, STDERR, or a location specified by the error_log ; directive found below. While errors should not be displayed on productions ; servers they should still be monitored and logging is a great way to do that. ; Default Value: Off ; Development Value: On ; Production Value: On ; http://php.net/log-errors log_errors = On ; Set maximum length of log_errors. In error_log information about the source is ; added. The default is 1024 and 0 allows to not apply any maximum length at all. ; http://php.net/log-errors-max-len log_errors_max_len = 1024 ; Do not log repeated messages. Repeated errors must occur in same file on same ; line unless ignore_repeated_source is set true. ; http://php.net/ignore-repeated-errors ignore_repeated_errors = Off ; Ignore source of message when ignoring repeated messages. When this setting ; is On you will not log errors with repeated messages from different files or ; source lines. ; http://php.net/ignore-repeated-source ignore_repeated_source = Off ; If this parameter is set to Off, then memory leaks will not be shown (on ; stdout or in the log). This has only effect in a debug compile, and if ; error reporting includes E_WARNING in the allowed list ; http://php.net/report-memleaks report_memleaks = On ; This setting is on by default. ;report_zend_debug = 0 ; Store the last error/warning message in $php_errormsg (boolean). Setting this value ; to On can assist in debugging and is appropriate for development servers. It should ; however be disabled on production servers. ; This directive is DEPRECATED. ; Default Value: Off ; Development Value: Off ; Production Value: Off ; http://php.net/track-errors ;track_errors = Off ; Turn off normal error reporting and emit XML-RPC error XML ; http://php.net/xmlrpc-errors ;xmlrpc_errors = 0 ; An XML-RPC faultCode ;xmlrpc_error_number = 0 ; When PHP displays or logs an error, it has the capability of formatting the ; error message as HTML for easier reading. This directive controls whether ; the error message is formatted as HTML or not. ; Note: This directive is hardcoded to Off for the CLI SAPI ; Default Value: On ; Development Value: On ; Production value: On ; http://php.net/html-errors html_errors = Off ; If html_errors is set to On *and* docref_root is not empty, then PHP ; produces clickable error messages that direct to a page describing the error ; or function causing the error in detail. ; You can download a copy of the PHP manual from http://php.net/docs ; and change docref_root to the base URL of your local copy including the ; leading '/'. You must also specify the file extension being used including ; the dot. PHP's default behavior is to leave these settings empty, in which ; case no links to documentation are generated. ; Note: Never use this feature for production boxes. ; http://php.net/docref-root ; Examples ;docref_root = "/phpmanual/" ; http://php.net/docref-ext ;docref_ext = .html ; String to output before an error message. PHP's default behavior is to leave ; this setting blank. ; http://php.net/error-prepend-string ; Example: ;error_prepend_string = "" ; String to output after an error message. PHP's default behavior is to leave ; this setting blank. ; http://php.net/error-append-string ; Example: ;error_append_string = "" ; Log errors to specified file. PHP's default behavior is to leave this value ; empty. ; http://php.net/error-log ; Example: ;error_log = php_errors.log ; Log errors to syslog (Event Log on Windows). ;error_log = syslog error_log = /var/log/php/error_log_73 ; The syslog ident is a string which is prepended to every message logged ; to syslog. Only used when error_log is set to syslog. ;syslog.ident = php ; The syslog facility is used to specify what type of program is logging ; the message. Only used when error_log is set to syslog. ;syslog.facility = user ; Set this to disable filtering control characters (the default). ; Some loggers only accept NVT-ASCII, others accept anything that's not ; control characters. If your logger accepts everything, then no filtering ; is needed at all. ; Allowed values are: ; ascii (only base ASCII characters) ; no_ctrl (all characters except control characters) ; all (all characters) ;syslog.filter = ascii ;windows.show_crt_warning ; Default value: 0 ; Development value: 0 ; Production value: 0 ;;;;;;;;;;;;;;;;; ; Data Handling ; ;;;;;;;;;;;;;;;;; ; The separator used in PHP generated URLs to separate arguments. ; PHP's default setting is "&". ; http://php.net/arg-separator.output ; Example: ;arg_separator.output = "&" ; List of separator(s) used by PHP to parse input URLs into variables. ; PHP's default setting is "&". ; NOTE: Every character in this directive is considered as separator! ; http://php.net/arg-separator.input ; Example: ;arg_separator.input = ";&" ; This directive determines which super global arrays are registered when PHP ; starts up. G,P,C,E & S are abbreviations for the following respective super ; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty ; paid for the registration of these arrays and because ENV is not as commonly ; used as the others, ENV is not recommended on productions servers. You ; can still get access to the environment variables through getenv() should you ; need to. ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS"; ; http://php.net/variables-order variables_order = "GPCS" ; This directive determines which super global data (G,P & C) should be ; registered into the super global array REQUEST. If so, it also determines ; the order in which that data is registered. The values for this directive ; are specified in the same manner as the variables_order directive, ; EXCEPT one. Leaving this value empty will cause PHP to use the value set ; in the variables_order directive. It does not mean it will leave the super ; globals array REQUEST empty. ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; http://php.net/request-order request_order = "GP" ; This directive determines whether PHP registers $argv & $argc each time it ; runs. $argv contains an array of all the arguments passed to PHP when a script ; is invoked. $argc contains an integer representing the number of arguments ; that were passed when the script was invoked. These arrays are extremely ; useful when running scripts from the command line. When this directive is ; enabled, registering these variables consumes CPU cycles and memory each time ; a script is executed. For performance reasons, this feature should be disabled ; on production servers. ; Note: This directive is hardcoded to On for the CLI SAPI ; Default Value: On ; Development Value: Off ; Production Value: Off ; http://php.net/register-argc-argv register_argc_argv = Off ; When enabled, the ENV, REQUEST and SERVER variables are created when they're ; first used (Just In Time) instead of when the script starts. If these ; variables are not used within a script, having this directive on will result ; in a performance gain. The PHP directive register_argc_argv must be disabled ; for this directive to have any affect. ; http://php.net/auto-globals-jit auto_globals_jit = On ; Whether PHP will read the POST data. ; This option is enabled by default. ; Most likely, you won't want to disable this option globally. It causes $_POST ; and $_FILES to always be empty; the only way you will be able to read the ; POST data will be through the php://input stream wrapper. This can be useful ; to proxy requests or to process the POST data in a memory efficient fashion. ; http://php.net/enable-post-data-reading ;enable_post_data_reading = Off ; Maximum size of POST data that PHP will accept. ; Its value may be 0 to disable the limit. It is ignored if POST data reading ; is disabled through enable_post_data_reading. ; http://php.net/post-max-size post_max_size = 350M ; Automatically add files before PHP document. ; http://php.net/auto-prepend-file auto_prepend_file = ; Automatically add files after PHP document. ; http://php.net/auto-append-file auto_append_file = ; By default, PHP will output a media type using the Content-Type header. To ; disable this, simply set it to be empty. ; ; PHP's built-in default media type is set to text/html. ; http://php.net/default-mimetype default_mimetype = "text/html" ; PHP's default character set is set to UTF-8. ; http://php.net/default-charset default_charset = "UTF-8" ; PHP internal character encoding is set to empty. ; If empty, default_charset is used. ; http://php.net/internal-encoding ;internal_encoding = ; PHP input character encoding is set to empty. ; If empty, default_charset is used. ; http://php.net/input-encoding ;input_encoding = ; PHP output character encoding is set to empty. ; If empty, default_charset is used. ; See also output_buffer. ; http://php.net/output-encoding ;output_encoding = ;;;;;;;;;;;;;;;;;;;;;;;;; ; Paths and Directories ; ;;;;;;;;;;;;;;;;;;;;;;;;; ; UNIX: "/path1:/path2" ;include_path = ".:/php/includes" ; ; Windows: "\path1;\path2" ;include_path = ".;c:\php\includes" ; ; PHP's default setting for include_path is ".;/path/to/php/pear" ; http://php.net/include-path include_path = ".:/opt/php73/lib/php" ; The root of the PHP pages, used only if nonempty. ; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root ; if you are running php as a CGI under any web server (other than IIS) ; see documentation for security issues. The alternate is to use the ; cgi.force_redirect configuration below ; http://php.net/doc-root doc_root = ; The directory under which PHP opens the script using /~username used only ; if nonempty. ; http://php.net/user-dir user_dir = ; Directory in which the loadable extensions (modules) reside. ; http://php.net/extension-dir ; extension_dir = "./" ; On windows: ; extension_dir = "ext" extension_dir = "/opt/php73/lib/php/extensions/no-debug-non-zts-20180731/" ; Directory where the temporary files should be placed. ; Defaults to the system default (see sys_get_temp_dir) sys_temp_dir = "/tmp" ; Whether or not to enable the dl() function. The dl() function does NOT work ; properly in multithreaded servers, such as IIS or Zeus, and is automatically ; disabled on them. ; http://php.net/enable-dl enable_dl = Off ; cgi.force_redirect is necessary to provide security running PHP as a CGI under ; most web servers. Left undefined, PHP turns this on by default. You can ; turn it off here AT YOUR OWN RISK ; **You CAN safely turn this off for IIS, in fact, you MUST.** ; http://php.net/cgi.force-redirect ;cgi.force_redirect = 1 ; if cgi.nph is enabled it will force cgi to always sent Status: 200 with ; every request. PHP's default behavior is to disable this feature. ;cgi.nph = 1 ; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape ; (iPlanet) web servers, you MAY need to set an environment variable name that PHP ; will look for to know it is OK to continue execution. Setting this variable MAY ; cause security issues, KNOW WHAT YOU ARE DOING FIRST. ; http://php.net/cgi.redirect-status-env ;cgi.redirect_status_env = ; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's ; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok ; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting ; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting ; of zero causes PHP to behave as before. Default is 1. You should fix your scripts ; to use SCRIPT_FILENAME rather than PATH_TRANSLATED. ; http://php.net/cgi.fix-pathinfo ;cgi.fix_pathinfo=1 ; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside ; of the web tree and people will not be able to circumvent .htaccess security. ;cgi.discard_path=1 ; FastCGI under IIS supports the ability to impersonate ; security tokens of the calling client. This allows IIS to define the ; security context that the request runs under. mod_fastcgi under Apache ; does not currently support this feature (03/17/2002) ; Set to 1 if running under IIS. Default is zero. ; http://php.net/fastcgi.impersonate ;fastcgi.impersonate = 1 ; Disable logging through FastCGI connection. PHP's default behavior is to enable ; this feature. ;fastcgi.logging = 0 ; cgi.rfc2616_headers configuration option tells PHP what type of headers to ; use when sending HTTP response code. If set to 0, PHP sends Status: header that ; is supported by Apache. When this option is set to 1, PHP will send ; RFC2616 compliant header. ; Default is zero. ; http://php.net/cgi.rfc2616-headers ;cgi.rfc2616_headers = 0 ; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #! ; (shebang) at the top of the running script. This line might be needed if the ; script support running both as stand-alone script and via PHP CGI<. PHP in CGI ; mode skips this line and ignores its content if this directive is turned on. ; http://php.net/cgi.check-shebang-line ;cgi.check_shebang_line=1 ;;;;;;;;;;;;;;;; ; File Uploads ; ;;;;;;;;;;;;;;;; ; Whether to allow HTTP file uploads. ; http://php.net/file-uploads file_uploads = On ; Temporary directory for HTTP uploaded files (will use system default if not ; specified). ; http://php.net/upload-tmp-dir upload_tmp_dir = /tmp ; Maximum allowed size for uploaded files. ; http://php.net/upload-max-filesize upload_max_filesize = 325M ; Maximum number of files that can be uploaded via a single request max_file_uploads = 50 ;;;;;;;;;;;;;;;;;; ; Fopen wrappers ; ;;;;;;;;;;;;;;;;;; ; Whether to allow the treatment of URLs (like http:// or ftp://) as files. ; http://php.net/allow-url-fopen allow_url_fopen = On ; Whether to allow include/require to open URLs (like http:// or ftp://) as files. ; http://php.net/allow-url-include allow_url_include = Off ; Define the anonymous ftp password (your email address). PHP's default setting ; for this is empty. ; http://php.net/from ;from="john@doe.com" ; Define the User-Agent string. PHP's default setting for this is empty. ; http://php.net/user-agent ;user_agent="PHP" ; Default timeout for socket based streams (seconds) ; http://php.net/default-socket-timeout default_socket_timeout = 180 ; If your scripts have to deal with files from Macintosh systems, ; or you are running on a Mac and need to deal with files from ; unix or win32 systems, setting this flag will cause PHP to ; automatically detect the EOL character in those files so that ; fgets() and file() will work regardless of the source of the file. ; http://php.net/auto-detect-line-endings auto_detect_line_endings = On ;;;;;;;;;;;;;;;;;;;;;; ; Dynamic Extensions ; ;;;;;;;;;;;;;;;;;;;;;; ; If you wish to have an extension loaded automatically, use the following ; syntax: ; ; extension=modulename ; ; For example: ; ; extension=mysqli ; ; When the extension library to load is not located in the default extension ; directory, You may specify an absolute path to the library file: ; ; extension=/path/to/extension/mysqli.so ; ; Note : The syntax used in previous PHP versions ('extension=.so' and ; 'extension='php_.dll') is supported for legacy reasons and may be ; deprecated in a future PHP major version. So, when it is possible, please ; move to the new ('extension=) syntax. ; ; Notes for Windows environments : ; ; - Many DLL files are located in the extensions/ (PHP 4) or ext/ (PHP 5+) ; extension folders as well as the separate PECL DLL download (PHP 5+). ; Be sure to appropriately set the extension_dir directive. ; ;extension=bz2 ;extension=curl ;extension=fileinfo ;extension=gd2 ;extension=gettext ;extension=gmp ;extension=intl ;extension=imap ;extension=interbase ;extension=ldap ;extension=mbstring ;extension=exif ; Must be after mbstring as it depends on it ;extension=mysqli ;extension=oci8_12c ; Use with Oracle Database 12c Instant Client ;extension=odbc ;extension=openssl ;extension=pdo_firebird ;extension=pdo_mysql ;extension=pdo_oci ;extension=pdo_odbc ;extension=pdo_pgsql ;extension=pdo_sqlite ;extension=pgsql ;extension=shmop ; The MIBS data available in the PHP distribution must be installed. ; See http://www.php.net/manual/en/snmp.installation.php ;extension=snmp ;extension=soap ;extension=sockets ;extension=sodium ;extension=sqlite3 ;extension=tidy ;extension=xmlrpc ;extension=xsl ;;;;;;;;;;;;;;;;;;; ; Module Settings ; ;;;;;;;;;;;;;;;;;;; [CLI Server] ; Whether the CLI web server uses ANSI color coding in its terminal output. cli_server.color = On [Date] ; Defines the default timezone used by the date functions ; http://php.net/date.timezone date.timezone = "UTC" ; http://php.net/date.default-latitude ;date.default_latitude = 31.7667 ; http://php.net/date.default-longitude ;date.default_longitude = 35.2333 ; http://php.net/date.sunrise-zenith ;date.sunrise_zenith = 90.583333 ; http://php.net/date.sunset-zenith ;date.sunset_zenith = 90.583333 [filter] ; http://php.net/filter.default ;filter.default = unsafe_raw ; http://php.net/filter.default-flags ;filter.default_flags = [iconv] ; Use of this INI entry is deprecated, use global input_encoding instead. ; If empty, default_charset or input_encoding or iconv.input_encoding is used. ; The precedence is: default_charset < input_encoding < iconv.input_encoding ;iconv.input_encoding = ; Use of this INI entry is deprecated, use global internal_encoding instead. ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;iconv.internal_encoding = ; Use of this INI entry is deprecated, use global output_encoding instead. ; If empty, default_charset or output_encoding or iconv.output_encoding is used. ; The precedence is: default_charset < output_encoding < iconv.output_encoding ; To use an output encoding conversion, iconv's output handler must be set ; otherwise output encoding conversion cannot be performed. ;iconv.output_encoding = [intl] ;intl.default_locale = ; This directive allows you to produce PHP errors when some error ; happens within intl functions. The value is the level of the error produced. ; Default is 0, which does not produce any errors. ;intl.error_level = E_WARNING ;intl.use_exceptions = 0 [sqlite3] ;sqlite3.extension_dir = [Pcre] ;PCRE library backtracking limit. ; http://php.net/pcre.backtrack-limit ;pcre.backtrack_limit=100000 ;PCRE library recursion limit. ;Please note that if you set this value to a high number you may consume all ;the available process stack and eventually crash PHP (due to reaching the ;stack size limit imposed by the Operating System). ; http://php.net/pcre.recursion-limit ;pcre.recursion_limit=100000 ;Enables or disables JIT compilation of patterns. This requires the PCRE ;library to be compiled with JIT support. ;pcre.jit=1 [Pdo] ; Whether to pool ODBC connections. Can be one of "strict", "relaxed" or "off" ; http://php.net/pdo-odbc.connection-pooling ;pdo_odbc.connection_pooling=strict ;pdo_odbc.db2_instance_name [Pdo_mysql] ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. pdo_mysql.default_socket= [Phar] ; http://php.net/phar.readonly ;phar.readonly = On ; http://php.net/phar.require-hash ;phar.require_hash = On ;phar.cache_list = [mail function] ; For Win32 only. ; http://php.net/smtp ;SMTP = localhost ; http://php.net/smtp-port ;smtp_port = 25 ; For Win32 only. ; http://php.net/sendmail-from ;sendmail_from = me@example.com ; For Unix only. You may supply arguments as well (default: "sendmail -t -i"). ; http://php.net/sendmail-path sendmail_path = /usr/sbin/sendmail -t -i ; Force the addition of the specified parameters to be passed as extra parameters ; to the sendmail binary. These parameters will always replace the value of ; the 5th parameter to mail(). ;mail.force_extra_parameters = ; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename mail.add_x_header = Off ; The path to a log file that will log all mail() calls. Log entries include ; the full path of the script, line number, To address and headers. ;mail.log = ; Log mail to syslog (Event Log on Windows). ;mail.log = syslog [ODBC] ; http://php.net/odbc.default-db ;odbc.default_db = Not yet implemented ; http://php.net/odbc.default-user ;odbc.default_user = Not yet implemented ; http://php.net/odbc.default-pw ;odbc.default_pw = Not yet implemented ; Controls the ODBC cursor model. ; Default: SQL_CURSOR_STATIC (default). ;odbc.default_cursortype ; Allow or prevent persistent links. ; http://php.net/odbc.allow-persistent odbc.allow_persistent = On ; Check that a connection is still valid before reuse. ; http://php.net/odbc.check-persistent odbc.check_persistent = On ; Maximum number of persistent links. -1 means no limit. ; http://php.net/odbc.max-persistent odbc.max_persistent = -1 ; Maximum number of links (persistent + non-persistent). -1 means no limit. ; http://php.net/odbc.max-links odbc.max_links = -1 ; Handling of LONG fields. Returns number of bytes to variables. 0 means ; passthru. ; http://php.net/odbc.defaultlrl odbc.defaultlrl = 4096 ; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char. ; See the documentation on odbc_binmode and odbc_longreadlen for an explanation ; of odbc.defaultlrl and odbc.defaultbinmode ; http://php.net/odbc.defaultbinmode odbc.defaultbinmode = 1 [Interbase] ; Allow or prevent persistent links. ibase.allow_persistent = 1 ; Maximum number of persistent links. -1 means no limit. ibase.max_persistent = -1 ; Maximum number of links (persistent + non-persistent). -1 means no limit. ibase.max_links = -1 ; Default database name for ibase_connect(). ;ibase.default_db = ; Default username for ibase_connect(). ;ibase.default_user = ; Default password for ibase_connect(). ;ibase.default_password = ; Default charset for ibase_connect(). ;ibase.default_charset = ; Default timestamp format. ibase.timestampformat = "%Y-%m-%d %H:%M:%S" ; Default date format. ibase.dateformat = "%Y-%m-%d" ; Default time format. ibase.timeformat = "%H:%M:%S" [MySQLi] ; Maximum number of persistent links. -1 means no limit. ; http://php.net/mysqli.max-persistent mysqli.max_persistent = -1 ; Allow accessing, from PHP's perspective, local files with LOAD DATA statements ; http://php.net/mysqli.allow_local_infile ;mysqli.allow_local_infile = On ; Allow or prevent persistent links. ; http://php.net/mysqli.allow-persistent mysqli.allow_persistent = On ; Maximum number of links. -1 means no limit. ; http://php.net/mysqli.max-links mysqli.max_links = -1 ; Default port number for mysqli_connect(). If unset, mysqli_connect() will use ; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the ; compile-time value defined MYSQL_PORT (in that order). Win32 will only look ; at MYSQL_PORT. ; http://php.net/mysqli.default-port mysqli.default_port = 3306 ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. ; http://php.net/mysqli.default-socket mysqli.default_socket = ; Default host for mysql_connect() (doesn't apply in safe mode). ; http://php.net/mysqli.default-host mysqli.default_host = ; Default user for mysql_connect() (doesn't apply in safe mode). ; http://php.net/mysqli.default-user mysqli.default_user = ; Default password for mysqli_connect() (doesn't apply in safe mode). ; Note that this is generally a *bad* idea to store passwords in this file. ; *Any* user with PHP access can run 'echo get_cfg_var("mysqli.default_pw") ; and reveal this password! And of course, any users with read access to this ; file will be able to reveal the password as well. ; http://php.net/mysqli.default-pw mysqli.default_pw = ; Allow or prevent reconnect mysqli.reconnect = Off [mysqlnd] ; Enable / Disable collection of general statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. mysqlnd.collect_statistics = 0 ; Enable / Disable collection of memory usage statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. mysqlnd.collect_memory_statistics = 0 ; Records communication from all extensions using mysqlnd to the specified log ; file. ; http://php.net/mysqlnd.debug ;mysqlnd.debug = ; Defines which queries will be logged. ;mysqlnd.log_mask = 0 ; Default size of the mysqlnd memory pool, which is used by result sets. mysqlnd.mempool_default_size = 64000 ; Size of a pre-allocated buffer used when sending commands to MySQL in bytes. mysqlnd.net_cmd_buffer_size = 8192 ; Size of a pre-allocated buffer used for reading data sent by the server in ; bytes. mysqlnd.net_read_buffer_size = 131072 ; Timeout for network requests in seconds. ;mysqlnd.net_read_timeout = 31536000 ; SHA-256 Authentication Plugin related. File with the MySQL server public RSA ; key. ;mysqlnd.sha256_server_public_key = [OCI8] ; Connection: Enables privileged connections using external ; credentials (OCI_SYSOPER, OCI_SYSDBA) ; http://php.net/oci8.privileged-connect ;oci8.privileged_connect = Off ; Connection: The maximum number of persistent OCI8 connections per ; process. Using -1 means no limit. ; http://php.net/oci8.max-persistent ;oci8.max_persistent = -1 ; Connection: The maximum number of seconds a process is allowed to ; maintain an idle persistent connection. Using -1 means idle ; persistent connections will be maintained forever. ; http://php.net/oci8.persistent-timeout ;oci8.persistent_timeout = -1 ; Connection: The number of seconds that must pass before issuing a ; ping during oci_pconnect() to check the connection validity. When ; set to 0, each oci_pconnect() will cause a ping. Using -1 disables ; pings completely. ; http://php.net/oci8.ping-interval ;oci8.ping_interval = 60 ; Connection: Set this to a user chosen connection class to be used ; for all pooled server requests with Oracle 11g Database Resident ; Connection Pooling (DRCP). To use DRCP, this value should be set to ; the same string for all web servers running the same application, ; the database pool must be configured, and the connection string must ; specify to use a pooled server. ;oci8.connection_class = ; High Availability: Using On lets PHP receive Fast Application ; Notification (FAN) events generated when a database node fails. The ; database must also be configured to post FAN events. ;oci8.events = Off ; Tuning: This option enables statement caching, and specifies how ; many statements to cache. Using 0 disables statement caching. ; http://php.net/oci8.statement-cache-size ;oci8.statement_cache_size = 20 ; Tuning: Enables statement prefetching and sets the default number of ; rows that will be fetched automatically after statement execution. ; http://php.net/oci8.default-prefetch ;oci8.default_prefetch = 100 ; Compatibility. Using On means oci_close() will not close ; oci_connect() and oci_new_connect() connections. ; http://php.net/oci8.old-oci-close-semantics ;oci8.old_oci_close_semantics = Off [PostgreSQL] ; Allow or prevent persistent links. ; http://php.net/pgsql.allow-persistent pgsql.allow_persistent = On ; Detect broken persistent links always with pg_pconnect(). ; Auto reset feature requires a little overheads. ; http://php.net/pgsql.auto-reset-persistent pgsql.auto_reset_persistent = Off ; Maximum number of persistent links. -1 means no limit. ; http://php.net/pgsql.max-persistent pgsql.max_persistent = -1 ; Maximum number of links (persistent+non persistent). -1 means no limit. ; http://php.net/pgsql.max-links pgsql.max_links = -1 ; Ignore PostgreSQL backends Notice message or not. ; Notice message logging require a little overheads. ; http://php.net/pgsql.ignore-notice pgsql.ignore_notice = 0 ; Log PostgreSQL backends Notice message or not. ; Unless pgsql.ignore_notice=0, module cannot log notice message. ; http://php.net/pgsql.log-notice pgsql.log_notice = 0 [bcmath] ; Number of decimal digits for all bcmath functions. ; http://php.net/bcmath.scale bcmath.scale = 0 [browscap] ; http://php.net/browscap ;browscap = extra/browscap.ini [Session] ; Handler used to store/retrieve data. ; http://php.net/session.save-handler session.save_handler = files ; Argument passed to save_handler. In the case of files, this is the path ; where data files are stored. Note: Windows users have to change this ; variable in order to use PHP's session functions. ; ; The path can be defined as: ; ; session.save_path = "N;/path" ; ; where N is an integer. Instead of storing all the session files in ; /path, what this will do is use subdirectories N-levels deep, and ; store the session data in those directories. This is useful if ; your OS has problems with many files in one directory, and is ; a more efficient layout for servers that handle many sessions. ; ; NOTE 1: PHP will not create this directory structure automatically. ; You can use the script in the ext/session dir for that purpose. ; NOTE 2: See the section on garbage collection below if you choose to ; use subdirectories for session storage ; ; The file storage module creates files using mode 600 by default. ; You can change that by using ; ; session.save_path = "N;MODE;/path" ; ; where MODE is the octal representation of the mode. Note that this ; does not overwrite the process's umask. ; http://php.net/session.save-path session.save_path = "/opt/tmp" ; Whether to use strict session mode. ; Strict session mode does not accept an uninitialized session ID, and ; regenerates the session ID if the browser sends an uninitialized session ID. ; Strict mode protects applications from session fixation via a session adoption ; vulnerability. It is disabled by default for maximum compatibility, but ; enabling it is encouraged. ; https://wiki.php.net/rfc/strict_sessions session.use_strict_mode = 0 ; Whether to use cookies. ; http://php.net/session.use-cookies session.use_cookies = 1 ; http://php.net/session.cookie-secure ;session.cookie_secure = ; This option forces PHP to fetch and use a cookie for storing and maintaining ; the session id. We encourage this operation as it's very helpful in combating ; session hijacking when not specifying and managing your own session id. It is ; not the be-all and end-all of session hijacking defense, but it's a good start. ; http://php.net/session.use-only-cookies session.use_only_cookies = 1 ; Name of the session (used as cookie name). ; http://php.net/session.name session.name = PHPSESSID ; Initialize session on request startup. ; http://php.net/session.auto-start session.auto_start = 0 ; Lifetime in seconds of cookie or, if 0, until browser is restarted. ; http://php.net/session.cookie-lifetime session.cookie_lifetime = 0 ; The path for which the cookie is valid. ; http://php.net/session.cookie-path session.cookie_path = / ; The domain for which the cookie is valid. ; http://php.net/session.cookie-domain session.cookie_domain = ; Whether or not to add the httpOnly flag to the cookie, which makes it ; inaccessible to browser scripting languages such as JavaScript. ; http://php.net/session.cookie-httponly session.cookie_httponly = 1 ; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF) ; Current valid values are "Lax" or "Strict" ; https://tools.ietf.org/html/draft-west-first-party-cookies-07 session.cookie_samesite = ; Handler used to serialize data. php is the standard serializer of PHP. ; http://php.net/session.serialize-handler session.serialize_handler = php ; Defines the probability that the 'garbage collection' process is started ; on every session initialization. The probability is calculated by using ; gc_probability/gc_divisor. Where session.gc_probability is the numerator ; and gc_divisor is the denominator in the equation. Setting this value to 1 ; when the session.gc_divisor value is 100 will give you approximately a 1% chance ; the gc will run on any given request. ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; http://php.net/session.gc-probability session.gc_probability = 1 ; Defines the probability that the 'garbage collection' process is started on every ; session initialization. The probability is calculated by using the following equation: ; gc_probability/gc_divisor. Where session.gc_probability is the numerator and ; session.gc_divisor is the denominator in the equation. Setting this value to 100 ; when the session.gc_probability value is 1 will give you approximately a 1% chance ; the gc will run on any given request. Increasing this value to 1000 will give you ; a 0.1% chance the gc will run on any given request. For high volume production servers, ; this is a more efficient approach. ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; http://php.net/session.gc-divisor session.gc_divisor = 1000 ; After this number of seconds, stored data will be seen as 'garbage' and ; cleaned up by the garbage collection process. ; http://php.net/session.gc-maxlifetime session.gc_maxlifetime = 1440 ; NOTE: If you are using the subdirectory option for storing session files ; (see session.save_path above), then garbage collection does *not* ; happen automatically. You will need to do your own garbage ; collection through a shell script, cron entry, or some other method. ; For example, the following script would is the equivalent of ; setting session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes): ; find /path/to/sessions -cmin +24 -type f | xargs rm ; Check HTTP Referer to invalidate externally stored URLs containing ids. ; HTTP_REFERER has to contain this substring for the session to be ; considered as valid. ; http://php.net/session.referer-check session.referer_check = ; Set to {nocache,private,public,} to determine HTTP caching aspects ; or leave this empty to avoid sending anti-caching headers. ; http://php.net/session.cache-limiter session.cache_limiter = nocache ; Document expires after n minutes. ; http://php.net/session.cache-expire session.cache_expire = 180 ; trans sid support is disabled by default. ; Use of trans sid may risk your users' security. ; Use this option with caution. ; - User may send URL contains active session ID ; to other person via. email/irc/etc. ; - URL that contains active session ID may be stored ; in publicly accessible computer. ; - User may access your site with the same session ID ; always using URL stored in browser's history or bookmarks. ; http://php.net/session.use-trans-sid session.use_trans_sid = 0 ; Set session ID character length. This value could be between 22 to 256. ; Shorter length than default is supported only for compatibility reason. ; Users should use 32 or more chars. ; http://php.net/session.sid-length ; Default Value: 32 ; Development Value: 26 ; Production Value: 26 session.sid_length = 26 ; The URL rewriter will look for URLs in a defined set of HTML tags. ; is special; if you include them here, the rewriter will ; add a hidden field with the info which is otherwise appended ; to URLs. tag's action attribute URL will not be modified ; unless it is specified. ; Note that all valid entries require a "=", even if no value follows. ; Default Value: "a=href,area=href,frame=src,form=" ; Development Value: "a=href,area=href,frame=src,form=" ; Production Value: "a=href,area=href,frame=src,form=" ; http://php.net/url-rewriter.tags session.trans_sid_tags = "a=href,area=href,frame=src,form=" ; URL rewriter does not rewrite absolute URLs by default. ; To enable rewrites for absolute paths, target hosts must be specified ; at RUNTIME. i.e. use ini_set() ; tags is special. PHP will check action attribute's URL regardless ; of session.trans_sid_tags setting. ; If no host is defined, HTTP_HOST will be used for allowed host. ; Example value: php.net,www.php.net,wiki.php.net ; Use "," for multiple hosts. No spaces are allowed. ; Default Value: "" ; Development Value: "" ; Production Value: "" ;session.trans_sid_hosts="" ; Define how many bits are stored in each character when converting ; the binary hash data to something readable. ; Possible values: ; 4 (4 bits: 0-9, a-f) ; 5 (5 bits: 0-9, a-v) ; 6 (6 bits: 0-9, a-z, A-Z, "-", ",") ; Default Value: 4 ; Development Value: 5 ; Production Value: 5 ; http://php.net/session.hash-bits-per-character session.sid_bits_per_character = 5 ; Enable upload progress tracking in $_SESSION ; Default Value: On ; Development Value: On ; Production Value: On ; http://php.net/session.upload-progress.enabled ;session.upload_progress.enabled = On ; Cleanup the progress information as soon as all POST data has been read ; (i.e. upload completed). ; Default Value: On ; Development Value: On ; Production Value: On ; http://php.net/session.upload-progress.cleanup ;session.upload_progress.cleanup = On ; A prefix used for the upload progress key in $_SESSION ; Default Value: "upload_progress_" ; Development Value: "upload_progress_" ; Production Value: "upload_progress_" ; http://php.net/session.upload-progress.prefix ;session.upload_progress.prefix = "upload_progress_" ; The index name (concatenated with the prefix) in $_SESSION ; containing the upload progress information ; Default Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Development Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Production Value: "PHP_SESSION_UPLOAD_PROGRESS" ; http://php.net/session.upload-progress.name ;session.upload_progress.name = "PHP_SESSION_UPLOAD_PROGRESS" ; How frequently the upload progress should be updated. ; Given either in percentages (per-file), or in bytes ; Default Value: "1%" ; Development Value: "1%" ; Production Value: "1%" ; http://php.net/session.upload-progress.freq ;session.upload_progress.freq = "1%" ; The minimum delay between updates, in seconds ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; http://php.net/session.upload-progress.min-freq ;session.upload_progress.min_freq = "1" ; Only write session data when session data is changed. Enabled by default. ; http://php.net/session.lazy-write ;session.lazy_write = On [Assertion] ; Switch whether to compile assertions at all (to have no overhead at run-time) ; -1: Do not compile at all ; 0: Jump over assertion at run-time ; 1: Execute assertions ; Changing from or to a negative value is only possible in php.ini! (For turning assertions on and off at run-time, see assert.active, when zend.assertions = 1) ; Default Value: 1 ; Development Value: 1 ; Production Value: -1 ; http://php.net/zend.assertions zend.assertions = -1 ; Assert(expr); active by default. ; http://php.net/assert.active ;assert.active = On ; Throw an AssertionError on failed assertions ; http://php.net/assert.exception ;assert.exception = On ; Issue a PHP warning for each failed assertion. (Overridden by assert.exception if active) ; http://php.net/assert.warning ;assert.warning = On ; Don't bail out by default. ; http://php.net/assert.bail ;assert.bail = Off ; User-function to be called if an assertion fails. ; http://php.net/assert.callback ;assert.callback = 0 ; Eval the expression with current error_reporting(). Set to true if you want ; error_reporting(0) around the eval(). ; http://php.net/assert.quiet-eval ;assert.quiet_eval = 0 [COM] ; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs ; http://php.net/com.typelib-file ;com.typelib_file = ; allow Distributed-COM calls ; http://php.net/com.allow-dcom ;com.allow_dcom = true ; autoregister constants of a component's typlib on com_load() ; http://php.net/com.autoregister-typelib ;com.autoregister_typelib = true ; register constants casesensitive ; http://php.net/com.autoregister-casesensitive ;com.autoregister_casesensitive = false ; show warnings on duplicate constant registrations ; http://php.net/com.autoregister-verbose ;com.autoregister_verbose = true ; The default character set code-page to use when passing strings to and from COM objects. ; Default: system ANSI code page ;com.code_page= [mbstring] ; language for internal character representation. ; This affects mb_send_mail() and mbstring.detect_order. ; http://php.net/mbstring.language ;mbstring.language = Japanese ; Use of this INI entry is deprecated, use global internal_encoding instead. ; internal/script encoding. ; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*) ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;mbstring.internal_encoding = ; Use of this INI entry is deprecated, use global input_encoding instead. ; http input encoding. ; mbstring.encoding_translation = On is needed to use this setting. ; If empty, default_charset or input_encoding or mbstring.input is used. ; The precedence is: default_charset < input_encoding < mbsting.http_input ; http://php.net/mbstring.http-input ;mbstring.http_input = ; Use of this INI entry is deprecated, use global output_encoding instead. ; http output encoding. ; mb_output_handler must be registered as output buffer to function. ; If empty, default_charset or output_encoding or mbstring.http_output is used. ; The precedence is: default_charset < output_encoding < mbstring.http_output ; To use an output encoding conversion, mbstring's output handler must be set ; otherwise output encoding conversion cannot be performed. ; http://php.net/mbstring.http-output ;mbstring.http_output = ; enable automatic encoding translation according to ; mbstring.internal_encoding setting. Input chars are ; converted to internal encoding by setting this to On. ; Note: Do _not_ use automatic encoding translation for ; portable libs/applications. ; http://php.net/mbstring.encoding-translation ;mbstring.encoding_translation = Off ; automatic encoding detection order. ; "auto" detect order is changed according to mbstring.language ; http://php.net/mbstring.detect-order ;mbstring.detect_order = auto ; substitute_character used when character cannot be converted ; one from another ; http://php.net/mbstring.substitute-character ;mbstring.substitute_character = none ; overload(replace) single byte functions by mbstring functions. ; mail(), ereg(), etc are overloaded by mb_send_mail(), mb_ereg(), ; etc. Possible values are 0,1,2,4 or combination of them. ; For example, 7 for overload everything. ; 0: No overload ; 1: Overload mail() function ; 2: Overload str*() functions ; 4: Overload ereg*() functions ; http://php.net/mbstring.func-overload ;mbstring.func_overload = 0 ; enable strict encoding detection. ; Default: Off ;mbstring.strict_detection = On ; This directive specifies the regex pattern of content types for which mb_output_handler() ; is activated. ; Default: mbstring.http_output_conv_mimetype=^(text/|application/xhtml\+xml) ;mbstring.http_output_conv_mimetype= [gd] ; Tell the jpeg decode to ignore warnings and try to create ; a gd image. The warning will then be displayed as notices ; disabled by default ; http://php.net/gd.jpeg-ignore-warning ;gd.jpeg_ignore_warning = 1 [exif] ; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS. ; With mbstring support this will automatically be converted into the encoding ; given by corresponding encode setting. When empty mbstring.internal_encoding ; is used. For the decode settings you can distinguish between motorola and ; intel byte order. A decode setting cannot be empty. ; http://php.net/exif.encode-unicode ;exif.encode_unicode = ISO-8859-15 ; http://php.net/exif.decode-unicode-motorola ;exif.decode_unicode_motorola = UCS-2BE ; http://php.net/exif.decode-unicode-intel ;exif.decode_unicode_intel = UCS-2LE ; http://php.net/exif.encode-jis ;exif.encode_jis = ; http://php.net/exif.decode-jis-motorola ;exif.decode_jis_motorola = JIS ; http://php.net/exif.decode-jis-intel ;exif.decode_jis_intel = JIS [Tidy] ; The path to a default tidy configuration file to use when using tidy ; http://php.net/tidy.default-config ;tidy.default_config = /usr/local/lib/php/default.tcfg ; Should tidy clean and repair output automatically? ; WARNING: Do not use this option if you are generating non-html content ; such as dynamic images ; http://php.net/tidy.clean-output tidy.clean_output = Off [soap] ; Enables or disables WSDL caching feature. ; http://php.net/soap.wsdl-cache-enabled soap.wsdl_cache_enabled=1 ; Sets the directory name where SOAP extension will put cache files. ; http://php.net/soap.wsdl-cache-dir soap.wsdl_cache_dir="/tmp" ; (time to live) Sets the number of second while cached file will be used ; instead of original one. ; http://php.net/soap.wsdl-cache-ttl soap.wsdl_cache_ttl=86400 ; Sets the size of the cache limit. (Max. number of WSDL files to cache) soap.wsdl_cache_limit = 5 [sysvshm] ; A default size of the shared memory segment ;sysvshm.init_mem = 10000 [ldap] ; Sets the maximum number of open links or -1 for unlimited. ldap.max_links = -1 [dba] ;dba.default_handler= [opcache] ; Determines if Zend OPCache is enabled ;opcache.enable=1 ; Determines if Zend OPCache is enabled for the CLI version of PHP ;opcache.enable_cli=0 ; The OPcache shared memory storage size. ;opcache.memory_consumption=128 ; The amount of memory for interned strings in Mbytes. ;opcache.interned_strings_buffer=8 ; The maximum number of keys (scripts) in the OPcache hash table. ; Only numbers between 200 and 1000000 are allowed. ;opcache.max_accelerated_files=10000 ; The maximum percentage of "wasted" memory until a restart is scheduled. ;opcache.max_wasted_percentage=5 ; When this directive is enabled, the OPcache appends the current working ; directory to the script key, thus eliminating possible collisions between ; files with the same name (basename). Disabling the directive improves ; performance, but may break existing applications. ;opcache.use_cwd=1 ; When disabled, you must reset the OPcache manually or restart the ; webserver for changes to the filesystem to take effect. ;opcache.validate_timestamps=1 ; How often (in seconds) to check file timestamps for changes to the shared ; memory storage allocation. ("1" means validate once per second, but only ; once per request. "0" means always validate) ;opcache.revalidate_freq=2 ; Enables or disables file search in include_path optimization ;opcache.revalidate_path=0 ; If disabled, all PHPDoc comments are dropped from the code to reduce the ; size of the optimized code. ;opcache.save_comments=1 ; Allow file existence override (file_exists, etc.) performance feature. ;opcache.enable_file_override=0 ; A bitmask, where each bit enables or disables the appropriate OPcache ; passes ;opcache.optimization_level=0x7FFFBFFF ;opcache.dups_fix=0 ; The location of the OPcache blacklist file (wildcards allowed). ; Each OPcache blacklist file is a text file that holds the names of files ; that should not be accelerated. The file format is to add each filename ; to a new line. The filename may be a full path or just a file prefix ; (i.e., /var/www/x blacklists all the files and directories in /var/www ; that start with 'x'). Line starting with a ; are ignored (comments). ;opcache.blacklist_filename= ; Allows exclusion of large files from being cached. By default all files ; are cached. ;opcache.max_file_size=0 ; Check the cache checksum each N requests. ; The default value of "0" means that the checks are disabled. ;opcache.consistency_checks=0 ; How long to wait (in seconds) for a scheduled restart to begin if the cache ; is not being accessed. ;opcache.force_restart_timeout=180 ; OPcache error_log file name. Empty string assumes "stderr". ;opcache.error_log= ; All OPcache errors go to the Web server log. ; By default, only fatal errors (level 0) or errors (level 1) are logged. ; You can also enable warnings (level 2), info messages (level 3) or ; debug messages (level 4). ;opcache.log_verbosity_level=1 ; Preferred Shared Memory back-end. Leave empty and let the system decide. ;opcache.preferred_memory_model= ; Protect the shared memory from unexpected writing during script execution. ; Useful for internal debugging only. ;opcache.protect_memory=0 ; Allows calling OPcache API functions only from PHP scripts which path is ; started from specified string. The default "" means no restriction ;opcache.restrict_api= ; Mapping base of shared memory segments (for Windows only). All the PHP ; processes have to map shared memory into the same address space. This ; directive allows to manually fix the "Unable to reattach to base address" ; errors. ;opcache.mmap_base= ; Enables and sets the second level cache directory. ; It should improve performance when SHM memory is full, at server restart or ; SHM reset. The default "" disables file based caching. ;opcache.file_cache= ; Enables or disables opcode caching in shared memory. ;opcache.file_cache_only=0 ; Enables or disables checksum validation when script loaded from file cache. ;opcache.file_cache_consistency_checks=1 ; Implies opcache.file_cache_only=1 for a certain process that failed to ; reattach to the shared memory (for Windows only). Explicitly enabled file ; cache is required. ;opcache.file_cache_fallback=1 ; Enables or disables copying of PHP code (text segment) into HUGE PAGES. ; This should improve performance, but requires appropriate OS configuration. ;opcache.huge_code_pages=0 ; Validate cached file permissions. ;opcache.validate_permission=0 ; Prevent name collisions in chroot'ed environment. ;opcache.validate_root=0 ; If specified, it produces opcode dumps for debugging different stages of ; optimizations. ;opcache.opt_debug_level=0 [curl] ; A default value for the CURLOPT_CAINFO option. This is required to be an ; absolute path. ;curl.cainfo = [openssl] ; The location of a Certificate Authority (CA) file on the local filesystem ; to use when verifying the identity of SSL/TLS peers. Most users should ; not specify a value for this directive as PHP will attempt to use the ; OS-managed cert stores in its absence. If specified, this value may still ; be overridden on a per-stream basis via the "cafile" SSL stream context ; option. ;openssl.cafile= ; If openssl.cafile is not specified or if the CA file is not found, the ; directory pointed to by openssl.capath is searched for a suitable ; certificate. This value must be a correctly hashed certificate directory. ; Most users should not specify a value for this directive as PHP will ; attempt to use the OS-managed cert stores in its absence. If specified, ; this value may still be overridden on a per-stream basis via the "capath" ; SSL stream context option. ;openssl.capath= ; Local Variables: ; tab-width: 4 ; End: [Zend] zend_extension="/usr/local/ioncube/ioncube_loader_lin_7.3.so" ; fix for segfaults auto_globals_jit = Off cgi.fix_pathinfo = 1 mbstring.http_input = "pass" mbstring.http_output = "pass" mbstring.encoding_translation = 0 ; Enable Extensions extension=uploadprogress.so extension=imagick.so extension=jsmin.so extension=redis.so ; APCu extension=apcu.so apc.enable_cli=1 apc.gc_ttl=300 apc.shm_segments=1 apc.shm_size=256M apc.slam_defense=0 apc.ttl=0 ; ================================================ FILE: aegir/conf/php/php74-cli.ini ================================================ [PHP] ;;;;;;;;;;;;;;;;;;; ; About php.ini ; ;;;;;;;;;;;;;;;;;;; ; PHP's initialization file, generally called php.ini, is responsible for ; configuring many of the aspects of PHP's behavior. ; PHP attempts to find and load this configuration from a number of locations. ; The following is a summary of its search order: ; 1. SAPI module specific location. ; 2. The PHPRC environment variable. (As of PHP 5.2.0) ; 3. A number of predefined registry keys on Windows (As of PHP 5.2.0) ; 4. Current working directory (except CLI) ; 5. The web server's directory (for SAPI modules), or directory of PHP ; (otherwise in Windows) ; 6. The directory from the --with-config-file-path compile time option, or the ; Windows directory (usually C:\windows) ; See the PHP docs for more specific information. ; http://php.net/configuration.file ; The syntax of the file is extremely simple. Whitespace and lines ; beginning with a semicolon are silently ignored (as you probably guessed). ; Section headers (e.g. [Foo]) are also silently ignored, even though ; they might mean something in the future. ; Directives following the section heading [PATH=/www/mysite] only ; apply to PHP files in the /www/mysite directory. Directives ; following the section heading [HOST=www.example.com] only apply to ; PHP files served from www.example.com. Directives set in these ; special sections cannot be overridden by user-defined INI files or ; at runtime. Currently, [PATH=] and [HOST=] sections only work under ; CGI/FastCGI. ; http://php.net/ini.sections ; Directives are specified using the following syntax: ; directive = value ; Directive names are *case sensitive* - foo=bar is different from FOO=bar. ; Directives are variables used to configure PHP or PHP extensions. ; There is no name validation. If PHP can't find an expected ; directive because it is not set or is mistyped, a default value will be used. ; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one ; of the INI constants (On, Off, True, False, Yes, No and None) or an expression ; (e.g. E_ALL & ~E_NOTICE), a quoted string ("bar"), or a reference to a ; previously set variable or directive (e.g. ${foo}) ; Expressions in the INI file are limited to bitwise operators and parentheses: ; | bitwise OR ; ^ bitwise XOR ; & bitwise AND ; ~ bitwise NOT ; ! boolean NOT ; Boolean flags can be turned on using the values 1, On, True or Yes. ; They can be turned off using the values 0, Off, False or No. ; An empty string can be denoted by simply not writing anything after the equal ; sign, or by using the None keyword: ; foo = ; sets foo to an empty string ; foo = None ; sets foo to an empty string ; foo = "None" ; sets foo to the string 'None' ; If you use constants in your value, and these constants belong to a ; dynamically loaded extension (either a PHP extension or a Zend extension), ; you may only use these constants *after* the line that loads the extension. ;;;;;;;;;;;;;;;;;;; ; About this file ; ;;;;;;;;;;;;;;;;;;; ; PHP comes packaged with two INI files. One that is recommended to be used ; in production environments and one that is recommended to be used in ; development environments. ; php.ini-production contains settings which hold security, performance and ; best practices at its core. But please be aware, these settings may break ; compatibility with older or less security conscience applications. We ; recommending using the production ini in production and testing environments. ; php.ini-development is very similar to its production variant, except it is ; much more verbose when it comes to errors. We recommend using the ; development version only in development environments, as errors shown to ; application users can inadvertently leak otherwise secure information. ; This is the php.ini-production INI file. ;;;;;;;;;;;;;;;;;;; ; Quick Reference ; ;;;;;;;;;;;;;;;;;;; ; The following are all the settings which are different in either the production ; or development versions of the INIs with respect to PHP's default behavior. ; Please see the actual settings later in the document for more details as to why ; we recommend these changes in PHP's behavior. display_errors = Off ; Default Value: On ; Development Value: On ; Production Value: Off ; display_startup_errors ; Default Value: Off ; Development Value: On ; Production Value: Off ; error_reporting ; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; log_errors ; Default Value: Off ; Development Value: On ; Production Value: On ; max_input_time ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; output_buffering ; Default Value: Off ; Development Value: 4096 ; Production Value: 4096 ; register_argc_argv ; Default Value: On ; Development Value: Off ; Production Value: Off ; request_order ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; session.gc_divisor ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; session.sid_bits_per_character ; Default Value: 4 ; Development Value: 5 ; Production Value: 5 ; short_open_tag ; Default Value: On ; Development Value: Off ; Production Value: Off ; variables_order ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS" ;;;;;;;;;;;;;;;;;;;; ; php.ini Options ; ;;;;;;;;;;;;;;;;;;;; ; Name for user-defined php.ini (.htaccess) files. Default is ".user.ini" ;user_ini.filename = ".user.ini" ; To disable this feature set this option to an empty value user_ini.filename = ; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes) ;user_ini.cache_ttl = 300 ;;;;;;;;;;;;;;;;;;;; ; Language Options ; ;;;;;;;;;;;;;;;;;;;; ; Enable the PHP scripting language engine under Apache. ; http://php.net/engine engine = On ; This directive determines whether or not PHP will recognize code between ; tags as PHP source which should be processed as such. It is ; generally recommended that should be used and that this feature ; should be disabled, as enabling it may result in issues when generating XML ; documents, however this remains supported for backward compatibility reasons. ; Note that this directive does not control the would work. ; http://php.net/syntax-highlighting ;highlight.string = #DD0000 ;highlight.comment = #FF9900 ;highlight.keyword = #007700 ;highlight.default = #0000BB ;highlight.html = #000000 ; If enabled, the request will be allowed to complete even if the user aborts ; the request. Consider enabling it if executing long requests, which may end up ; being interrupted by the user or a browser timing out. PHP's default behavior ; is to disable this feature. ; http://php.net/ignore-user-abort ;ignore_user_abort = On ; Determines the size of the realpath cache to be used by PHP. This value should ; be increased on systems where PHP opens many files to reflect the quantity of ; the file operations performed. ; Note: if open_basedir is set, the cache is disabled ; http://php.net/realpath-cache-size realpath_cache_size=64M ; Duration of time, in seconds for which to cache realpath information for a given ; file or directory. For systems with rarely changing files, consider increasing this ; value. ; http://php.net/realpath-cache-ttl realpath_cache_ttl=5 ; Enables or disables the circular reference collector. ; http://php.net/zend.enable-gc zend.enable_gc = On ; If enabled, scripts may be written in encodings that are incompatible with ; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such ; encodings. To use this feature, mbstring extension must be enabled. ; Default: Off ;zend.multibyte = Off ; Allows to set the default encoding for the scripts. This value will be used ; unless "declare(encoding=...)" directive appears at the top of the script. ; Only affects if zend.multibyte is set. ; Default: "" ;zend.script_encoding = ; Allows to include or exclude arguments from stack traces generated for exceptions ; Default: Off ; In production, it is recommended to turn this setting on to prohibit the output ; of sensitive information in stack traces zend.exception_ignore_args = On ;;;;;;;;;;;;;;;;; ; Miscellaneous ; ;;;;;;;;;;;;;;;;; ; Decides whether PHP may expose the fact that it is installed on the server ; (e.g. by adding its signature to the Web server header). It is no security ; threat in any way, but it makes it possible to determine whether you use PHP ; on your server or not. ; http://php.net/expose-php expose_php = On ;;;;;;;;;;;;;;;;;;; ; Resource Limits ; ;;;;;;;;;;;;;;;;;;; ; Maximum execution time of each script, in seconds ; http://php.net/max-execution-time ; Note: This directive is hardcoded to 0 for the CLI SAPI max_execution_time = 3600 ; Maximum amount of time each script may spend parsing request data. It's a good ; idea to limit this time on productions servers in order to eliminate unexpectedly ; long running scripts. ; Note: This directive is hardcoded to -1 for the CLI SAPI ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; http://php.net/max-input-time max_input_time = 3600 ; Maximum input variable nesting level ; http://php.net/max-input-nesting-level ;max_input_nesting_level = 64 ; How many GET/POST/COOKIE input variables may be accepted max_input_vars = 9999 ; Maximum amount of memory a script may consume ; http://php.net/memory-limit memory_limit = 395M ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; Error handling and logging ; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; This directive informs PHP of which errors, warnings and notices you would like ; it to take action for. The recommended way of setting values for this ; directive is through the use of the error level constants and bitwise ; operators. The error level constants are below here for convenience as well as ; some common settings and their meanings. ; By default, PHP is set to take action on all errors, notices and warnings EXCEPT ; those related to E_NOTICE and E_STRICT, which together cover best practices and ; recommended coding standards in PHP. For performance reasons, this is the ; recommend error reporting setting. Your production server shouldn't be wasting ; resources complaining about best practices and coding standards. That's what ; development servers and development settings are for. ; Note: The php.ini-development file has this setting as E_ALL. This ; means it pretty much reports everything which is exactly what you want during ; development and early testing. ; ; Error Level Constants: ; E_ALL - All errors and warnings (includes E_STRICT as of PHP 5.4.0) ; E_ERROR - fatal run-time errors ; E_RECOVERABLE_ERROR - almost fatal run-time errors ; E_WARNING - run-time warnings (non-fatal errors) ; E_PARSE - compile-time parse errors ; E_NOTICE - run-time notices (these are warnings which often result ; from a bug in your code, but it's possible that it was ; intentional (e.g., using an uninitialized variable and ; relying on the fact it is automatically initialized to an ; empty string) ; E_STRICT - run-time notices, enable to have PHP suggest changes ; to your code which will ensure the best interoperability ; and forward compatibility of your code ; E_CORE_ERROR - fatal errors that occur during PHP's initial startup ; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's ; initial startup ; E_COMPILE_ERROR - fatal compile-time errors ; E_COMPILE_WARNING - compile-time warnings (non-fatal errors) ; E_USER_ERROR - user-generated error message ; E_USER_WARNING - user-generated warning message ; E_USER_NOTICE - user-generated notice message ; E_DEPRECATED - warn about code that will not work in future versions ; of PHP ; E_USER_DEPRECATED - user-generated deprecation warnings ; ; Common Values: ; E_ALL (Show all errors, warnings and notices including coding standards.) ; E_ALL & ~E_NOTICE (Show all errors, except for notices) ; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.) ; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors) ; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; http://php.net/error-reporting error_reporting = 1 ; This directive controls whether or not and where PHP will output errors, ; notices and warnings too. Error output is very useful during development, but ; it could be very dangerous in production environments. Depending on the code ; which is triggering the error, sensitive information could potentially leak ; out of your application such as database usernames and passwords or worse. ; For production environments, we recommend logging errors rather than ; sending them to STDOUT. ; Possible Values: ; Off = Do not display any errors ; stderr = Display errors to STDERR (affects only CGI/CLI binaries!) ; On or stdout = Display errors to STDOUT ; Default Value: On ; Development Value: On ; Production Value: Off ; http://php.net/display-errors display_errors = Off ; The display of errors which occur during PHP's startup sequence are handled ; separately from display_errors. PHP's default behavior is to suppress those ; errors from clients. Turning the display of startup errors on can be useful in ; debugging configuration problems. We strongly recommend you ; set this to 'off' for production servers. ; Default Value: Off ; Development Value: On ; Production Value: Off ; http://php.net/display-startup-errors display_startup_errors = Off ; Besides displaying errors, PHP can also log errors to locations such as a ; server-specific log, STDERR, or a location specified by the error_log ; directive found below. While errors should not be displayed on productions ; servers they should still be monitored and logging is a great way to do that. ; Default Value: Off ; Development Value: On ; Production Value: On ; http://php.net/log-errors log_errors = On ; Set maximum length of log_errors. In error_log information about the source is ; added. The default is 1024 and 0 allows to not apply any maximum length at all. ; http://php.net/log-errors-max-len log_errors_max_len = 1024 ; Do not log repeated messages. Repeated errors must occur in same file on same ; line unless ignore_repeated_source is set true. ; http://php.net/ignore-repeated-errors ignore_repeated_errors = Off ; Ignore source of message when ignoring repeated messages. When this setting ; is On you will not log errors with repeated messages from different files or ; source lines. ; http://php.net/ignore-repeated-source ignore_repeated_source = Off ; If this parameter is set to Off, then memory leaks will not be shown (on ; stdout or in the log). This is only effective in a debug compile, and if ; error reporting includes E_WARNING in the allowed list ; http://php.net/report-memleaks report_memleaks = On ; This setting is on by default. ;report_zend_debug = 0 ; Store the last error/warning message in $php_errormsg (boolean). Setting this value ; to On can assist in debugging and is appropriate for development servers. It should ; however be disabled on production servers. ; This directive is DEPRECATED. ; Default Value: Off ; Development Value: Off ; Production Value: Off ; http://php.net/track-errors ;track_errors = Off ; Turn off normal error reporting and emit XML-RPC error XML ; http://php.net/xmlrpc-errors ;xmlrpc_errors = 0 ; An XML-RPC faultCode ;xmlrpc_error_number = 0 ; When PHP displays or logs an error, it has the capability of formatting the ; error message as HTML for easier reading. This directive controls whether ; the error message is formatted as HTML or not. ; Note: This directive is hardcoded to Off for the CLI SAPI ; http://php.net/html-errors html_errors = Off ; If html_errors is set to On *and* docref_root is not empty, then PHP ; produces clickable error messages that direct to a page describing the error ; or function causing the error in detail. ; You can download a copy of the PHP manual from http://php.net/docs ; and change docref_root to the base URL of your local copy including the ; leading '/'. You must also specify the file extension being used including ; the dot. PHP's default behavior is to leave these settings empty, in which ; case no links to documentation are generated. ; Note: Never use this feature for production boxes. ; http://php.net/docref-root ; Examples ;docref_root = "/phpmanual/" ; http://php.net/docref-ext ;docref_ext = .html ; String to output before an error message. PHP's default behavior is to leave ; this setting blank. ; http://php.net/error-prepend-string ; Example: ;error_prepend_string = "" ; String to output after an error message. PHP's default behavior is to leave ; this setting blank. ; http://php.net/error-append-string ; Example: ;error_append_string = "" ; Log errors to specified file. PHP's default behavior is to leave this value ; empty. ; http://php.net/error-log ; Example: ;error_log = php_errors.log ; Log errors to syslog (Event Log on Windows). ;error_log = syslog error_log = /var/log/php/error_log_cli_74 ; The syslog ident is a string which is prepended to every message logged ; to syslog. Only used when error_log is set to syslog. ;syslog.ident = php ; The syslog facility is used to specify what type of program is logging ; the message. Only used when error_log is set to syslog. ;syslog.facility = user ; Set this to disable filtering control characters (the default). ; Some loggers only accept NVT-ASCII, others accept anything that's not ; control characters. If your logger accepts everything, then no filtering ; is needed at all. ; Allowed values are: ; ascii (all printable ASCII characters and NL) ; no-ctrl (all characters except control characters) ; all (all characters) ; raw (like "all", but messages are not split at newlines) ; http://php.net/syslog.filter ;syslog.filter = ascii ;windows.show_crt_warning ; Default value: 0 ; Development value: 0 ; Production value: 0 ;;;;;;;;;;;;;;;;; ; Data Handling ; ;;;;;;;;;;;;;;;;; ; The separator used in PHP generated URLs to separate arguments. ; PHP's default setting is "&". ; http://php.net/arg-separator.output ; Example: ;arg_separator.output = "&" ; List of separator(s) used by PHP to parse input URLs into variables. ; PHP's default setting is "&". ; NOTE: Every character in this directive is considered as separator! ; http://php.net/arg-separator.input ; Example: ;arg_separator.input = ";&" ; This directive determines which super global arrays are registered when PHP ; starts up. G,P,C,E & S are abbreviations for the following respective super ; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty ; paid for the registration of these arrays and because ENV is not as commonly ; used as the others, ENV is not recommended on productions servers. You ; can still get access to the environment variables through getenv() should you ; need to. ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS"; ; http://php.net/variables-order variables_order = "GPCS" ; This directive determines which super global data (G,P & C) should be ; registered into the super global array REQUEST. If so, it also determines ; the order in which that data is registered. The values for this directive ; are specified in the same manner as the variables_order directive, ; EXCEPT one. Leaving this value empty will cause PHP to use the value set ; in the variables_order directive. It does not mean it will leave the super ; globals array REQUEST empty. ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; http://php.net/request-order request_order = "GP" ; This directive determines whether PHP registers $argv & $argc each time it ; runs. $argv contains an array of all the arguments passed to PHP when a script ; is invoked. $argc contains an integer representing the number of arguments ; that were passed when the script was invoked. These arrays are extremely ; useful when running scripts from the command line. When this directive is ; enabled, registering these variables consumes CPU cycles and memory each time ; a script is executed. For performance reasons, this feature should be disabled ; on production servers. ; Note: This directive is hardcoded to On for the CLI SAPI ; Default Value: On ; Development Value: Off ; Production Value: Off ; http://php.net/register-argc-argv register_argc_argv = Off ; When enabled, the ENV, REQUEST and SERVER variables are created when they're ; first used (Just In Time) instead of when the script starts. If these ; variables are not used within a script, having this directive on will result ; in a performance gain. The PHP directive register_argc_argv must be disabled ; for this directive to have any effect. ; http://php.net/auto-globals-jit auto_globals_jit = On ; Whether PHP will read the POST data. ; This option is enabled by default. ; Most likely, you won't want to disable this option globally. It causes $_POST ; and $_FILES to always be empty; the only way you will be able to read the ; POST data will be through the php://input stream wrapper. This can be useful ; to proxy requests or to process the POST data in a memory efficient fashion. ; http://php.net/enable-post-data-reading ;enable_post_data_reading = Off ; Maximum size of POST data that PHP will accept. ; Its value may be 0 to disable the limit. It is ignored if POST data reading ; is disabled through enable_post_data_reading. ; http://php.net/post-max-size post_max_size = 350M ; Automatically add files before PHP document. ; http://php.net/auto-prepend-file auto_prepend_file = ; Automatically add files after PHP document. ; http://php.net/auto-append-file auto_append_file = ; By default, PHP will output a media type using the Content-Type header. To ; disable this, simply set it to be empty. ; ; PHP's built-in default media type is set to text/html. ; http://php.net/default-mimetype default_mimetype = "text/html" ; PHP's default character set is set to UTF-8. ; http://php.net/default-charset default_charset = "UTF-8" ; PHP internal character encoding is set to empty. ; If empty, default_charset is used. ; http://php.net/internal-encoding ;internal_encoding = ; PHP input character encoding is set to empty. ; If empty, default_charset is used. ; http://php.net/input-encoding ;input_encoding = ; PHP output character encoding is set to empty. ; If empty, default_charset is used. ; See also output_buffer. ; http://php.net/output-encoding ;output_encoding = ;;;;;;;;;;;;;;;;;;;;;;;;; ; Paths and Directories ; ;;;;;;;;;;;;;;;;;;;;;;;;; ; UNIX: "/path1:/path2" ;include_path = ".:/php/includes" ; ; Windows: "\path1;\path2" ;include_path = ".;c:\php\includes" ; ; PHP's default setting for include_path is ".;/path/to/php/pear" ; http://php.net/include-path include_path = ".:/opt/php74/lib/php" ; The root of the PHP pages, used only if nonempty. ; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root ; if you are running php as a CGI under any web server (other than IIS) ; see documentation for security issues. The alternate is to use the ; cgi.force_redirect configuration below ; http://php.net/doc-root doc_root = ; The directory under which PHP opens the script using /~username used only ; if nonempty. ; http://php.net/user-dir user_dir = ; Directory in which the loadable extensions (modules) reside. ; http://php.net/extension-dir ;extension_dir = "./" ; On windows: ;extension_dir = "ext" extension_dir = "/opt/php74/lib/php/extensions/no-debug-non-zts-20190902/" ; Directory where the temporary files should be placed. ; Defaults to the system default (see sys_get_temp_dir) sys_temp_dir = "/tmp" ; Whether or not to enable the dl() function. The dl() function does NOT work ; properly in multithreaded servers, such as IIS or Zeus, and is automatically ; disabled on them. ; http://php.net/enable-dl enable_dl = Off ; cgi.force_redirect is necessary to provide security running PHP as a CGI under ; most web servers. Left undefined, PHP turns this on by default. You can ; turn it off here AT YOUR OWN RISK ; **You CAN safely turn this off for IIS, in fact, you MUST.** ; http://php.net/cgi.force-redirect ;cgi.force_redirect = 1 ; if cgi.nph is enabled it will force cgi to always sent Status: 200 with ; every request. PHP's default behavior is to disable this feature. ;cgi.nph = 1 ; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape ; (iPlanet) web servers, you MAY need to set an environment variable name that PHP ; will look for to know it is OK to continue execution. Setting this variable MAY ; cause security issues, KNOW WHAT YOU ARE DOING FIRST. ; http://php.net/cgi.redirect-status-env ;cgi.redirect_status_env = ; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's ; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok ; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting ; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting ; of zero causes PHP to behave as before. Default is 1. You should fix your scripts ; to use SCRIPT_FILENAME rather than PATH_TRANSLATED. ; http://php.net/cgi.fix-pathinfo ;cgi.fix_pathinfo=1 ; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside ; of the web tree and people will not be able to circumvent .htaccess security. ;cgi.discard_path=1 ; FastCGI under IIS supports the ability to impersonate ; security tokens of the calling client. This allows IIS to define the ; security context that the request runs under. mod_fastcgi under Apache ; does not currently support this feature (03/17/2002) ; Set to 1 if running under IIS. Default is zero. ; http://php.net/fastcgi.impersonate ;fastcgi.impersonate = 1 ; Disable logging through FastCGI connection. PHP's default behavior is to enable ; this feature. ;fastcgi.logging = 0 ; cgi.rfc2616_headers configuration option tells PHP what type of headers to ; use when sending HTTP response code. If set to 0, PHP sends Status: header that ; is supported by Apache. When this option is set to 1, PHP will send ; RFC2616 compliant header. ; Default is zero. ; http://php.net/cgi.rfc2616-headers ;cgi.rfc2616_headers = 0 ; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #! ; (shebang) at the top of the running script. This line might be needed if the ; script support running both as stand-alone script and via PHP CGI<. PHP in CGI ; mode skips this line and ignores its content if this directive is turned on. ; http://php.net/cgi.check-shebang-line ;cgi.check_shebang_line=1 ;;;;;;;;;;;;;;;; ; File Uploads ; ;;;;;;;;;;;;;;;; ; Whether to allow HTTP file uploads. ; http://php.net/file-uploads file_uploads = On ; Temporary directory for HTTP uploaded files (will use system default if not ; specified). ; http://php.net/upload-tmp-dir upload_tmp_dir = /tmp ; Maximum allowed size for uploaded files. ; http://php.net/upload-max-filesize upload_max_filesize = 325M ; Maximum number of files that can be uploaded via a single request max_file_uploads = 50 ;;;;;;;;;;;;;;;;;; ; Fopen wrappers ; ;;;;;;;;;;;;;;;;;; ; Whether to allow the treatment of URLs (like http:// or ftp://) as files. ; http://php.net/allow-url-fopen allow_url_fopen = On ; Whether to allow include/require to open URLs (like http:// or ftp://) as files. ; http://php.net/allow-url-include allow_url_include = Off ; Define the anonymous ftp password (your email address). PHP's default setting ; for this is empty. ; http://php.net/from ;from="john@doe.com" ; Define the User-Agent string. PHP's default setting for this is empty. ; http://php.net/user-agent ;user_agent="PHP" ; Default timeout for socket based streams (seconds) ; http://php.net/default-socket-timeout default_socket_timeout = 3600 ; If your scripts have to deal with files from Macintosh systems, ; or you are running on a Mac and need to deal with files from ; unix or win32 systems, setting this flag will cause PHP to ; automatically detect the EOL character in those files so that ; fgets() and file() will work regardless of the source of the file. ; http://php.net/auto-detect-line-endings auto_detect_line_endings = On ;;;;;;;;;;;;;;;;;;;;;; ; Dynamic Extensions ; ;;;;;;;;;;;;;;;;;;;;;; ; If you wish to have an extension loaded automatically, use the following ; syntax: ; ; extension=modulename ; ; For example: ; ; extension=mysqli ; ; When the extension library to load is not located in the default extension ; directory, You may specify an absolute path to the library file: ; ; extension=/path/to/extension/mysqli.so ; ; Note : The syntax used in previous PHP versions ('extension=.so' and ; 'extension='php_.dll') is supported for legacy reasons and may be ; deprecated in a future PHP major version. So, when it is possible, please ; move to the new ('extension=) syntax. ; ; Notes for Windows environments : ; ; - Many DLL files are located in the extensions/ (PHP 4) or ext/ (PHP 5+) ; extension folders as well as the separate PECL DLL download (PHP 5+). ; Be sure to appropriately set the extension_dir directive. ; ;extension=bz2 ;extension=curl ;extension=ffi ;extension=ftp ;extension=fileinfo ;extension=gd2 ;extension=gettext ;extension=gmp ;extension=intl ;extension=imap ;extension=ldap ;extension=mbstring ;extension=exif ; Must be after mbstring as it depends on it ;extension=mysqli ;extension=oci8_12c ; Use with Oracle Database 12c Instant Client ;extension=odbc ;extension=openssl ;extension=pdo_firebird ;extension=pdo_mysql ;extension=pdo_oci ;extension=pdo_odbc ;extension=pdo_pgsql ;extension=pdo_sqlite ;extension=pgsql ;extension=shmop ; The MIBS data available in the PHP distribution must be installed. ; See http://www.php.net/manual/en/snmp.installation.php ;extension=snmp ;extension=soap ;extension=sockets ;extension=sodium ;extension=sqlite3 ;extension=tidy ;extension=xmlrpc ;extension=xsl ;;;;;;;;;;;;;;;;;;; ; Module Settings ; ;;;;;;;;;;;;;;;;;;; [CLI Server] ; Whether the CLI web server uses ANSI color coding in its terminal output. cli_server.color = On [Date] ; Defines the default timezone used by the date functions ; http://php.net/date.timezone date.timezone = "UTC" ; http://php.net/date.default-latitude ;date.default_latitude = 31.7667 ; http://php.net/date.default-longitude ;date.default_longitude = 35.2333 ; http://php.net/date.sunrise-zenith ;date.sunrise_zenith = 90.583333 ; http://php.net/date.sunset-zenith ;date.sunset_zenith = 90.583333 [filter] ; http://php.net/filter.default ;filter.default = unsafe_raw ; http://php.net/filter.default-flags ;filter.default_flags = [iconv] ; Use of this INI entry is deprecated, use global input_encoding instead. ; If empty, default_charset or input_encoding or iconv.input_encoding is used. ; The precedence is: default_charset < input_encoding < iconv.input_encoding ;iconv.input_encoding = ; Use of this INI entry is deprecated, use global internal_encoding instead. ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;iconv.internal_encoding = ; Use of this INI entry is deprecated, use global output_encoding instead. ; If empty, default_charset or output_encoding or iconv.output_encoding is used. ; The precedence is: default_charset < output_encoding < iconv.output_encoding ; To use an output encoding conversion, iconv's output handler must be set ; otherwise output encoding conversion cannot be performed. ;iconv.output_encoding = [imap] ; rsh/ssh logins are disabled by default. Use this INI entry if you want to ; enable them. Note that the IMAP library does not filter mailbox names before ; passing them to rsh/ssh command, thus passing untrusted data to this function ; with rsh/ssh enabled is insecure. ;imap.enable_insecure_rsh=0 [intl] ;intl.default_locale = ; This directive allows you to produce PHP errors when some error ; happens within intl functions. The value is the level of the error produced. ; Default is 0, which does not produce any errors. ;intl.error_level = E_WARNING ;intl.use_exceptions = 0 [sqlite3] ; Directory pointing to SQLite3 extensions ; http://php.net/sqlite3.extension-dir ;sqlite3.extension_dir = ; SQLite defensive mode flag (only available from SQLite 3.26+) ; When the defensive flag is enabled, language features that allow ordinary ; SQL to deliberately corrupt the database file are disabled. This forbids ; writing directly to the schema, shadow tables (eg. FTS data tables), or ; the sqlite_dbpage virtual table. ; https://www.sqlite.org/c3ref/c_dbconfig_defensive.html ; (for older SQLite versions, this flag has no use) ;sqlite3.defensive = 1 [Pcre] ; PCRE library backtracking limit. ; http://php.net/pcre.backtrack-limit ;pcre.backtrack_limit=100000 ; PCRE library recursion limit. ; Please note that if you set this value to a high number you may consume all ; the available process stack and eventually crash PHP (due to reaching the ; stack size limit imposed by the Operating System). ; http://php.net/pcre.recursion-limit ;pcre.recursion_limit=100000 ; Enables or disables JIT compilation of patterns. This requires the PCRE ; library to be compiled with JIT support. ;pcre.jit=1 [Pdo] ; Whether to pool ODBC connections. Can be one of "strict", "relaxed" or "off" ; http://php.net/pdo-odbc.connection-pooling ;pdo_odbc.connection_pooling=strict ;pdo_odbc.db2_instance_name [Pdo_mysql] ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. pdo_mysql.default_socket= [Phar] ; http://php.net/phar.readonly ;phar.readonly = On ; http://php.net/phar.require-hash ;phar.require_hash = On ;phar.cache_list = [mail function] ; For Win32 only. ; http://php.net/smtp ;SMTP = localhost ; http://php.net/smtp-port ;smtp_port = 25 ; For Win32 only. ; http://php.net/sendmail-from ;sendmail_from = me@example.com ; For Unix only. You may supply arguments as well (default: "sendmail -t -i"). ; http://php.net/sendmail-path sendmail_path = /usr/sbin/sendmail -t -i ; Force the addition of the specified parameters to be passed as extra parameters ; to the sendmail binary. These parameters will always replace the value of ; the 5th parameter to mail(). ;mail.force_extra_parameters = ; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename mail.add_x_header = Off ; The path to a log file that will log all mail() calls. Log entries include ; the full path of the script, line number, To address and headers. ;mail.log = ; Log mail to syslog (Event Log on Windows). ;mail.log = syslog [ODBC] ; http://php.net/odbc.default-db ;odbc.default_db = Not yet implemented ; http://php.net/odbc.default-user ;odbc.default_user = Not yet implemented ; http://php.net/odbc.default-pw ;odbc.default_pw = Not yet implemented ; Controls the ODBC cursor model. ; Default: SQL_CURSOR_STATIC (default). ;odbc.default_cursortype ; Allow or prevent persistent links. ; http://php.net/odbc.allow-persistent odbc.allow_persistent = On ; Check that a connection is still valid before reuse. ; http://php.net/odbc.check-persistent odbc.check_persistent = On ; Maximum number of persistent links. -1 means no limit. ; http://php.net/odbc.max-persistent odbc.max_persistent = -1 ; Maximum number of links (persistent + non-persistent). -1 means no limit. ; http://php.net/odbc.max-links odbc.max_links = -1 ; Handling of LONG fields. Returns number of bytes to variables. 0 means ; passthru. ; http://php.net/odbc.defaultlrl odbc.defaultlrl = 4096 ; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char. ; See the documentation on odbc_binmode and odbc_longreadlen for an explanation ; of odbc.defaultlrl and odbc.defaultbinmode ; http://php.net/odbc.defaultbinmode odbc.defaultbinmode = 1 [MySQLi] ; Maximum number of persistent links. -1 means no limit. ; http://php.net/mysqli.max-persistent mysqli.max_persistent = -1 ; Allow accessing, from PHP's perspective, local files with LOAD DATA statements ; http://php.net/mysqli.allow_local_infile ;mysqli.allow_local_infile = On ; Allow or prevent persistent links. ; http://php.net/mysqli.allow-persistent mysqli.allow_persistent = On ; Maximum number of links. -1 means no limit. ; http://php.net/mysqli.max-links mysqli.max_links = -1 ; Default port number for mysqli_connect(). If unset, mysqli_connect() will use ; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the ; compile-time value defined MYSQL_PORT (in that order). Win32 will only look ; at MYSQL_PORT. ; http://php.net/mysqli.default-port mysqli.default_port = 3306 ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. ; http://php.net/mysqli.default-socket mysqli.default_socket = ; Default host for mysqli_connect() (doesn't apply in safe mode). ; http://php.net/mysqli.default-host mysqli.default_host = ; Default user for mysqli_connect() (doesn't apply in safe mode). ; http://php.net/mysqli.default-user mysqli.default_user = ; Default password for mysqli_connect() (doesn't apply in safe mode). ; Note that this is generally a *bad* idea to store passwords in this file. ; *Any* user with PHP access can run 'echo get_cfg_var("mysqli.default_pw") ; and reveal this password! And of course, any users with read access to this ; file will be able to reveal the password as well. ; http://php.net/mysqli.default-pw mysqli.default_pw = ; Allow or prevent reconnect mysqli.reconnect = Off [mysqlnd] ; Enable / Disable collection of general statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. mysqlnd.collect_statistics = 0 ; Enable / Disable collection of memory usage statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. mysqlnd.collect_memory_statistics = 0 ; Records communication from all extensions using mysqlnd to the specified log ; file. ; http://php.net/mysqlnd.debug ;mysqlnd.debug = ; Defines which queries will be logged. ;mysqlnd.log_mask = 0 ; Default size of the mysqlnd memory pool, which is used by result sets. mysqlnd.mempool_default_size = 64000 ; Size of a pre-allocated buffer used when sending commands to MySQL in bytes. mysqlnd.net_cmd_buffer_size = 8192 ; Size of a pre-allocated buffer used for reading data sent by the server in ; bytes. mysqlnd.net_read_buffer_size = 131072 ; Timeout for network requests in seconds. ;mysqlnd.net_read_timeout = 31536000 ; SHA-256 Authentication Plugin related. File with the MySQL server public RSA ; key. ;mysqlnd.sha256_server_public_key = [OCI8] ; Connection: Enables privileged connections using external ; credentials (OCI_SYSOPER, OCI_SYSDBA) ; http://php.net/oci8.privileged-connect ;oci8.privileged_connect = Off ; Connection: The maximum number of persistent OCI8 connections per ; process. Using -1 means no limit. ; http://php.net/oci8.max-persistent ;oci8.max_persistent = -1 ; Connection: The maximum number of seconds a process is allowed to ; maintain an idle persistent connection. Using -1 means idle ; persistent connections will be maintained forever. ; http://php.net/oci8.persistent-timeout ;oci8.persistent_timeout = -1 ; Connection: The number of seconds that must pass before issuing a ; ping during oci_pconnect() to check the connection validity. When ; set to 0, each oci_pconnect() will cause a ping. Using -1 disables ; pings completely. ; http://php.net/oci8.ping-interval ;oci8.ping_interval = 60 ; Connection: Set this to a user chosen connection class to be used ; for all pooled server requests with Oracle 11g Database Resident ; Connection Pooling (DRCP). To use DRCP, this value should be set to ; the same string for all web servers running the same application, ; the database pool must be configured, and the connection string must ; specify to use a pooled server. ;oci8.connection_class = ; High Availability: Using On lets PHP receive Fast Application ; Notification (FAN) events generated when a database node fails. The ; database must also be configured to post FAN events. ;oci8.events = Off ; Tuning: This option enables statement caching, and specifies how ; many statements to cache. Using 0 disables statement caching. ; http://php.net/oci8.statement-cache-size ;oci8.statement_cache_size = 20 ; Tuning: Enables statement prefetching and sets the default number of ; rows that will be fetched automatically after statement execution. ; http://php.net/oci8.default-prefetch ;oci8.default_prefetch = 100 ; Compatibility. Using On means oci_close() will not close ; oci_connect() and oci_new_connect() connections. ; http://php.net/oci8.old-oci-close-semantics ;oci8.old_oci_close_semantics = Off [PostgreSQL] ; Allow or prevent persistent links. ; http://php.net/pgsql.allow-persistent pgsql.allow_persistent = On ; Detect broken persistent links always with pg_pconnect(). ; Auto reset feature requires a little overheads. ; http://php.net/pgsql.auto-reset-persistent pgsql.auto_reset_persistent = Off ; Maximum number of persistent links. -1 means no limit. ; http://php.net/pgsql.max-persistent pgsql.max_persistent = -1 ; Maximum number of links (persistent+non persistent). -1 means no limit. ; http://php.net/pgsql.max-links pgsql.max_links = -1 ; Ignore PostgreSQL backends Notice message or not. ; Notice message logging require a little overheads. ; http://php.net/pgsql.ignore-notice pgsql.ignore_notice = 0 ; Log PostgreSQL backends Notice message or not. ; Unless pgsql.ignore_notice=0, module cannot log notice message. ; http://php.net/pgsql.log-notice pgsql.log_notice = 0 [bcmath] ; Number of decimal digits for all bcmath functions. ; http://php.net/bcmath.scale bcmath.scale = 0 [browscap] ; http://php.net/browscap ;browscap = extra/browscap.ini [Session] ; Handler used to store/retrieve data. ; http://php.net/session.save-handler session.save_handler = files ; Argument passed to save_handler. In the case of files, this is the path ; where data files are stored. Note: Windows users have to change this ; variable in order to use PHP's session functions. ; ; The path can be defined as: ; ; session.save_path = "N;/path" ; ; where N is an integer. Instead of storing all the session files in ; /path, what this will do is use subdirectories N-levels deep, and ; store the session data in those directories. This is useful if ; your OS has problems with many files in one directory, and is ; a more efficient layout for servers that handle many sessions. ; ; NOTE 1: PHP will not create this directory structure automatically. ; You can use the script in the ext/session dir for that purpose. ; NOTE 2: See the section on garbage collection below if you choose to ; use subdirectories for session storage ; ; The file storage module creates files using mode 600 by default. ; You can change that by using ; ; session.save_path = "N;MODE;/path" ; ; where MODE is the octal representation of the mode. Note that this ; does not overwrite the process's umask. ; http://php.net/session.save-path session.save_path = "/opt/tmp" ; Whether to use strict session mode. ; Strict session mode does not accept an uninitialized session ID, and ; regenerates the session ID if the browser sends an uninitialized session ID. ; Strict mode protects applications from session fixation via a session adoption ; vulnerability. It is disabled by default for maximum compatibility, but ; enabling it is encouraged. ; https://wiki.php.net/rfc/strict_sessions session.use_strict_mode = 0 ; Whether to use cookies. ; http://php.net/session.use-cookies session.use_cookies = 1 ; http://php.net/session.cookie-secure ;session.cookie_secure = ; This option forces PHP to fetch and use a cookie for storing and maintaining ; the session id. We encourage this operation as it's very helpful in combating ; session hijacking when not specifying and managing your own session id. It is ; not the be-all and end-all of session hijacking defense, but it's a good start. ; http://php.net/session.use-only-cookies session.use_only_cookies = 1 ; Name of the session (used as cookie name). ; http://php.net/session.name session.name = PHPSESSID ; Initialize session on request startup. ; http://php.net/session.auto-start session.auto_start = 0 ; Lifetime in seconds of cookie or, if 0, until browser is restarted. ; http://php.net/session.cookie-lifetime session.cookie_lifetime = 0 ; The path for which the cookie is valid. ; http://php.net/session.cookie-path session.cookie_path = / ; The domain for which the cookie is valid. ; http://php.net/session.cookie-domain session.cookie_domain = ; Whether or not to add the httpOnly flag to the cookie, which makes it ; inaccessible to browser scripting languages such as JavaScript. ; http://php.net/session.cookie-httponly session.cookie_httponly = 1 ; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF) ; Current valid values are "Strict", "Lax" or "None". When using "None", ; make sure to include the quotes, as `none` is interpreted like `false` in ini files. ; https://tools.ietf.org/html/draft-west-first-party-cookies-07 session.cookie_samesite = ; Handler used to serialize data. php is the standard serializer of PHP. ; http://php.net/session.serialize-handler session.serialize_handler = php ; Defines the probability that the 'garbage collection' process is started on every ; session initialization. The probability is calculated by using gc_probability/gc_divisor, ; e.g. 1/100 means there is a 1% chance that the GC process starts on each request. ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; http://php.net/session.gc-probability session.gc_probability = 1 ; Defines the probability that the 'garbage collection' process is started on every ; session initialization. The probability is calculated by using gc_probability/gc_divisor, ; e.g. 1/100 means there is a 1% chance that the GC process starts on each request. ; For high volume production servers, using a value of 1000 is a more efficient approach. ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; http://php.net/session.gc-divisor session.gc_divisor = 1000 ; After this number of seconds, stored data will be seen as 'garbage' and ; cleaned up by the garbage collection process. ; http://php.net/session.gc-maxlifetime session.gc_maxlifetime = 1440 ; NOTE: If you are using the subdirectory option for storing session files ; (see session.save_path above), then garbage collection does *not* ; happen automatically. You will need to do your own garbage ; collection through a shell script, cron entry, or some other method. ; For example, the following script is the equivalent of setting ; session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes): ; find /path/to/sessions -cmin +24 -type f | xargs rm ; Check HTTP Referer to invalidate externally stored URLs containing ids. ; HTTP_REFERER has to contain this substring for the session to be ; considered as valid. ; http://php.net/session.referer-check session.referer_check = ; Set to {nocache,private,public,} to determine HTTP caching aspects ; or leave this empty to avoid sending anti-caching headers. ; http://php.net/session.cache-limiter session.cache_limiter = nocache ; Document expires after n minutes. ; http://php.net/session.cache-expire session.cache_expire = 180 ; trans sid support is disabled by default. ; Use of trans sid may risk your users' security. ; Use this option with caution. ; - User may send URL contains active session ID ; to other person via. email/irc/etc. ; - URL that contains active session ID may be stored ; in publicly accessible computer. ; - User may access your site with the same session ID ; always using URL stored in browser's history or bookmarks. ; http://php.net/session.use-trans-sid session.use_trans_sid = 0 ; Set session ID character length. This value could be between 22 to 256. ; Shorter length than default is supported only for compatibility reason. ; Users should use 32 or more chars. ; http://php.net/session.sid-length ; Default Value: 32 ; Development Value: 26 ; Production Value: 26 session.sid_length = 26 ; The URL rewriter will look for URLs in a defined set of HTML tags. ; is special; if you include them here, the rewriter will ; add a hidden field with the info which is otherwise appended ; to URLs. tag's action attribute URL will not be modified ; unless it is specified. ; Note that all valid entries require a "=", even if no value follows. ; Default Value: "a=href,area=href,frame=src,form=" ; Development Value: "a=href,area=href,frame=src,form=" ; Production Value: "a=href,area=href,frame=src,form=" ; http://php.net/url-rewriter.tags session.trans_sid_tags = "a=href,area=href,frame=src,form=" ; URL rewriter does not rewrite absolute URLs by default. ; To enable rewrites for absolute paths, target hosts must be specified ; at RUNTIME. i.e. use ini_set() ; tags is special. PHP will check action attribute's URL regardless ; of session.trans_sid_tags setting. ; If no host is defined, HTTP_HOST will be used for allowed host. ; Example value: php.net,www.php.net,wiki.php.net ; Use "," for multiple hosts. No spaces are allowed. ; Default Value: "" ; Development Value: "" ; Production Value: "" ;session.trans_sid_hosts="" ; Define how many bits are stored in each character when converting ; the binary hash data to something readable. ; Possible values: ; 4 (4 bits: 0-9, a-f) ; 5 (5 bits: 0-9, a-v) ; 6 (6 bits: 0-9, a-z, A-Z, "-", ",") ; Default Value: 4 ; Development Value: 5 ; Production Value: 5 ; http://php.net/session.hash-bits-per-character session.sid_bits_per_character = 5 ; Enable upload progress tracking in $_SESSION ; Default Value: On ; Development Value: On ; Production Value: On ; http://php.net/session.upload-progress.enabled ;session.upload_progress.enabled = On ; Cleanup the progress information as soon as all POST data has been read ; (i.e. upload completed). ; Default Value: On ; Development Value: On ; Production Value: On ; http://php.net/session.upload-progress.cleanup ;session.upload_progress.cleanup = On ; A prefix used for the upload progress key in $_SESSION ; Default Value: "upload_progress_" ; Development Value: "upload_progress_" ; Production Value: "upload_progress_" ; http://php.net/session.upload-progress.prefix ;session.upload_progress.prefix = "upload_progress_" ; The index name (concatenated with the prefix) in $_SESSION ; containing the upload progress information ; Default Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Development Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Production Value: "PHP_SESSION_UPLOAD_PROGRESS" ; http://php.net/session.upload-progress.name ;session.upload_progress.name = "PHP_SESSION_UPLOAD_PROGRESS" ; How frequently the upload progress should be updated. ; Given either in percentages (per-file), or in bytes ; Default Value: "1%" ; Development Value: "1%" ; Production Value: "1%" ; http://php.net/session.upload-progress.freq ;session.upload_progress.freq = "1%" ; The minimum delay between updates, in seconds ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; http://php.net/session.upload-progress.min-freq ;session.upload_progress.min_freq = "1" ; Only write session data when session data is changed. Enabled by default. ; http://php.net/session.lazy-write ;session.lazy_write = On [Assertion] ; Switch whether to compile assertions at all (to have no overhead at run-time) ; -1: Do not compile at all ; 0: Jump over assertion at run-time ; 1: Execute assertions ; Changing from or to a negative value is only possible in php.ini! (For turning assertions on and off at run-time, see assert.active, when zend.assertions = 1) ; Default Value: 1 ; Development Value: 1 ; Production Value: -1 ; http://php.net/zend.assertions zend.assertions = -1 ; Assert(expr); active by default. ; http://php.net/assert.active ;assert.active = On ; Throw an AssertionError on failed assertions ; http://php.net/assert.exception ;assert.exception = On ; Issue a PHP warning for each failed assertion. (Overridden by assert.exception if active) ; http://php.net/assert.warning ;assert.warning = On ; Don't bail out by default. ; http://php.net/assert.bail ;assert.bail = Off ; User-function to be called if an assertion fails. ; http://php.net/assert.callback ;assert.callback = 0 ; Eval the expression with current error_reporting(). Set to true if you want ; error_reporting(0) around the eval(). ; http://php.net/assert.quiet-eval ;assert.quiet_eval = 0 [COM] ; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs ; http://php.net/com.typelib-file ;com.typelib_file = ; allow Distributed-COM calls ; http://php.net/com.allow-dcom ;com.allow_dcom = true ; autoregister constants of a component's typlib on com_load() ; http://php.net/com.autoregister-typelib ;com.autoregister_typelib = true ; register constants casesensitive ; http://php.net/com.autoregister-casesensitive ;com.autoregister_casesensitive = false ; show warnings on duplicate constant registrations ; http://php.net/com.autoregister-verbose ;com.autoregister_verbose = true ; The default character set code-page to use when passing strings to and from COM objects. ; Default: system ANSI code page ;com.code_page= [mbstring] ; language for internal character representation. ; This affects mb_send_mail() and mbstring.detect_order. ; http://php.net/mbstring.language ;mbstring.language = Japanese ; Use of this INI entry is deprecated, use global internal_encoding instead. ; internal/script encoding. ; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*) ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;mbstring.internal_encoding = ; Use of this INI entry is deprecated, use global input_encoding instead. ; http input encoding. ; mbstring.encoding_translation = On is needed to use this setting. ; If empty, default_charset or input_encoding or mbstring.input is used. ; The precedence is: default_charset < input_encoding < mbsting.http_input ; http://php.net/mbstring.http-input ;mbstring.http_input = ; Use of this INI entry is deprecated, use global output_encoding instead. ; http output encoding. ; mb_output_handler must be registered as output buffer to function. ; If empty, default_charset or output_encoding or mbstring.http_output is used. ; The precedence is: default_charset < output_encoding < mbstring.http_output ; To use an output encoding conversion, mbstring's output handler must be set ; otherwise output encoding conversion cannot be performed. ; http://php.net/mbstring.http-output ;mbstring.http_output = ; enable automatic encoding translation according to ; mbstring.internal_encoding setting. Input chars are ; converted to internal encoding by setting this to On. ; Note: Do _not_ use automatic encoding translation for ; portable libs/applications. ; http://php.net/mbstring.encoding-translation ;mbstring.encoding_translation = Off ; automatic encoding detection order. ; "auto" detect order is changed according to mbstring.language ; http://php.net/mbstring.detect-order ;mbstring.detect_order = auto ; substitute_character used when character cannot be converted ; one from another ; http://php.net/mbstring.substitute-character ;mbstring.substitute_character = none ; overload(replace) single byte functions by mbstring functions. ; mail(), ereg(), etc are overloaded by mb_send_mail(), mb_ereg(), ; etc. Possible values are 0,1,2,4 or combination of them. ; For example, 7 for overload everything. ; 0: No overload ; 1: Overload mail() function ; 2: Overload str*() functions ; 4: Overload ereg*() functions ; http://php.net/mbstring.func-overload ;mbstring.func_overload = 0 ; enable strict encoding detection. ; Default: Off ;mbstring.strict_detection = On ; This directive specifies the regex pattern of content types for which mb_output_handler() ; is activated. ; Default: mbstring.http_output_conv_mimetype=^(text/|application/xhtml\+xml) ;mbstring.http_output_conv_mimetype= ; This directive specifies maximum stack depth for mbstring regular expressions. It is similar ; to the pcre.recursion_limit for PCRE. ; Default: 100000 ;mbstring.regex_stack_limit=100000 ; This directive specifies maximum retry count for mbstring regular expressions. It is similar ; to the pcre.backtrack_limit for PCRE. ; Default: 1000000 ;mbstring.regex_retry_limit=1000000 [gd] ; Tell the jpeg decode to ignore warnings and try to create ; a gd image. The warning will then be displayed as notices ; disabled by default ; http://php.net/gd.jpeg-ignore-warning ;gd.jpeg_ignore_warning = 1 [exif] ; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS. ; With mbstring support this will automatically be converted into the encoding ; given by corresponding encode setting. When empty mbstring.internal_encoding ; is used. For the decode settings you can distinguish between motorola and ; intel byte order. A decode setting cannot be empty. ; http://php.net/exif.encode-unicode ;exif.encode_unicode = ISO-8859-15 ; http://php.net/exif.decode-unicode-motorola ;exif.decode_unicode_motorola = UCS-2BE ; http://php.net/exif.decode-unicode-intel ;exif.decode_unicode_intel = UCS-2LE ; http://php.net/exif.encode-jis ;exif.encode_jis = ; http://php.net/exif.decode-jis-motorola ;exif.decode_jis_motorola = JIS ; http://php.net/exif.decode-jis-intel ;exif.decode_jis_intel = JIS [Tidy] ; The path to a default tidy configuration file to use when using tidy ; http://php.net/tidy.default-config ;tidy.default_config = /usr/local/lib/php/default.tcfg ; Should tidy clean and repair output automatically? ; WARNING: Do not use this option if you are generating non-html content ; such as dynamic images ; http://php.net/tidy.clean-output tidy.clean_output = Off [soap] ; Enables or disables WSDL caching feature. ; http://php.net/soap.wsdl-cache-enabled soap.wsdl_cache_enabled=1 ; Sets the directory name where SOAP extension will put cache files. ; http://php.net/soap.wsdl-cache-dir soap.wsdl_cache_dir="/tmp" ; (time to live) Sets the number of second while cached file will be used ; instead of original one. ; http://php.net/soap.wsdl-cache-ttl soap.wsdl_cache_ttl=86400 ; Sets the size of the cache limit. (Max. number of WSDL files to cache) soap.wsdl_cache_limit = 5 [sysvshm] ; A default size of the shared memory segment ;sysvshm.init_mem = 10000 [ldap] ; Sets the maximum number of open links or -1 for unlimited. ldap.max_links = -1 [dba] ;dba.default_handler= [opcache] ; Determines if Zend OPCache is enabled ;opcache.enable=1 ; Determines if Zend OPCache is enabled for the CLI version of PHP ;opcache.enable_cli=0 ; The OPcache shared memory storage size. ;opcache.memory_consumption=128 ; The amount of memory for interned strings in Mbytes. ;opcache.interned_strings_buffer=8 ; The maximum number of keys (scripts) in the OPcache hash table. ; Only numbers between 200 and 1000000 are allowed. ;opcache.max_accelerated_files=10000 ; The maximum percentage of "wasted" memory until a restart is scheduled. ;opcache.max_wasted_percentage=5 ; When this directive is enabled, the OPcache appends the current working ; directory to the script key, thus eliminating possible collisions between ; files with the same name (basename). Disabling the directive improves ; performance, but may break existing applications. ;opcache.use_cwd=1 ; When disabled, you must reset the OPcache manually or restart the ; webserver for changes to the filesystem to take effect. ;opcache.validate_timestamps=1 ; How often (in seconds) to check file timestamps for changes to the shared ; memory storage allocation. ("1" means validate once per second, but only ; once per request. "0" means always validate) ;opcache.revalidate_freq=2 ; Enables or disables file search in include_path optimization ;opcache.revalidate_path=0 ; If disabled, all PHPDoc comments are dropped from the code to reduce the ; size of the optimized code. ;opcache.save_comments=1 ; Allow file existence override (file_exists, etc.) performance feature. ;opcache.enable_file_override=0 ; A bitmask, where each bit enables or disables the appropriate OPcache ; passes ;opcache.optimization_level=0x7FFFBFFF ;opcache.dups_fix=0 ; The location of the OPcache blacklist file (wildcards allowed). ; Each OPcache blacklist file is a text file that holds the names of files ; that should not be accelerated. The file format is to add each filename ; to a new line. The filename may be a full path or just a file prefix ; (i.e., /var/www/x blacklists all the files and directories in /var/www ; that start with 'x'). Line starting with a ; are ignored (comments). ;opcache.blacklist_filename= ; Allows exclusion of large files from being cached. By default all files ; are cached. ;opcache.max_file_size=0 ; Check the cache checksum each N requests. ; The default value of "0" means that the checks are disabled. ;opcache.consistency_checks=0 ; How long to wait (in seconds) for a scheduled restart to begin if the cache ; is not being accessed. ;opcache.force_restart_timeout=180 ; OPcache error_log file name. Empty string assumes "stderr". ;opcache.error_log= ; All OPcache errors go to the Web server log. ; By default, only fatal errors (level 0) or errors (level 1) are logged. ; You can also enable warnings (level 2), info messages (level 3) or ; debug messages (level 4). ;opcache.log_verbosity_level=1 ; Preferred Shared Memory back-end. Leave empty and let the system decide. ;opcache.preferred_memory_model= ; Protect the shared memory from unexpected writing during script execution. ; Useful for internal debugging only. ;opcache.protect_memory=0 ; Allows calling OPcache API functions only from PHP scripts which path is ; started from specified string. The default "" means no restriction ;opcache.restrict_api= ; Mapping base of shared memory segments (for Windows only). All the PHP ; processes have to map shared memory into the same address space. This ; directive allows to manually fix the "Unable to reattach to base address" ; errors. ;opcache.mmap_base= ; Facilitates multiple OPcache instances per user (for Windows only). All PHP ; processes with the same cache ID and user share an OPcache instance. ;opcache.cache_id= ; Enables and sets the second level cache directory. ; It should improve performance when SHM memory is full, at server restart or ; SHM reset. The default "" disables file based caching. ;opcache.file_cache= ; Enables or disables opcode caching in shared memory. ;opcache.file_cache_only=0 ; Enables or disables checksum validation when script loaded from file cache. ;opcache.file_cache_consistency_checks=1 ; Implies opcache.file_cache_only=1 for a certain process that failed to ; reattach to the shared memory (for Windows only). Explicitly enabled file ; cache is required. ;opcache.file_cache_fallback=1 ; Enables or disables copying of PHP code (text segment) into HUGE PAGES. ; This should improve performance, but requires appropriate OS configuration. ;opcache.huge_code_pages=0 ; Validate cached file permissions. ;opcache.validate_permission=0 ; Prevent name collisions in chroot'ed environment. ;opcache.validate_root=0 ; If specified, it produces opcode dumps for debugging different stages of ; optimizations. ;opcache.opt_debug_level=0 ; Specifies a PHP script that is going to be compiled and executed at server ; start-up. ; http://php.net/opcache.preload ;opcache.preload= ; Preloading code as root is not allowed for security reasons. This directive ; facilitates to let the preloading to be run as another user. ; http://php.net/opcache.preload_user ;opcache.preload_user= ; Prevents caching files that are less than this number of seconds old. It ; protects from caching of incompletely updated files. In case all file updates ; on your site are atomic, you may increase performance by setting it to "0". ;opcache.file_update_protection=2 ; Absolute path used to store shared lockfiles (for *nix only). ;opcache.lockfile_path=/tmp [curl] ; A default value for the CURLOPT_CAINFO option. This is required to be an ; absolute path. ;curl.cainfo = [openssl] ; The location of a Certificate Authority (CA) file on the local filesystem ; to use when verifying the identity of SSL/TLS peers. Most users should ; not specify a value for this directive as PHP will attempt to use the ; OS-managed cert stores in its absence. If specified, this value may still ; be overridden on a per-stream basis via the "cafile" SSL stream context ; option. ;openssl.cafile= ; If openssl.cafile is not specified or if the CA file is not found, the ; directory pointed to by openssl.capath is searched for a suitable ; certificate. This value must be a correctly hashed certificate directory. ; Most users should not specify a value for this directive as PHP will ; attempt to use the OS-managed cert stores in its absence. If specified, ; this value may still be overridden on a per-stream basis via the "capath" ; SSL stream context option. ;openssl.capath= [ffi] ; FFI API restriction. Possible values: ; "preload" - enabled in CLI scripts and preloaded files (default) ; "false" - always disabled ; "true" - always enabled ;ffi.enable=preload ; List of headers files to preload, wildcard patterns allowed. ;ffi.preload= ; Local Variables: ; tab-width: 4 ; End: [Zend] zend_extension="/usr/local/ioncube/ioncube_loader_lin_7.4.so" ; fix for segfaults auto_globals_jit = Off cgi.fix_pathinfo = 1 mbstring.http_input = "pass" mbstring.http_output = "pass" mbstring.encoding_translation = 0 ; Enable Extensions extension=uploadprogress.so extension=imagick.so extension=jsmin.so extension=redis.so ================================================ FILE: aegir/conf/php/php74-fpm ================================================ #!/bin/bash ### BEGIN INIT INFO # Provides: php74-fpm # Required-Start: $remote_fs $network # Required-Stop: $remote_fs $network # Default-Start: 2 3 4 5 # Default-Stop: 0 1 6 # Short-Description: starts php74-fpm # Description: starts the PHP FastCGI Process Manager daemon ### END INIT INFO prefix=/opt/php74 exec_prefix=${prefix} php_fpm_BIN=/opt/php74/sbin/php-fpm php_fpm_CONF=/opt/php74/etc/php74-fpm.conf php_fpm_PID=/run/php74-fpm.pid php_opts="--fpm-config $php_fpm_CONF --pid $php_fpm_PID -c /opt/php74/etc/php74.ini" wait_for_pid() { try=0 while test $try -lt 5; do case "$1" in 'created') if [ -f "$2" ]; then try='' break fi ;; 'removed') if [ ! -f "$2" ]; then try='' break fi ;; esac echo -n . try=`expr $try + 1` sleep 1 done } case "$1" in start) echo -n "Starting php74-fpm..." $php_fpm_BIN --daemonize $php_opts if [ "$?" != 0 ]; then echo " failed" exit 1 fi wait_for_pid created $php_fpm_PID if [ -n "$try" ]; then echo " failed" exit 1 else echo " done" fi ;; stop) echo -n "Gracefully shutting down php74-fpm..." if [ ! -r $php_fpm_PID ]; then echo "warning, no pid file found - php74-fpm is not running ?" exit 1 fi kill -QUIT `cat $php_fpm_PID` wait_for_pid removed $php_fpm_PID if [ -n "$try" ]; then echo " failed. Use force-quit" exit 1 else echo " done" fi ;; status) if [ ! -r $php_fpm_PID ]; then echo "php74-fpm is stopped" exit 0 fi PID=`cat $php_fpm_PID` if ps -p $PID | grep -q $PID; then echo "php74-fpm (pid $PID) is running..." else echo "php74-fpm dead but pid file exists" fi ;; force-quit) echo -n "Terminating php74-fpm..." if [ ! -r $php_fpm_PID ]; then echo "warning, no pid file found - php74-fpm is not running ?" exit 1 fi kill -TERM `cat $php_fpm_PID` wait_for_pid removed $php_fpm_PID if [ -n "$try" ]; then echo " failed" exit 1 else echo " done" fi ;; restart) $0 stop $0 start ;; reload) echo -n "Reloading service php74-fpm..." if [ ! -r $php_fpm_PID ]; then echo "warning, no pid file found - php74-fpm is not running ?" exit 1 fi kill -USR2 `cat $php_fpm_PID` echo " done" ;; configtest) $php_fpm_BIN -t ;; *) echo "Usage: $0 {start|stop|force-quit|restart|reload|status|configtest}" exit 1 ;; esac ================================================ FILE: aegir/conf/php/php74-fpm.conf ================================================ ;;;;;;;;;;;;;;;;;;;;; ; FPM Configuration ; ;;;;;;;;;;;;;;;;;;;;; ; All relative paths in this configuration file are relative to PHP's install ; prefix (/opt/php74). This prefix can be dynamically changed by using the ; '-p' argument from the command line. ; Include one or more files. If glob(3) exists, it is used to include a bunch of ; files from a glob(3) pattern. This directive can be used everywhere in the ; file. ; Relative path can also be used. They will be prefixed by: ; - the global prefix if it's been set (-p argument) ; - /opt/php74 otherwise ;include=etc/fpm.d/*.conf ;;;;;;;;;;;;;;;;;; ; Global Options ; ;;;;;;;;;;;;;;;;;; [global] ; Pid file ; Note: the default prefix is /opt/php74/var ; Default Value: none pid = /run/php74-fpm.pid ; Error log file ; If it's set to "syslog", log is sent to syslogd instead of being written ; in a local file. ; Note: the default prefix is /opt/php74/var ; Default Value: log/php-fpm.log error_log = /var/log/php/php74-fpm-error.log ; syslog_facility is used to specify what type of program is logging the ; message. This lets syslogd specify that messages from different facilities ; will be handled differently. ; See syslog(3) for possible values (ex daemon equiv LOG_DAEMON) ; Default Value: daemon syslog.facility = daemon ; syslog_ident is prepended to every message. If you have multiple FPM ; instances running on the same server, you can change the default value ; which must suit common needs. ; Default Value: php-fpm syslog.ident = php74-fpm ; Log level ; Possible Values: alert, error, warning, notice, debug ; Default Value: notice log_level = warning ; If this number of child processes exit with SIGSEGV or SIGBUS within the time ; interval set by emergency_restart_interval then FPM will restart. A value ; of '0' means 'Off'. ; Default Value: 0 emergency_restart_threshold = 5 ; Interval of time used by emergency_restart_interval to determine when ; a graceful restart will be initiated. This can be useful to work around ; accidental corruptions in an accelerator's shared memory. ; Available Units: s(econds), m(inutes), h(ours), or d(ays) ; Default Unit: seconds ; Default Value: 0 emergency_restart_interval = 1m ; Time limit for child processes to wait for a reaction on signals from master. ; Available units: s(econds), m(inutes), h(ours), or d(ays) ; Default Unit: seconds ; Default Value: 0 process_control_timeout = 5s ; The maximum number of processes FPM will fork. This has been design to control ; the global number of processes when using dynamic PM within a lot of pools. ; Use it with caution. ; Note: A value of 0 indicates no limit ; Default Value: 0 process.max = 0 ; Specify the nice(2) priority to apply to the master process (only if set) ; The value can vary from -19 (highest priority) to 20 (lower priority) ; Note: - It will only work if the FPM master process is launched as root ; - The pool process will inherit the master process priority ; unless it specified otherwise ; Default Value: no set ; process.priority = -19 ; Send FPM to background. Set to 'no' to keep FPM in foreground for debugging. ; Default Value: yes daemonize = yes ; Set open file descriptor rlimit for the master process. ; Default Value: system defined value ;rlimit_files = 1024 ; Set max core size rlimit for the master process. ; Possible Values: 'unlimited' or an integer greater or equal to 0 ; Default Value: system defined value ;rlimit_core = 0 ; Specify the event mechanism FPM will use. The following is available: ; - select (any POSIX os) ; - poll (any POSIX os) ; - epoll (linux >= 2.5.44) ; - kqueue (FreeBSD >= 4.1, OpenBSD >= 2.9, NetBSD >= 2.0) ; - /dev/poll (Solaris >= 7) ; - port (Solaris >= 10) ; Default Value: not set (auto detection) ;events.mechanism = epoll ;;;;;;;;;;;;;;;;;;;; ; Pool Definitions ; ;;;;;;;;;;;;;;;;;;;; ; Multiple pools of child processes may be started with different listening ; ports and different management options. The name of the pool will be ; used in logs and stats. There is no limitation on the number of pools which ; FPM can handle. Your system will tell you anyway :) include = /opt/php74/etc/pool.d/*.conf ================================================ FILE: aegir/conf/php/php74.ini ================================================ [PHP] ;;;;;;;;;;;;;;;;;;; ; About php.ini ; ;;;;;;;;;;;;;;;;;;; ; PHP's initialization file, generally called php.ini, is responsible for ; configuring many of the aspects of PHP's behavior. ; PHP attempts to find and load this configuration from a number of locations. ; The following is a summary of its search order: ; 1. SAPI module specific location. ; 2. The PHPRC environment variable. (As of PHP 5.2.0) ; 3. A number of predefined registry keys on Windows (As of PHP 5.2.0) ; 4. Current working directory (except CLI) ; 5. The web server's directory (for SAPI modules), or directory of PHP ; (otherwise in Windows) ; 6. The directory from the --with-config-file-path compile time option, or the ; Windows directory (usually C:\windows) ; See the PHP docs for more specific information. ; http://php.net/configuration.file ; The syntax of the file is extremely simple. Whitespace and lines ; beginning with a semicolon are silently ignored (as you probably guessed). ; Section headers (e.g. [Foo]) are also silently ignored, even though ; they might mean something in the future. ; Directives following the section heading [PATH=/www/mysite] only ; apply to PHP files in the /www/mysite directory. Directives ; following the section heading [HOST=www.example.com] only apply to ; PHP files served from www.example.com. Directives set in these ; special sections cannot be overridden by user-defined INI files or ; at runtime. Currently, [PATH=] and [HOST=] sections only work under ; CGI/FastCGI. ; http://php.net/ini.sections ; Directives are specified using the following syntax: ; directive = value ; Directive names are *case sensitive* - foo=bar is different from FOO=bar. ; Directives are variables used to configure PHP or PHP extensions. ; There is no name validation. If PHP can't find an expected ; directive because it is not set or is mistyped, a default value will be used. ; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one ; of the INI constants (On, Off, True, False, Yes, No and None) or an expression ; (e.g. E_ALL & ~E_NOTICE), a quoted string ("bar"), or a reference to a ; previously set variable or directive (e.g. ${foo}) ; Expressions in the INI file are limited to bitwise operators and parentheses: ; | bitwise OR ; ^ bitwise XOR ; & bitwise AND ; ~ bitwise NOT ; ! boolean NOT ; Boolean flags can be turned on using the values 1, On, True or Yes. ; They can be turned off using the values 0, Off, False or No. ; An empty string can be denoted by simply not writing anything after the equal ; sign, or by using the None keyword: ; foo = ; sets foo to an empty string ; foo = None ; sets foo to an empty string ; foo = "None" ; sets foo to the string 'None' ; If you use constants in your value, and these constants belong to a ; dynamically loaded extension (either a PHP extension or a Zend extension), ; you may only use these constants *after* the line that loads the extension. ;;;;;;;;;;;;;;;;;;; ; About this file ; ;;;;;;;;;;;;;;;;;;; ; PHP comes packaged with two INI files. One that is recommended to be used ; in production environments and one that is recommended to be used in ; development environments. ; php.ini-production contains settings which hold security, performance and ; best practices at its core. But please be aware, these settings may break ; compatibility with older or less security conscience applications. We ; recommending using the production ini in production and testing environments. ; php.ini-development is very similar to its production variant, except it is ; much more verbose when it comes to errors. We recommend using the ; development version only in development environments, as errors shown to ; application users can inadvertently leak otherwise secure information. ; This is the php.ini-production INI file. ;;;;;;;;;;;;;;;;;;; ; Quick Reference ; ;;;;;;;;;;;;;;;;;;; ; The following are all the settings which are different in either the production ; or development versions of the INIs with respect to PHP's default behavior. ; Please see the actual settings later in the document for more details as to why ; we recommend these changes in PHP's behavior. display_errors = Off ; Default Value: On ; Development Value: On ; Production Value: Off ; display_startup_errors ; Default Value: Off ; Development Value: On ; Production Value: Off ; error_reporting ; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; log_errors ; Default Value: Off ; Development Value: On ; Production Value: On ; max_input_time ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; output_buffering ; Default Value: Off ; Development Value: 4096 ; Production Value: 4096 ; register_argc_argv ; Default Value: On ; Development Value: Off ; Production Value: Off ; request_order ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; session.gc_divisor ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; session.sid_bits_per_character ; Default Value: 4 ; Development Value: 5 ; Production Value: 5 ; short_open_tag ; Default Value: On ; Development Value: Off ; Production Value: Off ; variables_order ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS" ;;;;;;;;;;;;;;;;;;;; ; php.ini Options ; ;;;;;;;;;;;;;;;;;;;; ; Name for user-defined php.ini (.htaccess) files. Default is ".user.ini" ;user_ini.filename = ".user.ini" ; To disable this feature set this option to an empty value user_ini.filename = ; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes) ;user_ini.cache_ttl = 300 ;;;;;;;;;;;;;;;;;;;; ; Language Options ; ;;;;;;;;;;;;;;;;;;;; ; Enable the PHP scripting language engine under Apache. ; http://php.net/engine engine = On ; This directive determines whether or not PHP will recognize code between ; tags as PHP source which should be processed as such. It is ; generally recommended that should be used and that this feature ; should be disabled, as enabling it may result in issues when generating XML ; documents, however this remains supported for backward compatibility reasons. ; Note that this directive does not control the would work. ; http://php.net/syntax-highlighting ;highlight.string = #DD0000 ;highlight.comment = #FF9900 ;highlight.keyword = #007700 ;highlight.default = #0000BB ;highlight.html = #000000 ; If enabled, the request will be allowed to complete even if the user aborts ; the request. Consider enabling it if executing long requests, which may end up ; being interrupted by the user or a browser timing out. PHP's default behavior ; is to disable this feature. ; http://php.net/ignore-user-abort ;ignore_user_abort = On ; Determines the size of the realpath cache to be used by PHP. This value should ; be increased on systems where PHP opens many files to reflect the quantity of ; the file operations performed. ; Note: if open_basedir is set, the cache is disabled ; http://php.net/realpath-cache-size realpath_cache_size=64M ; Duration of time, in seconds for which to cache realpath information for a given ; file or directory. For systems with rarely changing files, consider increasing this ; value. ; http://php.net/realpath-cache-ttl realpath_cache_ttl=180 ; Enables or disables the circular reference collector. ; http://php.net/zend.enable-gc zend.enable_gc = On ; If enabled, scripts may be written in encodings that are incompatible with ; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such ; encodings. To use this feature, mbstring extension must be enabled. ; Default: Off ;zend.multibyte = Off ; Allows to set the default encoding for the scripts. This value will be used ; unless "declare(encoding=...)" directive appears at the top of the script. ; Only affects if zend.multibyte is set. ; Default: "" ;zend.script_encoding = ; Allows to include or exclude arguments from stack traces generated for exceptions ; Default: Off ; In production, it is recommended to turn this setting on to prohibit the output ; of sensitive information in stack traces zend.exception_ignore_args = On ;;;;;;;;;;;;;;;;; ; Miscellaneous ; ;;;;;;;;;;;;;;;;; ; Decides whether PHP may expose the fact that it is installed on the server ; (e.g. by adding its signature to the Web server header). It is no security ; threat in any way, but it makes it possible to determine whether you use PHP ; on your server or not. ; http://php.net/expose-php expose_php = On ;;;;;;;;;;;;;;;;;;; ; Resource Limits ; ;;;;;;;;;;;;;;;;;;; ; Maximum execution time of each script, in seconds ; http://php.net/max-execution-time ; Note: This directive is hardcoded to 0 for the CLI SAPI max_execution_time = 180 ; Maximum amount of time each script may spend parsing request data. It's a good ; idea to limit this time on productions servers in order to eliminate unexpectedly ; long running scripts. ; Note: This directive is hardcoded to -1 for the CLI SAPI ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; http://php.net/max-input-time max_input_time = 180 ; Maximum input variable nesting level ; http://php.net/max-input-nesting-level ;max_input_nesting_level = 64 ; How many GET/POST/COOKIE input variables may be accepted max_input_vars = 9999 ; Maximum amount of memory a script may consume ; http://php.net/memory-limit memory_limit = 395M ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; Error handling and logging ; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; This directive informs PHP of which errors, warnings and notices you would like ; it to take action for. The recommended way of setting values for this ; directive is through the use of the error level constants and bitwise ; operators. The error level constants are below here for convenience as well as ; some common settings and their meanings. ; By default, PHP is set to take action on all errors, notices and warnings EXCEPT ; those related to E_NOTICE and E_STRICT, which together cover best practices and ; recommended coding standards in PHP. For performance reasons, this is the ; recommend error reporting setting. Your production server shouldn't be wasting ; resources complaining about best practices and coding standards. That's what ; development servers and development settings are for. ; Note: The php.ini-development file has this setting as E_ALL. This ; means it pretty much reports everything which is exactly what you want during ; development and early testing. ; ; Error Level Constants: ; E_ALL - All errors and warnings (includes E_STRICT as of PHP 5.4.0) ; E_ERROR - fatal run-time errors ; E_RECOVERABLE_ERROR - almost fatal run-time errors ; E_WARNING - run-time warnings (non-fatal errors) ; E_PARSE - compile-time parse errors ; E_NOTICE - run-time notices (these are warnings which often result ; from a bug in your code, but it's possible that it was ; intentional (e.g., using an uninitialized variable and ; relying on the fact it is automatically initialized to an ; empty string) ; E_STRICT - run-time notices, enable to have PHP suggest changes ; to your code which will ensure the best interoperability ; and forward compatibility of your code ; E_CORE_ERROR - fatal errors that occur during PHP's initial startup ; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's ; initial startup ; E_COMPILE_ERROR - fatal compile-time errors ; E_COMPILE_WARNING - compile-time warnings (non-fatal errors) ; E_USER_ERROR - user-generated error message ; E_USER_WARNING - user-generated warning message ; E_USER_NOTICE - user-generated notice message ; E_DEPRECATED - warn about code that will not work in future versions ; of PHP ; E_USER_DEPRECATED - user-generated deprecation warnings ; ; Common Values: ; E_ALL (Show all errors, warnings and notices including coding standards.) ; E_ALL & ~E_NOTICE (Show all errors, except for notices) ; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.) ; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors) ; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; http://php.net/error-reporting error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT ; This directive controls whether or not and where PHP will output errors, ; notices and warnings too. Error output is very useful during development, but ; it could be very dangerous in production environments. Depending on the code ; which is triggering the error, sensitive information could potentially leak ; out of your application such as database usernames and passwords or worse. ; For production environments, we recommend logging errors rather than ; sending them to STDOUT. ; Possible Values: ; Off = Do not display any errors ; stderr = Display errors to STDERR (affects only CGI/CLI binaries!) ; On or stdout = Display errors to STDOUT ; Default Value: On ; Development Value: On ; Production Value: Off ; http://php.net/display-errors display_errors = Off ; The display of errors which occur during PHP's startup sequence are handled ; separately from display_errors. PHP's default behavior is to suppress those ; errors from clients. Turning the display of startup errors on can be useful in ; debugging configuration problems. We strongly recommend you ; set this to 'off' for production servers. ; Default Value: Off ; Development Value: On ; Production Value: Off ; http://php.net/display-startup-errors display_startup_errors = Off ; Besides displaying errors, PHP can also log errors to locations such as a ; server-specific log, STDERR, or a location specified by the error_log ; directive found below. While errors should not be displayed on productions ; servers they should still be monitored and logging is a great way to do that. ; Default Value: Off ; Development Value: On ; Production Value: On ; http://php.net/log-errors log_errors = On ; Set maximum length of log_errors. In error_log information about the source is ; added. The default is 1024 and 0 allows to not apply any maximum length at all. ; http://php.net/log-errors-max-len log_errors_max_len = 1024 ; Do not log repeated messages. Repeated errors must occur in same file on same ; line unless ignore_repeated_source is set true. ; http://php.net/ignore-repeated-errors ignore_repeated_errors = Off ; Ignore source of message when ignoring repeated messages. When this setting ; is On you will not log errors with repeated messages from different files or ; source lines. ; http://php.net/ignore-repeated-source ignore_repeated_source = Off ; If this parameter is set to Off, then memory leaks will not be shown (on ; stdout or in the log). This is only effective in a debug compile, and if ; error reporting includes E_WARNING in the allowed list ; http://php.net/report-memleaks report_memleaks = On ; This setting is on by default. ;report_zend_debug = 0 ; Store the last error/warning message in $php_errormsg (boolean). Setting this value ; to On can assist in debugging and is appropriate for development servers. It should ; however be disabled on production servers. ; This directive is DEPRECATED. ; Default Value: Off ; Development Value: Off ; Production Value: Off ; http://php.net/track-errors ;track_errors = Off ; Turn off normal error reporting and emit XML-RPC error XML ; http://php.net/xmlrpc-errors ;xmlrpc_errors = 0 ; An XML-RPC faultCode ;xmlrpc_error_number = 0 ; When PHP displays or logs an error, it has the capability of formatting the ; error message as HTML for easier reading. This directive controls whether ; the error message is formatted as HTML or not. ; Note: This directive is hardcoded to Off for the CLI SAPI ; http://php.net/html-errors html_errors = Off ; If html_errors is set to On *and* docref_root is not empty, then PHP ; produces clickable error messages that direct to a page describing the error ; or function causing the error in detail. ; You can download a copy of the PHP manual from http://php.net/docs ; and change docref_root to the base URL of your local copy including the ; leading '/'. You must also specify the file extension being used including ; the dot. PHP's default behavior is to leave these settings empty, in which ; case no links to documentation are generated. ; Note: Never use this feature for production boxes. ; http://php.net/docref-root ; Examples ;docref_root = "/phpmanual/" ; http://php.net/docref-ext ;docref_ext = .html ; String to output before an error message. PHP's default behavior is to leave ; this setting blank. ; http://php.net/error-prepend-string ; Example: ;error_prepend_string = "" ; String to output after an error message. PHP's default behavior is to leave ; this setting blank. ; http://php.net/error-append-string ; Example: ;error_append_string = "" ; Log errors to specified file. PHP's default behavior is to leave this value ; empty. ; http://php.net/error-log ; Example: ;error_log = php_errors.log ; Log errors to syslog (Event Log on Windows). ;error_log = syslog error_log = /var/log/php/error_log_74 ; The syslog ident is a string which is prepended to every message logged ; to syslog. Only used when error_log is set to syslog. ;syslog.ident = php ; The syslog facility is used to specify what type of program is logging ; the message. Only used when error_log is set to syslog. ;syslog.facility = user ; Set this to disable filtering control characters (the default). ; Some loggers only accept NVT-ASCII, others accept anything that's not ; control characters. If your logger accepts everything, then no filtering ; is needed at all. ; Allowed values are: ; ascii (all printable ASCII characters and NL) ; no-ctrl (all characters except control characters) ; all (all characters) ; raw (like "all", but messages are not split at newlines) ; http://php.net/syslog.filter ;syslog.filter = ascii ;windows.show_crt_warning ; Default value: 0 ; Development value: 0 ; Production value: 0 ;;;;;;;;;;;;;;;;; ; Data Handling ; ;;;;;;;;;;;;;;;;; ; The separator used in PHP generated URLs to separate arguments. ; PHP's default setting is "&". ; http://php.net/arg-separator.output ; Example: ;arg_separator.output = "&" ; List of separator(s) used by PHP to parse input URLs into variables. ; PHP's default setting is "&". ; NOTE: Every character in this directive is considered as separator! ; http://php.net/arg-separator.input ; Example: ;arg_separator.input = ";&" ; This directive determines which super global arrays are registered when PHP ; starts up. G,P,C,E & S are abbreviations for the following respective super ; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty ; paid for the registration of these arrays and because ENV is not as commonly ; used as the others, ENV is not recommended on productions servers. You ; can still get access to the environment variables through getenv() should you ; need to. ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS"; ; http://php.net/variables-order variables_order = "GPCS" ; This directive determines which super global data (G,P & C) should be ; registered into the super global array REQUEST. If so, it also determines ; the order in which that data is registered. The values for this directive ; are specified in the same manner as the variables_order directive, ; EXCEPT one. Leaving this value empty will cause PHP to use the value set ; in the variables_order directive. It does not mean it will leave the super ; globals array REQUEST empty. ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; http://php.net/request-order request_order = "GP" ; This directive determines whether PHP registers $argv & $argc each time it ; runs. $argv contains an array of all the arguments passed to PHP when a script ; is invoked. $argc contains an integer representing the number of arguments ; that were passed when the script was invoked. These arrays are extremely ; useful when running scripts from the command line. When this directive is ; enabled, registering these variables consumes CPU cycles and memory each time ; a script is executed. For performance reasons, this feature should be disabled ; on production servers. ; Note: This directive is hardcoded to On for the CLI SAPI ; Default Value: On ; Development Value: Off ; Production Value: Off ; http://php.net/register-argc-argv register_argc_argv = Off ; When enabled, the ENV, REQUEST and SERVER variables are created when they're ; first used (Just In Time) instead of when the script starts. If these ; variables are not used within a script, having this directive on will result ; in a performance gain. The PHP directive register_argc_argv must be disabled ; for this directive to have any effect. ; http://php.net/auto-globals-jit auto_globals_jit = On ; Whether PHP will read the POST data. ; This option is enabled by default. ; Most likely, you won't want to disable this option globally. It causes $_POST ; and $_FILES to always be empty; the only way you will be able to read the ; POST data will be through the php://input stream wrapper. This can be useful ; to proxy requests or to process the POST data in a memory efficient fashion. ; http://php.net/enable-post-data-reading ;enable_post_data_reading = Off ; Maximum size of POST data that PHP will accept. ; Its value may be 0 to disable the limit. It is ignored if POST data reading ; is disabled through enable_post_data_reading. ; http://php.net/post-max-size post_max_size = 350M ; Automatically add files before PHP document. ; http://php.net/auto-prepend-file auto_prepend_file = ; Automatically add files after PHP document. ; http://php.net/auto-append-file auto_append_file = ; By default, PHP will output a media type using the Content-Type header. To ; disable this, simply set it to be empty. ; ; PHP's built-in default media type is set to text/html. ; http://php.net/default-mimetype default_mimetype = "text/html" ; PHP's default character set is set to UTF-8. ; http://php.net/default-charset default_charset = "UTF-8" ; PHP internal character encoding is set to empty. ; If empty, default_charset is used. ; http://php.net/internal-encoding ;internal_encoding = ; PHP input character encoding is set to empty. ; If empty, default_charset is used. ; http://php.net/input-encoding ;input_encoding = ; PHP output character encoding is set to empty. ; If empty, default_charset is used. ; See also output_buffer. ; http://php.net/output-encoding ;output_encoding = ;;;;;;;;;;;;;;;;;;;;;;;;; ; Paths and Directories ; ;;;;;;;;;;;;;;;;;;;;;;;;; ; UNIX: "/path1:/path2" ;include_path = ".:/php/includes" ; ; Windows: "\path1;\path2" ;include_path = ".;c:\php\includes" ; ; PHP's default setting for include_path is ".;/path/to/php/pear" ; http://php.net/include-path include_path = ".:/opt/php74/lib/php" ; The root of the PHP pages, used only if nonempty. ; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root ; if you are running php as a CGI under any web server (other than IIS) ; see documentation for security issues. The alternate is to use the ; cgi.force_redirect configuration below ; http://php.net/doc-root doc_root = ; The directory under which PHP opens the script using /~username used only ; if nonempty. ; http://php.net/user-dir user_dir = ; Directory in which the loadable extensions (modules) reside. ; http://php.net/extension-dir ;extension_dir = "./" ; On windows: ;extension_dir = "ext" extension_dir = "/opt/php74/lib/php/extensions/no-debug-non-zts-20190902/" ; Directory where the temporary files should be placed. ; Defaults to the system default (see sys_get_temp_dir) sys_temp_dir = "/tmp" ; Whether or not to enable the dl() function. The dl() function does NOT work ; properly in multithreaded servers, such as IIS or Zeus, and is automatically ; disabled on them. ; http://php.net/enable-dl enable_dl = Off ; cgi.force_redirect is necessary to provide security running PHP as a CGI under ; most web servers. Left undefined, PHP turns this on by default. You can ; turn it off here AT YOUR OWN RISK ; **You CAN safely turn this off for IIS, in fact, you MUST.** ; http://php.net/cgi.force-redirect ;cgi.force_redirect = 1 ; if cgi.nph is enabled it will force cgi to always sent Status: 200 with ; every request. PHP's default behavior is to disable this feature. ;cgi.nph = 1 ; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape ; (iPlanet) web servers, you MAY need to set an environment variable name that PHP ; will look for to know it is OK to continue execution. Setting this variable MAY ; cause security issues, KNOW WHAT YOU ARE DOING FIRST. ; http://php.net/cgi.redirect-status-env ;cgi.redirect_status_env = ; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's ; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok ; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting ; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting ; of zero causes PHP to behave as before. Default is 1. You should fix your scripts ; to use SCRIPT_FILENAME rather than PATH_TRANSLATED. ; http://php.net/cgi.fix-pathinfo ;cgi.fix_pathinfo=1 ; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside ; of the web tree and people will not be able to circumvent .htaccess security. ;cgi.discard_path=1 ; FastCGI under IIS supports the ability to impersonate ; security tokens of the calling client. This allows IIS to define the ; security context that the request runs under. mod_fastcgi under Apache ; does not currently support this feature (03/17/2002) ; Set to 1 if running under IIS. Default is zero. ; http://php.net/fastcgi.impersonate ;fastcgi.impersonate = 1 ; Disable logging through FastCGI connection. PHP's default behavior is to enable ; this feature. ;fastcgi.logging = 0 ; cgi.rfc2616_headers configuration option tells PHP what type of headers to ; use when sending HTTP response code. If set to 0, PHP sends Status: header that ; is supported by Apache. When this option is set to 1, PHP will send ; RFC2616 compliant header. ; Default is zero. ; http://php.net/cgi.rfc2616-headers ;cgi.rfc2616_headers = 0 ; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #! ; (shebang) at the top of the running script. This line might be needed if the ; script support running both as stand-alone script and via PHP CGI<. PHP in CGI ; mode skips this line and ignores its content if this directive is turned on. ; http://php.net/cgi.check-shebang-line ;cgi.check_shebang_line=1 ;;;;;;;;;;;;;;;; ; File Uploads ; ;;;;;;;;;;;;;;;; ; Whether to allow HTTP file uploads. ; http://php.net/file-uploads file_uploads = On ; Temporary directory for HTTP uploaded files (will use system default if not ; specified). ; http://php.net/upload-tmp-dir upload_tmp_dir = /tmp ; Maximum allowed size for uploaded files. ; http://php.net/upload-max-filesize upload_max_filesize = 325M ; Maximum number of files that can be uploaded via a single request max_file_uploads = 50 ;;;;;;;;;;;;;;;;;; ; Fopen wrappers ; ;;;;;;;;;;;;;;;;;; ; Whether to allow the treatment of URLs (like http:// or ftp://) as files. ; http://php.net/allow-url-fopen allow_url_fopen = On ; Whether to allow include/require to open URLs (like http:// or ftp://) as files. ; http://php.net/allow-url-include allow_url_include = Off ; Define the anonymous ftp password (your email address). PHP's default setting ; for this is empty. ; http://php.net/from ;from="john@doe.com" ; Define the User-Agent string. PHP's default setting for this is empty. ; http://php.net/user-agent ;user_agent="PHP" ; Default timeout for socket based streams (seconds) ; http://php.net/default-socket-timeout default_socket_timeout = 180 ; If your scripts have to deal with files from Macintosh systems, ; or you are running on a Mac and need to deal with files from ; unix or win32 systems, setting this flag will cause PHP to ; automatically detect the EOL character in those files so that ; fgets() and file() will work regardless of the source of the file. ; http://php.net/auto-detect-line-endings auto_detect_line_endings = On ;;;;;;;;;;;;;;;;;;;;;; ; Dynamic Extensions ; ;;;;;;;;;;;;;;;;;;;;;; ; If you wish to have an extension loaded automatically, use the following ; syntax: ; ; extension=modulename ; ; For example: ; ; extension=mysqli ; ; When the extension library to load is not located in the default extension ; directory, You may specify an absolute path to the library file: ; ; extension=/path/to/extension/mysqli.so ; ; Note : The syntax used in previous PHP versions ('extension=.so' and ; 'extension='php_.dll') is supported for legacy reasons and may be ; deprecated in a future PHP major version. So, when it is possible, please ; move to the new ('extension=) syntax. ; ; Notes for Windows environments : ; ; - Many DLL files are located in the extensions/ (PHP 4) or ext/ (PHP 5+) ; extension folders as well as the separate PECL DLL download (PHP 5+). ; Be sure to appropriately set the extension_dir directive. ; ;extension=bz2 ;extension=curl ;extension=ffi ;extension=ftp ;extension=fileinfo ;extension=gd2 ;extension=gettext ;extension=gmp ;extension=intl ;extension=imap ;extension=ldap ;extension=mbstring ;extension=exif ; Must be after mbstring as it depends on it ;extension=mysqli ;extension=oci8_12c ; Use with Oracle Database 12c Instant Client ;extension=odbc ;extension=openssl ;extension=pdo_firebird ;extension=pdo_mysql ;extension=pdo_oci ;extension=pdo_odbc ;extension=pdo_pgsql ;extension=pdo_sqlite ;extension=pgsql ;extension=shmop ; The MIBS data available in the PHP distribution must be installed. ; See http://www.php.net/manual/en/snmp.installation.php ;extension=snmp ;extension=soap ;extension=sockets ;extension=sodium ;extension=sqlite3 ;extension=tidy ;extension=xmlrpc ;extension=xsl ;;;;;;;;;;;;;;;;;;; ; Module Settings ; ;;;;;;;;;;;;;;;;;;; [CLI Server] ; Whether the CLI web server uses ANSI color coding in its terminal output. cli_server.color = On [Date] ; Defines the default timezone used by the date functions ; http://php.net/date.timezone date.timezone = "UTC" ; http://php.net/date.default-latitude ;date.default_latitude = 31.7667 ; http://php.net/date.default-longitude ;date.default_longitude = 35.2333 ; http://php.net/date.sunrise-zenith ;date.sunrise_zenith = 90.583333 ; http://php.net/date.sunset-zenith ;date.sunset_zenith = 90.583333 [filter] ; http://php.net/filter.default ;filter.default = unsafe_raw ; http://php.net/filter.default-flags ;filter.default_flags = [iconv] ; Use of this INI entry is deprecated, use global input_encoding instead. ; If empty, default_charset or input_encoding or iconv.input_encoding is used. ; The precedence is: default_charset < input_encoding < iconv.input_encoding ;iconv.input_encoding = ; Use of this INI entry is deprecated, use global internal_encoding instead. ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;iconv.internal_encoding = ; Use of this INI entry is deprecated, use global output_encoding instead. ; If empty, default_charset or output_encoding or iconv.output_encoding is used. ; The precedence is: default_charset < output_encoding < iconv.output_encoding ; To use an output encoding conversion, iconv's output handler must be set ; otherwise output encoding conversion cannot be performed. ;iconv.output_encoding = [imap] ; rsh/ssh logins are disabled by default. Use this INI entry if you want to ; enable them. Note that the IMAP library does not filter mailbox names before ; passing them to rsh/ssh command, thus passing untrusted data to this function ; with rsh/ssh enabled is insecure. ;imap.enable_insecure_rsh=0 [intl] ;intl.default_locale = ; This directive allows you to produce PHP errors when some error ; happens within intl functions. The value is the level of the error produced. ; Default is 0, which does not produce any errors. ;intl.error_level = E_WARNING ;intl.use_exceptions = 0 [sqlite3] ; Directory pointing to SQLite3 extensions ; http://php.net/sqlite3.extension-dir ;sqlite3.extension_dir = ; SQLite defensive mode flag (only available from SQLite 3.26+) ; When the defensive flag is enabled, language features that allow ordinary ; SQL to deliberately corrupt the database file are disabled. This forbids ; writing directly to the schema, shadow tables (eg. FTS data tables), or ; the sqlite_dbpage virtual table. ; https://www.sqlite.org/c3ref/c_dbconfig_defensive.html ; (for older SQLite versions, this flag has no use) ;sqlite3.defensive = 1 [Pcre] ; PCRE library backtracking limit. ; http://php.net/pcre.backtrack-limit ;pcre.backtrack_limit=100000 ; PCRE library recursion limit. ; Please note that if you set this value to a high number you may consume all ; the available process stack and eventually crash PHP (due to reaching the ; stack size limit imposed by the Operating System). ; http://php.net/pcre.recursion-limit ;pcre.recursion_limit=100000 ; Enables or disables JIT compilation of patterns. This requires the PCRE ; library to be compiled with JIT support. ;pcre.jit=1 [Pdo] ; Whether to pool ODBC connections. Can be one of "strict", "relaxed" or "off" ; http://php.net/pdo-odbc.connection-pooling ;pdo_odbc.connection_pooling=strict ;pdo_odbc.db2_instance_name [Pdo_mysql] ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. pdo_mysql.default_socket= [Phar] ; http://php.net/phar.readonly ;phar.readonly = On ; http://php.net/phar.require-hash ;phar.require_hash = On ;phar.cache_list = [mail function] ; For Win32 only. ; http://php.net/smtp ;SMTP = localhost ; http://php.net/smtp-port ;smtp_port = 25 ; For Win32 only. ; http://php.net/sendmail-from ;sendmail_from = me@example.com ; For Unix only. You may supply arguments as well (default: "sendmail -t -i"). ; http://php.net/sendmail-path sendmail_path = /usr/sbin/sendmail -t -i ; Force the addition of the specified parameters to be passed as extra parameters ; to the sendmail binary. These parameters will always replace the value of ; the 5th parameter to mail(). ;mail.force_extra_parameters = ; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename mail.add_x_header = Off ; The path to a log file that will log all mail() calls. Log entries include ; the full path of the script, line number, To address and headers. ;mail.log = ; Log mail to syslog (Event Log on Windows). ;mail.log = syslog [ODBC] ; http://php.net/odbc.default-db ;odbc.default_db = Not yet implemented ; http://php.net/odbc.default-user ;odbc.default_user = Not yet implemented ; http://php.net/odbc.default-pw ;odbc.default_pw = Not yet implemented ; Controls the ODBC cursor model. ; Default: SQL_CURSOR_STATIC (default). ;odbc.default_cursortype ; Allow or prevent persistent links. ; http://php.net/odbc.allow-persistent odbc.allow_persistent = On ; Check that a connection is still valid before reuse. ; http://php.net/odbc.check-persistent odbc.check_persistent = On ; Maximum number of persistent links. -1 means no limit. ; http://php.net/odbc.max-persistent odbc.max_persistent = -1 ; Maximum number of links (persistent + non-persistent). -1 means no limit. ; http://php.net/odbc.max-links odbc.max_links = -1 ; Handling of LONG fields. Returns number of bytes to variables. 0 means ; passthru. ; http://php.net/odbc.defaultlrl odbc.defaultlrl = 4096 ; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char. ; See the documentation on odbc_binmode and odbc_longreadlen for an explanation ; of odbc.defaultlrl and odbc.defaultbinmode ; http://php.net/odbc.defaultbinmode odbc.defaultbinmode = 1 [MySQLi] ; Maximum number of persistent links. -1 means no limit. ; http://php.net/mysqli.max-persistent mysqli.max_persistent = -1 ; Allow accessing, from PHP's perspective, local files with LOAD DATA statements ; http://php.net/mysqli.allow_local_infile ;mysqli.allow_local_infile = On ; Allow or prevent persistent links. ; http://php.net/mysqli.allow-persistent mysqli.allow_persistent = On ; Maximum number of links. -1 means no limit. ; http://php.net/mysqli.max-links mysqli.max_links = -1 ; Default port number for mysqli_connect(). If unset, mysqli_connect() will use ; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the ; compile-time value defined MYSQL_PORT (in that order). Win32 will only look ; at MYSQL_PORT. ; http://php.net/mysqli.default-port mysqli.default_port = 3306 ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. ; http://php.net/mysqli.default-socket mysqli.default_socket = ; Default host for mysqli_connect() (doesn't apply in safe mode). ; http://php.net/mysqli.default-host mysqli.default_host = ; Default user for mysqli_connect() (doesn't apply in safe mode). ; http://php.net/mysqli.default-user mysqli.default_user = ; Default password for mysqli_connect() (doesn't apply in safe mode). ; Note that this is generally a *bad* idea to store passwords in this file. ; *Any* user with PHP access can run 'echo get_cfg_var("mysqli.default_pw") ; and reveal this password! And of course, any users with read access to this ; file will be able to reveal the password as well. ; http://php.net/mysqli.default-pw mysqli.default_pw = ; Allow or prevent reconnect mysqli.reconnect = Off [mysqlnd] ; Enable / Disable collection of general statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. mysqlnd.collect_statistics = 0 ; Enable / Disable collection of memory usage statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. mysqlnd.collect_memory_statistics = 0 ; Records communication from all extensions using mysqlnd to the specified log ; file. ; http://php.net/mysqlnd.debug ;mysqlnd.debug = ; Defines which queries will be logged. ;mysqlnd.log_mask = 0 ; Default size of the mysqlnd memory pool, which is used by result sets. mysqlnd.mempool_default_size = 64000 ; Size of a pre-allocated buffer used when sending commands to MySQL in bytes. mysqlnd.net_cmd_buffer_size = 8192 ; Size of a pre-allocated buffer used for reading data sent by the server in ; bytes. mysqlnd.net_read_buffer_size = 131072 ; Timeout for network requests in seconds. ;mysqlnd.net_read_timeout = 31536000 ; SHA-256 Authentication Plugin related. File with the MySQL server public RSA ; key. ;mysqlnd.sha256_server_public_key = [OCI8] ; Connection: Enables privileged connections using external ; credentials (OCI_SYSOPER, OCI_SYSDBA) ; http://php.net/oci8.privileged-connect ;oci8.privileged_connect = Off ; Connection: The maximum number of persistent OCI8 connections per ; process. Using -1 means no limit. ; http://php.net/oci8.max-persistent ;oci8.max_persistent = -1 ; Connection: The maximum number of seconds a process is allowed to ; maintain an idle persistent connection. Using -1 means idle ; persistent connections will be maintained forever. ; http://php.net/oci8.persistent-timeout ;oci8.persistent_timeout = -1 ; Connection: The number of seconds that must pass before issuing a ; ping during oci_pconnect() to check the connection validity. When ; set to 0, each oci_pconnect() will cause a ping. Using -1 disables ; pings completely. ; http://php.net/oci8.ping-interval ;oci8.ping_interval = 60 ; Connection: Set this to a user chosen connection class to be used ; for all pooled server requests with Oracle 11g Database Resident ; Connection Pooling (DRCP). To use DRCP, this value should be set to ; the same string for all web servers running the same application, ; the database pool must be configured, and the connection string must ; specify to use a pooled server. ;oci8.connection_class = ; High Availability: Using On lets PHP receive Fast Application ; Notification (FAN) events generated when a database node fails. The ; database must also be configured to post FAN events. ;oci8.events = Off ; Tuning: This option enables statement caching, and specifies how ; many statements to cache. Using 0 disables statement caching. ; http://php.net/oci8.statement-cache-size ;oci8.statement_cache_size = 20 ; Tuning: Enables statement prefetching and sets the default number of ; rows that will be fetched automatically after statement execution. ; http://php.net/oci8.default-prefetch ;oci8.default_prefetch = 100 ; Compatibility. Using On means oci_close() will not close ; oci_connect() and oci_new_connect() connections. ; http://php.net/oci8.old-oci-close-semantics ;oci8.old_oci_close_semantics = Off [PostgreSQL] ; Allow or prevent persistent links. ; http://php.net/pgsql.allow-persistent pgsql.allow_persistent = On ; Detect broken persistent links always with pg_pconnect(). ; Auto reset feature requires a little overheads. ; http://php.net/pgsql.auto-reset-persistent pgsql.auto_reset_persistent = Off ; Maximum number of persistent links. -1 means no limit. ; http://php.net/pgsql.max-persistent pgsql.max_persistent = -1 ; Maximum number of links (persistent+non persistent). -1 means no limit. ; http://php.net/pgsql.max-links pgsql.max_links = -1 ; Ignore PostgreSQL backends Notice message or not. ; Notice message logging require a little overheads. ; http://php.net/pgsql.ignore-notice pgsql.ignore_notice = 0 ; Log PostgreSQL backends Notice message or not. ; Unless pgsql.ignore_notice=0, module cannot log notice message. ; http://php.net/pgsql.log-notice pgsql.log_notice = 0 [bcmath] ; Number of decimal digits for all bcmath functions. ; http://php.net/bcmath.scale bcmath.scale = 0 [browscap] ; http://php.net/browscap ;browscap = extra/browscap.ini [Session] ; Handler used to store/retrieve data. ; http://php.net/session.save-handler session.save_handler = files ; Argument passed to save_handler. In the case of files, this is the path ; where data files are stored. Note: Windows users have to change this ; variable in order to use PHP's session functions. ; ; The path can be defined as: ; ; session.save_path = "N;/path" ; ; where N is an integer. Instead of storing all the session files in ; /path, what this will do is use subdirectories N-levels deep, and ; store the session data in those directories. This is useful if ; your OS has problems with many files in one directory, and is ; a more efficient layout for servers that handle many sessions. ; ; NOTE 1: PHP will not create this directory structure automatically. ; You can use the script in the ext/session dir for that purpose. ; NOTE 2: See the section on garbage collection below if you choose to ; use subdirectories for session storage ; ; The file storage module creates files using mode 600 by default. ; You can change that by using ; ; session.save_path = "N;MODE;/path" ; ; where MODE is the octal representation of the mode. Note that this ; does not overwrite the process's umask. ; http://php.net/session.save-path session.save_path = "/opt/tmp" ; Whether to use strict session mode. ; Strict session mode does not accept an uninitialized session ID, and ; regenerates the session ID if the browser sends an uninitialized session ID. ; Strict mode protects applications from session fixation via a session adoption ; vulnerability. It is disabled by default for maximum compatibility, but ; enabling it is encouraged. ; https://wiki.php.net/rfc/strict_sessions session.use_strict_mode = 0 ; Whether to use cookies. ; http://php.net/session.use-cookies session.use_cookies = 1 ; http://php.net/session.cookie-secure ;session.cookie_secure = ; This option forces PHP to fetch and use a cookie for storing and maintaining ; the session id. We encourage this operation as it's very helpful in combating ; session hijacking when not specifying and managing your own session id. It is ; not the be-all and end-all of session hijacking defense, but it's a good start. ; http://php.net/session.use-only-cookies session.use_only_cookies = 1 ; Name of the session (used as cookie name). ; http://php.net/session.name session.name = PHPSESSID ; Initialize session on request startup. ; http://php.net/session.auto-start session.auto_start = 0 ; Lifetime in seconds of cookie or, if 0, until browser is restarted. ; http://php.net/session.cookie-lifetime session.cookie_lifetime = 0 ; The path for which the cookie is valid. ; http://php.net/session.cookie-path session.cookie_path = / ; The domain for which the cookie is valid. ; http://php.net/session.cookie-domain session.cookie_domain = ; Whether or not to add the httpOnly flag to the cookie, which makes it ; inaccessible to browser scripting languages such as JavaScript. ; http://php.net/session.cookie-httponly session.cookie_httponly = 1 ; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF) ; Current valid values are "Strict", "Lax" or "None". When using "None", ; make sure to include the quotes, as `none` is interpreted like `false` in ini files. ; https://tools.ietf.org/html/draft-west-first-party-cookies-07 session.cookie_samesite = ; Handler used to serialize data. php is the standard serializer of PHP. ; http://php.net/session.serialize-handler session.serialize_handler = php ; Defines the probability that the 'garbage collection' process is started on every ; session initialization. The probability is calculated by using gc_probability/gc_divisor, ; e.g. 1/100 means there is a 1% chance that the GC process starts on each request. ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; http://php.net/session.gc-probability session.gc_probability = 1 ; Defines the probability that the 'garbage collection' process is started on every ; session initialization. The probability is calculated by using gc_probability/gc_divisor, ; e.g. 1/100 means there is a 1% chance that the GC process starts on each request. ; For high volume production servers, using a value of 1000 is a more efficient approach. ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; http://php.net/session.gc-divisor session.gc_divisor = 1000 ; After this number of seconds, stored data will be seen as 'garbage' and ; cleaned up by the garbage collection process. ; http://php.net/session.gc-maxlifetime session.gc_maxlifetime = 1440 ; NOTE: If you are using the subdirectory option for storing session files ; (see session.save_path above), then garbage collection does *not* ; happen automatically. You will need to do your own garbage ; collection through a shell script, cron entry, or some other method. ; For example, the following script is the equivalent of setting ; session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes): ; find /path/to/sessions -cmin +24 -type f | xargs rm ; Check HTTP Referer to invalidate externally stored URLs containing ids. ; HTTP_REFERER has to contain this substring for the session to be ; considered as valid. ; http://php.net/session.referer-check session.referer_check = ; Set to {nocache,private,public,} to determine HTTP caching aspects ; or leave this empty to avoid sending anti-caching headers. ; http://php.net/session.cache-limiter session.cache_limiter = nocache ; Document expires after n minutes. ; http://php.net/session.cache-expire session.cache_expire = 180 ; trans sid support is disabled by default. ; Use of trans sid may risk your users' security. ; Use this option with caution. ; - User may send URL contains active session ID ; to other person via. email/irc/etc. ; - URL that contains active session ID may be stored ; in publicly accessible computer. ; - User may access your site with the same session ID ; always using URL stored in browser's history or bookmarks. ; http://php.net/session.use-trans-sid session.use_trans_sid = 0 ; Set session ID character length. This value could be between 22 to 256. ; Shorter length than default is supported only for compatibility reason. ; Users should use 32 or more chars. ; http://php.net/session.sid-length ; Default Value: 32 ; Development Value: 26 ; Production Value: 26 session.sid_length = 26 ; The URL rewriter will look for URLs in a defined set of HTML tags. ; is special; if you include them here, the rewriter will ; add a hidden field with the info which is otherwise appended ; to URLs. tag's action attribute URL will not be modified ; unless it is specified. ; Note that all valid entries require a "=", even if no value follows. ; Default Value: "a=href,area=href,frame=src,form=" ; Development Value: "a=href,area=href,frame=src,form=" ; Production Value: "a=href,area=href,frame=src,form=" ; http://php.net/url-rewriter.tags session.trans_sid_tags = "a=href,area=href,frame=src,form=" ; URL rewriter does not rewrite absolute URLs by default. ; To enable rewrites for absolute paths, target hosts must be specified ; at RUNTIME. i.e. use ini_set() ; tags is special. PHP will check action attribute's URL regardless ; of session.trans_sid_tags setting. ; If no host is defined, HTTP_HOST will be used for allowed host. ; Example value: php.net,www.php.net,wiki.php.net ; Use "," for multiple hosts. No spaces are allowed. ; Default Value: "" ; Development Value: "" ; Production Value: "" ;session.trans_sid_hosts="" ; Define how many bits are stored in each character when converting ; the binary hash data to something readable. ; Possible values: ; 4 (4 bits: 0-9, a-f) ; 5 (5 bits: 0-9, a-v) ; 6 (6 bits: 0-9, a-z, A-Z, "-", ",") ; Default Value: 4 ; Development Value: 5 ; Production Value: 5 ; http://php.net/session.hash-bits-per-character session.sid_bits_per_character = 5 ; Enable upload progress tracking in $_SESSION ; Default Value: On ; Development Value: On ; Production Value: On ; http://php.net/session.upload-progress.enabled ;session.upload_progress.enabled = On ; Cleanup the progress information as soon as all POST data has been read ; (i.e. upload completed). ; Default Value: On ; Development Value: On ; Production Value: On ; http://php.net/session.upload-progress.cleanup ;session.upload_progress.cleanup = On ; A prefix used for the upload progress key in $_SESSION ; Default Value: "upload_progress_" ; Development Value: "upload_progress_" ; Production Value: "upload_progress_" ; http://php.net/session.upload-progress.prefix ;session.upload_progress.prefix = "upload_progress_" ; The index name (concatenated with the prefix) in $_SESSION ; containing the upload progress information ; Default Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Development Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Production Value: "PHP_SESSION_UPLOAD_PROGRESS" ; http://php.net/session.upload-progress.name ;session.upload_progress.name = "PHP_SESSION_UPLOAD_PROGRESS" ; How frequently the upload progress should be updated. ; Given either in percentages (per-file), or in bytes ; Default Value: "1%" ; Development Value: "1%" ; Production Value: "1%" ; http://php.net/session.upload-progress.freq ;session.upload_progress.freq = "1%" ; The minimum delay between updates, in seconds ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; http://php.net/session.upload-progress.min-freq ;session.upload_progress.min_freq = "1" ; Only write session data when session data is changed. Enabled by default. ; http://php.net/session.lazy-write ;session.lazy_write = On [Assertion] ; Switch whether to compile assertions at all (to have no overhead at run-time) ; -1: Do not compile at all ; 0: Jump over assertion at run-time ; 1: Execute assertions ; Changing from or to a negative value is only possible in php.ini! (For turning assertions on and off at run-time, see assert.active, when zend.assertions = 1) ; Default Value: 1 ; Development Value: 1 ; Production Value: -1 ; http://php.net/zend.assertions zend.assertions = -1 ; Assert(expr); active by default. ; http://php.net/assert.active ;assert.active = On ; Throw an AssertionError on failed assertions ; http://php.net/assert.exception ;assert.exception = On ; Issue a PHP warning for each failed assertion. (Overridden by assert.exception if active) ; http://php.net/assert.warning ;assert.warning = On ; Don't bail out by default. ; http://php.net/assert.bail ;assert.bail = Off ; User-function to be called if an assertion fails. ; http://php.net/assert.callback ;assert.callback = 0 ; Eval the expression with current error_reporting(). Set to true if you want ; error_reporting(0) around the eval(). ; http://php.net/assert.quiet-eval ;assert.quiet_eval = 0 [COM] ; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs ; http://php.net/com.typelib-file ;com.typelib_file = ; allow Distributed-COM calls ; http://php.net/com.allow-dcom ;com.allow_dcom = true ; autoregister constants of a component's typlib on com_load() ; http://php.net/com.autoregister-typelib ;com.autoregister_typelib = true ; register constants casesensitive ; http://php.net/com.autoregister-casesensitive ;com.autoregister_casesensitive = false ; show warnings on duplicate constant registrations ; http://php.net/com.autoregister-verbose ;com.autoregister_verbose = true ; The default character set code-page to use when passing strings to and from COM objects. ; Default: system ANSI code page ;com.code_page= [mbstring] ; language for internal character representation. ; This affects mb_send_mail() and mbstring.detect_order. ; http://php.net/mbstring.language ;mbstring.language = Japanese ; Use of this INI entry is deprecated, use global internal_encoding instead. ; internal/script encoding. ; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*) ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;mbstring.internal_encoding = ; Use of this INI entry is deprecated, use global input_encoding instead. ; http input encoding. ; mbstring.encoding_translation = On is needed to use this setting. ; If empty, default_charset or input_encoding or mbstring.input is used. ; The precedence is: default_charset < input_encoding < mbsting.http_input ; http://php.net/mbstring.http-input ;mbstring.http_input = ; Use of this INI entry is deprecated, use global output_encoding instead. ; http output encoding. ; mb_output_handler must be registered as output buffer to function. ; If empty, default_charset or output_encoding or mbstring.http_output is used. ; The precedence is: default_charset < output_encoding < mbstring.http_output ; To use an output encoding conversion, mbstring's output handler must be set ; otherwise output encoding conversion cannot be performed. ; http://php.net/mbstring.http-output ;mbstring.http_output = ; enable automatic encoding translation according to ; mbstring.internal_encoding setting. Input chars are ; converted to internal encoding by setting this to On. ; Note: Do _not_ use automatic encoding translation for ; portable libs/applications. ; http://php.net/mbstring.encoding-translation ;mbstring.encoding_translation = Off ; automatic encoding detection order. ; "auto" detect order is changed according to mbstring.language ; http://php.net/mbstring.detect-order ;mbstring.detect_order = auto ; substitute_character used when character cannot be converted ; one from another ; http://php.net/mbstring.substitute-character ;mbstring.substitute_character = none ; overload(replace) single byte functions by mbstring functions. ; mail(), ereg(), etc are overloaded by mb_send_mail(), mb_ereg(), ; etc. Possible values are 0,1,2,4 or combination of them. ; For example, 7 for overload everything. ; 0: No overload ; 1: Overload mail() function ; 2: Overload str*() functions ; 4: Overload ereg*() functions ; http://php.net/mbstring.func-overload ;mbstring.func_overload = 0 ; enable strict encoding detection. ; Default: Off ;mbstring.strict_detection = On ; This directive specifies the regex pattern of content types for which mb_output_handler() ; is activated. ; Default: mbstring.http_output_conv_mimetype=^(text/|application/xhtml\+xml) ;mbstring.http_output_conv_mimetype= ; This directive specifies maximum stack depth for mbstring regular expressions. It is similar ; to the pcre.recursion_limit for PCRE. ; Default: 100000 ;mbstring.regex_stack_limit=100000 ; This directive specifies maximum retry count for mbstring regular expressions. It is similar ; to the pcre.backtrack_limit for PCRE. ; Default: 1000000 ;mbstring.regex_retry_limit=1000000 [gd] ; Tell the jpeg decode to ignore warnings and try to create ; a gd image. The warning will then be displayed as notices ; disabled by default ; http://php.net/gd.jpeg-ignore-warning ;gd.jpeg_ignore_warning = 1 [exif] ; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS. ; With mbstring support this will automatically be converted into the encoding ; given by corresponding encode setting. When empty mbstring.internal_encoding ; is used. For the decode settings you can distinguish between motorola and ; intel byte order. A decode setting cannot be empty. ; http://php.net/exif.encode-unicode ;exif.encode_unicode = ISO-8859-15 ; http://php.net/exif.decode-unicode-motorola ;exif.decode_unicode_motorola = UCS-2BE ; http://php.net/exif.decode-unicode-intel ;exif.decode_unicode_intel = UCS-2LE ; http://php.net/exif.encode-jis ;exif.encode_jis = ; http://php.net/exif.decode-jis-motorola ;exif.decode_jis_motorola = JIS ; http://php.net/exif.decode-jis-intel ;exif.decode_jis_intel = JIS [Tidy] ; The path to a default tidy configuration file to use when using tidy ; http://php.net/tidy.default-config ;tidy.default_config = /usr/local/lib/php/default.tcfg ; Should tidy clean and repair output automatically? ; WARNING: Do not use this option if you are generating non-html content ; such as dynamic images ; http://php.net/tidy.clean-output tidy.clean_output = Off [soap] ; Enables or disables WSDL caching feature. ; http://php.net/soap.wsdl-cache-enabled soap.wsdl_cache_enabled=1 ; Sets the directory name where SOAP extension will put cache files. ; http://php.net/soap.wsdl-cache-dir soap.wsdl_cache_dir="/tmp" ; (time to live) Sets the number of second while cached file will be used ; instead of original one. ; http://php.net/soap.wsdl-cache-ttl soap.wsdl_cache_ttl=86400 ; Sets the size of the cache limit. (Max. number of WSDL files to cache) soap.wsdl_cache_limit = 5 [sysvshm] ; A default size of the shared memory segment ;sysvshm.init_mem = 10000 [ldap] ; Sets the maximum number of open links or -1 for unlimited. ldap.max_links = -1 [dba] ;dba.default_handler= [opcache] ; Determines if Zend OPCache is enabled ;opcache.enable=1 ; Determines if Zend OPCache is enabled for the CLI version of PHP ;opcache.enable_cli=0 ; The OPcache shared memory storage size. ;opcache.memory_consumption=128 ; The amount of memory for interned strings in Mbytes. ;opcache.interned_strings_buffer=8 ; The maximum number of keys (scripts) in the OPcache hash table. ; Only numbers between 200 and 1000000 are allowed. ;opcache.max_accelerated_files=10000 ; The maximum percentage of "wasted" memory until a restart is scheduled. ;opcache.max_wasted_percentage=5 ; When this directive is enabled, the OPcache appends the current working ; directory to the script key, thus eliminating possible collisions between ; files with the same name (basename). Disabling the directive improves ; performance, but may break existing applications. ;opcache.use_cwd=1 ; When disabled, you must reset the OPcache manually or restart the ; webserver for changes to the filesystem to take effect. ;opcache.validate_timestamps=1 ; How often (in seconds) to check file timestamps for changes to the shared ; memory storage allocation. ("1" means validate once per second, but only ; once per request. "0" means always validate) ;opcache.revalidate_freq=2 ; Enables or disables file search in include_path optimization ;opcache.revalidate_path=0 ; If disabled, all PHPDoc comments are dropped from the code to reduce the ; size of the optimized code. ;opcache.save_comments=1 ; Allow file existence override (file_exists, etc.) performance feature. ;opcache.enable_file_override=0 ; A bitmask, where each bit enables or disables the appropriate OPcache ; passes ;opcache.optimization_level=0x7FFFBFFF ;opcache.dups_fix=0 ; The location of the OPcache blacklist file (wildcards allowed). ; Each OPcache blacklist file is a text file that holds the names of files ; that should not be accelerated. The file format is to add each filename ; to a new line. The filename may be a full path or just a file prefix ; (i.e., /var/www/x blacklists all the files and directories in /var/www ; that start with 'x'). Line starting with a ; are ignored (comments). ;opcache.blacklist_filename= ; Allows exclusion of large files from being cached. By default all files ; are cached. ;opcache.max_file_size=0 ; Check the cache checksum each N requests. ; The default value of "0" means that the checks are disabled. ;opcache.consistency_checks=0 ; How long to wait (in seconds) for a scheduled restart to begin if the cache ; is not being accessed. ;opcache.force_restart_timeout=180 ; OPcache error_log file name. Empty string assumes "stderr". ;opcache.error_log= ; All OPcache errors go to the Web server log. ; By default, only fatal errors (level 0) or errors (level 1) are logged. ; You can also enable warnings (level 2), info messages (level 3) or ; debug messages (level 4). ;opcache.log_verbosity_level=1 ; Preferred Shared Memory back-end. Leave empty and let the system decide. ;opcache.preferred_memory_model= ; Protect the shared memory from unexpected writing during script execution. ; Useful for internal debugging only. ;opcache.protect_memory=0 ; Allows calling OPcache API functions only from PHP scripts which path is ; started from specified string. The default "" means no restriction ;opcache.restrict_api= ; Mapping base of shared memory segments (for Windows only). All the PHP ; processes have to map shared memory into the same address space. This ; directive allows to manually fix the "Unable to reattach to base address" ; errors. ;opcache.mmap_base= ; Facilitates multiple OPcache instances per user (for Windows only). All PHP ; processes with the same cache ID and user share an OPcache instance. ;opcache.cache_id= ; Enables and sets the second level cache directory. ; It should improve performance when SHM memory is full, at server restart or ; SHM reset. The default "" disables file based caching. ;opcache.file_cache= ; Enables or disables opcode caching in shared memory. ;opcache.file_cache_only=0 ; Enables or disables checksum validation when script loaded from file cache. ;opcache.file_cache_consistency_checks=1 ; Implies opcache.file_cache_only=1 for a certain process that failed to ; reattach to the shared memory (for Windows only). Explicitly enabled file ; cache is required. ;opcache.file_cache_fallback=1 ; Enables or disables copying of PHP code (text segment) into HUGE PAGES. ; This should improve performance, but requires appropriate OS configuration. ;opcache.huge_code_pages=0 ; Validate cached file permissions. ;opcache.validate_permission=0 ; Prevent name collisions in chroot'ed environment. ;opcache.validate_root=0 ; If specified, it produces opcode dumps for debugging different stages of ; optimizations. ;opcache.opt_debug_level=0 ; Specifies a PHP script that is going to be compiled and executed at server ; start-up. ; http://php.net/opcache.preload ;opcache.preload= ; Preloading code as root is not allowed for security reasons. This directive ; facilitates to let the preloading to be run as another user. ; http://php.net/opcache.preload_user ;opcache.preload_user= ; Prevents caching files that are less than this number of seconds old. It ; protects from caching of incompletely updated files. In case all file updates ; on your site are atomic, you may increase performance by setting it to "0". ;opcache.file_update_protection=2 ; Absolute path used to store shared lockfiles (for *nix only). ;opcache.lockfile_path=/tmp [curl] ; A default value for the CURLOPT_CAINFO option. This is required to be an ; absolute path. ;curl.cainfo = [openssl] ; The location of a Certificate Authority (CA) file on the local filesystem ; to use when verifying the identity of SSL/TLS peers. Most users should ; not specify a value for this directive as PHP will attempt to use the ; OS-managed cert stores in its absence. If specified, this value may still ; be overridden on a per-stream basis via the "cafile" SSL stream context ; option. ;openssl.cafile= ; If openssl.cafile is not specified or if the CA file is not found, the ; directory pointed to by openssl.capath is searched for a suitable ; certificate. This value must be a correctly hashed certificate directory. ; Most users should not specify a value for this directive as PHP will ; attempt to use the OS-managed cert stores in its absence. If specified, ; this value may still be overridden on a per-stream basis via the "capath" ; SSL stream context option. ;openssl.capath= [ffi] ; FFI API restriction. Possible values: ; "preload" - enabled in CLI scripts and preloaded files (default) ; "false" - always disabled ; "true" - always enabled ;ffi.enable=preload ; List of headers files to preload, wildcard patterns allowed. ;ffi.preload= ; Local Variables: ; tab-width: 4 ; End: [Zend] zend_extension="/usr/local/ioncube/ioncube_loader_lin_7.4.so" ; fix for segfaults auto_globals_jit = Off cgi.fix_pathinfo = 1 mbstring.http_input = "pass" mbstring.http_output = "pass" mbstring.encoding_translation = 0 ; Enable Extensions extension=uploadprogress.so extension=imagick.so extension=jsmin.so extension=redis.so ; APCu extension=apcu.so apc.enable_cli=1 apc.gc_ttl=300 apc.shm_segments=1 apc.shm_size=256M apc.slam_defense=0 apc.ttl=0 ; ================================================ FILE: aegir/conf/php/php80-cli.ini ================================================ [PHP] ;;;;;;;;;;;;;;;;;;; ; About php.ini ; ;;;;;;;;;;;;;;;;;;; ; PHP's initialization file, generally called php.ini, is responsible for ; configuring many of the aspects of PHP's behavior. ; PHP attempts to find and load this configuration from a number of locations. ; The following is a summary of its search order: ; 1. SAPI module specific location. ; 2. The PHPRC environment variable. (As of PHP 5.2.0) ; 3. A number of predefined registry keys on Windows (As of PHP 5.2.0) ; 4. Current working directory (except CLI) ; 5. The web server's directory (for SAPI modules), or directory of PHP ; (otherwise in Windows) ; 6. The directory from the --with-config-file-path compile time option, or the ; Windows directory (usually C:\windows) ; See the PHP docs for more specific information. ; http://php.net/configuration.file ; The syntax of the file is extremely simple. Whitespace and lines ; beginning with a semicolon are silently ignored (as you probably guessed). ; Section headers (e.g. [Foo]) are also silently ignored, even though ; they might mean something in the future. ; Directives following the section heading [PATH=/www/mysite] only ; apply to PHP files in the /www/mysite directory. Directives ; following the section heading [HOST=www.example.com] only apply to ; PHP files served from www.example.com. Directives set in these ; special sections cannot be overridden by user-defined INI files or ; at runtime. Currently, [PATH=] and [HOST=] sections only work under ; CGI/FastCGI. ; http://php.net/ini.sections ; Directives are specified using the following syntax: ; directive = value ; Directive names are *case sensitive* - foo=bar is different from FOO=bar. ; Directives are variables used to configure PHP or PHP extensions. ; There is no name validation. If PHP can't find an expected ; directive because it is not set or is mistyped, a default value will be used. ; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one ; of the INI constants (On, Off, True, False, Yes, No and None) or an expression ; (e.g. E_ALL & ~E_NOTICE), a quoted string ("bar"), or a reference to a ; previously set variable or directive (e.g. ${foo}) ; Expressions in the INI file are limited to bitwise operators and parentheses: ; | bitwise OR ; ^ bitwise XOR ; & bitwise AND ; ~ bitwise NOT ; ! boolean NOT ; Boolean flags can be turned on using the values 1, On, True or Yes. ; They can be turned off using the values 0, Off, False or No. ; An empty string can be denoted by simply not writing anything after the equal ; sign, or by using the None keyword: ; foo = ; sets foo to an empty string ; foo = None ; sets foo to an empty string ; foo = "None" ; sets foo to the string 'None' ; If you use constants in your value, and these constants belong to a ; dynamically loaded extension (either a PHP extension or a Zend extension), ; you may only use these constants *after* the line that loads the extension. ;;;;;;;;;;;;;;;;;;; ; About this file ; ;;;;;;;;;;;;;;;;;;; ; PHP comes packaged with two INI files. One that is recommended to be used ; in production environments and one that is recommended to be used in ; development environments. ; php.ini-production contains settings which hold security, performance and ; best practices at its core. But please be aware, these settings may break ; compatibility with older or less security conscience applications. We ; recommending using the production ini in production and testing environments. ; php.ini-development is very similar to its production variant, except it is ; much more verbose when it comes to errors. We recommend using the ; development version only in development environments, as errors shown to ; application users can inadvertently leak otherwise secure information. ; This is the php.ini-production INI file. ;;;;;;;;;;;;;;;;;;; ; Quick Reference ; ;;;;;;;;;;;;;;;;;;; ; The following are all the settings which are different in either the production ; or development versions of the INIs with respect to PHP's default behavior. ; Please see the actual settings later in the document for more details as to why ; we recommend these changes in PHP's behavior. display_errors = Off ; Default Value: On ; Development Value: On ; Production Value: Off ; display_startup_errors ; Default Value: On ; Development Value: On ; Production Value: Off ; error_reporting ; Default Value: E_ALL ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; log_errors ; Default Value: Off ; Development Value: On ; Production Value: On ; max_input_time ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; output_buffering ; Default Value: Off ; Development Value: 4096 ; Production Value: 4096 ; register_argc_argv ; Default Value: On ; Development Value: Off ; Production Value: Off ; request_order ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; session.gc_divisor ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; session.sid_bits_per_character ; Default Value: 4 ; Development Value: 5 ; Production Value: 5 ; short_open_tag ; Default Value: On ; Development Value: Off ; Production Value: Off ; variables_order ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS" ; zend.exception_ignore_args ; Default Value: Off ; Development Value: Off ; Production Value: On ; zend.exception_string_param_max_len ; Default Value: 15 ; Development Value: 15 ; Production Value: 0 ;;;;;;;;;;;;;;;;;;;; ; php.ini Options ; ;;;;;;;;;;;;;;;;;;;; ; Name for user-defined php.ini (.htaccess) files. Default is ".user.ini" ;user_ini.filename = ".user.ini" ; To disable this feature set this option to an empty value user_ini.filename = ; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes) ;user_ini.cache_ttl = 300 ;;;;;;;;;;;;;;;;;;;; ; Language Options ; ;;;;;;;;;;;;;;;;;;;; ; Enable the PHP scripting language engine under Apache. ; http://php.net/engine engine = On ; This directive determines whether or not PHP will recognize code between ; tags as PHP source which should be processed as such. It is ; generally recommended that should be used and that this feature ; should be disabled, as enabling it may result in issues when generating XML ; documents, however this remains supported for backward compatibility reasons. ; Note that this directive does not control the would work. ; http://php.net/syntax-highlighting ;highlight.string = #DD0000 ;highlight.comment = #FF9900 ;highlight.keyword = #007700 ;highlight.default = #0000BB ;highlight.html = #000000 ; If enabled, the request will be allowed to complete even if the user aborts ; the request. Consider enabling it if executing long requests, which may end up ; being interrupted by the user or a browser timing out. PHP's default behavior ; is to disable this feature. ; http://php.net/ignore-user-abort ;ignore_user_abort = On ; Determines the size of the realpath cache to be used by PHP. This value should ; be increased on systems where PHP opens many files to reflect the quantity of ; the file operations performed. ; Note: if open_basedir is set, the cache is disabled ; http://php.net/realpath-cache-size realpath_cache_size=64M ; Duration of time, in seconds for which to cache realpath information for a given ; file or directory. For systems with rarely changing files, consider increasing this ; value. ; http://php.net/realpath-cache-ttl realpath_cache_ttl=5 ; Enables or disables the circular reference collector. ; http://php.net/zend.enable-gc zend.enable_gc = On ; If enabled, scripts may be written in encodings that are incompatible with ; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such ; encodings. To use this feature, mbstring extension must be enabled. ;zend.multibyte = Off ; Allows to set the default encoding for the scripts. This value will be used ; unless "declare(encoding=...)" directive appears at the top of the script. ; Only affects if zend.multibyte is set. ;zend.script_encoding = ; Allows to include or exclude arguments from stack traces generated for exceptions. ; In production, it is recommended to turn this setting on to prohibit the output ; of sensitive information in stack traces ; Default Value: Off ; Development Value: Off ; Production Value: On zend.exception_ignore_args = On ; Allows setting the maximum string length in an argument of a stringified stack trace ; to a value between 0 and 1000000. ; This has no effect when zend.exception_ignore_args is enabled. ; Default Value: 15 ; Development Value: 15 ; Production Value: 0 ; In production, it is recommended to set this to 0 to reduce the output ; of sensitive information in stack traces. zend.exception_string_param_max_len = 0 ;;;;;;;;;;;;;;;;; ; Miscellaneous ; ;;;;;;;;;;;;;;;;; ; Decides whether PHP may expose the fact that it is installed on the server ; (e.g. by adding its signature to the Web server header). It is no security ; threat in any way, but it makes it possible to determine whether you use PHP ; on your server or not. ; http://php.net/expose-php expose_php = On ;;;;;;;;;;;;;;;;;;; ; Resource Limits ; ;;;;;;;;;;;;;;;;;;; ; Maximum execution time of each script, in seconds ; http://php.net/max-execution-time ; Note: This directive is hardcoded to 0 for the CLI SAPI max_execution_time = 3600 ; Maximum amount of time each script may spend parsing request data. It's a good ; idea to limit this time on productions servers in order to eliminate unexpectedly ; long running scripts. ; Note: This directive is hardcoded to -1 for the CLI SAPI ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; http://php.net/max-input-time max_input_time = 3600 ; Maximum input variable nesting level ; http://php.net/max-input-nesting-level ;max_input_nesting_level = 64 ; How many GET/POST/COOKIE input variables may be accepted max_input_vars = 9999 ; Maximum amount of memory a script may consume ; http://php.net/memory-limit memory_limit = 395M ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; Error handling and logging ; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; This directive informs PHP of which errors, warnings and notices you would like ; it to take action for. The recommended way of setting values for this ; directive is through the use of the error level constants and bitwise ; operators. The error level constants are below here for convenience as well as ; some common settings and their meanings. ; By default, PHP is set to take action on all errors, notices and warnings EXCEPT ; those related to E_NOTICE and E_STRICT, which together cover best practices and ; recommended coding standards in PHP. For performance reasons, this is the ; recommend error reporting setting. Your production server shouldn't be wasting ; resources complaining about best practices and coding standards. That's what ; development servers and development settings are for. ; Note: The php.ini-development file has this setting as E_ALL. This ; means it pretty much reports everything which is exactly what you want during ; development and early testing. ; ; Error Level Constants: ; E_ALL - All errors and warnings (includes E_STRICT as of PHP 5.4.0) ; E_ERROR - fatal run-time errors ; E_RECOVERABLE_ERROR - almost fatal run-time errors ; E_WARNING - run-time warnings (non-fatal errors) ; E_PARSE - compile-time parse errors ; E_NOTICE - run-time notices (these are warnings which often result ; from a bug in your code, but it's possible that it was ; intentional (e.g., using an uninitialized variable and ; relying on the fact it is automatically initialized to an ; empty string) ; E_STRICT - run-time notices, enable to have PHP suggest changes ; to your code which will ensure the best interoperability ; and forward compatibility of your code ; E_CORE_ERROR - fatal errors that occur during PHP's initial startup ; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's ; initial startup ; E_COMPILE_ERROR - fatal compile-time errors ; E_COMPILE_WARNING - compile-time warnings (non-fatal errors) ; E_USER_ERROR - user-generated error message ; E_USER_WARNING - user-generated warning message ; E_USER_NOTICE - user-generated notice message ; E_DEPRECATED - warn about code that will not work in future versions ; of PHP ; E_USER_DEPRECATED - user-generated deprecation warnings ; ; Common Values: ; E_ALL (Show all errors, warnings and notices including coding standards.) ; E_ALL & ~E_NOTICE (Show all errors, except for notices) ; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.) ; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors) ; Default Value: E_ALL ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; http://php.net/error-reporting error_reporting = 1 ; This directive controls whether or not and where PHP will output errors, ; notices and warnings too. Error output is very useful during development, but ; it could be very dangerous in production environments. Depending on the code ; which is triggering the error, sensitive information could potentially leak ; out of your application such as database usernames and passwords or worse. ; For production environments, we recommend logging errors rather than ; sending them to STDOUT. ; Possible Values: ; Off = Do not display any errors ; stderr = Display errors to STDERR (affects only CGI/CLI binaries!) ; On or stdout = Display errors to STDOUT ; Default Value: On ; Development Value: On ; Production Value: Off ; http://php.net/display-errors display_errors = Off ; The display of errors which occur during PHP's startup sequence are handled ; separately from display_errors. We strongly recommend you set this to 'off' ; for production servers to avoid leaking configuration details. ; Default Value: On ; Development Value: On ; Production Value: Off ; http://php.net/display-startup-errors display_startup_errors = Off ; Besides displaying errors, PHP can also log errors to locations such as a ; server-specific log, STDERR, or a location specified by the error_log ; directive found below. While errors should not be displayed on productions ; servers they should still be monitored and logging is a great way to do that. ; Default Value: Off ; Development Value: On ; Production Value: On ; http://php.net/log-errors log_errors = On ; Set maximum length of log_errors. In error_log information about the source is ; added. The default is 1024 and 0 allows to not apply any maximum length at all. ; http://php.net/log-errors-max-len log_errors_max_len = 1024 ; Do not log repeated messages. Repeated errors must occur in same file on same ; line unless ignore_repeated_source is set true. ; http://php.net/ignore-repeated-errors ignore_repeated_errors = Off ; Ignore source of message when ignoring repeated messages. When this setting ; is On you will not log errors with repeated messages from different files or ; source lines. ; http://php.net/ignore-repeated-source ignore_repeated_source = Off ; If this parameter is set to Off, then memory leaks will not be shown (on ; stdout or in the log). This is only effective in a debug compile, and if ; error reporting includes E_WARNING in the allowed list ; http://php.net/report-memleaks report_memleaks = On ; This setting is off by default. ;report_zend_debug = 0 ; Turn off normal error reporting and emit XML-RPC error XML ; http://php.net/xmlrpc-errors ;xmlrpc_errors = 0 ; An XML-RPC faultCode ;xmlrpc_error_number = 0 ; When PHP displays or logs an error, it has the capability of formatting the ; error message as HTML for easier reading. This directive controls whether ; the error message is formatted as HTML or not. ; Note: This directive is hardcoded to Off for the CLI SAPI ; http://php.net/html-errors html_errors = Off ; If html_errors is set to On *and* docref_root is not empty, then PHP ; produces clickable error messages that direct to a page describing the error ; or function causing the error in detail. ; You can download a copy of the PHP manual from http://php.net/docs ; and change docref_root to the base URL of your local copy including the ; leading '/'. You must also specify the file extension being used including ; the dot. PHP's default behavior is to leave these settings empty, in which ; case no links to documentation are generated. ; Note: Never use this feature for production boxes. ; http://php.net/docref-root ; Examples ;docref_root = "/phpmanual/" ; http://php.net/docref-ext ;docref_ext = .html ; String to output before an error message. PHP's default behavior is to leave ; this setting blank. ; http://php.net/error-prepend-string ; Example: ;error_prepend_string = "" ; String to output after an error message. PHP's default behavior is to leave ; this setting blank. ; http://php.net/error-append-string ; Example: ;error_append_string = "" ; Log errors to specified file. PHP's default behavior is to leave this value ; empty. ; http://php.net/error-log ; Example: ;error_log = php_errors.log ; Log errors to syslog (Event Log on Windows). ;error_log = syslog error_log = /var/log/php/error_log_cli_80 ; The syslog ident is a string which is prepended to every message logged ; to syslog. Only used when error_log is set to syslog. ;syslog.ident = php ; The syslog facility is used to specify what type of program is logging ; the message. Only used when error_log is set to syslog. ;syslog.facility = user ; Set this to disable filtering control characters (the default). ; Some loggers only accept NVT-ASCII, others accept anything that's not ; control characters. If your logger accepts everything, then no filtering ; is needed at all. ; Allowed values are: ; ascii (all printable ASCII characters and NL) ; no-ctrl (all characters except control characters) ; all (all characters) ; raw (like "all", but messages are not split at newlines) ; http://php.net/syslog.filter ;syslog.filter = ascii ;windows.show_crt_warning ; Default value: 0 ; Development value: 0 ; Production value: 0 ;;;;;;;;;;;;;;;;; ; Data Handling ; ;;;;;;;;;;;;;;;;; ; The separator used in PHP generated URLs to separate arguments. ; PHP's default setting is "&". ; http://php.net/arg-separator.output ; Example: ;arg_separator.output = "&" ; List of separator(s) used by PHP to parse input URLs into variables. ; PHP's default setting is "&". ; NOTE: Every character in this directive is considered as separator! ; http://php.net/arg-separator.input ; Example: ;arg_separator.input = ";&" ; This directive determines which super global arrays are registered when PHP ; starts up. G,P,C,E & S are abbreviations for the following respective super ; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty ; paid for the registration of these arrays and because ENV is not as commonly ; used as the others, ENV is not recommended on productions servers. You ; can still get access to the environment variables through getenv() should you ; need to. ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS"; ; http://php.net/variables-order variables_order = "GPCS" ; This directive determines which super global data (G,P & C) should be ; registered into the super global array REQUEST. If so, it also determines ; the order in which that data is registered. The values for this directive ; are specified in the same manner as the variables_order directive, ; EXCEPT one. Leaving this value empty will cause PHP to use the value set ; in the variables_order directive. It does not mean it will leave the super ; globals array REQUEST empty. ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; http://php.net/request-order request_order = "GP" ; This directive determines whether PHP registers $argv & $argc each time it ; runs. $argv contains an array of all the arguments passed to PHP when a script ; is invoked. $argc contains an integer representing the number of arguments ; that were passed when the script was invoked. These arrays are extremely ; useful when running scripts from the command line. When this directive is ; enabled, registering these variables consumes CPU cycles and memory each time ; a script is executed. For performance reasons, this feature should be disabled ; on production servers. ; Note: This directive is hardcoded to On for the CLI SAPI ; Default Value: On ; Development Value: Off ; Production Value: Off ; http://php.net/register-argc-argv register_argc_argv = Off ; When enabled, the ENV, REQUEST and SERVER variables are created when they're ; first used (Just In Time) instead of when the script starts. If these ; variables are not used within a script, having this directive on will result ; in a performance gain. The PHP directive register_argc_argv must be disabled ; for this directive to have any effect. ; http://php.net/auto-globals-jit auto_globals_jit = On ; Whether PHP will read the POST data. ; This option is enabled by default. ; Most likely, you won't want to disable this option globally. It causes $_POST ; and $_FILES to always be empty; the only way you will be able to read the ; POST data will be through the php://input stream wrapper. This can be useful ; to proxy requests or to process the POST data in a memory efficient fashion. ; http://php.net/enable-post-data-reading ;enable_post_data_reading = Off ; Maximum size of POST data that PHP will accept. ; Its value may be 0 to disable the limit. It is ignored if POST data reading ; is disabled through enable_post_data_reading. ; http://php.net/post-max-size post_max_size = 350M ; Automatically add files before PHP document. ; http://php.net/auto-prepend-file auto_prepend_file = ; Automatically add files after PHP document. ; http://php.net/auto-append-file auto_append_file = ; By default, PHP will output a media type using the Content-Type header. To ; disable this, simply set it to be empty. ; ; PHP's built-in default media type is set to text/html. ; http://php.net/default-mimetype default_mimetype = "text/html" ; PHP's default character set is set to UTF-8. ; http://php.net/default-charset default_charset = "UTF-8" ; PHP internal character encoding is set to empty. ; If empty, default_charset is used. ; http://php.net/internal-encoding ;internal_encoding = ; PHP input character encoding is set to empty. ; If empty, default_charset is used. ; http://php.net/input-encoding ;input_encoding = ; PHP output character encoding is set to empty. ; If empty, default_charset is used. ; See also output_buffer. ; http://php.net/output-encoding ;output_encoding = ;;;;;;;;;;;;;;;;;;;;;;;;; ; Paths and Directories ; ;;;;;;;;;;;;;;;;;;;;;;;;; ; UNIX: "/path1:/path2" ;include_path = ".:/php/includes" ; ; Windows: "\path1;\path2" ;include_path = ".;c:\php\includes" ; ; PHP's default setting for include_path is ".;/path/to/php/pear" ; http://php.net/include-path include_path = ".:/opt/php80/lib/php" ; The root of the PHP pages, used only if nonempty. ; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root ; if you are running php as a CGI under any web server (other than IIS) ; see documentation for security issues. The alternate is to use the ; cgi.force_redirect configuration below ; http://php.net/doc-root doc_root = ; The directory under which PHP opens the script using /~username used only ; if nonempty. ; http://php.net/user-dir user_dir = ; Directory in which the loadable extensions (modules) reside. ; http://php.net/extension-dir ;extension_dir = "./" ; On windows: ;extension_dir = "ext" extension_dir = "/opt/php80/lib/php/extensions/no-debug-non-zts-20200930/" ; Directory where the temporary files should be placed. ; Defaults to the system default (see sys_get_temp_dir) sys_temp_dir = "/tmp" ; Whether or not to enable the dl() function. The dl() function does NOT work ; properly in multithreaded servers, such as IIS or Zeus, and is automatically ; disabled on them. ; http://php.net/enable-dl enable_dl = Off ; cgi.force_redirect is necessary to provide security running PHP as a CGI under ; most web servers. Left undefined, PHP turns this on by default. You can ; turn it off here AT YOUR OWN RISK ; **You CAN safely turn this off for IIS, in fact, you MUST.** ; http://php.net/cgi.force-redirect ;cgi.force_redirect = 1 ; if cgi.nph is enabled it will force cgi to always sent Status: 200 with ; every request. PHP's default behavior is to disable this feature. ;cgi.nph = 1 ; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape ; (iPlanet) web servers, you MAY need to set an environment variable name that PHP ; will look for to know it is OK to continue execution. Setting this variable MAY ; cause security issues, KNOW WHAT YOU ARE DOING FIRST. ; http://php.net/cgi.redirect-status-env ;cgi.redirect_status_env = ; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's ; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok ; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting ; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting ; of zero causes PHP to behave as before. Default is 1. You should fix your scripts ; to use SCRIPT_FILENAME rather than PATH_TRANSLATED. ; http://php.net/cgi.fix-pathinfo ;cgi.fix_pathinfo=1 ; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside ; of the web tree and people will not be able to circumvent .htaccess security. ;cgi.discard_path=1 ; FastCGI under IIS supports the ability to impersonate ; security tokens of the calling client. This allows IIS to define the ; security context that the request runs under. mod_fastcgi under Apache ; does not currently support this feature (03/17/2002) ; Set to 1 if running under IIS. Default is zero. ; http://php.net/fastcgi.impersonate ;fastcgi.impersonate = 1 ; Disable logging through FastCGI connection. PHP's default behavior is to enable ; this feature. ;fastcgi.logging = 0 ; cgi.rfc2616_headers configuration option tells PHP what type of headers to ; use when sending HTTP response code. If set to 0, PHP sends Status: header that ; is supported by Apache. When this option is set to 1, PHP will send ; RFC2616 compliant header. ; Default is zero. ; http://php.net/cgi.rfc2616-headers ;cgi.rfc2616_headers = 0 ; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #! ; (shebang) at the top of the running script. This line might be needed if the ; script support running both as stand-alone script and via PHP CGI<. PHP in CGI ; mode skips this line and ignores its content if this directive is turned on. ; http://php.net/cgi.check-shebang-line ;cgi.check_shebang_line=1 ;;;;;;;;;;;;;;;; ; File Uploads ; ;;;;;;;;;;;;;;;; ; Whether to allow HTTP file uploads. ; http://php.net/file-uploads file_uploads = On ; Temporary directory for HTTP uploaded files (will use system default if not ; specified). ; http://php.net/upload-tmp-dir upload_tmp_dir = /tmp ; Maximum allowed size for uploaded files. ; http://php.net/upload-max-filesize upload_max_filesize = 325M ; Maximum number of files that can be uploaded via a single request max_file_uploads = 50 ;;;;;;;;;;;;;;;;;; ; Fopen wrappers ; ;;;;;;;;;;;;;;;;;; ; Whether to allow the treatment of URLs (like http:// or ftp://) as files. ; http://php.net/allow-url-fopen allow_url_fopen = On ; Whether to allow include/require to open URLs (like http:// or ftp://) as files. ; http://php.net/allow-url-include allow_url_include = Off ; Define the anonymous ftp password (your email address). PHP's default setting ; for this is empty. ; http://php.net/from ;from="john@doe.com" ; Define the User-Agent string. PHP's default setting for this is empty. ; http://php.net/user-agent ;user_agent="PHP" ; Default timeout for socket based streams (seconds) ; http://php.net/default-socket-timeout default_socket_timeout = 3600 ; If your scripts have to deal with files from Macintosh systems, ; or you are running on a Mac and need to deal with files from ; unix or win32 systems, setting this flag will cause PHP to ; automatically detect the EOL character in those files so that ; fgets() and file() will work regardless of the source of the file. ; http://php.net/auto-detect-line-endings auto_detect_line_endings = On ;;;;;;;;;;;;;;;;;;;;;; ; Dynamic Extensions ; ;;;;;;;;;;;;;;;;;;;;;; ; If you wish to have an extension loaded automatically, use the following ; syntax: ; ; extension=modulename ; ; For example: ; ; extension=mysqli ; ; When the extension library to load is not located in the default extension ; directory, You may specify an absolute path to the library file: ; ; extension=/path/to/extension/mysqli.so ; ; Note : The syntax used in previous PHP versions ('extension=.so' and ; 'extension='php_.dll') is supported for legacy reasons and may be ; deprecated in a future PHP major version. So, when it is possible, please ; move to the new ('extension=) syntax. ; ; Notes for Windows environments : ; ; - Many DLL files are located in the extensions/ (PHP 4) or ext/ (PHP 5+) ; extension folders as well as the separate PECL DLL download (PHP 5+). ; Be sure to appropriately set the extension_dir directive. ; ;extension=bz2 ;extension=curl ;extension=ffi ;extension=ftp ;extension=fileinfo ;extension=gd ;extension=gettext ;extension=gmp ;extension=intl ;extension=imap ;extension=ldap ;extension=mbstring ;extension=exif ; Must be after mbstring as it depends on it ;extension=mysqli ;extension=oci8_12c ; Use with Oracle Database 12c Instant Client ;extension=oci8_19 ; Use with Oracle Database 19 Instant Client ;extension=odbc ;extension=openssl ;extension=pdo_firebird ;extension=pdo_mysql ;extension=pdo_oci ;extension=pdo_odbc ;extension=pdo_pgsql ;extension=pdo_sqlite ;extension=pgsql ;extension=shmop ; The MIBS data available in the PHP distribution must be installed. ; See http://www.php.net/manual/en/snmp.installation.php ;extension=snmp ;extension=soap ;extension=sockets ;extension=sodium ;extension=sqlite3 ;extension=tidy ;extension=xsl ;zend_extension=opcache ;;;;;;;;;;;;;;;;;;; ; Module Settings ; ;;;;;;;;;;;;;;;;;;; [CLI Server] ; Whether the CLI web server uses ANSI color coding in its terminal output. cli_server.color = On [Date] ; Defines the default timezone used by the date functions ; http://php.net/date.timezone date.timezone = "UTC" ; http://php.net/date.default-latitude ;date.default_latitude = 31.7667 ; http://php.net/date.default-longitude ;date.default_longitude = 35.2333 ; http://php.net/date.sunrise-zenith ;date.sunrise_zenith = 90.833333 ; http://php.net/date.sunset-zenith ;date.sunset_zenith = 90.833333 [filter] ; http://php.net/filter.default ;filter.default = unsafe_raw ; http://php.net/filter.default-flags ;filter.default_flags = [iconv] ; Use of this INI entry is deprecated, use global input_encoding instead. ; If empty, default_charset or input_encoding or iconv.input_encoding is used. ; The precedence is: default_charset < input_encoding < iconv.input_encoding ;iconv.input_encoding = ; Use of this INI entry is deprecated, use global internal_encoding instead. ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;iconv.internal_encoding = ; Use of this INI entry is deprecated, use global output_encoding instead. ; If empty, default_charset or output_encoding or iconv.output_encoding is used. ; The precedence is: default_charset < output_encoding < iconv.output_encoding ; To use an output encoding conversion, iconv's output handler must be set ; otherwise output encoding conversion cannot be performed. ;iconv.output_encoding = [imap] ; rsh/ssh logins are disabled by default. Use this INI entry if you want to ; enable them. Note that the IMAP library does not filter mailbox names before ; passing them to rsh/ssh command, thus passing untrusted data to this function ; with rsh/ssh enabled is insecure. ;imap.enable_insecure_rsh=0 [intl] ;intl.default_locale = ; This directive allows you to produce PHP errors when some error ; happens within intl functions. The value is the level of the error produced. ; Default is 0, which does not produce any errors. ;intl.error_level = E_WARNING ;intl.use_exceptions = 0 [sqlite3] ; Directory pointing to SQLite3 extensions ; http://php.net/sqlite3.extension-dir ;sqlite3.extension_dir = ; SQLite defensive mode flag (only available from SQLite 3.26+) ; When the defensive flag is enabled, language features that allow ordinary ; SQL to deliberately corrupt the database file are disabled. This forbids ; writing directly to the schema, shadow tables (eg. FTS data tables), or ; the sqlite_dbpage virtual table. ; https://www.sqlite.org/c3ref/c_dbconfig_defensive.html ; (for older SQLite versions, this flag has no use) ;sqlite3.defensive = 1 [Pcre] ; PCRE library backtracking limit. ; http://php.net/pcre.backtrack-limit ;pcre.backtrack_limit=100000 ; PCRE library recursion limit. ; Please note that if you set this value to a high number you may consume all ; the available process stack and eventually crash PHP (due to reaching the ; stack size limit imposed by the Operating System). ; http://php.net/pcre.recursion-limit ;pcre.recursion_limit=100000 ; Enables or disables JIT compilation of patterns. This requires the PCRE ; library to be compiled with JIT support. ;pcre.jit=1 [Pdo] ; Whether to pool ODBC connections. Can be one of "strict", "relaxed" or "off" ; http://php.net/pdo-odbc.connection-pooling ;pdo_odbc.connection_pooling=strict [Pdo_mysql] ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. pdo_mysql.default_socket= [Phar] ; http://php.net/phar.readonly ;phar.readonly = On ; http://php.net/phar.require-hash ;phar.require_hash = On ;phar.cache_list = [mail function] ; For Win32 only. ; http://php.net/smtp ;SMTP = localhost ; http://php.net/smtp-port ;smtp_port = 25 ; For Win32 only. ; http://php.net/sendmail-from ;sendmail_from = me@example.com ; For Unix only. You may supply arguments as well (default: "sendmail -t -i"). ; http://php.net/sendmail-path sendmail_path = /usr/sbin/sendmail -t -i ; Force the addition of the specified parameters to be passed as extra parameters ; to the sendmail binary. These parameters will always replace the value of ; the 5th parameter to mail(). ;mail.force_extra_parameters = ; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename mail.add_x_header = Off ; The path to a log file that will log all mail() calls. Log entries include ; the full path of the script, line number, To address and headers. ;mail.log = ; Log mail to syslog (Event Log on Windows). ;mail.log = syslog [ODBC] ; http://php.net/odbc.default-db ;odbc.default_db = Not yet implemented ; http://php.net/odbc.default-user ;odbc.default_user = Not yet implemented ; http://php.net/odbc.default-pw ;odbc.default_pw = Not yet implemented ; Controls the ODBC cursor model. ; Default: SQL_CURSOR_STATIC (default). ;odbc.default_cursortype ; Allow or prevent persistent links. ; http://php.net/odbc.allow-persistent odbc.allow_persistent = On ; Check that a connection is still valid before reuse. ; http://php.net/odbc.check-persistent odbc.check_persistent = On ; Maximum number of persistent links. -1 means no limit. ; http://php.net/odbc.max-persistent odbc.max_persistent = -1 ; Maximum number of links (persistent + non-persistent). -1 means no limit. ; http://php.net/odbc.max-links odbc.max_links = -1 ; Handling of LONG fields. Returns number of bytes to variables. 0 means ; passthru. ; http://php.net/odbc.defaultlrl odbc.defaultlrl = 4096 ; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char. ; See the documentation on odbc_binmode and odbc_longreadlen for an explanation ; of odbc.defaultlrl and odbc.defaultbinmode ; http://php.net/odbc.defaultbinmode odbc.defaultbinmode = 1 [MySQLi] ; Maximum number of persistent links. -1 means no limit. ; http://php.net/mysqli.max-persistent mysqli.max_persistent = -1 ; Allow accessing, from PHP's perspective, local files with LOAD DATA statements ; http://php.net/mysqli.allow_local_infile ;mysqli.allow_local_infile = On ; Allow or prevent persistent links. ; http://php.net/mysqli.allow-persistent mysqli.allow_persistent = On ; Maximum number of links. -1 means no limit. ; http://php.net/mysqli.max-links mysqli.max_links = -1 ; Default port number for mysqli_connect(). If unset, mysqli_connect() will use ; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the ; compile-time value defined MYSQL_PORT (in that order). Win32 will only look ; at MYSQL_PORT. ; http://php.net/mysqli.default-port mysqli.default_port = 3306 ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. ; http://php.net/mysqli.default-socket mysqli.default_socket = ; Default host for mysqli_connect() (doesn't apply in safe mode). ; http://php.net/mysqli.default-host mysqli.default_host = ; Default user for mysqli_connect() (doesn't apply in safe mode). ; http://php.net/mysqli.default-user mysqli.default_user = ; Default password for mysqli_connect() (doesn't apply in safe mode). ; Note that this is generally a *bad* idea to store passwords in this file. ; *Any* user with PHP access can run 'echo get_cfg_var("mysqli.default_pw") ; and reveal this password! And of course, any users with read access to this ; file will be able to reveal the password as well. ; http://php.net/mysqli.default-pw mysqli.default_pw = ; Allow or prevent reconnect mysqli.reconnect = Off [mysqlnd] ; Enable / Disable collection of general statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. mysqlnd.collect_statistics = 0 ; Enable / Disable collection of memory usage statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. mysqlnd.collect_memory_statistics = 0 ; Records communication from all extensions using mysqlnd to the specified log ; file. ; http://php.net/mysqlnd.debug ;mysqlnd.debug = ; Defines which queries will be logged. ;mysqlnd.log_mask = 0 ; Default size of the mysqlnd memory pool, which is used by result sets. mysqlnd.mempool_default_size = 64000 ; Size of a pre-allocated buffer used when sending commands to MySQL in bytes. mysqlnd.net_cmd_buffer_size = 8192 ; Size of a pre-allocated buffer used for reading data sent by the server in ; bytes. mysqlnd.net_read_buffer_size = 131072 ; Timeout for network requests in seconds. ;mysqlnd.net_read_timeout = 31536000 ; SHA-256 Authentication Plugin related. File with the MySQL server public RSA ; key. ;mysqlnd.sha256_server_public_key = [OCI8] ; Connection: Enables privileged connections using external ; credentials (OCI_SYSOPER, OCI_SYSDBA) ; http://php.net/oci8.privileged-connect ;oci8.privileged_connect = Off ; Connection: The maximum number of persistent OCI8 connections per ; process. Using -1 means no limit. ; http://php.net/oci8.max-persistent ;oci8.max_persistent = -1 ; Connection: The maximum number of seconds a process is allowed to ; maintain an idle persistent connection. Using -1 means idle ; persistent connections will be maintained forever. ; http://php.net/oci8.persistent-timeout ;oci8.persistent_timeout = -1 ; Connection: The number of seconds that must pass before issuing a ; ping during oci_pconnect() to check the connection validity. When ; set to 0, each oci_pconnect() will cause a ping. Using -1 disables ; pings completely. ; http://php.net/oci8.ping-interval ;oci8.ping_interval = 60 ; Connection: Set this to a user chosen connection class to be used ; for all pooled server requests with Oracle 11g Database Resident ; Connection Pooling (DRCP). To use DRCP, this value should be set to ; the same string for all web servers running the same application, ; the database pool must be configured, and the connection string must ; specify to use a pooled server. ;oci8.connection_class = ; High Availability: Using On lets PHP receive Fast Application ; Notification (FAN) events generated when a database node fails. The ; database must also be configured to post FAN events. ;oci8.events = Off ; Tuning: This option enables statement caching, and specifies how ; many statements to cache. Using 0 disables statement caching. ; http://php.net/oci8.statement-cache-size ;oci8.statement_cache_size = 20 ; Tuning: Enables statement prefetching and sets the default number of ; rows that will be fetched automatically after statement execution. ; http://php.net/oci8.default-prefetch ;oci8.default_prefetch = 100 ; Compatibility. Using On means oci_close() will not close ; oci_connect() and oci_new_connect() connections. ; http://php.net/oci8.old-oci-close-semantics ;oci8.old_oci_close_semantics = Off [PostgreSQL] ; Allow or prevent persistent links. ; http://php.net/pgsql.allow-persistent pgsql.allow_persistent = On ; Detect broken persistent links always with pg_pconnect(). ; Auto reset feature requires a little overheads. ; http://php.net/pgsql.auto-reset-persistent pgsql.auto_reset_persistent = Off ; Maximum number of persistent links. -1 means no limit. ; http://php.net/pgsql.max-persistent pgsql.max_persistent = -1 ; Maximum number of links (persistent+non persistent). -1 means no limit. ; http://php.net/pgsql.max-links pgsql.max_links = -1 ; Ignore PostgreSQL backends Notice message or not. ; Notice message logging require a little overheads. ; http://php.net/pgsql.ignore-notice pgsql.ignore_notice = 0 ; Log PostgreSQL backends Notice message or not. ; Unless pgsql.ignore_notice=0, module cannot log notice message. ; http://php.net/pgsql.log-notice pgsql.log_notice = 0 [bcmath] ; Number of decimal digits for all bcmath functions. ; http://php.net/bcmath.scale bcmath.scale = 0 [browscap] ; http://php.net/browscap ;browscap = extra/browscap.ini [Session] ; Handler used to store/retrieve data. ; http://php.net/session.save-handler session.save_handler = files ; Argument passed to save_handler. In the case of files, this is the path ; where data files are stored. Note: Windows users have to change this ; variable in order to use PHP's session functions. ; ; The path can be defined as: ; ; session.save_path = "N;/path" ; ; where N is an integer. Instead of storing all the session files in ; /path, what this will do is use subdirectories N-levels deep, and ; store the session data in those directories. This is useful if ; your OS has problems with many files in one directory, and is ; a more efficient layout for servers that handle many sessions. ; ; NOTE 1: PHP will not create this directory structure automatically. ; You can use the script in the ext/session dir for that purpose. ; NOTE 2: See the section on garbage collection below if you choose to ; use subdirectories for session storage ; ; The file storage module creates files using mode 600 by default. ; You can change that by using ; ; session.save_path = "N;MODE;/path" ; ; where MODE is the octal representation of the mode. Note that this ; does not overwrite the process's umask. ; http://php.net/session.save-path session.save_path = "/opt/tmp" ; Whether to use strict session mode. ; Strict session mode does not accept an uninitialized session ID, and ; regenerates the session ID if the browser sends an uninitialized session ID. ; Strict mode protects applications from session fixation via a session adoption ; vulnerability. It is disabled by default for maximum compatibility, but ; enabling it is encouraged. ; https://wiki.php.net/rfc/strict_sessions session.use_strict_mode = 0 ; Whether to use cookies. ; http://php.net/session.use-cookies session.use_cookies = 1 ; http://php.net/session.cookie-secure ;session.cookie_secure = ; This option forces PHP to fetch and use a cookie for storing and maintaining ; the session id. We encourage this operation as it's very helpful in combating ; session hijacking when not specifying and managing your own session id. It is ; not the be-all and end-all of session hijacking defense, but it's a good start. ; http://php.net/session.use-only-cookies session.use_only_cookies = 1 ; Name of the session (used as cookie name). ; http://php.net/session.name session.name = PHPSESSID ; Initialize session on request startup. ; http://php.net/session.auto-start session.auto_start = 0 ; Lifetime in seconds of cookie or, if 0, until browser is restarted. ; http://php.net/session.cookie-lifetime session.cookie_lifetime = 0 ; The path for which the cookie is valid. ; http://php.net/session.cookie-path session.cookie_path = / ; The domain for which the cookie is valid. ; http://php.net/session.cookie-domain session.cookie_domain = ; Whether or not to add the httpOnly flag to the cookie, which makes it ; inaccessible to browser scripting languages such as JavaScript. ; http://php.net/session.cookie-httponly session.cookie_httponly = 1 ; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF) ; Current valid values are "Strict", "Lax" or "None". When using "None", ; make sure to include the quotes, as `none` is interpreted like `false` in ini files. ; https://tools.ietf.org/html/draft-west-first-party-cookies-07 session.cookie_samesite = ; Handler used to serialize data. php is the standard serializer of PHP. ; http://php.net/session.serialize-handler session.serialize_handler = php ; Defines the probability that the 'garbage collection' process is started on every ; session initialization. The probability is calculated by using gc_probability/gc_divisor, ; e.g. 1/100 means there is a 1% chance that the GC process starts on each request. ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; http://php.net/session.gc-probability session.gc_probability = 1 ; Defines the probability that the 'garbage collection' process is started on every ; session initialization. The probability is calculated by using gc_probability/gc_divisor, ; e.g. 1/100 means there is a 1% chance that the GC process starts on each request. ; For high volume production servers, using a value of 1000 is a more efficient approach. ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; http://php.net/session.gc-divisor session.gc_divisor = 1000 ; After this number of seconds, stored data will be seen as 'garbage' and ; cleaned up by the garbage collection process. ; http://php.net/session.gc-maxlifetime session.gc_maxlifetime = 1440 ; NOTE: If you are using the subdirectory option for storing session files ; (see session.save_path above), then garbage collection does *not* ; happen automatically. You will need to do your own garbage ; collection through a shell script, cron entry, or some other method. ; For example, the following script is the equivalent of setting ; session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes): ; find /path/to/sessions -cmin +24 -type f | xargs rm ; Check HTTP Referer to invalidate externally stored URLs containing ids. ; HTTP_REFERER has to contain this substring for the session to be ; considered as valid. ; http://php.net/session.referer-check session.referer_check = ; Set to {nocache,private,public,} to determine HTTP caching aspects ; or leave this empty to avoid sending anti-caching headers. ; http://php.net/session.cache-limiter session.cache_limiter = nocache ; Document expires after n minutes. ; http://php.net/session.cache-expire session.cache_expire = 180 ; trans sid support is disabled by default. ; Use of trans sid may risk your users' security. ; Use this option with caution. ; - User may send URL contains active session ID ; to other person via. email/irc/etc. ; - URL that contains active session ID may be stored ; in publicly accessible computer. ; - User may access your site with the same session ID ; always using URL stored in browser's history or bookmarks. ; http://php.net/session.use-trans-sid session.use_trans_sid = 0 ; Set session ID character length. This value could be between 22 to 256. ; Shorter length than default is supported only for compatibility reason. ; Users should use 32 or more chars. ; http://php.net/session.sid-length ; Default Value: 32 ; Development Value: 26 ; Production Value: 26 session.sid_length = 26 ; The URL rewriter will look for URLs in a defined set of HTML tags. ; is special; if you include them here, the rewriter will ; add a hidden field with the info which is otherwise appended ; to URLs. tag's action attribute URL will not be modified ; unless it is specified. ; Note that all valid entries require a "=", even if no value follows. ; Default Value: "a=href,area=href,frame=src,form=" ; Development Value: "a=href,area=href,frame=src,form=" ; Production Value: "a=href,area=href,frame=src,form=" ; http://php.net/url-rewriter.tags session.trans_sid_tags = "a=href,area=href,frame=src,form=" ; URL rewriter does not rewrite absolute URLs by default. ; To enable rewrites for absolute paths, target hosts must be specified ; at RUNTIME. i.e. use ini_set() ; tags is special. PHP will check action attribute's URL regardless ; of session.trans_sid_tags setting. ; If no host is defined, HTTP_HOST will be used for allowed host. ; Example value: php.net,www.php.net,wiki.php.net ; Use "," for multiple hosts. No spaces are allowed. ; Default Value: "" ; Development Value: "" ; Production Value: "" ;session.trans_sid_hosts="" ; Define how many bits are stored in each character when converting ; the binary hash data to something readable. ; Possible values: ; 4 (4 bits: 0-9, a-f) ; 5 (5 bits: 0-9, a-v) ; 6 (6 bits: 0-9, a-z, A-Z, "-", ",") ; Default Value: 4 ; Development Value: 5 ; Production Value: 5 ; http://php.net/session.hash-bits-per-character session.sid_bits_per_character = 5 ; Enable upload progress tracking in $_SESSION ; Default Value: On ; Development Value: On ; Production Value: On ; http://php.net/session.upload-progress.enabled ;session.upload_progress.enabled = On ; Cleanup the progress information as soon as all POST data has been read ; (i.e. upload completed). ; Default Value: On ; Development Value: On ; Production Value: On ; http://php.net/session.upload-progress.cleanup ;session.upload_progress.cleanup = On ; A prefix used for the upload progress key in $_SESSION ; Default Value: "upload_progress_" ; Development Value: "upload_progress_" ; Production Value: "upload_progress_" ; http://php.net/session.upload-progress.prefix ;session.upload_progress.prefix = "upload_progress_" ; The index name (concatenated with the prefix) in $_SESSION ; containing the upload progress information ; Default Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Development Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Production Value: "PHP_SESSION_UPLOAD_PROGRESS" ; http://php.net/session.upload-progress.name ;session.upload_progress.name = "PHP_SESSION_UPLOAD_PROGRESS" ; How frequently the upload progress should be updated. ; Given either in percentages (per-file), or in bytes ; Default Value: "1%" ; Development Value: "1%" ; Production Value: "1%" ; http://php.net/session.upload-progress.freq ;session.upload_progress.freq = "1%" ; The minimum delay between updates, in seconds ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; http://php.net/session.upload-progress.min-freq ;session.upload_progress.min_freq = "1" ; Only write session data when session data is changed. Enabled by default. ; http://php.net/session.lazy-write ;session.lazy_write = On [Assertion] ; Switch whether to compile assertions at all (to have no overhead at run-time) ; -1: Do not compile at all ; 0: Jump over assertion at run-time ; 1: Execute assertions ; Changing from or to a negative value is only possible in php.ini! (For turning assertions on and off at run-time, see assert.active, when zend.assertions = 1) ; Default Value: 1 ; Development Value: 1 ; Production Value: -1 ; http://php.net/zend.assertions zend.assertions = -1 ; Assert(expr); active by default. ; http://php.net/assert.active ;assert.active = On ; Throw an AssertionError on failed assertions ; http://php.net/assert.exception ;assert.exception = On ; Issue a PHP warning for each failed assertion. (Overridden by assert.exception if active) ; http://php.net/assert.warning ;assert.warning = On ; Don't bail out by default. ; http://php.net/assert.bail ;assert.bail = Off ; User-function to be called if an assertion fails. ; http://php.net/assert.callback ;assert.callback = 0 [COM] ; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs ; http://php.net/com.typelib-file ;com.typelib_file = ; allow Distributed-COM calls ; http://php.net/com.allow-dcom ;com.allow_dcom = true ; autoregister constants of a component's typlib on com_load() ; http://php.net/com.autoregister-typelib ;com.autoregister_typelib = true ; register constants casesensitive ; http://php.net/com.autoregister-casesensitive ;com.autoregister_casesensitive = false ; show warnings on duplicate constant registrations ; http://php.net/com.autoregister-verbose ;com.autoregister_verbose = true ; The default character set code-page to use when passing strings to and from COM objects. ; Default: system ANSI code page ;com.code_page= ; The version of the .NET framework to use. The value of the setting are the first three parts ; of the framework's version number, separated by dots, and prefixed with "v", e.g. "v4.0.30319". ;com.dotnet_version= [mbstring] ; language for internal character representation. ; This affects mb_send_mail() and mbstring.detect_order. ; http://php.net/mbstring.language ;mbstring.language = Japanese ; Use of this INI entry is deprecated, use global internal_encoding instead. ; internal/script encoding. ; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*) ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;mbstring.internal_encoding = ; Use of this INI entry is deprecated, use global input_encoding instead. ; http input encoding. ; mbstring.encoding_translation = On is needed to use this setting. ; If empty, default_charset or input_encoding or mbstring.input is used. ; The precedence is: default_charset < input_encoding < mbstring.http_input ; http://php.net/mbstring.http-input ;mbstring.http_input = ; Use of this INI entry is deprecated, use global output_encoding instead. ; http output encoding. ; mb_output_handler must be registered as output buffer to function. ; If empty, default_charset or output_encoding or mbstring.http_output is used. ; The precedence is: default_charset < output_encoding < mbstring.http_output ; To use an output encoding conversion, mbstring's output handler must be set ; otherwise output encoding conversion cannot be performed. ; http://php.net/mbstring.http-output ;mbstring.http_output = ; enable automatic encoding translation according to ; mbstring.internal_encoding setting. Input chars are ; converted to internal encoding by setting this to On. ; Note: Do _not_ use automatic encoding translation for ; portable libs/applications. ; http://php.net/mbstring.encoding-translation ;mbstring.encoding_translation = Off ; automatic encoding detection order. ; "auto" detect order is changed according to mbstring.language ; http://php.net/mbstring.detect-order ;mbstring.detect_order = auto ; substitute_character used when character cannot be converted ; one from another ; http://php.net/mbstring.substitute-character ;mbstring.substitute_character = none ; Enable strict encoding detection. ;mbstring.strict_detection = Off ; This directive specifies the regex pattern of content types for which mb_output_handler() ; is activated. ; Default: mbstring.http_output_conv_mimetypes=^(text/|application/xhtml\+xml) ;mbstring.http_output_conv_mimetypes= ; This directive specifies maximum stack depth for mbstring regular expressions. It is similar ; to the pcre.recursion_limit for PCRE. ;mbstring.regex_stack_limit=100000 ; This directive specifies maximum retry count for mbstring regular expressions. It is similar ; to the pcre.backtrack_limit for PCRE. ;mbstring.regex_retry_limit=1000000 [gd] ; Tell the jpeg decode to ignore warnings and try to create ; a gd image. The warning will then be displayed as notices ; disabled by default ; http://php.net/gd.jpeg-ignore-warning ;gd.jpeg_ignore_warning = 1 [exif] ; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS. ; With mbstring support this will automatically be converted into the encoding ; given by corresponding encode setting. When empty mbstring.internal_encoding ; is used. For the decode settings you can distinguish between motorola and ; intel byte order. A decode setting cannot be empty. ; http://php.net/exif.encode-unicode ;exif.encode_unicode = ISO-8859-15 ; http://php.net/exif.decode-unicode-motorola ;exif.decode_unicode_motorola = UCS-2BE ; http://php.net/exif.decode-unicode-intel ;exif.decode_unicode_intel = UCS-2LE ; http://php.net/exif.encode-jis ;exif.encode_jis = ; http://php.net/exif.decode-jis-motorola ;exif.decode_jis_motorola = JIS ; http://php.net/exif.decode-jis-intel ;exif.decode_jis_intel = JIS [Tidy] ; The path to a default tidy configuration file to use when using tidy ; http://php.net/tidy.default-config ;tidy.default_config = /usr/local/lib/php/default.tcfg ; Should tidy clean and repair output automatically? ; WARNING: Do not use this option if you are generating non-html content ; such as dynamic images ; http://php.net/tidy.clean-output tidy.clean_output = Off [soap] ; Enables or disables WSDL caching feature. ; http://php.net/soap.wsdl-cache-enabled soap.wsdl_cache_enabled=1 ; Sets the directory name where SOAP extension will put cache files. ; http://php.net/soap.wsdl-cache-dir soap.wsdl_cache_dir="/tmp" ; (time to live) Sets the number of second while cached file will be used ; instead of original one. ; http://php.net/soap.wsdl-cache-ttl soap.wsdl_cache_ttl=86400 ; Sets the size of the cache limit. (Max. number of WSDL files to cache) soap.wsdl_cache_limit = 5 [sysvshm] ; A default size of the shared memory segment ;sysvshm.init_mem = 10000 [ldap] ; Sets the maximum number of open links or -1 for unlimited. ldap.max_links = -1 [dba] ;dba.default_handler= [opcache] ; Determines if Zend OPCache is enabled ;opcache.enable=1 ; Determines if Zend OPCache is enabled for the CLI version of PHP ;opcache.enable_cli=0 ; The OPcache shared memory storage size. ;opcache.memory_consumption=128 ; The amount of memory for interned strings in Mbytes. ;opcache.interned_strings_buffer=8 ; The maximum number of keys (scripts) in the OPcache hash table. ; Only numbers between 200 and 1000000 are allowed. ;opcache.max_accelerated_files=10000 ; The maximum percentage of "wasted" memory until a restart is scheduled. ;opcache.max_wasted_percentage=5 ; When this directive is enabled, the OPcache appends the current working ; directory to the script key, thus eliminating possible collisions between ; files with the same name (basename). Disabling the directive improves ; performance, but may break existing applications. ;opcache.use_cwd=1 ; When disabled, you must reset the OPcache manually or restart the ; webserver for changes to the filesystem to take effect. ;opcache.validate_timestamps=1 ; How often (in seconds) to check file timestamps for changes to the shared ; memory storage allocation. ("1" means validate once per second, but only ; once per request. "0" means always validate) ;opcache.revalidate_freq=2 ; Enables or disables file search in include_path optimization ;opcache.revalidate_path=0 ; If disabled, all PHPDoc comments are dropped from the code to reduce the ; size of the optimized code. ;opcache.save_comments=1 ; If enabled, compilation warnings (including notices and deprecations) will ; be recorded and replayed each time a file is included. Otherwise, compilation ; warnings will only be emitted when the file is first cached. ;opcache.record_warnings=0 ; Allow file existence override (file_exists, etc.) performance feature. ;opcache.enable_file_override=0 ; A bitmask, where each bit enables or disables the appropriate OPcache ; passes ;opcache.optimization_level=0x7FFFBFFF ;opcache.dups_fix=0 ; The location of the OPcache blacklist file (wildcards allowed). ; Each OPcache blacklist file is a text file that holds the names of files ; that should not be accelerated. The file format is to add each filename ; to a new line. The filename may be a full path or just a file prefix ; (i.e., /var/www/x blacklists all the files and directories in /var/www ; that start with 'x'). Line starting with a ; are ignored (comments). ;opcache.blacklist_filename= ; Allows exclusion of large files from being cached. By default all files ; are cached. ;opcache.max_file_size=0 ; Check the cache checksum each N requests. ; The default value of "0" means that the checks are disabled. ;opcache.consistency_checks=0 ; How long to wait (in seconds) for a scheduled restart to begin if the cache ; is not being accessed. ;opcache.force_restart_timeout=180 ; OPcache error_log file name. Empty string assumes "stderr". ;opcache.error_log= ; All OPcache errors go to the Web server log. ; By default, only fatal errors (level 0) or errors (level 1) are logged. ; You can also enable warnings (level 2), info messages (level 3) or ; debug messages (level 4). ;opcache.log_verbosity_level=1 ; Preferred Shared Memory back-end. Leave empty and let the system decide. ;opcache.preferred_memory_model= ; Protect the shared memory from unexpected writing during script execution. ; Useful for internal debugging only. ;opcache.protect_memory=0 ; Allows calling OPcache API functions only from PHP scripts which path is ; started from specified string. The default "" means no restriction ;opcache.restrict_api= ; Mapping base of shared memory segments (for Windows only). All the PHP ; processes have to map shared memory into the same address space. This ; directive allows to manually fix the "Unable to reattach to base address" ; errors. ;opcache.mmap_base= ; Facilitates multiple OPcache instances per user (for Windows only). All PHP ; processes with the same cache ID and user share an OPcache instance. ;opcache.cache_id= ; Enables and sets the second level cache directory. ; It should improve performance when SHM memory is full, at server restart or ; SHM reset. The default "" disables file based caching. ;opcache.file_cache= ; Enables or disables opcode caching in shared memory. ;opcache.file_cache_only=0 ; Enables or disables checksum validation when script loaded from file cache. ;opcache.file_cache_consistency_checks=1 ; Implies opcache.file_cache_only=1 for a certain process that failed to ; reattach to the shared memory (for Windows only). Explicitly enabled file ; cache is required. ;opcache.file_cache_fallback=1 ; Enables or disables copying of PHP code (text segment) into HUGE PAGES. ; This should improve performance, but requires appropriate OS configuration. ;opcache.huge_code_pages=0 ; Validate cached file permissions. ;opcache.validate_permission=0 ; Prevent name collisions in chroot'ed environment. ;opcache.validate_root=0 ; If specified, it produces opcode dumps for debugging different stages of ; optimizations. ;opcache.opt_debug_level=0 ; Specifies a PHP script that is going to be compiled and executed at server ; start-up. ; http://php.net/opcache.preload ;opcache.preload= ; Preloading code as root is not allowed for security reasons. This directive ; facilitates to let the preloading to be run as another user. ; http://php.net/opcache.preload_user ;opcache.preload_user= ; Prevents caching files that are less than this number of seconds old. It ; protects from caching of incompletely updated files. In case all file updates ; on your site are atomic, you may increase performance by setting it to "0". ;opcache.file_update_protection=2 ; Absolute path used to store shared lockfiles (for *nix only). ;opcache.lockfile_path=/tmp [curl] ; A default value for the CURLOPT_CAINFO option. This is required to be an ; absolute path. ;curl.cainfo = [openssl] ; The location of a Certificate Authority (CA) file on the local filesystem ; to use when verifying the identity of SSL/TLS peers. Most users should ; not specify a value for this directive as PHP will attempt to use the ; OS-managed cert stores in its absence. If specified, this value may still ; be overridden on a per-stream basis via the "cafile" SSL stream context ; option. ;openssl.cafile= ; If openssl.cafile is not specified or if the CA file is not found, the ; directory pointed to by openssl.capath is searched for a suitable ; certificate. This value must be a correctly hashed certificate directory. ; Most users should not specify a value for this directive as PHP will ; attempt to use the OS-managed cert stores in its absence. If specified, ; this value may still be overridden on a per-stream basis via the "capath" ; SSL stream context option. ;openssl.capath= [ffi] ; FFI API restriction. Possible values: ; "preload" - enabled in CLI scripts and preloaded files (default) ; "false" - always disabled ; "true" - always enabled ;ffi.enable=preload ; List of headers files to preload, wildcard patterns allowed. ;ffi.preload= [Zend] ; fix for segfaults auto_globals_jit = Off cgi.fix_pathinfo = 1 mbstring.http_input = "pass" mbstring.http_output = "pass" mbstring.encoding_translation = 0 ; Enable Extensions extension=uploadprogress.so extension=imagick.so extension=redis.so ================================================ FILE: aegir/conf/php/php80-fpm ================================================ #!/bin/bash ### BEGIN INIT INFO # Provides: php80-fpm # Required-Start: $remote_fs $network # Required-Stop: $remote_fs $network # Default-Start: 2 3 4 5 # Default-Stop: 0 1 6 # Short-Description: starts php80-fpm # Description: starts the PHP FastCGI Process Manager daemon ### END INIT INFO prefix=/opt/php80 exec_prefix=${prefix} php_fpm_BIN=/opt/php80/sbin/php-fpm php_fpm_CONF=/opt/php80/etc/php80-fpm.conf php_fpm_PID=/run/php80-fpm.pid php_opts="--fpm-config $php_fpm_CONF --pid $php_fpm_PID -c /opt/php80/etc/php80.ini" wait_for_pid() { try=0 while test $try -lt 5; do case "$1" in 'created') if [ -f "$2" ]; then try='' break fi ;; 'removed') if [ ! -f "$2" ]; then try='' break fi ;; esac echo -n . try=`expr $try + 1` sleep 1 done } case "$1" in start) echo -n "Starting php80-fpm..." $php_fpm_BIN --daemonize $php_opts if [ "$?" != 0 ]; then echo " failed" exit 1 fi wait_for_pid created $php_fpm_PID if [ -n "$try" ]; then echo " failed" exit 1 else echo " done" fi ;; stop) echo -n "Gracefully shutting down php80-fpm..." if [ ! -r $php_fpm_PID ]; then echo "warning, no pid file found - php80-fpm is not running ?" exit 1 fi kill -QUIT `cat $php_fpm_PID` wait_for_pid removed $php_fpm_PID if [ -n "$try" ]; then echo " failed. Use force-quit" exit 1 else echo " done" fi ;; status) if [ ! -r $php_fpm_PID ]; then echo "php80-fpm is stopped" exit 0 fi PID=`cat $php_fpm_PID` if ps -p $PID | grep -q $PID; then echo "php80-fpm (pid $PID) is running..." else echo "php80-fpm dead but pid file exists" fi ;; force-quit) echo -n "Terminating php80-fpm..." if [ ! -r $php_fpm_PID ]; then echo "warning, no pid file found - php80-fpm is not running ?" exit 1 fi kill -TERM `cat $php_fpm_PID` wait_for_pid removed $php_fpm_PID if [ -n "$try" ]; then echo " failed" exit 1 else echo " done" fi ;; restart) $0 stop $0 start ;; reload) echo -n "Reloading service php80-fpm..." if [ ! -r $php_fpm_PID ]; then echo "warning, no pid file found - php80-fpm is not running ?" exit 1 fi kill -USR2 `cat $php_fpm_PID` echo " done" ;; configtest) $php_fpm_BIN -t ;; *) echo "Usage: $0 {start|stop|force-quit|restart|reload|status|configtest}" exit 1 ;; esac ================================================ FILE: aegir/conf/php/php80-fpm.conf ================================================ ;;;;;;;;;;;;;;;;;;;;; ; FPM Configuration ; ;;;;;;;;;;;;;;;;;;;;; ; All relative paths in this configuration file are relative to PHP's install ; prefix (/opt/php80). This prefix can be dynamically changed by using the ; '-p' argument from the command line. ; Include one or more files. If glob(3) exists, it is used to include a bunch of ; files from a glob(3) pattern. This directive can be used everywhere in the ; file. ; Relative path can also be used. They will be prefixed by: ; - the global prefix if it's been set (-p argument) ; - /opt/php80 otherwise ;include=etc/fpm.d/*.conf ;;;;;;;;;;;;;;;;;; ; Global Options ; ;;;;;;;;;;;;;;;;;; [global] ; Pid file ; Note: the default prefix is /opt/php80/var ; Default Value: none pid = /run/php80-fpm.pid ; Error log file ; If it's set to "syslog", log is sent to syslogd instead of being written ; in a local file. ; Note: the default prefix is /opt/php80/var ; Default Value: log/php-fpm.log error_log = /var/log/php/php80-fpm-error.log ; syslog_facility is used to specify what type of program is logging the ; message. This lets syslogd specify that messages from different facilities ; will be handled differently. ; See syslog(3) for possible values (ex daemon equiv LOG_DAEMON) ; Default Value: daemon syslog.facility = daemon ; syslog_ident is prepended to every message. If you have multiple FPM ; instances running on the same server, you can change the default value ; which must suit common needs. ; Default Value: php-fpm syslog.ident = php80-fpm ; Log level ; Possible Values: alert, error, warning, notice, debug ; Default Value: notice log_level = warning ; If this number of child processes exit with SIGSEGV or SIGBUS within the time ; interval set by emergency_restart_interval then FPM will restart. A value ; of '0' means 'Off'. ; Default Value: 0 emergency_restart_threshold = 5 ; Interval of time used by emergency_restart_interval to determine when ; a graceful restart will be initiated. This can be useful to work around ; accidental corruptions in an accelerator's shared memory. ; Available Units: s(econds), m(inutes), h(ours), or d(ays) ; Default Unit: seconds ; Default Value: 0 emergency_restart_interval = 1m ; Time limit for child processes to wait for a reaction on signals from master. ; Available units: s(econds), m(inutes), h(ours), or d(ays) ; Default Unit: seconds ; Default Value: 0 process_control_timeout = 5s ; The maximum number of processes FPM will fork. This has been design to control ; the global number of processes when using dynamic PM within a lot of pools. ; Use it with caution. ; Note: A value of 0 indicates no limit ; Default Value: 0 process.max = 0 ; Specify the nice(2) priority to apply to the master process (only if set) ; The value can vary from -19 (highest priority) to 20 (lower priority) ; Note: - It will only work if the FPM master process is launched as root ; - The pool process will inherit the master process priority ; unless it specified otherwise ; Default Value: no set ; process.priority = -19 ; Send FPM to background. Set to 'no' to keep FPM in foreground for debugging. ; Default Value: yes daemonize = yes ; Set open file descriptor rlimit for the master process. ; Default Value: system defined value ;rlimit_files = 1024 ; Set max core size rlimit for the master process. ; Possible Values: 'unlimited' or an integer greater or equal to 0 ; Default Value: system defined value ;rlimit_core = 0 ; Specify the event mechanism FPM will use. The following is available: ; - select (any POSIX os) ; - poll (any POSIX os) ; - epoll (linux >= 2.5.44) ; - kqueue (FreeBSD >= 4.1, OpenBSD >= 2.9, NetBSD >= 2.0) ; - /dev/poll (Solaris >= 7) ; - port (Solaris >= 10) ; Default Value: not set (auto detection) ;events.mechanism = epoll ;;;;;;;;;;;;;;;;;;;; ; Pool Definitions ; ;;;;;;;;;;;;;;;;;;;; ; Multiple pools of child processes may be started with different listening ; ports and different management options. The name of the pool will be ; used in logs and stats. There is no limitation on the number of pools which ; FPM can handle. Your system will tell you anyway :) include = /opt/php80/etc/pool.d/*.conf ================================================ FILE: aegir/conf/php/php80.ini ================================================ [PHP] ;;;;;;;;;;;;;;;;;;; ; About php.ini ; ;;;;;;;;;;;;;;;;;;; ; PHP's initialization file, generally called php.ini, is responsible for ; configuring many of the aspects of PHP's behavior. ; PHP attempts to find and load this configuration from a number of locations. ; The following is a summary of its search order: ; 1. SAPI module specific location. ; 2. The PHPRC environment variable. (As of PHP 5.2.0) ; 3. A number of predefined registry keys on Windows (As of PHP 5.2.0) ; 4. Current working directory (except CLI) ; 5. The web server's directory (for SAPI modules), or directory of PHP ; (otherwise in Windows) ; 6. The directory from the --with-config-file-path compile time option, or the ; Windows directory (usually C:\windows) ; See the PHP docs for more specific information. ; http://php.net/configuration.file ; The syntax of the file is extremely simple. Whitespace and lines ; beginning with a semicolon are silently ignored (as you probably guessed). ; Section headers (e.g. [Foo]) are also silently ignored, even though ; they might mean something in the future. ; Directives following the section heading [PATH=/www/mysite] only ; apply to PHP files in the /www/mysite directory. Directives ; following the section heading [HOST=www.example.com] only apply to ; PHP files served from www.example.com. Directives set in these ; special sections cannot be overridden by user-defined INI files or ; at runtime. Currently, [PATH=] and [HOST=] sections only work under ; CGI/FastCGI. ; http://php.net/ini.sections ; Directives are specified using the following syntax: ; directive = value ; Directive names are *case sensitive* - foo=bar is different from FOO=bar. ; Directives are variables used to configure PHP or PHP extensions. ; There is no name validation. If PHP can't find an expected ; directive because it is not set or is mistyped, a default value will be used. ; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one ; of the INI constants (On, Off, True, False, Yes, No and None) or an expression ; (e.g. E_ALL & ~E_NOTICE), a quoted string ("bar"), or a reference to a ; previously set variable or directive (e.g. ${foo}) ; Expressions in the INI file are limited to bitwise operators and parentheses: ; | bitwise OR ; ^ bitwise XOR ; & bitwise AND ; ~ bitwise NOT ; ! boolean NOT ; Boolean flags can be turned on using the values 1, On, True or Yes. ; They can be turned off using the values 0, Off, False or No. ; An empty string can be denoted by simply not writing anything after the equal ; sign, or by using the None keyword: ; foo = ; sets foo to an empty string ; foo = None ; sets foo to an empty string ; foo = "None" ; sets foo to the string 'None' ; If you use constants in your value, and these constants belong to a ; dynamically loaded extension (either a PHP extension or a Zend extension), ; you may only use these constants *after* the line that loads the extension. ;;;;;;;;;;;;;;;;;;; ; About this file ; ;;;;;;;;;;;;;;;;;;; ; PHP comes packaged with two INI files. One that is recommended to be used ; in production environments and one that is recommended to be used in ; development environments. ; php.ini-production contains settings which hold security, performance and ; best practices at its core. But please be aware, these settings may break ; compatibility with older or less security conscience applications. We ; recommending using the production ini in production and testing environments. ; php.ini-development is very similar to its production variant, except it is ; much more verbose when it comes to errors. We recommend using the ; development version only in development environments, as errors shown to ; application users can inadvertently leak otherwise secure information. ; This is the php.ini-production INI file. ;;;;;;;;;;;;;;;;;;; ; Quick Reference ; ;;;;;;;;;;;;;;;;;;; ; The following are all the settings which are different in either the production ; or development versions of the INIs with respect to PHP's default behavior. ; Please see the actual settings later in the document for more details as to why ; we recommend these changes in PHP's behavior. display_errors = Off ; Default Value: On ; Development Value: On ; Production Value: Off ; display_startup_errors ; Default Value: On ; Development Value: On ; Production Value: Off ; error_reporting ; Default Value: E_ALL ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; log_errors ; Default Value: Off ; Development Value: On ; Production Value: On ; max_input_time ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; output_buffering ; Default Value: Off ; Development Value: 4096 ; Production Value: 4096 ; register_argc_argv ; Default Value: On ; Development Value: Off ; Production Value: Off ; request_order ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; session.gc_divisor ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; session.sid_bits_per_character ; Default Value: 4 ; Development Value: 5 ; Production Value: 5 ; short_open_tag ; Default Value: On ; Development Value: Off ; Production Value: Off ; variables_order ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS" ; zend.exception_ignore_args ; Default Value: Off ; Development Value: Off ; Production Value: On ; zend.exception_string_param_max_len ; Default Value: 15 ; Development Value: 15 ; Production Value: 0 ;;;;;;;;;;;;;;;;;;;; ; php.ini Options ; ;;;;;;;;;;;;;;;;;;;; ; Name for user-defined php.ini (.htaccess) files. Default is ".user.ini" ;user_ini.filename = ".user.ini" ; To disable this feature set this option to an empty value user_ini.filename = ; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes) ;user_ini.cache_ttl = 300 ;;;;;;;;;;;;;;;;;;;; ; Language Options ; ;;;;;;;;;;;;;;;;;;;; ; Enable the PHP scripting language engine under Apache. ; http://php.net/engine engine = On ; This directive determines whether or not PHP will recognize code between ; tags as PHP source which should be processed as such. It is ; generally recommended that should be used and that this feature ; should be disabled, as enabling it may result in issues when generating XML ; documents, however this remains supported for backward compatibility reasons. ; Note that this directive does not control the would work. ; http://php.net/syntax-highlighting ;highlight.string = #DD0000 ;highlight.comment = #FF9900 ;highlight.keyword = #007700 ;highlight.default = #0000BB ;highlight.html = #000000 ; If enabled, the request will be allowed to complete even if the user aborts ; the request. Consider enabling it if executing long requests, which may end up ; being interrupted by the user or a browser timing out. PHP's default behavior ; is to disable this feature. ; http://php.net/ignore-user-abort ;ignore_user_abort = On ; Determines the size of the realpath cache to be used by PHP. This value should ; be increased on systems where PHP opens many files to reflect the quantity of ; the file operations performed. ; Note: if open_basedir is set, the cache is disabled ; http://php.net/realpath-cache-size realpath_cache_size=64M ; Duration of time, in seconds for which to cache realpath information for a given ; file or directory. For systems with rarely changing files, consider increasing this ; value. ; http://php.net/realpath-cache-ttl realpath_cache_ttl=180 ; Enables or disables the circular reference collector. ; http://php.net/zend.enable-gc zend.enable_gc = On ; If enabled, scripts may be written in encodings that are incompatible with ; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such ; encodings. To use this feature, mbstring extension must be enabled. ;zend.multibyte = Off ; Allows to set the default encoding for the scripts. This value will be used ; unless "declare(encoding=...)" directive appears at the top of the script. ; Only affects if zend.multibyte is set. ;zend.script_encoding = ; Allows to include or exclude arguments from stack traces generated for exceptions. ; In production, it is recommended to turn this setting on to prohibit the output ; of sensitive information in stack traces ; Default Value: Off ; Development Value: Off ; Production Value: On zend.exception_ignore_args = On ; Allows setting the maximum string length in an argument of a stringified stack trace ; to a value between 0 and 1000000. ; This has no effect when zend.exception_ignore_args is enabled. ; Default Value: 15 ; Development Value: 15 ; Production Value: 0 ; In production, it is recommended to set this to 0 to reduce the output ; of sensitive information in stack traces. zend.exception_string_param_max_len = 0 ;;;;;;;;;;;;;;;;; ; Miscellaneous ; ;;;;;;;;;;;;;;;;; ; Decides whether PHP may expose the fact that it is installed on the server ; (e.g. by adding its signature to the Web server header). It is no security ; threat in any way, but it makes it possible to determine whether you use PHP ; on your server or not. ; http://php.net/expose-php expose_php = On ;;;;;;;;;;;;;;;;;;; ; Resource Limits ; ;;;;;;;;;;;;;;;;;;; ; Maximum execution time of each script, in seconds ; http://php.net/max-execution-time ; Note: This directive is hardcoded to 0 for the CLI SAPI max_execution_time = 180 ; Maximum amount of time each script may spend parsing request data. It's a good ; idea to limit this time on productions servers in order to eliminate unexpectedly ; long running scripts. ; Note: This directive is hardcoded to -1 for the CLI SAPI ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; http://php.net/max-input-time max_input_time = 180 ; Maximum input variable nesting level ; http://php.net/max-input-nesting-level ;max_input_nesting_level = 64 ; How many GET/POST/COOKIE input variables may be accepted max_input_vars = 9999 ; Maximum amount of memory a script may consume ; http://php.net/memory-limit memory_limit = 395M ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; Error handling and logging ; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; This directive informs PHP of which errors, warnings and notices you would like ; it to take action for. The recommended way of setting values for this ; directive is through the use of the error level constants and bitwise ; operators. The error level constants are below here for convenience as well as ; some common settings and their meanings. ; By default, PHP is set to take action on all errors, notices and warnings EXCEPT ; those related to E_NOTICE and E_STRICT, which together cover best practices and ; recommended coding standards in PHP. For performance reasons, this is the ; recommend error reporting setting. Your production server shouldn't be wasting ; resources complaining about best practices and coding standards. That's what ; development servers and development settings are for. ; Note: The php.ini-development file has this setting as E_ALL. This ; means it pretty much reports everything which is exactly what you want during ; development and early testing. ; ; Error Level Constants: ; E_ALL - All errors and warnings (includes E_STRICT as of PHP 5.4.0) ; E_ERROR - fatal run-time errors ; E_RECOVERABLE_ERROR - almost fatal run-time errors ; E_WARNING - run-time warnings (non-fatal errors) ; E_PARSE - compile-time parse errors ; E_NOTICE - run-time notices (these are warnings which often result ; from a bug in your code, but it's possible that it was ; intentional (e.g., using an uninitialized variable and ; relying on the fact it is automatically initialized to an ; empty string) ; E_STRICT - run-time notices, enable to have PHP suggest changes ; to your code which will ensure the best interoperability ; and forward compatibility of your code ; E_CORE_ERROR - fatal errors that occur during PHP's initial startup ; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's ; initial startup ; E_COMPILE_ERROR - fatal compile-time errors ; E_COMPILE_WARNING - compile-time warnings (non-fatal errors) ; E_USER_ERROR - user-generated error message ; E_USER_WARNING - user-generated warning message ; E_USER_NOTICE - user-generated notice message ; E_DEPRECATED - warn about code that will not work in future versions ; of PHP ; E_USER_DEPRECATED - user-generated deprecation warnings ; ; Common Values: ; E_ALL (Show all errors, warnings and notices including coding standards.) ; E_ALL & ~E_NOTICE (Show all errors, except for notices) ; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.) ; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors) ; Default Value: E_ALL ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; http://php.net/error-reporting error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT ; This directive controls whether or not and where PHP will output errors, ; notices and warnings too. Error output is very useful during development, but ; it could be very dangerous in production environments. Depending on the code ; which is triggering the error, sensitive information could potentially leak ; out of your application such as database usernames and passwords or worse. ; For production environments, we recommend logging errors rather than ; sending them to STDOUT. ; Possible Values: ; Off = Do not display any errors ; stderr = Display errors to STDERR (affects only CGI/CLI binaries!) ; On or stdout = Display errors to STDOUT ; Default Value: On ; Development Value: On ; Production Value: Off ; http://php.net/display-errors display_errors = Off ; The display of errors which occur during PHP's startup sequence are handled ; separately from display_errors. We strongly recommend you set this to 'off' ; for production servers to avoid leaking configuration details. ; Default Value: On ; Development Value: On ; Production Value: Off ; http://php.net/display-startup-errors display_startup_errors = Off ; Besides displaying errors, PHP can also log errors to locations such as a ; server-specific log, STDERR, or a location specified by the error_log ; directive found below. While errors should not be displayed on productions ; servers they should still be monitored and logging is a great way to do that. ; Default Value: Off ; Development Value: On ; Production Value: On ; http://php.net/log-errors log_errors = On ; Set maximum length of log_errors. In error_log information about the source is ; added. The default is 1024 and 0 allows to not apply any maximum length at all. ; http://php.net/log-errors-max-len log_errors_max_len = 1024 ; Do not log repeated messages. Repeated errors must occur in same file on same ; line unless ignore_repeated_source is set true. ; http://php.net/ignore-repeated-errors ignore_repeated_errors = Off ; Ignore source of message when ignoring repeated messages. When this setting ; is On you will not log errors with repeated messages from different files or ; source lines. ; http://php.net/ignore-repeated-source ignore_repeated_source = Off ; If this parameter is set to Off, then memory leaks will not be shown (on ; stdout or in the log). This is only effective in a debug compile, and if ; error reporting includes E_WARNING in the allowed list ; http://php.net/report-memleaks report_memleaks = On ; This setting is off by default. ;report_zend_debug = 0 ; Turn off normal error reporting and emit XML-RPC error XML ; http://php.net/xmlrpc-errors ;xmlrpc_errors = 0 ; An XML-RPC faultCode ;xmlrpc_error_number = 0 ; When PHP displays or logs an error, it has the capability of formatting the ; error message as HTML for easier reading. This directive controls whether ; the error message is formatted as HTML or not. ; Note: This directive is hardcoded to Off for the CLI SAPI ; http://php.net/html-errors html_errors = Off ; If html_errors is set to On *and* docref_root is not empty, then PHP ; produces clickable error messages that direct to a page describing the error ; or function causing the error in detail. ; You can download a copy of the PHP manual from http://php.net/docs ; and change docref_root to the base URL of your local copy including the ; leading '/'. You must also specify the file extension being used including ; the dot. PHP's default behavior is to leave these settings empty, in which ; case no links to documentation are generated. ; Note: Never use this feature for production boxes. ; http://php.net/docref-root ; Examples ;docref_root = "/phpmanual/" ; http://php.net/docref-ext ;docref_ext = .html ; String to output before an error message. PHP's default behavior is to leave ; this setting blank. ; http://php.net/error-prepend-string ; Example: ;error_prepend_string = "" ; String to output after an error message. PHP's default behavior is to leave ; this setting blank. ; http://php.net/error-append-string ; Example: ;error_append_string = "" ; Log errors to specified file. PHP's default behavior is to leave this value ; empty. ; http://php.net/error-log ; Example: ;error_log = php_errors.log ; Log errors to syslog (Event Log on Windows). ;error_log = syslog error_log = /var/log/php/error_log_80 ; The syslog ident is a string which is prepended to every message logged ; to syslog. Only used when error_log is set to syslog. ;syslog.ident = php ; The syslog facility is used to specify what type of program is logging ; the message. Only used when error_log is set to syslog. ;syslog.facility = user ; Set this to disable filtering control characters (the default). ; Some loggers only accept NVT-ASCII, others accept anything that's not ; control characters. If your logger accepts everything, then no filtering ; is needed at all. ; Allowed values are: ; ascii (all printable ASCII characters and NL) ; no-ctrl (all characters except control characters) ; all (all characters) ; raw (like "all", but messages are not split at newlines) ; http://php.net/syslog.filter ;syslog.filter = ascii ;windows.show_crt_warning ; Default value: 0 ; Development value: 0 ; Production value: 0 ;;;;;;;;;;;;;;;;; ; Data Handling ; ;;;;;;;;;;;;;;;;; ; The separator used in PHP generated URLs to separate arguments. ; PHP's default setting is "&". ; http://php.net/arg-separator.output ; Example: ;arg_separator.output = "&" ; List of separator(s) used by PHP to parse input URLs into variables. ; PHP's default setting is "&". ; NOTE: Every character in this directive is considered as separator! ; http://php.net/arg-separator.input ; Example: ;arg_separator.input = ";&" ; This directive determines which super global arrays are registered when PHP ; starts up. G,P,C,E & S are abbreviations for the following respective super ; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty ; paid for the registration of these arrays and because ENV is not as commonly ; used as the others, ENV is not recommended on productions servers. You ; can still get access to the environment variables through getenv() should you ; need to. ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS"; ; http://php.net/variables-order variables_order = "GPCS" ; This directive determines which super global data (G,P & C) should be ; registered into the super global array REQUEST. If so, it also determines ; the order in which that data is registered. The values for this directive ; are specified in the same manner as the variables_order directive, ; EXCEPT one. Leaving this value empty will cause PHP to use the value set ; in the variables_order directive. It does not mean it will leave the super ; globals array REQUEST empty. ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; http://php.net/request-order request_order = "GP" ; This directive determines whether PHP registers $argv & $argc each time it ; runs. $argv contains an array of all the arguments passed to PHP when a script ; is invoked. $argc contains an integer representing the number of arguments ; that were passed when the script was invoked. These arrays are extremely ; useful when running scripts from the command line. When this directive is ; enabled, registering these variables consumes CPU cycles and memory each time ; a script is executed. For performance reasons, this feature should be disabled ; on production servers. ; Note: This directive is hardcoded to On for the CLI SAPI ; Default Value: On ; Development Value: Off ; Production Value: Off ; http://php.net/register-argc-argv register_argc_argv = Off ; When enabled, the ENV, REQUEST and SERVER variables are created when they're ; first used (Just In Time) instead of when the script starts. If these ; variables are not used within a script, having this directive on will result ; in a performance gain. The PHP directive register_argc_argv must be disabled ; for this directive to have any effect. ; http://php.net/auto-globals-jit auto_globals_jit = On ; Whether PHP will read the POST data. ; This option is enabled by default. ; Most likely, you won't want to disable this option globally. It causes $_POST ; and $_FILES to always be empty; the only way you will be able to read the ; POST data will be through the php://input stream wrapper. This can be useful ; to proxy requests or to process the POST data in a memory efficient fashion. ; http://php.net/enable-post-data-reading ;enable_post_data_reading = Off ; Maximum size of POST data that PHP will accept. ; Its value may be 0 to disable the limit. It is ignored if POST data reading ; is disabled through enable_post_data_reading. ; http://php.net/post-max-size post_max_size = 350M ; Automatically add files before PHP document. ; http://php.net/auto-prepend-file auto_prepend_file = ; Automatically add files after PHP document. ; http://php.net/auto-append-file auto_append_file = ; By default, PHP will output a media type using the Content-Type header. To ; disable this, simply set it to be empty. ; ; PHP's built-in default media type is set to text/html. ; http://php.net/default-mimetype default_mimetype = "text/html" ; PHP's default character set is set to UTF-8. ; http://php.net/default-charset default_charset = "UTF-8" ; PHP internal character encoding is set to empty. ; If empty, default_charset is used. ; http://php.net/internal-encoding ;internal_encoding = ; PHP input character encoding is set to empty. ; If empty, default_charset is used. ; http://php.net/input-encoding ;input_encoding = ; PHP output character encoding is set to empty. ; If empty, default_charset is used. ; See also output_buffer. ; http://php.net/output-encoding ;output_encoding = ;;;;;;;;;;;;;;;;;;;;;;;;; ; Paths and Directories ; ;;;;;;;;;;;;;;;;;;;;;;;;; ; UNIX: "/path1:/path2" ;include_path = ".:/php/includes" ; ; Windows: "\path1;\path2" ;include_path = ".;c:\php\includes" ; ; PHP's default setting for include_path is ".;/path/to/php/pear" ; http://php.net/include-path include_path = ".:/opt/php80/lib/php" ; The root of the PHP pages, used only if nonempty. ; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root ; if you are running php as a CGI under any web server (other than IIS) ; see documentation for security issues. The alternate is to use the ; cgi.force_redirect configuration below ; http://php.net/doc-root doc_root = ; The directory under which PHP opens the script using /~username used only ; if nonempty. ; http://php.net/user-dir user_dir = ; Directory in which the loadable extensions (modules) reside. ; http://php.net/extension-dir ;extension_dir = "./" ; On windows: ;extension_dir = "ext" extension_dir = "/opt/php80/lib/php/extensions/no-debug-non-zts-20200930/" ; Directory where the temporary files should be placed. ; Defaults to the system default (see sys_get_temp_dir) sys_temp_dir = "/tmp" ; Whether or not to enable the dl() function. The dl() function does NOT work ; properly in multithreaded servers, such as IIS or Zeus, and is automatically ; disabled on them. ; http://php.net/enable-dl enable_dl = Off ; cgi.force_redirect is necessary to provide security running PHP as a CGI under ; most web servers. Left undefined, PHP turns this on by default. You can ; turn it off here AT YOUR OWN RISK ; **You CAN safely turn this off for IIS, in fact, you MUST.** ; http://php.net/cgi.force-redirect ;cgi.force_redirect = 1 ; if cgi.nph is enabled it will force cgi to always sent Status: 200 with ; every request. PHP's default behavior is to disable this feature. ;cgi.nph = 1 ; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape ; (iPlanet) web servers, you MAY need to set an environment variable name that PHP ; will look for to know it is OK to continue execution. Setting this variable MAY ; cause security issues, KNOW WHAT YOU ARE DOING FIRST. ; http://php.net/cgi.redirect-status-env ;cgi.redirect_status_env = ; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's ; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok ; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting ; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting ; of zero causes PHP to behave as before. Default is 1. You should fix your scripts ; to use SCRIPT_FILENAME rather than PATH_TRANSLATED. ; http://php.net/cgi.fix-pathinfo ;cgi.fix_pathinfo=1 ; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside ; of the web tree and people will not be able to circumvent .htaccess security. ;cgi.discard_path=1 ; FastCGI under IIS supports the ability to impersonate ; security tokens of the calling client. This allows IIS to define the ; security context that the request runs under. mod_fastcgi under Apache ; does not currently support this feature (03/17/2002) ; Set to 1 if running under IIS. Default is zero. ; http://php.net/fastcgi.impersonate ;fastcgi.impersonate = 1 ; Disable logging through FastCGI connection. PHP's default behavior is to enable ; this feature. ;fastcgi.logging = 0 ; cgi.rfc2616_headers configuration option tells PHP what type of headers to ; use when sending HTTP response code. If set to 0, PHP sends Status: header that ; is supported by Apache. When this option is set to 1, PHP will send ; RFC2616 compliant header. ; Default is zero. ; http://php.net/cgi.rfc2616-headers ;cgi.rfc2616_headers = 0 ; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #! ; (shebang) at the top of the running script. This line might be needed if the ; script support running both as stand-alone script and via PHP CGI<. PHP in CGI ; mode skips this line and ignores its content if this directive is turned on. ; http://php.net/cgi.check-shebang-line ;cgi.check_shebang_line=1 ;;;;;;;;;;;;;;;; ; File Uploads ; ;;;;;;;;;;;;;;;; ; Whether to allow HTTP file uploads. ; http://php.net/file-uploads file_uploads = On ; Temporary directory for HTTP uploaded files (will use system default if not ; specified). ; http://php.net/upload-tmp-dir upload_tmp_dir = /tmp ; Maximum allowed size for uploaded files. ; http://php.net/upload-max-filesize upload_max_filesize = 325M ; Maximum number of files that can be uploaded via a single request max_file_uploads = 50 ;;;;;;;;;;;;;;;;;; ; Fopen wrappers ; ;;;;;;;;;;;;;;;;;; ; Whether to allow the treatment of URLs (like http:// or ftp://) as files. ; http://php.net/allow-url-fopen allow_url_fopen = On ; Whether to allow include/require to open URLs (like http:// or ftp://) as files. ; http://php.net/allow-url-include allow_url_include = Off ; Define the anonymous ftp password (your email address). PHP's default setting ; for this is empty. ; http://php.net/from ;from="john@doe.com" ; Define the User-Agent string. PHP's default setting for this is empty. ; http://php.net/user-agent ;user_agent="PHP" ; Default timeout for socket based streams (seconds) ; http://php.net/default-socket-timeout default_socket_timeout = 180 ; If your scripts have to deal with files from Macintosh systems, ; or you are running on a Mac and need to deal with files from ; unix or win32 systems, setting this flag will cause PHP to ; automatically detect the EOL character in those files so that ; fgets() and file() will work regardless of the source of the file. ; http://php.net/auto-detect-line-endings auto_detect_line_endings = On ;;;;;;;;;;;;;;;;;;;;;; ; Dynamic Extensions ; ;;;;;;;;;;;;;;;;;;;;;; ; If you wish to have an extension loaded automatically, use the following ; syntax: ; ; extension=modulename ; ; For example: ; ; extension=mysqli ; ; When the extension library to load is not located in the default extension ; directory, You may specify an absolute path to the library file: ; ; extension=/path/to/extension/mysqli.so ; ; Note : The syntax used in previous PHP versions ('extension=.so' and ; 'extension='php_.dll') is supported for legacy reasons and may be ; deprecated in a future PHP major version. So, when it is possible, please ; move to the new ('extension=) syntax. ; ; Notes for Windows environments : ; ; - Many DLL files are located in the extensions/ (PHP 4) or ext/ (PHP 5+) ; extension folders as well as the separate PECL DLL download (PHP 5+). ; Be sure to appropriately set the extension_dir directive. ; ;extension=bz2 ;extension=curl ;extension=ffi ;extension=ftp ;extension=fileinfo ;extension=gd ;extension=gettext ;extension=gmp ;extension=intl ;extension=imap ;extension=ldap ;extension=mbstring ;extension=exif ; Must be after mbstring as it depends on it ;extension=mysqli ;extension=oci8_12c ; Use with Oracle Database 12c Instant Client ;extension=oci8_19 ; Use with Oracle Database 19 Instant Client ;extension=odbc ;extension=openssl ;extension=pdo_firebird ;extension=pdo_mysql ;extension=pdo_oci ;extension=pdo_odbc ;extension=pdo_pgsql ;extension=pdo_sqlite ;extension=pgsql ;extension=shmop ; The MIBS data available in the PHP distribution must be installed. ; See http://www.php.net/manual/en/snmp.installation.php ;extension=snmp ;extension=soap ;extension=sockets ;extension=sodium ;extension=sqlite3 ;extension=tidy ;extension=xsl ;zend_extension=opcache ;;;;;;;;;;;;;;;;;;; ; Module Settings ; ;;;;;;;;;;;;;;;;;;; [CLI Server] ; Whether the CLI web server uses ANSI color coding in its terminal output. cli_server.color = On [Date] ; Defines the default timezone used by the date functions ; http://php.net/date.timezone date.timezone = "UTC" ; http://php.net/date.default-latitude ;date.default_latitude = 31.7667 ; http://php.net/date.default-longitude ;date.default_longitude = 35.2333 ; http://php.net/date.sunrise-zenith ;date.sunrise_zenith = 90.833333 ; http://php.net/date.sunset-zenith ;date.sunset_zenith = 90.833333 [filter] ; http://php.net/filter.default ;filter.default = unsafe_raw ; http://php.net/filter.default-flags ;filter.default_flags = [iconv] ; Use of this INI entry is deprecated, use global input_encoding instead. ; If empty, default_charset or input_encoding or iconv.input_encoding is used. ; The precedence is: default_charset < input_encoding < iconv.input_encoding ;iconv.input_encoding = ; Use of this INI entry is deprecated, use global internal_encoding instead. ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;iconv.internal_encoding = ; Use of this INI entry is deprecated, use global output_encoding instead. ; If empty, default_charset or output_encoding or iconv.output_encoding is used. ; The precedence is: default_charset < output_encoding < iconv.output_encoding ; To use an output encoding conversion, iconv's output handler must be set ; otherwise output encoding conversion cannot be performed. ;iconv.output_encoding = [imap] ; rsh/ssh logins are disabled by default. Use this INI entry if you want to ; enable them. Note that the IMAP library does not filter mailbox names before ; passing them to rsh/ssh command, thus passing untrusted data to this function ; with rsh/ssh enabled is insecure. ;imap.enable_insecure_rsh=0 [intl] ;intl.default_locale = ; This directive allows you to produce PHP errors when some error ; happens within intl functions. The value is the level of the error produced. ; Default is 0, which does not produce any errors. ;intl.error_level = E_WARNING ;intl.use_exceptions = 0 [sqlite3] ; Directory pointing to SQLite3 extensions ; http://php.net/sqlite3.extension-dir ;sqlite3.extension_dir = ; SQLite defensive mode flag (only available from SQLite 3.26+) ; When the defensive flag is enabled, language features that allow ordinary ; SQL to deliberately corrupt the database file are disabled. This forbids ; writing directly to the schema, shadow tables (eg. FTS data tables), or ; the sqlite_dbpage virtual table. ; https://www.sqlite.org/c3ref/c_dbconfig_defensive.html ; (for older SQLite versions, this flag has no use) ;sqlite3.defensive = 1 [Pcre] ; PCRE library backtracking limit. ; http://php.net/pcre.backtrack-limit ;pcre.backtrack_limit=100000 ; PCRE library recursion limit. ; Please note that if you set this value to a high number you may consume all ; the available process stack and eventually crash PHP (due to reaching the ; stack size limit imposed by the Operating System). ; http://php.net/pcre.recursion-limit ;pcre.recursion_limit=100000 ; Enables or disables JIT compilation of patterns. This requires the PCRE ; library to be compiled with JIT support. ;pcre.jit=1 [Pdo] ; Whether to pool ODBC connections. Can be one of "strict", "relaxed" or "off" ; http://php.net/pdo-odbc.connection-pooling ;pdo_odbc.connection_pooling=strict [Pdo_mysql] ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. pdo_mysql.default_socket= [Phar] ; http://php.net/phar.readonly ;phar.readonly = On ; http://php.net/phar.require-hash ;phar.require_hash = On ;phar.cache_list = [mail function] ; For Win32 only. ; http://php.net/smtp ;SMTP = localhost ; http://php.net/smtp-port ;smtp_port = 25 ; For Win32 only. ; http://php.net/sendmail-from ;sendmail_from = me@example.com ; For Unix only. You may supply arguments as well (default: "sendmail -t -i"). ; http://php.net/sendmail-path sendmail_path = /usr/sbin/sendmail -t -i ; Force the addition of the specified parameters to be passed as extra parameters ; to the sendmail binary. These parameters will always replace the value of ; the 5th parameter to mail(). ;mail.force_extra_parameters = ; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename mail.add_x_header = Off ; The path to a log file that will log all mail() calls. Log entries include ; the full path of the script, line number, To address and headers. ;mail.log = ; Log mail to syslog (Event Log on Windows). ;mail.log = syslog [ODBC] ; http://php.net/odbc.default-db ;odbc.default_db = Not yet implemented ; http://php.net/odbc.default-user ;odbc.default_user = Not yet implemented ; http://php.net/odbc.default-pw ;odbc.default_pw = Not yet implemented ; Controls the ODBC cursor model. ; Default: SQL_CURSOR_STATIC (default). ;odbc.default_cursortype ; Allow or prevent persistent links. ; http://php.net/odbc.allow-persistent odbc.allow_persistent = On ; Check that a connection is still valid before reuse. ; http://php.net/odbc.check-persistent odbc.check_persistent = On ; Maximum number of persistent links. -1 means no limit. ; http://php.net/odbc.max-persistent odbc.max_persistent = -1 ; Maximum number of links (persistent + non-persistent). -1 means no limit. ; http://php.net/odbc.max-links odbc.max_links = -1 ; Handling of LONG fields. Returns number of bytes to variables. 0 means ; passthru. ; http://php.net/odbc.defaultlrl odbc.defaultlrl = 4096 ; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char. ; See the documentation on odbc_binmode and odbc_longreadlen for an explanation ; of odbc.defaultlrl and odbc.defaultbinmode ; http://php.net/odbc.defaultbinmode odbc.defaultbinmode = 1 [MySQLi] ; Maximum number of persistent links. -1 means no limit. ; http://php.net/mysqli.max-persistent mysqli.max_persistent = -1 ; Allow accessing, from PHP's perspective, local files with LOAD DATA statements ; http://php.net/mysqli.allow_local_infile ;mysqli.allow_local_infile = On ; Allow or prevent persistent links. ; http://php.net/mysqli.allow-persistent mysqli.allow_persistent = On ; Maximum number of links. -1 means no limit. ; http://php.net/mysqli.max-links mysqli.max_links = -1 ; Default port number for mysqli_connect(). If unset, mysqli_connect() will use ; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the ; compile-time value defined MYSQL_PORT (in that order). Win32 will only look ; at MYSQL_PORT. ; http://php.net/mysqli.default-port mysqli.default_port = 3306 ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. ; http://php.net/mysqli.default-socket mysqli.default_socket = ; Default host for mysqli_connect() (doesn't apply in safe mode). ; http://php.net/mysqli.default-host mysqli.default_host = ; Default user for mysqli_connect() (doesn't apply in safe mode). ; http://php.net/mysqli.default-user mysqli.default_user = ; Default password for mysqli_connect() (doesn't apply in safe mode). ; Note that this is generally a *bad* idea to store passwords in this file. ; *Any* user with PHP access can run 'echo get_cfg_var("mysqli.default_pw") ; and reveal this password! And of course, any users with read access to this ; file will be able to reveal the password as well. ; http://php.net/mysqli.default-pw mysqli.default_pw = ; Allow or prevent reconnect mysqli.reconnect = Off [mysqlnd] ; Enable / Disable collection of general statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. mysqlnd.collect_statistics = 0 ; Enable / Disable collection of memory usage statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. mysqlnd.collect_memory_statistics = 0 ; Records communication from all extensions using mysqlnd to the specified log ; file. ; http://php.net/mysqlnd.debug ;mysqlnd.debug = ; Defines which queries will be logged. ;mysqlnd.log_mask = 0 ; Default size of the mysqlnd memory pool, which is used by result sets. mysqlnd.mempool_default_size = 64000 ; Size of a pre-allocated buffer used when sending commands to MySQL in bytes. mysqlnd.net_cmd_buffer_size = 8192 ; Size of a pre-allocated buffer used for reading data sent by the server in ; bytes. mysqlnd.net_read_buffer_size = 131072 ; Timeout for network requests in seconds. ;mysqlnd.net_read_timeout = 31536000 ; SHA-256 Authentication Plugin related. File with the MySQL server public RSA ; key. ;mysqlnd.sha256_server_public_key = [OCI8] ; Connection: Enables privileged connections using external ; credentials (OCI_SYSOPER, OCI_SYSDBA) ; http://php.net/oci8.privileged-connect ;oci8.privileged_connect = Off ; Connection: The maximum number of persistent OCI8 connections per ; process. Using -1 means no limit. ; http://php.net/oci8.max-persistent ;oci8.max_persistent = -1 ; Connection: The maximum number of seconds a process is allowed to ; maintain an idle persistent connection. Using -1 means idle ; persistent connections will be maintained forever. ; http://php.net/oci8.persistent-timeout ;oci8.persistent_timeout = -1 ; Connection: The number of seconds that must pass before issuing a ; ping during oci_pconnect() to check the connection validity. When ; set to 0, each oci_pconnect() will cause a ping. Using -1 disables ; pings completely. ; http://php.net/oci8.ping-interval ;oci8.ping_interval = 60 ; Connection: Set this to a user chosen connection class to be used ; for all pooled server requests with Oracle 11g Database Resident ; Connection Pooling (DRCP). To use DRCP, this value should be set to ; the same string for all web servers running the same application, ; the database pool must be configured, and the connection string must ; specify to use a pooled server. ;oci8.connection_class = ; High Availability: Using On lets PHP receive Fast Application ; Notification (FAN) events generated when a database node fails. The ; database must also be configured to post FAN events. ;oci8.events = Off ; Tuning: This option enables statement caching, and specifies how ; many statements to cache. Using 0 disables statement caching. ; http://php.net/oci8.statement-cache-size ;oci8.statement_cache_size = 20 ; Tuning: Enables statement prefetching and sets the default number of ; rows that will be fetched automatically after statement execution. ; http://php.net/oci8.default-prefetch ;oci8.default_prefetch = 100 ; Compatibility. Using On means oci_close() will not close ; oci_connect() and oci_new_connect() connections. ; http://php.net/oci8.old-oci-close-semantics ;oci8.old_oci_close_semantics = Off [PostgreSQL] ; Allow or prevent persistent links. ; http://php.net/pgsql.allow-persistent pgsql.allow_persistent = On ; Detect broken persistent links always with pg_pconnect(). ; Auto reset feature requires a little overheads. ; http://php.net/pgsql.auto-reset-persistent pgsql.auto_reset_persistent = Off ; Maximum number of persistent links. -1 means no limit. ; http://php.net/pgsql.max-persistent pgsql.max_persistent = -1 ; Maximum number of links (persistent+non persistent). -1 means no limit. ; http://php.net/pgsql.max-links pgsql.max_links = -1 ; Ignore PostgreSQL backends Notice message or not. ; Notice message logging require a little overheads. ; http://php.net/pgsql.ignore-notice pgsql.ignore_notice = 0 ; Log PostgreSQL backends Notice message or not. ; Unless pgsql.ignore_notice=0, module cannot log notice message. ; http://php.net/pgsql.log-notice pgsql.log_notice = 0 [bcmath] ; Number of decimal digits for all bcmath functions. ; http://php.net/bcmath.scale bcmath.scale = 0 [browscap] ; http://php.net/browscap ;browscap = extra/browscap.ini [Session] ; Handler used to store/retrieve data. ; http://php.net/session.save-handler session.save_handler = files ; Argument passed to save_handler. In the case of files, this is the path ; where data files are stored. Note: Windows users have to change this ; variable in order to use PHP's session functions. ; ; The path can be defined as: ; ; session.save_path = "N;/path" ; ; where N is an integer. Instead of storing all the session files in ; /path, what this will do is use subdirectories N-levels deep, and ; store the session data in those directories. This is useful if ; your OS has problems with many files in one directory, and is ; a more efficient layout for servers that handle many sessions. ; ; NOTE 1: PHP will not create this directory structure automatically. ; You can use the script in the ext/session dir for that purpose. ; NOTE 2: See the section on garbage collection below if you choose to ; use subdirectories for session storage ; ; The file storage module creates files using mode 600 by default. ; You can change that by using ; ; session.save_path = "N;MODE;/path" ; ; where MODE is the octal representation of the mode. Note that this ; does not overwrite the process's umask. ; http://php.net/session.save-path session.save_path = "/opt/tmp" ; Whether to use strict session mode. ; Strict session mode does not accept an uninitialized session ID, and ; regenerates the session ID if the browser sends an uninitialized session ID. ; Strict mode protects applications from session fixation via a session adoption ; vulnerability. It is disabled by default for maximum compatibility, but ; enabling it is encouraged. ; https://wiki.php.net/rfc/strict_sessions session.use_strict_mode = 0 ; Whether to use cookies. ; http://php.net/session.use-cookies session.use_cookies = 1 ; http://php.net/session.cookie-secure ;session.cookie_secure = ; This option forces PHP to fetch and use a cookie for storing and maintaining ; the session id. We encourage this operation as it's very helpful in combating ; session hijacking when not specifying and managing your own session id. It is ; not the be-all and end-all of session hijacking defense, but it's a good start. ; http://php.net/session.use-only-cookies session.use_only_cookies = 1 ; Name of the session (used as cookie name). ; http://php.net/session.name session.name = PHPSESSID ; Initialize session on request startup. ; http://php.net/session.auto-start session.auto_start = 0 ; Lifetime in seconds of cookie or, if 0, until browser is restarted. ; http://php.net/session.cookie-lifetime session.cookie_lifetime = 0 ; The path for which the cookie is valid. ; http://php.net/session.cookie-path session.cookie_path = / ; The domain for which the cookie is valid. ; http://php.net/session.cookie-domain session.cookie_domain = ; Whether or not to add the httpOnly flag to the cookie, which makes it ; inaccessible to browser scripting languages such as JavaScript. ; http://php.net/session.cookie-httponly session.cookie_httponly = 1 ; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF) ; Current valid values are "Strict", "Lax" or "None". When using "None", ; make sure to include the quotes, as `none` is interpreted like `false` in ini files. ; https://tools.ietf.org/html/draft-west-first-party-cookies-07 session.cookie_samesite = ; Handler used to serialize data. php is the standard serializer of PHP. ; http://php.net/session.serialize-handler session.serialize_handler = php ; Defines the probability that the 'garbage collection' process is started on every ; session initialization. The probability is calculated by using gc_probability/gc_divisor, ; e.g. 1/100 means there is a 1% chance that the GC process starts on each request. ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; http://php.net/session.gc-probability session.gc_probability = 1 ; Defines the probability that the 'garbage collection' process is started on every ; session initialization. The probability is calculated by using gc_probability/gc_divisor, ; e.g. 1/100 means there is a 1% chance that the GC process starts on each request. ; For high volume production servers, using a value of 1000 is a more efficient approach. ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; http://php.net/session.gc-divisor session.gc_divisor = 1000 ; After this number of seconds, stored data will be seen as 'garbage' and ; cleaned up by the garbage collection process. ; http://php.net/session.gc-maxlifetime session.gc_maxlifetime = 1440 ; NOTE: If you are using the subdirectory option for storing session files ; (see session.save_path above), then garbage collection does *not* ; happen automatically. You will need to do your own garbage ; collection through a shell script, cron entry, or some other method. ; For example, the following script is the equivalent of setting ; session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes): ; find /path/to/sessions -cmin +24 -type f | xargs rm ; Check HTTP Referer to invalidate externally stored URLs containing ids. ; HTTP_REFERER has to contain this substring for the session to be ; considered as valid. ; http://php.net/session.referer-check session.referer_check = ; Set to {nocache,private,public,} to determine HTTP caching aspects ; or leave this empty to avoid sending anti-caching headers. ; http://php.net/session.cache-limiter session.cache_limiter = nocache ; Document expires after n minutes. ; http://php.net/session.cache-expire session.cache_expire = 180 ; trans sid support is disabled by default. ; Use of trans sid may risk your users' security. ; Use this option with caution. ; - User may send URL contains active session ID ; to other person via. email/irc/etc. ; - URL that contains active session ID may be stored ; in publicly accessible computer. ; - User may access your site with the same session ID ; always using URL stored in browser's history or bookmarks. ; http://php.net/session.use-trans-sid session.use_trans_sid = 0 ; Set session ID character length. This value could be between 22 to 256. ; Shorter length than default is supported only for compatibility reason. ; Users should use 32 or more chars. ; http://php.net/session.sid-length ; Default Value: 32 ; Development Value: 26 ; Production Value: 26 session.sid_length = 26 ; The URL rewriter will look for URLs in a defined set of HTML tags. ; is special; if you include them here, the rewriter will ; add a hidden field with the info which is otherwise appended ; to URLs. tag's action attribute URL will not be modified ; unless it is specified. ; Note that all valid entries require a "=", even if no value follows. ; Default Value: "a=href,area=href,frame=src,form=" ; Development Value: "a=href,area=href,frame=src,form=" ; Production Value: "a=href,area=href,frame=src,form=" ; http://php.net/url-rewriter.tags session.trans_sid_tags = "a=href,area=href,frame=src,form=" ; URL rewriter does not rewrite absolute URLs by default. ; To enable rewrites for absolute paths, target hosts must be specified ; at RUNTIME. i.e. use ini_set() ; tags is special. PHP will check action attribute's URL regardless ; of session.trans_sid_tags setting. ; If no host is defined, HTTP_HOST will be used for allowed host. ; Example value: php.net,www.php.net,wiki.php.net ; Use "," for multiple hosts. No spaces are allowed. ; Default Value: "" ; Development Value: "" ; Production Value: "" ;session.trans_sid_hosts="" ; Define how many bits are stored in each character when converting ; the binary hash data to something readable. ; Possible values: ; 4 (4 bits: 0-9, a-f) ; 5 (5 bits: 0-9, a-v) ; 6 (6 bits: 0-9, a-z, A-Z, "-", ",") ; Default Value: 4 ; Development Value: 5 ; Production Value: 5 ; http://php.net/session.hash-bits-per-character session.sid_bits_per_character = 5 ; Enable upload progress tracking in $_SESSION ; Default Value: On ; Development Value: On ; Production Value: On ; http://php.net/session.upload-progress.enabled ;session.upload_progress.enabled = On ; Cleanup the progress information as soon as all POST data has been read ; (i.e. upload completed). ; Default Value: On ; Development Value: On ; Production Value: On ; http://php.net/session.upload-progress.cleanup ;session.upload_progress.cleanup = On ; A prefix used for the upload progress key in $_SESSION ; Default Value: "upload_progress_" ; Development Value: "upload_progress_" ; Production Value: "upload_progress_" ; http://php.net/session.upload-progress.prefix ;session.upload_progress.prefix = "upload_progress_" ; The index name (concatenated with the prefix) in $_SESSION ; containing the upload progress information ; Default Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Development Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Production Value: "PHP_SESSION_UPLOAD_PROGRESS" ; http://php.net/session.upload-progress.name ;session.upload_progress.name = "PHP_SESSION_UPLOAD_PROGRESS" ; How frequently the upload progress should be updated. ; Given either in percentages (per-file), or in bytes ; Default Value: "1%" ; Development Value: "1%" ; Production Value: "1%" ; http://php.net/session.upload-progress.freq ;session.upload_progress.freq = "1%" ; The minimum delay between updates, in seconds ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; http://php.net/session.upload-progress.min-freq ;session.upload_progress.min_freq = "1" ; Only write session data when session data is changed. Enabled by default. ; http://php.net/session.lazy-write ;session.lazy_write = On [Assertion] ; Switch whether to compile assertions at all (to have no overhead at run-time) ; -1: Do not compile at all ; 0: Jump over assertion at run-time ; 1: Execute assertions ; Changing from or to a negative value is only possible in php.ini! (For turning assertions on and off at run-time, see assert.active, when zend.assertions = 1) ; Default Value: 1 ; Development Value: 1 ; Production Value: -1 ; http://php.net/zend.assertions zend.assertions = -1 ; Assert(expr); active by default. ; http://php.net/assert.active ;assert.active = On ; Throw an AssertionError on failed assertions ; http://php.net/assert.exception ;assert.exception = On ; Issue a PHP warning for each failed assertion. (Overridden by assert.exception if active) ; http://php.net/assert.warning ;assert.warning = On ; Don't bail out by default. ; http://php.net/assert.bail ;assert.bail = Off ; User-function to be called if an assertion fails. ; http://php.net/assert.callback ;assert.callback = 0 [COM] ; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs ; http://php.net/com.typelib-file ;com.typelib_file = ; allow Distributed-COM calls ; http://php.net/com.allow-dcom ;com.allow_dcom = true ; autoregister constants of a component's typlib on com_load() ; http://php.net/com.autoregister-typelib ;com.autoregister_typelib = true ; register constants casesensitive ; http://php.net/com.autoregister-casesensitive ;com.autoregister_casesensitive = false ; show warnings on duplicate constant registrations ; http://php.net/com.autoregister-verbose ;com.autoregister_verbose = true ; The default character set code-page to use when passing strings to and from COM objects. ; Default: system ANSI code page ;com.code_page= ; The version of the .NET framework to use. The value of the setting are the first three parts ; of the framework's version number, separated by dots, and prefixed with "v", e.g. "v4.0.30319". ;com.dotnet_version= [mbstring] ; language for internal character representation. ; This affects mb_send_mail() and mbstring.detect_order. ; http://php.net/mbstring.language ;mbstring.language = Japanese ; Use of this INI entry is deprecated, use global internal_encoding instead. ; internal/script encoding. ; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*) ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;mbstring.internal_encoding = ; Use of this INI entry is deprecated, use global input_encoding instead. ; http input encoding. ; mbstring.encoding_translation = On is needed to use this setting. ; If empty, default_charset or input_encoding or mbstring.input is used. ; The precedence is: default_charset < input_encoding < mbstring.http_input ; http://php.net/mbstring.http-input ;mbstring.http_input = ; Use of this INI entry is deprecated, use global output_encoding instead. ; http output encoding. ; mb_output_handler must be registered as output buffer to function. ; If empty, default_charset or output_encoding or mbstring.http_output is used. ; The precedence is: default_charset < output_encoding < mbstring.http_output ; To use an output encoding conversion, mbstring's output handler must be set ; otherwise output encoding conversion cannot be performed. ; http://php.net/mbstring.http-output ;mbstring.http_output = ; enable automatic encoding translation according to ; mbstring.internal_encoding setting. Input chars are ; converted to internal encoding by setting this to On. ; Note: Do _not_ use automatic encoding translation for ; portable libs/applications. ; http://php.net/mbstring.encoding-translation ;mbstring.encoding_translation = Off ; automatic encoding detection order. ; "auto" detect order is changed according to mbstring.language ; http://php.net/mbstring.detect-order ;mbstring.detect_order = auto ; substitute_character used when character cannot be converted ; one from another ; http://php.net/mbstring.substitute-character ;mbstring.substitute_character = none ; Enable strict encoding detection. ;mbstring.strict_detection = Off ; This directive specifies the regex pattern of content types for which mb_output_handler() ; is activated. ; Default: mbstring.http_output_conv_mimetypes=^(text/|application/xhtml\+xml) ;mbstring.http_output_conv_mimetypes= ; This directive specifies maximum stack depth for mbstring regular expressions. It is similar ; to the pcre.recursion_limit for PCRE. ;mbstring.regex_stack_limit=100000 ; This directive specifies maximum retry count for mbstring regular expressions. It is similar ; to the pcre.backtrack_limit for PCRE. ;mbstring.regex_retry_limit=1000000 [gd] ; Tell the jpeg decode to ignore warnings and try to create ; a gd image. The warning will then be displayed as notices ; disabled by default ; http://php.net/gd.jpeg-ignore-warning ;gd.jpeg_ignore_warning = 1 [exif] ; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS. ; With mbstring support this will automatically be converted into the encoding ; given by corresponding encode setting. When empty mbstring.internal_encoding ; is used. For the decode settings you can distinguish between motorola and ; intel byte order. A decode setting cannot be empty. ; http://php.net/exif.encode-unicode ;exif.encode_unicode = ISO-8859-15 ; http://php.net/exif.decode-unicode-motorola ;exif.decode_unicode_motorola = UCS-2BE ; http://php.net/exif.decode-unicode-intel ;exif.decode_unicode_intel = UCS-2LE ; http://php.net/exif.encode-jis ;exif.encode_jis = ; http://php.net/exif.decode-jis-motorola ;exif.decode_jis_motorola = JIS ; http://php.net/exif.decode-jis-intel ;exif.decode_jis_intel = JIS [Tidy] ; The path to a default tidy configuration file to use when using tidy ; http://php.net/tidy.default-config ;tidy.default_config = /usr/local/lib/php/default.tcfg ; Should tidy clean and repair output automatically? ; WARNING: Do not use this option if you are generating non-html content ; such as dynamic images ; http://php.net/tidy.clean-output tidy.clean_output = Off [soap] ; Enables or disables WSDL caching feature. ; http://php.net/soap.wsdl-cache-enabled soap.wsdl_cache_enabled=1 ; Sets the directory name where SOAP extension will put cache files. ; http://php.net/soap.wsdl-cache-dir soap.wsdl_cache_dir="/tmp" ; (time to live) Sets the number of second while cached file will be used ; instead of original one. ; http://php.net/soap.wsdl-cache-ttl soap.wsdl_cache_ttl=86400 ; Sets the size of the cache limit. (Max. number of WSDL files to cache) soap.wsdl_cache_limit = 5 [sysvshm] ; A default size of the shared memory segment ;sysvshm.init_mem = 10000 [ldap] ; Sets the maximum number of open links or -1 for unlimited. ldap.max_links = -1 [dba] ;dba.default_handler= [opcache] ; Determines if Zend OPCache is enabled ;opcache.enable=1 ; Determines if Zend OPCache is enabled for the CLI version of PHP ;opcache.enable_cli=0 ; The OPcache shared memory storage size. ;opcache.memory_consumption=128 ; The amount of memory for interned strings in Mbytes. ;opcache.interned_strings_buffer=8 ; The maximum number of keys (scripts) in the OPcache hash table. ; Only numbers between 200 and 1000000 are allowed. ;opcache.max_accelerated_files=10000 ; The maximum percentage of "wasted" memory until a restart is scheduled. ;opcache.max_wasted_percentage=5 ; When this directive is enabled, the OPcache appends the current working ; directory to the script key, thus eliminating possible collisions between ; files with the same name (basename). Disabling the directive improves ; performance, but may break existing applications. ;opcache.use_cwd=1 ; When disabled, you must reset the OPcache manually or restart the ; webserver for changes to the filesystem to take effect. ;opcache.validate_timestamps=1 ; How often (in seconds) to check file timestamps for changes to the shared ; memory storage allocation. ("1" means validate once per second, but only ; once per request. "0" means always validate) ;opcache.revalidate_freq=2 ; Enables or disables file search in include_path optimization ;opcache.revalidate_path=0 ; If disabled, all PHPDoc comments are dropped from the code to reduce the ; size of the optimized code. ;opcache.save_comments=1 ; If enabled, compilation warnings (including notices and deprecations) will ; be recorded and replayed each time a file is included. Otherwise, compilation ; warnings will only be emitted when the file is first cached. ;opcache.record_warnings=0 ; Allow file existence override (file_exists, etc.) performance feature. ;opcache.enable_file_override=0 ; A bitmask, where each bit enables or disables the appropriate OPcache ; passes ;opcache.optimization_level=0x7FFFBFFF ;opcache.dups_fix=0 ; The location of the OPcache blacklist file (wildcards allowed). ; Each OPcache blacklist file is a text file that holds the names of files ; that should not be accelerated. The file format is to add each filename ; to a new line. The filename may be a full path or just a file prefix ; (i.e., /var/www/x blacklists all the files and directories in /var/www ; that start with 'x'). Line starting with a ; are ignored (comments). ;opcache.blacklist_filename= ; Allows exclusion of large files from being cached. By default all files ; are cached. ;opcache.max_file_size=0 ; Check the cache checksum each N requests. ; The default value of "0" means that the checks are disabled. ;opcache.consistency_checks=0 ; How long to wait (in seconds) for a scheduled restart to begin if the cache ; is not being accessed. ;opcache.force_restart_timeout=180 ; OPcache error_log file name. Empty string assumes "stderr". ;opcache.error_log= ; All OPcache errors go to the Web server log. ; By default, only fatal errors (level 0) or errors (level 1) are logged. ; You can also enable warnings (level 2), info messages (level 3) or ; debug messages (level 4). ;opcache.log_verbosity_level=1 ; Preferred Shared Memory back-end. Leave empty and let the system decide. ;opcache.preferred_memory_model= ; Protect the shared memory from unexpected writing during script execution. ; Useful for internal debugging only. ;opcache.protect_memory=0 ; Allows calling OPcache API functions only from PHP scripts which path is ; started from specified string. The default "" means no restriction ;opcache.restrict_api= ; Mapping base of shared memory segments (for Windows only). All the PHP ; processes have to map shared memory into the same address space. This ; directive allows to manually fix the "Unable to reattach to base address" ; errors. ;opcache.mmap_base= ; Facilitates multiple OPcache instances per user (for Windows only). All PHP ; processes with the same cache ID and user share an OPcache instance. ;opcache.cache_id= ; Enables and sets the second level cache directory. ; It should improve performance when SHM memory is full, at server restart or ; SHM reset. The default "" disables file based caching. ;opcache.file_cache= ; Enables or disables opcode caching in shared memory. ;opcache.file_cache_only=0 ; Enables or disables checksum validation when script loaded from file cache. ;opcache.file_cache_consistency_checks=1 ; Implies opcache.file_cache_only=1 for a certain process that failed to ; reattach to the shared memory (for Windows only). Explicitly enabled file ; cache is required. ;opcache.file_cache_fallback=1 ; Enables or disables copying of PHP code (text segment) into HUGE PAGES. ; This should improve performance, but requires appropriate OS configuration. ;opcache.huge_code_pages=0 ; Validate cached file permissions. ;opcache.validate_permission=0 ; Prevent name collisions in chroot'ed environment. ;opcache.validate_root=0 ; If specified, it produces opcode dumps for debugging different stages of ; optimizations. ;opcache.opt_debug_level=0 ; Specifies a PHP script that is going to be compiled and executed at server ; start-up. ; http://php.net/opcache.preload ;opcache.preload= ; Preloading code as root is not allowed for security reasons. This directive ; facilitates to let the preloading to be run as another user. ; http://php.net/opcache.preload_user ;opcache.preload_user= ; Prevents caching files that are less than this number of seconds old. It ; protects from caching of incompletely updated files. In case all file updates ; on your site are atomic, you may increase performance by setting it to "0". ;opcache.file_update_protection=2 ; Absolute path used to store shared lockfiles (for *nix only). ;opcache.lockfile_path=/tmp [curl] ; A default value for the CURLOPT_CAINFO option. This is required to be an ; absolute path. ;curl.cainfo = [openssl] ; The location of a Certificate Authority (CA) file on the local filesystem ; to use when verifying the identity of SSL/TLS peers. Most users should ; not specify a value for this directive as PHP will attempt to use the ; OS-managed cert stores in its absence. If specified, this value may still ; be overridden on a per-stream basis via the "cafile" SSL stream context ; option. ;openssl.cafile= ; If openssl.cafile is not specified or if the CA file is not found, the ; directory pointed to by openssl.capath is searched for a suitable ; certificate. This value must be a correctly hashed certificate directory. ; Most users should not specify a value for this directive as PHP will ; attempt to use the OS-managed cert stores in its absence. If specified, ; this value may still be overridden on a per-stream basis via the "capath" ; SSL stream context option. ;openssl.capath= [ffi] ; FFI API restriction. Possible values: ; "preload" - enabled in CLI scripts and preloaded files (default) ; "false" - always disabled ; "true" - always enabled ;ffi.enable=preload ; List of headers files to preload, wildcard patterns allowed. ;ffi.preload= [Zend] ; fix for segfaults auto_globals_jit = Off cgi.fix_pathinfo = 1 mbstring.http_input = "pass" mbstring.http_output = "pass" mbstring.encoding_translation = 0 ; Enable Extensions extension=uploadprogress.so extension=imagick.so extension=redis.so ; APCu extension=apcu.so apc.enable_cli=1 apc.gc_ttl=300 apc.shm_segments=1 apc.shm_size=256M apc.slam_defense=0 apc.ttl=0 ; ================================================ FILE: aegir/conf/php/php81-cli.ini ================================================ [PHP] ;;;;;;;;;;;;;;;;;;; ; About php.ini ; ;;;;;;;;;;;;;;;;;;; ; PHP's initialization file, generally called php.ini, is responsible for ; configuring many of the aspects of PHP's behavior. ; PHP attempts to find and load this configuration from a number of locations. ; The following is a summary of its search order: ; 1. SAPI module specific location. ; 2. The PHPRC environment variable. (As of PHP 5.2.0) ; 3. A number of predefined registry keys on Windows (As of PHP 5.2.0) ; 4. Current working directory (except CLI) ; 5. The web server's directory (for SAPI modules), or directory of PHP ; (otherwise in Windows) ; 6. The directory from the --with-config-file-path compile time option, or the ; Windows directory (usually C:\windows) ; See the PHP docs for more specific information. ; https://php.net/configuration.file ; The syntax of the file is extremely simple. Whitespace and lines ; beginning with a semicolon are silently ignored (as you probably guessed). ; Section headers (e.g. [Foo]) are also silently ignored, even though ; they might mean something in the future. ; Directives following the section heading [PATH=/www/mysite] only ; apply to PHP files in the /www/mysite directory. Directives ; following the section heading [HOST=www.example.com] only apply to ; PHP files served from www.example.com. Directives set in these ; special sections cannot be overridden by user-defined INI files or ; at runtime. Currently, [PATH=] and [HOST=] sections only work under ; CGI/FastCGI. ; https://php.net/ini.sections ; Directives are specified using the following syntax: ; directive = value ; Directive names are *case sensitive* - foo=bar is different from FOO=bar. ; Directives are variables used to configure PHP or PHP extensions. ; There is no name validation. If PHP can't find an expected ; directive because it is not set or is mistyped, a default value will be used. ; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one ; of the INI constants (On, Off, True, False, Yes, No and None) or an expression ; (e.g. E_ALL & ~E_NOTICE), a quoted string ("bar"), or a reference to a ; previously set variable or directive (e.g. ${foo}) ; Expressions in the INI file are limited to bitwise operators and parentheses: ; | bitwise OR ; ^ bitwise XOR ; & bitwise AND ; ~ bitwise NOT ; ! boolean NOT ; Boolean flags can be turned on using the values 1, On, True or Yes. ; They can be turned off using the values 0, Off, False or No. ; An empty string can be denoted by simply not writing anything after the equal ; sign, or by using the None keyword: ; foo = ; sets foo to an empty string ; foo = None ; sets foo to an empty string ; foo = "None" ; sets foo to the string 'None' ; If you use constants in your value, and these constants belong to a ; dynamically loaded extension (either a PHP extension or a Zend extension), ; you may only use these constants *after* the line that loads the extension. ;;;;;;;;;;;;;;;;;;; ; About this file ; ;;;;;;;;;;;;;;;;;;; ; PHP comes packaged with two INI files. One that is recommended to be used ; in production environments and one that is recommended to be used in ; development environments. ; php.ini-production contains settings which hold security, performance and ; best practices at its core. But please be aware, these settings may break ; compatibility with older or less security conscience applications. We ; recommending using the production ini in production and testing environments. ; php.ini-development is very similar to its production variant, except it is ; much more verbose when it comes to errors. We recommend using the ; development version only in development environments, as errors shown to ; application users can inadvertently leak otherwise secure information. ; This is the php.ini-production INI file. ;;;;;;;;;;;;;;;;;;; ; Quick Reference ; ;;;;;;;;;;;;;;;;;;; ; The following are all the settings which are different in either the production ; or development versions of the INIs with respect to PHP's default behavior. ; Please see the actual settings later in the document for more details as to why ; we recommend these changes in PHP's behavior. display_errors = Off ; Default Value: On ; Development Value: On ; Production Value: Off ; display_startup_errors ; Default Value: On ; Development Value: On ; Production Value: Off ; error_reporting ; Default Value: E_ALL ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; log_errors ; Default Value: Off ; Development Value: On ; Production Value: On ; max_input_time ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; output_buffering ; Default Value: Off ; Development Value: 4096 ; Production Value: 4096 ; register_argc_argv ; Default Value: On ; Development Value: Off ; Production Value: Off ; request_order ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; session.gc_divisor ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; session.sid_bits_per_character ; Default Value: 4 ; Development Value: 5 ; Production Value: 5 ; short_open_tag ; Default Value: On ; Development Value: Off ; Production Value: Off ; variables_order ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS" ; zend.exception_ignore_args ; Default Value: Off ; Development Value: Off ; Production Value: On ; zend.exception_string_param_max_len ; Default Value: 15 ; Development Value: 15 ; Production Value: 0 ;;;;;;;;;;;;;;;;;;;; ; php.ini Options ; ;;;;;;;;;;;;;;;;;;;; ; Name for user-defined php.ini (.htaccess) files. Default is ".user.ini" ;user_ini.filename = ".user.ini" ; To disable this feature set this option to an empty value user_ini.filename = ; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes) ;user_ini.cache_ttl = 300 ;;;;;;;;;;;;;;;;;;;; ; Language Options ; ;;;;;;;;;;;;;;;;;;;; ; Enable the PHP scripting language engine under Apache. ; https://php.net/engine engine = On ; This directive determines whether or not PHP will recognize code between ; tags as PHP source which should be processed as such. It is ; generally recommended that should be used and that this feature ; should be disabled, as enabling it may result in issues when generating XML ; documents, however this remains supported for backward compatibility reasons. ; Note that this directive does not control the would work. ; https://php.net/syntax-highlighting ;highlight.string = #DD0000 ;highlight.comment = #FF9900 ;highlight.keyword = #007700 ;highlight.default = #0000BB ;highlight.html = #000000 ; If enabled, the request will be allowed to complete even if the user aborts ; the request. Consider enabling it if executing long requests, which may end up ; being interrupted by the user or a browser timing out. PHP's default behavior ; is to disable this feature. ; https://php.net/ignore-user-abort ;ignore_user_abort = On ; Determines the size of the realpath cache to be used by PHP. This value should ; be increased on systems where PHP opens many files to reflect the quantity of ; the file operations performed. ; Note: if open_basedir is set, the cache is disabled ; https://php.net/realpath-cache-size realpath_cache_size=64M ; Duration of time, in seconds for which to cache realpath information for a given ; file or directory. For systems with rarely changing files, consider increasing this ; value. ; https://php.net/realpath-cache-ttl realpath_cache_ttl=5 ; Enables or disables the circular reference collector. ; https://php.net/zend.enable-gc zend.enable_gc = On ; If enabled, scripts may be written in encodings that are incompatible with ; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such ; encodings. To use this feature, mbstring extension must be enabled. ;zend.multibyte = Off ; Allows to set the default encoding for the scripts. This value will be used ; unless "declare(encoding=...)" directive appears at the top of the script. ; Only affects if zend.multibyte is set. ;zend.script_encoding = ; Allows to include or exclude arguments from stack traces generated for exceptions. ; In production, it is recommended to turn this setting on to prohibit the output ; of sensitive information in stack traces ; Default Value: Off ; Development Value: Off ; Production Value: On zend.exception_ignore_args = On ; Allows setting the maximum string length in an argument of a stringified stack trace ; to a value between 0 and 1000000. ; This has no effect when zend.exception_ignore_args is enabled. ; Default Value: 15 ; Development Value: 15 ; Production Value: 0 ; In production, it is recommended to set this to 0 to reduce the output ; of sensitive information in stack traces. zend.exception_string_param_max_len = 0 ;;;;;;;;;;;;;;;;; ; Miscellaneous ; ;;;;;;;;;;;;;;;;; ; Decides whether PHP may expose the fact that it is installed on the server ; (e.g. by adding its signature to the Web server header). It is no security ; threat in any way, but it makes it possible to determine whether you use PHP ; on your server or not. ; https://php.net/expose-php expose_php = On ;;;;;;;;;;;;;;;;;;; ; Resource Limits ; ;;;;;;;;;;;;;;;;;;; ; Maximum execution time of each script, in seconds ; https://php.net/max-execution-time ; Note: This directive is hardcoded to 0 for the CLI SAPI max_execution_time = 3600 ; Maximum amount of time each script may spend parsing request data. It's a good ; idea to limit this time on productions servers in order to eliminate unexpectedly ; long running scripts. ; Note: This directive is hardcoded to -1 for the CLI SAPI ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; https://php.net/max-input-time max_input_time = 3600 ; Maximum input variable nesting level ; https://php.net/max-input-nesting-level ;max_input_nesting_level = 64 ; How many GET/POST/COOKIE input variables may be accepted max_input_vars = 9999 ; Maximum amount of memory a script may consume ; https://php.net/memory-limit memory_limit = 395M ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; Error handling and logging ; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; This directive informs PHP of which errors, warnings and notices you would like ; it to take action for. The recommended way of setting values for this ; directive is through the use of the error level constants and bitwise ; operators. The error level constants are below here for convenience as well as ; some common settings and their meanings. ; By default, PHP is set to take action on all errors, notices and warnings EXCEPT ; those related to E_NOTICE and E_STRICT, which together cover best practices and ; recommended coding standards in PHP. For performance reasons, this is the ; recommend error reporting setting. Your production server shouldn't be wasting ; resources complaining about best practices and coding standards. That's what ; development servers and development settings are for. ; Note: The php.ini-development file has this setting as E_ALL. This ; means it pretty much reports everything which is exactly what you want during ; development and early testing. ; ; Error Level Constants: ; E_ALL - All errors and warnings (includes E_STRICT as of PHP 5.4.0) ; E_ERROR - fatal run-time errors ; E_RECOVERABLE_ERROR - almost fatal run-time errors ; E_WARNING - run-time warnings (non-fatal errors) ; E_PARSE - compile-time parse errors ; E_NOTICE - run-time notices (these are warnings which often result ; from a bug in your code, but it's possible that it was ; intentional (e.g., using an uninitialized variable and ; relying on the fact it is automatically initialized to an ; empty string) ; E_STRICT - run-time notices, enable to have PHP suggest changes ; to your code which will ensure the best interoperability ; and forward compatibility of your code ; E_CORE_ERROR - fatal errors that occur during PHP's initial startup ; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's ; initial startup ; E_COMPILE_ERROR - fatal compile-time errors ; E_COMPILE_WARNING - compile-time warnings (non-fatal errors) ; E_USER_ERROR - user-generated error message ; E_USER_WARNING - user-generated warning message ; E_USER_NOTICE - user-generated notice message ; E_DEPRECATED - warn about code that will not work in future versions ; of PHP ; E_USER_DEPRECATED - user-generated deprecation warnings ; ; Common Values: ; E_ALL (Show all errors, warnings and notices including coding standards.) ; E_ALL & ~E_NOTICE (Show all errors, except for notices) ; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.) ; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors) ; Default Value: E_ALL ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; https://php.net/error-reporting error_reporting = 1 ; This directive controls whether or not and where PHP will output errors, ; notices and warnings too. Error output is very useful during development, but ; it could be very dangerous in production environments. Depending on the code ; which is triggering the error, sensitive information could potentially leak ; out of your application such as database usernames and passwords or worse. ; For production environments, we recommend logging errors rather than ; sending them to STDOUT. ; Possible Values: ; Off = Do not display any errors ; stderr = Display errors to STDERR (affects only CGI/CLI binaries!) ; On or stdout = Display errors to STDOUT ; Default Value: On ; Development Value: On ; Production Value: Off ; https://php.net/display-errors display_errors = Off ; The display of errors which occur during PHP's startup sequence are handled ; separately from display_errors. We strongly recommend you set this to 'off' ; for production servers to avoid leaking configuration details. ; Default Value: On ; Development Value: On ; Production Value: Off ; https://php.net/display-startup-errors display_startup_errors = Off ; Besides displaying errors, PHP can also log errors to locations such as a ; server-specific log, STDERR, or a location specified by the error_log ; directive found below. While errors should not be displayed on productions ; servers they should still be monitored and logging is a great way to do that. ; Default Value: Off ; Development Value: On ; Production Value: On ; https://php.net/log-errors log_errors = On ; Do not log repeated messages. Repeated errors must occur in same file on same ; line unless ignore_repeated_source is set true. ; https://php.net/ignore-repeated-errors ignore_repeated_errors = Off ; Ignore source of message when ignoring repeated messages. When this setting ; is On you will not log errors with repeated messages from different files or ; source lines. ; https://php.net/ignore-repeated-source ignore_repeated_source = Off ; If this parameter is set to Off, then memory leaks will not be shown (on ; stdout or in the log). This is only effective in a debug compile, and if ; error reporting includes E_WARNING in the allowed list ; https://php.net/report-memleaks report_memleaks = On ; This setting is off by default. ;report_zend_debug = 0 ; Turn off normal error reporting and emit XML-RPC error XML ; https://php.net/xmlrpc-errors ;xmlrpc_errors = 0 ; An XML-RPC faultCode ;xmlrpc_error_number = 0 ; When PHP displays or logs an error, it has the capability of formatting the ; error message as HTML for easier reading. This directive controls whether ; the error message is formatted as HTML or not. ; Note: This directive is hardcoded to Off for the CLI SAPI ; https://php.net/html-errors html_errors = Off ; If html_errors is set to On *and* docref_root is not empty, then PHP ; produces clickable error messages that direct to a page describing the error ; or function causing the error in detail. ; You can download a copy of the PHP manual from https://php.net/docs ; and change docref_root to the base URL of your local copy including the ; leading '/'. You must also specify the file extension being used including ; the dot. PHP's default behavior is to leave these settings empty, in which ; case no links to documentation are generated. ; Note: Never use this feature for production boxes. ; https://php.net/docref-root ; Examples ;docref_root = "/phpmanual/" ; https://php.net/docref-ext ;docref_ext = .html ; String to output before an error message. PHP's default behavior is to leave ; this setting blank. ; https://php.net/error-prepend-string ; Example: ;error_prepend_string = "" ; String to output after an error message. PHP's default behavior is to leave ; this setting blank. ; https://php.net/error-append-string ; Example: ;error_append_string = "" ; Log errors to specified file. PHP's default behavior is to leave this value ; empty. ; https://php.net/error-log ; Example: ;error_log = php_errors.log ; Log errors to syslog (Event Log on Windows). ;error_log = syslog error_log = /var/log/php/error_log_cli_81 ; The syslog ident is a string which is prepended to every message logged ; to syslog. Only used when error_log is set to syslog. ;syslog.ident = php ; The syslog facility is used to specify what type of program is logging ; the message. Only used when error_log is set to syslog. ;syslog.facility = user ; Set this to disable filtering control characters (the default). ; Some loggers only accept NVT-ASCII, others accept anything that's not ; control characters. If your logger accepts everything, then no filtering ; is needed at all. ; Allowed values are: ; ascii (all printable ASCII characters and NL) ; no-ctrl (all characters except control characters) ; all (all characters) ; raw (like "all", but messages are not split at newlines) ; https://php.net/syslog.filter ;syslog.filter = ascii ;windows.show_crt_warning ; Default value: 0 ; Development value: 0 ; Production value: 0 ;;;;;;;;;;;;;;;;; ; Data Handling ; ;;;;;;;;;;;;;;;;; ; The separator used in PHP generated URLs to separate arguments. ; PHP's default setting is "&". ; https://php.net/arg-separator.output ; Example: ;arg_separator.output = "&" ; List of separator(s) used by PHP to parse input URLs into variables. ; PHP's default setting is "&". ; NOTE: Every character in this directive is considered as separator! ; https://php.net/arg-separator.input ; Example: ;arg_separator.input = ";&" ; This directive determines which super global arrays are registered when PHP ; starts up. G,P,C,E & S are abbreviations for the following respective super ; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty ; paid for the registration of these arrays and because ENV is not as commonly ; used as the others, ENV is not recommended on productions servers. You ; can still get access to the environment variables through getenv() should you ; need to. ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS"; ; https://php.net/variables-order variables_order = "GPCS" ; This directive determines which super global data (G,P & C) should be ; registered into the super global array REQUEST. If so, it also determines ; the order in which that data is registered. The values for this directive ; are specified in the same manner as the variables_order directive, ; EXCEPT one. Leaving this value empty will cause PHP to use the value set ; in the variables_order directive. It does not mean it will leave the super ; globals array REQUEST empty. ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; https://php.net/request-order request_order = "GP" ; This directive determines whether PHP registers $argv & $argc each time it ; runs. $argv contains an array of all the arguments passed to PHP when a script ; is invoked. $argc contains an integer representing the number of arguments ; that were passed when the script was invoked. These arrays are extremely ; useful when running scripts from the command line. When this directive is ; enabled, registering these variables consumes CPU cycles and memory each time ; a script is executed. For performance reasons, this feature should be disabled ; on production servers. ; Note: This directive is hardcoded to On for the CLI SAPI ; Default Value: On ; Development Value: Off ; Production Value: Off ; https://php.net/register-argc-argv register_argc_argv = Off ; When enabled, the ENV, REQUEST and SERVER variables are created when they're ; first used (Just In Time) instead of when the script starts. If these ; variables are not used within a script, having this directive on will result ; in a performance gain. The PHP directive register_argc_argv must be disabled ; for this directive to have any effect. ; https://php.net/auto-globals-jit auto_globals_jit = On ; Whether PHP will read the POST data. ; This option is enabled by default. ; Most likely, you won't want to disable this option globally. It causes $_POST ; and $_FILES to always be empty; the only way you will be able to read the ; POST data will be through the php://input stream wrapper. This can be useful ; to proxy requests or to process the POST data in a memory efficient fashion. ; https://php.net/enable-post-data-reading ;enable_post_data_reading = Off ; Maximum size of POST data that PHP will accept. ; Its value may be 0 to disable the limit. It is ignored if POST data reading ; is disabled through enable_post_data_reading. ; https://php.net/post-max-size post_max_size = 350M ; Automatically add files before PHP document. ; https://php.net/auto-prepend-file auto_prepend_file = ; Automatically add files after PHP document. ; https://php.net/auto-append-file auto_append_file = ; By default, PHP will output a media type using the Content-Type header. To ; disable this, simply set it to be empty. ; ; PHP's built-in default media type is set to text/html. ; https://php.net/default-mimetype default_mimetype = "text/html" ; PHP's default character set is set to UTF-8. ; https://php.net/default-charset default_charset = "UTF-8" ; PHP internal character encoding is set to empty. ; If empty, default_charset is used. ; https://php.net/internal-encoding ;internal_encoding = ; PHP input character encoding is set to empty. ; If empty, default_charset is used. ; https://php.net/input-encoding ;input_encoding = ; PHP output character encoding is set to empty. ; If empty, default_charset is used. ; See also output_buffer. ; https://php.net/output-encoding ;output_encoding = ;;;;;;;;;;;;;;;;;;;;;;;;; ; Paths and Directories ; ;;;;;;;;;;;;;;;;;;;;;;;;; ; UNIX: "/path1:/path2" ;include_path = ".:/php/includes" ; ; Windows: "\path1;\path2" ;include_path = ".;c:\php\includes" ; ; PHP's default setting for include_path is ".;/path/to/php/pear" ; https://php.net/include-path include_path = ".:/opt/php81/lib/php" ; The root of the PHP pages, used only if nonempty. ; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root ; if you are running php as a CGI under any web server (other than IIS) ; see documentation for security issues. The alternate is to use the ; cgi.force_redirect configuration below ; https://php.net/doc-root doc_root = ; The directory under which PHP opens the script using /~username used only ; if nonempty. ; https://php.net/user-dir user_dir = ; Directory in which the loadable extensions (modules) reside. ; https://php.net/extension-dir ;extension_dir = "./" ; On windows: ;extension_dir = "ext" extension_dir = "/opt/php81/lib/php/extensions/no-debug-non-zts-20210902/" ; Directory where the temporary files should be placed. ; Defaults to the system default (see sys_get_temp_dir) sys_temp_dir = "/tmp" ; Whether or not to enable the dl() function. The dl() function does NOT work ; properly in multithreaded servers, such as IIS or Zeus, and is automatically ; disabled on them. ; https://php.net/enable-dl enable_dl = Off ; cgi.force_redirect is necessary to provide security running PHP as a CGI under ; most web servers. Left undefined, PHP turns this on by default. You can ; turn it off here AT YOUR OWN RISK ; **You CAN safely turn this off for IIS, in fact, you MUST.** ; https://php.net/cgi.force-redirect ;cgi.force_redirect = 1 ; if cgi.nph is enabled it will force cgi to always sent Status: 200 with ; every request. PHP's default behavior is to disable this feature. ;cgi.nph = 1 ; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape ; (iPlanet) web servers, you MAY need to set an environment variable name that PHP ; will look for to know it is OK to continue execution. Setting this variable MAY ; cause security issues, KNOW WHAT YOU ARE DOING FIRST. ; https://php.net/cgi.redirect-status-env ;cgi.redirect_status_env = ; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's ; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok ; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting ; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting ; of zero causes PHP to behave as before. Default is 1. You should fix your scripts ; to use SCRIPT_FILENAME rather than PATH_TRANSLATED. ; https://php.net/cgi.fix-pathinfo ;cgi.fix_pathinfo=1 ; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside ; of the web tree and people will not be able to circumvent .htaccess security. ;cgi.discard_path=1 ; FastCGI under IIS supports the ability to impersonate ; security tokens of the calling client. This allows IIS to define the ; security context that the request runs under. mod_fastcgi under Apache ; does not currently support this feature (03/17/2002) ; Set to 1 if running under IIS. Default is zero. ; https://php.net/fastcgi.impersonate ;fastcgi.impersonate = 1 ; Disable logging through FastCGI connection. PHP's default behavior is to enable ; this feature. ;fastcgi.logging = 0 ; cgi.rfc2616_headers configuration option tells PHP what type of headers to ; use when sending HTTP response code. If set to 0, PHP sends Status: header that ; is supported by Apache. When this option is set to 1, PHP will send ; RFC2616 compliant header. ; Default is zero. ; https://php.net/cgi.rfc2616-headers ;cgi.rfc2616_headers = 0 ; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #! ; (shebang) at the top of the running script. This line might be needed if the ; script support running both as stand-alone script and via PHP CGI<. PHP in CGI ; mode skips this line and ignores its content if this directive is turned on. ; https://php.net/cgi.check-shebang-line ;cgi.check_shebang_line=1 ;;;;;;;;;;;;;;;; ; File Uploads ; ;;;;;;;;;;;;;;;; ; Whether to allow HTTP file uploads. ; https://php.net/file-uploads file_uploads = On ; Temporary directory for HTTP uploaded files (will use system default if not ; specified). ; https://php.net/upload-tmp-dir upload_tmp_dir = /tmp ; Maximum allowed size for uploaded files. ; https://php.net/upload-max-filesize upload_max_filesize = 325M ; Maximum number of files that can be uploaded via a single request max_file_uploads = 50 ;;;;;;;;;;;;;;;;;; ; Fopen wrappers ; ;;;;;;;;;;;;;;;;;; ; Whether to allow the treatment of URLs (like https:// or ftp://) as files. ; https://php.net/allow-url-fopen allow_url_fopen = On ; Whether to allow include/require to open URLs (like https:// or ftp://) as files. ; https://php.net/allow-url-include allow_url_include = Off ; Define the anonymous ftp password (your email address). PHP's default setting ; for this is empty. ; https://php.net/from ;from="john@doe.com" ; Define the User-Agent string. PHP's default setting for this is empty. ; https://php.net/user-agent ;user_agent="PHP" ; Default timeout for socket based streams (seconds) ; https://php.net/default-socket-timeout default_socket_timeout = 3600 ; If your scripts have to deal with files from Macintosh systems, ; or you are running on a Mac and need to deal with files from ; unix or win32 systems, setting this flag will cause PHP to ; automatically detect the EOL character in those files so that ; fgets() and file() will work regardless of the source of the file. ; https://php.net/auto-detect-line-endings auto_detect_line_endings = On ;;;;;;;;;;;;;;;;;;;;;; ; Dynamic Extensions ; ;;;;;;;;;;;;;;;;;;;;;; ; If you wish to have an extension loaded automatically, use the following ; syntax: ; ; extension=modulename ; ; For example: ; ; extension=mysqli ; ; When the extension library to load is not located in the default extension ; directory, You may specify an absolute path to the library file: ; ; extension=/path/to/extension/mysqli.so ; ; Note : The syntax used in previous PHP versions ('extension=.so' and ; 'extension='php_.dll') is supported for legacy reasons and may be ; deprecated in a future PHP major version. So, when it is possible, please ; move to the new ('extension=) syntax. ; ; Notes for Windows environments : ; ; - Many DLL files are located in the extensions/ (PHP 4) or ext/ (PHP 5+) ; extension folders as well as the separate PECL DLL download (PHP 5+). ; Be sure to appropriately set the extension_dir directive. ; ;extension=bz2 ;extension=curl ;extension=ffi ;extension=ftp ;extension=fileinfo ;extension=gd ;extension=gettext ;extension=gmp ;extension=intl ;extension=imap ;extension=ldap ;extension=mbstring ;extension=exif ; Must be after mbstring as it depends on it ;extension=mysqli ;extension=oci8_12c ; Use with Oracle Database 12c Instant Client ;extension=oci8_19 ; Use with Oracle Database 19 Instant Client ;extension=odbc ;extension=openssl ;extension=pdo_firebird ;extension=pdo_mysql ;extension=pdo_oci ;extension=pdo_odbc ;extension=pdo_pgsql ;extension=pdo_sqlite ;extension=pgsql ;extension=shmop ; The MIBS data available in the PHP distribution must be installed. ; See https://www.php.net/manual/en/snmp.installation.php ;extension=snmp ;extension=soap ;extension=sockets ;extension=sodium ;extension=sqlite3 ;extension=tidy ;extension=xsl ;zend_extension=opcache ;;;;;;;;;;;;;;;;;;; ; Module Settings ; ;;;;;;;;;;;;;;;;;;; [CLI Server] ; Whether the CLI web server uses ANSI color coding in its terminal output. cli_server.color = On [Date] ; Defines the default timezone used by the date functions ; https://php.net/date.timezone date.timezone = "UTC" ; https://php.net/date.default-latitude ;date.default_latitude = 31.7667 ; https://php.net/date.default-longitude ;date.default_longitude = 35.2333 ; https://php.net/date.sunrise-zenith ;date.sunrise_zenith = 90.833333 ; https://php.net/date.sunset-zenith ;date.sunset_zenith = 90.833333 [filter] ; https://php.net/filter.default ;filter.default = unsafe_raw ; https://php.net/filter.default-flags ;filter.default_flags = [iconv] ; Use of this INI entry is deprecated, use global input_encoding instead. ; If empty, default_charset or input_encoding or iconv.input_encoding is used. ; The precedence is: default_charset < input_encoding < iconv.input_encoding ;iconv.input_encoding = ; Use of this INI entry is deprecated, use global internal_encoding instead. ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;iconv.internal_encoding = ; Use of this INI entry is deprecated, use global output_encoding instead. ; If empty, default_charset or output_encoding or iconv.output_encoding is used. ; The precedence is: default_charset < output_encoding < iconv.output_encoding ; To use an output encoding conversion, iconv's output handler must be set ; otherwise output encoding conversion cannot be performed. ;iconv.output_encoding = [imap] ; rsh/ssh logins are disabled by default. Use this INI entry if you want to ; enable them. Note that the IMAP library does not filter mailbox names before ; passing them to rsh/ssh command, thus passing untrusted data to this function ; with rsh/ssh enabled is insecure. ;imap.enable_insecure_rsh=0 [intl] ;intl.default_locale = ; This directive allows you to produce PHP errors when some error ; happens within intl functions. The value is the level of the error produced. ; Default is 0, which does not produce any errors. ;intl.error_level = E_WARNING ;intl.use_exceptions = 0 [sqlite3] ; Directory pointing to SQLite3 extensions ; https://php.net/sqlite3.extension-dir ;sqlite3.extension_dir = ; SQLite defensive mode flag (only available from SQLite 3.26+) ; When the defensive flag is enabled, language features that allow ordinary ; SQL to deliberately corrupt the database file are disabled. This forbids ; writing directly to the schema, shadow tables (eg. FTS data tables), or ; the sqlite_dbpage virtual table. ; https://www.sqlite.org/c3ref/c_dbconfig_defensive.html ; (for older SQLite versions, this flag has no use) ;sqlite3.defensive = 1 [Pcre] ; PCRE library backtracking limit. ; https://php.net/pcre.backtrack-limit ;pcre.backtrack_limit=100000 ; PCRE library recursion limit. ; Please note that if you set this value to a high number you may consume all ; the available process stack and eventually crash PHP (due to reaching the ; stack size limit imposed by the Operating System). ; https://php.net/pcre.recursion-limit ;pcre.recursion_limit=100000 ; Enables or disables JIT compilation of patterns. This requires the PCRE ; library to be compiled with JIT support. ;pcre.jit=1 [Pdo] ; Whether to pool ODBC connections. Can be one of "strict", "relaxed" or "off" ; https://php.net/pdo-odbc.connection-pooling ;pdo_odbc.connection_pooling=strict [Pdo_mysql] ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. pdo_mysql.default_socket= [Phar] ; https://php.net/phar.readonly ;phar.readonly = On ; https://php.net/phar.require-hash ;phar.require_hash = On ;phar.cache_list = [mail function] ; For Win32 only. ; https://php.net/smtp ;SMTP = localhost ; https://php.net/smtp-port ;smtp_port = 25 ; For Win32 only. ; https://php.net/sendmail-from ;sendmail_from = me@example.com ; For Unix only. You may supply arguments as well (default: "sendmail -t -i"). ; https://php.net/sendmail-path sendmail_path = /usr/sbin/sendmail -t -i ; Force the addition of the specified parameters to be passed as extra parameters ; to the sendmail binary. These parameters will always replace the value of ; the 5th parameter to mail(). ;mail.force_extra_parameters = ; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename mail.add_x_header = Off ; The path to a log file that will log all mail() calls. Log entries include ; the full path of the script, line number, To address and headers. ;mail.log = ; Log mail to syslog (Event Log on Windows). ;mail.log = syslog [ODBC] ; https://php.net/odbc.default-db ;odbc.default_db = Not yet implemented ; https://php.net/odbc.default-user ;odbc.default_user = Not yet implemented ; https://php.net/odbc.default-pw ;odbc.default_pw = Not yet implemented ; Controls the ODBC cursor model. ; Default: SQL_CURSOR_STATIC (default). ;odbc.default_cursortype ; Allow or prevent persistent links. ; https://php.net/odbc.allow-persistent odbc.allow_persistent = On ; Check that a connection is still valid before reuse. ; https://php.net/odbc.check-persistent odbc.check_persistent = On ; Maximum number of persistent links. -1 means no limit. ; https://php.net/odbc.max-persistent odbc.max_persistent = -1 ; Maximum number of links (persistent + non-persistent). -1 means no limit. ; https://php.net/odbc.max-links odbc.max_links = -1 ; Handling of LONG fields. Returns number of bytes to variables. 0 means ; passthru. ; https://php.net/odbc.defaultlrl odbc.defaultlrl = 4096 ; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char. ; See the documentation on odbc_binmode and odbc_longreadlen for an explanation ; of odbc.defaultlrl and odbc.defaultbinmode ; https://php.net/odbc.defaultbinmode odbc.defaultbinmode = 1 [MySQLi] ; Maximum number of persistent links. -1 means no limit. ; https://php.net/mysqli.max-persistent mysqli.max_persistent = -1 ; Allow accessing, from PHP's perspective, local files with LOAD DATA statements ; https://php.net/mysqli.allow_local_infile ;mysqli.allow_local_infile = On ; It allows the user to specify a folder where files that can be sent via LOAD DATA ; LOCAL can exist. It is ignored if mysqli.allow_local_infile is enabled. ;mysqli.local_infile_directory = ; Allow or prevent persistent links. ; https://php.net/mysqli.allow-persistent mysqli.allow_persistent = On ; Maximum number of links. -1 means no limit. ; https://php.net/mysqli.max-links mysqli.max_links = -1 ; Default port number for mysqli_connect(). If unset, mysqli_connect() will use ; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the ; compile-time value defined MYSQL_PORT (in that order). Win32 will only look ; at MYSQL_PORT. ; https://php.net/mysqli.default-port mysqli.default_port = 3306 ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. ; https://php.net/mysqli.default-socket mysqli.default_socket = ; Default host for mysqli_connect() (doesn't apply in safe mode). ; https://php.net/mysqli.default-host mysqli.default_host = ; Default user for mysqli_connect() (doesn't apply in safe mode). ; https://php.net/mysqli.default-user mysqli.default_user = ; Default password for mysqli_connect() (doesn't apply in safe mode). ; Note that this is generally a *bad* idea to store passwords in this file. ; *Any* user with PHP access can run 'echo get_cfg_var("mysqli.default_pw") ; and reveal this password! And of course, any users with read access to this ; file will be able to reveal the password as well. ; https://php.net/mysqli.default-pw mysqli.default_pw = ; Allow or prevent reconnect mysqli.reconnect = Off ; If this option is enabled, closing a persistent connection will rollback ; any pending transactions of this connection, before it is put back ; into the persistent connection pool. ;mysqli.rollback_on_cached_plink = Off [mysqlnd] ; Enable / Disable collection of general statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. mysqlnd.collect_statistics = 0 ; Enable / Disable collection of memory usage statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. mysqlnd.collect_memory_statistics = 0 ; Records communication from all extensions using mysqlnd to the specified log ; file. ; https://php.net/mysqlnd.debug ;mysqlnd.debug = ; Defines which queries will be logged. ;mysqlnd.log_mask = 0 ; Default size of the mysqlnd memory pool, which is used by result sets. mysqlnd.mempool_default_size = 64000 ; Size of a pre-allocated buffer used when sending commands to MySQL in bytes. mysqlnd.net_cmd_buffer_size = 8192 ; Size of a pre-allocated buffer used for reading data sent by the server in ; bytes. mysqlnd.net_read_buffer_size = 131072 ; Timeout for network requests in seconds. ;mysqlnd.net_read_timeout = 31536000 ; SHA-256 Authentication Plugin related. File with the MySQL server public RSA ; key. ;mysqlnd.sha256_server_public_key = [OCI8] ; Connection: Enables privileged connections using external ; credentials (OCI_SYSOPER, OCI_SYSDBA) ; https://php.net/oci8.privileged-connect ;oci8.privileged_connect = Off ; Connection: The maximum number of persistent OCI8 connections per ; process. Using -1 means no limit. ; https://php.net/oci8.max-persistent ;oci8.max_persistent = -1 ; Connection: The maximum number of seconds a process is allowed to ; maintain an idle persistent connection. Using -1 means idle ; persistent connections will be maintained forever. ; https://php.net/oci8.persistent-timeout ;oci8.persistent_timeout = -1 ; Connection: The number of seconds that must pass before issuing a ; ping during oci_pconnect() to check the connection validity. When ; set to 0, each oci_pconnect() will cause a ping. Using -1 disables ; pings completely. ; https://php.net/oci8.ping-interval ;oci8.ping_interval = 60 ; Connection: Set this to a user chosen connection class to be used ; for all pooled server requests with Oracle 11g Database Resident ; Connection Pooling (DRCP). To use DRCP, this value should be set to ; the same string for all web servers running the same application, ; the database pool must be configured, and the connection string must ; specify to use a pooled server. ;oci8.connection_class = ; High Availability: Using On lets PHP receive Fast Application ; Notification (FAN) events generated when a database node fails. The ; database must also be configured to post FAN events. ;oci8.events = Off ; Tuning: This option enables statement caching, and specifies how ; many statements to cache. Using 0 disables statement caching. ; https://php.net/oci8.statement-cache-size ;oci8.statement_cache_size = 20 ; Tuning: Enables statement prefetching and sets the default number of ; rows that will be fetched automatically after statement execution. ; https://php.net/oci8.default-prefetch ;oci8.default_prefetch = 100 ; Compatibility. Using On means oci_close() will not close ; oci_connect() and oci_new_connect() connections. ; https://php.net/oci8.old-oci-close-semantics ;oci8.old_oci_close_semantics = Off [PostgreSQL] ; Allow or prevent persistent links. ; https://php.net/pgsql.allow-persistent pgsql.allow_persistent = On ; Detect broken persistent links always with pg_pconnect(). ; Auto reset feature requires a little overheads. ; https://php.net/pgsql.auto-reset-persistent pgsql.auto_reset_persistent = Off ; Maximum number of persistent links. -1 means no limit. ; https://php.net/pgsql.max-persistent pgsql.max_persistent = -1 ; Maximum number of links (persistent+non persistent). -1 means no limit. ; https://php.net/pgsql.max-links pgsql.max_links = -1 ; Ignore PostgreSQL backends Notice message or not. ; Notice message logging require a little overheads. ; https://php.net/pgsql.ignore-notice pgsql.ignore_notice = 0 ; Log PostgreSQL backends Notice message or not. ; Unless pgsql.ignore_notice=0, module cannot log notice message. ; https://php.net/pgsql.log-notice pgsql.log_notice = 0 [bcmath] ; Number of decimal digits for all bcmath functions. ; https://php.net/bcmath.scale bcmath.scale = 0 [browscap] ; https://php.net/browscap ;browscap = extra/browscap.ini [Session] ; Handler used to store/retrieve data. ; https://php.net/session.save-handler session.save_handler = files ; Argument passed to save_handler. In the case of files, this is the path ; where data files are stored. Note: Windows users have to change this ; variable in order to use PHP's session functions. ; ; The path can be defined as: ; ; session.save_path = "N;/path" ; ; where N is an integer. Instead of storing all the session files in ; /path, what this will do is use subdirectories N-levels deep, and ; store the session data in those directories. This is useful if ; your OS has problems with many files in one directory, and is ; a more efficient layout for servers that handle many sessions. ; ; NOTE 1: PHP will not create this directory structure automatically. ; You can use the script in the ext/session dir for that purpose. ; NOTE 2: See the section on garbage collection below if you choose to ; use subdirectories for session storage ; ; The file storage module creates files using mode 600 by default. ; You can change that by using ; ; session.save_path = "N;MODE;/path" ; ; where MODE is the octal representation of the mode. Note that this ; does not overwrite the process's umask. ; https://php.net/session.save-path session.save_path = "/opt/tmp" ; Whether to use strict session mode. ; Strict session mode does not accept an uninitialized session ID, and ; regenerates the session ID if the browser sends an uninitialized session ID. ; Strict mode protects applications from session fixation via a session adoption ; vulnerability. It is disabled by default for maximum compatibility, but ; enabling it is encouraged. ; https://wiki.php.net/rfc/strict_sessions session.use_strict_mode = 0 ; Whether to use cookies. ; https://php.net/session.use-cookies session.use_cookies = 1 ; https://php.net/session.cookie-secure ;session.cookie_secure = ; This option forces PHP to fetch and use a cookie for storing and maintaining ; the session id. We encourage this operation as it's very helpful in combating ; session hijacking when not specifying and managing your own session id. It is ; not the be-all and end-all of session hijacking defense, but it's a good start. ; https://php.net/session.use-only-cookies session.use_only_cookies = 1 ; Name of the session (used as cookie name). ; https://php.net/session.name session.name = PHPSESSID ; Initialize session on request startup. ; https://php.net/session.auto-start session.auto_start = 0 ; Lifetime in seconds of cookie or, if 0, until browser is restarted. ; https://php.net/session.cookie-lifetime session.cookie_lifetime = 0 ; The path for which the cookie is valid. ; https://php.net/session.cookie-path session.cookie_path = / ; The domain for which the cookie is valid. ; https://php.net/session.cookie-domain session.cookie_domain = ; Whether or not to add the httpOnly flag to the cookie, which makes it ; inaccessible to browser scripting languages such as JavaScript. ; https://php.net/session.cookie-httponly session.cookie_httponly = 1 ; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF) ; Current valid values are "Strict", "Lax" or "None". When using "None", ; make sure to include the quotes, as `none` is interpreted like `false` in ini files. ; https://tools.ietf.org/html/draft-west-first-party-cookies-07 session.cookie_samesite = ; Handler used to serialize data. php is the standard serializer of PHP. ; https://php.net/session.serialize-handler session.serialize_handler = php ; Defines the probability that the 'garbage collection' process is started on every ; session initialization. The probability is calculated by using gc_probability/gc_divisor, ; e.g. 1/100 means there is a 1% chance that the GC process starts on each request. ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; https://php.net/session.gc-probability session.gc_probability = 1 ; Defines the probability that the 'garbage collection' process is started on every ; session initialization. The probability is calculated by using gc_probability/gc_divisor, ; e.g. 1/100 means there is a 1% chance that the GC process starts on each request. ; For high volume production servers, using a value of 1000 is a more efficient approach. ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; https://php.net/session.gc-divisor session.gc_divisor = 1000 ; After this number of seconds, stored data will be seen as 'garbage' and ; cleaned up by the garbage collection process. ; https://php.net/session.gc-maxlifetime session.gc_maxlifetime = 1440 ; NOTE: If you are using the subdirectory option for storing session files ; (see session.save_path above), then garbage collection does *not* ; happen automatically. You will need to do your own garbage ; collection through a shell script, cron entry, or some other method. ; For example, the following script is the equivalent of setting ; session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes): ; find /path/to/sessions -cmin +24 -type f | xargs rm ; Check HTTP Referer to invalidate externally stored URLs containing ids. ; HTTP_REFERER has to contain this substring for the session to be ; considered as valid. ; https://php.net/session.referer-check session.referer_check = ; Set to {nocache,private,public,} to determine HTTP caching aspects ; or leave this empty to avoid sending anti-caching headers. ; https://php.net/session.cache-limiter session.cache_limiter = nocache ; Document expires after n minutes. ; https://php.net/session.cache-expire session.cache_expire = 180 ; trans sid support is disabled by default. ; Use of trans sid may risk your users' security. ; Use this option with caution. ; - User may send URL contains active session ID ; to other person via. email/irc/etc. ; - URL that contains active session ID may be stored ; in publicly accessible computer. ; - User may access your site with the same session ID ; always using URL stored in browser's history or bookmarks. ; https://php.net/session.use-trans-sid session.use_trans_sid = 0 ; Set session ID character length. This value could be between 22 to 256. ; Shorter length than default is supported only for compatibility reason. ; Users should use 32 or more chars. ; https://php.net/session.sid-length ; Default Value: 32 ; Development Value: 26 ; Production Value: 26 session.sid_length = 26 ; The URL rewriter will look for URLs in a defined set of HTML tags. ; is special; if you include them here, the rewriter will ; add a hidden field with the info which is otherwise appended ; to URLs. tag's action attribute URL will not be modified ; unless it is specified. ; Note that all valid entries require a "=", even if no value follows. ; Default Value: "a=href,area=href,frame=src,form=" ; Development Value: "a=href,area=href,frame=src,form=" ; Production Value: "a=href,area=href,frame=src,form=" ; https://php.net/url-rewriter.tags session.trans_sid_tags = "a=href,area=href,frame=src,form=" ; URL rewriter does not rewrite absolute URLs by default. ; To enable rewrites for absolute paths, target hosts must be specified ; at RUNTIME. i.e. use ini_set() ; tags is special. PHP will check action attribute's URL regardless ; of session.trans_sid_tags setting. ; If no host is defined, HTTP_HOST will be used for allowed host. ; Example value: php.net,www.php.net,wiki.php.net ; Use "," for multiple hosts. No spaces are allowed. ; Default Value: "" ; Development Value: "" ; Production Value: "" ;session.trans_sid_hosts="" ; Define how many bits are stored in each character when converting ; the binary hash data to something readable. ; Possible values: ; 4 (4 bits: 0-9, a-f) ; 5 (5 bits: 0-9, a-v) ; 6 (6 bits: 0-9, a-z, A-Z, "-", ",") ; Default Value: 4 ; Development Value: 5 ; Production Value: 5 ; https://php.net/session.hash-bits-per-character session.sid_bits_per_character = 5 ; Enable upload progress tracking in $_SESSION ; Default Value: On ; Development Value: On ; Production Value: On ; https://php.net/session.upload-progress.enabled ;session.upload_progress.enabled = On ; Cleanup the progress information as soon as all POST data has been read ; (i.e. upload completed). ; Default Value: On ; Development Value: On ; Production Value: On ; https://php.net/session.upload-progress.cleanup ;session.upload_progress.cleanup = On ; A prefix used for the upload progress key in $_SESSION ; Default Value: "upload_progress_" ; Development Value: "upload_progress_" ; Production Value: "upload_progress_" ; https://php.net/session.upload-progress.prefix ;session.upload_progress.prefix = "upload_progress_" ; The index name (concatenated with the prefix) in $_SESSION ; containing the upload progress information ; Default Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Development Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Production Value: "PHP_SESSION_UPLOAD_PROGRESS" ; https://php.net/session.upload-progress.name ;session.upload_progress.name = "PHP_SESSION_UPLOAD_PROGRESS" ; How frequently the upload progress should be updated. ; Given either in percentages (per-file), or in bytes ; Default Value: "1%" ; Development Value: "1%" ; Production Value: "1%" ; https://php.net/session.upload-progress.freq ;session.upload_progress.freq = "1%" ; The minimum delay between updates, in seconds ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; https://php.net/session.upload-progress.min-freq ;session.upload_progress.min_freq = "1" ; Only write session data when session data is changed. Enabled by default. ; https://php.net/session.lazy-write ;session.lazy_write = On [Assertion] ; Switch whether to compile assertions at all (to have no overhead at run-time) ; -1: Do not compile at all ; 0: Jump over assertion at run-time ; 1: Execute assertions ; Changing from or to a negative value is only possible in php.ini! (For turning assertions on and off at run-time, see assert.active, when zend.assertions = 1) ; Default Value: 1 ; Development Value: 1 ; Production Value: -1 ; https://php.net/zend.assertions zend.assertions = -1 ; Assert(expr); active by default. ; https://php.net/assert.active ;assert.active = On ; Throw an AssertionError on failed assertions ; https://php.net/assert.exception ;assert.exception = On ; Issue a PHP warning for each failed assertion. (Overridden by assert.exception if active) ; https://php.net/assert.warning ;assert.warning = On ; Don't bail out by default. ; https://php.net/assert.bail ;assert.bail = Off ; User-function to be called if an assertion fails. ; https://php.net/assert.callback ;assert.callback = 0 [COM] ; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs ; https://php.net/com.typelib-file ;com.typelib_file = ; allow Distributed-COM calls ; https://php.net/com.allow-dcom ;com.allow_dcom = true ; autoregister constants of a component's typelib on com_load() ; https://php.net/com.autoregister-typelib ;com.autoregister_typelib = true ; register constants casesensitive ; https://php.net/com.autoregister-casesensitive ;com.autoregister_casesensitive = false ; show warnings on duplicate constant registrations ; https://php.net/com.autoregister-verbose ;com.autoregister_verbose = true ; The default character set code-page to use when passing strings to and from COM objects. ; Default: system ANSI code page ;com.code_page= ; The version of the .NET framework to use. The value of the setting are the first three parts ; of the framework's version number, separated by dots, and prefixed with "v", e.g. "v4.0.30319". ;com.dotnet_version= [mbstring] ; language for internal character representation. ; This affects mb_send_mail() and mbstring.detect_order. ; https://php.net/mbstring.language ;mbstring.language = Japanese ; Use of this INI entry is deprecated, use global internal_encoding instead. ; internal/script encoding. ; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*) ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;mbstring.internal_encoding = ; Use of this INI entry is deprecated, use global input_encoding instead. ; http input encoding. ; mbstring.encoding_translation = On is needed to use this setting. ; If empty, default_charset or input_encoding or mbstring.input is used. ; The precedence is: default_charset < input_encoding < mbstring.http_input ; https://php.net/mbstring.http-input ;mbstring.http_input = ; Use of this INI entry is deprecated, use global output_encoding instead. ; http output encoding. ; mb_output_handler must be registered as output buffer to function. ; If empty, default_charset or output_encoding or mbstring.http_output is used. ; The precedence is: default_charset < output_encoding < mbstring.http_output ; To use an output encoding conversion, mbstring's output handler must be set ; otherwise output encoding conversion cannot be performed. ; https://php.net/mbstring.http-output ;mbstring.http_output = ; enable automatic encoding translation according to ; mbstring.internal_encoding setting. Input chars are ; converted to internal encoding by setting this to On. ; Note: Do _not_ use automatic encoding translation for ; portable libs/applications. ; https://php.net/mbstring.encoding-translation ;mbstring.encoding_translation = Off ; automatic encoding detection order. ; "auto" detect order is changed according to mbstring.language ; https://php.net/mbstring.detect-order ;mbstring.detect_order = auto ; substitute_character used when character cannot be converted ; one from another ; https://php.net/mbstring.substitute-character ;mbstring.substitute_character = none ; Enable strict encoding detection. ;mbstring.strict_detection = Off ; This directive specifies the regex pattern of content types for which mb_output_handler() ; is activated. ; Default: mbstring.http_output_conv_mimetypes=^(text/|application/xhtml\+xml) ;mbstring.http_output_conv_mimetypes= ; This directive specifies maximum stack depth for mbstring regular expressions. It is similar ; to the pcre.recursion_limit for PCRE. ;mbstring.regex_stack_limit=100000 ; This directive specifies maximum retry count for mbstring regular expressions. It is similar ; to the pcre.backtrack_limit for PCRE. ;mbstring.regex_retry_limit=1000000 [gd] ; Tell the jpeg decode to ignore warnings and try to create ; a gd image. The warning will then be displayed as notices ; disabled by default ; https://php.net/gd.jpeg-ignore-warning ;gd.jpeg_ignore_warning = 1 [exif] ; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS. ; With mbstring support this will automatically be converted into the encoding ; given by corresponding encode setting. When empty mbstring.internal_encoding ; is used. For the decode settings you can distinguish between motorola and ; intel byte order. A decode setting cannot be empty. ; https://php.net/exif.encode-unicode ;exif.encode_unicode = ISO-8859-15 ; https://php.net/exif.decode-unicode-motorola ;exif.decode_unicode_motorola = UCS-2BE ; https://php.net/exif.decode-unicode-intel ;exif.decode_unicode_intel = UCS-2LE ; https://php.net/exif.encode-jis ;exif.encode_jis = ; https://php.net/exif.decode-jis-motorola ;exif.decode_jis_motorola = JIS ; https://php.net/exif.decode-jis-intel ;exif.decode_jis_intel = JIS [Tidy] ; The path to a default tidy configuration file to use when using tidy ; https://php.net/tidy.default-config ;tidy.default_config = /usr/local/lib/php/default.tcfg ; Should tidy clean and repair output automatically? ; WARNING: Do not use this option if you are generating non-html content ; such as dynamic images ; https://php.net/tidy.clean-output tidy.clean_output = Off [soap] ; Enables or disables WSDL caching feature. ; https://php.net/soap.wsdl-cache-enabled soap.wsdl_cache_enabled=1 ; Sets the directory name where SOAP extension will put cache files. ; https://php.net/soap.wsdl-cache-dir soap.wsdl_cache_dir="/tmp" ; (time to live) Sets the number of second while cached file will be used ; instead of original one. ; https://php.net/soap.wsdl-cache-ttl soap.wsdl_cache_ttl=86400 ; Sets the size of the cache limit. (Max. number of WSDL files to cache) soap.wsdl_cache_limit = 5 [sysvshm] ; A default size of the shared memory segment ;sysvshm.init_mem = 10000 [ldap] ; Sets the maximum number of open links or -1 for unlimited. ldap.max_links = -1 [dba] ;dba.default_handler= [opcache] ; Determines if Zend OPCache is enabled ;opcache.enable=1 ; Determines if Zend OPCache is enabled for the CLI version of PHP ;opcache.enable_cli=0 ; The OPcache shared memory storage size. ;opcache.memory_consumption=128 ; The amount of memory for interned strings in Mbytes. ;opcache.interned_strings_buffer=8 ; The maximum number of keys (scripts) in the OPcache hash table. ; Only numbers between 200 and 1000000 are allowed. ;opcache.max_accelerated_files=10000 ; The maximum percentage of "wasted" memory until a restart is scheduled. ;opcache.max_wasted_percentage=5 ; When this directive is enabled, the OPcache appends the current working ; directory to the script key, thus eliminating possible collisions between ; files with the same name (basename). Disabling the directive improves ; performance, but may break existing applications. ;opcache.use_cwd=1 ; When disabled, you must reset the OPcache manually or restart the ; webserver for changes to the filesystem to take effect. ;opcache.validate_timestamps=1 ; How often (in seconds) to check file timestamps for changes to the shared ; memory storage allocation. ("1" means validate once per second, but only ; once per request. "0" means always validate) ;opcache.revalidate_freq=2 ; Enables or disables file search in include_path optimization ;opcache.revalidate_path=0 ; If disabled, all PHPDoc comments are dropped from the code to reduce the ; size of the optimized code. ;opcache.save_comments=1 ; If enabled, compilation warnings (including notices and deprecations) will ; be recorded and replayed each time a file is included. Otherwise, compilation ; warnings will only be emitted when the file is first cached. ;opcache.record_warnings=0 ; Allow file existence override (file_exists, etc.) performance feature. ;opcache.enable_file_override=0 ; A bitmask, where each bit enables or disables the appropriate OPcache ; passes ;opcache.optimization_level=0x7FFFBFFF ;opcache.dups_fix=0 ; The location of the OPcache blacklist file (wildcards allowed). ; Each OPcache blacklist file is a text file that holds the names of files ; that should not be accelerated. The file format is to add each filename ; to a new line. The filename may be a full path or just a file prefix ; (i.e., /var/www/x blacklists all the files and directories in /var/www ; that start with 'x'). Line starting with a ; are ignored (comments). ;opcache.blacklist_filename= ; Allows exclusion of large files from being cached. By default all files ; are cached. ;opcache.max_file_size=0 ; Check the cache checksum each N requests. ; The default value of "0" means that the checks are disabled. ;opcache.consistency_checks=0 ; How long to wait (in seconds) for a scheduled restart to begin if the cache ; is not being accessed. ;opcache.force_restart_timeout=180 ; OPcache error_log file name. Empty string assumes "stderr". ;opcache.error_log= ; All OPcache errors go to the Web server log. ; By default, only fatal errors (level 0) or errors (level 1) are logged. ; You can also enable warnings (level 2), info messages (level 3) or ; debug messages (level 4). ;opcache.log_verbosity_level=1 ; Preferred Shared Memory back-end. Leave empty and let the system decide. ;opcache.preferred_memory_model= ; Protect the shared memory from unexpected writing during script execution. ; Useful for internal debugging only. ;opcache.protect_memory=0 ; Allows calling OPcache API functions only from PHP scripts which path is ; started from specified string. The default "" means no restriction ;opcache.restrict_api= ; Mapping base of shared memory segments (for Windows only). All the PHP ; processes have to map shared memory into the same address space. This ; directive allows to manually fix the "Unable to reattach to base address" ; errors. ;opcache.mmap_base= ; Facilitates multiple OPcache instances per user (for Windows only). All PHP ; processes with the same cache ID and user share an OPcache instance. ;opcache.cache_id= ; Enables and sets the second level cache directory. ; It should improve performance when SHM memory is full, at server restart or ; SHM reset. The default "" disables file based caching. ;opcache.file_cache= ; Enables or disables opcode caching in shared memory. ;opcache.file_cache_only=0 ; Enables or disables checksum validation when script loaded from file cache. ;opcache.file_cache_consistency_checks=1 ; Implies opcache.file_cache_only=1 for a certain process that failed to ; reattach to the shared memory (for Windows only). Explicitly enabled file ; cache is required. ;opcache.file_cache_fallback=1 ; Enables or disables copying of PHP code (text segment) into HUGE PAGES. ; This should improve performance, but requires appropriate OS configuration. ;opcache.huge_code_pages=0 ; Validate cached file permissions. ;opcache.validate_permission=0 ; Prevent name collisions in chroot'ed environment. ;opcache.validate_root=0 ; If specified, it produces opcode dumps for debugging different stages of ; optimizations. ;opcache.opt_debug_level=0 ; Specifies a PHP script that is going to be compiled and executed at server ; start-up. ; https://php.net/opcache.preload ;opcache.preload= ; Preloading code as root is not allowed for security reasons. This directive ; facilitates to let the preloading to be run as another user. ; https://php.net/opcache.preload_user ;opcache.preload_user= ; Prevents caching files that are less than this number of seconds old. It ; protects from caching of incompletely updated files. In case all file updates ; on your site are atomic, you may increase performance by setting it to "0". ;opcache.file_update_protection=2 ; Absolute path used to store shared lockfiles (for *nix only). ;opcache.lockfile_path=/tmp [curl] ; A default value for the CURLOPT_CAINFO option. This is required to be an ; absolute path. ;curl.cainfo = [openssl] ; The location of a Certificate Authority (CA) file on the local filesystem ; to use when verifying the identity of SSL/TLS peers. Most users should ; not specify a value for this directive as PHP will attempt to use the ; OS-managed cert stores in its absence. If specified, this value may still ; be overridden on a per-stream basis via the "cafile" SSL stream context ; option. ;openssl.cafile= ; If openssl.cafile is not specified or if the CA file is not found, the ; directory pointed to by openssl.capath is searched for a suitable ; certificate. This value must be a correctly hashed certificate directory. ; Most users should not specify a value for this directive as PHP will ; attempt to use the OS-managed cert stores in its absence. If specified, ; this value may still be overridden on a per-stream basis via the "capath" ; SSL stream context option. ;openssl.capath= [ffi] ; FFI API restriction. Possible values: ; "preload" - enabled in CLI scripts and preloaded files (default) ; "false" - always disabled ; "true" - always enabled ;ffi.enable=preload ; List of headers files to preload, wildcard patterns allowed. ;ffi.preload= [Zend] zend_extension="/usr/local/ioncube/ioncube_loader_lin_8.1.so" ; fix for segfaults auto_globals_jit = Off cgi.fix_pathinfo = 1 mbstring.http_input = "pass" mbstring.http_output = "pass" mbstring.encoding_translation = 0 ; Enable Extensions extension=uploadprogress.so extension=imagick.so extension=redis.so ================================================ FILE: aegir/conf/php/php81-fpm ================================================ #!/bin/bash ### BEGIN INIT INFO # Provides: php81-fpm # Required-Start: $remote_fs $network # Required-Stop: $remote_fs $network # Default-Start: 2 3 4 5 # Default-Stop: 0 1 6 # Short-Description: starts php81-fpm # Description: starts the PHP FastCGI Process Manager daemon ### END INIT INFO prefix=/opt/php81 exec_prefix=${prefix} php_fpm_BIN=/opt/php81/sbin/php-fpm php_fpm_CONF=/opt/php81/etc/php81-fpm.conf php_fpm_PID=/run/php81-fpm.pid php_opts="--fpm-config $php_fpm_CONF --pid $php_fpm_PID -c /opt/php81/etc/php81.ini" wait_for_pid() { try=0 while test $try -lt 5; do case "$1" in 'created') if [ -f "$2" ]; then try='' break fi ;; 'removed') if [ ! -f "$2" ]; then try='' break fi ;; esac echo -n . try=`expr $try + 1` sleep 1 done } case "$1" in start) echo -n "Starting php81-fpm..." $php_fpm_BIN --daemonize $php_opts if [ "$?" != 0 ]; then echo " failed" exit 1 fi wait_for_pid created $php_fpm_PID if [ -n "$try" ]; then echo " failed" exit 1 else echo " done" fi ;; stop) echo -n "Gracefully shutting down php81-fpm..." if [ ! -r $php_fpm_PID ]; then echo "warning, no pid file found - php81-fpm is not running ?" exit 1 fi kill -QUIT `cat $php_fpm_PID` wait_for_pid removed $php_fpm_PID if [ -n "$try" ]; then echo " failed. Use force-quit" exit 1 else echo " done" fi ;; status) if [ ! -r $php_fpm_PID ]; then echo "php81-fpm is stopped" exit 0 fi PID=`cat $php_fpm_PID` if ps -p $PID | grep -q $PID; then echo "php81-fpm (pid $PID) is running..." else echo "php81-fpm dead but pid file exists" fi ;; force-quit) echo -n "Terminating php81-fpm..." if [ ! -r $php_fpm_PID ]; then echo "warning, no pid file found - php81-fpm is not running ?" exit 1 fi kill -TERM `cat $php_fpm_PID` wait_for_pid removed $php_fpm_PID if [ -n "$try" ]; then echo " failed" exit 1 else echo " done" fi ;; restart) $0 stop $0 start ;; reload) echo -n "Reloading service php81-fpm..." if [ ! -r $php_fpm_PID ]; then echo "warning, no pid file found - php81-fpm is not running ?" exit 1 fi kill -USR2 `cat $php_fpm_PID` echo " done" ;; configtest) $php_fpm_BIN -t ;; *) echo "Usage: $0 {start|stop|force-quit|restart|reload|status|configtest}" exit 1 ;; esac ================================================ FILE: aegir/conf/php/php81-fpm.conf ================================================ ;;;;;;;;;;;;;;;;;;;;; ; FPM Configuration ; ;;;;;;;;;;;;;;;;;;;;; ; All relative paths in this configuration file are relative to PHP's install ; prefix (/opt/php81). This prefix can be dynamically changed by using the ; '-p' argument from the command line. ; Include one or more files. If glob(3) exists, it is used to include a bunch of ; files from a glob(3) pattern. This directive can be used everywhere in the ; file. ; Relative path can also be used. They will be prefixed by: ; - the global prefix if it's been set (-p argument) ; - /opt/php81 otherwise ;include=etc/fpm.d/*.conf ;;;;;;;;;;;;;;;;;; ; Global Options ; ;;;;;;;;;;;;;;;;;; [global] ; Pid file ; Note: the default prefix is /opt/php81/var ; Default Value: none pid = /run/php81-fpm.pid ; Error log file ; If it's set to "syslog", log is sent to syslogd instead of being written ; in a local file. ; Note: the default prefix is /opt/php81/var ; Default Value: log/php-fpm.log error_log = /var/log/php/php81-fpm-error.log ; syslog_facility is used to specify what type of program is logging the ; message. This lets syslogd specify that messages from different facilities ; will be handled differently. ; See syslog(3) for possible values (ex daemon equiv LOG_DAEMON) ; Default Value: daemon syslog.facility = daemon ; syslog_ident is prepended to every message. If you have multiple FPM ; instances running on the same server, you can change the default value ; which must suit common needs. ; Default Value: php-fpm syslog.ident = php81-fpm ; Log level ; Possible Values: alert, error, warning, notice, debug ; Default Value: notice log_level = warning ; If this number of child processes exit with SIGSEGV or SIGBUS within the time ; interval set by emergency_restart_interval then FPM will restart. A value ; of '0' means 'Off'. ; Default Value: 0 emergency_restart_threshold = 5 ; Interval of time used by emergency_restart_interval to determine when ; a graceful restart will be initiated. This can be useful to work around ; accidental corruptions in an accelerator's shared memory. ; Available Units: s(econds), m(inutes), h(ours), or d(ays) ; Default Unit: seconds ; Default Value: 0 emergency_restart_interval = 1m ; Time limit for child processes to wait for a reaction on signals from master. ; Available units: s(econds), m(inutes), h(ours), or d(ays) ; Default Unit: seconds ; Default Value: 0 process_control_timeout = 5s ; The maximum number of processes FPM will fork. This has been design to control ; the global number of processes when using dynamic PM within a lot of pools. ; Use it with caution. ; Note: A value of 0 indicates no limit ; Default Value: 0 process.max = 0 ; Specify the nice(2) priority to apply to the master process (only if set) ; The value can vary from -19 (highest priority) to 20 (lower priority) ; Note: - It will only work if the FPM master process is launched as root ; - The pool process will inherit the master process priority ; unless it specified otherwise ; Default Value: no set ; process.priority = -19 ; Send FPM to background. Set to 'no' to keep FPM in foreground for debugging. ; Default Value: yes daemonize = yes ; Set open file descriptor rlimit for the master process. ; Default Value: system defined value ;rlimit_files = 1024 ; Set max core size rlimit for the master process. ; Possible Values: 'unlimited' or an integer greater or equal to 0 ; Default Value: system defined value ;rlimit_core = 0 ; Specify the event mechanism FPM will use. The following is available: ; - select (any POSIX os) ; - poll (any POSIX os) ; - epoll (linux >= 2.5.44) ; - kqueue (FreeBSD >= 4.1, OpenBSD >= 2.9, NetBSD >= 2.0) ; - /dev/poll (Solaris >= 7) ; - port (Solaris >= 10) ; Default Value: not set (auto detection) ;events.mechanism = epoll ;;;;;;;;;;;;;;;;;;;; ; Pool Definitions ; ;;;;;;;;;;;;;;;;;;;; ; Multiple pools of child processes may be started with different listening ; ports and different management options. The name of the pool will be ; used in logs and stats. There is no limitation on the number of pools which ; FPM can handle. Your system will tell you anyway :) include = /opt/php81/etc/pool.d/*.conf ================================================ FILE: aegir/conf/php/php81.ini ================================================ [PHP] ;;;;;;;;;;;;;;;;;;; ; About php.ini ; ;;;;;;;;;;;;;;;;;;; ; PHP's initialization file, generally called php.ini, is responsible for ; configuring many of the aspects of PHP's behavior. ; PHP attempts to find and load this configuration from a number of locations. ; The following is a summary of its search order: ; 1. SAPI module specific location. ; 2. The PHPRC environment variable. (As of PHP 5.2.0) ; 3. A number of predefined registry keys on Windows (As of PHP 5.2.0) ; 4. Current working directory (except CLI) ; 5. The web server's directory (for SAPI modules), or directory of PHP ; (otherwise in Windows) ; 6. The directory from the --with-config-file-path compile time option, or the ; Windows directory (usually C:\windows) ; See the PHP docs for more specific information. ; https://php.net/configuration.file ; The syntax of the file is extremely simple. Whitespace and lines ; beginning with a semicolon are silently ignored (as you probably guessed). ; Section headers (e.g. [Foo]) are also silently ignored, even though ; they might mean something in the future. ; Directives following the section heading [PATH=/www/mysite] only ; apply to PHP files in the /www/mysite directory. Directives ; following the section heading [HOST=www.example.com] only apply to ; PHP files served from www.example.com. Directives set in these ; special sections cannot be overridden by user-defined INI files or ; at runtime. Currently, [PATH=] and [HOST=] sections only work under ; CGI/FastCGI. ; https://php.net/ini.sections ; Directives are specified using the following syntax: ; directive = value ; Directive names are *case sensitive* - foo=bar is different from FOO=bar. ; Directives are variables used to configure PHP or PHP extensions. ; There is no name validation. If PHP can't find an expected ; directive because it is not set or is mistyped, a default value will be used. ; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one ; of the INI constants (On, Off, True, False, Yes, No and None) or an expression ; (e.g. E_ALL & ~E_NOTICE), a quoted string ("bar"), or a reference to a ; previously set variable or directive (e.g. ${foo}) ; Expressions in the INI file are limited to bitwise operators and parentheses: ; | bitwise OR ; ^ bitwise XOR ; & bitwise AND ; ~ bitwise NOT ; ! boolean NOT ; Boolean flags can be turned on using the values 1, On, True or Yes. ; They can be turned off using the values 0, Off, False or No. ; An empty string can be denoted by simply not writing anything after the equal ; sign, or by using the None keyword: ; foo = ; sets foo to an empty string ; foo = None ; sets foo to an empty string ; foo = "None" ; sets foo to the string 'None' ; If you use constants in your value, and these constants belong to a ; dynamically loaded extension (either a PHP extension or a Zend extension), ; you may only use these constants *after* the line that loads the extension. ;;;;;;;;;;;;;;;;;;; ; About this file ; ;;;;;;;;;;;;;;;;;;; ; PHP comes packaged with two INI files. One that is recommended to be used ; in production environments and one that is recommended to be used in ; development environments. ; php.ini-production contains settings which hold security, performance and ; best practices at its core. But please be aware, these settings may break ; compatibility with older or less security conscience applications. We ; recommending using the production ini in production and testing environments. ; php.ini-development is very similar to its production variant, except it is ; much more verbose when it comes to errors. We recommend using the ; development version only in development environments, as errors shown to ; application users can inadvertently leak otherwise secure information. ; This is the php.ini-production INI file. ;;;;;;;;;;;;;;;;;;; ; Quick Reference ; ;;;;;;;;;;;;;;;;;;; ; The following are all the settings which are different in either the production ; or development versions of the INIs with respect to PHP's default behavior. ; Please see the actual settings later in the document for more details as to why ; we recommend these changes in PHP's behavior. display_errors = Off ; Default Value: On ; Development Value: On ; Production Value: Off ; display_startup_errors ; Default Value: On ; Development Value: On ; Production Value: Off ; error_reporting ; Default Value: E_ALL ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; log_errors ; Default Value: Off ; Development Value: On ; Production Value: On ; max_input_time ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; output_buffering ; Default Value: Off ; Development Value: 4096 ; Production Value: 4096 ; register_argc_argv ; Default Value: On ; Development Value: Off ; Production Value: Off ; request_order ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; session.gc_divisor ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; session.sid_bits_per_character ; Default Value: 4 ; Development Value: 5 ; Production Value: 5 ; short_open_tag ; Default Value: On ; Development Value: Off ; Production Value: Off ; variables_order ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS" ; zend.exception_ignore_args ; Default Value: Off ; Development Value: Off ; Production Value: On ; zend.exception_string_param_max_len ; Default Value: 15 ; Development Value: 15 ; Production Value: 0 ;;;;;;;;;;;;;;;;;;;; ; php.ini Options ; ;;;;;;;;;;;;;;;;;;;; ; Name for user-defined php.ini (.htaccess) files. Default is ".user.ini" ;user_ini.filename = ".user.ini" ; To disable this feature set this option to an empty value user_ini.filename = ; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes) ;user_ini.cache_ttl = 300 ;;;;;;;;;;;;;;;;;;;; ; Language Options ; ;;;;;;;;;;;;;;;;;;;; ; Enable the PHP scripting language engine under Apache. ; https://php.net/engine engine = On ; This directive determines whether or not PHP will recognize code between ; tags as PHP source which should be processed as such. It is ; generally recommended that should be used and that this feature ; should be disabled, as enabling it may result in issues when generating XML ; documents, however this remains supported for backward compatibility reasons. ; Note that this directive does not control the would work. ; https://php.net/syntax-highlighting ;highlight.string = #DD0000 ;highlight.comment = #FF9900 ;highlight.keyword = #007700 ;highlight.default = #0000BB ;highlight.html = #000000 ; If enabled, the request will be allowed to complete even if the user aborts ; the request. Consider enabling it if executing long requests, which may end up ; being interrupted by the user or a browser timing out. PHP's default behavior ; is to disable this feature. ; https://php.net/ignore-user-abort ;ignore_user_abort = On ; Determines the size of the realpath cache to be used by PHP. This value should ; be increased on systems where PHP opens many files to reflect the quantity of ; the file operations performed. ; Note: if open_basedir is set, the cache is disabled ; https://php.net/realpath-cache-size realpath_cache_size=64M ; Duration of time, in seconds for which to cache realpath information for a given ; file or directory. For systems with rarely changing files, consider increasing this ; value. ; https://php.net/realpath-cache-ttl realpath_cache_ttl=180 ; Enables or disables the circular reference collector. ; https://php.net/zend.enable-gc zend.enable_gc = On ; If enabled, scripts may be written in encodings that are incompatible with ; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such ; encodings. To use this feature, mbstring extension must be enabled. ;zend.multibyte = Off ; Allows to set the default encoding for the scripts. This value will be used ; unless "declare(encoding=...)" directive appears at the top of the script. ; Only affects if zend.multibyte is set. ;zend.script_encoding = ; Allows to include or exclude arguments from stack traces generated for exceptions. ; In production, it is recommended to turn this setting on to prohibit the output ; of sensitive information in stack traces ; Default Value: Off ; Development Value: Off ; Production Value: On zend.exception_ignore_args = On ; Allows setting the maximum string length in an argument of a stringified stack trace ; to a value between 0 and 1000000. ; This has no effect when zend.exception_ignore_args is enabled. ; Default Value: 15 ; Development Value: 15 ; Production Value: 0 ; In production, it is recommended to set this to 0 to reduce the output ; of sensitive information in stack traces. zend.exception_string_param_max_len = 0 ;;;;;;;;;;;;;;;;; ; Miscellaneous ; ;;;;;;;;;;;;;;;;; ; Decides whether PHP may expose the fact that it is installed on the server ; (e.g. by adding its signature to the Web server header). It is no security ; threat in any way, but it makes it possible to determine whether you use PHP ; on your server or not. ; https://php.net/expose-php expose_php = On ;;;;;;;;;;;;;;;;;;; ; Resource Limits ; ;;;;;;;;;;;;;;;;;;; ; Maximum execution time of each script, in seconds ; https://php.net/max-execution-time ; Note: This directive is hardcoded to 0 for the CLI SAPI max_execution_time = 180 ; Maximum amount of time each script may spend parsing request data. It's a good ; idea to limit this time on productions servers in order to eliminate unexpectedly ; long running scripts. ; Note: This directive is hardcoded to -1 for the CLI SAPI ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; https://php.net/max-input-time max_input_time = 180 ; Maximum input variable nesting level ; https://php.net/max-input-nesting-level ;max_input_nesting_level = 64 ; How many GET/POST/COOKIE input variables may be accepted max_input_vars = 9999 ; Maximum amount of memory a script may consume ; https://php.net/memory-limit memory_limit = 395M ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; Error handling and logging ; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; This directive informs PHP of which errors, warnings and notices you would like ; it to take action for. The recommended way of setting values for this ; directive is through the use of the error level constants and bitwise ; operators. The error level constants are below here for convenience as well as ; some common settings and their meanings. ; By default, PHP is set to take action on all errors, notices and warnings EXCEPT ; those related to E_NOTICE and E_STRICT, which together cover best practices and ; recommended coding standards in PHP. For performance reasons, this is the ; recommend error reporting setting. Your production server shouldn't be wasting ; resources complaining about best practices and coding standards. That's what ; development servers and development settings are for. ; Note: The php.ini-development file has this setting as E_ALL. This ; means it pretty much reports everything which is exactly what you want during ; development and early testing. ; ; Error Level Constants: ; E_ALL - All errors and warnings (includes E_STRICT as of PHP 5.4.0) ; E_ERROR - fatal run-time errors ; E_RECOVERABLE_ERROR - almost fatal run-time errors ; E_WARNING - run-time warnings (non-fatal errors) ; E_PARSE - compile-time parse errors ; E_NOTICE - run-time notices (these are warnings which often result ; from a bug in your code, but it's possible that it was ; intentional (e.g., using an uninitialized variable and ; relying on the fact it is automatically initialized to an ; empty string) ; E_STRICT - run-time notices, enable to have PHP suggest changes ; to your code which will ensure the best interoperability ; and forward compatibility of your code ; E_CORE_ERROR - fatal errors that occur during PHP's initial startup ; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's ; initial startup ; E_COMPILE_ERROR - fatal compile-time errors ; E_COMPILE_WARNING - compile-time warnings (non-fatal errors) ; E_USER_ERROR - user-generated error message ; E_USER_WARNING - user-generated warning message ; E_USER_NOTICE - user-generated notice message ; E_DEPRECATED - warn about code that will not work in future versions ; of PHP ; E_USER_DEPRECATED - user-generated deprecation warnings ; ; Common Values: ; E_ALL (Show all errors, warnings and notices including coding standards.) ; E_ALL & ~E_NOTICE (Show all errors, except for notices) ; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.) ; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors) ; Default Value: E_ALL ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; https://php.net/error-reporting error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT ; This directive controls whether or not and where PHP will output errors, ; notices and warnings too. Error output is very useful during development, but ; it could be very dangerous in production environments. Depending on the code ; which is triggering the error, sensitive information could potentially leak ; out of your application such as database usernames and passwords or worse. ; For production environments, we recommend logging errors rather than ; sending them to STDOUT. ; Possible Values: ; Off = Do not display any errors ; stderr = Display errors to STDERR (affects only CGI/CLI binaries!) ; On or stdout = Display errors to STDOUT ; Default Value: On ; Development Value: On ; Production Value: Off ; https://php.net/display-errors display_errors = Off ; The display of errors which occur during PHP's startup sequence are handled ; separately from display_errors. We strongly recommend you set this to 'off' ; for production servers to avoid leaking configuration details. ; Default Value: On ; Development Value: On ; Production Value: Off ; https://php.net/display-startup-errors display_startup_errors = Off ; Besides displaying errors, PHP can also log errors to locations such as a ; server-specific log, STDERR, or a location specified by the error_log ; directive found below. While errors should not be displayed on productions ; servers they should still be monitored and logging is a great way to do that. ; Default Value: Off ; Development Value: On ; Production Value: On ; https://php.net/log-errors log_errors = On ; Do not log repeated messages. Repeated errors must occur in same file on same ; line unless ignore_repeated_source is set true. ; https://php.net/ignore-repeated-errors ignore_repeated_errors = Off ; Ignore source of message when ignoring repeated messages. When this setting ; is On you will not log errors with repeated messages from different files or ; source lines. ; https://php.net/ignore-repeated-source ignore_repeated_source = Off ; If this parameter is set to Off, then memory leaks will not be shown (on ; stdout or in the log). This is only effective in a debug compile, and if ; error reporting includes E_WARNING in the allowed list ; https://php.net/report-memleaks report_memleaks = On ; This setting is off by default. ;report_zend_debug = 0 ; Turn off normal error reporting and emit XML-RPC error XML ; https://php.net/xmlrpc-errors ;xmlrpc_errors = 0 ; An XML-RPC faultCode ;xmlrpc_error_number = 0 ; When PHP displays or logs an error, it has the capability of formatting the ; error message as HTML for easier reading. This directive controls whether ; the error message is formatted as HTML or not. ; Note: This directive is hardcoded to Off for the CLI SAPI ; https://php.net/html-errors html_errors = Off ; If html_errors is set to On *and* docref_root is not empty, then PHP ; produces clickable error messages that direct to a page describing the error ; or function causing the error in detail. ; You can download a copy of the PHP manual from https://php.net/docs ; and change docref_root to the base URL of your local copy including the ; leading '/'. You must also specify the file extension being used including ; the dot. PHP's default behavior is to leave these settings empty, in which ; case no links to documentation are generated. ; Note: Never use this feature for production boxes. ; https://php.net/docref-root ; Examples ;docref_root = "/phpmanual/" ; https://php.net/docref-ext ;docref_ext = .html ; String to output before an error message. PHP's default behavior is to leave ; this setting blank. ; https://php.net/error-prepend-string ; Example: ;error_prepend_string = "" ; String to output after an error message. PHP's default behavior is to leave ; this setting blank. ; https://php.net/error-append-string ; Example: ;error_append_string = "" ; Log errors to specified file. PHP's default behavior is to leave this value ; empty. ; https://php.net/error-log ; Example: ;error_log = php_errors.log ; Log errors to syslog (Event Log on Windows). ;error_log = syslog error_log = /var/log/php/error_log_81 ; The syslog ident is a string which is prepended to every message logged ; to syslog. Only used when error_log is set to syslog. ;syslog.ident = php ; The syslog facility is used to specify what type of program is logging ; the message. Only used when error_log is set to syslog. ;syslog.facility = user ; Set this to disable filtering control characters (the default). ; Some loggers only accept NVT-ASCII, others accept anything that's not ; control characters. If your logger accepts everything, then no filtering ; is needed at all. ; Allowed values are: ; ascii (all printable ASCII characters and NL) ; no-ctrl (all characters except control characters) ; all (all characters) ; raw (like "all", but messages are not split at newlines) ; https://php.net/syslog.filter ;syslog.filter = ascii ;windows.show_crt_warning ; Default value: 0 ; Development value: 0 ; Production value: 0 ;;;;;;;;;;;;;;;;; ; Data Handling ; ;;;;;;;;;;;;;;;;; ; The separator used in PHP generated URLs to separate arguments. ; PHP's default setting is "&". ; https://php.net/arg-separator.output ; Example: ;arg_separator.output = "&" ; List of separator(s) used by PHP to parse input URLs into variables. ; PHP's default setting is "&". ; NOTE: Every character in this directive is considered as separator! ; https://php.net/arg-separator.input ; Example: ;arg_separator.input = ";&" ; This directive determines which super global arrays are registered when PHP ; starts up. G,P,C,E & S are abbreviations for the following respective super ; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty ; paid for the registration of these arrays and because ENV is not as commonly ; used as the others, ENV is not recommended on productions servers. You ; can still get access to the environment variables through getenv() should you ; need to. ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS"; ; https://php.net/variables-order variables_order = "GPCS" ; This directive determines which super global data (G,P & C) should be ; registered into the super global array REQUEST. If so, it also determines ; the order in which that data is registered. The values for this directive ; are specified in the same manner as the variables_order directive, ; EXCEPT one. Leaving this value empty will cause PHP to use the value set ; in the variables_order directive. It does not mean it will leave the super ; globals array REQUEST empty. ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; https://php.net/request-order request_order = "GP" ; This directive determines whether PHP registers $argv & $argc each time it ; runs. $argv contains an array of all the arguments passed to PHP when a script ; is invoked. $argc contains an integer representing the number of arguments ; that were passed when the script was invoked. These arrays are extremely ; useful when running scripts from the command line. When this directive is ; enabled, registering these variables consumes CPU cycles and memory each time ; a script is executed. For performance reasons, this feature should be disabled ; on production servers. ; Note: This directive is hardcoded to On for the CLI SAPI ; Default Value: On ; Development Value: Off ; Production Value: Off ; https://php.net/register-argc-argv register_argc_argv = Off ; When enabled, the ENV, REQUEST and SERVER variables are created when they're ; first used (Just In Time) instead of when the script starts. If these ; variables are not used within a script, having this directive on will result ; in a performance gain. The PHP directive register_argc_argv must be disabled ; for this directive to have any effect. ; https://php.net/auto-globals-jit auto_globals_jit = On ; Whether PHP will read the POST data. ; This option is enabled by default. ; Most likely, you won't want to disable this option globally. It causes $_POST ; and $_FILES to always be empty; the only way you will be able to read the ; POST data will be through the php://input stream wrapper. This can be useful ; to proxy requests or to process the POST data in a memory efficient fashion. ; https://php.net/enable-post-data-reading ;enable_post_data_reading = Off ; Maximum size of POST data that PHP will accept. ; Its value may be 0 to disable the limit. It is ignored if POST data reading ; is disabled through enable_post_data_reading. ; https://php.net/post-max-size post_max_size = 350M ; Automatically add files before PHP document. ; https://php.net/auto-prepend-file auto_prepend_file = ; Automatically add files after PHP document. ; https://php.net/auto-append-file auto_append_file = ; By default, PHP will output a media type using the Content-Type header. To ; disable this, simply set it to be empty. ; ; PHP's built-in default media type is set to text/html. ; https://php.net/default-mimetype default_mimetype = "text/html" ; PHP's default character set is set to UTF-8. ; https://php.net/default-charset default_charset = "UTF-8" ; PHP internal character encoding is set to empty. ; If empty, default_charset is used. ; https://php.net/internal-encoding ;internal_encoding = ; PHP input character encoding is set to empty. ; If empty, default_charset is used. ; https://php.net/input-encoding ;input_encoding = ; PHP output character encoding is set to empty. ; If empty, default_charset is used. ; See also output_buffer. ; https://php.net/output-encoding ;output_encoding = ;;;;;;;;;;;;;;;;;;;;;;;;; ; Paths and Directories ; ;;;;;;;;;;;;;;;;;;;;;;;;; ; UNIX: "/path1:/path2" ;include_path = ".:/php/includes" ; ; Windows: "\path1;\path2" ;include_path = ".;c:\php\includes" ; ; PHP's default setting for include_path is ".;/path/to/php/pear" ; https://php.net/include-path include_path = ".:/opt/php81/lib/php" ; The root of the PHP pages, used only if nonempty. ; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root ; if you are running php as a CGI under any web server (other than IIS) ; see documentation for security issues. The alternate is to use the ; cgi.force_redirect configuration below ; https://php.net/doc-root doc_root = ; The directory under which PHP opens the script using /~username used only ; if nonempty. ; https://php.net/user-dir user_dir = ; Directory in which the loadable extensions (modules) reside. ; https://php.net/extension-dir ;extension_dir = "./" ; On windows: ;extension_dir = "ext" extension_dir = "/opt/php81/lib/php/extensions/no-debug-non-zts-20210902/" ; Directory where the temporary files should be placed. ; Defaults to the system default (see sys_get_temp_dir) sys_temp_dir = "/tmp" ; Whether or not to enable the dl() function. The dl() function does NOT work ; properly in multithreaded servers, such as IIS or Zeus, and is automatically ; disabled on them. ; https://php.net/enable-dl enable_dl = Off ; cgi.force_redirect is necessary to provide security running PHP as a CGI under ; most web servers. Left undefined, PHP turns this on by default. You can ; turn it off here AT YOUR OWN RISK ; **You CAN safely turn this off for IIS, in fact, you MUST.** ; https://php.net/cgi.force-redirect ;cgi.force_redirect = 1 ; if cgi.nph is enabled it will force cgi to always sent Status: 200 with ; every request. PHP's default behavior is to disable this feature. ;cgi.nph = 1 ; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape ; (iPlanet) web servers, you MAY need to set an environment variable name that PHP ; will look for to know it is OK to continue execution. Setting this variable MAY ; cause security issues, KNOW WHAT YOU ARE DOING FIRST. ; https://php.net/cgi.redirect-status-env ;cgi.redirect_status_env = ; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's ; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok ; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting ; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting ; of zero causes PHP to behave as before. Default is 1. You should fix your scripts ; to use SCRIPT_FILENAME rather than PATH_TRANSLATED. ; https://php.net/cgi.fix-pathinfo ;cgi.fix_pathinfo=1 ; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside ; of the web tree and people will not be able to circumvent .htaccess security. ;cgi.discard_path=1 ; FastCGI under IIS supports the ability to impersonate ; security tokens of the calling client. This allows IIS to define the ; security context that the request runs under. mod_fastcgi under Apache ; does not currently support this feature (03/17/2002) ; Set to 1 if running under IIS. Default is zero. ; https://php.net/fastcgi.impersonate ;fastcgi.impersonate = 1 ; Disable logging through FastCGI connection. PHP's default behavior is to enable ; this feature. ;fastcgi.logging = 0 ; cgi.rfc2616_headers configuration option tells PHP what type of headers to ; use when sending HTTP response code. If set to 0, PHP sends Status: header that ; is supported by Apache. When this option is set to 1, PHP will send ; RFC2616 compliant header. ; Default is zero. ; https://php.net/cgi.rfc2616-headers ;cgi.rfc2616_headers = 0 ; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #! ; (shebang) at the top of the running script. This line might be needed if the ; script support running both as stand-alone script and via PHP CGI<. PHP in CGI ; mode skips this line and ignores its content if this directive is turned on. ; https://php.net/cgi.check-shebang-line ;cgi.check_shebang_line=1 ;;;;;;;;;;;;;;;; ; File Uploads ; ;;;;;;;;;;;;;;;; ; Whether to allow HTTP file uploads. ; https://php.net/file-uploads file_uploads = On ; Temporary directory for HTTP uploaded files (will use system default if not ; specified). ; https://php.net/upload-tmp-dir upload_tmp_dir = /tmp ; Maximum allowed size for uploaded files. ; https://php.net/upload-max-filesize upload_max_filesize = 325M ; Maximum number of files that can be uploaded via a single request max_file_uploads = 50 ;;;;;;;;;;;;;;;;;; ; Fopen wrappers ; ;;;;;;;;;;;;;;;;;; ; Whether to allow the treatment of URLs (like https:// or ftp://) as files. ; https://php.net/allow-url-fopen allow_url_fopen = On ; Whether to allow include/require to open URLs (like https:// or ftp://) as files. ; https://php.net/allow-url-include allow_url_include = Off ; Define the anonymous ftp password (your email address). PHP's default setting ; for this is empty. ; https://php.net/from ;from="john@doe.com" ; Define the User-Agent string. PHP's default setting for this is empty. ; https://php.net/user-agent ;user_agent="PHP" ; Default timeout for socket based streams (seconds) ; https://php.net/default-socket-timeout default_socket_timeout = 180 ; If your scripts have to deal with files from Macintosh systems, ; or you are running on a Mac and need to deal with files from ; unix or win32 systems, setting this flag will cause PHP to ; automatically detect the EOL character in those files so that ; fgets() and file() will work regardless of the source of the file. ; https://php.net/auto-detect-line-endings auto_detect_line_endings = On ;;;;;;;;;;;;;;;;;;;;;; ; Dynamic Extensions ; ;;;;;;;;;;;;;;;;;;;;;; ; If you wish to have an extension loaded automatically, use the following ; syntax: ; ; extension=modulename ; ; For example: ; ; extension=mysqli ; ; When the extension library to load is not located in the default extension ; directory, You may specify an absolute path to the library file: ; ; extension=/path/to/extension/mysqli.so ; ; Note : The syntax used in previous PHP versions ('extension=.so' and ; 'extension='php_.dll') is supported for legacy reasons and may be ; deprecated in a future PHP major version. So, when it is possible, please ; move to the new ('extension=) syntax. ; ; Notes for Windows environments : ; ; - Many DLL files are located in the extensions/ (PHP 4) or ext/ (PHP 5+) ; extension folders as well as the separate PECL DLL download (PHP 5+). ; Be sure to appropriately set the extension_dir directive. ; ;extension=bz2 ;extension=curl ;extension=ffi ;extension=ftp ;extension=fileinfo ;extension=gd ;extension=gettext ;extension=gmp ;extension=intl ;extension=imap ;extension=ldap ;extension=mbstring ;extension=exif ; Must be after mbstring as it depends on it ;extension=mysqli ;extension=oci8_12c ; Use with Oracle Database 12c Instant Client ;extension=oci8_19 ; Use with Oracle Database 19 Instant Client ;extension=odbc ;extension=openssl ;extension=pdo_firebird ;extension=pdo_mysql ;extension=pdo_oci ;extension=pdo_odbc ;extension=pdo_pgsql ;extension=pdo_sqlite ;extension=pgsql ;extension=shmop ; The MIBS data available in the PHP distribution must be installed. ; See https://www.php.net/manual/en/snmp.installation.php ;extension=snmp ;extension=soap ;extension=sockets ;extension=sodium ;extension=sqlite3 ;extension=tidy ;extension=xsl ;zend_extension=opcache ;;;;;;;;;;;;;;;;;;; ; Module Settings ; ;;;;;;;;;;;;;;;;;;; [CLI Server] ; Whether the CLI web server uses ANSI color coding in its terminal output. cli_server.color = On [Date] ; Defines the default timezone used by the date functions ; https://php.net/date.timezone date.timezone = "UTC" ; https://php.net/date.default-latitude ;date.default_latitude = 31.7667 ; https://php.net/date.default-longitude ;date.default_longitude = 35.2333 ; https://php.net/date.sunrise-zenith ;date.sunrise_zenith = 90.833333 ; https://php.net/date.sunset-zenith ;date.sunset_zenith = 90.833333 [filter] ; https://php.net/filter.default ;filter.default = unsafe_raw ; https://php.net/filter.default-flags ;filter.default_flags = [iconv] ; Use of this INI entry is deprecated, use global input_encoding instead. ; If empty, default_charset or input_encoding or iconv.input_encoding is used. ; The precedence is: default_charset < input_encoding < iconv.input_encoding ;iconv.input_encoding = ; Use of this INI entry is deprecated, use global internal_encoding instead. ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;iconv.internal_encoding = ; Use of this INI entry is deprecated, use global output_encoding instead. ; If empty, default_charset or output_encoding or iconv.output_encoding is used. ; The precedence is: default_charset < output_encoding < iconv.output_encoding ; To use an output encoding conversion, iconv's output handler must be set ; otherwise output encoding conversion cannot be performed. ;iconv.output_encoding = [imap] ; rsh/ssh logins are disabled by default. Use this INI entry if you want to ; enable them. Note that the IMAP library does not filter mailbox names before ; passing them to rsh/ssh command, thus passing untrusted data to this function ; with rsh/ssh enabled is insecure. ;imap.enable_insecure_rsh=0 [intl] ;intl.default_locale = ; This directive allows you to produce PHP errors when some error ; happens within intl functions. The value is the level of the error produced. ; Default is 0, which does not produce any errors. ;intl.error_level = E_WARNING ;intl.use_exceptions = 0 [sqlite3] ; Directory pointing to SQLite3 extensions ; https://php.net/sqlite3.extension-dir ;sqlite3.extension_dir = ; SQLite defensive mode flag (only available from SQLite 3.26+) ; When the defensive flag is enabled, language features that allow ordinary ; SQL to deliberately corrupt the database file are disabled. This forbids ; writing directly to the schema, shadow tables (eg. FTS data tables), or ; the sqlite_dbpage virtual table. ; https://www.sqlite.org/c3ref/c_dbconfig_defensive.html ; (for older SQLite versions, this flag has no use) ;sqlite3.defensive = 1 [Pcre] ; PCRE library backtracking limit. ; https://php.net/pcre.backtrack-limit ;pcre.backtrack_limit=100000 ; PCRE library recursion limit. ; Please note that if you set this value to a high number you may consume all ; the available process stack and eventually crash PHP (due to reaching the ; stack size limit imposed by the Operating System). ; https://php.net/pcre.recursion-limit ;pcre.recursion_limit=100000 ; Enables or disables JIT compilation of patterns. This requires the PCRE ; library to be compiled with JIT support. ;pcre.jit=1 [Pdo] ; Whether to pool ODBC connections. Can be one of "strict", "relaxed" or "off" ; https://php.net/pdo-odbc.connection-pooling ;pdo_odbc.connection_pooling=strict [Pdo_mysql] ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. pdo_mysql.default_socket= [Phar] ; https://php.net/phar.readonly ;phar.readonly = On ; https://php.net/phar.require-hash ;phar.require_hash = On ;phar.cache_list = [mail function] ; For Win32 only. ; https://php.net/smtp ;SMTP = localhost ; https://php.net/smtp-port ;smtp_port = 25 ; For Win32 only. ; https://php.net/sendmail-from ;sendmail_from = me@example.com ; For Unix only. You may supply arguments as well (default: "sendmail -t -i"). ; https://php.net/sendmail-path sendmail_path = /usr/sbin/sendmail -t -i ; Force the addition of the specified parameters to be passed as extra parameters ; to the sendmail binary. These parameters will always replace the value of ; the 5th parameter to mail(). ;mail.force_extra_parameters = ; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename mail.add_x_header = Off ; The path to a log file that will log all mail() calls. Log entries include ; the full path of the script, line number, To address and headers. ;mail.log = ; Log mail to syslog (Event Log on Windows). ;mail.log = syslog [ODBC] ; https://php.net/odbc.default-db ;odbc.default_db = Not yet implemented ; https://php.net/odbc.default-user ;odbc.default_user = Not yet implemented ; https://php.net/odbc.default-pw ;odbc.default_pw = Not yet implemented ; Controls the ODBC cursor model. ; Default: SQL_CURSOR_STATIC (default). ;odbc.default_cursortype ; Allow or prevent persistent links. ; https://php.net/odbc.allow-persistent odbc.allow_persistent = On ; Check that a connection is still valid before reuse. ; https://php.net/odbc.check-persistent odbc.check_persistent = On ; Maximum number of persistent links. -1 means no limit. ; https://php.net/odbc.max-persistent odbc.max_persistent = -1 ; Maximum number of links (persistent + non-persistent). -1 means no limit. ; https://php.net/odbc.max-links odbc.max_links = -1 ; Handling of LONG fields. Returns number of bytes to variables. 0 means ; passthru. ; https://php.net/odbc.defaultlrl odbc.defaultlrl = 4096 ; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char. ; See the documentation on odbc_binmode and odbc_longreadlen for an explanation ; of odbc.defaultlrl and odbc.defaultbinmode ; https://php.net/odbc.defaultbinmode odbc.defaultbinmode = 1 [MySQLi] ; Maximum number of persistent links. -1 means no limit. ; https://php.net/mysqli.max-persistent mysqli.max_persistent = -1 ; Allow accessing, from PHP's perspective, local files with LOAD DATA statements ; https://php.net/mysqli.allow_local_infile ;mysqli.allow_local_infile = On ; It allows the user to specify a folder where files that can be sent via LOAD DATA ; LOCAL can exist. It is ignored if mysqli.allow_local_infile is enabled. ;mysqli.local_infile_directory = ; Allow or prevent persistent links. ; https://php.net/mysqli.allow-persistent mysqli.allow_persistent = On ; Maximum number of links. -1 means no limit. ; https://php.net/mysqli.max-links mysqli.max_links = -1 ; Default port number for mysqli_connect(). If unset, mysqli_connect() will use ; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the ; compile-time value defined MYSQL_PORT (in that order). Win32 will only look ; at MYSQL_PORT. ; https://php.net/mysqli.default-port mysqli.default_port = 3306 ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. ; https://php.net/mysqli.default-socket mysqli.default_socket = ; Default host for mysqli_connect() (doesn't apply in safe mode). ; https://php.net/mysqli.default-host mysqli.default_host = ; Default user for mysqli_connect() (doesn't apply in safe mode). ; https://php.net/mysqli.default-user mysqli.default_user = ; Default password for mysqli_connect() (doesn't apply in safe mode). ; Note that this is generally a *bad* idea to store passwords in this file. ; *Any* user with PHP access can run 'echo get_cfg_var("mysqli.default_pw") ; and reveal this password! And of course, any users with read access to this ; file will be able to reveal the password as well. ; https://php.net/mysqli.default-pw mysqli.default_pw = ; Allow or prevent reconnect mysqli.reconnect = Off ; If this option is enabled, closing a persistent connection will rollback ; any pending transactions of this connection, before it is put back ; into the persistent connection pool. ;mysqli.rollback_on_cached_plink = Off [mysqlnd] ; Enable / Disable collection of general statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. mysqlnd.collect_statistics = 0 ; Enable / Disable collection of memory usage statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. mysqlnd.collect_memory_statistics = 0 ; Records communication from all extensions using mysqlnd to the specified log ; file. ; https://php.net/mysqlnd.debug ;mysqlnd.debug = ; Defines which queries will be logged. ;mysqlnd.log_mask = 0 ; Default size of the mysqlnd memory pool, which is used by result sets. mysqlnd.mempool_default_size = 64000 ; Size of a pre-allocated buffer used when sending commands to MySQL in bytes. mysqlnd.net_cmd_buffer_size = 8192 ; Size of a pre-allocated buffer used for reading data sent by the server in ; bytes. mysqlnd.net_read_buffer_size = 131072 ; Timeout for network requests in seconds. ;mysqlnd.net_read_timeout = 31536000 ; SHA-256 Authentication Plugin related. File with the MySQL server public RSA ; key. ;mysqlnd.sha256_server_public_key = [OCI8] ; Connection: Enables privileged connections using external ; credentials (OCI_SYSOPER, OCI_SYSDBA) ; https://php.net/oci8.privileged-connect ;oci8.privileged_connect = Off ; Connection: The maximum number of persistent OCI8 connections per ; process. Using -1 means no limit. ; https://php.net/oci8.max-persistent ;oci8.max_persistent = -1 ; Connection: The maximum number of seconds a process is allowed to ; maintain an idle persistent connection. Using -1 means idle ; persistent connections will be maintained forever. ; https://php.net/oci8.persistent-timeout ;oci8.persistent_timeout = -1 ; Connection: The number of seconds that must pass before issuing a ; ping during oci_pconnect() to check the connection validity. When ; set to 0, each oci_pconnect() will cause a ping. Using -1 disables ; pings completely. ; https://php.net/oci8.ping-interval ;oci8.ping_interval = 60 ; Connection: Set this to a user chosen connection class to be used ; for all pooled server requests with Oracle 11g Database Resident ; Connection Pooling (DRCP). To use DRCP, this value should be set to ; the same string for all web servers running the same application, ; the database pool must be configured, and the connection string must ; specify to use a pooled server. ;oci8.connection_class = ; High Availability: Using On lets PHP receive Fast Application ; Notification (FAN) events generated when a database node fails. The ; database must also be configured to post FAN events. ;oci8.events = Off ; Tuning: This option enables statement caching, and specifies how ; many statements to cache. Using 0 disables statement caching. ; https://php.net/oci8.statement-cache-size ;oci8.statement_cache_size = 20 ; Tuning: Enables statement prefetching and sets the default number of ; rows that will be fetched automatically after statement execution. ; https://php.net/oci8.default-prefetch ;oci8.default_prefetch = 100 ; Compatibility. Using On means oci_close() will not close ; oci_connect() and oci_new_connect() connections. ; https://php.net/oci8.old-oci-close-semantics ;oci8.old_oci_close_semantics = Off [PostgreSQL] ; Allow or prevent persistent links. ; https://php.net/pgsql.allow-persistent pgsql.allow_persistent = On ; Detect broken persistent links always with pg_pconnect(). ; Auto reset feature requires a little overheads. ; https://php.net/pgsql.auto-reset-persistent pgsql.auto_reset_persistent = Off ; Maximum number of persistent links. -1 means no limit. ; https://php.net/pgsql.max-persistent pgsql.max_persistent = -1 ; Maximum number of links (persistent+non persistent). -1 means no limit. ; https://php.net/pgsql.max-links pgsql.max_links = -1 ; Ignore PostgreSQL backends Notice message or not. ; Notice message logging require a little overheads. ; https://php.net/pgsql.ignore-notice pgsql.ignore_notice = 0 ; Log PostgreSQL backends Notice message or not. ; Unless pgsql.ignore_notice=0, module cannot log notice message. ; https://php.net/pgsql.log-notice pgsql.log_notice = 0 [bcmath] ; Number of decimal digits for all bcmath functions. ; https://php.net/bcmath.scale bcmath.scale = 0 [browscap] ; https://php.net/browscap ;browscap = extra/browscap.ini [Session] ; Handler used to store/retrieve data. ; https://php.net/session.save-handler session.save_handler = files ; Argument passed to save_handler. In the case of files, this is the path ; where data files are stored. Note: Windows users have to change this ; variable in order to use PHP's session functions. ; ; The path can be defined as: ; ; session.save_path = "N;/path" ; ; where N is an integer. Instead of storing all the session files in ; /path, what this will do is use subdirectories N-levels deep, and ; store the session data in those directories. This is useful if ; your OS has problems with many files in one directory, and is ; a more efficient layout for servers that handle many sessions. ; ; NOTE 1: PHP will not create this directory structure automatically. ; You can use the script in the ext/session dir for that purpose. ; NOTE 2: See the section on garbage collection below if you choose to ; use subdirectories for session storage ; ; The file storage module creates files using mode 600 by default. ; You can change that by using ; ; session.save_path = "N;MODE;/path" ; ; where MODE is the octal representation of the mode. Note that this ; does not overwrite the process's umask. ; https://php.net/session.save-path session.save_path = "/opt/tmp" ; Whether to use strict session mode. ; Strict session mode does not accept an uninitialized session ID, and ; regenerates the session ID if the browser sends an uninitialized session ID. ; Strict mode protects applications from session fixation via a session adoption ; vulnerability. It is disabled by default for maximum compatibility, but ; enabling it is encouraged. ; https://wiki.php.net/rfc/strict_sessions session.use_strict_mode = 0 ; Whether to use cookies. ; https://php.net/session.use-cookies session.use_cookies = 1 ; https://php.net/session.cookie-secure ;session.cookie_secure = ; This option forces PHP to fetch and use a cookie for storing and maintaining ; the session id. We encourage this operation as it's very helpful in combating ; session hijacking when not specifying and managing your own session id. It is ; not the be-all and end-all of session hijacking defense, but it's a good start. ; https://php.net/session.use-only-cookies session.use_only_cookies = 1 ; Name of the session (used as cookie name). ; https://php.net/session.name session.name = PHPSESSID ; Initialize session on request startup. ; https://php.net/session.auto-start session.auto_start = 0 ; Lifetime in seconds of cookie or, if 0, until browser is restarted. ; https://php.net/session.cookie-lifetime session.cookie_lifetime = 0 ; The path for which the cookie is valid. ; https://php.net/session.cookie-path session.cookie_path = / ; The domain for which the cookie is valid. ; https://php.net/session.cookie-domain session.cookie_domain = ; Whether or not to add the httpOnly flag to the cookie, which makes it ; inaccessible to browser scripting languages such as JavaScript. ; https://php.net/session.cookie-httponly session.cookie_httponly = 1 ; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF) ; Current valid values are "Strict", "Lax" or "None". When using "None", ; make sure to include the quotes, as `none` is interpreted like `false` in ini files. ; https://tools.ietf.org/html/draft-west-first-party-cookies-07 session.cookie_samesite = ; Handler used to serialize data. php is the standard serializer of PHP. ; https://php.net/session.serialize-handler session.serialize_handler = php ; Defines the probability that the 'garbage collection' process is started on every ; session initialization. The probability is calculated by using gc_probability/gc_divisor, ; e.g. 1/100 means there is a 1% chance that the GC process starts on each request. ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; https://php.net/session.gc-probability session.gc_probability = 1 ; Defines the probability that the 'garbage collection' process is started on every ; session initialization. The probability is calculated by using gc_probability/gc_divisor, ; e.g. 1/100 means there is a 1% chance that the GC process starts on each request. ; For high volume production servers, using a value of 1000 is a more efficient approach. ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; https://php.net/session.gc-divisor session.gc_divisor = 1000 ; After this number of seconds, stored data will be seen as 'garbage' and ; cleaned up by the garbage collection process. ; https://php.net/session.gc-maxlifetime session.gc_maxlifetime = 1440 ; NOTE: If you are using the subdirectory option for storing session files ; (see session.save_path above), then garbage collection does *not* ; happen automatically. You will need to do your own garbage ; collection through a shell script, cron entry, or some other method. ; For example, the following script is the equivalent of setting ; session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes): ; find /path/to/sessions -cmin +24 -type f | xargs rm ; Check HTTP Referer to invalidate externally stored URLs containing ids. ; HTTP_REFERER has to contain this substring for the session to be ; considered as valid. ; https://php.net/session.referer-check session.referer_check = ; Set to {nocache,private,public,} to determine HTTP caching aspects ; or leave this empty to avoid sending anti-caching headers. ; https://php.net/session.cache-limiter session.cache_limiter = nocache ; Document expires after n minutes. ; https://php.net/session.cache-expire session.cache_expire = 180 ; trans sid support is disabled by default. ; Use of trans sid may risk your users' security. ; Use this option with caution. ; - User may send URL contains active session ID ; to other person via. email/irc/etc. ; - URL that contains active session ID may be stored ; in publicly accessible computer. ; - User may access your site with the same session ID ; always using URL stored in browser's history or bookmarks. ; https://php.net/session.use-trans-sid session.use_trans_sid = 0 ; Set session ID character length. This value could be between 22 to 256. ; Shorter length than default is supported only for compatibility reason. ; Users should use 32 or more chars. ; https://php.net/session.sid-length ; Default Value: 32 ; Development Value: 26 ; Production Value: 26 session.sid_length = 26 ; The URL rewriter will look for URLs in a defined set of HTML tags. ; is special; if you include them here, the rewriter will ; add a hidden field with the info which is otherwise appended ; to URLs. tag's action attribute URL will not be modified ; unless it is specified. ; Note that all valid entries require a "=", even if no value follows. ; Default Value: "a=href,area=href,frame=src,form=" ; Development Value: "a=href,area=href,frame=src,form=" ; Production Value: "a=href,area=href,frame=src,form=" ; https://php.net/url-rewriter.tags session.trans_sid_tags = "a=href,area=href,frame=src,form=" ; URL rewriter does not rewrite absolute URLs by default. ; To enable rewrites for absolute paths, target hosts must be specified ; at RUNTIME. i.e. use ini_set() ; tags is special. PHP will check action attribute's URL regardless ; of session.trans_sid_tags setting. ; If no host is defined, HTTP_HOST will be used for allowed host. ; Example value: php.net,www.php.net,wiki.php.net ; Use "," for multiple hosts. No spaces are allowed. ; Default Value: "" ; Development Value: "" ; Production Value: "" ;session.trans_sid_hosts="" ; Define how many bits are stored in each character when converting ; the binary hash data to something readable. ; Possible values: ; 4 (4 bits: 0-9, a-f) ; 5 (5 bits: 0-9, a-v) ; 6 (6 bits: 0-9, a-z, A-Z, "-", ",") ; Default Value: 4 ; Development Value: 5 ; Production Value: 5 ; https://php.net/session.hash-bits-per-character session.sid_bits_per_character = 5 ; Enable upload progress tracking in $_SESSION ; Default Value: On ; Development Value: On ; Production Value: On ; https://php.net/session.upload-progress.enabled ;session.upload_progress.enabled = On ; Cleanup the progress information as soon as all POST data has been read ; (i.e. upload completed). ; Default Value: On ; Development Value: On ; Production Value: On ; https://php.net/session.upload-progress.cleanup ;session.upload_progress.cleanup = On ; A prefix used for the upload progress key in $_SESSION ; Default Value: "upload_progress_" ; Development Value: "upload_progress_" ; Production Value: "upload_progress_" ; https://php.net/session.upload-progress.prefix ;session.upload_progress.prefix = "upload_progress_" ; The index name (concatenated with the prefix) in $_SESSION ; containing the upload progress information ; Default Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Development Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Production Value: "PHP_SESSION_UPLOAD_PROGRESS" ; https://php.net/session.upload-progress.name ;session.upload_progress.name = "PHP_SESSION_UPLOAD_PROGRESS" ; How frequently the upload progress should be updated. ; Given either in percentages (per-file), or in bytes ; Default Value: "1%" ; Development Value: "1%" ; Production Value: "1%" ; https://php.net/session.upload-progress.freq ;session.upload_progress.freq = "1%" ; The minimum delay between updates, in seconds ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; https://php.net/session.upload-progress.min-freq ;session.upload_progress.min_freq = "1" ; Only write session data when session data is changed. Enabled by default. ; https://php.net/session.lazy-write ;session.lazy_write = On [Assertion] ; Switch whether to compile assertions at all (to have no overhead at run-time) ; -1: Do not compile at all ; 0: Jump over assertion at run-time ; 1: Execute assertions ; Changing from or to a negative value is only possible in php.ini! (For turning assertions on and off at run-time, see assert.active, when zend.assertions = 1) ; Default Value: 1 ; Development Value: 1 ; Production Value: -1 ; https://php.net/zend.assertions zend.assertions = -1 ; Assert(expr); active by default. ; https://php.net/assert.active ;assert.active = On ; Throw an AssertionError on failed assertions ; https://php.net/assert.exception ;assert.exception = On ; Issue a PHP warning for each failed assertion. (Overridden by assert.exception if active) ; https://php.net/assert.warning ;assert.warning = On ; Don't bail out by default. ; https://php.net/assert.bail ;assert.bail = Off ; User-function to be called if an assertion fails. ; https://php.net/assert.callback ;assert.callback = 0 [COM] ; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs ; https://php.net/com.typelib-file ;com.typelib_file = ; allow Distributed-COM calls ; https://php.net/com.allow-dcom ;com.allow_dcom = true ; autoregister constants of a component's typelib on com_load() ; https://php.net/com.autoregister-typelib ;com.autoregister_typelib = true ; register constants casesensitive ; https://php.net/com.autoregister-casesensitive ;com.autoregister_casesensitive = false ; show warnings on duplicate constant registrations ; https://php.net/com.autoregister-verbose ;com.autoregister_verbose = true ; The default character set code-page to use when passing strings to and from COM objects. ; Default: system ANSI code page ;com.code_page= ; The version of the .NET framework to use. The value of the setting are the first three parts ; of the framework's version number, separated by dots, and prefixed with "v", e.g. "v4.0.30319". ;com.dotnet_version= [mbstring] ; language for internal character representation. ; This affects mb_send_mail() and mbstring.detect_order. ; https://php.net/mbstring.language ;mbstring.language = Japanese ; Use of this INI entry is deprecated, use global internal_encoding instead. ; internal/script encoding. ; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*) ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;mbstring.internal_encoding = ; Use of this INI entry is deprecated, use global input_encoding instead. ; http input encoding. ; mbstring.encoding_translation = On is needed to use this setting. ; If empty, default_charset or input_encoding or mbstring.input is used. ; The precedence is: default_charset < input_encoding < mbstring.http_input ; https://php.net/mbstring.http-input ;mbstring.http_input = ; Use of this INI entry is deprecated, use global output_encoding instead. ; http output encoding. ; mb_output_handler must be registered as output buffer to function. ; If empty, default_charset or output_encoding or mbstring.http_output is used. ; The precedence is: default_charset < output_encoding < mbstring.http_output ; To use an output encoding conversion, mbstring's output handler must be set ; otherwise output encoding conversion cannot be performed. ; https://php.net/mbstring.http-output ;mbstring.http_output = ; enable automatic encoding translation according to ; mbstring.internal_encoding setting. Input chars are ; converted to internal encoding by setting this to On. ; Note: Do _not_ use automatic encoding translation for ; portable libs/applications. ; https://php.net/mbstring.encoding-translation ;mbstring.encoding_translation = Off ; automatic encoding detection order. ; "auto" detect order is changed according to mbstring.language ; https://php.net/mbstring.detect-order ;mbstring.detect_order = auto ; substitute_character used when character cannot be converted ; one from another ; https://php.net/mbstring.substitute-character ;mbstring.substitute_character = none ; Enable strict encoding detection. ;mbstring.strict_detection = Off ; This directive specifies the regex pattern of content types for which mb_output_handler() ; is activated. ; Default: mbstring.http_output_conv_mimetypes=^(text/|application/xhtml\+xml) ;mbstring.http_output_conv_mimetypes= ; This directive specifies maximum stack depth for mbstring regular expressions. It is similar ; to the pcre.recursion_limit for PCRE. ;mbstring.regex_stack_limit=100000 ; This directive specifies maximum retry count for mbstring regular expressions. It is similar ; to the pcre.backtrack_limit for PCRE. ;mbstring.regex_retry_limit=1000000 [gd] ; Tell the jpeg decode to ignore warnings and try to create ; a gd image. The warning will then be displayed as notices ; disabled by default ; https://php.net/gd.jpeg-ignore-warning ;gd.jpeg_ignore_warning = 1 [exif] ; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS. ; With mbstring support this will automatically be converted into the encoding ; given by corresponding encode setting. When empty mbstring.internal_encoding ; is used. For the decode settings you can distinguish between motorola and ; intel byte order. A decode setting cannot be empty. ; https://php.net/exif.encode-unicode ;exif.encode_unicode = ISO-8859-15 ; https://php.net/exif.decode-unicode-motorola ;exif.decode_unicode_motorola = UCS-2BE ; https://php.net/exif.decode-unicode-intel ;exif.decode_unicode_intel = UCS-2LE ; https://php.net/exif.encode-jis ;exif.encode_jis = ; https://php.net/exif.decode-jis-motorola ;exif.decode_jis_motorola = JIS ; https://php.net/exif.decode-jis-intel ;exif.decode_jis_intel = JIS [Tidy] ; The path to a default tidy configuration file to use when using tidy ; https://php.net/tidy.default-config ;tidy.default_config = /usr/local/lib/php/default.tcfg ; Should tidy clean and repair output automatically? ; WARNING: Do not use this option if you are generating non-html content ; such as dynamic images ; https://php.net/tidy.clean-output tidy.clean_output = Off [soap] ; Enables or disables WSDL caching feature. ; https://php.net/soap.wsdl-cache-enabled soap.wsdl_cache_enabled=1 ; Sets the directory name where SOAP extension will put cache files. ; https://php.net/soap.wsdl-cache-dir soap.wsdl_cache_dir="/tmp" ; (time to live) Sets the number of second while cached file will be used ; instead of original one. ; https://php.net/soap.wsdl-cache-ttl soap.wsdl_cache_ttl=86400 ; Sets the size of the cache limit. (Max. number of WSDL files to cache) soap.wsdl_cache_limit = 5 [sysvshm] ; A default size of the shared memory segment ;sysvshm.init_mem = 10000 [ldap] ; Sets the maximum number of open links or -1 for unlimited. ldap.max_links = -1 [dba] ;dba.default_handler= [opcache] ; Determines if Zend OPCache is enabled ;opcache.enable=1 ; Determines if Zend OPCache is enabled for the CLI version of PHP ;opcache.enable_cli=0 ; The OPcache shared memory storage size. ;opcache.memory_consumption=128 ; The amount of memory for interned strings in Mbytes. ;opcache.interned_strings_buffer=8 ; The maximum number of keys (scripts) in the OPcache hash table. ; Only numbers between 200 and 1000000 are allowed. ;opcache.max_accelerated_files=10000 ; The maximum percentage of "wasted" memory until a restart is scheduled. ;opcache.max_wasted_percentage=5 ; When this directive is enabled, the OPcache appends the current working ; directory to the script key, thus eliminating possible collisions between ; files with the same name (basename). Disabling the directive improves ; performance, but may break existing applications. ;opcache.use_cwd=1 ; When disabled, you must reset the OPcache manually or restart the ; webserver for changes to the filesystem to take effect. ;opcache.validate_timestamps=1 ; How often (in seconds) to check file timestamps for changes to the shared ; memory storage allocation. ("1" means validate once per second, but only ; once per request. "0" means always validate) ;opcache.revalidate_freq=2 ; Enables or disables file search in include_path optimization ;opcache.revalidate_path=0 ; If disabled, all PHPDoc comments are dropped from the code to reduce the ; size of the optimized code. ;opcache.save_comments=1 ; If enabled, compilation warnings (including notices and deprecations) will ; be recorded and replayed each time a file is included. Otherwise, compilation ; warnings will only be emitted when the file is first cached. ;opcache.record_warnings=0 ; Allow file existence override (file_exists, etc.) performance feature. ;opcache.enable_file_override=0 ; A bitmask, where each bit enables or disables the appropriate OPcache ; passes ;opcache.optimization_level=0x7FFFBFFF ;opcache.dups_fix=0 ; The location of the OPcache blacklist file (wildcards allowed). ; Each OPcache blacklist file is a text file that holds the names of files ; that should not be accelerated. The file format is to add each filename ; to a new line. The filename may be a full path or just a file prefix ; (i.e., /var/www/x blacklists all the files and directories in /var/www ; that start with 'x'). Line starting with a ; are ignored (comments). ;opcache.blacklist_filename= ; Allows exclusion of large files from being cached. By default all files ; are cached. ;opcache.max_file_size=0 ; Check the cache checksum each N requests. ; The default value of "0" means that the checks are disabled. ;opcache.consistency_checks=0 ; How long to wait (in seconds) for a scheduled restart to begin if the cache ; is not being accessed. ;opcache.force_restart_timeout=180 ; OPcache error_log file name. Empty string assumes "stderr". ;opcache.error_log= ; All OPcache errors go to the Web server log. ; By default, only fatal errors (level 0) or errors (level 1) are logged. ; You can also enable warnings (level 2), info messages (level 3) or ; debug messages (level 4). ;opcache.log_verbosity_level=1 ; Preferred Shared Memory back-end. Leave empty and let the system decide. ;opcache.preferred_memory_model= ; Protect the shared memory from unexpected writing during script execution. ; Useful for internal debugging only. ;opcache.protect_memory=0 ; Allows calling OPcache API functions only from PHP scripts which path is ; started from specified string. The default "" means no restriction ;opcache.restrict_api= ; Mapping base of shared memory segments (for Windows only). All the PHP ; processes have to map shared memory into the same address space. This ; directive allows to manually fix the "Unable to reattach to base address" ; errors. ;opcache.mmap_base= ; Facilitates multiple OPcache instances per user (for Windows only). All PHP ; processes with the same cache ID and user share an OPcache instance. ;opcache.cache_id= ; Enables and sets the second level cache directory. ; It should improve performance when SHM memory is full, at server restart or ; SHM reset. The default "" disables file based caching. ;opcache.file_cache= ; Enables or disables opcode caching in shared memory. ;opcache.file_cache_only=0 ; Enables or disables checksum validation when script loaded from file cache. ;opcache.file_cache_consistency_checks=1 ; Implies opcache.file_cache_only=1 for a certain process that failed to ; reattach to the shared memory (for Windows only). Explicitly enabled file ; cache is required. ;opcache.file_cache_fallback=1 ; Enables or disables copying of PHP code (text segment) into HUGE PAGES. ; This should improve performance, but requires appropriate OS configuration. ;opcache.huge_code_pages=0 ; Validate cached file permissions. ;opcache.validate_permission=0 ; Prevent name collisions in chroot'ed environment. ;opcache.validate_root=0 ; If specified, it produces opcode dumps for debugging different stages of ; optimizations. ;opcache.opt_debug_level=0 ; Specifies a PHP script that is going to be compiled and executed at server ; start-up. ; https://php.net/opcache.preload ;opcache.preload= ; Preloading code as root is not allowed for security reasons. This directive ; facilitates to let the preloading to be run as another user. ; https://php.net/opcache.preload_user ;opcache.preload_user= ; Prevents caching files that are less than this number of seconds old. It ; protects from caching of incompletely updated files. In case all file updates ; on your site are atomic, you may increase performance by setting it to "0". ;opcache.file_update_protection=2 ; Absolute path used to store shared lockfiles (for *nix only). ;opcache.lockfile_path=/tmp [curl] ; A default value for the CURLOPT_CAINFO option. This is required to be an ; absolute path. ;curl.cainfo = [openssl] ; The location of a Certificate Authority (CA) file on the local filesystem ; to use when verifying the identity of SSL/TLS peers. Most users should ; not specify a value for this directive as PHP will attempt to use the ; OS-managed cert stores in its absence. If specified, this value may still ; be overridden on a per-stream basis via the "cafile" SSL stream context ; option. ;openssl.cafile= ; If openssl.cafile is not specified or if the CA file is not found, the ; directory pointed to by openssl.capath is searched for a suitable ; certificate. This value must be a correctly hashed certificate directory. ; Most users should not specify a value for this directive as PHP will ; attempt to use the OS-managed cert stores in its absence. If specified, ; this value may still be overridden on a per-stream basis via the "capath" ; SSL stream context option. ;openssl.capath= [ffi] ; FFI API restriction. Possible values: ; "preload" - enabled in CLI scripts and preloaded files (default) ; "false" - always disabled ; "true" - always enabled ;ffi.enable=preload ; List of headers files to preload, wildcard patterns allowed. ;ffi.preload= [Zend] zend_extension="/usr/local/ioncube/ioncube_loader_lin_8.1.so" ; fix for segfaults auto_globals_jit = Off cgi.fix_pathinfo = 1 mbstring.http_input = "pass" mbstring.http_output = "pass" mbstring.encoding_translation = 0 ; Enable Extensions extension=uploadprogress.so extension=imagick.so extension=redis.so ; APCu extension=apcu.so apc.enable_cli=1 apc.gc_ttl=300 apc.shm_segments=1 apc.shm_size=256M apc.slam_defense=0 apc.ttl=0 ; ================================================ FILE: aegir/conf/php/php82-cli.ini ================================================ [PHP] ;;;;;;;;;;;;;;;;;;; ; About php.ini ; ;;;;;;;;;;;;;;;;;;; ; PHP's initialization file, generally called php.ini, is responsible for ; configuring many of the aspects of PHP's behavior. ; PHP attempts to find and load this configuration from a number of locations. ; The following is a summary of its search order: ; 1. SAPI module specific location. ; 2. The PHPRC environment variable. (As of PHP 5.2.0) ; 3. A number of predefined registry keys on Windows (As of PHP 5.2.0) ; 4. Current working directory (except CLI) ; 5. The web server's directory (for SAPI modules), or directory of PHP ; (otherwise in Windows) ; 6. The directory from the --with-config-file-path compile time option, or the ; Windows directory (usually C:\windows) ; See the PHP docs for more specific information. ; https://php.net/configuration.file ; The syntax of the file is extremely simple. Whitespace and lines ; beginning with a semicolon are silently ignored (as you probably guessed). ; Section headers (e.g. [Foo]) are also silently ignored, even though ; they might mean something in the future. ; Directives following the section heading [PATH=/www/mysite] only ; apply to PHP files in the /www/mysite directory. Directives ; following the section heading [HOST=www.example.com] only apply to ; PHP files served from www.example.com. Directives set in these ; special sections cannot be overridden by user-defined INI files or ; at runtime. Currently, [PATH=] and [HOST=] sections only work under ; CGI/FastCGI. ; https://php.net/ini.sections ; Directives are specified using the following syntax: ; directive = value ; Directive names are *case sensitive* - foo=bar is different from FOO=bar. ; Directives are variables used to configure PHP or PHP extensions. ; There is no name validation. If PHP can't find an expected ; directive because it is not set or is mistyped, a default value will be used. ; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one ; of the INI constants (On, Off, True, False, Yes, No and None) or an expression ; (e.g. E_ALL & ~E_NOTICE), a quoted string ("bar"), or a reference to a ; previously set variable or directive (e.g. ${foo}) ; Expressions in the INI file are limited to bitwise operators and parentheses: ; | bitwise OR ; ^ bitwise XOR ; & bitwise AND ; ~ bitwise NOT ; ! boolean NOT ; Boolean flags can be turned on using the values 1, On, True or Yes. ; They can be turned off using the values 0, Off, False or No. ; An empty string can be denoted by simply not writing anything after the equal ; sign, or by using the None keyword: ; foo = ; sets foo to an empty string ; foo = None ; sets foo to an empty string ; foo = "None" ; sets foo to the string 'None' ; If you use constants in your value, and these constants belong to a ; dynamically loaded extension (either a PHP extension or a Zend extension), ; you may only use these constants *after* the line that loads the extension. ;;;;;;;;;;;;;;;;;;; ; About this file ; ;;;;;;;;;;;;;;;;;;; ; PHP comes packaged with two INI files. One that is recommended to be used ; in production environments and one that is recommended to be used in ; development environments. ; php.ini-production contains settings which hold security, performance and ; best practices at its core. But please be aware, these settings may break ; compatibility with older or less security conscience applications. We ; recommending using the production ini in production and testing environments. ; php.ini-development is very similar to its production variant, except it is ; much more verbose when it comes to errors. We recommend using the ; development version only in development environments, as errors shown to ; application users can inadvertently leak otherwise secure information. ; This is the php.ini-production INI file. ;;;;;;;;;;;;;;;;;;; ; Quick Reference ; ;;;;;;;;;;;;;;;;;;; ; The following are all the settings which are different in either the production ; or development versions of the INIs with respect to PHP's default behavior. ; Please see the actual settings later in the document for more details as to why ; we recommend these changes in PHP's behavior. display_errors = Off ; Default Value: On ; Development Value: On ; Production Value: Off ; display_startup_errors ; Default Value: On ; Development Value: On ; Production Value: Off ; error_reporting ; Default Value: E_ALL ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; log_errors ; Default Value: Off ; Development Value: On ; Production Value: On ; max_input_time ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; output_buffering ; Default Value: Off ; Development Value: 4096 ; Production Value: 4096 ; register_argc_argv ; Default Value: On ; Development Value: Off ; Production Value: Off ; request_order ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; session.gc_divisor ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; session.sid_bits_per_character ; Default Value: 4 ; Development Value: 5 ; Production Value: 5 ; short_open_tag ; Default Value: On ; Development Value: Off ; Production Value: Off ; variables_order ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS" ; zend.exception_ignore_args ; Default Value: Off ; Development Value: Off ; Production Value: On ; zend.exception_string_param_max_len ; Default Value: 15 ; Development Value: 15 ; Production Value: 0 ;;;;;;;;;;;;;;;;;;;; ; php.ini Options ; ;;;;;;;;;;;;;;;;;;;; ; Name for user-defined php.ini (.htaccess) files. Default is ".user.ini" ;user_ini.filename = ".user.ini" ; To disable this feature set this option to an empty value user_ini.filename = ; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes) ;user_ini.cache_ttl = 300 ;;;;;;;;;;;;;;;;;;;; ; Language Options ; ;;;;;;;;;;;;;;;;;;;; ; Enable the PHP scripting language engine under Apache. ; https://php.net/engine engine = On ; This directive determines whether or not PHP will recognize code between ; tags as PHP source which should be processed as such. It is ; generally recommended that should be used and that this feature ; should be disabled, as enabling it may result in issues when generating XML ; documents, however this remains supported for backward compatibility reasons. ; Note that this directive does not control the would work. ; https://php.net/syntax-highlighting ;highlight.string = #DD0000 ;highlight.comment = #FF9900 ;highlight.keyword = #007700 ;highlight.default = #0000BB ;highlight.html = #000000 ; If enabled, the request will be allowed to complete even if the user aborts ; the request. Consider enabling it if executing long requests, which may end up ; being interrupted by the user or a browser timing out. PHP's default behavior ; is to disable this feature. ; https://php.net/ignore-user-abort ;ignore_user_abort = On ; Determines the size of the realpath cache to be used by PHP. This value should ; be increased on systems where PHP opens many files to reflect the quantity of ; the file operations performed. ; Note: if open_basedir is set, the cache is disabled ; https://php.net/realpath-cache-size realpath_cache_size=64M ; Duration of time, in seconds for which to cache realpath information for a given ; file or directory. For systems with rarely changing files, consider increasing this ; value. ; https://php.net/realpath-cache-ttl realpath_cache_ttl=5 ; Enables or disables the circular reference collector. ; https://php.net/zend.enable-gc zend.enable_gc = On ; If enabled, scripts may be written in encodings that are incompatible with ; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such ; encodings. To use this feature, mbstring extension must be enabled. ;zend.multibyte = Off ; Allows to set the default encoding for the scripts. This value will be used ; unless "declare(encoding=...)" directive appears at the top of the script. ; Only affects if zend.multibyte is set. ;zend.script_encoding = ; Allows to include or exclude arguments from stack traces generated for exceptions. ; In production, it is recommended to turn this setting on to prohibit the output ; of sensitive information in stack traces ; Default Value: Off ; Development Value: Off ; Production Value: On zend.exception_ignore_args = On ; Allows setting the maximum string length in an argument of a stringified stack trace ; to a value between 0 and 1000000. ; This has no effect when zend.exception_ignore_args is enabled. ; Default Value: 15 ; Development Value: 15 ; Production Value: 0 ; In production, it is recommended to set this to 0 to reduce the output ; of sensitive information in stack traces. zend.exception_string_param_max_len = 0 ;;;;;;;;;;;;;;;;; ; Miscellaneous ; ;;;;;;;;;;;;;;;;; ; Decides whether PHP may expose the fact that it is installed on the server ; (e.g. by adding its signature to the Web server header). It is no security ; threat in any way, but it makes it possible to determine whether you use PHP ; on your server or not. ; https://php.net/expose-php expose_php = On ;;;;;;;;;;;;;;;;;;; ; Resource Limits ; ;;;;;;;;;;;;;;;;;;; ; Maximum execution time of each script, in seconds ; https://php.net/max-execution-time ; Note: This directive is hardcoded to 0 for the CLI SAPI max_execution_time = 3600 ; Maximum amount of time each script may spend parsing request data. It's a good ; idea to limit this time on productions servers in order to eliminate unexpectedly ; long running scripts. ; Note: This directive is hardcoded to -1 for the CLI SAPI ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; https://php.net/max-input-time max_input_time = 3600 ; Maximum input variable nesting level ; https://php.net/max-input-nesting-level ;max_input_nesting_level = 64 ; How many GET/POST/COOKIE input variables may be accepted max_input_vars = 9999 ; Maximum amount of memory a script may consume ; https://php.net/memory-limit memory_limit = 395M ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; Error handling and logging ; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; This directive informs PHP of which errors, warnings and notices you would like ; it to take action for. The recommended way of setting values for this ; directive is through the use of the error level constants and bitwise ; operators. The error level constants are below here for convenience as well as ; some common settings and their meanings. ; By default, PHP is set to take action on all errors, notices and warnings EXCEPT ; those related to E_NOTICE and E_STRICT, which together cover best practices and ; recommended coding standards in PHP. For performance reasons, this is the ; recommend error reporting setting. Your production server shouldn't be wasting ; resources complaining about best practices and coding standards. That's what ; development servers and development settings are for. ; Note: The php.ini-development file has this setting as E_ALL. This ; means it pretty much reports everything which is exactly what you want during ; development and early testing. ; ; Error Level Constants: ; E_ALL - All errors and warnings (includes E_STRICT as of PHP 5.4.0) ; E_ERROR - fatal run-time errors ; E_RECOVERABLE_ERROR - almost fatal run-time errors ; E_WARNING - run-time warnings (non-fatal errors) ; E_PARSE - compile-time parse errors ; E_NOTICE - run-time notices (these are warnings which often result ; from a bug in your code, but it's possible that it was ; intentional (e.g., using an uninitialized variable and ; relying on the fact it is automatically initialized to an ; empty string) ; E_STRICT - run-time notices, enable to have PHP suggest changes ; to your code which will ensure the best interoperability ; and forward compatibility of your code ; E_CORE_ERROR - fatal errors that occur during PHP's initial startup ; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's ; initial startup ; E_COMPILE_ERROR - fatal compile-time errors ; E_COMPILE_WARNING - compile-time warnings (non-fatal errors) ; E_USER_ERROR - user-generated error message ; E_USER_WARNING - user-generated warning message ; E_USER_NOTICE - user-generated notice message ; E_DEPRECATED - warn about code that will not work in future versions ; of PHP ; E_USER_DEPRECATED - user-generated deprecation warnings ; ; Common Values: ; E_ALL (Show all errors, warnings and notices including coding standards.) ; E_ALL & ~E_NOTICE (Show all errors, except for notices) ; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.) ; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors) ; Default Value: E_ALL ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; https://php.net/error-reporting error_reporting = 1 ; This directive controls whether or not and where PHP will output errors, ; notices and warnings too. Error output is very useful during development, but ; it could be very dangerous in production environments. Depending on the code ; which is triggering the error, sensitive information could potentially leak ; out of your application such as database usernames and passwords or worse. ; For production environments, we recommend logging errors rather than ; sending them to STDOUT. ; Possible Values: ; Off = Do not display any errors ; stderr = Display errors to STDERR (affects only CGI/CLI binaries!) ; On or stdout = Display errors to STDOUT ; Default Value: On ; Development Value: On ; Production Value: Off ; https://php.net/display-errors display_errors = Off ; The display of errors which occur during PHP's startup sequence are handled ; separately from display_errors. We strongly recommend you set this to 'off' ; for production servers to avoid leaking configuration details. ; Default Value: On ; Development Value: On ; Production Value: Off ; https://php.net/display-startup-errors display_startup_errors = Off ; Besides displaying errors, PHP can also log errors to locations such as a ; server-specific log, STDERR, or a location specified by the error_log ; directive found below. While errors should not be displayed on productions ; servers they should still be monitored and logging is a great way to do that. ; Default Value: Off ; Development Value: On ; Production Value: On ; https://php.net/log-errors log_errors = On ; Do not log repeated messages. Repeated errors must occur in same file on same ; line unless ignore_repeated_source is set true. ; https://php.net/ignore-repeated-errors ignore_repeated_errors = Off ; Ignore source of message when ignoring repeated messages. When this setting ; is On you will not log errors with repeated messages from different files or ; source lines. ; https://php.net/ignore-repeated-source ignore_repeated_source = Off ; If this parameter is set to Off, then memory leaks will not be shown (on ; stdout or in the log). This is only effective in a debug compile, and if ; error reporting includes E_WARNING in the allowed list ; https://php.net/report-memleaks report_memleaks = On ; This setting is off by default. ;report_zend_debug = 0 ; Turn off normal error reporting and emit XML-RPC error XML ; https://php.net/xmlrpc-errors ;xmlrpc_errors = 0 ; An XML-RPC faultCode ;xmlrpc_error_number = 0 ; When PHP displays or logs an error, it has the capability of formatting the ; error message as HTML for easier reading. This directive controls whether ; the error message is formatted as HTML or not. ; Note: This directive is hardcoded to Off for the CLI SAPI ; https://php.net/html-errors html_errors = Off ; If html_errors is set to On *and* docref_root is not empty, then PHP ; produces clickable error messages that direct to a page describing the error ; or function causing the error in detail. ; You can download a copy of the PHP manual from https://php.net/docs ; and change docref_root to the base URL of your local copy including the ; leading '/'. You must also specify the file extension being used including ; the dot. PHP's default behavior is to leave these settings empty, in which ; case no links to documentation are generated. ; Note: Never use this feature for production boxes. ; https://php.net/docref-root ; Examples ;docref_root = "/phpmanual/" ; https://php.net/docref-ext ;docref_ext = .html ; String to output before an error message. PHP's default behavior is to leave ; this setting blank. ; https://php.net/error-prepend-string ; Example: ;error_prepend_string = "" ; String to output after an error message. PHP's default behavior is to leave ; this setting blank. ; https://php.net/error-append-string ; Example: ;error_append_string = "" ; Log errors to specified file. PHP's default behavior is to leave this value ; empty. ; https://php.net/error-log ; Example: ;error_log = php_errors.log ; Log errors to syslog (Event Log on Windows). ;error_log = syslog error_log = /var/log/php/error_log_cli_82 ; The syslog ident is a string which is prepended to every message logged ; to syslog. Only used when error_log is set to syslog. ;syslog.ident = php ; The syslog facility is used to specify what type of program is logging ; the message. Only used when error_log is set to syslog. ;syslog.facility = user ; Set this to disable filtering control characters (the default). ; Some loggers only accept NVT-ASCII, others accept anything that's not ; control characters. If your logger accepts everything, then no filtering ; is needed at all. ; Allowed values are: ; ascii (all printable ASCII characters and NL) ; no-ctrl (all characters except control characters) ; all (all characters) ; raw (like "all", but messages are not split at newlines) ; https://php.net/syslog.filter ;syslog.filter = ascii ;windows.show_crt_warning ; Default value: 0 ; Development value: 0 ; Production value: 0 ;;;;;;;;;;;;;;;;; ; Data Handling ; ;;;;;;;;;;;;;;;;; ; The separator used in PHP generated URLs to separate arguments. ; PHP's default setting is "&". ; https://php.net/arg-separator.output ; Example: ;arg_separator.output = "&" ; List of separator(s) used by PHP to parse input URLs into variables. ; PHP's default setting is "&". ; NOTE: Every character in this directive is considered as separator! ; https://php.net/arg-separator.input ; Example: ;arg_separator.input = ";&" ; This directive determines which super global arrays are registered when PHP ; starts up. G,P,C,E & S are abbreviations for the following respective super ; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty ; paid for the registration of these arrays and because ENV is not as commonly ; used as the others, ENV is not recommended on productions servers. You ; can still get access to the environment variables through getenv() should you ; need to. ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS"; ; https://php.net/variables-order variables_order = "GPCS" ; This directive determines which super global data (G,P & C) should be ; registered into the super global array REQUEST. If so, it also determines ; the order in which that data is registered. The values for this directive ; are specified in the same manner as the variables_order directive, ; EXCEPT one. Leaving this value empty will cause PHP to use the value set ; in the variables_order directive. It does not mean it will leave the super ; globals array REQUEST empty. ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; https://php.net/request-order request_order = "GP" ; This directive determines whether PHP registers $argv & $argc each time it ; runs. $argv contains an array of all the arguments passed to PHP when a script ; is invoked. $argc contains an integer representing the number of arguments ; that were passed when the script was invoked. These arrays are extremely ; useful when running scripts from the command line. When this directive is ; enabled, registering these variables consumes CPU cycles and memory each time ; a script is executed. For performance reasons, this feature should be disabled ; on production servers. ; Note: This directive is hardcoded to On for the CLI SAPI ; Default Value: On ; Development Value: Off ; Production Value: Off ; https://php.net/register-argc-argv register_argc_argv = Off ; When enabled, the ENV, REQUEST and SERVER variables are created when they're ; first used (Just In Time) instead of when the script starts. If these ; variables are not used within a script, having this directive on will result ; in a performance gain. The PHP directive register_argc_argv must be disabled ; for this directive to have any effect. ; https://php.net/auto-globals-jit auto_globals_jit = On ; Whether PHP will read the POST data. ; This option is enabled by default. ; Most likely, you won't want to disable this option globally. It causes $_POST ; and $_FILES to always be empty; the only way you will be able to read the ; POST data will be through the php://input stream wrapper. This can be useful ; to proxy requests or to process the POST data in a memory efficient fashion. ; https://php.net/enable-post-data-reading ;enable_post_data_reading = Off ; Maximum size of POST data that PHP will accept. ; Its value may be 0 to disable the limit. It is ignored if POST data reading ; is disabled through enable_post_data_reading. ; https://php.net/post-max-size post_max_size = 350M ; Automatically add files before PHP document. ; https://php.net/auto-prepend-file auto_prepend_file = ; Automatically add files after PHP document. ; https://php.net/auto-append-file auto_append_file = ; By default, PHP will output a media type using the Content-Type header. To ; disable this, simply set it to be empty. ; ; PHP's built-in default media type is set to text/html. ; https://php.net/default-mimetype default_mimetype = "text/html" ; PHP's default character set is set to UTF-8. ; https://php.net/default-charset default_charset = "UTF-8" ; PHP internal character encoding is set to empty. ; If empty, default_charset is used. ; https://php.net/internal-encoding ;internal_encoding = ; PHP input character encoding is set to empty. ; If empty, default_charset is used. ; https://php.net/input-encoding ;input_encoding = ; PHP output character encoding is set to empty. ; If empty, default_charset is used. ; See also output_buffer. ; https://php.net/output-encoding ;output_encoding = ;;;;;;;;;;;;;;;;;;;;;;;;; ; Paths and Directories ; ;;;;;;;;;;;;;;;;;;;;;;;;; ; UNIX: "/path1:/path2" ;include_path = ".:/php/includes" ; ; Windows: "\path1;\path2" ;include_path = ".;c:\php\includes" ; ; PHP's default setting for include_path is ".;/path/to/php/pear" ; https://php.net/include-path include_path = ".:/opt/php82/lib/php" ; The root of the PHP pages, used only if nonempty. ; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root ; if you are running php as a CGI under any web server (other than IIS) ; see documentation for security issues. The alternate is to use the ; cgi.force_redirect configuration below ; https://php.net/doc-root doc_root = ; The directory under which PHP opens the script using /~username used only ; if nonempty. ; https://php.net/user-dir user_dir = ; Directory in which the loadable extensions (modules) reside. ; https://php.net/extension-dir ;extension_dir = "./" ; On windows: ;extension_dir = "ext" extension_dir = "/opt/php82/lib/php/extensions/no-debug-non-zts-20220829/" ; Directory where the temporary files should be placed. ; Defaults to the system default (see sys_get_temp_dir) sys_temp_dir = "/tmp" ; Whether or not to enable the dl() function. The dl() function does NOT work ; properly in multithreaded servers, such as IIS or Zeus, and is automatically ; disabled on them. ; https://php.net/enable-dl enable_dl = Off ; cgi.force_redirect is necessary to provide security running PHP as a CGI under ; most web servers. Left undefined, PHP turns this on by default. You can ; turn it off here AT YOUR OWN RISK ; **You CAN safely turn this off for IIS, in fact, you MUST.** ; https://php.net/cgi.force-redirect ;cgi.force_redirect = 1 ; if cgi.nph is enabled it will force cgi to always sent Status: 200 with ; every request. PHP's default behavior is to disable this feature. ;cgi.nph = 1 ; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape ; (iPlanet) web servers, you MAY need to set an environment variable name that PHP ; will look for to know it is OK to continue execution. Setting this variable MAY ; cause security issues, KNOW WHAT YOU ARE DOING FIRST. ; https://php.net/cgi.redirect-status-env ;cgi.redirect_status_env = ; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's ; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok ; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting ; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting ; of zero causes PHP to behave as before. Default is 1. You should fix your scripts ; to use SCRIPT_FILENAME rather than PATH_TRANSLATED. ; https://php.net/cgi.fix-pathinfo ;cgi.fix_pathinfo=1 ; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside ; of the web tree and people will not be able to circumvent .htaccess security. ;cgi.discard_path=1 ; FastCGI under IIS supports the ability to impersonate ; security tokens of the calling client. This allows IIS to define the ; security context that the request runs under. mod_fastcgi under Apache ; does not currently support this feature (03/17/2002) ; Set to 1 if running under IIS. Default is zero. ; https://php.net/fastcgi.impersonate ;fastcgi.impersonate = 1 ; Disable logging through FastCGI connection. PHP's default behavior is to enable ; this feature. ;fastcgi.logging = 0 ; cgi.rfc2616_headers configuration option tells PHP what type of headers to ; use when sending HTTP response code. If set to 0, PHP sends Status: header that ; is supported by Apache. When this option is set to 1, PHP will send ; RFC2616 compliant header. ; Default is zero. ; https://php.net/cgi.rfc2616-headers ;cgi.rfc2616_headers = 0 ; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #! ; (shebang) at the top of the running script. This line might be needed if the ; script support running both as stand-alone script and via PHP CGI<. PHP in CGI ; mode skips this line and ignores its content if this directive is turned on. ; https://php.net/cgi.check-shebang-line ;cgi.check_shebang_line=1 ;;;;;;;;;;;;;;;; ; File Uploads ; ;;;;;;;;;;;;;;;; ; Whether to allow HTTP file uploads. ; https://php.net/file-uploads file_uploads = On ; Temporary directory for HTTP uploaded files (will use system default if not ; specified). ; https://php.net/upload-tmp-dir upload_tmp_dir = /tmp ; Maximum allowed size for uploaded files. ; https://php.net/upload-max-filesize upload_max_filesize = 325M ; Maximum number of files that can be uploaded via a single request max_file_uploads = 50 ;;;;;;;;;;;;;;;;;; ; Fopen wrappers ; ;;;;;;;;;;;;;;;;;; ; Whether to allow the treatment of URLs (like https:// or ftp://) as files. ; https://php.net/allow-url-fopen allow_url_fopen = On ; Whether to allow include/require to open URLs (like https:// or ftp://) as files. ; https://php.net/allow-url-include allow_url_include = Off ; Define the anonymous ftp password (your email address). PHP's default setting ; for this is empty. ; https://php.net/from ;from="john@doe.com" ; Define the User-Agent string. PHP's default setting for this is empty. ; https://php.net/user-agent ;user_agent="PHP" ; Default timeout for socket based streams (seconds) ; https://php.net/default-socket-timeout default_socket_timeout = 3600 ; If your scripts have to deal with files from Macintosh systems, ; or you are running on a Mac and need to deal with files from ; unix or win32 systems, setting this flag will cause PHP to ; automatically detect the EOL character in those files so that ; fgets() and file() will work regardless of the source of the file. ; https://php.net/auto-detect-line-endings auto_detect_line_endings = On ;;;;;;;;;;;;;;;;;;;;;; ; Dynamic Extensions ; ;;;;;;;;;;;;;;;;;;;;;; ; If you wish to have an extension loaded automatically, use the following ; syntax: ; ; extension=modulename ; ; For example: ; ; extension=mysqli ; ; When the extension library to load is not located in the default extension ; directory, You may specify an absolute path to the library file: ; ; extension=/path/to/extension/mysqli.so ; ; Note : The syntax used in previous PHP versions ('extension=.so' and ; 'extension='php_.dll') is supported for legacy reasons and may be ; deprecated in a future PHP major version. So, when it is possible, please ; move to the new ('extension=) syntax. ; ; Notes for Windows environments : ; ; - Many DLL files are located in the extensions/ (PHP 4) or ext/ (PHP 5+) ; extension folders as well as the separate PECL DLL download (PHP 5+). ; Be sure to appropriately set the extension_dir directive. ; ;extension=bz2 ;extension=curl ;extension=ffi ;extension=ftp ;extension=fileinfo ;extension=gd ;extension=gettext ;extension=gmp ;extension=intl ;extension=imap ;extension=ldap ;extension=mbstring ;extension=exif ; Must be after mbstring as it depends on it ;extension=mysqli ;extension=oci8_12c ; Use with Oracle Database 12c Instant Client ;extension=oci8_19 ; Use with Oracle Database 19 Instant Client ;extension=odbc ;extension=openssl ;extension=pdo_firebird ;extension=pdo_mysql ;extension=pdo_oci ;extension=pdo_odbc ;extension=pdo_pgsql ;extension=pdo_sqlite ;extension=pgsql ;extension=shmop ; The MIBS data available in the PHP distribution must be installed. ; See https://www.php.net/manual/en/snmp.installation.php ;extension=snmp ;extension=soap ;extension=sockets ;extension=sodium ;extension=sqlite3 ;extension=tidy ;extension=xsl ;zend_extension=opcache ;;;;;;;;;;;;;;;;;;; ; Module Settings ; ;;;;;;;;;;;;;;;;;;; [CLI Server] ; Whether the CLI web server uses ANSI color coding in its terminal output. cli_server.color = On [Date] ; Defines the default timezone used by the date functions ; https://php.net/date.timezone date.timezone = "UTC" ; https://php.net/date.default-latitude ;date.default_latitude = 31.7667 ; https://php.net/date.default-longitude ;date.default_longitude = 35.2333 ; https://php.net/date.sunrise-zenith ;date.sunrise_zenith = 90.833333 ; https://php.net/date.sunset-zenith ;date.sunset_zenith = 90.833333 [filter] ; https://php.net/filter.default ;filter.default = unsafe_raw ; https://php.net/filter.default-flags ;filter.default_flags = [iconv] ; Use of this INI entry is deprecated, use global input_encoding instead. ; If empty, default_charset or input_encoding or iconv.input_encoding is used. ; The precedence is: default_charset < input_encoding < iconv.input_encoding ;iconv.input_encoding = ; Use of this INI entry is deprecated, use global internal_encoding instead. ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;iconv.internal_encoding = ; Use of this INI entry is deprecated, use global output_encoding instead. ; If empty, default_charset or output_encoding or iconv.output_encoding is used. ; The precedence is: default_charset < output_encoding < iconv.output_encoding ; To use an output encoding conversion, iconv's output handler must be set ; otherwise output encoding conversion cannot be performed. ;iconv.output_encoding = [imap] ; rsh/ssh logins are disabled by default. Use this INI entry if you want to ; enable them. Note that the IMAP library does not filter mailbox names before ; passing them to rsh/ssh command, thus passing untrusted data to this function ; with rsh/ssh enabled is insecure. ;imap.enable_insecure_rsh=0 [intl] ;intl.default_locale = ; This directive allows you to produce PHP errors when some error ; happens within intl functions. The value is the level of the error produced. ; Default is 0, which does not produce any errors. ;intl.error_level = E_WARNING ;intl.use_exceptions = 0 [sqlite3] ; Directory pointing to SQLite3 extensions ; https://php.net/sqlite3.extension-dir ;sqlite3.extension_dir = ; SQLite defensive mode flag (only available from SQLite 3.26+) ; When the defensive flag is enabled, language features that allow ordinary ; SQL to deliberately corrupt the database file are disabled. This forbids ; writing directly to the schema, shadow tables (eg. FTS data tables), or ; the sqlite_dbpage virtual table. ; https://www.sqlite.org/c3ref/c_dbconfig_defensive.html ; (for older SQLite versions, this flag has no use) ;sqlite3.defensive = 1 [Pcre] ; PCRE library backtracking limit. ; https://php.net/pcre.backtrack-limit ;pcre.backtrack_limit=100000 ; PCRE library recursion limit. ; Please note that if you set this value to a high number you may consume all ; the available process stack and eventually crash PHP (due to reaching the ; stack size limit imposed by the Operating System). ; https://php.net/pcre.recursion-limit ;pcre.recursion_limit=100000 ; Enables or disables JIT compilation of patterns. This requires the PCRE ; library to be compiled with JIT support. ;pcre.jit=1 [Pdo] ; Whether to pool ODBC connections. Can be one of "strict", "relaxed" or "off" ; https://php.net/pdo-odbc.connection-pooling ;pdo_odbc.connection_pooling=strict [Pdo_mysql] ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. pdo_mysql.default_socket= [Phar] ; https://php.net/phar.readonly ;phar.readonly = On ; https://php.net/phar.require-hash ;phar.require_hash = On ;phar.cache_list = [mail function] ; For Win32 only. ; https://php.net/smtp ;SMTP = localhost ; https://php.net/smtp-port ;smtp_port = 25 ; For Win32 only. ; https://php.net/sendmail-from ;sendmail_from = me@example.com ; For Unix only. You may supply arguments as well (default: "sendmail -t -i"). ; https://php.net/sendmail-path sendmail_path = /usr/sbin/sendmail -t -i ; Force the addition of the specified parameters to be passed as extra parameters ; to the sendmail binary. These parameters will always replace the value of ; the 5th parameter to mail(). ;mail.force_extra_parameters = ; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename mail.add_x_header = Off ; The path to a log file that will log all mail() calls. Log entries include ; the full path of the script, line number, To address and headers. ;mail.log = ; Log mail to syslog (Event Log on Windows). ;mail.log = syslog [ODBC] ; https://php.net/odbc.default-db ;odbc.default_db = Not yet implemented ; https://php.net/odbc.default-user ;odbc.default_user = Not yet implemented ; https://php.net/odbc.default-pw ;odbc.default_pw = Not yet implemented ; Controls the ODBC cursor model. ; Default: SQL_CURSOR_STATIC (default). ;odbc.default_cursortype ; Allow or prevent persistent links. ; https://php.net/odbc.allow-persistent odbc.allow_persistent = On ; Check that a connection is still valid before reuse. ; https://php.net/odbc.check-persistent odbc.check_persistent = On ; Maximum number of persistent links. -1 means no limit. ; https://php.net/odbc.max-persistent odbc.max_persistent = -1 ; Maximum number of links (persistent + non-persistent). -1 means no limit. ; https://php.net/odbc.max-links odbc.max_links = -1 ; Handling of LONG fields. Returns number of bytes to variables. 0 means ; passthru. ; https://php.net/odbc.defaultlrl odbc.defaultlrl = 4096 ; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char. ; See the documentation on odbc_binmode and odbc_longreadlen for an explanation ; of odbc.defaultlrl and odbc.defaultbinmode ; https://php.net/odbc.defaultbinmode odbc.defaultbinmode = 1 [MySQLi] ; Maximum number of persistent links. -1 means no limit. ; https://php.net/mysqli.max-persistent mysqli.max_persistent = -1 ; Allow accessing, from PHP's perspective, local files with LOAD DATA statements ; https://php.net/mysqli.allow_local_infile ;mysqli.allow_local_infile = On ; It allows the user to specify a folder where files that can be sent via LOAD DATA ; LOCAL can exist. It is ignored if mysqli.allow_local_infile is enabled. ;mysqli.local_infile_directory = ; Allow or prevent persistent links. ; https://php.net/mysqli.allow-persistent mysqli.allow_persistent = On ; Maximum number of links. -1 means no limit. ; https://php.net/mysqli.max-links mysqli.max_links = -1 ; Default port number for mysqli_connect(). If unset, mysqli_connect() will use ; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the ; compile-time value defined MYSQL_PORT (in that order). Win32 will only look ; at MYSQL_PORT. ; https://php.net/mysqli.default-port mysqli.default_port = 3306 ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. ; https://php.net/mysqli.default-socket mysqli.default_socket = ; Default host for mysqli_connect() (doesn't apply in safe mode). ; https://php.net/mysqli.default-host mysqli.default_host = ; Default user for mysqli_connect() (doesn't apply in safe mode). ; https://php.net/mysqli.default-user mysqli.default_user = ; Default password for mysqli_connect() (doesn't apply in safe mode). ; Note that this is generally a *bad* idea to store passwords in this file. ; *Any* user with PHP access can run 'echo get_cfg_var("mysqli.default_pw") ; and reveal this password! And of course, any users with read access to this ; file will be able to reveal the password as well. ; https://php.net/mysqli.default-pw mysqli.default_pw = ; Allow or prevent reconnect mysqli.reconnect = Off ; If this option is enabled, closing a persistent connection will rollback ; any pending transactions of this connection, before it is put back ; into the persistent connection pool. ;mysqli.rollback_on_cached_plink = Off [mysqlnd] ; Enable / Disable collection of general statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. mysqlnd.collect_statistics = 0 ; Enable / Disable collection of memory usage statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. mysqlnd.collect_memory_statistics = 0 ; Records communication from all extensions using mysqlnd to the specified log ; file. ; https://php.net/mysqlnd.debug ;mysqlnd.debug = ; Defines which queries will be logged. ;mysqlnd.log_mask = 0 ; Default size of the mysqlnd memory pool, which is used by result sets. mysqlnd.mempool_default_size = 64000 ; Size of a pre-allocated buffer used when sending commands to MySQL in bytes. mysqlnd.net_cmd_buffer_size = 8192 ; Size of a pre-allocated buffer used for reading data sent by the server in ; bytes. mysqlnd.net_read_buffer_size = 131072 ; Timeout for network requests in seconds. ;mysqlnd.net_read_timeout = 31536000 ; SHA-256 Authentication Plugin related. File with the MySQL server public RSA ; key. ;mysqlnd.sha256_server_public_key = [OCI8] ; Connection: Enables privileged connections using external ; credentials (OCI_SYSOPER, OCI_SYSDBA) ; https://php.net/oci8.privileged-connect ;oci8.privileged_connect = Off ; Connection: The maximum number of persistent OCI8 connections per ; process. Using -1 means no limit. ; https://php.net/oci8.max-persistent ;oci8.max_persistent = -1 ; Connection: The maximum number of seconds a process is allowed to ; maintain an idle persistent connection. Using -1 means idle ; persistent connections will be maintained forever. ; https://php.net/oci8.persistent-timeout ;oci8.persistent_timeout = -1 ; Connection: The number of seconds that must pass before issuing a ; ping during oci_pconnect() to check the connection validity. When ; set to 0, each oci_pconnect() will cause a ping. Using -1 disables ; pings completely. ; https://php.net/oci8.ping-interval ;oci8.ping_interval = 60 ; Connection: Set this to a user chosen connection class to be used ; for all pooled server requests with Oracle 11g Database Resident ; Connection Pooling (DRCP). To use DRCP, this value should be set to ; the same string for all web servers running the same application, ; the database pool must be configured, and the connection string must ; specify to use a pooled server. ;oci8.connection_class = ; High Availability: Using On lets PHP receive Fast Application ; Notification (FAN) events generated when a database node fails. The ; database must also be configured to post FAN events. ;oci8.events = Off ; Tuning: This option enables statement caching, and specifies how ; many statements to cache. Using 0 disables statement caching. ; https://php.net/oci8.statement-cache-size ;oci8.statement_cache_size = 20 ; Tuning: Enables statement prefetching and sets the default number of ; rows that will be fetched automatically after statement execution. ; https://php.net/oci8.default-prefetch ;oci8.default_prefetch = 100 ; Compatibility. Using On means oci_close() will not close ; oci_connect() and oci_new_connect() connections. ; https://php.net/oci8.old-oci-close-semantics ;oci8.old_oci_close_semantics = Off [PostgreSQL] ; Allow or prevent persistent links. ; https://php.net/pgsql.allow-persistent pgsql.allow_persistent = On ; Detect broken persistent links always with pg_pconnect(). ; Auto reset feature requires a little overheads. ; https://php.net/pgsql.auto-reset-persistent pgsql.auto_reset_persistent = Off ; Maximum number of persistent links. -1 means no limit. ; https://php.net/pgsql.max-persistent pgsql.max_persistent = -1 ; Maximum number of links (persistent+non persistent). -1 means no limit. ; https://php.net/pgsql.max-links pgsql.max_links = -1 ; Ignore PostgreSQL backends Notice message or not. ; Notice message logging require a little overheads. ; https://php.net/pgsql.ignore-notice pgsql.ignore_notice = 0 ; Log PostgreSQL backends Notice message or not. ; Unless pgsql.ignore_notice=0, module cannot log notice message. ; https://php.net/pgsql.log-notice pgsql.log_notice = 0 [bcmath] ; Number of decimal digits for all bcmath functions. ; https://php.net/bcmath.scale bcmath.scale = 0 [browscap] ; https://php.net/browscap ;browscap = extra/browscap.ini [Session] ; Handler used to store/retrieve data. ; https://php.net/session.save-handler session.save_handler = files ; Argument passed to save_handler. In the case of files, this is the path ; where data files are stored. Note: Windows users have to change this ; variable in order to use PHP's session functions. ; ; The path can be defined as: ; ; session.save_path = "N;/path" ; ; where N is an integer. Instead of storing all the session files in ; /path, what this will do is use subdirectories N-levels deep, and ; store the session data in those directories. This is useful if ; your OS has problems with many files in one directory, and is ; a more efficient layout for servers that handle many sessions. ; ; NOTE 1: PHP will not create this directory structure automatically. ; You can use the script in the ext/session dir for that purpose. ; NOTE 2: See the section on garbage collection below if you choose to ; use subdirectories for session storage ; ; The file storage module creates files using mode 600 by default. ; You can change that by using ; ; session.save_path = "N;MODE;/path" ; ; where MODE is the octal representation of the mode. Note that this ; does not overwrite the process's umask. ; https://php.net/session.save-path session.save_path = "/opt/tmp" ; Whether to use strict session mode. ; Strict session mode does not accept an uninitialized session ID, and ; regenerates the session ID if the browser sends an uninitialized session ID. ; Strict mode protects applications from session fixation via a session adoption ; vulnerability. It is disabled by default for maximum compatibility, but ; enabling it is encouraged. ; https://wiki.php.net/rfc/strict_sessions session.use_strict_mode = 0 ; Whether to use cookies. ; https://php.net/session.use-cookies session.use_cookies = 1 ; https://php.net/session.cookie-secure ;session.cookie_secure = ; This option forces PHP to fetch and use a cookie for storing and maintaining ; the session id. We encourage this operation as it's very helpful in combating ; session hijacking when not specifying and managing your own session id. It is ; not the be-all and end-all of session hijacking defense, but it's a good start. ; https://php.net/session.use-only-cookies session.use_only_cookies = 1 ; Name of the session (used as cookie name). ; https://php.net/session.name session.name = PHPSESSID ; Initialize session on request startup. ; https://php.net/session.auto-start session.auto_start = 0 ; Lifetime in seconds of cookie or, if 0, until browser is restarted. ; https://php.net/session.cookie-lifetime session.cookie_lifetime = 0 ; The path for which the cookie is valid. ; https://php.net/session.cookie-path session.cookie_path = / ; The domain for which the cookie is valid. ; https://php.net/session.cookie-domain session.cookie_domain = ; Whether or not to add the httpOnly flag to the cookie, which makes it ; inaccessible to browser scripting languages such as JavaScript. ; https://php.net/session.cookie-httponly session.cookie_httponly = 1 ; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF) ; Current valid values are "Strict", "Lax" or "None". When using "None", ; make sure to include the quotes, as `none` is interpreted like `false` in ini files. ; https://tools.ietf.org/html/draft-west-first-party-cookies-07 session.cookie_samesite = ; Handler used to serialize data. php is the standard serializer of PHP. ; https://php.net/session.serialize-handler session.serialize_handler = php ; Defines the probability that the 'garbage collection' process is started on every ; session initialization. The probability is calculated by using gc_probability/gc_divisor, ; e.g. 1/100 means there is a 1% chance that the GC process starts on each request. ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; https://php.net/session.gc-probability session.gc_probability = 1 ; Defines the probability that the 'garbage collection' process is started on every ; session initialization. The probability is calculated by using gc_probability/gc_divisor, ; e.g. 1/100 means there is a 1% chance that the GC process starts on each request. ; For high volume production servers, using a value of 1000 is a more efficient approach. ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; https://php.net/session.gc-divisor session.gc_divisor = 1000 ; After this number of seconds, stored data will be seen as 'garbage' and ; cleaned up by the garbage collection process. ; https://php.net/session.gc-maxlifetime session.gc_maxlifetime = 1440 ; NOTE: If you are using the subdirectory option for storing session files ; (see session.save_path above), then garbage collection does *not* ; happen automatically. You will need to do your own garbage ; collection through a shell script, cron entry, or some other method. ; For example, the following script is the equivalent of setting ; session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes): ; find /path/to/sessions -cmin +24 -type f | xargs rm ; Check HTTP Referer to invalidate externally stored URLs containing ids. ; HTTP_REFERER has to contain this substring for the session to be ; considered as valid. ; https://php.net/session.referer-check session.referer_check = ; Set to {nocache,private,public,} to determine HTTP caching aspects ; or leave this empty to avoid sending anti-caching headers. ; https://php.net/session.cache-limiter session.cache_limiter = nocache ; Document expires after n minutes. ; https://php.net/session.cache-expire session.cache_expire = 180 ; trans sid support is disabled by default. ; Use of trans sid may risk your users' security. ; Use this option with caution. ; - User may send URL contains active session ID ; to other person via. email/irc/etc. ; - URL that contains active session ID may be stored ; in publicly accessible computer. ; - User may access your site with the same session ID ; always using URL stored in browser's history or bookmarks. ; https://php.net/session.use-trans-sid session.use_trans_sid = 0 ; Set session ID character length. This value could be between 22 to 256. ; Shorter length than default is supported only for compatibility reason. ; Users should use 32 or more chars. ; https://php.net/session.sid-length ; Default Value: 32 ; Development Value: 26 ; Production Value: 26 session.sid_length = 26 ; The URL rewriter will look for URLs in a defined set of HTML tags. ; is special; if you include them here, the rewriter will ; add a hidden field with the info which is otherwise appended ; to URLs. tag's action attribute URL will not be modified ; unless it is specified. ; Note that all valid entries require a "=", even if no value follows. ; Default Value: "a=href,area=href,frame=src,form=" ; Development Value: "a=href,area=href,frame=src,form=" ; Production Value: "a=href,area=href,frame=src,form=" ; https://php.net/url-rewriter.tags session.trans_sid_tags = "a=href,area=href,frame=src,form=" ; URL rewriter does not rewrite absolute URLs by default. ; To enable rewrites for absolute paths, target hosts must be specified ; at RUNTIME. i.e. use ini_set() ; tags is special. PHP will check action attribute's URL regardless ; of session.trans_sid_tags setting. ; If no host is defined, HTTP_HOST will be used for allowed host. ; Example value: php.net,www.php.net,wiki.php.net ; Use "," for multiple hosts. No spaces are allowed. ; Default Value: "" ; Development Value: "" ; Production Value: "" ;session.trans_sid_hosts="" ; Define how many bits are stored in each character when converting ; the binary hash data to something readable. ; Possible values: ; 4 (4 bits: 0-9, a-f) ; 5 (5 bits: 0-9, a-v) ; 6 (6 bits: 0-9, a-z, A-Z, "-", ",") ; Default Value: 4 ; Development Value: 5 ; Production Value: 5 ; https://php.net/session.hash-bits-per-character session.sid_bits_per_character = 5 ; Enable upload progress tracking in $_SESSION ; Default Value: On ; Development Value: On ; Production Value: On ; https://php.net/session.upload-progress.enabled ;session.upload_progress.enabled = On ; Cleanup the progress information as soon as all POST data has been read ; (i.e. upload completed). ; Default Value: On ; Development Value: On ; Production Value: On ; https://php.net/session.upload-progress.cleanup ;session.upload_progress.cleanup = On ; A prefix used for the upload progress key in $_SESSION ; Default Value: "upload_progress_" ; Development Value: "upload_progress_" ; Production Value: "upload_progress_" ; https://php.net/session.upload-progress.prefix ;session.upload_progress.prefix = "upload_progress_" ; The index name (concatenated with the prefix) in $_SESSION ; containing the upload progress information ; Default Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Development Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Production Value: "PHP_SESSION_UPLOAD_PROGRESS" ; https://php.net/session.upload-progress.name ;session.upload_progress.name = "PHP_SESSION_UPLOAD_PROGRESS" ; How frequently the upload progress should be updated. ; Given either in percentages (per-file), or in bytes ; Default Value: "1%" ; Development Value: "1%" ; Production Value: "1%" ; https://php.net/session.upload-progress.freq ;session.upload_progress.freq = "1%" ; The minimum delay between updates, in seconds ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; https://php.net/session.upload-progress.min-freq ;session.upload_progress.min_freq = "1" ; Only write session data when session data is changed. Enabled by default. ; https://php.net/session.lazy-write ;session.lazy_write = On [Assertion] ; Switch whether to compile assertions at all (to have no overhead at run-time) ; -1: Do not compile at all ; 0: Jump over assertion at run-time ; 1: Execute assertions ; Changing from or to a negative value is only possible in php.ini! (For turning assertions on and off at run-time, see assert.active, when zend.assertions = 1) ; Default Value: 1 ; Development Value: 1 ; Production Value: -1 ; https://php.net/zend.assertions zend.assertions = -1 ; Assert(expr); active by default. ; https://php.net/assert.active ;assert.active = On ; Throw an AssertionError on failed assertions ; https://php.net/assert.exception ;assert.exception = On ; Issue a PHP warning for each failed assertion. (Overridden by assert.exception if active) ; https://php.net/assert.warning ;assert.warning = On ; Don't bail out by default. ; https://php.net/assert.bail ;assert.bail = Off ; User-function to be called if an assertion fails. ; https://php.net/assert.callback ;assert.callback = 0 [COM] ; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs ; https://php.net/com.typelib-file ;com.typelib_file = ; allow Distributed-COM calls ; https://php.net/com.allow-dcom ;com.allow_dcom = true ; autoregister constants of a component's typelib on com_load() ; https://php.net/com.autoregister-typelib ;com.autoregister_typelib = true ; register constants casesensitive ; https://php.net/com.autoregister-casesensitive ;com.autoregister_casesensitive = false ; show warnings on duplicate constant registrations ; https://php.net/com.autoregister-verbose ;com.autoregister_verbose = true ; The default character set code-page to use when passing strings to and from COM objects. ; Default: system ANSI code page ;com.code_page= ; The version of the .NET framework to use. The value of the setting are the first three parts ; of the framework's version number, separated by dots, and prefixed with "v", e.g. "v4.0.30319". ;com.dotnet_version= [mbstring] ; language for internal character representation. ; This affects mb_send_mail() and mbstring.detect_order. ; https://php.net/mbstring.language ;mbstring.language = Japanese ; Use of this INI entry is deprecated, use global internal_encoding instead. ; internal/script encoding. ; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*) ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;mbstring.internal_encoding = ; Use of this INI entry is deprecated, use global input_encoding instead. ; http input encoding. ; mbstring.encoding_translation = On is needed to use this setting. ; If empty, default_charset or input_encoding or mbstring.input is used. ; The precedence is: default_charset < input_encoding < mbstring.http_input ; https://php.net/mbstring.http-input ;mbstring.http_input = ; Use of this INI entry is deprecated, use global output_encoding instead. ; http output encoding. ; mb_output_handler must be registered as output buffer to function. ; If empty, default_charset or output_encoding or mbstring.http_output is used. ; The precedence is: default_charset < output_encoding < mbstring.http_output ; To use an output encoding conversion, mbstring's output handler must be set ; otherwise output encoding conversion cannot be performed. ; https://php.net/mbstring.http-output ;mbstring.http_output = ; enable automatic encoding translation according to ; mbstring.internal_encoding setting. Input chars are ; converted to internal encoding by setting this to On. ; Note: Do _not_ use automatic encoding translation for ; portable libs/applications. ; https://php.net/mbstring.encoding-translation ;mbstring.encoding_translation = Off ; automatic encoding detection order. ; "auto" detect order is changed according to mbstring.language ; https://php.net/mbstring.detect-order ;mbstring.detect_order = auto ; substitute_character used when character cannot be converted ; one from another ; https://php.net/mbstring.substitute-character ;mbstring.substitute_character = none ; Enable strict encoding detection. ;mbstring.strict_detection = Off ; This directive specifies the regex pattern of content types for which mb_output_handler() ; is activated. ; Default: mbstring.http_output_conv_mimetypes=^(text/|application/xhtml\+xml) ;mbstring.http_output_conv_mimetypes= ; This directive specifies maximum stack depth for mbstring regular expressions. It is similar ; to the pcre.recursion_limit for PCRE. ;mbstring.regex_stack_limit=100000 ; This directive specifies maximum retry count for mbstring regular expressions. It is similar ; to the pcre.backtrack_limit for PCRE. ;mbstring.regex_retry_limit=1000000 [gd] ; Tell the jpeg decode to ignore warnings and try to create ; a gd image. The warning will then be displayed as notices ; disabled by default ; https://php.net/gd.jpeg-ignore-warning ;gd.jpeg_ignore_warning = 1 [exif] ; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS. ; With mbstring support this will automatically be converted into the encoding ; given by corresponding encode setting. When empty mbstring.internal_encoding ; is used. For the decode settings you can distinguish between motorola and ; intel byte order. A decode setting cannot be empty. ; https://php.net/exif.encode-unicode ;exif.encode_unicode = ISO-8859-15 ; https://php.net/exif.decode-unicode-motorola ;exif.decode_unicode_motorola = UCS-2BE ; https://php.net/exif.decode-unicode-intel ;exif.decode_unicode_intel = UCS-2LE ; https://php.net/exif.encode-jis ;exif.encode_jis = ; https://php.net/exif.decode-jis-motorola ;exif.decode_jis_motorola = JIS ; https://php.net/exif.decode-jis-intel ;exif.decode_jis_intel = JIS [Tidy] ; The path to a default tidy configuration file to use when using tidy ; https://php.net/tidy.default-config ;tidy.default_config = /usr/local/lib/php/default.tcfg ; Should tidy clean and repair output automatically? ; WARNING: Do not use this option if you are generating non-html content ; such as dynamic images ; https://php.net/tidy.clean-output tidy.clean_output = Off [soap] ; Enables or disables WSDL caching feature. ; https://php.net/soap.wsdl-cache-enabled soap.wsdl_cache_enabled=1 ; Sets the directory name where SOAP extension will put cache files. ; https://php.net/soap.wsdl-cache-dir soap.wsdl_cache_dir="/tmp" ; (time to live) Sets the number of second while cached file will be used ; instead of original one. ; https://php.net/soap.wsdl-cache-ttl soap.wsdl_cache_ttl=86400 ; Sets the size of the cache limit. (Max. number of WSDL files to cache) soap.wsdl_cache_limit = 5 [sysvshm] ; A default size of the shared memory segment ;sysvshm.init_mem = 10000 [ldap] ; Sets the maximum number of open links or -1 for unlimited. ldap.max_links = -1 [dba] ;dba.default_handler= [opcache] ; Determines if Zend OPCache is enabled ;opcache.enable=1 ; Determines if Zend OPCache is enabled for the CLI version of PHP ;opcache.enable_cli=0 ; The OPcache shared memory storage size. ;opcache.memory_consumption=128 ; The amount of memory for interned strings in Mbytes. ;opcache.interned_strings_buffer=8 ; The maximum number of keys (scripts) in the OPcache hash table. ; Only numbers between 200 and 1000000 are allowed. ;opcache.max_accelerated_files=10000 ; The maximum percentage of "wasted" memory until a restart is scheduled. ;opcache.max_wasted_percentage=5 ; When this directive is enabled, the OPcache appends the current working ; directory to the script key, thus eliminating possible collisions between ; files with the same name (basename). Disabling the directive improves ; performance, but may break existing applications. ;opcache.use_cwd=1 ; When disabled, you must reset the OPcache manually or restart the ; webserver for changes to the filesystem to take effect. ;opcache.validate_timestamps=1 ; How often (in seconds) to check file timestamps for changes to the shared ; memory storage allocation. ("1" means validate once per second, but only ; once per request. "0" means always validate) ;opcache.revalidate_freq=2 ; Enables or disables file search in include_path optimization ;opcache.revalidate_path=0 ; If disabled, all PHPDoc comments are dropped from the code to reduce the ; size of the optimized code. ;opcache.save_comments=1 ; If enabled, compilation warnings (including notices and deprecations) will ; be recorded and replayed each time a file is included. Otherwise, compilation ; warnings will only be emitted when the file is first cached. ;opcache.record_warnings=0 ; Allow file existence override (file_exists, etc.) performance feature. ;opcache.enable_file_override=0 ; A bitmask, where each bit enables or disables the appropriate OPcache ; passes ;opcache.optimization_level=0x7FFFBFFF ;opcache.dups_fix=0 ; The location of the OPcache blacklist file (wildcards allowed). ; Each OPcache blacklist file is a text file that holds the names of files ; that should not be accelerated. The file format is to add each filename ; to a new line. The filename may be a full path or just a file prefix ; (i.e., /var/www/x blacklists all the files and directories in /var/www ; that start with 'x'). Line starting with a ; are ignored (comments). ;opcache.blacklist_filename= ; Allows exclusion of large files from being cached. By default all files ; are cached. ;opcache.max_file_size=0 ; Check the cache checksum each N requests. ; The default value of "0" means that the checks are disabled. ;opcache.consistency_checks=0 ; How long to wait (in seconds) for a scheduled restart to begin if the cache ; is not being accessed. ;opcache.force_restart_timeout=180 ; OPcache error_log file name. Empty string assumes "stderr". ;opcache.error_log= ; All OPcache errors go to the Web server log. ; By default, only fatal errors (level 0) or errors (level 1) are logged. ; You can also enable warnings (level 2), info messages (level 3) or ; debug messages (level 4). ;opcache.log_verbosity_level=1 ; Preferred Shared Memory back-end. Leave empty and let the system decide. ;opcache.preferred_memory_model= ; Protect the shared memory from unexpected writing during script execution. ; Useful for internal debugging only. ;opcache.protect_memory=0 ; Allows calling OPcache API functions only from PHP scripts which path is ; started from specified string. The default "" means no restriction ;opcache.restrict_api= ; Mapping base of shared memory segments (for Windows only). All the PHP ; processes have to map shared memory into the same address space. This ; directive allows to manually fix the "Unable to reattach to base address" ; errors. ;opcache.mmap_base= ; Facilitates multiple OPcache instances per user (for Windows only). All PHP ; processes with the same cache ID and user share an OPcache instance. ;opcache.cache_id= ; Enables and sets the second level cache directory. ; It should improve performance when SHM memory is full, at server restart or ; SHM reset. The default "" disables file based caching. ;opcache.file_cache= ; Enables or disables opcode caching in shared memory. ;opcache.file_cache_only=0 ; Enables or disables checksum validation when script loaded from file cache. ;opcache.file_cache_consistency_checks=1 ; Implies opcache.file_cache_only=1 for a certain process that failed to ; reattach to the shared memory (for Windows only). Explicitly enabled file ; cache is required. ;opcache.file_cache_fallback=1 ; Enables or disables copying of PHP code (text segment) into HUGE PAGES. ; This should improve performance, but requires appropriate OS configuration. ;opcache.huge_code_pages=0 ; Validate cached file permissions. ;opcache.validate_permission=0 ; Prevent name collisions in chroot'ed environment. ;opcache.validate_root=0 ; If specified, it produces opcode dumps for debugging different stages of ; optimizations. ;opcache.opt_debug_level=0 ; Specifies a PHP script that is going to be compiled and executed at server ; start-up. ; https://php.net/opcache.preload ;opcache.preload= ; Preloading code as root is not allowed for security reasons. This directive ; facilitates to let the preloading to be run as another user. ; https://php.net/opcache.preload_user ;opcache.preload_user= ; Prevents caching files that are less than this number of seconds old. It ; protects from caching of incompletely updated files. In case all file updates ; on your site are atomic, you may increase performance by setting it to "0". ;opcache.file_update_protection=2 ; Absolute path used to store shared lockfiles (for *nix only). ;opcache.lockfile_path=/tmp [curl] ; A default value for the CURLOPT_CAINFO option. This is required to be an ; absolute path. ;curl.cainfo = [openssl] ; The location of a Certificate Authority (CA) file on the local filesystem ; to use when verifying the identity of SSL/TLS peers. Most users should ; not specify a value for this directive as PHP will attempt to use the ; OS-managed cert stores in its absence. If specified, this value may still ; be overridden on a per-stream basis via the "cafile" SSL stream context ; option. ;openssl.cafile= ; If openssl.cafile is not specified or if the CA file is not found, the ; directory pointed to by openssl.capath is searched for a suitable ; certificate. This value must be a correctly hashed certificate directory. ; Most users should not specify a value for this directive as PHP will ; attempt to use the OS-managed cert stores in its absence. If specified, ; this value may still be overridden on a per-stream basis via the "capath" ; SSL stream context option. ;openssl.capath= [ffi] ; FFI API restriction. Possible values: ; "preload" - enabled in CLI scripts and preloaded files (default) ; "false" - always disabled ; "true" - always enabled ;ffi.enable=preload ; List of headers files to preload, wildcard patterns allowed. ;ffi.preload= [Zend] zend_extension="/usr/local/ioncube/ioncube_loader_lin_8.2.so" ; fix for segfaults auto_globals_jit = Off cgi.fix_pathinfo = 1 mbstring.http_input = "pass" mbstring.http_output = "pass" mbstring.encoding_translation = 0 ; Enable Extensions extension=uploadprogress.so extension=imagick.so extension=redis.so ================================================ FILE: aegir/conf/php/php82-fpm ================================================ #!/bin/bash ### BEGIN INIT INFO # Provides: php82-fpm # Required-Start: $remote_fs $network # Required-Stop: $remote_fs $network # Default-Start: 2 3 4 5 # Default-Stop: 0 1 6 # Short-Description: starts php82-fpm # Description: starts the PHP FastCGI Process Manager daemon ### END INIT INFO prefix=/opt/php82 exec_prefix=${prefix} php_fpm_BIN=/opt/php82/sbin/php-fpm php_fpm_CONF=/opt/php82/etc/php82-fpm.conf php_fpm_PID=/run/php82-fpm.pid php_opts="--fpm-config $php_fpm_CONF --pid $php_fpm_PID -c /opt/php82/etc/php82.ini" wait_for_pid() { try=0 while test $try -lt 5; do case "$1" in 'created') if [ -f "$2" ]; then try='' break fi ;; 'removed') if [ ! -f "$2" ]; then try='' break fi ;; esac echo -n . try=`expr $try + 1` sleep 1 done } case "$1" in start) echo -n "Starting php82-fpm..." $php_fpm_BIN --daemonize $php_opts if [ "$?" != 0 ]; then echo " failed" exit 1 fi wait_for_pid created $php_fpm_PID if [ -n "$try" ]; then echo " failed" exit 1 else echo " done" fi ;; stop) echo -n "Gracefully shutting down php82-fpm..." if [ ! -r $php_fpm_PID ]; then echo "warning, no pid file found - php82-fpm is not running ?" exit 1 fi kill -QUIT `cat $php_fpm_PID` wait_for_pid removed $php_fpm_PID if [ -n "$try" ]; then echo " failed. Use force-quit" exit 1 else echo " done" fi ;; status) if [ ! -r $php_fpm_PID ]; then echo "php82-fpm is stopped" exit 0 fi PID=`cat $php_fpm_PID` if ps -p $PID | grep -q $PID; then echo "php82-fpm (pid $PID) is running..." else echo "php82-fpm dead but pid file exists" fi ;; force-quit) echo -n "Terminating php82-fpm..." if [ ! -r $php_fpm_PID ]; then echo "warning, no pid file found - php82-fpm is not running ?" exit 1 fi kill -TERM `cat $php_fpm_PID` wait_for_pid removed $php_fpm_PID if [ -n "$try" ]; then echo " failed" exit 1 else echo " done" fi ;; restart) $0 stop $0 start ;; reload) echo -n "Reloading service php82-fpm..." if [ ! -r $php_fpm_PID ]; then echo "warning, no pid file found - php82-fpm is not running ?" exit 1 fi kill -USR2 `cat $php_fpm_PID` echo " done" ;; configtest) $php_fpm_BIN -t ;; *) echo "Usage: $0 {start|stop|force-quit|restart|reload|status|configtest}" exit 1 ;; esac ================================================ FILE: aegir/conf/php/php82-fpm.conf ================================================ ;;;;;;;;;;;;;;;;;;;;; ; FPM Configuration ; ;;;;;;;;;;;;;;;;;;;;; ; All relative paths in this configuration file are relative to PHP's install ; prefix (/opt/php82). This prefix can be dynamically changed by using the ; '-p' argument from the command line. ; Include one or more files. If glob(3) exists, it is used to include a bunch of ; files from a glob(3) pattern. This directive can be used everywhere in the ; file. ; Relative path can also be used. They will be prefixed by: ; - the global prefix if it's been set (-p argument) ; - /opt/php82 otherwise ;include=etc/fpm.d/*.conf ;;;;;;;;;;;;;;;;;; ; Global Options ; ;;;;;;;;;;;;;;;;;; [global] ; Pid file ; Note: the default prefix is /opt/php82/var ; Default Value: none pid = /run/php82-fpm.pid ; Error log file ; If it's set to "syslog", log is sent to syslogd instead of being written ; in a local file. ; Note: the default prefix is /opt/php82/var ; Default Value: log/php-fpm.log error_log = /var/log/php/php82-fpm-error.log ; syslog_facility is used to specify what type of program is logging the ; message. This lets syslogd specify that messages from different facilities ; will be handled differently. ; See syslog(3) for possible values (ex daemon equiv LOG_DAEMON) ; Default Value: daemon syslog.facility = daemon ; syslog_ident is prepended to every message. If you have multiple FPM ; instances running on the same server, you can change the default value ; which must suit common needs. ; Default Value: php-fpm syslog.ident = php82-fpm ; Log level ; Possible Values: alert, error, warning, notice, debug ; Default Value: notice log_level = warning ; If this number of child processes exit with SIGSEGV or SIGBUS within the time ; interval set by emergency_restart_interval then FPM will restart. A value ; of '0' means 'Off'. ; Default Value: 0 emergency_restart_threshold = 5 ; Interval of time used by emergency_restart_interval to determine when ; a graceful restart will be initiated. This can be useful to work around ; accidental corruptions in an accelerator's shared memory. ; Available Units: s(econds), m(inutes), h(ours), or d(ays) ; Default Unit: seconds ; Default Value: 0 emergency_restart_interval = 1m ; Time limit for child processes to wait for a reaction on signals from master. ; Available units: s(econds), m(inutes), h(ours), or d(ays) ; Default Unit: seconds ; Default Value: 0 process_control_timeout = 5s ; The maximum number of processes FPM will fork. This has been design to control ; the global number of processes when using dynamic PM within a lot of pools. ; Use it with caution. ; Note: A value of 0 indicates no limit ; Default Value: 0 process.max = 0 ; Specify the nice(2) priority to apply to the master process (only if set) ; The value can vary from -19 (highest priority) to 20 (lower priority) ; Note: - It will only work if the FPM master process is launched as root ; - The pool process will inherit the master process priority ; unless it specified otherwise ; Default Value: no set ; process.priority = -19 ; Send FPM to background. Set to 'no' to keep FPM in foreground for debugging. ; Default Value: yes daemonize = yes ; Set open file descriptor rlimit for the master process. ; Default Value: system defined value ;rlimit_files = 1024 ; Set max core size rlimit for the master process. ; Possible Values: 'unlimited' or an integer greater or equal to 0 ; Default Value: system defined value ;rlimit_core = 0 ; Specify the event mechanism FPM will use. The following is available: ; - select (any POSIX os) ; - poll (any POSIX os) ; - epoll (linux >= 2.5.44) ; - kqueue (FreeBSD >= 4.1, OpenBSD >= 2.9, NetBSD >= 2.0) ; - /dev/poll (Solaris >= 7) ; - port (Solaris >= 10) ; Default Value: not set (auto detection) ;events.mechanism = epoll ;;;;;;;;;;;;;;;;;;;; ; Pool Definitions ; ;;;;;;;;;;;;;;;;;;;; ; Multiple pools of child processes may be started with different listening ; ports and different management options. The name of the pool will be ; used in logs and stats. There is no limitation on the number of pools which ; FPM can handle. Your system will tell you anyway :) include = /opt/php82/etc/pool.d/*.conf ================================================ FILE: aegir/conf/php/php82.ini ================================================ [PHP] ;;;;;;;;;;;;;;;;;;; ; About php.ini ; ;;;;;;;;;;;;;;;;;;; ; PHP's initialization file, generally called php.ini, is responsible for ; configuring many of the aspects of PHP's behavior. ; PHP attempts to find and load this configuration from a number of locations. ; The following is a summary of its search order: ; 1. SAPI module specific location. ; 2. The PHPRC environment variable. (As of PHP 5.2.0) ; 3. A number of predefined registry keys on Windows (As of PHP 5.2.0) ; 4. Current working directory (except CLI) ; 5. The web server's directory (for SAPI modules), or directory of PHP ; (otherwise in Windows) ; 6. The directory from the --with-config-file-path compile time option, or the ; Windows directory (usually C:\windows) ; See the PHP docs for more specific information. ; https://php.net/configuration.file ; The syntax of the file is extremely simple. Whitespace and lines ; beginning with a semicolon are silently ignored (as you probably guessed). ; Section headers (e.g. [Foo]) are also silently ignored, even though ; they might mean something in the future. ; Directives following the section heading [PATH=/www/mysite] only ; apply to PHP files in the /www/mysite directory. Directives ; following the section heading [HOST=www.example.com] only apply to ; PHP files served from www.example.com. Directives set in these ; special sections cannot be overridden by user-defined INI files or ; at runtime. Currently, [PATH=] and [HOST=] sections only work under ; CGI/FastCGI. ; https://php.net/ini.sections ; Directives are specified using the following syntax: ; directive = value ; Directive names are *case sensitive* - foo=bar is different from FOO=bar. ; Directives are variables used to configure PHP or PHP extensions. ; There is no name validation. If PHP can't find an expected ; directive because it is not set or is mistyped, a default value will be used. ; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one ; of the INI constants (On, Off, True, False, Yes, No and None) or an expression ; (e.g. E_ALL & ~E_NOTICE), a quoted string ("bar"), or a reference to a ; previously set variable or directive (e.g. ${foo}) ; Expressions in the INI file are limited to bitwise operators and parentheses: ; | bitwise OR ; ^ bitwise XOR ; & bitwise AND ; ~ bitwise NOT ; ! boolean NOT ; Boolean flags can be turned on using the values 1, On, True or Yes. ; They can be turned off using the values 0, Off, False or No. ; An empty string can be denoted by simply not writing anything after the equal ; sign, or by using the None keyword: ; foo = ; sets foo to an empty string ; foo = None ; sets foo to an empty string ; foo = "None" ; sets foo to the string 'None' ; If you use constants in your value, and these constants belong to a ; dynamically loaded extension (either a PHP extension or a Zend extension), ; you may only use these constants *after* the line that loads the extension. ;;;;;;;;;;;;;;;;;;; ; About this file ; ;;;;;;;;;;;;;;;;;;; ; PHP comes packaged with two INI files. One that is recommended to be used ; in production environments and one that is recommended to be used in ; development environments. ; php.ini-production contains settings which hold security, performance and ; best practices at its core. But please be aware, these settings may break ; compatibility with older or less security conscience applications. We ; recommending using the production ini in production and testing environments. ; php.ini-development is very similar to its production variant, except it is ; much more verbose when it comes to errors. We recommend using the ; development version only in development environments, as errors shown to ; application users can inadvertently leak otherwise secure information. ; This is the php.ini-production INI file. ;;;;;;;;;;;;;;;;;;; ; Quick Reference ; ;;;;;;;;;;;;;;;;;;; ; The following are all the settings which are different in either the production ; or development versions of the INIs with respect to PHP's default behavior. ; Please see the actual settings later in the document for more details as to why ; we recommend these changes in PHP's behavior. display_errors = Off ; Default Value: On ; Development Value: On ; Production Value: Off ; display_startup_errors ; Default Value: On ; Development Value: On ; Production Value: Off ; error_reporting ; Default Value: E_ALL ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; log_errors ; Default Value: Off ; Development Value: On ; Production Value: On ; max_input_time ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; output_buffering ; Default Value: Off ; Development Value: 4096 ; Production Value: 4096 ; register_argc_argv ; Default Value: On ; Development Value: Off ; Production Value: Off ; request_order ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; session.gc_divisor ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; session.sid_bits_per_character ; Default Value: 4 ; Development Value: 5 ; Production Value: 5 ; short_open_tag ; Default Value: On ; Development Value: Off ; Production Value: Off ; variables_order ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS" ; zend.exception_ignore_args ; Default Value: Off ; Development Value: Off ; Production Value: On ; zend.exception_string_param_max_len ; Default Value: 15 ; Development Value: 15 ; Production Value: 0 ;;;;;;;;;;;;;;;;;;;; ; php.ini Options ; ;;;;;;;;;;;;;;;;;;;; ; Name for user-defined php.ini (.htaccess) files. Default is ".user.ini" ;user_ini.filename = ".user.ini" ; To disable this feature set this option to an empty value user_ini.filename = ; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes) ;user_ini.cache_ttl = 300 ;;;;;;;;;;;;;;;;;;;; ; Language Options ; ;;;;;;;;;;;;;;;;;;;; ; Enable the PHP scripting language engine under Apache. ; https://php.net/engine engine = On ; This directive determines whether or not PHP will recognize code between ; tags as PHP source which should be processed as such. It is ; generally recommended that should be used and that this feature ; should be disabled, as enabling it may result in issues when generating XML ; documents, however this remains supported for backward compatibility reasons. ; Note that this directive does not control the would work. ; https://php.net/syntax-highlighting ;highlight.string = #DD0000 ;highlight.comment = #FF9900 ;highlight.keyword = #007700 ;highlight.default = #0000BB ;highlight.html = #000000 ; If enabled, the request will be allowed to complete even if the user aborts ; the request. Consider enabling it if executing long requests, which may end up ; being interrupted by the user or a browser timing out. PHP's default behavior ; is to disable this feature. ; https://php.net/ignore-user-abort ;ignore_user_abort = On ; Determines the size of the realpath cache to be used by PHP. This value should ; be increased on systems where PHP opens many files to reflect the quantity of ; the file operations performed. ; Note: if open_basedir is set, the cache is disabled ; https://php.net/realpath-cache-size realpath_cache_size=64M ; Duration of time, in seconds for which to cache realpath information for a given ; file or directory. For systems with rarely changing files, consider increasing this ; value. ; https://php.net/realpath-cache-ttl realpath_cache_ttl=180 ; Enables or disables the circular reference collector. ; https://php.net/zend.enable-gc zend.enable_gc = On ; If enabled, scripts may be written in encodings that are incompatible with ; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such ; encodings. To use this feature, mbstring extension must be enabled. ;zend.multibyte = Off ; Allows to set the default encoding for the scripts. This value will be used ; unless "declare(encoding=...)" directive appears at the top of the script. ; Only affects if zend.multibyte is set. ;zend.script_encoding = ; Allows to include or exclude arguments from stack traces generated for exceptions. ; In production, it is recommended to turn this setting on to prohibit the output ; of sensitive information in stack traces ; Default Value: Off ; Development Value: Off ; Production Value: On zend.exception_ignore_args = On ; Allows setting the maximum string length in an argument of a stringified stack trace ; to a value between 0 and 1000000. ; This has no effect when zend.exception_ignore_args is enabled. ; Default Value: 15 ; Development Value: 15 ; Production Value: 0 ; In production, it is recommended to set this to 0 to reduce the output ; of sensitive information in stack traces. zend.exception_string_param_max_len = 0 ;;;;;;;;;;;;;;;;; ; Miscellaneous ; ;;;;;;;;;;;;;;;;; ; Decides whether PHP may expose the fact that it is installed on the server ; (e.g. by adding its signature to the Web server header). It is no security ; threat in any way, but it makes it possible to determine whether you use PHP ; on your server or not. ; https://php.net/expose-php expose_php = On ;;;;;;;;;;;;;;;;;;; ; Resource Limits ; ;;;;;;;;;;;;;;;;;;; ; Maximum execution time of each script, in seconds ; https://php.net/max-execution-time ; Note: This directive is hardcoded to 0 for the CLI SAPI max_execution_time = 180 ; Maximum amount of time each script may spend parsing request data. It's a good ; idea to limit this time on productions servers in order to eliminate unexpectedly ; long running scripts. ; Note: This directive is hardcoded to -1 for the CLI SAPI ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; https://php.net/max-input-time max_input_time = 180 ; Maximum input variable nesting level ; https://php.net/max-input-nesting-level ;max_input_nesting_level = 64 ; How many GET/POST/COOKIE input variables may be accepted max_input_vars = 9999 ; Maximum amount of memory a script may consume ; https://php.net/memory-limit memory_limit = 395M ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; Error handling and logging ; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; This directive informs PHP of which errors, warnings and notices you would like ; it to take action for. The recommended way of setting values for this ; directive is through the use of the error level constants and bitwise ; operators. The error level constants are below here for convenience as well as ; some common settings and their meanings. ; By default, PHP is set to take action on all errors, notices and warnings EXCEPT ; those related to E_NOTICE and E_STRICT, which together cover best practices and ; recommended coding standards in PHP. For performance reasons, this is the ; recommend error reporting setting. Your production server shouldn't be wasting ; resources complaining about best practices and coding standards. That's what ; development servers and development settings are for. ; Note: The php.ini-development file has this setting as E_ALL. This ; means it pretty much reports everything which is exactly what you want during ; development and early testing. ; ; Error Level Constants: ; E_ALL - All errors and warnings (includes E_STRICT as of PHP 5.4.0) ; E_ERROR - fatal run-time errors ; E_RECOVERABLE_ERROR - almost fatal run-time errors ; E_WARNING - run-time warnings (non-fatal errors) ; E_PARSE - compile-time parse errors ; E_NOTICE - run-time notices (these are warnings which often result ; from a bug in your code, but it's possible that it was ; intentional (e.g., using an uninitialized variable and ; relying on the fact it is automatically initialized to an ; empty string) ; E_STRICT - run-time notices, enable to have PHP suggest changes ; to your code which will ensure the best interoperability ; and forward compatibility of your code ; E_CORE_ERROR - fatal errors that occur during PHP's initial startup ; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's ; initial startup ; E_COMPILE_ERROR - fatal compile-time errors ; E_COMPILE_WARNING - compile-time warnings (non-fatal errors) ; E_USER_ERROR - user-generated error message ; E_USER_WARNING - user-generated warning message ; E_USER_NOTICE - user-generated notice message ; E_DEPRECATED - warn about code that will not work in future versions ; of PHP ; E_USER_DEPRECATED - user-generated deprecation warnings ; ; Common Values: ; E_ALL (Show all errors, warnings and notices including coding standards.) ; E_ALL & ~E_NOTICE (Show all errors, except for notices) ; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.) ; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors) ; Default Value: E_ALL ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; https://php.net/error-reporting error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT ; This directive controls whether or not and where PHP will output errors, ; notices and warnings too. Error output is very useful during development, but ; it could be very dangerous in production environments. Depending on the code ; which is triggering the error, sensitive information could potentially leak ; out of your application such as database usernames and passwords or worse. ; For production environments, we recommend logging errors rather than ; sending them to STDOUT. ; Possible Values: ; Off = Do not display any errors ; stderr = Display errors to STDERR (affects only CGI/CLI binaries!) ; On or stdout = Display errors to STDOUT ; Default Value: On ; Development Value: On ; Production Value: Off ; https://php.net/display-errors display_errors = Off ; The display of errors which occur during PHP's startup sequence are handled ; separately from display_errors. We strongly recommend you set this to 'off' ; for production servers to avoid leaking configuration details. ; Default Value: On ; Development Value: On ; Production Value: Off ; https://php.net/display-startup-errors display_startup_errors = Off ; Besides displaying errors, PHP can also log errors to locations such as a ; server-specific log, STDERR, or a location specified by the error_log ; directive found below. While errors should not be displayed on productions ; servers they should still be monitored and logging is a great way to do that. ; Default Value: Off ; Development Value: On ; Production Value: On ; https://php.net/log-errors log_errors = On ; Do not log repeated messages. Repeated errors must occur in same file on same ; line unless ignore_repeated_source is set true. ; https://php.net/ignore-repeated-errors ignore_repeated_errors = Off ; Ignore source of message when ignoring repeated messages. When this setting ; is On you will not log errors with repeated messages from different files or ; source lines. ; https://php.net/ignore-repeated-source ignore_repeated_source = Off ; If this parameter is set to Off, then memory leaks will not be shown (on ; stdout or in the log). This is only effective in a debug compile, and if ; error reporting includes E_WARNING in the allowed list ; https://php.net/report-memleaks report_memleaks = On ; This setting is off by default. ;report_zend_debug = 0 ; Turn off normal error reporting and emit XML-RPC error XML ; https://php.net/xmlrpc-errors ;xmlrpc_errors = 0 ; An XML-RPC faultCode ;xmlrpc_error_number = 0 ; When PHP displays or logs an error, it has the capability of formatting the ; error message as HTML for easier reading. This directive controls whether ; the error message is formatted as HTML or not. ; Note: This directive is hardcoded to Off for the CLI SAPI ; https://php.net/html-errors html_errors = Off ; If html_errors is set to On *and* docref_root is not empty, then PHP ; produces clickable error messages that direct to a page describing the error ; or function causing the error in detail. ; You can download a copy of the PHP manual from https://php.net/docs ; and change docref_root to the base URL of your local copy including the ; leading '/'. You must also specify the file extension being used including ; the dot. PHP's default behavior is to leave these settings empty, in which ; case no links to documentation are generated. ; Note: Never use this feature for production boxes. ; https://php.net/docref-root ; Examples ;docref_root = "/phpmanual/" ; https://php.net/docref-ext ;docref_ext = .html ; String to output before an error message. PHP's default behavior is to leave ; this setting blank. ; https://php.net/error-prepend-string ; Example: ;error_prepend_string = "" ; String to output after an error message. PHP's default behavior is to leave ; this setting blank. ; https://php.net/error-append-string ; Example: ;error_append_string = "" ; Log errors to specified file. PHP's default behavior is to leave this value ; empty. ; https://php.net/error-log ; Example: ;error_log = php_errors.log ; Log errors to syslog (Event Log on Windows). ;error_log = syslog error_log = /var/log/php/error_log_82 ; The syslog ident is a string which is prepended to every message logged ; to syslog. Only used when error_log is set to syslog. ;syslog.ident = php ; The syslog facility is used to specify what type of program is logging ; the message. Only used when error_log is set to syslog. ;syslog.facility = user ; Set this to disable filtering control characters (the default). ; Some loggers only accept NVT-ASCII, others accept anything that's not ; control characters. If your logger accepts everything, then no filtering ; is needed at all. ; Allowed values are: ; ascii (all printable ASCII characters and NL) ; no-ctrl (all characters except control characters) ; all (all characters) ; raw (like "all", but messages are not split at newlines) ; https://php.net/syslog.filter ;syslog.filter = ascii ;windows.show_crt_warning ; Default value: 0 ; Development value: 0 ; Production value: 0 ;;;;;;;;;;;;;;;;; ; Data Handling ; ;;;;;;;;;;;;;;;;; ; The separator used in PHP generated URLs to separate arguments. ; PHP's default setting is "&". ; https://php.net/arg-separator.output ; Example: ;arg_separator.output = "&" ; List of separator(s) used by PHP to parse input URLs into variables. ; PHP's default setting is "&". ; NOTE: Every character in this directive is considered as separator! ; https://php.net/arg-separator.input ; Example: ;arg_separator.input = ";&" ; This directive determines which super global arrays are registered when PHP ; starts up. G,P,C,E & S are abbreviations for the following respective super ; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty ; paid for the registration of these arrays and because ENV is not as commonly ; used as the others, ENV is not recommended on productions servers. You ; can still get access to the environment variables through getenv() should you ; need to. ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS"; ; https://php.net/variables-order variables_order = "GPCS" ; This directive determines which super global data (G,P & C) should be ; registered into the super global array REQUEST. If so, it also determines ; the order in which that data is registered. The values for this directive ; are specified in the same manner as the variables_order directive, ; EXCEPT one. Leaving this value empty will cause PHP to use the value set ; in the variables_order directive. It does not mean it will leave the super ; globals array REQUEST empty. ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; https://php.net/request-order request_order = "GP" ; This directive determines whether PHP registers $argv & $argc each time it ; runs. $argv contains an array of all the arguments passed to PHP when a script ; is invoked. $argc contains an integer representing the number of arguments ; that were passed when the script was invoked. These arrays are extremely ; useful when running scripts from the command line. When this directive is ; enabled, registering these variables consumes CPU cycles and memory each time ; a script is executed. For performance reasons, this feature should be disabled ; on production servers. ; Note: This directive is hardcoded to On for the CLI SAPI ; Default Value: On ; Development Value: Off ; Production Value: Off ; https://php.net/register-argc-argv register_argc_argv = Off ; When enabled, the ENV, REQUEST and SERVER variables are created when they're ; first used (Just In Time) instead of when the script starts. If these ; variables are not used within a script, having this directive on will result ; in a performance gain. The PHP directive register_argc_argv must be disabled ; for this directive to have any effect. ; https://php.net/auto-globals-jit auto_globals_jit = On ; Whether PHP will read the POST data. ; This option is enabled by default. ; Most likely, you won't want to disable this option globally. It causes $_POST ; and $_FILES to always be empty; the only way you will be able to read the ; POST data will be through the php://input stream wrapper. This can be useful ; to proxy requests or to process the POST data in a memory efficient fashion. ; https://php.net/enable-post-data-reading ;enable_post_data_reading = Off ; Maximum size of POST data that PHP will accept. ; Its value may be 0 to disable the limit. It is ignored if POST data reading ; is disabled through enable_post_data_reading. ; https://php.net/post-max-size post_max_size = 350M ; Automatically add files before PHP document. ; https://php.net/auto-prepend-file auto_prepend_file = ; Automatically add files after PHP document. ; https://php.net/auto-append-file auto_append_file = ; By default, PHP will output a media type using the Content-Type header. To ; disable this, simply set it to be empty. ; ; PHP's built-in default media type is set to text/html. ; https://php.net/default-mimetype default_mimetype = "text/html" ; PHP's default character set is set to UTF-8. ; https://php.net/default-charset default_charset = "UTF-8" ; PHP internal character encoding is set to empty. ; If empty, default_charset is used. ; https://php.net/internal-encoding ;internal_encoding = ; PHP input character encoding is set to empty. ; If empty, default_charset is used. ; https://php.net/input-encoding ;input_encoding = ; PHP output character encoding is set to empty. ; If empty, default_charset is used. ; See also output_buffer. ; https://php.net/output-encoding ;output_encoding = ;;;;;;;;;;;;;;;;;;;;;;;;; ; Paths and Directories ; ;;;;;;;;;;;;;;;;;;;;;;;;; ; UNIX: "/path1:/path2" ;include_path = ".:/php/includes" ; ; Windows: "\path1;\path2" ;include_path = ".;c:\php\includes" ; ; PHP's default setting for include_path is ".;/path/to/php/pear" ; https://php.net/include-path include_path = ".:/opt/php82/lib/php" ; The root of the PHP pages, used only if nonempty. ; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root ; if you are running php as a CGI under any web server (other than IIS) ; see documentation for security issues. The alternate is to use the ; cgi.force_redirect configuration below ; https://php.net/doc-root doc_root = ; The directory under which PHP opens the script using /~username used only ; if nonempty. ; https://php.net/user-dir user_dir = ; Directory in which the loadable extensions (modules) reside. ; https://php.net/extension-dir ;extension_dir = "./" ; On windows: ;extension_dir = "ext" extension_dir = "/opt/php82/lib/php/extensions/no-debug-non-zts-20220829/" ; Directory where the temporary files should be placed. ; Defaults to the system default (see sys_get_temp_dir) sys_temp_dir = "/tmp" ; Whether or not to enable the dl() function. The dl() function does NOT work ; properly in multithreaded servers, such as IIS or Zeus, and is automatically ; disabled on them. ; https://php.net/enable-dl enable_dl = Off ; cgi.force_redirect is necessary to provide security running PHP as a CGI under ; most web servers. Left undefined, PHP turns this on by default. You can ; turn it off here AT YOUR OWN RISK ; **You CAN safely turn this off for IIS, in fact, you MUST.** ; https://php.net/cgi.force-redirect ;cgi.force_redirect = 1 ; if cgi.nph is enabled it will force cgi to always sent Status: 200 with ; every request. PHP's default behavior is to disable this feature. ;cgi.nph = 1 ; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape ; (iPlanet) web servers, you MAY need to set an environment variable name that PHP ; will look for to know it is OK to continue execution. Setting this variable MAY ; cause security issues, KNOW WHAT YOU ARE DOING FIRST. ; https://php.net/cgi.redirect-status-env ;cgi.redirect_status_env = ; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's ; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok ; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting ; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting ; of zero causes PHP to behave as before. Default is 1. You should fix your scripts ; to use SCRIPT_FILENAME rather than PATH_TRANSLATED. ; https://php.net/cgi.fix-pathinfo ;cgi.fix_pathinfo=1 ; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside ; of the web tree and people will not be able to circumvent .htaccess security. ;cgi.discard_path=1 ; FastCGI under IIS supports the ability to impersonate ; security tokens of the calling client. This allows IIS to define the ; security context that the request runs under. mod_fastcgi under Apache ; does not currently support this feature (03/17/2002) ; Set to 1 if running under IIS. Default is zero. ; https://php.net/fastcgi.impersonate ;fastcgi.impersonate = 1 ; Disable logging through FastCGI connection. PHP's default behavior is to enable ; this feature. ;fastcgi.logging = 0 ; cgi.rfc2616_headers configuration option tells PHP what type of headers to ; use when sending HTTP response code. If set to 0, PHP sends Status: header that ; is supported by Apache. When this option is set to 1, PHP will send ; RFC2616 compliant header. ; Default is zero. ; https://php.net/cgi.rfc2616-headers ;cgi.rfc2616_headers = 0 ; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #! ; (shebang) at the top of the running script. This line might be needed if the ; script support running both as stand-alone script and via PHP CGI<. PHP in CGI ; mode skips this line and ignores its content if this directive is turned on. ; https://php.net/cgi.check-shebang-line ;cgi.check_shebang_line=1 ;;;;;;;;;;;;;;;; ; File Uploads ; ;;;;;;;;;;;;;;;; ; Whether to allow HTTP file uploads. ; https://php.net/file-uploads file_uploads = On ; Temporary directory for HTTP uploaded files (will use system default if not ; specified). ; https://php.net/upload-tmp-dir upload_tmp_dir = /tmp ; Maximum allowed size for uploaded files. ; https://php.net/upload-max-filesize upload_max_filesize = 325M ; Maximum number of files that can be uploaded via a single request max_file_uploads = 50 ;;;;;;;;;;;;;;;;;; ; Fopen wrappers ; ;;;;;;;;;;;;;;;;;; ; Whether to allow the treatment of URLs (like https:// or ftp://) as files. ; https://php.net/allow-url-fopen allow_url_fopen = On ; Whether to allow include/require to open URLs (like https:// or ftp://) as files. ; https://php.net/allow-url-include allow_url_include = Off ; Define the anonymous ftp password (your email address). PHP's default setting ; for this is empty. ; https://php.net/from ;from="john@doe.com" ; Define the User-Agent string. PHP's default setting for this is empty. ; https://php.net/user-agent ;user_agent="PHP" ; Default timeout for socket based streams (seconds) ; https://php.net/default-socket-timeout default_socket_timeout = 180 ; If your scripts have to deal with files from Macintosh systems, ; or you are running on a Mac and need to deal with files from ; unix or win32 systems, setting this flag will cause PHP to ; automatically detect the EOL character in those files so that ; fgets() and file() will work regardless of the source of the file. ; https://php.net/auto-detect-line-endings auto_detect_line_endings = On ;;;;;;;;;;;;;;;;;;;;;; ; Dynamic Extensions ; ;;;;;;;;;;;;;;;;;;;;;; ; If you wish to have an extension loaded automatically, use the following ; syntax: ; ; extension=modulename ; ; For example: ; ; extension=mysqli ; ; When the extension library to load is not located in the default extension ; directory, You may specify an absolute path to the library file: ; ; extension=/path/to/extension/mysqli.so ; ; Note : The syntax used in previous PHP versions ('extension=.so' and ; 'extension='php_.dll') is supported for legacy reasons and may be ; deprecated in a future PHP major version. So, when it is possible, please ; move to the new ('extension=) syntax. ; ; Notes for Windows environments : ; ; - Many DLL files are located in the extensions/ (PHP 4) or ext/ (PHP 5+) ; extension folders as well as the separate PECL DLL download (PHP 5+). ; Be sure to appropriately set the extension_dir directive. ; ;extension=bz2 ;extension=curl ;extension=ffi ;extension=ftp ;extension=fileinfo ;extension=gd ;extension=gettext ;extension=gmp ;extension=intl ;extension=imap ;extension=ldap ;extension=mbstring ;extension=exif ; Must be after mbstring as it depends on it ;extension=mysqli ;extension=oci8_12c ; Use with Oracle Database 12c Instant Client ;extension=oci8_19 ; Use with Oracle Database 19 Instant Client ;extension=odbc ;extension=openssl ;extension=pdo_firebird ;extension=pdo_mysql ;extension=pdo_oci ;extension=pdo_odbc ;extension=pdo_pgsql ;extension=pdo_sqlite ;extension=pgsql ;extension=shmop ; The MIBS data available in the PHP distribution must be installed. ; See https://www.php.net/manual/en/snmp.installation.php ;extension=snmp ;extension=soap ;extension=sockets ;extension=sodium ;extension=sqlite3 ;extension=tidy ;extension=xsl ;zend_extension=opcache ;;;;;;;;;;;;;;;;;;; ; Module Settings ; ;;;;;;;;;;;;;;;;;;; [CLI Server] ; Whether the CLI web server uses ANSI color coding in its terminal output. cli_server.color = On [Date] ; Defines the default timezone used by the date functions ; https://php.net/date.timezone date.timezone = "UTC" ; https://php.net/date.default-latitude ;date.default_latitude = 31.7667 ; https://php.net/date.default-longitude ;date.default_longitude = 35.2333 ; https://php.net/date.sunrise-zenith ;date.sunrise_zenith = 90.833333 ; https://php.net/date.sunset-zenith ;date.sunset_zenith = 90.833333 [filter] ; https://php.net/filter.default ;filter.default = unsafe_raw ; https://php.net/filter.default-flags ;filter.default_flags = [iconv] ; Use of this INI entry is deprecated, use global input_encoding instead. ; If empty, default_charset or input_encoding or iconv.input_encoding is used. ; The precedence is: default_charset < input_encoding < iconv.input_encoding ;iconv.input_encoding = ; Use of this INI entry is deprecated, use global internal_encoding instead. ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;iconv.internal_encoding = ; Use of this INI entry is deprecated, use global output_encoding instead. ; If empty, default_charset or output_encoding or iconv.output_encoding is used. ; The precedence is: default_charset < output_encoding < iconv.output_encoding ; To use an output encoding conversion, iconv's output handler must be set ; otherwise output encoding conversion cannot be performed. ;iconv.output_encoding = [imap] ; rsh/ssh logins are disabled by default. Use this INI entry if you want to ; enable them. Note that the IMAP library does not filter mailbox names before ; passing them to rsh/ssh command, thus passing untrusted data to this function ; with rsh/ssh enabled is insecure. ;imap.enable_insecure_rsh=0 [intl] ;intl.default_locale = ; This directive allows you to produce PHP errors when some error ; happens within intl functions. The value is the level of the error produced. ; Default is 0, which does not produce any errors. ;intl.error_level = E_WARNING ;intl.use_exceptions = 0 [sqlite3] ; Directory pointing to SQLite3 extensions ; https://php.net/sqlite3.extension-dir ;sqlite3.extension_dir = ; SQLite defensive mode flag (only available from SQLite 3.26+) ; When the defensive flag is enabled, language features that allow ordinary ; SQL to deliberately corrupt the database file are disabled. This forbids ; writing directly to the schema, shadow tables (eg. FTS data tables), or ; the sqlite_dbpage virtual table. ; https://www.sqlite.org/c3ref/c_dbconfig_defensive.html ; (for older SQLite versions, this flag has no use) ;sqlite3.defensive = 1 [Pcre] ; PCRE library backtracking limit. ; https://php.net/pcre.backtrack-limit ;pcre.backtrack_limit=100000 ; PCRE library recursion limit. ; Please note that if you set this value to a high number you may consume all ; the available process stack and eventually crash PHP (due to reaching the ; stack size limit imposed by the Operating System). ; https://php.net/pcre.recursion-limit ;pcre.recursion_limit=100000 ; Enables or disables JIT compilation of patterns. This requires the PCRE ; library to be compiled with JIT support. ;pcre.jit=1 [Pdo] ; Whether to pool ODBC connections. Can be one of "strict", "relaxed" or "off" ; https://php.net/pdo-odbc.connection-pooling ;pdo_odbc.connection_pooling=strict [Pdo_mysql] ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. pdo_mysql.default_socket= [Phar] ; https://php.net/phar.readonly ;phar.readonly = On ; https://php.net/phar.require-hash ;phar.require_hash = On ;phar.cache_list = [mail function] ; For Win32 only. ; https://php.net/smtp ;SMTP = localhost ; https://php.net/smtp-port ;smtp_port = 25 ; For Win32 only. ; https://php.net/sendmail-from ;sendmail_from = me@example.com ; For Unix only. You may supply arguments as well (default: "sendmail -t -i"). ; https://php.net/sendmail-path sendmail_path = /usr/sbin/sendmail -t -i ; Force the addition of the specified parameters to be passed as extra parameters ; to the sendmail binary. These parameters will always replace the value of ; the 5th parameter to mail(). ;mail.force_extra_parameters = ; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename mail.add_x_header = Off ; The path to a log file that will log all mail() calls. Log entries include ; the full path of the script, line number, To address and headers. ;mail.log = ; Log mail to syslog (Event Log on Windows). ;mail.log = syslog [ODBC] ; https://php.net/odbc.default-db ;odbc.default_db = Not yet implemented ; https://php.net/odbc.default-user ;odbc.default_user = Not yet implemented ; https://php.net/odbc.default-pw ;odbc.default_pw = Not yet implemented ; Controls the ODBC cursor model. ; Default: SQL_CURSOR_STATIC (default). ;odbc.default_cursortype ; Allow or prevent persistent links. ; https://php.net/odbc.allow-persistent odbc.allow_persistent = On ; Check that a connection is still valid before reuse. ; https://php.net/odbc.check-persistent odbc.check_persistent = On ; Maximum number of persistent links. -1 means no limit. ; https://php.net/odbc.max-persistent odbc.max_persistent = -1 ; Maximum number of links (persistent + non-persistent). -1 means no limit. ; https://php.net/odbc.max-links odbc.max_links = -1 ; Handling of LONG fields. Returns number of bytes to variables. 0 means ; passthru. ; https://php.net/odbc.defaultlrl odbc.defaultlrl = 4096 ; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char. ; See the documentation on odbc_binmode and odbc_longreadlen for an explanation ; of odbc.defaultlrl and odbc.defaultbinmode ; https://php.net/odbc.defaultbinmode odbc.defaultbinmode = 1 [MySQLi] ; Maximum number of persistent links. -1 means no limit. ; https://php.net/mysqli.max-persistent mysqli.max_persistent = -1 ; Allow accessing, from PHP's perspective, local files with LOAD DATA statements ; https://php.net/mysqli.allow_local_infile ;mysqli.allow_local_infile = On ; It allows the user to specify a folder where files that can be sent via LOAD DATA ; LOCAL can exist. It is ignored if mysqli.allow_local_infile is enabled. ;mysqli.local_infile_directory = ; Allow or prevent persistent links. ; https://php.net/mysqli.allow-persistent mysqli.allow_persistent = On ; Maximum number of links. -1 means no limit. ; https://php.net/mysqli.max-links mysqli.max_links = -1 ; Default port number for mysqli_connect(). If unset, mysqli_connect() will use ; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the ; compile-time value defined MYSQL_PORT (in that order). Win32 will only look ; at MYSQL_PORT. ; https://php.net/mysqli.default-port mysqli.default_port = 3306 ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. ; https://php.net/mysqli.default-socket mysqli.default_socket = ; Default host for mysqli_connect() (doesn't apply in safe mode). ; https://php.net/mysqli.default-host mysqli.default_host = ; Default user for mysqli_connect() (doesn't apply in safe mode). ; https://php.net/mysqli.default-user mysqli.default_user = ; Default password for mysqli_connect() (doesn't apply in safe mode). ; Note that this is generally a *bad* idea to store passwords in this file. ; *Any* user with PHP access can run 'echo get_cfg_var("mysqli.default_pw") ; and reveal this password! And of course, any users with read access to this ; file will be able to reveal the password as well. ; https://php.net/mysqli.default-pw mysqli.default_pw = ; Allow or prevent reconnect mysqli.reconnect = Off ; If this option is enabled, closing a persistent connection will rollback ; any pending transactions of this connection, before it is put back ; into the persistent connection pool. ;mysqli.rollback_on_cached_plink = Off [mysqlnd] ; Enable / Disable collection of general statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. mysqlnd.collect_statistics = 0 ; Enable / Disable collection of memory usage statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. mysqlnd.collect_memory_statistics = 0 ; Records communication from all extensions using mysqlnd to the specified log ; file. ; https://php.net/mysqlnd.debug ;mysqlnd.debug = ; Defines which queries will be logged. ;mysqlnd.log_mask = 0 ; Default size of the mysqlnd memory pool, which is used by result sets. mysqlnd.mempool_default_size = 64000 ; Size of a pre-allocated buffer used when sending commands to MySQL in bytes. mysqlnd.net_cmd_buffer_size = 8192 ; Size of a pre-allocated buffer used for reading data sent by the server in ; bytes. mysqlnd.net_read_buffer_size = 131072 ; Timeout for network requests in seconds. ;mysqlnd.net_read_timeout = 31536000 ; SHA-256 Authentication Plugin related. File with the MySQL server public RSA ; key. ;mysqlnd.sha256_server_public_key = [OCI8] ; Connection: Enables privileged connections using external ; credentials (OCI_SYSOPER, OCI_SYSDBA) ; https://php.net/oci8.privileged-connect ;oci8.privileged_connect = Off ; Connection: The maximum number of persistent OCI8 connections per ; process. Using -1 means no limit. ; https://php.net/oci8.max-persistent ;oci8.max_persistent = -1 ; Connection: The maximum number of seconds a process is allowed to ; maintain an idle persistent connection. Using -1 means idle ; persistent connections will be maintained forever. ; https://php.net/oci8.persistent-timeout ;oci8.persistent_timeout = -1 ; Connection: The number of seconds that must pass before issuing a ; ping during oci_pconnect() to check the connection validity. When ; set to 0, each oci_pconnect() will cause a ping. Using -1 disables ; pings completely. ; https://php.net/oci8.ping-interval ;oci8.ping_interval = 60 ; Connection: Set this to a user chosen connection class to be used ; for all pooled server requests with Oracle 11g Database Resident ; Connection Pooling (DRCP). To use DRCP, this value should be set to ; the same string for all web servers running the same application, ; the database pool must be configured, and the connection string must ; specify to use a pooled server. ;oci8.connection_class = ; High Availability: Using On lets PHP receive Fast Application ; Notification (FAN) events generated when a database node fails. The ; database must also be configured to post FAN events. ;oci8.events = Off ; Tuning: This option enables statement caching, and specifies how ; many statements to cache. Using 0 disables statement caching. ; https://php.net/oci8.statement-cache-size ;oci8.statement_cache_size = 20 ; Tuning: Enables statement prefetching and sets the default number of ; rows that will be fetched automatically after statement execution. ; https://php.net/oci8.default-prefetch ;oci8.default_prefetch = 100 ; Compatibility. Using On means oci_close() will not close ; oci_connect() and oci_new_connect() connections. ; https://php.net/oci8.old-oci-close-semantics ;oci8.old_oci_close_semantics = Off [PostgreSQL] ; Allow or prevent persistent links. ; https://php.net/pgsql.allow-persistent pgsql.allow_persistent = On ; Detect broken persistent links always with pg_pconnect(). ; Auto reset feature requires a little overheads. ; https://php.net/pgsql.auto-reset-persistent pgsql.auto_reset_persistent = Off ; Maximum number of persistent links. -1 means no limit. ; https://php.net/pgsql.max-persistent pgsql.max_persistent = -1 ; Maximum number of links (persistent+non persistent). -1 means no limit. ; https://php.net/pgsql.max-links pgsql.max_links = -1 ; Ignore PostgreSQL backends Notice message or not. ; Notice message logging require a little overheads. ; https://php.net/pgsql.ignore-notice pgsql.ignore_notice = 0 ; Log PostgreSQL backends Notice message or not. ; Unless pgsql.ignore_notice=0, module cannot log notice message. ; https://php.net/pgsql.log-notice pgsql.log_notice = 0 [bcmath] ; Number of decimal digits for all bcmath functions. ; https://php.net/bcmath.scale bcmath.scale = 0 [browscap] ; https://php.net/browscap ;browscap = extra/browscap.ini [Session] ; Handler used to store/retrieve data. ; https://php.net/session.save-handler session.save_handler = files ; Argument passed to save_handler. In the case of files, this is the path ; where data files are stored. Note: Windows users have to change this ; variable in order to use PHP's session functions. ; ; The path can be defined as: ; ; session.save_path = "N;/path" ; ; where N is an integer. Instead of storing all the session files in ; /path, what this will do is use subdirectories N-levels deep, and ; store the session data in those directories. This is useful if ; your OS has problems with many files in one directory, and is ; a more efficient layout for servers that handle many sessions. ; ; NOTE 1: PHP will not create this directory structure automatically. ; You can use the script in the ext/session dir for that purpose. ; NOTE 2: See the section on garbage collection below if you choose to ; use subdirectories for session storage ; ; The file storage module creates files using mode 600 by default. ; You can change that by using ; ; session.save_path = "N;MODE;/path" ; ; where MODE is the octal representation of the mode. Note that this ; does not overwrite the process's umask. ; https://php.net/session.save-path session.save_path = "/opt/tmp" ; Whether to use strict session mode. ; Strict session mode does not accept an uninitialized session ID, and ; regenerates the session ID if the browser sends an uninitialized session ID. ; Strict mode protects applications from session fixation via a session adoption ; vulnerability. It is disabled by default for maximum compatibility, but ; enabling it is encouraged. ; https://wiki.php.net/rfc/strict_sessions session.use_strict_mode = 0 ; Whether to use cookies. ; https://php.net/session.use-cookies session.use_cookies = 1 ; https://php.net/session.cookie-secure ;session.cookie_secure = ; This option forces PHP to fetch and use a cookie for storing and maintaining ; the session id. We encourage this operation as it's very helpful in combating ; session hijacking when not specifying and managing your own session id. It is ; not the be-all and end-all of session hijacking defense, but it's a good start. ; https://php.net/session.use-only-cookies session.use_only_cookies = 1 ; Name of the session (used as cookie name). ; https://php.net/session.name session.name = PHPSESSID ; Initialize session on request startup. ; https://php.net/session.auto-start session.auto_start = 0 ; Lifetime in seconds of cookie or, if 0, until browser is restarted. ; https://php.net/session.cookie-lifetime session.cookie_lifetime = 0 ; The path for which the cookie is valid. ; https://php.net/session.cookie-path session.cookie_path = / ; The domain for which the cookie is valid. ; https://php.net/session.cookie-domain session.cookie_domain = ; Whether or not to add the httpOnly flag to the cookie, which makes it ; inaccessible to browser scripting languages such as JavaScript. ; https://php.net/session.cookie-httponly session.cookie_httponly = 1 ; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF) ; Current valid values are "Strict", "Lax" or "None". When using "None", ; make sure to include the quotes, as `none` is interpreted like `false` in ini files. ; https://tools.ietf.org/html/draft-west-first-party-cookies-07 session.cookie_samesite = ; Handler used to serialize data. php is the standard serializer of PHP. ; https://php.net/session.serialize-handler session.serialize_handler = php ; Defines the probability that the 'garbage collection' process is started on every ; session initialization. The probability is calculated by using gc_probability/gc_divisor, ; e.g. 1/100 means there is a 1% chance that the GC process starts on each request. ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; https://php.net/session.gc-probability session.gc_probability = 1 ; Defines the probability that the 'garbage collection' process is started on every ; session initialization. The probability is calculated by using gc_probability/gc_divisor, ; e.g. 1/100 means there is a 1% chance that the GC process starts on each request. ; For high volume production servers, using a value of 1000 is a more efficient approach. ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; https://php.net/session.gc-divisor session.gc_divisor = 1000 ; After this number of seconds, stored data will be seen as 'garbage' and ; cleaned up by the garbage collection process. ; https://php.net/session.gc-maxlifetime session.gc_maxlifetime = 1440 ; NOTE: If you are using the subdirectory option for storing session files ; (see session.save_path above), then garbage collection does *not* ; happen automatically. You will need to do your own garbage ; collection through a shell script, cron entry, or some other method. ; For example, the following script is the equivalent of setting ; session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes): ; find /path/to/sessions -cmin +24 -type f | xargs rm ; Check HTTP Referer to invalidate externally stored URLs containing ids. ; HTTP_REFERER has to contain this substring for the session to be ; considered as valid. ; https://php.net/session.referer-check session.referer_check = ; Set to {nocache,private,public,} to determine HTTP caching aspects ; or leave this empty to avoid sending anti-caching headers. ; https://php.net/session.cache-limiter session.cache_limiter = nocache ; Document expires after n minutes. ; https://php.net/session.cache-expire session.cache_expire = 180 ; trans sid support is disabled by default. ; Use of trans sid may risk your users' security. ; Use this option with caution. ; - User may send URL contains active session ID ; to other person via. email/irc/etc. ; - URL that contains active session ID may be stored ; in publicly accessible computer. ; - User may access your site with the same session ID ; always using URL stored in browser's history or bookmarks. ; https://php.net/session.use-trans-sid session.use_trans_sid = 0 ; Set session ID character length. This value could be between 22 to 256. ; Shorter length than default is supported only for compatibility reason. ; Users should use 32 or more chars. ; https://php.net/session.sid-length ; Default Value: 32 ; Development Value: 26 ; Production Value: 26 session.sid_length = 26 ; The URL rewriter will look for URLs in a defined set of HTML tags. ; is special; if you include them here, the rewriter will ; add a hidden field with the info which is otherwise appended ; to URLs. tag's action attribute URL will not be modified ; unless it is specified. ; Note that all valid entries require a "=", even if no value follows. ; Default Value: "a=href,area=href,frame=src,form=" ; Development Value: "a=href,area=href,frame=src,form=" ; Production Value: "a=href,area=href,frame=src,form=" ; https://php.net/url-rewriter.tags session.trans_sid_tags = "a=href,area=href,frame=src,form=" ; URL rewriter does not rewrite absolute URLs by default. ; To enable rewrites for absolute paths, target hosts must be specified ; at RUNTIME. i.e. use ini_set() ; tags is special. PHP will check action attribute's URL regardless ; of session.trans_sid_tags setting. ; If no host is defined, HTTP_HOST will be used for allowed host. ; Example value: php.net,www.php.net,wiki.php.net ; Use "," for multiple hosts. No spaces are allowed. ; Default Value: "" ; Development Value: "" ; Production Value: "" ;session.trans_sid_hosts="" ; Define how many bits are stored in each character when converting ; the binary hash data to something readable. ; Possible values: ; 4 (4 bits: 0-9, a-f) ; 5 (5 bits: 0-9, a-v) ; 6 (6 bits: 0-9, a-z, A-Z, "-", ",") ; Default Value: 4 ; Development Value: 5 ; Production Value: 5 ; https://php.net/session.hash-bits-per-character session.sid_bits_per_character = 5 ; Enable upload progress tracking in $_SESSION ; Default Value: On ; Development Value: On ; Production Value: On ; https://php.net/session.upload-progress.enabled ;session.upload_progress.enabled = On ; Cleanup the progress information as soon as all POST data has been read ; (i.e. upload completed). ; Default Value: On ; Development Value: On ; Production Value: On ; https://php.net/session.upload-progress.cleanup ;session.upload_progress.cleanup = On ; A prefix used for the upload progress key in $_SESSION ; Default Value: "upload_progress_" ; Development Value: "upload_progress_" ; Production Value: "upload_progress_" ; https://php.net/session.upload-progress.prefix ;session.upload_progress.prefix = "upload_progress_" ; The index name (concatenated with the prefix) in $_SESSION ; containing the upload progress information ; Default Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Development Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Production Value: "PHP_SESSION_UPLOAD_PROGRESS" ; https://php.net/session.upload-progress.name ;session.upload_progress.name = "PHP_SESSION_UPLOAD_PROGRESS" ; How frequently the upload progress should be updated. ; Given either in percentages (per-file), or in bytes ; Default Value: "1%" ; Development Value: "1%" ; Production Value: "1%" ; https://php.net/session.upload-progress.freq ;session.upload_progress.freq = "1%" ; The minimum delay between updates, in seconds ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; https://php.net/session.upload-progress.min-freq ;session.upload_progress.min_freq = "1" ; Only write session data when session data is changed. Enabled by default. ; https://php.net/session.lazy-write ;session.lazy_write = On [Assertion] ; Switch whether to compile assertions at all (to have no overhead at run-time) ; -1: Do not compile at all ; 0: Jump over assertion at run-time ; 1: Execute assertions ; Changing from or to a negative value is only possible in php.ini! (For turning assertions on and off at run-time, see assert.active, when zend.assertions = 1) ; Default Value: 1 ; Development Value: 1 ; Production Value: -1 ; https://php.net/zend.assertions zend.assertions = -1 ; Assert(expr); active by default. ; https://php.net/assert.active ;assert.active = On ; Throw an AssertionError on failed assertions ; https://php.net/assert.exception ;assert.exception = On ; Issue a PHP warning for each failed assertion. (Overridden by assert.exception if active) ; https://php.net/assert.warning ;assert.warning = On ; Don't bail out by default. ; https://php.net/assert.bail ;assert.bail = Off ; User-function to be called if an assertion fails. ; https://php.net/assert.callback ;assert.callback = 0 [COM] ; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs ; https://php.net/com.typelib-file ;com.typelib_file = ; allow Distributed-COM calls ; https://php.net/com.allow-dcom ;com.allow_dcom = true ; autoregister constants of a component's typelib on com_load() ; https://php.net/com.autoregister-typelib ;com.autoregister_typelib = true ; register constants casesensitive ; https://php.net/com.autoregister-casesensitive ;com.autoregister_casesensitive = false ; show warnings on duplicate constant registrations ; https://php.net/com.autoregister-verbose ;com.autoregister_verbose = true ; The default character set code-page to use when passing strings to and from COM objects. ; Default: system ANSI code page ;com.code_page= ; The version of the .NET framework to use. The value of the setting are the first three parts ; of the framework's version number, separated by dots, and prefixed with "v", e.g. "v4.0.30319". ;com.dotnet_version= [mbstring] ; language for internal character representation. ; This affects mb_send_mail() and mbstring.detect_order. ; https://php.net/mbstring.language ;mbstring.language = Japanese ; Use of this INI entry is deprecated, use global internal_encoding instead. ; internal/script encoding. ; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*) ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;mbstring.internal_encoding = ; Use of this INI entry is deprecated, use global input_encoding instead. ; http input encoding. ; mbstring.encoding_translation = On is needed to use this setting. ; If empty, default_charset or input_encoding or mbstring.input is used. ; The precedence is: default_charset < input_encoding < mbstring.http_input ; https://php.net/mbstring.http-input ;mbstring.http_input = ; Use of this INI entry is deprecated, use global output_encoding instead. ; http output encoding. ; mb_output_handler must be registered as output buffer to function. ; If empty, default_charset or output_encoding or mbstring.http_output is used. ; The precedence is: default_charset < output_encoding < mbstring.http_output ; To use an output encoding conversion, mbstring's output handler must be set ; otherwise output encoding conversion cannot be performed. ; https://php.net/mbstring.http-output ;mbstring.http_output = ; enable automatic encoding translation according to ; mbstring.internal_encoding setting. Input chars are ; converted to internal encoding by setting this to On. ; Note: Do _not_ use automatic encoding translation for ; portable libs/applications. ; https://php.net/mbstring.encoding-translation ;mbstring.encoding_translation = Off ; automatic encoding detection order. ; "auto" detect order is changed according to mbstring.language ; https://php.net/mbstring.detect-order ;mbstring.detect_order = auto ; substitute_character used when character cannot be converted ; one from another ; https://php.net/mbstring.substitute-character ;mbstring.substitute_character = none ; Enable strict encoding detection. ;mbstring.strict_detection = Off ; This directive specifies the regex pattern of content types for which mb_output_handler() ; is activated. ; Default: mbstring.http_output_conv_mimetypes=^(text/|application/xhtml\+xml) ;mbstring.http_output_conv_mimetypes= ; This directive specifies maximum stack depth for mbstring regular expressions. It is similar ; to the pcre.recursion_limit for PCRE. ;mbstring.regex_stack_limit=100000 ; This directive specifies maximum retry count for mbstring regular expressions. It is similar ; to the pcre.backtrack_limit for PCRE. ;mbstring.regex_retry_limit=1000000 [gd] ; Tell the jpeg decode to ignore warnings and try to create ; a gd image. The warning will then be displayed as notices ; disabled by default ; https://php.net/gd.jpeg-ignore-warning ;gd.jpeg_ignore_warning = 1 [exif] ; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS. ; With mbstring support this will automatically be converted into the encoding ; given by corresponding encode setting. When empty mbstring.internal_encoding ; is used. For the decode settings you can distinguish between motorola and ; intel byte order. A decode setting cannot be empty. ; https://php.net/exif.encode-unicode ;exif.encode_unicode = ISO-8859-15 ; https://php.net/exif.decode-unicode-motorola ;exif.decode_unicode_motorola = UCS-2BE ; https://php.net/exif.decode-unicode-intel ;exif.decode_unicode_intel = UCS-2LE ; https://php.net/exif.encode-jis ;exif.encode_jis = ; https://php.net/exif.decode-jis-motorola ;exif.decode_jis_motorola = JIS ; https://php.net/exif.decode-jis-intel ;exif.decode_jis_intel = JIS [Tidy] ; The path to a default tidy configuration file to use when using tidy ; https://php.net/tidy.default-config ;tidy.default_config = /usr/local/lib/php/default.tcfg ; Should tidy clean and repair output automatically? ; WARNING: Do not use this option if you are generating non-html content ; such as dynamic images ; https://php.net/tidy.clean-output tidy.clean_output = Off [soap] ; Enables or disables WSDL caching feature. ; https://php.net/soap.wsdl-cache-enabled soap.wsdl_cache_enabled=1 ; Sets the directory name where SOAP extension will put cache files. ; https://php.net/soap.wsdl-cache-dir soap.wsdl_cache_dir="/tmp" ; (time to live) Sets the number of second while cached file will be used ; instead of original one. ; https://php.net/soap.wsdl-cache-ttl soap.wsdl_cache_ttl=86400 ; Sets the size of the cache limit. (Max. number of WSDL files to cache) soap.wsdl_cache_limit = 5 [sysvshm] ; A default size of the shared memory segment ;sysvshm.init_mem = 10000 [ldap] ; Sets the maximum number of open links or -1 for unlimited. ldap.max_links = -1 [dba] ;dba.default_handler= [opcache] ; Determines if Zend OPCache is enabled ;opcache.enable=1 ; Determines if Zend OPCache is enabled for the CLI version of PHP ;opcache.enable_cli=0 ; The OPcache shared memory storage size. ;opcache.memory_consumption=128 ; The amount of memory for interned strings in Mbytes. ;opcache.interned_strings_buffer=8 ; The maximum number of keys (scripts) in the OPcache hash table. ; Only numbers between 200 and 1000000 are allowed. ;opcache.max_accelerated_files=10000 ; The maximum percentage of "wasted" memory until a restart is scheduled. ;opcache.max_wasted_percentage=5 ; When this directive is enabled, the OPcache appends the current working ; directory to the script key, thus eliminating possible collisions between ; files with the same name (basename). Disabling the directive improves ; performance, but may break existing applications. ;opcache.use_cwd=1 ; When disabled, you must reset the OPcache manually or restart the ; webserver for changes to the filesystem to take effect. ;opcache.validate_timestamps=1 ; How often (in seconds) to check file timestamps for changes to the shared ; memory storage allocation. ("1" means validate once per second, but only ; once per request. "0" means always validate) ;opcache.revalidate_freq=2 ; Enables or disables file search in include_path optimization ;opcache.revalidate_path=0 ; If disabled, all PHPDoc comments are dropped from the code to reduce the ; size of the optimized code. ;opcache.save_comments=1 ; If enabled, compilation warnings (including notices and deprecations) will ; be recorded and replayed each time a file is included. Otherwise, compilation ; warnings will only be emitted when the file is first cached. ;opcache.record_warnings=0 ; Allow file existence override (file_exists, etc.) performance feature. ;opcache.enable_file_override=0 ; A bitmask, where each bit enables or disables the appropriate OPcache ; passes ;opcache.optimization_level=0x7FFFBFFF ;opcache.dups_fix=0 ; The location of the OPcache blacklist file (wildcards allowed). ; Each OPcache blacklist file is a text file that holds the names of files ; that should not be accelerated. The file format is to add each filename ; to a new line. The filename may be a full path or just a file prefix ; (i.e., /var/www/x blacklists all the files and directories in /var/www ; that start with 'x'). Line starting with a ; are ignored (comments). ;opcache.blacklist_filename= ; Allows exclusion of large files from being cached. By default all files ; are cached. ;opcache.max_file_size=0 ; Check the cache checksum each N requests. ; The default value of "0" means that the checks are disabled. ;opcache.consistency_checks=0 ; How long to wait (in seconds) for a scheduled restart to begin if the cache ; is not being accessed. ;opcache.force_restart_timeout=180 ; OPcache error_log file name. Empty string assumes "stderr". ;opcache.error_log= ; All OPcache errors go to the Web server log. ; By default, only fatal errors (level 0) or errors (level 1) are logged. ; You can also enable warnings (level 2), info messages (level 3) or ; debug messages (level 4). ;opcache.log_verbosity_level=1 ; Preferred Shared Memory back-end. Leave empty and let the system decide. ;opcache.preferred_memory_model= ; Protect the shared memory from unexpected writing during script execution. ; Useful for internal debugging only. ;opcache.protect_memory=0 ; Allows calling OPcache API functions only from PHP scripts which path is ; started from specified string. The default "" means no restriction ;opcache.restrict_api= ; Mapping base of shared memory segments (for Windows only). All the PHP ; processes have to map shared memory into the same address space. This ; directive allows to manually fix the "Unable to reattach to base address" ; errors. ;opcache.mmap_base= ; Facilitates multiple OPcache instances per user (for Windows only). All PHP ; processes with the same cache ID and user share an OPcache instance. ;opcache.cache_id= ; Enables and sets the second level cache directory. ; It should improve performance when SHM memory is full, at server restart or ; SHM reset. The default "" disables file based caching. ;opcache.file_cache= ; Enables or disables opcode caching in shared memory. ;opcache.file_cache_only=0 ; Enables or disables checksum validation when script loaded from file cache. ;opcache.file_cache_consistency_checks=1 ; Implies opcache.file_cache_only=1 for a certain process that failed to ; reattach to the shared memory (for Windows only). Explicitly enabled file ; cache is required. ;opcache.file_cache_fallback=1 ; Enables or disables copying of PHP code (text segment) into HUGE PAGES. ; This should improve performance, but requires appropriate OS configuration. ;opcache.huge_code_pages=0 ; Validate cached file permissions. ;opcache.validate_permission=0 ; Prevent name collisions in chroot'ed environment. ;opcache.validate_root=0 ; If specified, it produces opcode dumps for debugging different stages of ; optimizations. ;opcache.opt_debug_level=0 ; Specifies a PHP script that is going to be compiled and executed at server ; start-up. ; https://php.net/opcache.preload ;opcache.preload= ; Preloading code as root is not allowed for security reasons. This directive ; facilitates to let the preloading to be run as another user. ; https://php.net/opcache.preload_user ;opcache.preload_user= ; Prevents caching files that are less than this number of seconds old. It ; protects from caching of incompletely updated files. In case all file updates ; on your site are atomic, you may increase performance by setting it to "0". ;opcache.file_update_protection=2 ; Absolute path used to store shared lockfiles (for *nix only). ;opcache.lockfile_path=/tmp [curl] ; A default value for the CURLOPT_CAINFO option. This is required to be an ; absolute path. ;curl.cainfo = [openssl] ; The location of a Certificate Authority (CA) file on the local filesystem ; to use when verifying the identity of SSL/TLS peers. Most users should ; not specify a value for this directive as PHP will attempt to use the ; OS-managed cert stores in its absence. If specified, this value may still ; be overridden on a per-stream basis via the "cafile" SSL stream context ; option. ;openssl.cafile= ; If openssl.cafile is not specified or if the CA file is not found, the ; directory pointed to by openssl.capath is searched for a suitable ; certificate. This value must be a correctly hashed certificate directory. ; Most users should not specify a value for this directive as PHP will ; attempt to use the OS-managed cert stores in its absence. If specified, ; this value may still be overridden on a per-stream basis via the "capath" ; SSL stream context option. ;openssl.capath= [ffi] ; FFI API restriction. Possible values: ; "preload" - enabled in CLI scripts and preloaded files (default) ; "false" - always disabled ; "true" - always enabled ;ffi.enable=preload ; List of headers files to preload, wildcard patterns allowed. ;ffi.preload= [Zend] zend_extension="/usr/local/ioncube/ioncube_loader_lin_8.2.so" ; fix for segfaults auto_globals_jit = Off cgi.fix_pathinfo = 1 mbstring.http_input = "pass" mbstring.http_output = "pass" mbstring.encoding_translation = 0 ; Enable Extensions extension=uploadprogress.so extension=imagick.so extension=redis.so ; APCu extension=apcu.so apc.enable_cli=1 apc.gc_ttl=300 apc.shm_segments=1 apc.shm_size=256M apc.slam_defense=0 apc.ttl=0 ; ================================================ FILE: aegir/conf/php/php83-cli.ini ================================================ [PHP] ;;;;;;;;;;;;;;;;;;; ; About php.ini ; ;;;;;;;;;;;;;;;;;;; ; PHP's initialization file, generally called php.ini, is responsible for ; configuring many of the aspects of PHP's behavior. ; PHP attempts to find and load this configuration from a number of locations. ; The following is a summary of its search order: ; 1. SAPI module specific location. ; 2. The PHPRC environment variable. ; 3. A number of predefined registry keys on Windows ; 4. Current working directory (except CLI) ; 5. The web server's directory (for SAPI modules), or directory of PHP ; (otherwise in Windows) ; 6. The directory from the --with-config-file-path compile time option, or the ; Windows directory (usually C:\windows) ; See the PHP docs for more specific information. ; https://php.net/configuration.file ; The syntax of the file is extremely simple. Whitespace and lines ; beginning with a semicolon are silently ignored (as you probably guessed). ; Section headers (e.g. [Foo]) are also silently ignored, even though ; they might mean something in the future. ; Directives following the section heading [PATH=/www/mysite] only ; apply to PHP files in the /www/mysite directory. Directives ; following the section heading [HOST=www.example.com] only apply to ; PHP files served from www.example.com. Directives set in these ; special sections cannot be overridden by user-defined INI files or ; at runtime. Currently, [PATH=] and [HOST=] sections only work under ; CGI/FastCGI. ; https://php.net/ini.sections ; Directives are specified using the following syntax: ; directive = value ; Directive names are *case sensitive* - foo=bar is different from FOO=bar. ; Directives are variables used to configure PHP or PHP extensions. ; There is no name validation. If PHP can't find an expected ; directive because it is not set or is mistyped, a default value will be used. ; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one ; of the INI constants (On, Off, True, False, Yes, No and None) or an expression ; (e.g. E_ALL & ~E_NOTICE), a quoted string ("bar"), or a reference to a ; previously set variable or directive (e.g. ${foo}) ; Expressions in the INI file are limited to bitwise operators and parentheses: ; | bitwise OR ; ^ bitwise XOR ; & bitwise AND ; ~ bitwise NOT ; ! boolean NOT ; Boolean flags can be turned on using the values 1, On, True or Yes. ; They can be turned off using the values 0, Off, False or No. ; An empty string can be denoted by simply not writing anything after the equal ; sign, or by using the None keyword: ; foo = ; sets foo to an empty string ; foo = None ; sets foo to an empty string ; foo = "None" ; sets foo to the string 'None' ; If you use constants in your value, and these constants belong to a ; dynamically loaded extension (either a PHP extension or a Zend extension), ; you may only use these constants *after* the line that loads the extension. ;;;;;;;;;;;;;;;;;;; ; About this file ; ;;;;;;;;;;;;;;;;;;; ; PHP comes packaged with two INI files. One that is recommended to be used ; in production environments and one that is recommended to be used in ; development environments. ; php.ini-production contains settings which hold security, performance and ; best practices at its core. But please be aware, these settings may break ; compatibility with older or less security-conscious applications. We ; recommending using the production ini in production and testing environments. ; php.ini-development is very similar to its production variant, except it is ; much more verbose when it comes to errors. We recommend using the ; development version only in development environments, as errors shown to ; application users can inadvertently leak otherwise secure information. ; This is the php.ini-production INI file. ;;;;;;;;;;;;;;;;;;; ; Quick Reference ; ;;;;;;;;;;;;;;;;;;; ; The following are all the settings which are different in either the production ; or development versions of the INIs with respect to PHP's default behavior. ; Please see the actual settings later in the document for more details as to why ; we recommend these changes in PHP's behavior. display_errors = Off ; Default Value: On ; Development Value: On ; Production Value: Off ; display_startup_errors ; Default Value: On ; Development Value: On ; Production Value: Off ; error_reporting ; Default Value: E_ALL ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; log_errors ; Default Value: Off ; Development Value: On ; Production Value: On ; max_input_time ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; output_buffering ; Default Value: Off ; Development Value: 4096 ; Production Value: 4096 ; register_argc_argv ; Default Value: On ; Development Value: Off ; Production Value: Off ; request_order ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; session.gc_divisor ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; session.sid_bits_per_character ; Default Value: 4 ; Development Value: 5 ; Production Value: 5 ; session.sid_length ; Default Value: 32 ; Development Value: 26 ; Production Value: 26 ; short_open_tag ; Default Value: On ; Development Value: Off ; Production Value: Off ; variables_order ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS" ; zend.assertions ; Default Value: 1 ; Development Value: 1 ; Production Value: -1 ; zend.exception_ignore_args ; Default Value: Off ; Development Value: Off ; Production Value: On ; zend.exception_string_param_max_len ; Default Value: 15 ; Development Value: 15 ; Production Value: 0 ;;;;;;;;;;;;;;;;;;;; ; php.ini Options ; ;;;;;;;;;;;;;;;;;;;; ; Name for user-defined php.ini (.htaccess) files. Default is ".user.ini" ;user_ini.filename = ".user.ini" ; To disable this feature set this option to an empty value user_ini.filename = ; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes) ;user_ini.cache_ttl = 300 ;;;;;;;;;;;;;;;;;;;; ; Language Options ; ;;;;;;;;;;;;;;;;;;;; ; Enable the PHP scripting language engine under Apache. ; https://php.net/engine engine = On ; This directive determines whether or not PHP will recognize code between ; tags as PHP source which should be processed as such. It is ; generally recommended that should be used and that this feature ; should be disabled, as enabling it may result in issues when generating XML ; documents, however this remains supported for backward compatibility reasons. ; Note that this directive does not control the would work. ; https://php.net/syntax-highlighting ;highlight.string = #DD0000 ;highlight.comment = #FF9900 ;highlight.keyword = #007700 ;highlight.default = #0000BB ;highlight.html = #000000 ; If enabled, the request will be allowed to complete even if the user aborts ; the request. Consider enabling it if executing long requests, which may end up ; being interrupted by the user or a browser timing out. PHP's default behavior ; is to disable this feature. ; https://php.net/ignore-user-abort ;ignore_user_abort = On ; Determines the size of the realpath cache to be used by PHP. This value should ; be increased on systems where PHP opens many files to reflect the quantity of ; the file operations performed. ; Note: if open_basedir is set, the cache is disabled ; https://php.net/realpath-cache-size realpath_cache_size=64M ; Duration of time, in seconds for which to cache realpath information for a given ; file or directory. For systems with rarely changing files, consider increasing this ; value. ; https://php.net/realpath-cache-ttl realpath_cache_ttl=5 ; Enables or disables the circular reference collector. ; https://php.net/zend.enable-gc zend.enable_gc = On ; If enabled, scripts may be written in encodings that are incompatible with ; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such ; encodings. To use this feature, mbstring extension must be enabled. ;zend.multibyte = Off ; Allows to set the default encoding for the scripts. This value will be used ; unless "declare(encoding=...)" directive appears at the top of the script. ; Only affects if zend.multibyte is set. ;zend.script_encoding = ; Allows to include or exclude arguments from stack traces generated for exceptions. ; In production, it is recommended to turn this setting on to prohibit the output ; of sensitive information in stack traces ; Default Value: Off ; Development Value: Off ; Production Value: On zend.exception_ignore_args = On ; Allows setting the maximum string length in an argument of a stringified stack trace ; to a value between 0 and 1000000. ; This has no effect when zend.exception_ignore_args is enabled. ; Default Value: 15 ; Development Value: 15 ; Production Value: 0 ; In production, it is recommended to set this to 0 to reduce the output ; of sensitive information in stack traces. zend.exception_string_param_max_len = 0 ;;;;;;;;;;;;;;;;; ; Miscellaneous ; ;;;;;;;;;;;;;;;;; ; Decides whether PHP may expose the fact that it is installed on the server ; (e.g. by adding its signature to the Web server header). It is no security ; threat in any way, but it makes it possible to determine whether you use PHP ; on your server or not. ; https://php.net/expose-php expose_php = On ;;;;;;;;;;;;;;;;;;; ; Resource Limits ; ;;;;;;;;;;;;;;;;;;; ; Maximum execution time of each script, in seconds ; https://php.net/max-execution-time ; Note: This directive is hardcoded to 0 for the CLI SAPI max_execution_time = 3600 ; Maximum amount of time each script may spend parsing request data. It's a good ; idea to limit this time on productions servers in order to eliminate unexpectedly ; long running scripts. ; Note: This directive is hardcoded to -1 for the CLI SAPI ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; https://php.net/max-input-time max_input_time = 3600 ; Maximum input variable nesting level ; https://php.net/max-input-nesting-level ;max_input_nesting_level = 64 ; How many GET/POST/COOKIE input variables may be accepted max_input_vars = 9999 ; How many multipart body parts (combined input variable and file uploads) may ; be accepted. ; Default Value: -1 (Sum of max_input_vars and max_file_uploads) ;max_multipart_body_parts = 1500 ; Maximum amount of memory a script may consume ; https://php.net/memory-limit memory_limit = 395M ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; Error handling and logging ; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; This directive informs PHP of which errors, warnings and notices you would like ; it to take action for. The recommended way of setting values for this ; directive is through the use of the error level constants and bitwise ; operators. The error level constants are below here for convenience as well as ; some common settings and their meanings. ; By default, PHP is set to take action on all errors, notices and warnings EXCEPT ; those related to E_NOTICE and E_STRICT, which together cover best practices and ; recommended coding standards in PHP. For performance reasons, this is the ; recommend error reporting setting. Your production server shouldn't be wasting ; resources complaining about best practices and coding standards. That's what ; development servers and development settings are for. ; Note: The php.ini-development file has this setting as E_ALL. This ; means it pretty much reports everything which is exactly what you want during ; development and early testing. ; ; Error Level Constants: ; E_ALL - All errors and warnings ; E_ERROR - fatal run-time errors ; E_RECOVERABLE_ERROR - almost fatal run-time errors ; E_WARNING - run-time warnings (non-fatal errors) ; E_PARSE - compile-time parse errors ; E_NOTICE - run-time notices (these are warnings which often result ; from a bug in your code, but it's possible that it was ; intentional (e.g., using an uninitialized variable and ; relying on the fact it is automatically initialized to an ; empty string) ; E_STRICT - run-time notices, enable to have PHP suggest changes ; to your code which will ensure the best interoperability ; and forward compatibility of your code ; E_CORE_ERROR - fatal errors that occur during PHP's initial startup ; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's ; initial startup ; E_COMPILE_ERROR - fatal compile-time errors ; E_COMPILE_WARNING - compile-time warnings (non-fatal errors) ; E_USER_ERROR - user-generated error message ; E_USER_WARNING - user-generated warning message ; E_USER_NOTICE - user-generated notice message ; E_DEPRECATED - warn about code that will not work in future versions ; of PHP ; E_USER_DEPRECATED - user-generated deprecation warnings ; ; Common Values: ; E_ALL (Show all errors, warnings and notices including coding standards.) ; E_ALL & ~E_NOTICE (Show all errors, except for notices) ; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.) ; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors) ; Default Value: E_ALL ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; https://php.net/error-reporting error_reporting = 1 ; This directive controls whether or not and where PHP will output errors, ; notices and warnings too. Error output is very useful during development, but ; it could be very dangerous in production environments. Depending on the code ; which is triggering the error, sensitive information could potentially leak ; out of your application such as database usernames and passwords or worse. ; For production environments, we recommend logging errors rather than ; sending them to STDOUT. ; Possible Values: ; Off = Do not display any errors ; stderr = Display errors to STDERR (affects only CGI/CLI binaries!) ; On or stdout = Display errors to STDOUT ; Default Value: On ; Development Value: On ; Production Value: Off ; https://php.net/display-errors display_errors = Off ; The display of errors which occur during PHP's startup sequence are handled ; separately from display_errors. We strongly recommend you set this to 'off' ; for production servers to avoid leaking configuration details. ; Default Value: On ; Development Value: On ; Production Value: Off ; https://php.net/display-startup-errors display_startup_errors = Off ; Besides displaying errors, PHP can also log errors to locations such as a ; server-specific log, STDERR, or a location specified by the error_log ; directive found below. While errors should not be displayed on productions ; servers they should still be monitored and logging is a great way to do that. ; Default Value: Off ; Development Value: On ; Production Value: On ; https://php.net/log-errors log_errors = On ; Do not log repeated messages. Repeated errors must occur in same file on same ; line unless ignore_repeated_source is set true. ; https://php.net/ignore-repeated-errors ignore_repeated_errors = Off ; Ignore source of message when ignoring repeated messages. When this setting ; is On you will not log errors with repeated messages from different files or ; source lines. ; https://php.net/ignore-repeated-source ignore_repeated_source = Off ; If this parameter is set to Off, then memory leaks will not be shown (on ; stdout or in the log). This is only effective in a debug compile, and if ; error reporting includes E_WARNING in the allowed list ; https://php.net/report-memleaks report_memleaks = On ; This setting is off by default. ;report_zend_debug = 0 ; Turn off normal error reporting and emit XML-RPC error XML ; https://php.net/xmlrpc-errors ;xmlrpc_errors = 0 ; An XML-RPC faultCode ;xmlrpc_error_number = 0 ; When PHP displays or logs an error, it has the capability of formatting the ; error message as HTML for easier reading. This directive controls whether ; the error message is formatted as HTML or not. ; Note: This directive is hardcoded to Off for the CLI SAPI ; https://php.net/html-errors html_errors = Off ; If html_errors is set to On *and* docref_root is not empty, then PHP ; produces clickable error messages that direct to a page describing the error ; or function causing the error in detail. ; You can download a copy of the PHP manual from https://php.net/docs ; and change docref_root to the base URL of your local copy including the ; leading '/'. You must also specify the file extension being used including ; the dot. PHP's default behavior is to leave these settings empty, in which ; case no links to documentation are generated. ; Note: Never use this feature for production boxes. ; https://php.net/docref-root ; Examples ;docref_root = "/phpmanual/" ; https://php.net/docref-ext ;docref_ext = .html ; String to output before an error message. PHP's default behavior is to leave ; this setting blank. ; https://php.net/error-prepend-string ; Example: ;error_prepend_string = "" ; String to output after an error message. PHP's default behavior is to leave ; this setting blank. ; https://php.net/error-append-string ; Example: ;error_append_string = "" ; Log errors to specified file. PHP's default behavior is to leave this value ; empty. ; https://php.net/error-log ; Example: ;error_log = php_errors.log ; Log errors to syslog (Event Log on Windows). ;error_log = syslog error_log = /var/log/php/error_log_cli_83 ; The syslog ident is a string which is prepended to every message logged ; to syslog. Only used when error_log is set to syslog. ;syslog.ident = php ; The syslog facility is used to specify what type of program is logging ; the message. Only used when error_log is set to syslog. ;syslog.facility = user ; Set this to disable filtering control characters (the default). ; Some loggers only accept NVT-ASCII, others accept anything that's not ; control characters. If your logger accepts everything, then no filtering ; is needed at all. ; Allowed values are: ; ascii (all printable ASCII characters and NL) ; no-ctrl (all characters except control characters) ; all (all characters) ; raw (like "all", but messages are not split at newlines) ; https://php.net/syslog.filter ;syslog.filter = ascii ;windows.show_crt_warning ; Default value: 0 ; Development value: 0 ; Production value: 0 ;;;;;;;;;;;;;;;;; ; Data Handling ; ;;;;;;;;;;;;;;;;; ; The separator used in PHP generated URLs to separate arguments. ; PHP's default setting is "&". ; https://php.net/arg-separator.output ; Example: ;arg_separator.output = "&" ; List of separator(s) used by PHP to parse input URLs into variables. ; PHP's default setting is "&". ; NOTE: Every character in this directive is considered as separator! ; https://php.net/arg-separator.input ; Example: ;arg_separator.input = ";&" ; This directive determines which super global arrays are registered when PHP ; starts up. G,P,C,E & S are abbreviations for the following respective super ; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty ; paid for the registration of these arrays and because ENV is not as commonly ; used as the others, ENV is not recommended on productions servers. You ; can still get access to the environment variables through getenv() should you ; need to. ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS"; ; https://php.net/variables-order variables_order = "GPCS" ; This directive determines which super global data (G,P & C) should be ; registered into the super global array REQUEST. If so, it also determines ; the order in which that data is registered. The values for this directive ; are specified in the same manner as the variables_order directive, ; EXCEPT one. Leaving this value empty will cause PHP to use the value set ; in the variables_order directive. It does not mean it will leave the super ; globals array REQUEST empty. ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; https://php.net/request-order request_order = "GP" ; This directive determines whether PHP registers $argv & $argc each time it ; runs. $argv contains an array of all the arguments passed to PHP when a script ; is invoked. $argc contains an integer representing the number of arguments ; that were passed when the script was invoked. These arrays are extremely ; useful when running scripts from the command line. When this directive is ; enabled, registering these variables consumes CPU cycles and memory each time ; a script is executed. For performance reasons, this feature should be disabled ; on production servers. ; Note: This directive is hardcoded to On for the CLI SAPI ; Default Value: On ; Development Value: Off ; Production Value: Off ; https://php.net/register-argc-argv register_argc_argv = Off ; When enabled, the ENV, REQUEST and SERVER variables are created when they're ; first used (Just In Time) instead of when the script starts. If these ; variables are not used within a script, having this directive on will result ; in a performance gain. The PHP directive register_argc_argv must be disabled ; for this directive to have any effect. ; https://php.net/auto-globals-jit auto_globals_jit = On ; Whether PHP will read the POST data. ; This option is enabled by default. ; Most likely, you won't want to disable this option globally. It causes $_POST ; and $_FILES to always be empty; the only way you will be able to read the ; POST data will be through the php://input stream wrapper. This can be useful ; to proxy requests or to process the POST data in a memory efficient fashion. ; https://php.net/enable-post-data-reading ;enable_post_data_reading = Off ; Maximum size of POST data that PHP will accept. ; Its value may be 0 to disable the limit. It is ignored if POST data reading ; is disabled through enable_post_data_reading. ; https://php.net/post-max-size post_max_size = 350M ; Automatically add files before PHP document. ; https://php.net/auto-prepend-file auto_prepend_file = ; Automatically add files after PHP document. ; https://php.net/auto-append-file auto_append_file = ; By default, PHP will output a media type using the Content-Type header. To ; disable this, simply set it to be empty. ; ; PHP's built-in default media type is set to text/html. ; https://php.net/default-mimetype default_mimetype = "text/html" ; PHP's default character set is set to UTF-8. ; https://php.net/default-charset default_charset = "UTF-8" ; PHP internal character encoding is set to empty. ; If empty, default_charset is used. ; https://php.net/internal-encoding ;internal_encoding = ; PHP input character encoding is set to empty. ; If empty, default_charset is used. ; https://php.net/input-encoding ;input_encoding = ; PHP output character encoding is set to empty. ; If empty, default_charset is used. ; See also output_buffer. ; https://php.net/output-encoding ;output_encoding = ;;;;;;;;;;;;;;;;;;;;;;;;; ; Paths and Directories ; ;;;;;;;;;;;;;;;;;;;;;;;;; ; UNIX: "/path1:/path2" ;include_path = ".:/php/includes" ; ; Windows: "\path1;\path2" ;include_path = ".;c:\php\includes" ; ; PHP's default setting for include_path is ".;/path/to/php/pear" ; https://php.net/include-path include_path = ".:/opt/php83/lib/php" ; The root of the PHP pages, used only if nonempty. ; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root ; if you are running php as a CGI under any web server (other than IIS) ; see documentation for security issues. The alternate is to use the ; cgi.force_redirect configuration below ; https://php.net/doc-root doc_root = ; The directory under which PHP opens the script using /~username used only ; if nonempty. ; https://php.net/user-dir user_dir = ; Directory in which the loadable extensions (modules) reside. ; https://php.net/extension-dir ;extension_dir = "./" ; On windows: ;extension_dir = "ext" extension_dir = "/opt/php83/lib/php/extensions/no-debug-non-zts-20230831/" ; Directory where the temporary files should be placed. ; Defaults to the system default (see sys_get_temp_dir) sys_temp_dir = "/tmp" ; Whether or not to enable the dl() function. The dl() function does NOT work ; properly in multithreaded servers, such as IIS or Zeus, and is automatically ; disabled on them. ; https://php.net/enable-dl enable_dl = Off ; cgi.force_redirect is necessary to provide security running PHP as a CGI under ; most web servers. Left undefined, PHP turns this on by default. You can ; turn it off here AT YOUR OWN RISK ; **You CAN safely turn this off for IIS, in fact, you MUST.** ; https://php.net/cgi.force-redirect ;cgi.force_redirect = 1 ; if cgi.nph is enabled it will force cgi to always sent Status: 200 with ; every request. PHP's default behavior is to disable this feature. ;cgi.nph = 1 ; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape ; (iPlanet) web servers, you MAY need to set an environment variable name that PHP ; will look for to know it is OK to continue execution. Setting this variable MAY ; cause security issues, KNOW WHAT YOU ARE DOING FIRST. ; https://php.net/cgi.redirect-status-env ;cgi.redirect_status_env = ; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's ; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok ; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting ; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting ; of zero causes PHP to behave as before. Default is 1. You should fix your scripts ; to use SCRIPT_FILENAME rather than PATH_TRANSLATED. ; https://php.net/cgi.fix-pathinfo ;cgi.fix_pathinfo=1 ; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside ; of the web tree and people will not be able to circumvent .htaccess security. ;cgi.discard_path=1 ; FastCGI under IIS supports the ability to impersonate ; security tokens of the calling client. This allows IIS to define the ; security context that the request runs under. mod_fastcgi under Apache ; does not currently support this feature (03/17/2002) ; Set to 1 if running under IIS. Default is zero. ; https://php.net/fastcgi.impersonate ;fastcgi.impersonate = 1 ; Disable logging through FastCGI connection. PHP's default behavior is to enable ; this feature. ;fastcgi.logging = 0 ; cgi.rfc2616_headers configuration option tells PHP what type of headers to ; use when sending HTTP response code. If set to 0, PHP sends Status: header that ; is supported by Apache. When this option is set to 1, PHP will send ; RFC2616 compliant header. ; Default is zero. ; https://php.net/cgi.rfc2616-headers ;cgi.rfc2616_headers = 0 ; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #! ; (shebang) at the top of the running script. This line might be needed if the ; script support running both as stand-alone script and via PHP CGI<. PHP in CGI ; mode skips this line and ignores its content if this directive is turned on. ; https://php.net/cgi.check-shebang-line ;cgi.check_shebang_line=1 ;;;;;;;;;;;;;;;; ; File Uploads ; ;;;;;;;;;;;;;;;; ; Whether to allow HTTP file uploads. ; https://php.net/file-uploads file_uploads = On ; Temporary directory for HTTP uploaded files (will use system default if not ; specified). ; https://php.net/upload-tmp-dir upload_tmp_dir = /tmp ; Maximum allowed size for uploaded files. ; https://php.net/upload-max-filesize upload_max_filesize = 325M ; Maximum number of files that can be uploaded via a single request max_file_uploads = 50 ;;;;;;;;;;;;;;;;;; ; Fopen wrappers ; ;;;;;;;;;;;;;;;;;; ; Whether to allow the treatment of URLs (like http:// or ftp://) as files. ; https://php.net/allow-url-fopen allow_url_fopen = On ; Whether to allow include/require to open URLs (like https:// or ftp://) as files. ; https://php.net/allow-url-include allow_url_include = Off ; Define the anonymous ftp password (your email address). PHP's default setting ; for this is empty. ; https://php.net/from ;from="john@doe.com" ; Define the User-Agent string. PHP's default setting for this is empty. ; https://php.net/user-agent ;user_agent="PHP" ; Default timeout for socket based streams (seconds) ; https://php.net/default-socket-timeout default_socket_timeout = 3600 ; If your scripts have to deal with files from Macintosh systems, ; or you are running on a Mac and need to deal with files from ; unix or win32 systems, setting this flag will cause PHP to ; automatically detect the EOL character in those files so that ; fgets() and file() will work regardless of the source of the file. ; https://php.net/auto-detect-line-endings auto_detect_line_endings = On ;;;;;;;;;;;;;;;;;;;;;; ; Dynamic Extensions ; ;;;;;;;;;;;;;;;;;;;;;; ; If you wish to have an extension loaded automatically, use the following ; syntax: ; ; extension=modulename ; ; For example: ; ; extension=mysqli ; ; When the extension library to load is not located in the default extension ; directory, You may specify an absolute path to the library file: ; ; extension=/path/to/extension/mysqli.so ; ; Note : The syntax used in previous PHP versions ('extension=.so' and ; 'extension='php_.dll') is supported for legacy reasons and may be ; deprecated in a future PHP major version. So, when it is possible, please ; move to the new ('extension=) syntax. ; ; Notes for Windows environments : ; ; - Many DLL files are located in the ext/ ; extension folders as well as the separate PECL DLL download. ; Be sure to appropriately set the extension_dir directive. ; ;extension=bz2 ; The ldap extension must be before curl if OpenSSL 1.0.2 and OpenLDAP is used ; otherwise it results in segfault when unloading after using SASL. ; See https://github.com/php/php-src/issues/8620 for more info. ;extension=ldap ;extension=curl ;extension=ffi ;extension=ftp ;extension=fileinfo ;extension=gd ;extension=gettext ;extension=gmp ;extension=intl ;extension=imap ;extension=mbstring ;extension=exif ; Must be after mbstring as it depends on it ;extension=mysqli ;extension=oci8_12c ; Use with Oracle Database 12c Instant Client ;extension=oci8_19 ; Use with Oracle Database 19 Instant Client ;extension=odbc ;extension=openssl ;extension=pdo_firebird ;extension=pdo_mysql ;extension=pdo_oci ;extension=pdo_odbc ;extension=pdo_pgsql ;extension=pdo_sqlite ;extension=pgsql ;extension=shmop ; The MIBS data available in the PHP distribution must be installed. ; See https://www.php.net/manual/en/snmp.installation.php ;extension=snmp ;extension=soap ;extension=sockets ;extension=sodium ;extension=sqlite3 ;extension=tidy ;extension=xsl ;extension=zip ;zend_extension=opcache ;;;;;;;;;;;;;;;;;;; ; Module Settings ; ;;;;;;;;;;;;;;;;;;; [CLI Server] ; Whether the CLI web server uses ANSI color coding in its terminal output. cli_server.color = On [Date] ; Defines the default timezone used by the date functions ; https://php.net/date.timezone date.timezone = "UTC" ; https://php.net/date.default-latitude ;date.default_latitude = 31.7667 ; https://php.net/date.default-longitude ;date.default_longitude = 35.2333 ; https://php.net/date.sunrise-zenith ;date.sunrise_zenith = 90.833333 ; https://php.net/date.sunset-zenith ;date.sunset_zenith = 90.833333 [filter] ; https://php.net/filter.default ;filter.default = unsafe_raw ; https://php.net/filter.default-flags ;filter.default_flags = [iconv] ; Use of this INI entry is deprecated, use global input_encoding instead. ; If empty, default_charset or input_encoding or iconv.input_encoding is used. ; The precedence is: default_charset < input_encoding < iconv.input_encoding ;iconv.input_encoding = ; Use of this INI entry is deprecated, use global internal_encoding instead. ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;iconv.internal_encoding = ; Use of this INI entry is deprecated, use global output_encoding instead. ; If empty, default_charset or output_encoding or iconv.output_encoding is used. ; The precedence is: default_charset < output_encoding < iconv.output_encoding ; To use an output encoding conversion, iconv's output handler must be set ; otherwise output encoding conversion cannot be performed. ;iconv.output_encoding = [imap] ; rsh/ssh logins are disabled by default. Use this INI entry if you want to ; enable them. Note that the IMAP library does not filter mailbox names before ; passing them to rsh/ssh command, thus passing untrusted data to this function ; with rsh/ssh enabled is insecure. ;imap.enable_insecure_rsh=0 [intl] ;intl.default_locale = ; This directive allows you to produce PHP errors when some error ; happens within intl functions. The value is the level of the error produced. ; Default is 0, which does not produce any errors. ;intl.error_level = E_WARNING ;intl.use_exceptions = 0 [sqlite3] ; Directory pointing to SQLite3 extensions ; https://php.net/sqlite3.extension-dir ;sqlite3.extension_dir = ; SQLite defensive mode flag (only available from SQLite 3.26+) ; When the defensive flag is enabled, language features that allow ordinary ; SQL to deliberately corrupt the database file are disabled. This forbids ; writing directly to the schema, shadow tables (eg. FTS data tables), or ; the sqlite_dbpage virtual table. ; https://www.sqlite.org/c3ref/c_dbconfig_defensive.html ; (for older SQLite versions, this flag has no use) ;sqlite3.defensive = 1 [Pcre] ; PCRE library backtracking limit. ; https://php.net/pcre.backtrack-limit ;pcre.backtrack_limit=100000 ; PCRE library recursion limit. ; Please note that if you set this value to a high number you may consume all ; the available process stack and eventually crash PHP (due to reaching the ; stack size limit imposed by the Operating System). ; https://php.net/pcre.recursion-limit ;pcre.recursion_limit=100000 ; Enables or disables JIT compilation of patterns. This requires the PCRE ; library to be compiled with JIT support. ;pcre.jit=1 [Pdo] ; Whether to pool ODBC connections. Can be one of "strict", "relaxed" or "off" ; https://php.net/pdo-odbc.connection-pooling ;pdo_odbc.connection_pooling=strict [Pdo_mysql] ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. pdo_mysql.default_socket= [Phar] ; https://php.net/phar.readonly ;phar.readonly = On ; https://php.net/phar.require-hash ;phar.require_hash = On ;phar.cache_list = [mail function] ; For Win32 only. ; https://php.net/smtp ;SMTP = localhost ; https://php.net/smtp-port ;smtp_port = 25 ; For Win32 only. ; https://php.net/sendmail-from ;sendmail_from = me@example.com ; For Unix only. You may supply arguments as well (default: "sendmail -t -i"). ; https://php.net/sendmail-path sendmail_path = /usr/sbin/sendmail -t -i ; Force the addition of the specified parameters to be passed as extra parameters ; to the sendmail binary. These parameters will always replace the value of ; the 5th parameter to mail(). ;mail.force_extra_parameters = ; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename mail.add_x_header = Off ; Use mixed LF and CRLF line separators to keep compatibility with some ; RFC 2822 non conformant MTA. mail.mixed_lf_and_crlf = Off ; The path to a log file that will log all mail() calls. Log entries include ; the full path of the script, line number, To address and headers. ;mail.log = ; Log mail to syslog (Event Log on Windows). ;mail.log = syslog [ODBC] ; https://php.net/odbc.default-db ;odbc.default_db = Not yet implemented ; https://php.net/odbc.default-user ;odbc.default_user = Not yet implemented ; https://php.net/odbc.default-pw ;odbc.default_pw = Not yet implemented ; Controls the ODBC cursor model. ; Default: SQL_CURSOR_STATIC (default). ;odbc.default_cursortype ; Allow or prevent persistent links. ; https://php.net/odbc.allow-persistent odbc.allow_persistent = On ; Check that a connection is still valid before reuse. ; https://php.net/odbc.check-persistent odbc.check_persistent = On ; Maximum number of persistent links. -1 means no limit. ; https://php.net/odbc.max-persistent odbc.max_persistent = -1 ; Maximum number of links (persistent + non-persistent). -1 means no limit. ; https://php.net/odbc.max-links odbc.max_links = -1 ; Handling of LONG fields. Returns number of bytes to variables. 0 means ; passthru. ; https://php.net/odbc.defaultlrl odbc.defaultlrl = 4096 ; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char. ; See the documentation on odbc_binmode and odbc_longreadlen for an explanation ; of odbc.defaultlrl and odbc.defaultbinmode ; https://php.net/odbc.defaultbinmode odbc.defaultbinmode = 1 [MySQLi] ; Maximum number of persistent links. -1 means no limit. ; https://php.net/mysqli.max-persistent mysqli.max_persistent = -1 ; Allow accessing, from PHP's perspective, local files with LOAD DATA statements ; https://php.net/mysqli.allow_local_infile ;mysqli.allow_local_infile = On ; It allows the user to specify a folder where files that can be sent via LOAD DATA ; LOCAL can exist. It is ignored if mysqli.allow_local_infile is enabled. ;mysqli.local_infile_directory = ; Allow or prevent persistent links. ; https://php.net/mysqli.allow-persistent mysqli.allow_persistent = On ; Maximum number of links. -1 means no limit. ; https://php.net/mysqli.max-links mysqli.max_links = -1 ; Default port number for mysqli_connect(). If unset, mysqli_connect() will use ; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the ; compile-time value defined MYSQL_PORT (in that order). Win32 will only look ; at MYSQL_PORT. ; https://php.net/mysqli.default-port mysqli.default_port = 3306 ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. ; https://php.net/mysqli.default-socket mysqli.default_socket = ; Default host for mysqli_connect() (doesn't apply in safe mode). ; https://php.net/mysqli.default-host mysqli.default_host = ; Default user for mysqli_connect() (doesn't apply in safe mode). ; https://php.net/mysqli.default-user mysqli.default_user = ; Default password for mysqli_connect() (doesn't apply in safe mode). ; Note that this is generally a *bad* idea to store passwords in this file. ; *Any* user with PHP access can run 'echo get_cfg_var("mysqli.default_pw") ; and reveal this password! And of course, any users with read access to this ; file will be able to reveal the password as well. ; https://php.net/mysqli.default-pw mysqli.default_pw = ; If this option is enabled, closing a persistent connection will rollback ; any pending transactions of this connection, before it is put back ; into the persistent connection pool. ;mysqli.rollback_on_cached_plink = Off [mysqlnd] ; Enable / Disable collection of general statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. mysqlnd.collect_statistics = 0 ; Enable / Disable collection of memory usage statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. mysqlnd.collect_memory_statistics = 0 ; Records communication from all extensions using mysqlnd to the specified log ; file. ; https://php.net/mysqlnd.debug ;mysqlnd.debug = ; Defines which queries will be logged. ;mysqlnd.log_mask = 0 ; Default size of the mysqlnd memory pool, which is used by result sets. mysqlnd.mempool_default_size = 64000 ; Size of a pre-allocated buffer used when sending commands to MySQL in bytes. mysqlnd.net_cmd_buffer_size = 8192 ; Size of a pre-allocated buffer used for reading data sent by the server in ; bytes. mysqlnd.net_read_buffer_size = 131072 ; Timeout for network requests in seconds. ;mysqlnd.net_read_timeout = 31536000 ; SHA-256 Authentication Plugin related. File with the MySQL server public RSA ; key. ;mysqlnd.sha256_server_public_key = [OCI8] ; Connection: Enables privileged connections using external ; credentials (OCI_SYSOPER, OCI_SYSDBA) ; https://php.net/oci8.privileged-connect ;oci8.privileged_connect = Off ; Connection: The maximum number of persistent OCI8 connections per ; process. Using -1 means no limit. ; https://php.net/oci8.max-persistent ;oci8.max_persistent = -1 ; Connection: The maximum number of seconds a process is allowed to ; maintain an idle persistent connection. Using -1 means idle ; persistent connections will be maintained forever. ; https://php.net/oci8.persistent-timeout ;oci8.persistent_timeout = -1 ; Connection: The number of seconds that must pass before issuing a ; ping during oci_pconnect() to check the connection validity. When ; set to 0, each oci_pconnect() will cause a ping. Using -1 disables ; pings completely. ; https://php.net/oci8.ping-interval ;oci8.ping_interval = 60 ; Connection: Set this to a user chosen connection class to be used ; for all pooled server requests with Oracle Database Resident ; Connection Pooling (DRCP). To use DRCP, this value should be set to ; the same string for all web servers running the same application, ; the database pool must be configured, and the connection string must ; specify to use a pooled server. ;oci8.connection_class = ; High Availability: Using On lets PHP receive Fast Application ; Notification (FAN) events generated when a database node fails. The ; database must also be configured to post FAN events. ;oci8.events = Off ; Tuning: This option enables statement caching, and specifies how ; many statements to cache. Using 0 disables statement caching. ; https://php.net/oci8.statement-cache-size ;oci8.statement_cache_size = 20 ; Tuning: Enables row prefetching and sets the default number of ; rows that will be fetched automatically after statement execution. ; https://php.net/oci8.default-prefetch ;oci8.default_prefetch = 100 ; Tuning: Sets the amount of LOB data that is internally returned from ; Oracle Database when an Oracle LOB locator is initially retrieved as ; part of a query. Setting this can improve performance by reducing ; round-trips. ; https://php.net/oci8.prefetch-lob-size ; oci8.prefetch_lob_size = 0 ; Compatibility. Using On means oci_close() will not close ; oci_connect() and oci_new_connect() connections. ; https://php.net/oci8.old-oci-close-semantics ;oci8.old_oci_close_semantics = Off [PostgreSQL] ; Allow or prevent persistent links. ; https://php.net/pgsql.allow-persistent pgsql.allow_persistent = On ; Detect broken persistent links always with pg_pconnect(). ; Auto reset feature requires a little overheads. ; https://php.net/pgsql.auto-reset-persistent pgsql.auto_reset_persistent = Off ; Maximum number of persistent links. -1 means no limit. ; https://php.net/pgsql.max-persistent pgsql.max_persistent = -1 ; Maximum number of links (persistent+non persistent). -1 means no limit. ; https://php.net/pgsql.max-links pgsql.max_links = -1 ; Ignore PostgreSQL backends Notice message or not. ; Notice message logging require a little overheads. ; https://php.net/pgsql.ignore-notice pgsql.ignore_notice = 0 ; Log PostgreSQL backends Notice message or not. ; Unless pgsql.ignore_notice=0, module cannot log notice message. ; https://php.net/pgsql.log-notice pgsql.log_notice = 0 [bcmath] ; Number of decimal digits for all bcmath functions. ; https://php.net/bcmath.scale bcmath.scale = 0 [browscap] ; https://php.net/browscap ;browscap = extra/browscap.ini [Session] ; Handler used to store/retrieve data. ; https://php.net/session.save-handler session.save_handler = files ; Argument passed to save_handler. In the case of files, this is the path ; where data files are stored. Note: Windows users have to change this ; variable in order to use PHP's session functions. ; ; The path can be defined as: ; ; session.save_path = "N;/path" ; ; where N is an integer. Instead of storing all the session files in ; /path, what this will do is use subdirectories N-levels deep, and ; store the session data in those directories. This is useful if ; your OS has problems with many files in one directory, and is ; a more efficient layout for servers that handle many sessions. ; ; NOTE 1: PHP will not create this directory structure automatically. ; You can use the script in the ext/session dir for that purpose. ; NOTE 2: See the section on garbage collection below if you choose to ; use subdirectories for session storage ; ; The file storage module creates files using mode 600 by default. ; You can change that by using ; ; session.save_path = "N;MODE;/path" ; ; where MODE is the octal representation of the mode. Note that this ; does not overwrite the process's umask. ; https://php.net/session.save-path session.save_path = "/opt/tmp" ; Whether to use strict session mode. ; Strict session mode does not accept an uninitialized session ID, and ; regenerates the session ID if the browser sends an uninitialized session ID. ; Strict mode protects applications from session fixation via a session adoption ; vulnerability. It is disabled by default for maximum compatibility, but ; enabling it is encouraged. ; https://wiki.php.net/rfc/strict_sessions session.use_strict_mode = 0 ; Whether to use cookies. ; https://php.net/session.use-cookies session.use_cookies = 1 ; https://php.net/session.cookie-secure ;session.cookie_secure = ; This option forces PHP to fetch and use a cookie for storing and maintaining ; the session id. We encourage this operation as it's very helpful in combating ; session hijacking when not specifying and managing your own session id. It is ; not the be-all and end-all of session hijacking defense, but it's a good start. ; https://php.net/session.use-only-cookies session.use_only_cookies = 1 ; Name of the session (used as cookie name). ; https://php.net/session.name session.name = PHPSESSID ; Initialize session on request startup. ; https://php.net/session.auto-start session.auto_start = 0 ; Lifetime in seconds of cookie or, if 0, until browser is restarted. ; https://php.net/session.cookie-lifetime session.cookie_lifetime = 0 ; The path for which the cookie is valid. ; https://php.net/session.cookie-path session.cookie_path = / ; The domain for which the cookie is valid. ; https://php.net/session.cookie-domain session.cookie_domain = ; Whether or not to add the httpOnly flag to the cookie, which makes it ; inaccessible to browser scripting languages such as JavaScript. ; https://php.net/session.cookie-httponly session.cookie_httponly = 1 ; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF) ; Current valid values are "Strict", "Lax" or "None". When using "None", ; make sure to include the quotes, as `none` is interpreted like `false` in ini files. ; https://tools.ietf.org/html/draft-west-first-party-cookies-07 session.cookie_samesite = ; Handler used to serialize data. php is the standard serializer of PHP. ; https://php.net/session.serialize-handler session.serialize_handler = php ; Defines the probability that the 'garbage collection' process is started on every ; session initialization. The probability is calculated by using gc_probability/gc_divisor, ; e.g. 1/100 means there is a 1% chance that the GC process starts on each request. ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; https://php.net/session.gc-probability session.gc_probability = 1 ; Defines the probability that the 'garbage collection' process is started on every ; session initialization. The probability is calculated by using gc_probability/gc_divisor, ; e.g. 1/100 means there is a 1% chance that the GC process starts on each request. ; For high volume production servers, using a value of 1000 is a more efficient approach. ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; https://php.net/session.gc-divisor session.gc_divisor = 1000 ; After this number of seconds, stored data will be seen as 'garbage' and ; cleaned up by the garbage collection process. ; https://php.net/session.gc-maxlifetime session.gc_maxlifetime = 1440 ; NOTE: If you are using the subdirectory option for storing session files ; (see session.save_path above), then garbage collection does *not* ; happen automatically. You will need to do your own garbage ; collection through a shell script, cron entry, or some other method. ; For example, the following script is the equivalent of setting ; session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes): ; find /path/to/sessions -cmin +24 -type f | xargs rm ; Check HTTP Referer to invalidate externally stored URLs containing ids. ; HTTP_REFERER has to contain this substring for the session to be ; considered as valid. ; https://php.net/session.referer-check session.referer_check = ; Set to {nocache,private,public,} to determine HTTP caching aspects ; or leave this empty to avoid sending anti-caching headers. ; https://php.net/session.cache-limiter session.cache_limiter = nocache ; Document expires after n minutes. ; https://php.net/session.cache-expire session.cache_expire = 180 ; trans sid support is disabled by default. ; Use of trans sid may risk your users' security. ; Use this option with caution. ; - User may send URL contains active session ID ; to other person via. email/irc/etc. ; - URL that contains active session ID may be stored ; in publicly accessible computer. ; - User may access your site with the same session ID ; always using URL stored in browser's history or bookmarks. ; https://php.net/session.use-trans-sid session.use_trans_sid = 0 ; Set session ID character length. This value could be between 22 to 256. ; Shorter length than default is supported only for compatibility reason. ; Users should use 32 or more chars. ; https://php.net/session.sid-length ; Default Value: 32 ; Development Value: 26 ; Production Value: 26 session.sid_length = 26 ; The URL rewriter will look for URLs in a defined set of HTML tags. ; is special; if you include them here, the rewriter will ; add a hidden field with the info which is otherwise appended ; to URLs. tag's action attribute URL will not be modified ; unless it is specified. ; Note that all valid entries require a "=", even if no value follows. ; Default Value: "a=href,area=href,frame=src,form=" ; Development Value: "a=href,area=href,frame=src,form=" ; Production Value: "a=href,area=href,frame=src,form=" ; https://php.net/url-rewriter.tags session.trans_sid_tags = "a=href,area=href,frame=src,form=" ; URL rewriter does not rewrite absolute URLs by default. ; To enable rewrites for absolute paths, target hosts must be specified ; at RUNTIME. i.e. use ini_set() ; tags is special. PHP will check action attribute's URL regardless ; of session.trans_sid_tags setting. ; If no host is defined, HTTP_HOST will be used for allowed host. ; Example value: php.net,www.php.net,wiki.php.net ; Use "," for multiple hosts. No spaces are allowed. ; Default Value: "" ; Development Value: "" ; Production Value: "" ;session.trans_sid_hosts="" ; Define how many bits are stored in each character when converting ; the binary hash data to something readable. ; Possible values: ; 4 (4 bits: 0-9, a-f) ; 5 (5 bits: 0-9, a-v) ; 6 (6 bits: 0-9, a-z, A-Z, "-", ",") ; Default Value: 4 ; Development Value: 5 ; Production Value: 5 ; https://php.net/session.hash-bits-per-character session.sid_bits_per_character = 5 ; Enable upload progress tracking in $_SESSION ; Default Value: On ; Development Value: On ; Production Value: On ; https://php.net/session.upload-progress.enabled ;session.upload_progress.enabled = On ; Cleanup the progress information as soon as all POST data has been read ; (i.e. upload completed). ; Default Value: On ; Development Value: On ; Production Value: On ; https://php.net/session.upload-progress.cleanup ;session.upload_progress.cleanup = On ; A prefix used for the upload progress key in $_SESSION ; Default Value: "upload_progress_" ; Development Value: "upload_progress_" ; Production Value: "upload_progress_" ; https://php.net/session.upload-progress.prefix ;session.upload_progress.prefix = "upload_progress_" ; The index name (concatenated with the prefix) in $_SESSION ; containing the upload progress information ; Default Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Development Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Production Value: "PHP_SESSION_UPLOAD_PROGRESS" ; https://php.net/session.upload-progress.name ;session.upload_progress.name = "PHP_SESSION_UPLOAD_PROGRESS" ; How frequently the upload progress should be updated. ; Given either in percentages (per-file), or in bytes ; Default Value: "1%" ; Development Value: "1%" ; Production Value: "1%" ; https://php.net/session.upload-progress.freq ;session.upload_progress.freq = "1%" ; The minimum delay between updates, in seconds ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; https://php.net/session.upload-progress.min-freq ;session.upload_progress.min_freq = "1" ; Only write session data when session data is changed. Enabled by default. ; https://php.net/session.lazy-write ;session.lazy_write = On [Assertion] ; Switch whether to compile assertions at all (to have no overhead at run-time) ; -1: Do not compile at all ; 0: Jump over assertion at run-time ; 1: Execute assertions ; Changing from or to a negative value is only possible in php.ini! ; (For turning assertions on and off at run-time, toggle zend.assertions between the values 1 and 0) ; Default Value: 1 ; Development Value: 1 ; Production Value: -1 ; https://php.net/zend.assertions zend.assertions = -1 [COM] ; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs ; https://php.net/com.typelib-file ;com.typelib_file = ; allow Distributed-COM calls ; https://php.net/com.allow-dcom ;com.allow_dcom = true ; autoregister constants of a component's typelib on com_load() ; https://php.net/com.autoregister-typelib ;com.autoregister_typelib = true ; register constants casesensitive ; https://php.net/com.autoregister-casesensitive ;com.autoregister_casesensitive = false ; show warnings on duplicate constant registrations ; https://php.net/com.autoregister-verbose ;com.autoregister_verbose = true ; The default character set code-page to use when passing strings to and from COM objects. ; Default: system ANSI code page ;com.code_page= ; The version of the .NET framework to use. The value of the setting are the first three parts ; of the framework's version number, separated by dots, and prefixed with "v", e.g. "v4.0.30319". ;com.dotnet_version= [mbstring] ; language for internal character representation. ; This affects mb_send_mail() and mbstring.detect_order. ; https://php.net/mbstring.language ;mbstring.language = Japanese ; Use of this INI entry is deprecated, use global internal_encoding instead. ; internal/script encoding. ; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*) ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;mbstring.internal_encoding = ; Use of this INI entry is deprecated, use global input_encoding instead. ; http input encoding. ; mbstring.encoding_translation = On is needed to use this setting. ; If empty, default_charset or input_encoding or mbstring.input is used. ; The precedence is: default_charset < input_encoding < mbstring.http_input ; https://php.net/mbstring.http-input ;mbstring.http_input = ; Use of this INI entry is deprecated, use global output_encoding instead. ; http output encoding. ; mb_output_handler must be registered as output buffer to function. ; If empty, default_charset or output_encoding or mbstring.http_output is used. ; The precedence is: default_charset < output_encoding < mbstring.http_output ; To use an output encoding conversion, mbstring's output handler must be set ; otherwise output encoding conversion cannot be performed. ; https://php.net/mbstring.http-output ;mbstring.http_output = ; enable automatic encoding translation according to ; mbstring.internal_encoding setting. Input chars are ; converted to internal encoding by setting this to On. ; Note: Do _not_ use automatic encoding translation for ; portable libs/applications. ; https://php.net/mbstring.encoding-translation ;mbstring.encoding_translation = Off ; automatic encoding detection order. ; "auto" detect order is changed according to mbstring.language ; https://php.net/mbstring.detect-order ;mbstring.detect_order = auto ; substitute_character used when character cannot be converted ; one from another ; https://php.net/mbstring.substitute-character ;mbstring.substitute_character = none ; Enable strict encoding detection. ;mbstring.strict_detection = Off ; This directive specifies the regex pattern of content types for which mb_output_handler() ; is activated. ; Default: mbstring.http_output_conv_mimetypes=^(text/|application/xhtml\+xml) ;mbstring.http_output_conv_mimetypes= ; This directive specifies maximum stack depth for mbstring regular expressions. It is similar ; to the pcre.recursion_limit for PCRE. ;mbstring.regex_stack_limit=100000 ; This directive specifies maximum retry count for mbstring regular expressions. It is similar ; to the pcre.backtrack_limit for PCRE. ;mbstring.regex_retry_limit=1000000 [gd] ; Tell the jpeg decode to ignore warnings and try to create ; a gd image. The warning will then be displayed as notices ; disabled by default ; https://php.net/gd.jpeg-ignore-warning ;gd.jpeg_ignore_warning = 1 [exif] ; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS. ; With mbstring support this will automatically be converted into the encoding ; given by corresponding encode setting. When empty mbstring.internal_encoding ; is used. For the decode settings you can distinguish between motorola and ; intel byte order. A decode setting cannot be empty. ; https://php.net/exif.encode-unicode ;exif.encode_unicode = ISO-8859-15 ; https://php.net/exif.decode-unicode-motorola ;exif.decode_unicode_motorola = UCS-2BE ; https://php.net/exif.decode-unicode-intel ;exif.decode_unicode_intel = UCS-2LE ; https://php.net/exif.encode-jis ;exif.encode_jis = ; https://php.net/exif.decode-jis-motorola ;exif.decode_jis_motorola = JIS ; https://php.net/exif.decode-jis-intel ;exif.decode_jis_intel = JIS [Tidy] ; The path to a default tidy configuration file to use when using tidy ; https://php.net/tidy.default-config ;tidy.default_config = /usr/local/lib/php/default.tcfg ; Should tidy clean and repair output automatically? ; WARNING: Do not use this option if you are generating non-html content ; such as dynamic images ; https://php.net/tidy.clean-output tidy.clean_output = Off [soap] ; Enables or disables WSDL caching feature. ; https://php.net/soap.wsdl-cache-enabled soap.wsdl_cache_enabled=1 ; Sets the directory name where SOAP extension will put cache files. ; https://php.net/soap.wsdl-cache-dir soap.wsdl_cache_dir="/tmp" ; (time to live) Sets the number of second while cached file will be used ; instead of original one. ; https://php.net/soap.wsdl-cache-ttl soap.wsdl_cache_ttl=86400 ; Sets the size of the cache limit. (Max. number of WSDL files to cache) soap.wsdl_cache_limit = 5 [sysvshm] ; A default size of the shared memory segment ;sysvshm.init_mem = 10000 [ldap] ; Sets the maximum number of open links or -1 for unlimited. ldap.max_links = -1 [dba] ;dba.default_handler= [opcache] ; Determines if Zend OPCache is enabled ;opcache.enable=1 ; Determines if Zend OPCache is enabled for the CLI version of PHP ;opcache.enable_cli=0 ; The OPcache shared memory storage size. ;opcache.memory_consumption=128 ; The amount of memory for interned strings in Mbytes. ;opcache.interned_strings_buffer=8 ; The maximum number of keys (scripts) in the OPcache hash table. ; Only numbers between 200 and 1000000 are allowed. ;opcache.max_accelerated_files=10000 ; The maximum percentage of "wasted" memory until a restart is scheduled. ;opcache.max_wasted_percentage=5 ; When this directive is enabled, the OPcache appends the current working ; directory to the script key, thus eliminating possible collisions between ; files with the same name (basename). Disabling the directive improves ; performance, but may break existing applications. ;opcache.use_cwd=1 ; When disabled, you must reset the OPcache manually or restart the ; webserver for changes to the filesystem to take effect. ;opcache.validate_timestamps=1 ; How often (in seconds) to check file timestamps for changes to the shared ; memory storage allocation. ("1" means validate once per second, but only ; once per request. "0" means always validate) ;opcache.revalidate_freq=2 ; Enables or disables file search in include_path optimization ;opcache.revalidate_path=0 ; If disabled, all PHPDoc comments are dropped from the code to reduce the ; size of the optimized code. ;opcache.save_comments=1 ; If enabled, compilation warnings (including notices and deprecations) will ; be recorded and replayed each time a file is included. Otherwise, compilation ; warnings will only be emitted when the file is first cached. ;opcache.record_warnings=0 ; Allow file existence override (file_exists, etc.) performance feature. ;opcache.enable_file_override=0 ; A bitmask, where each bit enables or disables the appropriate OPcache ; passes ;opcache.optimization_level=0x7FFFBFFF ;opcache.dups_fix=0 ; The location of the OPcache blacklist file (wildcards allowed). ; Each OPcache blacklist file is a text file that holds the names of files ; that should not be accelerated. The file format is to add each filename ; to a new line. The filename may be a full path or just a file prefix ; (i.e., /var/www/x blacklists all the files and directories in /var/www ; that start with 'x'). Line starting with a ; are ignored (comments). ;opcache.blacklist_filename= ; Allows exclusion of large files from being cached. By default all files ; are cached. ;opcache.max_file_size=0 ; How long to wait (in seconds) for a scheduled restart to begin if the cache ; is not being accessed. ;opcache.force_restart_timeout=180 ; OPcache error_log file name. Empty string assumes "stderr". ;opcache.error_log= ; All OPcache errors go to the Web server log. ; By default, only fatal errors (level 0) or errors (level 1) are logged. ; You can also enable warnings (level 2), info messages (level 3) or ; debug messages (level 4). ;opcache.log_verbosity_level=1 ; Preferred Shared Memory back-end. Leave empty and let the system decide. ;opcache.preferred_memory_model= ; Protect the shared memory from unexpected writing during script execution. ; Useful for internal debugging only. ;opcache.protect_memory=0 ; Allows calling OPcache API functions only from PHP scripts which path is ; started from specified string. The default "" means no restriction ;opcache.restrict_api= ; Mapping base of shared memory segments (for Windows only). All the PHP ; processes have to map shared memory into the same address space. This ; directive allows to manually fix the "Unable to reattach to base address" ; errors. ;opcache.mmap_base= ; Facilitates multiple OPcache instances per user (for Windows only). All PHP ; processes with the same cache ID and user share an OPcache instance. ;opcache.cache_id= ; Enables and sets the second level cache directory. ; It should improve performance when SHM memory is full, at server restart or ; SHM reset. The default "" disables file based caching. ;opcache.file_cache= ; Enables or disables opcode caching in shared memory. ;opcache.file_cache_only=0 ; Enables or disables checksum validation when script loaded from file cache. ;opcache.file_cache_consistency_checks=1 ; Implies opcache.file_cache_only=1 for a certain process that failed to ; reattach to the shared memory (for Windows only). Explicitly enabled file ; cache is required. ;opcache.file_cache_fallback=1 ; Enables or disables copying of PHP code (text segment) into HUGE PAGES. ; Under certain circumstances (if only a single global PHP process is ; started from which all others fork), this can increase performance ; by a tiny amount because TLB misses are reduced. On the other hand, this ; delays PHP startup, increases memory usage and degrades performance ; under memory pressure - use with care. ; Requires appropriate OS configuration. ;opcache.huge_code_pages=0 ; Validate cached file permissions. ;opcache.validate_permission=0 ; Prevent name collisions in chroot'ed environment. ;opcache.validate_root=0 ; If specified, it produces opcode dumps for debugging different stages of ; optimizations. ;opcache.opt_debug_level=0 ; Specifies a PHP script that is going to be compiled and executed at server ; start-up. ; https://php.net/opcache.preload ;opcache.preload= ; Preloading code as root is not allowed for security reasons. This directive ; facilitates to let the preloading to be run as another user. ; https://php.net/opcache.preload_user ;opcache.preload_user= ; Prevents caching files that are less than this number of seconds old. It ; protects from caching of incompletely updated files. In case all file updates ; on your site are atomic, you may increase performance by setting it to "0". ;opcache.file_update_protection=2 ; Absolute path used to store shared lockfiles (for *nix only). ;opcache.lockfile_path=/tmp [curl] ; A default value for the CURLOPT_CAINFO option. This is required to be an ; absolute path. ;curl.cainfo = [openssl] ; The location of a Certificate Authority (CA) file on the local filesystem ; to use when verifying the identity of SSL/TLS peers. Most users should ; not specify a value for this directive as PHP will attempt to use the ; OS-managed cert stores in its absence. If specified, this value may still ; be overridden on a per-stream basis via the "cafile" SSL stream context ; option. ;openssl.cafile= ; If openssl.cafile is not specified or if the CA file is not found, the ; directory pointed to by openssl.capath is searched for a suitable ; certificate. This value must be a correctly hashed certificate directory. ; Most users should not specify a value for this directive as PHP will ; attempt to use the OS-managed cert stores in its absence. If specified, ; this value may still be overridden on a per-stream basis via the "capath" ; SSL stream context option. ;openssl.capath= [ffi] ; FFI API restriction. Possible values: ; "preload" - enabled in CLI scripts and preloaded files (default) ; "false" - always disabled ; "true" - always enabled ;ffi.enable=preload ; List of headers files to preload, wildcard patterns allowed. ;ffi.preload= [Zend] zend_extension="/usr/local/ioncube/ioncube_loader_lin_8.3.so" ; fix for segfaults auto_globals_jit = Off cgi.fix_pathinfo = 1 mbstring.http_input = "pass" mbstring.http_output = "pass" mbstring.encoding_translation = 0 ; Enable Extensions extension=uploadprogress.so extension=imagick.so extension=redis.so ================================================ FILE: aegir/conf/php/php83-fpm ================================================ #!/bin/bash ### BEGIN INIT INFO # Provides: php83-fpm # Required-Start: $remote_fs $network # Required-Stop: $remote_fs $network # Default-Start: 2 3 4 5 # Default-Stop: 0 1 6 # Short-Description: starts php83-fpm # Description: starts the PHP FastCGI Process Manager daemon ### END INIT INFO prefix=/opt/php83 exec_prefix=${prefix} php_fpm_BIN=/opt/php83/sbin/php-fpm php_fpm_CONF=/opt/php83/etc/php83-fpm.conf php_fpm_PID=/run/php83-fpm.pid php_opts="--fpm-config $php_fpm_CONF --pid $php_fpm_PID -c /opt/php83/etc/php83.ini" wait_for_pid() { try=0 while test $try -lt 5; do case "$1" in 'created') if [ -f "$2" ]; then try='' break fi ;; 'removed') if [ ! -f "$2" ]; then try='' break fi ;; esac echo -n . try=`expr $try + 1` sleep 1 done } case "$1" in start) echo -n "Starting php83-fpm..." $php_fpm_BIN --daemonize $php_opts if [ "$?" != 0 ]; then echo " failed" exit 1 fi wait_for_pid created $php_fpm_PID if [ -n "$try" ]; then echo " failed" exit 1 else echo " done" fi ;; stop) echo -n "Gracefully shutting down php83-fpm..." if [ ! -r $php_fpm_PID ]; then echo "warning, no pid file found - php83-fpm is not running ?" exit 1 fi kill -QUIT `cat $php_fpm_PID` wait_for_pid removed $php_fpm_PID if [ -n "$try" ]; then echo " failed. Use force-quit" exit 1 else echo " done" fi ;; status) if [ ! -r $php_fpm_PID ]; then echo "php83-fpm is stopped" exit 0 fi PID=`cat $php_fpm_PID` if ps -p $PID | grep -q $PID; then echo "php83-fpm (pid $PID) is running..." else echo "php83-fpm dead but pid file exists" fi ;; force-quit) echo -n "Terminating php83-fpm..." if [ ! -r $php_fpm_PID ]; then echo "warning, no pid file found - php83-fpm is not running ?" exit 1 fi kill -TERM `cat $php_fpm_PID` wait_for_pid removed $php_fpm_PID if [ -n "$try" ]; then echo " failed" exit 1 else echo " done" fi ;; restart) $0 stop $0 start ;; reload) echo -n "Reloading service php83-fpm..." if [ ! -r $php_fpm_PID ]; then echo "warning, no pid file found - php83-fpm is not running ?" exit 1 fi kill -USR2 `cat $php_fpm_PID` echo " done" ;; configtest) $php_fpm_BIN -t ;; *) echo "Usage: $0 {start|stop|force-quit|restart|reload|status|configtest}" exit 1 ;; esac ================================================ FILE: aegir/conf/php/php83-fpm.conf ================================================ ;;;;;;;;;;;;;;;;;;;;; ; FPM Configuration ; ;;;;;;;;;;;;;;;;;;;;; ; All relative paths in this configuration file are relative to PHP's install ; prefix (/opt/php83). This prefix can be dynamically changed by using the ; '-p' argument from the command line. ; Include one or more files. If glob(3) exists, it is used to include a bunch of ; files from a glob(3) pattern. This directive can be used everywhere in the ; file. ; Relative path can also be used. They will be prefixed by: ; - the global prefix if it's been set (-p argument) ; - /opt/php83 otherwise ;include=etc/fpm.d/*.conf ;;;;;;;;;;;;;;;;;; ; Global Options ; ;;;;;;;;;;;;;;;;;; [global] ; Pid file ; Note: the default prefix is /opt/php83/var ; Default Value: none pid = /run/php83-fpm.pid ; Error log file ; If it's set to "syslog", log is sent to syslogd instead of being written ; in a local file. ; Note: the default prefix is /opt/php83/var ; Default Value: log/php-fpm.log error_log = /var/log/php/php83-fpm-error.log ; syslog_facility is used to specify what type of program is logging the ; message. This lets syslogd specify that messages from different facilities ; will be handled differently. ; See syslog(3) for possible values (ex daemon equiv LOG_DAEMON) ; Default Value: daemon syslog.facility = daemon ; syslog_ident is prepended to every message. If you have multiple FPM ; instances running on the same server, you can change the default value ; which must suit common needs. ; Default Value: php-fpm syslog.ident = php83-fpm ; Log level ; Possible Values: alert, error, warning, notice, debug ; Default Value: notice log_level = warning ; If this number of child processes exit with SIGSEGV or SIGBUS within the time ; interval set by emergency_restart_interval then FPM will restart. A value ; of '0' means 'Off'. ; Default Value: 0 emergency_restart_threshold = 5 ; Interval of time used by emergency_restart_interval to determine when ; a graceful restart will be initiated. This can be useful to work around ; accidental corruptions in an accelerator's shared memory. ; Available Units: s(econds), m(inutes), h(ours), or d(ays) ; Default Unit: seconds ; Default Value: 0 emergency_restart_interval = 1m ; Time limit for child processes to wait for a reaction on signals from master. ; Available units: s(econds), m(inutes), h(ours), or d(ays) ; Default Unit: seconds ; Default Value: 0 process_control_timeout = 5s ; The maximum number of processes FPM will fork. This has been design to control ; the global number of processes when using dynamic PM within a lot of pools. ; Use it with caution. ; Note: A value of 0 indicates no limit ; Default Value: 0 process.max = 0 ; Specify the nice(2) priority to apply to the master process (only if set) ; The value can vary from -19 (highest priority) to 20 (lower priority) ; Note: - It will only work if the FPM master process is launched as root ; - The pool process will inherit the master process priority ; unless it specified otherwise ; Default Value: no set ; process.priority = -19 ; Send FPM to background. Set to 'no' to keep FPM in foreground for debugging. ; Default Value: yes daemonize = yes ; Set open file descriptor rlimit for the master process. ; Default Value: system defined value ;rlimit_files = 1024 ; Set max core size rlimit for the master process. ; Possible Values: 'unlimited' or an integer greater or equal to 0 ; Default Value: system defined value ;rlimit_core = 0 ; Specify the event mechanism FPM will use. The following is available: ; - select (any POSIX os) ; - poll (any POSIX os) ; - epoll (linux >= 2.5.44) ; - kqueue (FreeBSD >= 4.1, OpenBSD >= 2.9, NetBSD >= 2.0) ; - /dev/poll (Solaris >= 7) ; - port (Solaris >= 10) ; Default Value: not set (auto detection) ;events.mechanism = epoll ;;;;;;;;;;;;;;;;;;;; ; Pool Definitions ; ;;;;;;;;;;;;;;;;;;;; ; Multiple pools of child processes may be started with different listening ; ports and different management options. The name of the pool will be ; used in logs and stats. There is no limitation on the number of pools which ; FPM can handle. Your system will tell you anyway :) include = /opt/php83/etc/pool.d/*.conf ================================================ FILE: aegir/conf/php/php83.ini ================================================ [PHP] ;;;;;;;;;;;;;;;;;;; ; About php.ini ; ;;;;;;;;;;;;;;;;;;; ; PHP's initialization file, generally called php.ini, is responsible for ; configuring many of the aspects of PHP's behavior. ; PHP attempts to find and load this configuration from a number of locations. ; The following is a summary of its search order: ; 1. SAPI module specific location. ; 2. The PHPRC environment variable. ; 3. A number of predefined registry keys on Windows ; 4. Current working directory (except CLI) ; 5. The web server's directory (for SAPI modules), or directory of PHP ; (otherwise in Windows) ; 6. The directory from the --with-config-file-path compile time option, or the ; Windows directory (usually C:\windows) ; See the PHP docs for more specific information. ; https://php.net/configuration.file ; The syntax of the file is extremely simple. Whitespace and lines ; beginning with a semicolon are silently ignored (as you probably guessed). ; Section headers (e.g. [Foo]) are also silently ignored, even though ; they might mean something in the future. ; Directives following the section heading [PATH=/www/mysite] only ; apply to PHP files in the /www/mysite directory. Directives ; following the section heading [HOST=www.example.com] only apply to ; PHP files served from www.example.com. Directives set in these ; special sections cannot be overridden by user-defined INI files or ; at runtime. Currently, [PATH=] and [HOST=] sections only work under ; CGI/FastCGI. ; https://php.net/ini.sections ; Directives are specified using the following syntax: ; directive = value ; Directive names are *case sensitive* - foo=bar is different from FOO=bar. ; Directives are variables used to configure PHP or PHP extensions. ; There is no name validation. If PHP can't find an expected ; directive because it is not set or is mistyped, a default value will be used. ; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one ; of the INI constants (On, Off, True, False, Yes, No and None) or an expression ; (e.g. E_ALL & ~E_NOTICE), a quoted string ("bar"), or a reference to a ; previously set variable or directive (e.g. ${foo}) ; Expressions in the INI file are limited to bitwise operators and parentheses: ; | bitwise OR ; ^ bitwise XOR ; & bitwise AND ; ~ bitwise NOT ; ! boolean NOT ; Boolean flags can be turned on using the values 1, On, True or Yes. ; They can be turned off using the values 0, Off, False or No. ; An empty string can be denoted by simply not writing anything after the equal ; sign, or by using the None keyword: ; foo = ; sets foo to an empty string ; foo = None ; sets foo to an empty string ; foo = "None" ; sets foo to the string 'None' ; If you use constants in your value, and these constants belong to a ; dynamically loaded extension (either a PHP extension or a Zend extension), ; you may only use these constants *after* the line that loads the extension. ;;;;;;;;;;;;;;;;;;; ; About this file ; ;;;;;;;;;;;;;;;;;;; ; PHP comes packaged with two INI files. One that is recommended to be used ; in production environments and one that is recommended to be used in ; development environments. ; php.ini-production contains settings which hold security, performance and ; best practices at its core. But please be aware, these settings may break ; compatibility with older or less security-conscious applications. We ; recommending using the production ini in production and testing environments. ; php.ini-development is very similar to its production variant, except it is ; much more verbose when it comes to errors. We recommend using the ; development version only in development environments, as errors shown to ; application users can inadvertently leak otherwise secure information. ; This is the php.ini-production INI file. ;;;;;;;;;;;;;;;;;;; ; Quick Reference ; ;;;;;;;;;;;;;;;;;;; ; The following are all the settings which are different in either the production ; or development versions of the INIs with respect to PHP's default behavior. ; Please see the actual settings later in the document for more details as to why ; we recommend these changes in PHP's behavior. display_errors = Off ; Default Value: On ; Development Value: On ; Production Value: Off ; display_startup_errors ; Default Value: On ; Development Value: On ; Production Value: Off ; error_reporting ; Default Value: E_ALL ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; log_errors ; Default Value: Off ; Development Value: On ; Production Value: On ; max_input_time ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; output_buffering ; Default Value: Off ; Development Value: 4096 ; Production Value: 4096 ; register_argc_argv ; Default Value: On ; Development Value: Off ; Production Value: Off ; request_order ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; session.gc_divisor ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; session.sid_bits_per_character ; Default Value: 4 ; Development Value: 5 ; Production Value: 5 ; session.sid_length ; Default Value: 32 ; Development Value: 26 ; Production Value: 26 ; short_open_tag ; Default Value: On ; Development Value: Off ; Production Value: Off ; variables_order ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS" ; zend.assertions ; Default Value: 1 ; Development Value: 1 ; Production Value: -1 ; zend.exception_ignore_args ; Default Value: Off ; Development Value: Off ; Production Value: On ; zend.exception_string_param_max_len ; Default Value: 15 ; Development Value: 15 ; Production Value: 0 ;;;;;;;;;;;;;;;;;;;; ; php.ini Options ; ;;;;;;;;;;;;;;;;;;;; ; Name for user-defined php.ini (.htaccess) files. Default is ".user.ini" ;user_ini.filename = ".user.ini" ; To disable this feature set this option to an empty value user_ini.filename = ; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes) ;user_ini.cache_ttl = 300 ;;;;;;;;;;;;;;;;;;;; ; Language Options ; ;;;;;;;;;;;;;;;;;;;; ; Enable the PHP scripting language engine under Apache. ; https://php.net/engine engine = On ; This directive determines whether or not PHP will recognize code between ; tags as PHP source which should be processed as such. It is ; generally recommended that should be used and that this feature ; should be disabled, as enabling it may result in issues when generating XML ; documents, however this remains supported for backward compatibility reasons. ; Note that this directive does not control the would work. ; https://php.net/syntax-highlighting ;highlight.string = #DD0000 ;highlight.comment = #FF9900 ;highlight.keyword = #007700 ;highlight.default = #0000BB ;highlight.html = #000000 ; If enabled, the request will be allowed to complete even if the user aborts ; the request. Consider enabling it if executing long requests, which may end up ; being interrupted by the user or a browser timing out. PHP's default behavior ; is to disable this feature. ; https://php.net/ignore-user-abort ;ignore_user_abort = On ; Determines the size of the realpath cache to be used by PHP. This value should ; be increased on systems where PHP opens many files to reflect the quantity of ; the file operations performed. ; Note: if open_basedir is set, the cache is disabled ; https://php.net/realpath-cache-size realpath_cache_size=64M ; Duration of time, in seconds for which to cache realpath information for a given ; file or directory. For systems with rarely changing files, consider increasing this ; value. ; https://php.net/realpath-cache-ttl realpath_cache_ttl=180 ; Enables or disables the circular reference collector. ; https://php.net/zend.enable-gc zend.enable_gc = On ; If enabled, scripts may be written in encodings that are incompatible with ; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such ; encodings. To use this feature, mbstring extension must be enabled. ;zend.multibyte = Off ; Allows to set the default encoding for the scripts. This value will be used ; unless "declare(encoding=...)" directive appears at the top of the script. ; Only affects if zend.multibyte is set. ;zend.script_encoding = ; Allows to include or exclude arguments from stack traces generated for exceptions. ; In production, it is recommended to turn this setting on to prohibit the output ; of sensitive information in stack traces ; Default Value: Off ; Development Value: Off ; Production Value: On zend.exception_ignore_args = On ; Allows setting the maximum string length in an argument of a stringified stack trace ; to a value between 0 and 1000000. ; This has no effect when zend.exception_ignore_args is enabled. ; Default Value: 15 ; Development Value: 15 ; Production Value: 0 ; In production, it is recommended to set this to 0 to reduce the output ; of sensitive information in stack traces. zend.exception_string_param_max_len = 0 ;;;;;;;;;;;;;;;;; ; Miscellaneous ; ;;;;;;;;;;;;;;;;; ; Decides whether PHP may expose the fact that it is installed on the server ; (e.g. by adding its signature to the Web server header). It is no security ; threat in any way, but it makes it possible to determine whether you use PHP ; on your server or not. ; https://php.net/expose-php expose_php = On ;;;;;;;;;;;;;;;;;;; ; Resource Limits ; ;;;;;;;;;;;;;;;;;;; ; Maximum execution time of each script, in seconds ; https://php.net/max-execution-time ; Note: This directive is hardcoded to 0 for the CLI SAPI max_execution_time = 180 ; Maximum amount of time each script may spend parsing request data. It's a good ; idea to limit this time on productions servers in order to eliminate unexpectedly ; long running scripts. ; Note: This directive is hardcoded to -1 for the CLI SAPI ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; https://php.net/max-input-time max_input_time = 180 ; Maximum input variable nesting level ; https://php.net/max-input-nesting-level ;max_input_nesting_level = 64 ; How many GET/POST/COOKIE input variables may be accepted max_input_vars = 9999 ; How many multipart body parts (combined input variable and file uploads) may ; be accepted. ; Default Value: -1 (Sum of max_input_vars and max_file_uploads) ;max_multipart_body_parts = 1500 ; Maximum amount of memory a script may consume ; https://php.net/memory-limit memory_limit = 395M ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; Error handling and logging ; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; This directive informs PHP of which errors, warnings and notices you would like ; it to take action for. The recommended way of setting values for this ; directive is through the use of the error level constants and bitwise ; operators. The error level constants are below here for convenience as well as ; some common settings and their meanings. ; By default, PHP is set to take action on all errors, notices and warnings EXCEPT ; those related to E_NOTICE and E_STRICT, which together cover best practices and ; recommended coding standards in PHP. For performance reasons, this is the ; recommend error reporting setting. Your production server shouldn't be wasting ; resources complaining about best practices and coding standards. That's what ; development servers and development settings are for. ; Note: The php.ini-development file has this setting as E_ALL. This ; means it pretty much reports everything which is exactly what you want during ; development and early testing. ; ; Error Level Constants: ; E_ALL - All errors and warnings ; E_ERROR - fatal run-time errors ; E_RECOVERABLE_ERROR - almost fatal run-time errors ; E_WARNING - run-time warnings (non-fatal errors) ; E_PARSE - compile-time parse errors ; E_NOTICE - run-time notices (these are warnings which often result ; from a bug in your code, but it's possible that it was ; intentional (e.g., using an uninitialized variable and ; relying on the fact it is automatically initialized to an ; empty string) ; E_STRICT - run-time notices, enable to have PHP suggest changes ; to your code which will ensure the best interoperability ; and forward compatibility of your code ; E_CORE_ERROR - fatal errors that occur during PHP's initial startup ; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's ; initial startup ; E_COMPILE_ERROR - fatal compile-time errors ; E_COMPILE_WARNING - compile-time warnings (non-fatal errors) ; E_USER_ERROR - user-generated error message ; E_USER_WARNING - user-generated warning message ; E_USER_NOTICE - user-generated notice message ; E_DEPRECATED - warn about code that will not work in future versions ; of PHP ; E_USER_DEPRECATED - user-generated deprecation warnings ; ; Common Values: ; E_ALL (Show all errors, warnings and notices including coding standards.) ; E_ALL & ~E_NOTICE (Show all errors, except for notices) ; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.) ; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors) ; Default Value: E_ALL ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; https://php.net/error-reporting error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT ; This directive controls whether or not and where PHP will output errors, ; notices and warnings too. Error output is very useful during development, but ; it could be very dangerous in production environments. Depending on the code ; which is triggering the error, sensitive information could potentially leak ; out of your application such as database usernames and passwords or worse. ; For production environments, we recommend logging errors rather than ; sending them to STDOUT. ; Possible Values: ; Off = Do not display any errors ; stderr = Display errors to STDERR (affects only CGI/CLI binaries!) ; On or stdout = Display errors to STDOUT ; Default Value: On ; Development Value: On ; Production Value: Off ; https://php.net/display-errors display_errors = Off ; The display of errors which occur during PHP's startup sequence are handled ; separately from display_errors. We strongly recommend you set this to 'off' ; for production servers to avoid leaking configuration details. ; Default Value: On ; Development Value: On ; Production Value: Off ; https://php.net/display-startup-errors display_startup_errors = Off ; Besides displaying errors, PHP can also log errors to locations such as a ; server-specific log, STDERR, or a location specified by the error_log ; directive found below. While errors should not be displayed on productions ; servers they should still be monitored and logging is a great way to do that. ; Default Value: Off ; Development Value: On ; Production Value: On ; https://php.net/log-errors log_errors = On ; Do not log repeated messages. Repeated errors must occur in same file on same ; line unless ignore_repeated_source is set true. ; https://php.net/ignore-repeated-errors ignore_repeated_errors = Off ; Ignore source of message when ignoring repeated messages. When this setting ; is On you will not log errors with repeated messages from different files or ; source lines. ; https://php.net/ignore-repeated-source ignore_repeated_source = Off ; If this parameter is set to Off, then memory leaks will not be shown (on ; stdout or in the log). This is only effective in a debug compile, and if ; error reporting includes E_WARNING in the allowed list ; https://php.net/report-memleaks report_memleaks = On ; This setting is off by default. ;report_zend_debug = 0 ; Turn off normal error reporting and emit XML-RPC error XML ; https://php.net/xmlrpc-errors ;xmlrpc_errors = 0 ; An XML-RPC faultCode ;xmlrpc_error_number = 0 ; When PHP displays or logs an error, it has the capability of formatting the ; error message as HTML for easier reading. This directive controls whether ; the error message is formatted as HTML or not. ; Note: This directive is hardcoded to Off for the CLI SAPI ; https://php.net/html-errors html_errors = Off ; If html_errors is set to On *and* docref_root is not empty, then PHP ; produces clickable error messages that direct to a page describing the error ; or function causing the error in detail. ; You can download a copy of the PHP manual from https://php.net/docs ; and change docref_root to the base URL of your local copy including the ; leading '/'. You must also specify the file extension being used including ; the dot. PHP's default behavior is to leave these settings empty, in which ; case no links to documentation are generated. ; Note: Never use this feature for production boxes. ; https://php.net/docref-root ; Examples ;docref_root = "/phpmanual/" ; https://php.net/docref-ext ;docref_ext = .html ; String to output before an error message. PHP's default behavior is to leave ; this setting blank. ; https://php.net/error-prepend-string ; Example: ;error_prepend_string = "" ; String to output after an error message. PHP's default behavior is to leave ; this setting blank. ; https://php.net/error-append-string ; Example: ;error_append_string = "" ; Log errors to specified file. PHP's default behavior is to leave this value ; empty. ; https://php.net/error-log ; Example: ;error_log = php_errors.log ; Log errors to syslog (Event Log on Windows). ;error_log = syslog error_log = /var/log/php/error_log_83 ; The syslog ident is a string which is prepended to every message logged ; to syslog. Only used when error_log is set to syslog. ;syslog.ident = php ; The syslog facility is used to specify what type of program is logging ; the message. Only used when error_log is set to syslog. ;syslog.facility = user ; Set this to disable filtering control characters (the default). ; Some loggers only accept NVT-ASCII, others accept anything that's not ; control characters. If your logger accepts everything, then no filtering ; is needed at all. ; Allowed values are: ; ascii (all printable ASCII characters and NL) ; no-ctrl (all characters except control characters) ; all (all characters) ; raw (like "all", but messages are not split at newlines) ; https://php.net/syslog.filter ;syslog.filter = ascii ;windows.show_crt_warning ; Default value: 0 ; Development value: 0 ; Production value: 0 ;;;;;;;;;;;;;;;;; ; Data Handling ; ;;;;;;;;;;;;;;;;; ; The separator used in PHP generated URLs to separate arguments. ; PHP's default setting is "&". ; https://php.net/arg-separator.output ; Example: ;arg_separator.output = "&" ; List of separator(s) used by PHP to parse input URLs into variables. ; PHP's default setting is "&". ; NOTE: Every character in this directive is considered as separator! ; https://php.net/arg-separator.input ; Example: ;arg_separator.input = ";&" ; This directive determines which super global arrays are registered when PHP ; starts up. G,P,C,E & S are abbreviations for the following respective super ; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty ; paid for the registration of these arrays and because ENV is not as commonly ; used as the others, ENV is not recommended on productions servers. You ; can still get access to the environment variables through getenv() should you ; need to. ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS"; ; https://php.net/variables-order variables_order = "GPCS" ; This directive determines which super global data (G,P & C) should be ; registered into the super global array REQUEST. If so, it also determines ; the order in which that data is registered. The values for this directive ; are specified in the same manner as the variables_order directive, ; EXCEPT one. Leaving this value empty will cause PHP to use the value set ; in the variables_order directive. It does not mean it will leave the super ; globals array REQUEST empty. ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; https://php.net/request-order request_order = "GP" ; This directive determines whether PHP registers $argv & $argc each time it ; runs. $argv contains an array of all the arguments passed to PHP when a script ; is invoked. $argc contains an integer representing the number of arguments ; that were passed when the script was invoked. These arrays are extremely ; useful when running scripts from the command line. When this directive is ; enabled, registering these variables consumes CPU cycles and memory each time ; a script is executed. For performance reasons, this feature should be disabled ; on production servers. ; Note: This directive is hardcoded to On for the CLI SAPI ; Default Value: On ; Development Value: Off ; Production Value: Off ; https://php.net/register-argc-argv register_argc_argv = Off ; When enabled, the ENV, REQUEST and SERVER variables are created when they're ; first used (Just In Time) instead of when the script starts. If these ; variables are not used within a script, having this directive on will result ; in a performance gain. The PHP directive register_argc_argv must be disabled ; for this directive to have any effect. ; https://php.net/auto-globals-jit auto_globals_jit = On ; Whether PHP will read the POST data. ; This option is enabled by default. ; Most likely, you won't want to disable this option globally. It causes $_POST ; and $_FILES to always be empty; the only way you will be able to read the ; POST data will be through the php://input stream wrapper. This can be useful ; to proxy requests or to process the POST data in a memory efficient fashion. ; https://php.net/enable-post-data-reading ;enable_post_data_reading = Off ; Maximum size of POST data that PHP will accept. ; Its value may be 0 to disable the limit. It is ignored if POST data reading ; is disabled through enable_post_data_reading. ; https://php.net/post-max-size post_max_size = 350M ; Automatically add files before PHP document. ; https://php.net/auto-prepend-file auto_prepend_file = ; Automatically add files after PHP document. ; https://php.net/auto-append-file auto_append_file = ; By default, PHP will output a media type using the Content-Type header. To ; disable this, simply set it to be empty. ; ; PHP's built-in default media type is set to text/html. ; https://php.net/default-mimetype default_mimetype = "text/html" ; PHP's default character set is set to UTF-8. ; https://php.net/default-charset default_charset = "UTF-8" ; PHP internal character encoding is set to empty. ; If empty, default_charset is used. ; https://php.net/internal-encoding ;internal_encoding = ; PHP input character encoding is set to empty. ; If empty, default_charset is used. ; https://php.net/input-encoding ;input_encoding = ; PHP output character encoding is set to empty. ; If empty, default_charset is used. ; See also output_buffer. ; https://php.net/output-encoding ;output_encoding = ;;;;;;;;;;;;;;;;;;;;;;;;; ; Paths and Directories ; ;;;;;;;;;;;;;;;;;;;;;;;;; ; UNIX: "/path1:/path2" ;include_path = ".:/php/includes" ; ; Windows: "\path1;\path2" ;include_path = ".;c:\php\includes" ; ; PHP's default setting for include_path is ".;/path/to/php/pear" ; https://php.net/include-path include_path = ".:/opt/php83/lib/php" ; The root of the PHP pages, used only if nonempty. ; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root ; if you are running php as a CGI under any web server (other than IIS) ; see documentation for security issues. The alternate is to use the ; cgi.force_redirect configuration below ; https://php.net/doc-root doc_root = ; The directory under which PHP opens the script using /~username used only ; if nonempty. ; https://php.net/user-dir user_dir = ; Directory in which the loadable extensions (modules) reside. ; https://php.net/extension-dir ;extension_dir = "./" ; On windows: ;extension_dir = "ext" extension_dir = "/opt/php83/lib/php/extensions/no-debug-non-zts-20230831/" ; Directory where the temporary files should be placed. ; Defaults to the system default (see sys_get_temp_dir) sys_temp_dir = "/tmp" ; Whether or not to enable the dl() function. The dl() function does NOT work ; properly in multithreaded servers, such as IIS or Zeus, and is automatically ; disabled on them. ; https://php.net/enable-dl enable_dl = Off ; cgi.force_redirect is necessary to provide security running PHP as a CGI under ; most web servers. Left undefined, PHP turns this on by default. You can ; turn it off here AT YOUR OWN RISK ; **You CAN safely turn this off for IIS, in fact, you MUST.** ; https://php.net/cgi.force-redirect ;cgi.force_redirect = 1 ; if cgi.nph is enabled it will force cgi to always sent Status: 200 with ; every request. PHP's default behavior is to disable this feature. ;cgi.nph = 1 ; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape ; (iPlanet) web servers, you MAY need to set an environment variable name that PHP ; will look for to know it is OK to continue execution. Setting this variable MAY ; cause security issues, KNOW WHAT YOU ARE DOING FIRST. ; https://php.net/cgi.redirect-status-env ;cgi.redirect_status_env = ; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's ; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok ; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting ; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting ; of zero causes PHP to behave as before. Default is 1. You should fix your scripts ; to use SCRIPT_FILENAME rather than PATH_TRANSLATED. ; https://php.net/cgi.fix-pathinfo ;cgi.fix_pathinfo=1 ; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside ; of the web tree and people will not be able to circumvent .htaccess security. ;cgi.discard_path=1 ; FastCGI under IIS supports the ability to impersonate ; security tokens of the calling client. This allows IIS to define the ; security context that the request runs under. mod_fastcgi under Apache ; does not currently support this feature (03/17/2002) ; Set to 1 if running under IIS. Default is zero. ; https://php.net/fastcgi.impersonate ;fastcgi.impersonate = 1 ; Disable logging through FastCGI connection. PHP's default behavior is to enable ; this feature. ;fastcgi.logging = 0 ; cgi.rfc2616_headers configuration option tells PHP what type of headers to ; use when sending HTTP response code. If set to 0, PHP sends Status: header that ; is supported by Apache. When this option is set to 1, PHP will send ; RFC2616 compliant header. ; Default is zero. ; https://php.net/cgi.rfc2616-headers ;cgi.rfc2616_headers = 0 ; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #! ; (shebang) at the top of the running script. This line might be needed if the ; script support running both as stand-alone script and via PHP CGI<. PHP in CGI ; mode skips this line and ignores its content if this directive is turned on. ; https://php.net/cgi.check-shebang-line ;cgi.check_shebang_line=1 ;;;;;;;;;;;;;;;; ; File Uploads ; ;;;;;;;;;;;;;;;; ; Whether to allow HTTP file uploads. ; https://php.net/file-uploads file_uploads = On ; Temporary directory for HTTP uploaded files (will use system default if not ; specified). ; https://php.net/upload-tmp-dir upload_tmp_dir = /tmp ; Maximum allowed size for uploaded files. ; https://php.net/upload-max-filesize upload_max_filesize = 325M ; Maximum number of files that can be uploaded via a single request max_file_uploads = 50 ;;;;;;;;;;;;;;;;;; ; Fopen wrappers ; ;;;;;;;;;;;;;;;;;; ; Whether to allow the treatment of URLs (like http:// or ftp://) as files. ; https://php.net/allow-url-fopen allow_url_fopen = On ; Whether to allow include/require to open URLs (like https:// or ftp://) as files. ; https://php.net/allow-url-include allow_url_include = Off ; Define the anonymous ftp password (your email address). PHP's default setting ; for this is empty. ; https://php.net/from ;from="john@doe.com" ; Define the User-Agent string. PHP's default setting for this is empty. ; https://php.net/user-agent ;user_agent="PHP" ; Default timeout for socket based streams (seconds) ; https://php.net/default-socket-timeout default_socket_timeout = 180 ; If your scripts have to deal with files from Macintosh systems, ; or you are running on a Mac and need to deal with files from ; unix or win32 systems, setting this flag will cause PHP to ; automatically detect the EOL character in those files so that ; fgets() and file() will work regardless of the source of the file. ; https://php.net/auto-detect-line-endings auto_detect_line_endings = On ;;;;;;;;;;;;;;;;;;;;;; ; Dynamic Extensions ; ;;;;;;;;;;;;;;;;;;;;;; ; If you wish to have an extension loaded automatically, use the following ; syntax: ; ; extension=modulename ; ; For example: ; ; extension=mysqli ; ; When the extension library to load is not located in the default extension ; directory, You may specify an absolute path to the library file: ; ; extension=/path/to/extension/mysqli.so ; ; Note : The syntax used in previous PHP versions ('extension=.so' and ; 'extension='php_.dll') is supported for legacy reasons and may be ; deprecated in a future PHP major version. So, when it is possible, please ; move to the new ('extension=) syntax. ; ; Notes for Windows environments : ; ; - Many DLL files are located in the ext/ ; extension folders as well as the separate PECL DLL download. ; Be sure to appropriately set the extension_dir directive. ; ;extension=bz2 ; The ldap extension must be before curl if OpenSSL 1.0.2 and OpenLDAP is used ; otherwise it results in segfault when unloading after using SASL. ; See https://github.com/php/php-src/issues/8620 for more info. ;extension=ldap ;extension=curl ;extension=ffi ;extension=ftp ;extension=fileinfo ;extension=gd ;extension=gettext ;extension=gmp ;extension=intl ;extension=imap ;extension=mbstring ;extension=exif ; Must be after mbstring as it depends on it ;extension=mysqli ;extension=oci8_12c ; Use with Oracle Database 12c Instant Client ;extension=oci8_19 ; Use with Oracle Database 19 Instant Client ;extension=odbc ;extension=openssl ;extension=pdo_firebird ;extension=pdo_mysql ;extension=pdo_oci ;extension=pdo_odbc ;extension=pdo_pgsql ;extension=pdo_sqlite ;extension=pgsql ;extension=shmop ; The MIBS data available in the PHP distribution must be installed. ; See https://www.php.net/manual/en/snmp.installation.php ;extension=snmp ;extension=soap ;extension=sockets ;extension=sodium ;extension=sqlite3 ;extension=tidy ;extension=xsl ;extension=zip ;zend_extension=opcache ;;;;;;;;;;;;;;;;;;; ; Module Settings ; ;;;;;;;;;;;;;;;;;;; [CLI Server] ; Whether the CLI web server uses ANSI color coding in its terminal output. cli_server.color = On [Date] ; Defines the default timezone used by the date functions ; https://php.net/date.timezone date.timezone = "UTC" ; https://php.net/date.default-latitude ;date.default_latitude = 31.7667 ; https://php.net/date.default-longitude ;date.default_longitude = 35.2333 ; https://php.net/date.sunrise-zenith ;date.sunrise_zenith = 90.833333 ; https://php.net/date.sunset-zenith ;date.sunset_zenith = 90.833333 [filter] ; https://php.net/filter.default ;filter.default = unsafe_raw ; https://php.net/filter.default-flags ;filter.default_flags = [iconv] ; Use of this INI entry is deprecated, use global input_encoding instead. ; If empty, default_charset or input_encoding or iconv.input_encoding is used. ; The precedence is: default_charset < input_encoding < iconv.input_encoding ;iconv.input_encoding = ; Use of this INI entry is deprecated, use global internal_encoding instead. ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;iconv.internal_encoding = ; Use of this INI entry is deprecated, use global output_encoding instead. ; If empty, default_charset or output_encoding or iconv.output_encoding is used. ; The precedence is: default_charset < output_encoding < iconv.output_encoding ; To use an output encoding conversion, iconv's output handler must be set ; otherwise output encoding conversion cannot be performed. ;iconv.output_encoding = [imap] ; rsh/ssh logins are disabled by default. Use this INI entry if you want to ; enable them. Note that the IMAP library does not filter mailbox names before ; passing them to rsh/ssh command, thus passing untrusted data to this function ; with rsh/ssh enabled is insecure. ;imap.enable_insecure_rsh=0 [intl] ;intl.default_locale = ; This directive allows you to produce PHP errors when some error ; happens within intl functions. The value is the level of the error produced. ; Default is 0, which does not produce any errors. ;intl.error_level = E_WARNING ;intl.use_exceptions = 0 [sqlite3] ; Directory pointing to SQLite3 extensions ; https://php.net/sqlite3.extension-dir ;sqlite3.extension_dir = ; SQLite defensive mode flag (only available from SQLite 3.26+) ; When the defensive flag is enabled, language features that allow ordinary ; SQL to deliberately corrupt the database file are disabled. This forbids ; writing directly to the schema, shadow tables (eg. FTS data tables), or ; the sqlite_dbpage virtual table. ; https://www.sqlite.org/c3ref/c_dbconfig_defensive.html ; (for older SQLite versions, this flag has no use) ;sqlite3.defensive = 1 [Pcre] ; PCRE library backtracking limit. ; https://php.net/pcre.backtrack-limit ;pcre.backtrack_limit=100000 ; PCRE library recursion limit. ; Please note that if you set this value to a high number you may consume all ; the available process stack and eventually crash PHP (due to reaching the ; stack size limit imposed by the Operating System). ; https://php.net/pcre.recursion-limit ;pcre.recursion_limit=100000 ; Enables or disables JIT compilation of patterns. This requires the PCRE ; library to be compiled with JIT support. ;pcre.jit=1 [Pdo] ; Whether to pool ODBC connections. Can be one of "strict", "relaxed" or "off" ; https://php.net/pdo-odbc.connection-pooling ;pdo_odbc.connection_pooling=strict [Pdo_mysql] ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. pdo_mysql.default_socket= [Phar] ; https://php.net/phar.readonly ;phar.readonly = On ; https://php.net/phar.require-hash ;phar.require_hash = On ;phar.cache_list = [mail function] ; For Win32 only. ; https://php.net/smtp ;SMTP = localhost ; https://php.net/smtp-port ;smtp_port = 25 ; For Win32 only. ; https://php.net/sendmail-from ;sendmail_from = me@example.com ; For Unix only. You may supply arguments as well (default: "sendmail -t -i"). ; https://php.net/sendmail-path sendmail_path = /usr/sbin/sendmail -t -i ; Force the addition of the specified parameters to be passed as extra parameters ; to the sendmail binary. These parameters will always replace the value of ; the 5th parameter to mail(). ;mail.force_extra_parameters = ; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename mail.add_x_header = Off ; Use mixed LF and CRLF line separators to keep compatibility with some ; RFC 2822 non conformant MTA. mail.mixed_lf_and_crlf = Off ; The path to a log file that will log all mail() calls. Log entries include ; the full path of the script, line number, To address and headers. ;mail.log = ; Log mail to syslog (Event Log on Windows). ;mail.log = syslog [ODBC] ; https://php.net/odbc.default-db ;odbc.default_db = Not yet implemented ; https://php.net/odbc.default-user ;odbc.default_user = Not yet implemented ; https://php.net/odbc.default-pw ;odbc.default_pw = Not yet implemented ; Controls the ODBC cursor model. ; Default: SQL_CURSOR_STATIC (default). ;odbc.default_cursortype ; Allow or prevent persistent links. ; https://php.net/odbc.allow-persistent odbc.allow_persistent = On ; Check that a connection is still valid before reuse. ; https://php.net/odbc.check-persistent odbc.check_persistent = On ; Maximum number of persistent links. -1 means no limit. ; https://php.net/odbc.max-persistent odbc.max_persistent = -1 ; Maximum number of links (persistent + non-persistent). -1 means no limit. ; https://php.net/odbc.max-links odbc.max_links = -1 ; Handling of LONG fields. Returns number of bytes to variables. 0 means ; passthru. ; https://php.net/odbc.defaultlrl odbc.defaultlrl = 4096 ; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char. ; See the documentation on odbc_binmode and odbc_longreadlen for an explanation ; of odbc.defaultlrl and odbc.defaultbinmode ; https://php.net/odbc.defaultbinmode odbc.defaultbinmode = 1 [MySQLi] ; Maximum number of persistent links. -1 means no limit. ; https://php.net/mysqli.max-persistent mysqli.max_persistent = -1 ; Allow accessing, from PHP's perspective, local files with LOAD DATA statements ; https://php.net/mysqli.allow_local_infile ;mysqli.allow_local_infile = On ; It allows the user to specify a folder where files that can be sent via LOAD DATA ; LOCAL can exist. It is ignored if mysqli.allow_local_infile is enabled. ;mysqli.local_infile_directory = ; Allow or prevent persistent links. ; https://php.net/mysqli.allow-persistent mysqli.allow_persistent = On ; Maximum number of links. -1 means no limit. ; https://php.net/mysqli.max-links mysqli.max_links = -1 ; Default port number for mysqli_connect(). If unset, mysqli_connect() will use ; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the ; compile-time value defined MYSQL_PORT (in that order). Win32 will only look ; at MYSQL_PORT. ; https://php.net/mysqli.default-port mysqli.default_port = 3306 ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. ; https://php.net/mysqli.default-socket mysqli.default_socket = ; Default host for mysqli_connect() (doesn't apply in safe mode). ; https://php.net/mysqli.default-host mysqli.default_host = ; Default user for mysqli_connect() (doesn't apply in safe mode). ; https://php.net/mysqli.default-user mysqli.default_user = ; Default password for mysqli_connect() (doesn't apply in safe mode). ; Note that this is generally a *bad* idea to store passwords in this file. ; *Any* user with PHP access can run 'echo get_cfg_var("mysqli.default_pw") ; and reveal this password! And of course, any users with read access to this ; file will be able to reveal the password as well. ; https://php.net/mysqli.default-pw mysqli.default_pw = ; Allow or prevent reconnect mysqli.reconnect = Off ; If this option is enabled, closing a persistent connection will rollback ; any pending transactions of this connection, before it is put back ; into the persistent connection pool. ;mysqli.rollback_on_cached_plink = Off [mysqlnd] ; Enable / Disable collection of general statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. mysqlnd.collect_statistics = 0 ; Enable / Disable collection of memory usage statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. mysqlnd.collect_memory_statistics = 0 ; Records communication from all extensions using mysqlnd to the specified log ; file. ; https://php.net/mysqlnd.debug ;mysqlnd.debug = ; Defines which queries will be logged. ;mysqlnd.log_mask = 0 ; Default size of the mysqlnd memory pool, which is used by result sets. mysqlnd.mempool_default_size = 64000 ; Size of a pre-allocated buffer used when sending commands to MySQL in bytes. mysqlnd.net_cmd_buffer_size = 8192 ; Size of a pre-allocated buffer used for reading data sent by the server in ; bytes. mysqlnd.net_read_buffer_size = 131072 ; Timeout for network requests in seconds. ;mysqlnd.net_read_timeout = 31536000 ; SHA-256 Authentication Plugin related. File with the MySQL server public RSA ; key. ;mysqlnd.sha256_server_public_key = [OCI8] ; Connection: Enables privileged connections using external ; credentials (OCI_SYSOPER, OCI_SYSDBA) ; https://php.net/oci8.privileged-connect ;oci8.privileged_connect = Off ; Connection: The maximum number of persistent OCI8 connections per ; process. Using -1 means no limit. ; https://php.net/oci8.max-persistent ;oci8.max_persistent = -1 ; Connection: The maximum number of seconds a process is allowed to ; maintain an idle persistent connection. Using -1 means idle ; persistent connections will be maintained forever. ; https://php.net/oci8.persistent-timeout ;oci8.persistent_timeout = -1 ; Connection: The number of seconds that must pass before issuing a ; ping during oci_pconnect() to check the connection validity. When ; set to 0, each oci_pconnect() will cause a ping. Using -1 disables ; pings completely. ; https://php.net/oci8.ping-interval ;oci8.ping_interval = 60 ; Connection: Set this to a user chosen connection class to be used ; for all pooled server requests with Oracle Database Resident ; Connection Pooling (DRCP). To use DRCP, this value should be set to ; the same string for all web servers running the same application, ; the database pool must be configured, and the connection string must ; specify to use a pooled server. ;oci8.connection_class = ; High Availability: Using On lets PHP receive Fast Application ; Notification (FAN) events generated when a database node fails. The ; database must also be configured to post FAN events. ;oci8.events = Off ; Tuning: This option enables statement caching, and specifies how ; many statements to cache. Using 0 disables statement caching. ; https://php.net/oci8.statement-cache-size ;oci8.statement_cache_size = 20 ; Tuning: Enables row prefetching and sets the default number of ; rows that will be fetched automatically after statement execution. ; https://php.net/oci8.default-prefetch ;oci8.default_prefetch = 100 ; Tuning: Sets the amount of LOB data that is internally returned from ; Oracle Database when an Oracle LOB locator is initially retrieved as ; part of a query. Setting this can improve performance by reducing ; round-trips. ; https://php.net/oci8.prefetch-lob-size ; oci8.prefetch_lob_size = 0 ; Compatibility. Using On means oci_close() will not close ; oci_connect() and oci_new_connect() connections. ; https://php.net/oci8.old-oci-close-semantics ;oci8.old_oci_close_semantics = Off [PostgreSQL] ; Allow or prevent persistent links. ; https://php.net/pgsql.allow-persistent pgsql.allow_persistent = On ; Detect broken persistent links always with pg_pconnect(). ; Auto reset feature requires a little overheads. ; https://php.net/pgsql.auto-reset-persistent pgsql.auto_reset_persistent = Off ; Maximum number of persistent links. -1 means no limit. ; https://php.net/pgsql.max-persistent pgsql.max_persistent = -1 ; Maximum number of links (persistent+non persistent). -1 means no limit. ; https://php.net/pgsql.max-links pgsql.max_links = -1 ; Ignore PostgreSQL backends Notice message or not. ; Notice message logging require a little overheads. ; https://php.net/pgsql.ignore-notice pgsql.ignore_notice = 0 ; Log PostgreSQL backends Notice message or not. ; Unless pgsql.ignore_notice=0, module cannot log notice message. ; https://php.net/pgsql.log-notice pgsql.log_notice = 0 [bcmath] ; Number of decimal digits for all bcmath functions. ; https://php.net/bcmath.scale bcmath.scale = 0 [browscap] ; https://php.net/browscap ;browscap = extra/browscap.ini [Session] ; Handler used to store/retrieve data. ; https://php.net/session.save-handler session.save_handler = files ; Argument passed to save_handler. In the case of files, this is the path ; where data files are stored. Note: Windows users have to change this ; variable in order to use PHP's session functions. ; ; The path can be defined as: ; ; session.save_path = "N;/path" ; ; where N is an integer. Instead of storing all the session files in ; /path, what this will do is use subdirectories N-levels deep, and ; store the session data in those directories. This is useful if ; your OS has problems with many files in one directory, and is ; a more efficient layout for servers that handle many sessions. ; ; NOTE 1: PHP will not create this directory structure automatically. ; You can use the script in the ext/session dir for that purpose. ; NOTE 2: See the section on garbage collection below if you choose to ; use subdirectories for session storage ; ; The file storage module creates files using mode 600 by default. ; You can change that by using ; ; session.save_path = "N;MODE;/path" ; ; where MODE is the octal representation of the mode. Note that this ; does not overwrite the process's umask. ; https://php.net/session.save-path session.save_path = "/opt/tmp" ; Whether to use strict session mode. ; Strict session mode does not accept an uninitialized session ID, and ; regenerates the session ID if the browser sends an uninitialized session ID. ; Strict mode protects applications from session fixation via a session adoption ; vulnerability. It is disabled by default for maximum compatibility, but ; enabling it is encouraged. ; https://wiki.php.net/rfc/strict_sessions session.use_strict_mode = 0 ; Whether to use cookies. ; https://php.net/session.use-cookies session.use_cookies = 1 ; https://php.net/session.cookie-secure ;session.cookie_secure = ; This option forces PHP to fetch and use a cookie for storing and maintaining ; the session id. We encourage this operation as it's very helpful in combating ; session hijacking when not specifying and managing your own session id. It is ; not the be-all and end-all of session hijacking defense, but it's a good start. ; https://php.net/session.use-only-cookies session.use_only_cookies = 1 ; Name of the session (used as cookie name). ; https://php.net/session.name session.name = PHPSESSID ; Initialize session on request startup. ; https://php.net/session.auto-start session.auto_start = 0 ; Lifetime in seconds of cookie or, if 0, until browser is restarted. ; https://php.net/session.cookie-lifetime session.cookie_lifetime = 0 ; The path for which the cookie is valid. ; https://php.net/session.cookie-path session.cookie_path = / ; The domain for which the cookie is valid. ; https://php.net/session.cookie-domain session.cookie_domain = ; Whether or not to add the httpOnly flag to the cookie, which makes it ; inaccessible to browser scripting languages such as JavaScript. ; https://php.net/session.cookie-httponly session.cookie_httponly = 1 ; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF) ; Current valid values are "Strict", "Lax" or "None". When using "None", ; make sure to include the quotes, as `none` is interpreted like `false` in ini files. ; https://tools.ietf.org/html/draft-west-first-party-cookies-07 session.cookie_samesite = ; Handler used to serialize data. php is the standard serializer of PHP. ; https://php.net/session.serialize-handler session.serialize_handler = php ; Defines the probability that the 'garbage collection' process is started on every ; session initialization. The probability is calculated by using gc_probability/gc_divisor, ; e.g. 1/100 means there is a 1% chance that the GC process starts on each request. ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; https://php.net/session.gc-probability session.gc_probability = 1 ; Defines the probability that the 'garbage collection' process is started on every ; session initialization. The probability is calculated by using gc_probability/gc_divisor, ; e.g. 1/100 means there is a 1% chance that the GC process starts on each request. ; For high volume production servers, using a value of 1000 is a more efficient approach. ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; https://php.net/session.gc-divisor session.gc_divisor = 1000 ; After this number of seconds, stored data will be seen as 'garbage' and ; cleaned up by the garbage collection process. ; https://php.net/session.gc-maxlifetime session.gc_maxlifetime = 1440 ; NOTE: If you are using the subdirectory option for storing session files ; (see session.save_path above), then garbage collection does *not* ; happen automatically. You will need to do your own garbage ; collection through a shell script, cron entry, or some other method. ; For example, the following script is the equivalent of setting ; session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes): ; find /path/to/sessions -cmin +24 -type f | xargs rm ; Check HTTP Referer to invalidate externally stored URLs containing ids. ; HTTP_REFERER has to contain this substring for the session to be ; considered as valid. ; https://php.net/session.referer-check session.referer_check = ; Set to {nocache,private,public,} to determine HTTP caching aspects ; or leave this empty to avoid sending anti-caching headers. ; https://php.net/session.cache-limiter session.cache_limiter = nocache ; Document expires after n minutes. ; https://php.net/session.cache-expire session.cache_expire = 180 ; trans sid support is disabled by default. ; Use of trans sid may risk your users' security. ; Use this option with caution. ; - User may send URL contains active session ID ; to other person via. email/irc/etc. ; - URL that contains active session ID may be stored ; in publicly accessible computer. ; - User may access your site with the same session ID ; always using URL stored in browser's history or bookmarks. ; https://php.net/session.use-trans-sid session.use_trans_sid = 0 ; Set session ID character length. This value could be between 22 to 256. ; Shorter length than default is supported only for compatibility reason. ; Users should use 32 or more chars. ; https://php.net/session.sid-length ; Default Value: 32 ; Development Value: 26 ; Production Value: 26 session.sid_length = 26 ; The URL rewriter will look for URLs in a defined set of HTML tags. ; is special; if you include them here, the rewriter will ; add a hidden field with the info which is otherwise appended ; to URLs. tag's action attribute URL will not be modified ; unless it is specified. ; Note that all valid entries require a "=", even if no value follows. ; Default Value: "a=href,area=href,frame=src,form=" ; Development Value: "a=href,area=href,frame=src,form=" ; Production Value: "a=href,area=href,frame=src,form=" ; https://php.net/url-rewriter.tags session.trans_sid_tags = "a=href,area=href,frame=src,form=" ; URL rewriter does not rewrite absolute URLs by default. ; To enable rewrites for absolute paths, target hosts must be specified ; at RUNTIME. i.e. use ini_set() ; tags is special. PHP will check action attribute's URL regardless ; of session.trans_sid_tags setting. ; If no host is defined, HTTP_HOST will be used for allowed host. ; Example value: php.net,www.php.net,wiki.php.net ; Use "," for multiple hosts. No spaces are allowed. ; Default Value: "" ; Development Value: "" ; Production Value: "" ;session.trans_sid_hosts="" ; Define how many bits are stored in each character when converting ; the binary hash data to something readable. ; Possible values: ; 4 (4 bits: 0-9, a-f) ; 5 (5 bits: 0-9, a-v) ; 6 (6 bits: 0-9, a-z, A-Z, "-", ",") ; Default Value: 4 ; Development Value: 5 ; Production Value: 5 ; https://php.net/session.hash-bits-per-character session.sid_bits_per_character = 5 ; Enable upload progress tracking in $_SESSION ; Default Value: On ; Development Value: On ; Production Value: On ; https://php.net/session.upload-progress.enabled ;session.upload_progress.enabled = On ; Cleanup the progress information as soon as all POST data has been read ; (i.e. upload completed). ; Default Value: On ; Development Value: On ; Production Value: On ; https://php.net/session.upload-progress.cleanup ;session.upload_progress.cleanup = On ; A prefix used for the upload progress key in $_SESSION ; Default Value: "upload_progress_" ; Development Value: "upload_progress_" ; Production Value: "upload_progress_" ; https://php.net/session.upload-progress.prefix ;session.upload_progress.prefix = "upload_progress_" ; The index name (concatenated with the prefix) in $_SESSION ; containing the upload progress information ; Default Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Development Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Production Value: "PHP_SESSION_UPLOAD_PROGRESS" ; https://php.net/session.upload-progress.name ;session.upload_progress.name = "PHP_SESSION_UPLOAD_PROGRESS" ; How frequently the upload progress should be updated. ; Given either in percentages (per-file), or in bytes ; Default Value: "1%" ; Development Value: "1%" ; Production Value: "1%" ; https://php.net/session.upload-progress.freq ;session.upload_progress.freq = "1%" ; The minimum delay between updates, in seconds ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; https://php.net/session.upload-progress.min-freq ;session.upload_progress.min_freq = "1" ; Only write session data when session data is changed. Enabled by default. ; https://php.net/session.lazy-write ;session.lazy_write = On [Assertion] ; Switch whether to compile assertions at all (to have no overhead at run-time) ; -1: Do not compile at all ; 0: Jump over assertion at run-time ; 1: Execute assertions ; Changing from or to a negative value is only possible in php.ini! ; (For turning assertions on and off at run-time, toggle zend.assertions between the values 1 and 0) ; Default Value: 1 ; Development Value: 1 ; Production Value: -1 ; https://php.net/zend.assertions zend.assertions = -1 [COM] ; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs ; https://php.net/com.typelib-file ;com.typelib_file = ; allow Distributed-COM calls ; https://php.net/com.allow-dcom ;com.allow_dcom = true ; autoregister constants of a component's typelib on com_load() ; https://php.net/com.autoregister-typelib ;com.autoregister_typelib = true ; register constants casesensitive ; https://php.net/com.autoregister-casesensitive ;com.autoregister_casesensitive = false ; show warnings on duplicate constant registrations ; https://php.net/com.autoregister-verbose ;com.autoregister_verbose = true ; The default character set code-page to use when passing strings to and from COM objects. ; Default: system ANSI code page ;com.code_page= ; The version of the .NET framework to use. The value of the setting are the first three parts ; of the framework's version number, separated by dots, and prefixed with "v", e.g. "v4.0.30319". ;com.dotnet_version= [mbstring] ; language for internal character representation. ; This affects mb_send_mail() and mbstring.detect_order. ; https://php.net/mbstring.language ;mbstring.language = Japanese ; Use of this INI entry is deprecated, use global internal_encoding instead. ; internal/script encoding. ; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*) ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;mbstring.internal_encoding = ; Use of this INI entry is deprecated, use global input_encoding instead. ; http input encoding. ; mbstring.encoding_translation = On is needed to use this setting. ; If empty, default_charset or input_encoding or mbstring.input is used. ; The precedence is: default_charset < input_encoding < mbstring.http_input ; https://php.net/mbstring.http-input ;mbstring.http_input = ; Use of this INI entry is deprecated, use global output_encoding instead. ; http output encoding. ; mb_output_handler must be registered as output buffer to function. ; If empty, default_charset or output_encoding or mbstring.http_output is used. ; The precedence is: default_charset < output_encoding < mbstring.http_output ; To use an output encoding conversion, mbstring's output handler must be set ; otherwise output encoding conversion cannot be performed. ; https://php.net/mbstring.http-output ;mbstring.http_output = ; enable automatic encoding translation according to ; mbstring.internal_encoding setting. Input chars are ; converted to internal encoding by setting this to On. ; Note: Do _not_ use automatic encoding translation for ; portable libs/applications. ; https://php.net/mbstring.encoding-translation ;mbstring.encoding_translation = Off ; automatic encoding detection order. ; "auto" detect order is changed according to mbstring.language ; https://php.net/mbstring.detect-order ;mbstring.detect_order = auto ; substitute_character used when character cannot be converted ; one from another ; https://php.net/mbstring.substitute-character ;mbstring.substitute_character = none ; Enable strict encoding detection. ;mbstring.strict_detection = Off ; This directive specifies the regex pattern of content types for which mb_output_handler() ; is activated. ; Default: mbstring.http_output_conv_mimetypes=^(text/|application/xhtml\+xml) ;mbstring.http_output_conv_mimetypes= ; This directive specifies maximum stack depth for mbstring regular expressions. It is similar ; to the pcre.recursion_limit for PCRE. ;mbstring.regex_stack_limit=100000 ; This directive specifies maximum retry count for mbstring regular expressions. It is similar ; to the pcre.backtrack_limit for PCRE. ;mbstring.regex_retry_limit=1000000 [gd] ; Tell the jpeg decode to ignore warnings and try to create ; a gd image. The warning will then be displayed as notices ; disabled by default ; https://php.net/gd.jpeg-ignore-warning ;gd.jpeg_ignore_warning = 1 [exif] ; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS. ; With mbstring support this will automatically be converted into the encoding ; given by corresponding encode setting. When empty mbstring.internal_encoding ; is used. For the decode settings you can distinguish between motorola and ; intel byte order. A decode setting cannot be empty. ; https://php.net/exif.encode-unicode ;exif.encode_unicode = ISO-8859-15 ; https://php.net/exif.decode-unicode-motorola ;exif.decode_unicode_motorola = UCS-2BE ; https://php.net/exif.decode-unicode-intel ;exif.decode_unicode_intel = UCS-2LE ; https://php.net/exif.encode-jis ;exif.encode_jis = ; https://php.net/exif.decode-jis-motorola ;exif.decode_jis_motorola = JIS ; https://php.net/exif.decode-jis-intel ;exif.decode_jis_intel = JIS [Tidy] ; The path to a default tidy configuration file to use when using tidy ; https://php.net/tidy.default-config ;tidy.default_config = /usr/local/lib/php/default.tcfg ; Should tidy clean and repair output automatically? ; WARNING: Do not use this option if you are generating non-html content ; such as dynamic images ; https://php.net/tidy.clean-output tidy.clean_output = Off [soap] ; Enables or disables WSDL caching feature. ; https://php.net/soap.wsdl-cache-enabled soap.wsdl_cache_enabled=1 ; Sets the directory name where SOAP extension will put cache files. ; https://php.net/soap.wsdl-cache-dir soap.wsdl_cache_dir="/tmp" ; (time to live) Sets the number of second while cached file will be used ; instead of original one. ; https://php.net/soap.wsdl-cache-ttl soap.wsdl_cache_ttl=86400 ; Sets the size of the cache limit. (Max. number of WSDL files to cache) soap.wsdl_cache_limit = 5 [sysvshm] ; A default size of the shared memory segment ;sysvshm.init_mem = 10000 [ldap] ; Sets the maximum number of open links or -1 for unlimited. ldap.max_links = -1 [dba] ;dba.default_handler= [opcache] ; Determines if Zend OPCache is enabled ;opcache.enable=1 ; Determines if Zend OPCache is enabled for the CLI version of PHP ;opcache.enable_cli=0 ; The OPcache shared memory storage size. ;opcache.memory_consumption=128 ; The amount of memory for interned strings in Mbytes. ;opcache.interned_strings_buffer=8 ; The maximum number of keys (scripts) in the OPcache hash table. ; Only numbers between 200 and 1000000 are allowed. ;opcache.max_accelerated_files=10000 ; The maximum percentage of "wasted" memory until a restart is scheduled. ;opcache.max_wasted_percentage=5 ; When this directive is enabled, the OPcache appends the current working ; directory to the script key, thus eliminating possible collisions between ; files with the same name (basename). Disabling the directive improves ; performance, but may break existing applications. ;opcache.use_cwd=1 ; When disabled, you must reset the OPcache manually or restart the ; webserver for changes to the filesystem to take effect. ;opcache.validate_timestamps=1 ; How often (in seconds) to check file timestamps for changes to the shared ; memory storage allocation. ("1" means validate once per second, but only ; once per request. "0" means always validate) ;opcache.revalidate_freq=2 ; Enables or disables file search in include_path optimization ;opcache.revalidate_path=0 ; If disabled, all PHPDoc comments are dropped from the code to reduce the ; size of the optimized code. ;opcache.save_comments=1 ; If enabled, compilation warnings (including notices and deprecations) will ; be recorded and replayed each time a file is included. Otherwise, compilation ; warnings will only be emitted when the file is first cached. ;opcache.record_warnings=0 ; Allow file existence override (file_exists, etc.) performance feature. ;opcache.enable_file_override=0 ; A bitmask, where each bit enables or disables the appropriate OPcache ; passes ;opcache.optimization_level=0x7FFFBFFF ;opcache.dups_fix=0 ; The location of the OPcache blacklist file (wildcards allowed). ; Each OPcache blacklist file is a text file that holds the names of files ; that should not be accelerated. The file format is to add each filename ; to a new line. The filename may be a full path or just a file prefix ; (i.e., /var/www/x blacklists all the files and directories in /var/www ; that start with 'x'). Line starting with a ; are ignored (comments). ;opcache.blacklist_filename= ; Allows exclusion of large files from being cached. By default all files ; are cached. ;opcache.max_file_size=0 ; How long to wait (in seconds) for a scheduled restart to begin if the cache ; is not being accessed. ;opcache.force_restart_timeout=180 ; OPcache error_log file name. Empty string assumes "stderr". ;opcache.error_log= ; All OPcache errors go to the Web server log. ; By default, only fatal errors (level 0) or errors (level 1) are logged. ; You can also enable warnings (level 2), info messages (level 3) or ; debug messages (level 4). ;opcache.log_verbosity_level=1 ; Preferred Shared Memory back-end. Leave empty and let the system decide. ;opcache.preferred_memory_model= ; Protect the shared memory from unexpected writing during script execution. ; Useful for internal debugging only. ;opcache.protect_memory=0 ; Allows calling OPcache API functions only from PHP scripts which path is ; started from specified string. The default "" means no restriction ;opcache.restrict_api= ; Mapping base of shared memory segments (for Windows only). All the PHP ; processes have to map shared memory into the same address space. This ; directive allows to manually fix the "Unable to reattach to base address" ; errors. ;opcache.mmap_base= ; Facilitates multiple OPcache instances per user (for Windows only). All PHP ; processes with the same cache ID and user share an OPcache instance. ;opcache.cache_id= ; Enables and sets the second level cache directory. ; It should improve performance when SHM memory is full, at server restart or ; SHM reset. The default "" disables file based caching. ;opcache.file_cache= ; Enables or disables opcode caching in shared memory. ;opcache.file_cache_only=0 ; Enables or disables checksum validation when script loaded from file cache. ;opcache.file_cache_consistency_checks=1 ; Implies opcache.file_cache_only=1 for a certain process that failed to ; reattach to the shared memory (for Windows only). Explicitly enabled file ; cache is required. ;opcache.file_cache_fallback=1 ; Enables or disables copying of PHP code (text segment) into HUGE PAGES. ; Under certain circumstances (if only a single global PHP process is ; started from which all others fork), this can increase performance ; by a tiny amount because TLB misses are reduced. On the other hand, this ; delays PHP startup, increases memory usage and degrades performance ; under memory pressure - use with care. ; Requires appropriate OS configuration. ;opcache.huge_code_pages=0 ; Validate cached file permissions. ;opcache.validate_permission=0 ; Prevent name collisions in chroot'ed environment. ;opcache.validate_root=0 ; If specified, it produces opcode dumps for debugging different stages of ; optimizations. ;opcache.opt_debug_level=0 ; Specifies a PHP script that is going to be compiled and executed at server ; start-up. ; https://php.net/opcache.preload ;opcache.preload= ; Preloading code as root is not allowed for security reasons. This directive ; facilitates to let the preloading to be run as another user. ; https://php.net/opcache.preload_user ;opcache.preload_user= ; Prevents caching files that are less than this number of seconds old. It ; protects from caching of incompletely updated files. In case all file updates ; on your site are atomic, you may increase performance by setting it to "0". ;opcache.file_update_protection=2 ; Absolute path used to store shared lockfiles (for *nix only). ;opcache.lockfile_path=/tmp [curl] ; A default value for the CURLOPT_CAINFO option. This is required to be an ; absolute path. ;curl.cainfo = [openssl] ; The location of a Certificate Authority (CA) file on the local filesystem ; to use when verifying the identity of SSL/TLS peers. Most users should ; not specify a value for this directive as PHP will attempt to use the ; OS-managed cert stores in its absence. If specified, this value may still ; be overridden on a per-stream basis via the "cafile" SSL stream context ; option. ;openssl.cafile= ; If openssl.cafile is not specified or if the CA file is not found, the ; directory pointed to by openssl.capath is searched for a suitable ; certificate. This value must be a correctly hashed certificate directory. ; Most users should not specify a value for this directive as PHP will ; attempt to use the OS-managed cert stores in its absence. If specified, ; this value may still be overridden on a per-stream basis via the "capath" ; SSL stream context option. ;openssl.capath= [ffi] ; FFI API restriction. Possible values: ; "preload" - enabled in CLI scripts and preloaded files (default) ; "false" - always disabled ; "true" - always enabled ;ffi.enable=preload ; List of headers files to preload, wildcard patterns allowed. ;ffi.preload= [Zend] zend_extension="/usr/local/ioncube/ioncube_loader_lin_8.3.so" ; fix for segfaults auto_globals_jit = Off cgi.fix_pathinfo = 1 mbstring.http_input = "pass" mbstring.http_output = "pass" mbstring.encoding_translation = 0 ; Enable Extensions extension=uploadprogress.so extension=imagick.so extension=redis.so ; APCu extension=apcu.so apc.enable_cli=1 apc.gc_ttl=300 apc.shm_segments=1 apc.shm_size=256M apc.slam_defense=0 apc.ttl=0 ; ================================================ FILE: aegir/conf/php/php84-cli.ini ================================================ [PHP] ;;;;;;;;;;;;;;;;;;; ; About php.ini ; ;;;;;;;;;;;;;;;;;;; ; PHP's initialization file, generally called php.ini, is responsible for ; configuring many of the aspects of PHP's behavior. ; PHP attempts to find and load this configuration from a number of locations. ; The following is a summary of its search order: ; 1. SAPI module specific location. ; 2. The PHPRC environment variable. ; 3. A number of predefined registry keys on Windows ; 4. Current working directory (except CLI) ; 5. The web server's directory (for SAPI modules), or directory of PHP ; (otherwise in Windows) ; 6. The directory from the --with-config-file-path compile time option, or the ; Windows directory (usually C:\windows) ; See the PHP docs for more specific information. ; https://php.net/configuration.file ; The syntax of the file is extremely simple. Whitespace and lines ; beginning with a semicolon are silently ignored (as you probably guessed). ; Section headers (e.g. [Foo]) are also silently ignored, even though ; they might mean something in the future. ; Directives following the section heading [PATH=/www/mysite] only ; apply to PHP files in the /www/mysite directory. Directives ; following the section heading [HOST=www.example.com] only apply to ; PHP files served from www.example.com. Directives set in these ; special sections cannot be overridden by user-defined INI files or ; at runtime. Currently, [PATH=] and [HOST=] sections only work under ; CGI/FastCGI. ; https://php.net/ini.sections ; Directives are specified using the following syntax: ; directive = value ; Directive names are *case sensitive* - foo=bar is different from FOO=bar. ; Directives are variables used to configure PHP or PHP extensions. ; There is no name validation. If PHP can't find an expected ; directive because it is not set or is mistyped, a default value will be used. ; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one ; of the INI constants (On, Off, True, False, Yes, No and None) or an expression ; (e.g. E_ALL & ~E_NOTICE), a quoted string ("bar"), or a reference to a ; previously set variable or directive (e.g. ${foo}) ; Expressions in the INI file are limited to bitwise operators and parentheses: ; | bitwise OR ; ^ bitwise XOR ; & bitwise AND ; ~ bitwise NOT ; ! boolean NOT ; Boolean flags can be turned on using the values 1, On, True or Yes. ; They can be turned off using the values 0, Off, False or No. ; An empty string can be denoted by simply not writing anything after the equal ; sign, or by using the None keyword: ; foo = ; sets foo to an empty string ; foo = None ; sets foo to an empty string ; foo = "None" ; sets foo to the string 'None' ; If you use constants in your value, and these constants belong to a ; dynamically loaded extension (either a PHP extension or a Zend extension), ; you may only use these constants *after* the line that loads the extension. ;;;;;;;;;;;;;;;;;;; ; About this file ; ;;;;;;;;;;;;;;;;;;; ; PHP comes packaged with two INI files. One that is recommended to be used ; in production environments and one that is recommended to be used in ; development environments. ; php.ini-production contains settings which hold security, performance and ; best practices at its core. But please be aware, these settings may break ; compatibility with older or less security-conscious applications. We ; recommending using the production ini in production and testing environments. ; php.ini-development is very similar to its production variant, except it is ; much more verbose when it comes to errors. We recommend using the ; development version only in development environments, as errors shown to ; application users can inadvertently leak otherwise secure information. ; This is the php.ini-production INI file. ;;;;;;;;;;;;;;;;;;; ; Quick Reference ; ;;;;;;;;;;;;;;;;;;; ; The following are all the settings which are different in either the production ; or development versions of the INIs with respect to PHP's default behavior. ; Please see the actual settings later in the document for more details as to why ; we recommend these changes in PHP's behavior. display_errors = Off ; Default Value: On ; Development Value: On ; Production Value: Off ; display_startup_errors ; Default Value: On ; Development Value: On ; Production Value: Off ; error_reporting ; Default Value: E_ALL ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED ; log_errors ; Default Value: Off ; Development Value: On ; Production Value: On ; max_input_time ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; output_buffering ; Default Value: Off ; Development Value: 4096 ; Production Value: 4096 ; register_argc_argv ; Default Value: On ; Development Value: Off ; Production Value: Off ; request_order ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; session.gc_divisor ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; short_open_tag ; Default Value: On ; Development Value: Off ; Production Value: Off ; variables_order ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS" ; zend.assertions ; Default Value: 1 ; Development Value: 1 ; Production Value: -1 ; zend.exception_ignore_args ; Default Value: Off ; Development Value: Off ; Production Value: On ; zend.exception_string_param_max_len ; Default Value: 15 ; Development Value: 15 ; Production Value: 0 ;;;;;;;;;;;;;;;;;;;; ; php.ini Options ; ;;;;;;;;;;;;;;;;;;;; ; Name for user-defined php.ini (.htaccess) files. Default is ".user.ini" ;user_ini.filename = ".user.ini" ; To disable this feature set this option to an empty value user_ini.filename = ; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes) ;user_ini.cache_ttl = 300 ;;;;;;;;;;;;;;;;;;;; ; Language Options ; ;;;;;;;;;;;;;;;;;;;; ; Enable the PHP scripting language engine under Apache. ; https://php.net/engine engine = On ; This directive determines whether or not PHP will recognize code between ; tags as PHP source which should be processed as such. It is ; generally recommended that should be used and that this feature ; should be disabled, as enabling it may result in issues when generating XML ; documents, however this remains supported for backward compatibility reasons. ; Note that this directive does not control the would work. ; https://php.net/syntax-highlighting ;highlight.string = #DD0000 ;highlight.comment = #FF9900 ;highlight.keyword = #007700 ;highlight.default = #0000BB ;highlight.html = #000000 ; If enabled, the request will be allowed to complete even if the user aborts ; the request. Consider enabling it if executing long requests, which may end up ; being interrupted by the user or a browser timing out. PHP's default behavior ; is to disable this feature. ; https://php.net/ignore-user-abort ;ignore_user_abort = On ; Determines the size of the realpath cache to be used by PHP. This value should ; be increased on systems where PHP opens many files to reflect the quantity of ; the file operations performed. ; Note: if open_basedir is set, the cache is disabled ; https://php.net/realpath-cache-size realpath_cache_size=64M ; Duration of time, in seconds for which to cache realpath information for a given ; file or directory. For systems with rarely changing files, consider increasing this ; value. ; https://php.net/realpath-cache-ttl realpath_cache_ttl=5 ; Enables or disables the circular reference collector. ; https://php.net/zend.enable-gc zend.enable_gc = On ; If enabled, scripts may be written in encodings that are incompatible with ; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such ; encodings. To use this feature, mbstring extension must be enabled. ;zend.multibyte = Off ; Allows to set the default encoding for the scripts. This value will be used ; unless "declare(encoding=...)" directive appears at the top of the script. ; Only affects if zend.multibyte is set. ;zend.script_encoding = ; Allows to include or exclude arguments from stack traces generated for exceptions. ; In production, it is recommended to turn this setting on to prohibit the output ; of sensitive information in stack traces ; Default Value: Off ; Development Value: Off ; Production Value: On zend.exception_ignore_args = On ; Allows setting the maximum string length in an argument of a stringified stack trace ; to a value between 0 and 1000000. ; This has no effect when zend.exception_ignore_args is enabled. ; Default Value: 15 ; Development Value: 15 ; Production Value: 0 ; In production, it is recommended to set this to 0 to reduce the output ; of sensitive information in stack traces. zend.exception_string_param_max_len = 0 ;;;;;;;;;;;;;;;;; ; Miscellaneous ; ;;;;;;;;;;;;;;;;; ; Decides whether PHP may expose the fact that it is installed on the server ; (e.g. by adding its signature to the Web server header). It is no security ; threat in any way, but it makes it possible to determine whether you use PHP ; on your server or not. ; https://php.net/expose-php expose_php = On ;;;;;;;;;;;;;;;;;;; ; Resource Limits ; ;;;;;;;;;;;;;;;;;;; ; Maximum execution time of each script, in seconds ; https://php.net/max-execution-time ; Note: This directive is hardcoded to 0 for the CLI SAPI max_execution_time = 3600 ; Maximum amount of time each script may spend parsing request data. It's a good ; idea to limit this time on productions servers in order to eliminate unexpectedly ; long running scripts. ; Note: This directive is hardcoded to -1 for the CLI SAPI ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; https://php.net/max-input-time max_input_time = 3600 ; Maximum input variable nesting level ; https://php.net/max-input-nesting-level ;max_input_nesting_level = 64 ; How many GET/POST/COOKIE input variables may be accepted max_input_vars = 9999 ; How many multipart body parts (combined input variable and file uploads) may ; be accepted. ; Default Value: -1 (Sum of max_input_vars and max_file_uploads) ;max_multipart_body_parts = 1500 ; Maximum amount of memory a script may consume ; https://php.net/memory-limit memory_limit = 395M ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; Error handling and logging ; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; This directive informs PHP of which errors, warnings and notices you would like ; it to take action for. The recommended way of setting values for this ; directive is through the use of the error level constants and bitwise ; operators. The error level constants are below here for convenience as well as ; some common settings and their meanings. ; By default, PHP is set to take action on all errors, notices and warnings EXCEPT ; those related to E_NOTICE, which together cover best practices and ; recommended coding standards in PHP. For performance reasons, this is the ; recommend error reporting setting. Your production server shouldn't be wasting ; resources complaining about best practices and coding standards. That's what ; development servers and development settings are for. ; Note: The php.ini-development file has this setting as E_ALL. This ; means it pretty much reports everything which is exactly what you want during ; development and early testing. ; ; Error Level Constants: ; E_ALL - All errors and warnings ; E_ERROR - fatal run-time errors ; E_RECOVERABLE_ERROR - almost fatal run-time errors ; E_WARNING - run-time warnings (non-fatal errors) ; E_PARSE - compile-time parse errors ; E_NOTICE - run-time notices (these are warnings which often result ; from a bug in your code, but it's possible that it was ; intentional (e.g., using an uninitialized variable and ; relying on the fact it is automatically initialized to an ; empty string) ; E_CORE_ERROR - fatal errors that occur during PHP's initial startup ; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's ; initial startup ; E_COMPILE_ERROR - fatal compile-time errors ; E_COMPILE_WARNING - compile-time warnings (non-fatal errors) ; E_USER_ERROR - user-generated error message ; E_USER_WARNING - user-generated warning message ; E_USER_NOTICE - user-generated notice message ; E_DEPRECATED - warn about code that will not work in future versions ; of PHP ; E_USER_DEPRECATED - user-generated deprecation warnings ; ; Common Values: ; E_ALL (Show all errors, warnings and notices including coding standards.) ; E_ALL & ~E_NOTICE (Show all errors, except for notices) ; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors) ; Default Value: E_ALL ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED ; https://php.net/error-reporting error_reporting = 1 ; This directive controls whether or not and where PHP will output errors, ; notices and warnings too. Error output is very useful during development, but ; it could be very dangerous in production environments. Depending on the code ; which is triggering the error, sensitive information could potentially leak ; out of your application such as database usernames and passwords or worse. ; For production environments, we recommend logging errors rather than ; sending them to STDOUT. ; Possible Values: ; Off = Do not display any errors ; stderr = Display errors to STDERR (affects only CGI/CLI binaries!) ; On or stdout = Display errors to STDOUT ; Default Value: On ; Development Value: On ; Production Value: Off ; https://php.net/display-errors display_errors = Off ; The display of errors which occur during PHP's startup sequence are handled ; separately from display_errors. We strongly recommend you set this to 'off' ; for production servers to avoid leaking configuration details. ; Default Value: On ; Development Value: On ; Production Value: Off ; https://php.net/display-startup-errors display_startup_errors = Off ; Besides displaying errors, PHP can also log errors to locations such as a ; server-specific log, STDERR, or a location specified by the error_log ; directive found below. While errors should not be displayed on productions ; servers they should still be monitored and logging is a great way to do that. ; Default Value: Off ; Development Value: On ; Production Value: On ; https://php.net/log-errors log_errors = On ; Do not log repeated messages. Repeated errors must occur in same file on same ; line unless ignore_repeated_source is set true. ; https://php.net/ignore-repeated-errors ignore_repeated_errors = Off ; Ignore source of message when ignoring repeated messages. When this setting ; is On you will not log errors with repeated messages from different files or ; source lines. ; https://php.net/ignore-repeated-source ignore_repeated_source = Off ; If this parameter is set to Off, then memory leaks will not be shown (on ; stdout or in the log). This is only effective in a debug compile, and if ; error reporting includes E_WARNING in the allowed list ; https://php.net/report-memleaks report_memleaks = On ; This setting is off by default. ;report_zend_debug = 0 ; Turn off normal error reporting and emit XML-RPC error XML ; https://php.net/xmlrpc-errors ;xmlrpc_errors = 0 ; An XML-RPC faultCode ;xmlrpc_error_number = 0 ; When PHP displays or logs an error, it has the capability of formatting the ; error message as HTML for easier reading. This directive controls whether ; the error message is formatted as HTML or not. ; Note: This directive is hardcoded to Off for the CLI SAPI ; https://php.net/html-errors html_errors = Off ; If html_errors is set to On *and* docref_root is not empty, then PHP ; produces clickable error messages that direct to a page describing the error ; or function causing the error in detail. ; You can download a copy of the PHP manual from https://php.net/docs ; and change docref_root to the base URL of your local copy including the ; leading '/'. You must also specify the file extension being used including ; the dot. PHP's default behavior is to leave these settings empty, in which ; case no links to documentation are generated. ; Note: Never use this feature for production boxes. ; https://php.net/docref-root ; Examples ;docref_root = "/phpmanual/" ; https://php.net/docref-ext ;docref_ext = .html ; String to output before an error message. PHP's default behavior is to leave ; this setting blank. ; https://php.net/error-prepend-string ; Example: ;error_prepend_string = "" ; String to output after an error message. PHP's default behavior is to leave ; this setting blank. ; https://php.net/error-append-string ; Example: ;error_append_string = "" ; Log errors to specified file. PHP's default behavior is to leave this value ; empty. ; https://php.net/error-log ; Example: ;error_log = php_errors.log ; Log errors to syslog (Event Log on Windows). ;error_log = syslog error_log = /var/log/php/error_log_cli_84 ; The syslog ident is a string which is prepended to every message logged ; to syslog. Only used when error_log is set to syslog. ;syslog.ident = php ; The syslog facility is used to specify what type of program is logging ; the message. Only used when error_log is set to syslog. ;syslog.facility = user ; Set this to disable filtering control characters (the default). ; Some loggers only accept NVT-ASCII, others accept anything that's not ; control characters. If your logger accepts everything, then no filtering ; is needed at all. ; Allowed values are: ; ascii (all printable ASCII characters and NL) ; no-ctrl (all characters except control characters) ; all (all characters) ; raw (like "all", but messages are not split at newlines) ; https://php.net/syslog.filter ;syslog.filter = ascii ;windows.show_crt_warning ; Default value: 0 ; Development value: 0 ; Production value: 0 ;;;;;;;;;;;;;;;;; ; Data Handling ; ;;;;;;;;;;;;;;;;; ; The separator used in PHP generated URLs to separate arguments. ; PHP's default setting is "&". ; https://php.net/arg-separator.output ; Example: ;arg_separator.output = "&" ; List of separator(s) used by PHP to parse input URLs into variables. ; PHP's default setting is "&". ; NOTE: Every character in this directive is considered as separator! ; https://php.net/arg-separator.input ; Example: ;arg_separator.input = ";&" ; This directive determines which super global arrays are registered when PHP ; starts up. G,P,C,E & S are abbreviations for the following respective super ; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty ; paid for the registration of these arrays and because ENV is not as commonly ; used as the others, ENV is not recommended on productions servers. You ; can still get access to the environment variables through getenv() should you ; need to. ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS"; ; https://php.net/variables-order variables_order = "GPCS" ; This directive determines which super global data (G,P & C) should be ; registered into the super global array REQUEST. If so, it also determines ; the order in which that data is registered. The values for this directive ; are specified in the same manner as the variables_order directive, ; EXCEPT one. Leaving this value empty will cause PHP to use the value set ; in the variables_order directive. It does not mean it will leave the super ; globals array REQUEST empty. ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; https://php.net/request-order request_order = "GP" ; This directive determines whether PHP registers $argv & $argc each time it ; runs. $argv contains an array of all the arguments passed to PHP when a script ; is invoked. $argc contains an integer representing the number of arguments ; that were passed when the script was invoked. These arrays are extremely ; useful when running scripts from the command line. When this directive is ; enabled, registering these variables consumes CPU cycles and memory each time ; a script is executed. For performance reasons, this feature should be disabled ; on production servers. ; Note: This directive is hardcoded to On for the CLI SAPI ; Default Value: On ; Development Value: Off ; Production Value: Off ; https://php.net/register-argc-argv register_argc_argv = Off ; When enabled, the ENV, REQUEST and SERVER variables are created when they're ; first used (Just In Time) instead of when the script starts. If these ; variables are not used within a script, having this directive on will result ; in a performance gain. The PHP directive register_argc_argv must be disabled ; for this directive to have any effect. ; https://php.net/auto-globals-jit auto_globals_jit = On ; Whether PHP will read the POST data. ; This option is enabled by default. ; Most likely, you won't want to disable this option globally. It causes $_POST ; and $_FILES to always be empty; the only way you will be able to read the ; POST data will be through the php://input stream wrapper. This can be useful ; to proxy requests or to process the POST data in a memory efficient fashion. ; https://php.net/enable-post-data-reading ;enable_post_data_reading = Off ; Maximum size of POST data that PHP will accept. ; Its value may be 0 to disable the limit. It is ignored if POST data reading ; is disabled through enable_post_data_reading. ; https://php.net/post-max-size post_max_size = 350M ; Automatically add files before PHP document. ; https://php.net/auto-prepend-file auto_prepend_file = ; Automatically add files after PHP document. ; https://php.net/auto-append-file auto_append_file = ; By default, PHP will output a media type using the Content-Type header. To ; disable this, simply set it to be empty. ; ; PHP's built-in default media type is set to text/html. ; https://php.net/default-mimetype default_mimetype = "text/html" ; PHP's default character set is set to UTF-8. ; https://php.net/default-charset default_charset = "UTF-8" ; PHP internal character encoding is set to empty. ; If empty, default_charset is used. ; https://php.net/internal-encoding ;internal_encoding = ; PHP input character encoding is set to empty. ; If empty, default_charset is used. ; https://php.net/input-encoding ;input_encoding = ; PHP output character encoding is set to empty. ; If empty, default_charset is used. ; See also output_buffer. ; https://php.net/output-encoding ;output_encoding = ;;;;;;;;;;;;;;;;;;;;;;;;; ; Paths and Directories ; ;;;;;;;;;;;;;;;;;;;;;;;;; ; UNIX: "/path1:/path2" ;include_path = ".:/php/includes" ; ; Windows: "\path1;\path2" ;include_path = ".;c:\php\includes" ; ; PHP's default setting for include_path is ".;/path/to/php/pear" ; https://php.net/include-path include_path = ".:/opt/php84/lib/php" ; The root of the PHP pages, used only if nonempty. ; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root ; if you are running php as a CGI under any web server (other than IIS) ; see documentation for security issues. The alternate is to use the ; cgi.force_redirect configuration below ; https://php.net/doc-root doc_root = ; The directory under which PHP opens the script using /~username used only ; if nonempty. ; https://php.net/user-dir user_dir = ; Directory in which the loadable extensions (modules) reside. ; https://php.net/extension-dir ;extension_dir = "./" ; On windows: ;extension_dir = "ext" extension_dir = "/opt/php84/lib/php/extensions/no-debug-non-zts-20240924/" ; Directory where the temporary files should be placed. ; Defaults to the system default (see sys_get_temp_dir) sys_temp_dir = "/tmp" ; Whether or not to enable the dl() function. The dl() function does NOT work ; properly in multithreaded servers, such as IIS or Zeus, and is automatically ; disabled on them. ; https://php.net/enable-dl enable_dl = Off ; cgi.force_redirect is necessary to provide security running PHP as a CGI under ; most web servers. Left undefined, PHP turns this on by default. You can ; turn it off here AT YOUR OWN RISK ; **You CAN safely turn this off for IIS, in fact, you MUST.** ; https://php.net/cgi.force-redirect ;cgi.force_redirect = 1 ; if cgi.nph is enabled it will force cgi to always sent Status: 200 with ; every request. PHP's default behavior is to disable this feature. ;cgi.nph = 1 ; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape ; (iPlanet) web servers, you MAY need to set an environment variable name that PHP ; will look for to know it is OK to continue execution. Setting this variable MAY ; cause security issues, KNOW WHAT YOU ARE DOING FIRST. ; https://php.net/cgi.redirect-status-env ;cgi.redirect_status_env = ; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's ; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok ; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting ; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting ; of zero causes PHP to behave as before. Default is 1. You should fix your scripts ; to use SCRIPT_FILENAME rather than PATH_TRANSLATED. ; https://php.net/cgi.fix-pathinfo ;cgi.fix_pathinfo=1 ; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside ; of the web tree and people will not be able to circumvent .htaccess security. ;cgi.discard_path=1 ; FastCGI under IIS supports the ability to impersonate ; security tokens of the calling client. This allows IIS to define the ; security context that the request runs under. mod_fastcgi under Apache ; does not currently support this feature (03/17/2002) ; Set to 1 if running under IIS. Default is zero. ; https://php.net/fastcgi.impersonate ;fastcgi.impersonate = 1 ; Disable logging through FastCGI connection. PHP's default behavior is to enable ; this feature. ;fastcgi.logging = 0 ; cgi.rfc2616_headers configuration option tells PHP what type of headers to ; use when sending HTTP response code. If set to 0, PHP sends Status: header that ; is supported by Apache. When this option is set to 1, PHP will send ; RFC2616 compliant header. ; Default is zero. ; https://php.net/cgi.rfc2616-headers ;cgi.rfc2616_headers = 0 ; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #! ; (shebang) at the top of the running script. This line might be needed if the ; script support running both as stand-alone script and via PHP CGI<. PHP in CGI ; mode skips this line and ignores its content if this directive is turned on. ; https://php.net/cgi.check-shebang-line ;cgi.check_shebang_line=1 ;;;;;;;;;;;;;;;; ; File Uploads ; ;;;;;;;;;;;;;;;; ; Whether to allow HTTP file uploads. ; https://php.net/file-uploads file_uploads = On ; Temporary directory for HTTP uploaded files (will use system default if not ; specified). ; https://php.net/upload-tmp-dir upload_tmp_dir = /tmp ; Maximum allowed size for uploaded files. ; https://php.net/upload-max-filesize upload_max_filesize = 325M ; Maximum number of files that can be uploaded via a single request max_file_uploads = 50 ;;;;;;;;;;;;;;;;;; ; Fopen wrappers ; ;;;;;;;;;;;;;;;;;; ; Whether to allow the treatment of URLs (like http:// or ftp://) as files. ; https://php.net/allow-url-fopen allow_url_fopen = On ; Whether to allow include/require to open URLs (like https:// or ftp://) as files. ; https://php.net/allow-url-include allow_url_include = Off ; Define the anonymous ftp password (your email address). PHP's default setting ; for this is empty. ; https://php.net/from ;from="john@doe.com" ; Define the User-Agent string. PHP's default setting for this is empty. ; https://php.net/user-agent ;user_agent="PHP" ; Default timeout for socket based streams (seconds) ; https://php.net/default-socket-timeout default_socket_timeout = 3600 ; If your scripts have to deal with files from Macintosh systems, ; or you are running on a Mac and need to deal with files from ; unix or win32 systems, setting this flag will cause PHP to ; automatically detect the EOL character in those files so that ; fgets() and file() will work regardless of the source of the file. ; https://php.net/auto-detect-line-endings auto_detect_line_endings = On ;;;;;;;;;;;;;;;;;;;;;; ; Dynamic Extensions ; ;;;;;;;;;;;;;;;;;;;;;; ; If you wish to have an extension loaded automatically, use the following ; syntax: ; ; extension=modulename ; ; For example: ; ; extension=mysqli ; ; When the extension library to load is not located in the default extension ; directory, You may specify an absolute path to the library file: ; ; extension=/path/to/extension/mysqli.so ; ; Note : The syntax used in previous PHP versions ('extension=.so' and ; 'extension='php_.dll') is supported for legacy reasons and may be ; deprecated in a future PHP major version. So, when it is possible, please ; move to the new ('extension=) syntax. ; ; Notes for Windows environments : ; ; - Many DLL files are located in the ext/ ; extension folders as well as the separate PECL DLL download. ; Be sure to appropriately set the extension_dir directive. ; ;extension=bz2 ;extension=curl ;extension=ffi ;extension=ftp ;extension=fileinfo ;extension=gd ;extension=gettext ;extension=gmp ;extension=intl ;extension=ldap ;extension=mbstring ;extension=exif ; Must be after mbstring as it depends on it ;extension=mysqli ;extension=odbc ;extension=openssl ;extension=pdo_firebird ;extension=pdo_mysql ;extension=pdo_odbc ;extension=pdo_pgsql ;extension=pdo_sqlite ;extension=pgsql ;extension=shmop ; The MIBS data available in the PHP distribution must be installed. ; See https://www.php.net/manual/en/snmp.installation.php ;extension=snmp ;extension=soap ;extension=sockets ;extension=sodium ;extension=sqlite3 ;extension=tidy ;extension=xsl ;extension=zip ;zend_extension=opcache ;;;;;;;;;;;;;;;;;;; ; Module Settings ; ;;;;;;;;;;;;;;;;;;; [CLI Server] ; Whether the CLI web server uses ANSI color coding in its terminal output. cli_server.color = On [Date] ; Defines the default timezone used by the date functions ; https://php.net/date.timezone date.timezone = "UTC" ; https://php.net/date.default-latitude ;date.default_latitude = 31.7667 ; https://php.net/date.default-longitude ;date.default_longitude = 35.2333 ; https://php.net/date.sunrise-zenith ;date.sunrise_zenith = 90.833333 ; https://php.net/date.sunset-zenith ;date.sunset_zenith = 90.833333 [filter] ; https://php.net/filter.default ;filter.default = unsafe_raw ; https://php.net/filter.default-flags ;filter.default_flags = [iconv] ; Use of this INI entry is deprecated, use global input_encoding instead. ; If empty, default_charset or input_encoding or iconv.input_encoding is used. ; The precedence is: default_charset < input_encoding < iconv.input_encoding ;iconv.input_encoding = ; Use of this INI entry is deprecated, use global internal_encoding instead. ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;iconv.internal_encoding = ; Use of this INI entry is deprecated, use global output_encoding instead. ; If empty, default_charset or output_encoding or iconv.output_encoding is used. ; The precedence is: default_charset < output_encoding < iconv.output_encoding ; To use an output encoding conversion, iconv's output handler must be set ; otherwise output encoding conversion cannot be performed. ;iconv.output_encoding = [intl] ;intl.default_locale = ; This directive allows you to produce PHP errors when some error ; happens within intl functions. The value is the level of the error produced. ; Default is 0, which does not produce any errors. ;intl.error_level = E_WARNING ;intl.use_exceptions = 0 [sqlite3] ; Directory pointing to SQLite3 extensions ; https://php.net/sqlite3.extension-dir ;sqlite3.extension_dir = ; SQLite defensive mode flag (only available from SQLite 3.26+) ; When the defensive flag is enabled, language features that allow ordinary ; SQL to deliberately corrupt the database file are disabled. This forbids ; writing directly to the schema, shadow tables (eg. FTS data tables), or ; the sqlite_dbpage virtual table. ; https://www.sqlite.org/c3ref/c_dbconfig_defensive.html ; (for older SQLite versions, this flag has no use) ;sqlite3.defensive = 1 [Pcre] ; PCRE library backtracking limit. ; https://php.net/pcre.backtrack-limit ;pcre.backtrack_limit=100000 ; PCRE library recursion limit. ; Please note that if you set this value to a high number you may consume all ; the available process stack and eventually crash PHP (due to reaching the ; stack size limit imposed by the Operating System). ; https://php.net/pcre.recursion-limit ;pcre.recursion_limit=100000 ; Enables or disables JIT compilation of patterns. This requires the PCRE ; library to be compiled with JIT support. ;pcre.jit=1 [Pdo] ; Whether to pool ODBC connections. Can be one of "strict", "relaxed" or "off" ; https://php.net/pdo-odbc.connection-pooling ;pdo_odbc.connection_pooling=strict [Pdo_mysql] ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. pdo_mysql.default_socket= [Phar] ; https://php.net/phar.readonly ;phar.readonly = On ; https://php.net/phar.require-hash ;phar.require_hash = On ;phar.cache_list = [mail function] ; For Win32 only. ; https://php.net/smtp ;SMTP = localhost ; https://php.net/smtp-port ;smtp_port = 25 ; For Win32 only. ; https://php.net/sendmail-from ;sendmail_from = me@example.com ; For Unix only. You may supply arguments as well (default: "sendmail -t -i"). ; https://php.net/sendmail-path sendmail_path = /usr/sbin/sendmail -t -i ; Force the addition of the specified parameters to be passed as extra parameters ; to the sendmail binary. These parameters will always replace the value of ; the 5th parameter to mail(). ;mail.force_extra_parameters = ; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename mail.add_x_header = Off ; Use mixed LF and CRLF line separators to keep compatibility with some ; RFC 2822 non conformant MTA. mail.mixed_lf_and_crlf = Off ; The path to a log file that will log all mail() calls. Log entries include ; the full path of the script, line number, To address and headers. ;mail.log = ; Log mail to syslog (Event Log on Windows). ;mail.log = syslog [ODBC] ; https://php.net/odbc.default-db ;odbc.default_db = Not yet implemented ; https://php.net/odbc.default-user ;odbc.default_user = Not yet implemented ; https://php.net/odbc.default-pw ;odbc.default_pw = Not yet implemented ; Controls the ODBC cursor model. ; Default: SQL_CURSOR_STATIC (default). ;odbc.default_cursortype ; Allow or prevent persistent links. ; https://php.net/odbc.allow-persistent odbc.allow_persistent = On ; Check that a connection is still valid before reuse. ; https://php.net/odbc.check-persistent odbc.check_persistent = On ; Maximum number of persistent links. -1 means no limit. ; https://php.net/odbc.max-persistent odbc.max_persistent = -1 ; Maximum number of links (persistent + non-persistent). -1 means no limit. ; https://php.net/odbc.max-links odbc.max_links = -1 ; Handling of LONG fields. Returns number of bytes to variables. 0 means ; passthru. ; https://php.net/odbc.defaultlrl odbc.defaultlrl = 4096 ; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char. ; See the documentation on odbc_binmode and odbc_longreadlen for an explanation ; of odbc.defaultlrl and odbc.defaultbinmode ; https://php.net/odbc.defaultbinmode odbc.defaultbinmode = 1 [MySQLi] ; Maximum number of persistent links. -1 means no limit. ; https://php.net/mysqli.max-persistent mysqli.max_persistent = -1 ; Allow accessing, from PHP's perspective, local files with LOAD DATA statements ; https://php.net/mysqli.allow_local_infile ;mysqli.allow_local_infile = On ; It allows the user to specify a folder where files that can be sent via LOAD DATA ; LOCAL can exist. It is ignored if mysqli.allow_local_infile is enabled. ;mysqli.local_infile_directory = ; Allow or prevent persistent links. ; https://php.net/mysqli.allow-persistent mysqli.allow_persistent = On ; Maximum number of links. -1 means no limit. ; https://php.net/mysqli.max-links mysqli.max_links = -1 ; Default port number for mysqli_connect(). If unset, mysqli_connect() will use ; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the ; compile-time value defined MYSQL_PORT (in that order). Win32 will only look ; at MYSQL_PORT. ; https://php.net/mysqli.default-port mysqli.default_port = 3306 ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. ; https://php.net/mysqli.default-socket mysqli.default_socket = ; Default host for mysqli_connect() (doesn't apply in safe mode). ; https://php.net/mysqli.default-host mysqli.default_host = ; Default user for mysqli_connect() (doesn't apply in safe mode). ; https://php.net/mysqli.default-user mysqli.default_user = ; Default password for mysqli_connect() (doesn't apply in safe mode). ; Note that this is generally a *bad* idea to store passwords in this file. ; *Any* user with PHP access can run 'echo get_cfg_var("mysqli.default_pw") ; and reveal this password! And of course, any users with read access to this ; file will be able to reveal the password as well. ; https://php.net/mysqli.default-pw mysqli.default_pw = ; If this option is enabled, closing a persistent connection will rollback ; any pending transactions of this connection, before it is put back ; into the persistent connection pool. ;mysqli.rollback_on_cached_plink = Off [mysqlnd] ; Enable / Disable collection of general statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. mysqlnd.collect_statistics = 0 ; Enable / Disable collection of memory usage statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. mysqlnd.collect_memory_statistics = 0 ; Records communication from all extensions using mysqlnd to the specified log ; file. ; https://php.net/mysqlnd.debug ;mysqlnd.debug = ; Defines which queries will be logged. ;mysqlnd.log_mask = 0 ; Default size of the mysqlnd memory pool, which is used by result sets. mysqlnd.mempool_default_size = 64000 ; Size of a pre-allocated buffer used when sending commands to MySQL in bytes. mysqlnd.net_cmd_buffer_size = 8192 ; Size of a pre-allocated buffer used for reading data sent by the server in ; bytes. mysqlnd.net_read_buffer_size = 131072 ; Timeout for network requests in seconds. ;mysqlnd.net_read_timeout = 31536000 ; SHA-256 Authentication Plugin related. File with the MySQL server public RSA ; key. ;mysqlnd.sha256_server_public_key = [PostgreSQL] ; Allow or prevent persistent links. ; https://php.net/pgsql.allow-persistent pgsql.allow_persistent = On ; Detect broken persistent links always with pg_pconnect(). ; Auto reset feature requires a little overheads. ; https://php.net/pgsql.auto-reset-persistent pgsql.auto_reset_persistent = Off ; Maximum number of persistent links. -1 means no limit. ; https://php.net/pgsql.max-persistent pgsql.max_persistent = -1 ; Maximum number of links (persistent+non persistent). -1 means no limit. ; https://php.net/pgsql.max-links pgsql.max_links = -1 ; Ignore PostgreSQL backends Notice message or not. ; Notice message logging require a little overheads. ; https://php.net/pgsql.ignore-notice pgsql.ignore_notice = 0 ; Log PostgreSQL backends Notice message or not. ; Unless pgsql.ignore_notice=0, module cannot log notice message. ; https://php.net/pgsql.log-notice pgsql.log_notice = 0 [bcmath] ; Number of decimal digits for all bcmath functions. ; https://php.net/bcmath.scale bcmath.scale = 0 [browscap] ; https://php.net/browscap ;browscap = extra/browscap.ini [Session] ; Handler used to store/retrieve data. ; https://php.net/session.save-handler session.save_handler = files ; Argument passed to save_handler. In the case of files, this is the path ; where data files are stored. Note: Windows users have to change this ; variable in order to use PHP's session functions. ; ; The path can be defined as: ; ; session.save_path = "N;/path" ; ; where N is an integer. Instead of storing all the session files in ; /path, what this will do is use subdirectories N-levels deep, and ; store the session data in those directories. This is useful if ; your OS has problems with many files in one directory, and is ; a more efficient layout for servers that handle many sessions. ; ; NOTE 1: PHP will not create this directory structure automatically. ; You can use the script in the ext/session dir for that purpose. ; NOTE 2: See the section on garbage collection below if you choose to ; use subdirectories for session storage ; ; The file storage module creates files using mode 600 by default. ; You can change that by using ; ; session.save_path = "N;MODE;/path" ; ; where MODE is the octal representation of the mode. Note that this ; does not overwrite the process's umask. ; https://php.net/session.save-path session.save_path = "/opt/tmp" ; Whether to use strict session mode. ; Strict session mode does not accept an uninitialized session ID, and ; regenerates the session ID if the browser sends an uninitialized session ID. ; Strict mode protects applications from session fixation via a session adoption ; vulnerability. It is disabled by default for maximum compatibility, but ; enabling it is encouraged. ; https://wiki.php.net/rfc/strict_sessions session.use_strict_mode = 0 ; Whether to use cookies. ; https://php.net/session.use-cookies session.use_cookies = 1 ; https://php.net/session.cookie-secure ;session.cookie_secure = ; This option forces PHP to fetch and use a cookie for storing and maintaining ; the session id. We encourage this operation as it's very helpful in combating ; session hijacking when not specifying and managing your own session id. It is ; not the be-all and end-all of session hijacking defense, but it's a good start. ; https://php.net/session.use-only-cookies session.use_only_cookies = 1 ; Name of the session (used as cookie name). ; https://php.net/session.name session.name = PHPSESSID ; Initialize session on request startup. ; https://php.net/session.auto-start session.auto_start = 0 ; Lifetime in seconds of cookie or, if 0, until browser is restarted. ; https://php.net/session.cookie-lifetime session.cookie_lifetime = 0 ; The path for which the cookie is valid. ; https://php.net/session.cookie-path session.cookie_path = / ; The domain for which the cookie is valid. ; https://php.net/session.cookie-domain session.cookie_domain = ; Whether or not to add the httpOnly flag to the cookie, which makes it ; inaccessible to browser scripting languages such as JavaScript. ; https://php.net/session.cookie-httponly session.cookie_httponly = 1 ; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF) ; Current valid values are "Strict", "Lax" or "None". When using "None", ; make sure to include the quotes, as `none` is interpreted like `false` in ini files. ; https://tools.ietf.org/html/draft-west-first-party-cookies-07 session.cookie_samesite = ; Handler used to serialize data. php is the standard serializer of PHP. ; https://php.net/session.serialize-handler session.serialize_handler = php ; Defines the probability that the 'garbage collection' process is started on every ; session initialization. The probability is calculated by using gc_probability/gc_divisor, ; e.g. 1/100 means there is a 1% chance that the GC process starts on each request. ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; https://php.net/session.gc-probability session.gc_probability = 1 ; Defines the probability that the 'garbage collection' process is started on every ; session initialization. The probability is calculated by using gc_probability/gc_divisor, ; e.g. 1/100 means there is a 1% chance that the GC process starts on each request. ; For high volume production servers, using a value of 1000 is a more efficient approach. ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; https://php.net/session.gc-divisor session.gc_divisor = 1000 ; After this number of seconds, stored data will be seen as 'garbage' and ; cleaned up by the garbage collection process. ; https://php.net/session.gc-maxlifetime session.gc_maxlifetime = 1440 ; NOTE: If you are using the subdirectory option for storing session files ; (see session.save_path above), then garbage collection does *not* ; happen automatically. You will need to do your own garbage ; collection through a shell script, cron entry, or some other method. ; For example, the following script is the equivalent of setting ; session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes): ; find /path/to/sessions -cmin +24 -type f | xargs rm ; Check HTTP Referer to invalidate externally stored URLs containing ids. ; HTTP_REFERER has to contain this substring for the session to be ; considered as valid. ; https://php.net/session.referer-check session.referer_check = ; Set to {nocache,private,public,} to determine HTTP caching aspects ; or leave this empty to avoid sending anti-caching headers. ; https://php.net/session.cache-limiter session.cache_limiter = nocache ; Document expires after n minutes. ; https://php.net/session.cache-expire session.cache_expire = 180 ; trans sid support is disabled by default. ; Use of trans sid may risk your users' security. ; Use this option with caution. ; - User may send URL contains active session ID ; to other person via. email/irc/etc. ; - URL that contains active session ID may be stored ; in publicly accessible computer. ; - User may access your site with the same session ID ; always using URL stored in browser's history or bookmarks. ; https://php.net/session.use-trans-sid session.use_trans_sid = 0 ; The URL rewriter will look for URLs in a defined set of HTML tags. ; is special; if you include them here, the rewriter will ; add a hidden field with the info which is otherwise appended ; to URLs. tag's action attribute URL will not be modified ; unless it is specified. ; Note that all valid entries require a "=", even if no value follows. ; Default Value: "a=href,area=href,frame=src,form=" ; Development Value: "a=href,area=href,frame=src,form=" ; Production Value: "a=href,area=href,frame=src,form=" ; https://php.net/url-rewriter.tags session.trans_sid_tags = "a=href,area=href,frame=src,form=" ; URL rewriter does not rewrite absolute URLs by default. ; To enable rewrites for absolute paths, target hosts must be specified ; at RUNTIME. i.e. use ini_set() ; tags is special. PHP will check action attribute's URL regardless ; of session.trans_sid_tags setting. ; If no host is defined, HTTP_HOST will be used for allowed host. ; Example value: php.net,www.php.net,wiki.php.net ; Use "," for multiple hosts. No spaces are allowed. ; Default Value: "" ; Development Value: "" ; Production Value: "" ;session.trans_sid_hosts="" ; Enable upload progress tracking in $_SESSION ; Default Value: On ; Development Value: On ; Production Value: On ; https://php.net/session.upload-progress.enabled ;session.upload_progress.enabled = On ; Cleanup the progress information as soon as all POST data has been read ; (i.e. upload completed). ; Default Value: On ; Development Value: On ; Production Value: On ; https://php.net/session.upload-progress.cleanup ;session.upload_progress.cleanup = On ; A prefix used for the upload progress key in $_SESSION ; Default Value: "upload_progress_" ; Development Value: "upload_progress_" ; Production Value: "upload_progress_" ; https://php.net/session.upload-progress.prefix ;session.upload_progress.prefix = "upload_progress_" ; The index name (concatenated with the prefix) in $_SESSION ; containing the upload progress information ; Default Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Development Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Production Value: "PHP_SESSION_UPLOAD_PROGRESS" ; https://php.net/session.upload-progress.name ;session.upload_progress.name = "PHP_SESSION_UPLOAD_PROGRESS" ; How frequently the upload progress should be updated. ; Given either in percentages (per-file), or in bytes ; Default Value: "1%" ; Development Value: "1%" ; Production Value: "1%" ; https://php.net/session.upload-progress.freq ;session.upload_progress.freq = "1%" ; The minimum delay between updates, in seconds ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; https://php.net/session.upload-progress.min-freq ;session.upload_progress.min_freq = "1" ; Only write session data when session data is changed. Enabled by default. ; https://php.net/session.lazy-write ;session.lazy_write = On [Assertion] ; Switch whether to compile assertions at all (to have no overhead at run-time) ; -1: Do not compile at all ; 0: Jump over assertion at run-time ; 1: Execute assertions ; Changing from or to a negative value is only possible in php.ini! ; (For turning assertions on and off at run-time, toggle zend.assertions between the values 1 and 0) ; Default Value: 1 ; Development Value: 1 ; Production Value: -1 ; https://php.net/zend.assertions zend.assertions = -1 [COM] ; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs ; https://php.net/com.typelib-file ;com.typelib_file = ; allow Distributed-COM calls ; https://php.net/com.allow-dcom ;com.allow_dcom = true ; autoregister constants of a component's typelib on com_load() ; https://php.net/com.autoregister-typelib ;com.autoregister_typelib = true ; register constants casesensitive ; https://php.net/com.autoregister-casesensitive ;com.autoregister_casesensitive = false ; show warnings on duplicate constant registrations ; https://php.net/com.autoregister-verbose ;com.autoregister_verbose = true ; The default character set code-page to use when passing strings to and from COM objects. ; Default: system ANSI code page ;com.code_page= ; The version of the .NET framework to use. The value of the setting are the first three parts ; of the framework's version number, separated by dots, and prefixed with "v", e.g. "v4.0.30319". ;com.dotnet_version= [mbstring] ; language for internal character representation. ; This affects mb_send_mail() and mbstring.detect_order. ; https://php.net/mbstring.language ;mbstring.language = Japanese ; Use of this INI entry is deprecated, use global internal_encoding instead. ; internal/script encoding. ; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*) ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;mbstring.internal_encoding = ; Use of this INI entry is deprecated, use global input_encoding instead. ; http input encoding. ; mbstring.encoding_translation = On is needed to use this setting. ; If empty, default_charset or input_encoding or mbstring.input is used. ; The precedence is: default_charset < input_encoding < mbstring.http_input ; https://php.net/mbstring.http-input ;mbstring.http_input = ; Use of this INI entry is deprecated, use global output_encoding instead. ; http output encoding. ; mb_output_handler must be registered as output buffer to function. ; If empty, default_charset or output_encoding or mbstring.http_output is used. ; The precedence is: default_charset < output_encoding < mbstring.http_output ; To use an output encoding conversion, mbstring's output handler must be set ; otherwise output encoding conversion cannot be performed. ; https://php.net/mbstring.http-output ;mbstring.http_output = ; enable automatic encoding translation according to ; mbstring.internal_encoding setting. Input chars are ; converted to internal encoding by setting this to On. ; Note: Do _not_ use automatic encoding translation for ; portable libs/applications. ; https://php.net/mbstring.encoding-translation ;mbstring.encoding_translation = Off ; automatic encoding detection order. ; "auto" detect order is changed according to mbstring.language ; https://php.net/mbstring.detect-order ;mbstring.detect_order = auto ; substitute_character used when character cannot be converted ; one from another ; https://php.net/mbstring.substitute-character ;mbstring.substitute_character = none ; Enable strict encoding detection. ;mbstring.strict_detection = Off ; This directive specifies the regex pattern of content types for which mb_output_handler() ; is activated. ; Default: mbstring.http_output_conv_mimetypes=^(text/|application/xhtml\+xml) ;mbstring.http_output_conv_mimetypes= ; This directive specifies maximum stack depth for mbstring regular expressions. It is similar ; to the pcre.recursion_limit for PCRE. ;mbstring.regex_stack_limit=100000 ; This directive specifies maximum retry count for mbstring regular expressions. It is similar ; to the pcre.backtrack_limit for PCRE. ;mbstring.regex_retry_limit=1000000 [gd] ; Tell the jpeg decode to ignore warnings and try to create ; a gd image. The warning will then be displayed as notices ; disabled by default ; https://php.net/gd.jpeg-ignore-warning ;gd.jpeg_ignore_warning = 1 [exif] ; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS. ; With mbstring support this will automatically be converted into the encoding ; given by corresponding encode setting. When empty mbstring.internal_encoding ; is used. For the decode settings you can distinguish between motorola and ; intel byte order. A decode setting must not be empty. ; https://php.net/exif.encode-unicode ;exif.encode_unicode = ISO-8859-15 ; https://php.net/exif.decode-unicode-motorola ;exif.decode_unicode_motorola = UCS-2BE ; https://php.net/exif.decode-unicode-intel ;exif.decode_unicode_intel = UCS-2LE ; https://php.net/exif.encode-jis ;exif.encode_jis = ; https://php.net/exif.decode-jis-motorola ;exif.decode_jis_motorola = JIS ; https://php.net/exif.decode-jis-intel ;exif.decode_jis_intel = JIS [Tidy] ; The path to a default tidy configuration file to use when using tidy ; https://php.net/tidy.default-config ;tidy.default_config = /usr/local/lib/php/default.tcfg ; Should tidy clean and repair output automatically? ; WARNING: Do not use this option if you are generating non-html content ; such as dynamic images ; https://php.net/tidy.clean-output tidy.clean_output = Off [soap] ; Enables or disables WSDL caching feature. ; https://php.net/soap.wsdl-cache-enabled soap.wsdl_cache_enabled=1 ; Sets the directory name where SOAP extension will put cache files. ; https://php.net/soap.wsdl-cache-dir soap.wsdl_cache_dir="/tmp" ; (time to live) Sets the number of second while cached file will be used ; instead of original one. ; https://php.net/soap.wsdl-cache-ttl soap.wsdl_cache_ttl=86400 ; Sets the size of the cache limit. (Max. number of WSDL files to cache) soap.wsdl_cache_limit = 5 [sysvshm] ; A default size of the shared memory segment ;sysvshm.init_mem = 10000 [ldap] ; Sets the maximum number of open links or -1 for unlimited. ldap.max_links = -1 [dba] ;dba.default_handler= [opcache] ; Determines if Zend OPCache is enabled ;opcache.enable=1 ; Determines if Zend OPCache is enabled for the CLI version of PHP ;opcache.enable_cli=0 ; The OPcache shared memory storage size. ;opcache.memory_consumption=128 ; The amount of memory for interned strings in Mbytes. ;opcache.interned_strings_buffer=8 ; The maximum number of keys (scripts) in the OPcache hash table. ; Only numbers between 200 and 1000000 are allowed. ;opcache.max_accelerated_files=10000 ; The maximum percentage of "wasted" memory until a restart is scheduled. ;opcache.max_wasted_percentage=5 ; When this directive is enabled, the OPcache appends the current working ; directory to the script key, thus eliminating possible collisions between ; files with the same name (basename). Disabling the directive improves ; performance, but may break existing applications. ;opcache.use_cwd=1 ; When disabled, you must reset the OPcache manually or restart the ; webserver for changes to the filesystem to take effect. ;opcache.validate_timestamps=1 ; How often (in seconds) to check file timestamps for changes to the shared ; memory storage allocation. ("1" means validate once per second, but only ; once per request. "0" means always validate) ;opcache.revalidate_freq=2 ; Enables or disables file search in include_path optimization ;opcache.revalidate_path=0 ; If disabled, all PHPDoc comments are dropped from the code to reduce the ; size of the optimized code. ;opcache.save_comments=1 ; If enabled, compilation warnings (including notices and deprecations) will ; be recorded and replayed each time a file is included. Otherwise, compilation ; warnings will only be emitted when the file is first cached. ;opcache.record_warnings=0 ; Allow file existence override (file_exists, etc.) performance feature. ;opcache.enable_file_override=0 ; A bitmask, where each bit enables or disables the appropriate OPcache ; passes ;opcache.optimization_level=0x7FFFBFFF ;opcache.dups_fix=0 ; The location of the OPcache blacklist file (wildcards allowed). ; Each OPcache blacklist file is a text file that holds the names of files ; that should not be accelerated. The file format is to add each filename ; to a new line. The filename may be a full path or just a file prefix ; (i.e., /var/www/x blacklists all the files and directories in /var/www ; that start with 'x'). Line starting with a ; are ignored (comments). ;opcache.blacklist_filename= ; Allows exclusion of large files from being cached. By default all files ; are cached. ;opcache.max_file_size=0 ; How long to wait (in seconds) for a scheduled restart to begin if the cache ; is not being accessed. ;opcache.force_restart_timeout=180 ; OPcache error_log file name. Empty string assumes "stderr". ;opcache.error_log= ; All OPcache errors go to the Web server log. ; By default, only fatal errors (level 0) or errors (level 1) are logged. ; You can also enable warnings (level 2), info messages (level 3) or ; debug messages (level 4). ;opcache.log_verbosity_level=1 ; Preferred Shared Memory back-end. Leave empty and let the system decide. ;opcache.preferred_memory_model= ; Protect the shared memory from unexpected writing during script execution. ; Useful for internal debugging only. ;opcache.protect_memory=0 ; Allows calling OPcache API functions only from PHP scripts which path is ; started from specified string. The default "" means no restriction ;opcache.restrict_api= ; Mapping base of shared memory segments (for Windows only). All the PHP ; processes have to map shared memory into the same address space. This ; directive allows to manually fix the "Unable to reattach to base address" ; errors. ;opcache.mmap_base= ; Facilitates multiple OPcache instances per user (for Windows only). All PHP ; processes with the same cache ID and user share an OPcache instance. ;opcache.cache_id= ; Enables and sets the second level cache directory. ; It should improve performance when SHM memory is full, at server restart or ; SHM reset. The default "" disables file based caching. ;opcache.file_cache= ; Enables or disables opcode caching in shared memory. ;opcache.file_cache_only=0 ; Enables or disables checksum validation when script loaded from file cache. ;opcache.file_cache_consistency_checks=1 ; Implies opcache.file_cache_only=1 for a certain process that failed to ; reattach to the shared memory (for Windows only). Explicitly enabled file ; cache is required. ;opcache.file_cache_fallback=1 ; Enables or disables copying of PHP code (text segment) into HUGE PAGES. ; Under certain circumstances (if only a single global PHP process is ; started from which all others fork), this can increase performance ; by a tiny amount because TLB misses are reduced. On the other hand, this ; delays PHP startup, increases memory usage and degrades performance ; under memory pressure - use with care. ; Requires appropriate OS configuration. ;opcache.huge_code_pages=0 ; Validate cached file permissions. ;opcache.validate_permission=0 ; Prevent name collisions in chroot'ed environment. ;opcache.validate_root=0 ; If specified, it produces opcode dumps for debugging different stages of ; optimizations. ;opcache.opt_debug_level=0 ; Specifies a PHP script that is going to be compiled and executed at server ; start-up. ; https://php.net/opcache.preload ;opcache.preload= ; Preloading code as root is not allowed for security reasons. This directive ; facilitates to let the preloading to be run as another user. ; https://php.net/opcache.preload_user ;opcache.preload_user= ; Prevents caching files that are less than this number of seconds old. It ; protects from caching of incompletely updated files. In case all file updates ; on your site are atomic, you may increase performance by setting it to "0". ;opcache.file_update_protection=2 ; Absolute path used to store shared lockfiles (for *nix only). ;opcache.lockfile_path=/tmp [curl] ; A default value for the CURLOPT_CAINFO option. This is required to be an ; absolute path. ;curl.cainfo = [openssl] ; The location of a Certificate Authority (CA) file on the local filesystem ; to use when verifying the identity of SSL/TLS peers. Most users should ; not specify a value for this directive as PHP will attempt to use the ; OS-managed cert stores in its absence. If specified, this value may still ; be overridden on a per-stream basis via the "cafile" SSL stream context ; option. ;openssl.cafile= ; If openssl.cafile is not specified or if the CA file is not found, the ; directory pointed to by openssl.capath is searched for a suitable ; certificate. This value must be a correctly hashed certificate directory. ; Most users should not specify a value for this directive as PHP will ; attempt to use the OS-managed cert stores in its absence. If specified, ; this value may still be overridden on a per-stream basis via the "capath" ; SSL stream context option. ;openssl.capath= [ffi] ; FFI API restriction. Possible values: ; "preload" - enabled in CLI scripts and preloaded files (default) ; "false" - always disabled ; "true" - always enabled ;ffi.enable=preload ; List of headers files to preload, wildcard patterns allowed. ;ffi.preload= [Zend] zend_extension="/usr/local/ioncube/ioncube_loader_lin_8.4.so" ; fix for segfaults auto_globals_jit = Off cgi.fix_pathinfo = 1 mbstring.http_input = "pass" mbstring.http_output = "pass" mbstring.encoding_translation = 0 ; Enable Extensions extension=uploadprogress.so extension=imagick.so extension=redis.so ================================================ FILE: aegir/conf/php/php84-fpm ================================================ #!/bin/bash ### BEGIN INIT INFO # Provides: php84-fpm # Required-Start: $remote_fs $network # Required-Stop: $remote_fs $network # Default-Start: 2 3 4 5 # Default-Stop: 0 1 6 # Short-Description: starts php84-fpm # Description: starts the PHP FastCGI Process Manager daemon ### END INIT INFO prefix=/opt/php84 exec_prefix=${prefix} php_fpm_BIN=/opt/php84/sbin/php-fpm php_fpm_CONF=/opt/php84/etc/php84-fpm.conf php_fpm_PID=/run/php84-fpm.pid php_opts="--fpm-config $php_fpm_CONF --pid $php_fpm_PID -c /opt/php84/etc/php84.ini" wait_for_pid() { try=0 while test $try -lt 5; do case "$1" in 'created') if [ -f "$2" ]; then try='' break fi ;; 'removed') if [ ! -f "$2" ]; then try='' break fi ;; esac echo -n . try=`expr $try + 1` sleep 1 done } case "$1" in start) echo -n "Starting php84-fpm..." $php_fpm_BIN --daemonize $php_opts if [ "$?" != 0 ]; then echo " failed" exit 1 fi wait_for_pid created $php_fpm_PID if [ -n "$try" ]; then echo " failed" exit 1 else echo " done" fi ;; stop) echo -n "Gracefully shutting down php84-fpm..." if [ ! -r $php_fpm_PID ]; then echo "warning, no pid file found - php84-fpm is not running ?" exit 1 fi kill -QUIT `cat $php_fpm_PID` wait_for_pid removed $php_fpm_PID if [ -n "$try" ]; then echo " failed. Use force-quit" exit 1 else echo " done" fi ;; status) if [ ! -r $php_fpm_PID ]; then echo "php84-fpm is stopped" exit 0 fi PID=`cat $php_fpm_PID` if ps -p $PID | grep -q $PID; then echo "php84-fpm (pid $PID) is running..." else echo "php84-fpm dead but pid file exists" fi ;; force-quit) echo -n "Terminating php84-fpm..." if [ ! -r $php_fpm_PID ]; then echo "warning, no pid file found - php84-fpm is not running ?" exit 1 fi kill -TERM `cat $php_fpm_PID` wait_for_pid removed $php_fpm_PID if [ -n "$try" ]; then echo " failed" exit 1 else echo " done" fi ;; restart) $0 stop $0 start ;; reload) echo -n "Reloading service php84-fpm..." if [ ! -r $php_fpm_PID ]; then echo "warning, no pid file found - php84-fpm is not running ?" exit 1 fi kill -USR2 `cat $php_fpm_PID` echo " done" ;; configtest) $php_fpm_BIN -t ;; *) echo "Usage: $0 {start|stop|force-quit|restart|reload|status|configtest}" exit 1 ;; esac ================================================ FILE: aegir/conf/php/php84-fpm.conf ================================================ ;;;;;;;;;;;;;;;;;;;;; ; FPM Configuration ; ;;;;;;;;;;;;;;;;;;;;; ; All relative paths in this configuration file are relative to PHP's install ; prefix (/opt/php84). This prefix can be dynamically changed by using the ; '-p' argument from the command line. ; Include one or more files. If glob(3) exists, it is used to include a bunch of ; files from a glob(3) pattern. This directive can be used everywhere in the ; file. ; Relative path can also be used. They will be prefixed by: ; - the global prefix if it's been set (-p argument) ; - /opt/php84 otherwise ;include=etc/fpm.d/*.conf ;;;;;;;;;;;;;;;;;; ; Global Options ; ;;;;;;;;;;;;;;;;;; [global] ; Pid file ; Note: the default prefix is /opt/php84/var ; Default Value: none pid = /run/php84-fpm.pid ; Error log file ; If it's set to "syslog", log is sent to syslogd instead of being written ; in a local file. ; Note: the default prefix is /opt/php84/var ; Default Value: log/php-fpm.log error_log = /var/log/php/php84-fpm-error.log ; syslog_facility is used to specify what type of program is logging the ; message. This lets syslogd specify that messages from different facilities ; will be handled differently. ; See syslog(3) for possible values (ex daemon equiv LOG_DAEMON) ; Default Value: daemon syslog.facility = daemon ; syslog_ident is prepended to every message. If you have multiple FPM ; instances running on the same server, you can change the default value ; which must suit common needs. ; Default Value: php-fpm syslog.ident = php84-fpm ; Log level ; Possible Values: alert, error, warning, notice, debug ; Default Value: notice log_level = warning ; If this number of child processes exit with SIGSEGV or SIGBUS within the time ; interval set by emergency_restart_interval then FPM will restart. A value ; of '0' means 'Off'. ; Default Value: 0 emergency_restart_threshold = 5 ; Interval of time used by emergency_restart_interval to determine when ; a graceful restart will be initiated. This can be useful to work around ; accidental corruptions in an accelerator's shared memory. ; Available Units: s(econds), m(inutes), h(ours), or d(ays) ; Default Unit: seconds ; Default Value: 0 emergency_restart_interval = 1m ; Time limit for child processes to wait for a reaction on signals from master. ; Available units: s(econds), m(inutes), h(ours), or d(ays) ; Default Unit: seconds ; Default Value: 0 process_control_timeout = 5s ; The maximum number of processes FPM will fork. This has been design to control ; the global number of processes when using dynamic PM within a lot of pools. ; Use it with caution. ; Note: A value of 0 indicates no limit ; Default Value: 0 process.max = 0 ; Specify the nice(2) priority to apply to the master process (only if set) ; The value can vary from -19 (highest priority) to 20 (lower priority) ; Note: - It will only work if the FPM master process is launched as root ; - The pool process will inherit the master process priority ; unless it specified otherwise ; Default Value: no set ; process.priority = -19 ; Send FPM to background. Set to 'no' to keep FPM in foreground for debugging. ; Default Value: yes daemonize = yes ; Set open file descriptor rlimit for the master process. ; Default Value: system defined value ;rlimit_files = 1024 ; Set max core size rlimit for the master process. ; Possible Values: 'unlimited' or an integer greater or equal to 0 ; Default Value: system defined value ;rlimit_core = 0 ; Specify the event mechanism FPM will use. The following is available: ; - select (any POSIX os) ; - poll (any POSIX os) ; - epoll (linux >= 2.5.44) ; - kqueue (FreeBSD >= 4.1, OpenBSD >= 2.9, NetBSD >= 2.0) ; - /dev/poll (Solaris >= 7) ; - port (Solaris >= 10) ; Default Value: not set (auto detection) ;events.mechanism = epoll ;;;;;;;;;;;;;;;;;;;; ; Pool Definitions ; ;;;;;;;;;;;;;;;;;;;; ; Multiple pools of child processes may be started with different listening ; ports and different management options. The name of the pool will be ; used in logs and stats. There is no limitation on the number of pools which ; FPM can handle. Your system will tell you anyway :) include = /opt/php84/etc/pool.d/*.conf ================================================ FILE: aegir/conf/php/php84.ini ================================================ [PHP] ;;;;;;;;;;;;;;;;;;; ; About php.ini ; ;;;;;;;;;;;;;;;;;;; ; PHP's initialization file, generally called php.ini, is responsible for ; configuring many of the aspects of PHP's behavior. ; PHP attempts to find and load this configuration from a number of locations. ; The following is a summary of its search order: ; 1. SAPI module specific location. ; 2. The PHPRC environment variable. ; 3. A number of predefined registry keys on Windows ; 4. Current working directory (except CLI) ; 5. The web server's directory (for SAPI modules), or directory of PHP ; (otherwise in Windows) ; 6. The directory from the --with-config-file-path compile time option, or the ; Windows directory (usually C:\windows) ; See the PHP docs for more specific information. ; https://php.net/configuration.file ; The syntax of the file is extremely simple. Whitespace and lines ; beginning with a semicolon are silently ignored (as you probably guessed). ; Section headers (e.g. [Foo]) are also silently ignored, even though ; they might mean something in the future. ; Directives following the section heading [PATH=/www/mysite] only ; apply to PHP files in the /www/mysite directory. Directives ; following the section heading [HOST=www.example.com] only apply to ; PHP files served from www.example.com. Directives set in these ; special sections cannot be overridden by user-defined INI files or ; at runtime. Currently, [PATH=] and [HOST=] sections only work under ; CGI/FastCGI. ; https://php.net/ini.sections ; Directives are specified using the following syntax: ; directive = value ; Directive names are *case sensitive* - foo=bar is different from FOO=bar. ; Directives are variables used to configure PHP or PHP extensions. ; There is no name validation. If PHP can't find an expected ; directive because it is not set or is mistyped, a default value will be used. ; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one ; of the INI constants (On, Off, True, False, Yes, No and None) or an expression ; (e.g. E_ALL & ~E_NOTICE), a quoted string ("bar"), or a reference to a ; previously set variable or directive (e.g. ${foo}) ; Expressions in the INI file are limited to bitwise operators and parentheses: ; | bitwise OR ; ^ bitwise XOR ; & bitwise AND ; ~ bitwise NOT ; ! boolean NOT ; Boolean flags can be turned on using the values 1, On, True or Yes. ; They can be turned off using the values 0, Off, False or No. ; An empty string can be denoted by simply not writing anything after the equal ; sign, or by using the None keyword: ; foo = ; sets foo to an empty string ; foo = None ; sets foo to an empty string ; foo = "None" ; sets foo to the string 'None' ; If you use constants in your value, and these constants belong to a ; dynamically loaded extension (either a PHP extension or a Zend extension), ; you may only use these constants *after* the line that loads the extension. ;;;;;;;;;;;;;;;;;;; ; About this file ; ;;;;;;;;;;;;;;;;;;; ; PHP comes packaged with two INI files. One that is recommended to be used ; in production environments and one that is recommended to be used in ; development environments. ; php.ini-production contains settings which hold security, performance and ; best practices at its core. But please be aware, these settings may break ; compatibility with older or less security-conscious applications. We ; recommending using the production ini in production and testing environments. ; php.ini-development is very similar to its production variant, except it is ; much more verbose when it comes to errors. We recommend using the ; development version only in development environments, as errors shown to ; application users can inadvertently leak otherwise secure information. ; This is the php.ini-production INI file. ;;;;;;;;;;;;;;;;;;; ; Quick Reference ; ;;;;;;;;;;;;;;;;;;; ; The following are all the settings which are different in either the production ; or development versions of the INIs with respect to PHP's default behavior. ; Please see the actual settings later in the document for more details as to why ; we recommend these changes in PHP's behavior. display_errors = Off ; Default Value: On ; Development Value: On ; Production Value: Off ; display_startup_errors ; Default Value: On ; Development Value: On ; Production Value: Off ; error_reporting ; Default Value: E_ALL ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED ; log_errors ; Default Value: Off ; Development Value: On ; Production Value: On ; max_input_time ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; output_buffering ; Default Value: Off ; Development Value: 4096 ; Production Value: 4096 ; register_argc_argv ; Default Value: On ; Development Value: Off ; Production Value: Off ; request_order ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; session.gc_divisor ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; short_open_tag ; Default Value: On ; Development Value: Off ; Production Value: Off ; variables_order ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS" ; zend.assertions ; Default Value: 1 ; Development Value: 1 ; Production Value: -1 ; zend.exception_ignore_args ; Default Value: Off ; Development Value: Off ; Production Value: On ; zend.exception_string_param_max_len ; Default Value: 15 ; Development Value: 15 ; Production Value: 0 ;;;;;;;;;;;;;;;;;;;; ; php.ini Options ; ;;;;;;;;;;;;;;;;;;;; ; Name for user-defined php.ini (.htaccess) files. Default is ".user.ini" ;user_ini.filename = ".user.ini" ; To disable this feature set this option to an empty value user_ini.filename = ; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes) ;user_ini.cache_ttl = 300 ;;;;;;;;;;;;;;;;;;;; ; Language Options ; ;;;;;;;;;;;;;;;;;;;; ; Enable the PHP scripting language engine under Apache. ; https://php.net/engine engine = On ; This directive determines whether or not PHP will recognize code between ; tags as PHP source which should be processed as such. It is ; generally recommended that should be used and that this feature ; should be disabled, as enabling it may result in issues when generating XML ; documents, however this remains supported for backward compatibility reasons. ; Note that this directive does not control the would work. ; https://php.net/syntax-highlighting ;highlight.string = #DD0000 ;highlight.comment = #FF9900 ;highlight.keyword = #007700 ;highlight.default = #0000BB ;highlight.html = #000000 ; If enabled, the request will be allowed to complete even if the user aborts ; the request. Consider enabling it if executing long requests, which may end up ; being interrupted by the user or a browser timing out. PHP's default behavior ; is to disable this feature. ; https://php.net/ignore-user-abort ;ignore_user_abort = On ; Determines the size of the realpath cache to be used by PHP. This value should ; be increased on systems where PHP opens many files to reflect the quantity of ; the file operations performed. ; Note: if open_basedir is set, the cache is disabled ; https://php.net/realpath-cache-size realpath_cache_size=64M ; Duration of time, in seconds for which to cache realpath information for a given ; file or directory. For systems with rarely changing files, consider increasing this ; value. ; https://php.net/realpath-cache-ttl realpath_cache_ttl=180 ; Enables or disables the circular reference collector. ; https://php.net/zend.enable-gc zend.enable_gc = On ; If enabled, scripts may be written in encodings that are incompatible with ; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such ; encodings. To use this feature, mbstring extension must be enabled. ;zend.multibyte = Off ; Allows to set the default encoding for the scripts. This value will be used ; unless "declare(encoding=...)" directive appears at the top of the script. ; Only affects if zend.multibyte is set. ;zend.script_encoding = ; Allows to include or exclude arguments from stack traces generated for exceptions. ; In production, it is recommended to turn this setting on to prohibit the output ; of sensitive information in stack traces ; Default Value: Off ; Development Value: Off ; Production Value: On zend.exception_ignore_args = On ; Allows setting the maximum string length in an argument of a stringified stack trace ; to a value between 0 and 1000000. ; This has no effect when zend.exception_ignore_args is enabled. ; Default Value: 15 ; Development Value: 15 ; Production Value: 0 ; In production, it is recommended to set this to 0 to reduce the output ; of sensitive information in stack traces. zend.exception_string_param_max_len = 0 ;;;;;;;;;;;;;;;;; ; Miscellaneous ; ;;;;;;;;;;;;;;;;; ; Decides whether PHP may expose the fact that it is installed on the server ; (e.g. by adding its signature to the Web server header). It is no security ; threat in any way, but it makes it possible to determine whether you use PHP ; on your server or not. ; https://php.net/expose-php expose_php = On ;;;;;;;;;;;;;;;;;;; ; Resource Limits ; ;;;;;;;;;;;;;;;;;;; ; Maximum execution time of each script, in seconds ; https://php.net/max-execution-time ; Note: This directive is hardcoded to 0 for the CLI SAPI max_execution_time = 180 ; Maximum amount of time each script may spend parsing request data. It's a good ; idea to limit this time on productions servers in order to eliminate unexpectedly ; long running scripts. ; Note: This directive is hardcoded to -1 for the CLI SAPI ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; https://php.net/max-input-time max_input_time = 180 ; Maximum input variable nesting level ; https://php.net/max-input-nesting-level ;max_input_nesting_level = 64 ; How many GET/POST/COOKIE input variables may be accepted max_input_vars = 9999 ; How many multipart body parts (combined input variable and file uploads) may ; be accepted. ; Default Value: -1 (Sum of max_input_vars and max_file_uploads) ;max_multipart_body_parts = 1500 ; Maximum amount of memory a script may consume ; https://php.net/memory-limit memory_limit = 395M ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; Error handling and logging ; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; This directive informs PHP of which errors, warnings and notices you would like ; it to take action for. The recommended way of setting values for this ; directive is through the use of the error level constants and bitwise ; operators. The error level constants are below here for convenience as well as ; some common settings and their meanings. ; By default, PHP is set to take action on all errors, notices and warnings EXCEPT ; those related to E_NOTICE, which together cover best practices and ; recommended coding standards in PHP. For performance reasons, this is the ; recommend error reporting setting. Your production server shouldn't be wasting ; resources complaining about best practices and coding standards. That's what ; development servers and development settings are for. ; Note: The php.ini-development file has this setting as E_ALL. This ; means it pretty much reports everything which is exactly what you want during ; development and early testing. ; ; Error Level Constants: ; E_ALL - All errors and warnings ; E_ERROR - fatal run-time errors ; E_RECOVERABLE_ERROR - almost fatal run-time errors ; E_WARNING - run-time warnings (non-fatal errors) ; E_PARSE - compile-time parse errors ; E_NOTICE - run-time notices (these are warnings which often result ; from a bug in your code, but it's possible that it was ; intentional (e.g., using an uninitialized variable and ; relying on the fact it is automatically initialized to an ; empty string) ; E_CORE_ERROR - fatal errors that occur during PHP's initial startup ; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's ; initial startup ; E_COMPILE_ERROR - fatal compile-time errors ; E_COMPILE_WARNING - compile-time warnings (non-fatal errors) ; E_USER_ERROR - user-generated error message ; E_USER_WARNING - user-generated warning message ; E_USER_NOTICE - user-generated notice message ; E_DEPRECATED - warn about code that will not work in future versions ; of PHP ; E_USER_DEPRECATED - user-generated deprecation warnings ; ; Common Values: ; E_ALL (Show all errors, warnings and notices including coding standards.) ; E_ALL & ~E_NOTICE (Show all errors, except for notices) ; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors) ; Default Value: E_ALL ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED ; https://php.net/error-reporting error_reporting = E_ALL & ~E_DEPRECATED ; This directive controls whether or not and where PHP will output errors, ; notices and warnings too. Error output is very useful during development, but ; it could be very dangerous in production environments. Depending on the code ; which is triggering the error, sensitive information could potentially leak ; out of your application such as database usernames and passwords or worse. ; For production environments, we recommend logging errors rather than ; sending them to STDOUT. ; Possible Values: ; Off = Do not display any errors ; stderr = Display errors to STDERR (affects only CGI/CLI binaries!) ; On or stdout = Display errors to STDOUT ; Default Value: On ; Development Value: On ; Production Value: Off ; https://php.net/display-errors display_errors = Off ; The display of errors which occur during PHP's startup sequence are handled ; separately from display_errors. We strongly recommend you set this to 'off' ; for production servers to avoid leaking configuration details. ; Default Value: On ; Development Value: On ; Production Value: Off ; https://php.net/display-startup-errors display_startup_errors = Off ; Besides displaying errors, PHP can also log errors to locations such as a ; server-specific log, STDERR, or a location specified by the error_log ; directive found below. While errors should not be displayed on productions ; servers they should still be monitored and logging is a great way to do that. ; Default Value: Off ; Development Value: On ; Production Value: On ; https://php.net/log-errors log_errors = On ; Do not log repeated messages. Repeated errors must occur in same file on same ; line unless ignore_repeated_source is set true. ; https://php.net/ignore-repeated-errors ignore_repeated_errors = Off ; Ignore source of message when ignoring repeated messages. When this setting ; is On you will not log errors with repeated messages from different files or ; source lines. ; https://php.net/ignore-repeated-source ignore_repeated_source = Off ; If this parameter is set to Off, then memory leaks will not be shown (on ; stdout or in the log). This is only effective in a debug compile, and if ; error reporting includes E_WARNING in the allowed list ; https://php.net/report-memleaks report_memleaks = On ; This setting is off by default. ;report_zend_debug = 0 ; Turn off normal error reporting and emit XML-RPC error XML ; https://php.net/xmlrpc-errors ;xmlrpc_errors = 0 ; An XML-RPC faultCode ;xmlrpc_error_number = 0 ; When PHP displays or logs an error, it has the capability of formatting the ; error message as HTML for easier reading. This directive controls whether ; the error message is formatted as HTML or not. ; Note: This directive is hardcoded to Off for the CLI SAPI ; https://php.net/html-errors html_errors = Off ; If html_errors is set to On *and* docref_root is not empty, then PHP ; produces clickable error messages that direct to a page describing the error ; or function causing the error in detail. ; You can download a copy of the PHP manual from https://php.net/docs ; and change docref_root to the base URL of your local copy including the ; leading '/'. You must also specify the file extension being used including ; the dot. PHP's default behavior is to leave these settings empty, in which ; case no links to documentation are generated. ; Note: Never use this feature for production boxes. ; https://php.net/docref-root ; Examples ;docref_root = "/phpmanual/" ; https://php.net/docref-ext ;docref_ext = .html ; String to output before an error message. PHP's default behavior is to leave ; this setting blank. ; https://php.net/error-prepend-string ; Example: ;error_prepend_string = "" ; String to output after an error message. PHP's default behavior is to leave ; this setting blank. ; https://php.net/error-append-string ; Example: ;error_append_string = "" ; Log errors to specified file. PHP's default behavior is to leave this value ; empty. ; https://php.net/error-log ; Example: ;error_log = php_errors.log ; Log errors to syslog (Event Log on Windows). ;error_log = syslog error_log = /var/log/php/error_log_84 ; The syslog ident is a string which is prepended to every message logged ; to syslog. Only used when error_log is set to syslog. ;syslog.ident = php ; The syslog facility is used to specify what type of program is logging ; the message. Only used when error_log is set to syslog. ;syslog.facility = user ; Set this to disable filtering control characters (the default). ; Some loggers only accept NVT-ASCII, others accept anything that's not ; control characters. If your logger accepts everything, then no filtering ; is needed at all. ; Allowed values are: ; ascii (all printable ASCII characters and NL) ; no-ctrl (all characters except control characters) ; all (all characters) ; raw (like "all", but messages are not split at newlines) ; https://php.net/syslog.filter ;syslog.filter = ascii ;windows.show_crt_warning ; Default value: 0 ; Development value: 0 ; Production value: 0 ;;;;;;;;;;;;;;;;; ; Data Handling ; ;;;;;;;;;;;;;;;;; ; The separator used in PHP generated URLs to separate arguments. ; PHP's default setting is "&". ; https://php.net/arg-separator.output ; Example: ;arg_separator.output = "&" ; List of separator(s) used by PHP to parse input URLs into variables. ; PHP's default setting is "&". ; NOTE: Every character in this directive is considered as separator! ; https://php.net/arg-separator.input ; Example: ;arg_separator.input = ";&" ; This directive determines which super global arrays are registered when PHP ; starts up. G,P,C,E & S are abbreviations for the following respective super ; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty ; paid for the registration of these arrays and because ENV is not as commonly ; used as the others, ENV is not recommended on productions servers. You ; can still get access to the environment variables through getenv() should you ; need to. ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS"; ; https://php.net/variables-order variables_order = "GPCS" ; This directive determines which super global data (G,P & C) should be ; registered into the super global array REQUEST. If so, it also determines ; the order in which that data is registered. The values for this directive ; are specified in the same manner as the variables_order directive, ; EXCEPT one. Leaving this value empty will cause PHP to use the value set ; in the variables_order directive. It does not mean it will leave the super ; globals array REQUEST empty. ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; https://php.net/request-order request_order = "GP" ; This directive determines whether PHP registers $argv & $argc each time it ; runs. $argv contains an array of all the arguments passed to PHP when a script ; is invoked. $argc contains an integer representing the number of arguments ; that were passed when the script was invoked. These arrays are extremely ; useful when running scripts from the command line. When this directive is ; enabled, registering these variables consumes CPU cycles and memory each time ; a script is executed. For performance reasons, this feature should be disabled ; on production servers. ; Note: This directive is hardcoded to On for the CLI SAPI ; Default Value: On ; Development Value: Off ; Production Value: Off ; https://php.net/register-argc-argv register_argc_argv = Off ; When enabled, the ENV, REQUEST and SERVER variables are created when they're ; first used (Just In Time) instead of when the script starts. If these ; variables are not used within a script, having this directive on will result ; in a performance gain. The PHP directive register_argc_argv must be disabled ; for this directive to have any effect. ; https://php.net/auto-globals-jit auto_globals_jit = On ; Whether PHP will read the POST data. ; This option is enabled by default. ; Most likely, you won't want to disable this option globally. It causes $_POST ; and $_FILES to always be empty; the only way you will be able to read the ; POST data will be through the php://input stream wrapper. This can be useful ; to proxy requests or to process the POST data in a memory efficient fashion. ; https://php.net/enable-post-data-reading ;enable_post_data_reading = Off ; Maximum size of POST data that PHP will accept. ; Its value may be 0 to disable the limit. It is ignored if POST data reading ; is disabled through enable_post_data_reading. ; https://php.net/post-max-size post_max_size = 350M ; Automatically add files before PHP document. ; https://php.net/auto-prepend-file auto_prepend_file = ; Automatically add files after PHP document. ; https://php.net/auto-append-file auto_append_file = ; By default, PHP will output a media type using the Content-Type header. To ; disable this, simply set it to be empty. ; ; PHP's built-in default media type is set to text/html. ; https://php.net/default-mimetype default_mimetype = "text/html" ; PHP's default character set is set to UTF-8. ; https://php.net/default-charset default_charset = "UTF-8" ; PHP internal character encoding is set to empty. ; If empty, default_charset is used. ; https://php.net/internal-encoding ;internal_encoding = ; PHP input character encoding is set to empty. ; If empty, default_charset is used. ; https://php.net/input-encoding ;input_encoding = ; PHP output character encoding is set to empty. ; If empty, default_charset is used. ; See also output_buffer. ; https://php.net/output-encoding ;output_encoding = ;;;;;;;;;;;;;;;;;;;;;;;;; ; Paths and Directories ; ;;;;;;;;;;;;;;;;;;;;;;;;; ; UNIX: "/path1:/path2" ;include_path = ".:/php/includes" ; ; Windows: "\path1;\path2" ;include_path = ".;c:\php\includes" ; ; PHP's default setting for include_path is ".;/path/to/php/pear" ; https://php.net/include-path include_path = ".:/opt/php84/lib/php" ; The root of the PHP pages, used only if nonempty. ; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root ; if you are running php as a CGI under any web server (other than IIS) ; see documentation for security issues. The alternate is to use the ; cgi.force_redirect configuration below ; https://php.net/doc-root doc_root = ; The directory under which PHP opens the script using /~username used only ; if nonempty. ; https://php.net/user-dir user_dir = ; Directory in which the loadable extensions (modules) reside. ; https://php.net/extension-dir ;extension_dir = "./" ; On windows: ;extension_dir = "ext" extension_dir = "/opt/php84/lib/php/extensions/no-debug-non-zts-20240924/" ; Directory where the temporary files should be placed. ; Defaults to the system default (see sys_get_temp_dir) sys_temp_dir = "/tmp" ; Whether or not to enable the dl() function. The dl() function does NOT work ; properly in multithreaded servers, such as IIS or Zeus, and is automatically ; disabled on them. ; https://php.net/enable-dl enable_dl = Off ; cgi.force_redirect is necessary to provide security running PHP as a CGI under ; most web servers. Left undefined, PHP turns this on by default. You can ; turn it off here AT YOUR OWN RISK ; **You CAN safely turn this off for IIS, in fact, you MUST.** ; https://php.net/cgi.force-redirect ;cgi.force_redirect = 1 ; if cgi.nph is enabled it will force cgi to always sent Status: 200 with ; every request. PHP's default behavior is to disable this feature. ;cgi.nph = 1 ; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape ; (iPlanet) web servers, you MAY need to set an environment variable name that PHP ; will look for to know it is OK to continue execution. Setting this variable MAY ; cause security issues, KNOW WHAT YOU ARE DOING FIRST. ; https://php.net/cgi.redirect-status-env ;cgi.redirect_status_env = ; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's ; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok ; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting ; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting ; of zero causes PHP to behave as before. Default is 1. You should fix your scripts ; to use SCRIPT_FILENAME rather than PATH_TRANSLATED. ; https://php.net/cgi.fix-pathinfo ;cgi.fix_pathinfo=1 ; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside ; of the web tree and people will not be able to circumvent .htaccess security. ;cgi.discard_path=1 ; FastCGI under IIS supports the ability to impersonate ; security tokens of the calling client. This allows IIS to define the ; security context that the request runs under. mod_fastcgi under Apache ; does not currently support this feature (03/17/2002) ; Set to 1 if running under IIS. Default is zero. ; https://php.net/fastcgi.impersonate ;fastcgi.impersonate = 1 ; Disable logging through FastCGI connection. PHP's default behavior is to enable ; this feature. ;fastcgi.logging = 0 ; cgi.rfc2616_headers configuration option tells PHP what type of headers to ; use when sending HTTP response code. If set to 0, PHP sends Status: header that ; is supported by Apache. When this option is set to 1, PHP will send ; RFC2616 compliant header. ; Default is zero. ; https://php.net/cgi.rfc2616-headers ;cgi.rfc2616_headers = 0 ; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #! ; (shebang) at the top of the running script. This line might be needed if the ; script support running both as stand-alone script and via PHP CGI<. PHP in CGI ; mode skips this line and ignores its content if this directive is turned on. ; https://php.net/cgi.check-shebang-line ;cgi.check_shebang_line=1 ;;;;;;;;;;;;;;;; ; File Uploads ; ;;;;;;;;;;;;;;;; ; Whether to allow HTTP file uploads. ; https://php.net/file-uploads file_uploads = On ; Temporary directory for HTTP uploaded files (will use system default if not ; specified). ; https://php.net/upload-tmp-dir upload_tmp_dir = /tmp ; Maximum allowed size for uploaded files. ; https://php.net/upload-max-filesize upload_max_filesize = 325M ; Maximum number of files that can be uploaded via a single request max_file_uploads = 50 ;;;;;;;;;;;;;;;;;; ; Fopen wrappers ; ;;;;;;;;;;;;;;;;;; ; Whether to allow the treatment of URLs (like http:// or ftp://) as files. ; https://php.net/allow-url-fopen allow_url_fopen = On ; Whether to allow include/require to open URLs (like https:// or ftp://) as files. ; https://php.net/allow-url-include allow_url_include = Off ; Define the anonymous ftp password (your email address). PHP's default setting ; for this is empty. ; https://php.net/from ;from="john@doe.com" ; Define the User-Agent string. PHP's default setting for this is empty. ; https://php.net/user-agent ;user_agent="PHP" ; Default timeout for socket based streams (seconds) ; https://php.net/default-socket-timeout default_socket_timeout = 180 ; If your scripts have to deal with files from Macintosh systems, ; or you are running on a Mac and need to deal with files from ; unix or win32 systems, setting this flag will cause PHP to ; automatically detect the EOL character in those files so that ; fgets() and file() will work regardless of the source of the file. ; https://php.net/auto-detect-line-endings auto_detect_line_endings = On ;;;;;;;;;;;;;;;;;;;;;; ; Dynamic Extensions ; ;;;;;;;;;;;;;;;;;;;;;; ; If you wish to have an extension loaded automatically, use the following ; syntax: ; ; extension=modulename ; ; For example: ; ; extension=mysqli ; ; When the extension library to load is not located in the default extension ; directory, You may specify an absolute path to the library file: ; ; extension=/path/to/extension/mysqli.so ; ; Note : The syntax used in previous PHP versions ('extension=.so' and ; 'extension='php_.dll') is supported for legacy reasons and may be ; deprecated in a future PHP major version. So, when it is possible, please ; move to the new ('extension=) syntax. ; ; Notes for Windows environments : ; ; - Many DLL files are located in the ext/ ; extension folders as well as the separate PECL DLL download. ; Be sure to appropriately set the extension_dir directive. ; ;extension=bz2 ;extension=curl ;extension=ffi ;extension=ftp ;extension=fileinfo ;extension=gd ;extension=gettext ;extension=gmp ;extension=intl ;extension=ldap ;extension=mbstring ;extension=exif ; Must be after mbstring as it depends on it ;extension=mysqli ;extension=odbc ;extension=openssl ;extension=pdo_firebird ;extension=pdo_mysql ;extension=pdo_odbc ;extension=pdo_pgsql ;extension=pdo_sqlite ;extension=pgsql ;extension=shmop ; The MIBS data available in the PHP distribution must be installed. ; See https://www.php.net/manual/en/snmp.installation.php ;extension=snmp ;extension=soap ;extension=sockets ;extension=sodium ;extension=sqlite3 ;extension=tidy ;extension=xsl ;extension=zip ;zend_extension=opcache ;;;;;;;;;;;;;;;;;;; ; Module Settings ; ;;;;;;;;;;;;;;;;;;; [CLI Server] ; Whether the CLI web server uses ANSI color coding in its terminal output. cli_server.color = On [Date] ; Defines the default timezone used by the date functions ; https://php.net/date.timezone date.timezone = "UTC" ; https://php.net/date.default-latitude ;date.default_latitude = 31.7667 ; https://php.net/date.default-longitude ;date.default_longitude = 35.2333 ; https://php.net/date.sunrise-zenith ;date.sunrise_zenith = 90.833333 ; https://php.net/date.sunset-zenith ;date.sunset_zenith = 90.833333 [filter] ; https://php.net/filter.default ;filter.default = unsafe_raw ; https://php.net/filter.default-flags ;filter.default_flags = [iconv] ; Use of this INI entry is deprecated, use global input_encoding instead. ; If empty, default_charset or input_encoding or iconv.input_encoding is used. ; The precedence is: default_charset < input_encoding < iconv.input_encoding ;iconv.input_encoding = ; Use of this INI entry is deprecated, use global internal_encoding instead. ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;iconv.internal_encoding = ; Use of this INI entry is deprecated, use global output_encoding instead. ; If empty, default_charset or output_encoding or iconv.output_encoding is used. ; The precedence is: default_charset < output_encoding < iconv.output_encoding ; To use an output encoding conversion, iconv's output handler must be set ; otherwise output encoding conversion cannot be performed. ;iconv.output_encoding = [intl] ;intl.default_locale = ; This directive allows you to produce PHP errors when some error ; happens within intl functions. The value is the level of the error produced. ; Default is 0, which does not produce any errors. ;intl.error_level = E_WARNING ;intl.use_exceptions = 0 [sqlite3] ; Directory pointing to SQLite3 extensions ; https://php.net/sqlite3.extension-dir ;sqlite3.extension_dir = ; SQLite defensive mode flag (only available from SQLite 3.26+) ; When the defensive flag is enabled, language features that allow ordinary ; SQL to deliberately corrupt the database file are disabled. This forbids ; writing directly to the schema, shadow tables (eg. FTS data tables), or ; the sqlite_dbpage virtual table. ; https://www.sqlite.org/c3ref/c_dbconfig_defensive.html ; (for older SQLite versions, this flag has no use) ;sqlite3.defensive = 1 [Pcre] ; PCRE library backtracking limit. ; https://php.net/pcre.backtrack-limit ;pcre.backtrack_limit=100000 ; PCRE library recursion limit. ; Please note that if you set this value to a high number you may consume all ; the available process stack and eventually crash PHP (due to reaching the ; stack size limit imposed by the Operating System). ; https://php.net/pcre.recursion-limit ;pcre.recursion_limit=100000 ; Enables or disables JIT compilation of patterns. This requires the PCRE ; library to be compiled with JIT support. ;pcre.jit=1 [Pdo] ; Whether to pool ODBC connections. Can be one of "strict", "relaxed" or "off" ; https://php.net/pdo-odbc.connection-pooling ;pdo_odbc.connection_pooling=strict [Pdo_mysql] ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. pdo_mysql.default_socket= [Phar] ; https://php.net/phar.readonly ;phar.readonly = On ; https://php.net/phar.require-hash ;phar.require_hash = On ;phar.cache_list = [mail function] ; For Win32 only. ; https://php.net/smtp ;SMTP = localhost ; https://php.net/smtp-port ;smtp_port = 25 ; For Win32 only. ; https://php.net/sendmail-from ;sendmail_from = me@example.com ; For Unix only. You may supply arguments as well (default: "sendmail -t -i"). ; https://php.net/sendmail-path sendmail_path = /usr/sbin/sendmail -t -i ; Force the addition of the specified parameters to be passed as extra parameters ; to the sendmail binary. These parameters will always replace the value of ; the 5th parameter to mail(). ;mail.force_extra_parameters = ; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename mail.add_x_header = Off ; Use mixed LF and CRLF line separators to keep compatibility with some ; RFC 2822 non conformant MTA. mail.mixed_lf_and_crlf = Off ; The path to a log file that will log all mail() calls. Log entries include ; the full path of the script, line number, To address and headers. ;mail.log = ; Log mail to syslog (Event Log on Windows). ;mail.log = syslog [ODBC] ; https://php.net/odbc.default-db ;odbc.default_db = Not yet implemented ; https://php.net/odbc.default-user ;odbc.default_user = Not yet implemented ; https://php.net/odbc.default-pw ;odbc.default_pw = Not yet implemented ; Controls the ODBC cursor model. ; Default: SQL_CURSOR_STATIC (default). ;odbc.default_cursortype ; Allow or prevent persistent links. ; https://php.net/odbc.allow-persistent odbc.allow_persistent = On ; Check that a connection is still valid before reuse. ; https://php.net/odbc.check-persistent odbc.check_persistent = On ; Maximum number of persistent links. -1 means no limit. ; https://php.net/odbc.max-persistent odbc.max_persistent = -1 ; Maximum number of links (persistent + non-persistent). -1 means no limit. ; https://php.net/odbc.max-links odbc.max_links = -1 ; Handling of LONG fields. Returns number of bytes to variables. 0 means ; passthru. ; https://php.net/odbc.defaultlrl odbc.defaultlrl = 4096 ; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char. ; See the documentation on odbc_binmode and odbc_longreadlen for an explanation ; of odbc.defaultlrl and odbc.defaultbinmode ; https://php.net/odbc.defaultbinmode odbc.defaultbinmode = 1 [MySQLi] ; Maximum number of persistent links. -1 means no limit. ; https://php.net/mysqli.max-persistent mysqli.max_persistent = -1 ; Allow accessing, from PHP's perspective, local files with LOAD DATA statements ; https://php.net/mysqli.allow_local_infile ;mysqli.allow_local_infile = On ; It allows the user to specify a folder where files that can be sent via LOAD DATA ; LOCAL can exist. It is ignored if mysqli.allow_local_infile is enabled. ;mysqli.local_infile_directory = ; Allow or prevent persistent links. ; https://php.net/mysqli.allow-persistent mysqli.allow_persistent = On ; Maximum number of links. -1 means no limit. ; https://php.net/mysqli.max-links mysqli.max_links = -1 ; Default port number for mysqli_connect(). If unset, mysqli_connect() will use ; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the ; compile-time value defined MYSQL_PORT (in that order). Win32 will only look ; at MYSQL_PORT. ; https://php.net/mysqli.default-port mysqli.default_port = 3306 ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. ; https://php.net/mysqli.default-socket mysqli.default_socket = ; Default host for mysqli_connect() (doesn't apply in safe mode). ; https://php.net/mysqli.default-host mysqli.default_host = ; Default user for mysqli_connect() (doesn't apply in safe mode). ; https://php.net/mysqli.default-user mysqli.default_user = ; Default password for mysqli_connect() (doesn't apply in safe mode). ; Note that this is generally a *bad* idea to store passwords in this file. ; *Any* user with PHP access can run 'echo get_cfg_var("mysqli.default_pw") ; and reveal this password! And of course, any users with read access to this ; file will be able to reveal the password as well. ; https://php.net/mysqli.default-pw mysqli.default_pw = ; If this option is enabled, closing a persistent connection will rollback ; any pending transactions of this connection, before it is put back ; into the persistent connection pool. ;mysqli.rollback_on_cached_plink = Off [mysqlnd] ; Enable / Disable collection of general statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. mysqlnd.collect_statistics = 0 ; Enable / Disable collection of memory usage statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. mysqlnd.collect_memory_statistics = 0 ; Records communication from all extensions using mysqlnd to the specified log ; file. ; https://php.net/mysqlnd.debug ;mysqlnd.debug = ; Defines which queries will be logged. ;mysqlnd.log_mask = 0 ; Default size of the mysqlnd memory pool, which is used by result sets. mysqlnd.mempool_default_size = 64000 ; Size of a pre-allocated buffer used when sending commands to MySQL in bytes. mysqlnd.net_cmd_buffer_size = 8192 ; Size of a pre-allocated buffer used for reading data sent by the server in ; bytes. mysqlnd.net_read_buffer_size = 131072 ; Timeout for network requests in seconds. ;mysqlnd.net_read_timeout = 31536000 ; SHA-256 Authentication Plugin related. File with the MySQL server public RSA ; key. ;mysqlnd.sha256_server_public_key = [PostgreSQL] ; Allow or prevent persistent links. ; https://php.net/pgsql.allow-persistent pgsql.allow_persistent = On ; Detect broken persistent links always with pg_pconnect(). ; Auto reset feature requires a little overheads. ; https://php.net/pgsql.auto-reset-persistent pgsql.auto_reset_persistent = Off ; Maximum number of persistent links. -1 means no limit. ; https://php.net/pgsql.max-persistent pgsql.max_persistent = -1 ; Maximum number of links (persistent+non persistent). -1 means no limit. ; https://php.net/pgsql.max-links pgsql.max_links = -1 ; Ignore PostgreSQL backends Notice message or not. ; Notice message logging require a little overheads. ; https://php.net/pgsql.ignore-notice pgsql.ignore_notice = 0 ; Log PostgreSQL backends Notice message or not. ; Unless pgsql.ignore_notice=0, module cannot log notice message. ; https://php.net/pgsql.log-notice pgsql.log_notice = 0 [bcmath] ; Number of decimal digits for all bcmath functions. ; https://php.net/bcmath.scale bcmath.scale = 0 [browscap] ; https://php.net/browscap ;browscap = extra/browscap.ini [Session] ; Handler used to store/retrieve data. ; https://php.net/session.save-handler session.save_handler = files ; Argument passed to save_handler. In the case of files, this is the path ; where data files are stored. Note: Windows users have to change this ; variable in order to use PHP's session functions. ; ; The path can be defined as: ; ; session.save_path = "N;/path" ; ; where N is an integer. Instead of storing all the session files in ; /path, what this will do is use subdirectories N-levels deep, and ; store the session data in those directories. This is useful if ; your OS has problems with many files in one directory, and is ; a more efficient layout for servers that handle many sessions. ; ; NOTE 1: PHP will not create this directory structure automatically. ; You can use the script in the ext/session dir for that purpose. ; NOTE 2: See the section on garbage collection below if you choose to ; use subdirectories for session storage ; ; The file storage module creates files using mode 600 by default. ; You can change that by using ; ; session.save_path = "N;MODE;/path" ; ; where MODE is the octal representation of the mode. Note that this ; does not overwrite the process's umask. ; https://php.net/session.save-path session.save_path = "/opt/tmp" ; Whether to use strict session mode. ; Strict session mode does not accept an uninitialized session ID, and ; regenerates the session ID if the browser sends an uninitialized session ID. ; Strict mode protects applications from session fixation via a session adoption ; vulnerability. It is disabled by default for maximum compatibility, but ; enabling it is encouraged. ; https://wiki.php.net/rfc/strict_sessions session.use_strict_mode = 0 ; Whether to use cookies. ; https://php.net/session.use-cookies session.use_cookies = 1 ; https://php.net/session.cookie-secure ;session.cookie_secure = ; This option forces PHP to fetch and use a cookie for storing and maintaining ; the session id. We encourage this operation as it's very helpful in combating ; session hijacking when not specifying and managing your own session id. It is ; not the be-all and end-all of session hijacking defense, but it's a good start. ; https://php.net/session.use-only-cookies session.use_only_cookies = 1 ; Name of the session (used as cookie name). ; https://php.net/session.name session.name = PHPSESSID ; Initialize session on request startup. ; https://php.net/session.auto-start session.auto_start = 0 ; Lifetime in seconds of cookie or, if 0, until browser is restarted. ; https://php.net/session.cookie-lifetime session.cookie_lifetime = 0 ; The path for which the cookie is valid. ; https://php.net/session.cookie-path session.cookie_path = / ; The domain for which the cookie is valid. ; https://php.net/session.cookie-domain session.cookie_domain = ; Whether or not to add the httpOnly flag to the cookie, which makes it ; inaccessible to browser scripting languages such as JavaScript. ; https://php.net/session.cookie-httponly session.cookie_httponly = 1 ; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF) ; Current valid values are "Strict", "Lax" or "None". When using "None", ; make sure to include the quotes, as `none` is interpreted like `false` in ini files. ; https://tools.ietf.org/html/draft-west-first-party-cookies-07 session.cookie_samesite = ; Handler used to serialize data. php is the standard serializer of PHP. ; https://php.net/session.serialize-handler session.serialize_handler = php ; Defines the probability that the 'garbage collection' process is started on every ; session initialization. The probability is calculated by using gc_probability/gc_divisor, ; e.g. 1/100 means there is a 1% chance that the GC process starts on each request. ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; https://php.net/session.gc-probability session.gc_probability = 1 ; Defines the probability that the 'garbage collection' process is started on every ; session initialization. The probability is calculated by using gc_probability/gc_divisor, ; e.g. 1/100 means there is a 1% chance that the GC process starts on each request. ; For high volume production servers, using a value of 1000 is a more efficient approach. ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; https://php.net/session.gc-divisor session.gc_divisor = 1000 ; After this number of seconds, stored data will be seen as 'garbage' and ; cleaned up by the garbage collection process. ; https://php.net/session.gc-maxlifetime session.gc_maxlifetime = 1440 ; NOTE: If you are using the subdirectory option for storing session files ; (see session.save_path above), then garbage collection does *not* ; happen automatically. You will need to do your own garbage ; collection through a shell script, cron entry, or some other method. ; For example, the following script is the equivalent of setting ; session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes): ; find /path/to/sessions -cmin +24 -type f | xargs rm ; Check HTTP Referer to invalidate externally stored URLs containing ids. ; HTTP_REFERER has to contain this substring for the session to be ; considered as valid. ; https://php.net/session.referer-check session.referer_check = ; Set to {nocache,private,public,} to determine HTTP caching aspects ; or leave this empty to avoid sending anti-caching headers. ; https://php.net/session.cache-limiter session.cache_limiter = nocache ; Document expires after n minutes. ; https://php.net/session.cache-expire session.cache_expire = 180 ; trans sid support is disabled by default. ; Use of trans sid may risk your users' security. ; Use this option with caution. ; - User may send URL contains active session ID ; to other person via. email/irc/etc. ; - URL that contains active session ID may be stored ; in publicly accessible computer. ; - User may access your site with the same session ID ; always using URL stored in browser's history or bookmarks. ; https://php.net/session.use-trans-sid session.use_trans_sid = 0 ; The URL rewriter will look for URLs in a defined set of HTML tags. ; is special; if you include them here, the rewriter will ; add a hidden field with the info which is otherwise appended ; to URLs. tag's action attribute URL will not be modified ; unless it is specified. ; Note that all valid entries require a "=", even if no value follows. ; Default Value: "a=href,area=href,frame=src,form=" ; Development Value: "a=href,area=href,frame=src,form=" ; Production Value: "a=href,area=href,frame=src,form=" ; https://php.net/url-rewriter.tags session.trans_sid_tags = "a=href,area=href,frame=src,form=" ; URL rewriter does not rewrite absolute URLs by default. ; To enable rewrites for absolute paths, target hosts must be specified ; at RUNTIME. i.e. use ini_set() ; tags is special. PHP will check action attribute's URL regardless ; of session.trans_sid_tags setting. ; If no host is defined, HTTP_HOST will be used for allowed host. ; Example value: php.net,www.php.net,wiki.php.net ; Use "," for multiple hosts. No spaces are allowed. ; Default Value: "" ; Development Value: "" ; Production Value: "" ;session.trans_sid_hosts="" ; Enable upload progress tracking in $_SESSION ; Default Value: On ; Development Value: On ; Production Value: On ; https://php.net/session.upload-progress.enabled ;session.upload_progress.enabled = On ; Cleanup the progress information as soon as all POST data has been read ; (i.e. upload completed). ; Default Value: On ; Development Value: On ; Production Value: On ; https://php.net/session.upload-progress.cleanup ;session.upload_progress.cleanup = On ; A prefix used for the upload progress key in $_SESSION ; Default Value: "upload_progress_" ; Development Value: "upload_progress_" ; Production Value: "upload_progress_" ; https://php.net/session.upload-progress.prefix ;session.upload_progress.prefix = "upload_progress_" ; The index name (concatenated with the prefix) in $_SESSION ; containing the upload progress information ; Default Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Development Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Production Value: "PHP_SESSION_UPLOAD_PROGRESS" ; https://php.net/session.upload-progress.name ;session.upload_progress.name = "PHP_SESSION_UPLOAD_PROGRESS" ; How frequently the upload progress should be updated. ; Given either in percentages (per-file), or in bytes ; Default Value: "1%" ; Development Value: "1%" ; Production Value: "1%" ; https://php.net/session.upload-progress.freq ;session.upload_progress.freq = "1%" ; The minimum delay between updates, in seconds ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; https://php.net/session.upload-progress.min-freq ;session.upload_progress.min_freq = "1" ; Only write session data when session data is changed. Enabled by default. ; https://php.net/session.lazy-write ;session.lazy_write = On [Assertion] ; Switch whether to compile assertions at all (to have no overhead at run-time) ; -1: Do not compile at all ; 0: Jump over assertion at run-time ; 1: Execute assertions ; Changing from or to a negative value is only possible in php.ini! ; (For turning assertions on and off at run-time, toggle zend.assertions between the values 1 and 0) ; Default Value: 1 ; Development Value: 1 ; Production Value: -1 ; https://php.net/zend.assertions zend.assertions = -1 [COM] ; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs ; https://php.net/com.typelib-file ;com.typelib_file = ; allow Distributed-COM calls ; https://php.net/com.allow-dcom ;com.allow_dcom = true ; autoregister constants of a component's typelib on com_load() ; https://php.net/com.autoregister-typelib ;com.autoregister_typelib = true ; register constants casesensitive ; https://php.net/com.autoregister-casesensitive ;com.autoregister_casesensitive = false ; show warnings on duplicate constant registrations ; https://php.net/com.autoregister-verbose ;com.autoregister_verbose = true ; The default character set code-page to use when passing strings to and from COM objects. ; Default: system ANSI code page ;com.code_page= ; The version of the .NET framework to use. The value of the setting are the first three parts ; of the framework's version number, separated by dots, and prefixed with "v", e.g. "v4.0.30319". ;com.dotnet_version= [mbstring] ; language for internal character representation. ; This affects mb_send_mail() and mbstring.detect_order. ; https://php.net/mbstring.language ;mbstring.language = Japanese ; Use of this INI entry is deprecated, use global internal_encoding instead. ; internal/script encoding. ; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*) ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;mbstring.internal_encoding = ; Use of this INI entry is deprecated, use global input_encoding instead. ; http input encoding. ; mbstring.encoding_translation = On is needed to use this setting. ; If empty, default_charset or input_encoding or mbstring.input is used. ; The precedence is: default_charset < input_encoding < mbstring.http_input ; https://php.net/mbstring.http-input ;mbstring.http_input = ; Use of this INI entry is deprecated, use global output_encoding instead. ; http output encoding. ; mb_output_handler must be registered as output buffer to function. ; If empty, default_charset or output_encoding or mbstring.http_output is used. ; The precedence is: default_charset < output_encoding < mbstring.http_output ; To use an output encoding conversion, mbstring's output handler must be set ; otherwise output encoding conversion cannot be performed. ; https://php.net/mbstring.http-output ;mbstring.http_output = ; enable automatic encoding translation according to ; mbstring.internal_encoding setting. Input chars are ; converted to internal encoding by setting this to On. ; Note: Do _not_ use automatic encoding translation for ; portable libs/applications. ; https://php.net/mbstring.encoding-translation ;mbstring.encoding_translation = Off ; automatic encoding detection order. ; "auto" detect order is changed according to mbstring.language ; https://php.net/mbstring.detect-order ;mbstring.detect_order = auto ; substitute_character used when character cannot be converted ; one from another ; https://php.net/mbstring.substitute-character ;mbstring.substitute_character = none ; Enable strict encoding detection. ;mbstring.strict_detection = Off ; This directive specifies the regex pattern of content types for which mb_output_handler() ; is activated. ; Default: mbstring.http_output_conv_mimetypes=^(text/|application/xhtml\+xml) ;mbstring.http_output_conv_mimetypes= ; This directive specifies maximum stack depth for mbstring regular expressions. It is similar ; to the pcre.recursion_limit for PCRE. ;mbstring.regex_stack_limit=100000 ; This directive specifies maximum retry count for mbstring regular expressions. It is similar ; to the pcre.backtrack_limit for PCRE. ;mbstring.regex_retry_limit=1000000 [gd] ; Tell the jpeg decode to ignore warnings and try to create ; a gd image. The warning will then be displayed as notices ; disabled by default ; https://php.net/gd.jpeg-ignore-warning ;gd.jpeg_ignore_warning = 1 [exif] ; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS. ; With mbstring support this will automatically be converted into the encoding ; given by corresponding encode setting. When empty mbstring.internal_encoding ; is used. For the decode settings you can distinguish between motorola and ; intel byte order. A decode setting must not be empty. ; https://php.net/exif.encode-unicode ;exif.encode_unicode = ISO-8859-15 ; https://php.net/exif.decode-unicode-motorola ;exif.decode_unicode_motorola = UCS-2BE ; https://php.net/exif.decode-unicode-intel ;exif.decode_unicode_intel = UCS-2LE ; https://php.net/exif.encode-jis ;exif.encode_jis = ; https://php.net/exif.decode-jis-motorola ;exif.decode_jis_motorola = JIS ; https://php.net/exif.decode-jis-intel ;exif.decode_jis_intel = JIS [Tidy] ; The path to a default tidy configuration file to use when using tidy ; https://php.net/tidy.default-config ;tidy.default_config = /usr/local/lib/php/default.tcfg ; Should tidy clean and repair output automatically? ; WARNING: Do not use this option if you are generating non-html content ; such as dynamic images ; https://php.net/tidy.clean-output tidy.clean_output = Off [soap] ; Enables or disables WSDL caching feature. ; https://php.net/soap.wsdl-cache-enabled soap.wsdl_cache_enabled=1 ; Sets the directory name where SOAP extension will put cache files. ; https://php.net/soap.wsdl-cache-dir soap.wsdl_cache_dir="/tmp" ; (time to live) Sets the number of second while cached file will be used ; instead of original one. ; https://php.net/soap.wsdl-cache-ttl soap.wsdl_cache_ttl=86400 ; Sets the size of the cache limit. (Max. number of WSDL files to cache) soap.wsdl_cache_limit = 5 [sysvshm] ; A default size of the shared memory segment ;sysvshm.init_mem = 10000 [ldap] ; Sets the maximum number of open links or -1 for unlimited. ldap.max_links = -1 [dba] ;dba.default_handler= [opcache] ; Determines if Zend OPCache is enabled ;opcache.enable=1 ; Determines if Zend OPCache is enabled for the CLI version of PHP ;opcache.enable_cli=0 ; The OPcache shared memory storage size. ;opcache.memory_consumption=128 ; The amount of memory for interned strings in Mbytes. ;opcache.interned_strings_buffer=8 ; The maximum number of keys (scripts) in the OPcache hash table. ; Only numbers between 200 and 1000000 are allowed. ;opcache.max_accelerated_files=10000 ; The maximum percentage of "wasted" memory until a restart is scheduled. ;opcache.max_wasted_percentage=5 ; When this directive is enabled, the OPcache appends the current working ; directory to the script key, thus eliminating possible collisions between ; files with the same name (basename). Disabling the directive improves ; performance, but may break existing applications. ;opcache.use_cwd=1 ; When disabled, you must reset the OPcache manually or restart the ; webserver for changes to the filesystem to take effect. ;opcache.validate_timestamps=1 ; How often (in seconds) to check file timestamps for changes to the shared ; memory storage allocation. ("1" means validate once per second, but only ; once per request. "0" means always validate) ;opcache.revalidate_freq=2 ; Enables or disables file search in include_path optimization ;opcache.revalidate_path=0 ; If disabled, all PHPDoc comments are dropped from the code to reduce the ; size of the optimized code. ;opcache.save_comments=1 ; If enabled, compilation warnings (including notices and deprecations) will ; be recorded and replayed each time a file is included. Otherwise, compilation ; warnings will only be emitted when the file is first cached. ;opcache.record_warnings=0 ; Allow file existence override (file_exists, etc.) performance feature. ;opcache.enable_file_override=0 ; A bitmask, where each bit enables or disables the appropriate OPcache ; passes ;opcache.optimization_level=0x7FFFBFFF ;opcache.dups_fix=0 ; The location of the OPcache blacklist file (wildcards allowed). ; Each OPcache blacklist file is a text file that holds the names of files ; that should not be accelerated. The file format is to add each filename ; to a new line. The filename may be a full path or just a file prefix ; (i.e., /var/www/x blacklists all the files and directories in /var/www ; that start with 'x'). Line starting with a ; are ignored (comments). ;opcache.blacklist_filename= ; Allows exclusion of large files from being cached. By default all files ; are cached. ;opcache.max_file_size=0 ; How long to wait (in seconds) for a scheduled restart to begin if the cache ; is not being accessed. ;opcache.force_restart_timeout=180 ; OPcache error_log file name. Empty string assumes "stderr". ;opcache.error_log= ; All OPcache errors go to the Web server log. ; By default, only fatal errors (level 0) or errors (level 1) are logged. ; You can also enable warnings (level 2), info messages (level 3) or ; debug messages (level 4). ;opcache.log_verbosity_level=1 ; Preferred Shared Memory back-end. Leave empty and let the system decide. ;opcache.preferred_memory_model= ; Protect the shared memory from unexpected writing during script execution. ; Useful for internal debugging only. ;opcache.protect_memory=0 ; Allows calling OPcache API functions only from PHP scripts which path is ; started from specified string. The default "" means no restriction ;opcache.restrict_api= ; Mapping base of shared memory segments (for Windows only). All the PHP ; processes have to map shared memory into the same address space. This ; directive allows to manually fix the "Unable to reattach to base address" ; errors. ;opcache.mmap_base= ; Facilitates multiple OPcache instances per user (for Windows only). All PHP ; processes with the same cache ID and user share an OPcache instance. ;opcache.cache_id= ; Enables and sets the second level cache directory. ; It should improve performance when SHM memory is full, at server restart or ; SHM reset. The default "" disables file based caching. ;opcache.file_cache= ; Enables or disables opcode caching in shared memory. ;opcache.file_cache_only=0 ; Enables or disables checksum validation when script loaded from file cache. ;opcache.file_cache_consistency_checks=1 ; Implies opcache.file_cache_only=1 for a certain process that failed to ; reattach to the shared memory (for Windows only). Explicitly enabled file ; cache is required. ;opcache.file_cache_fallback=1 ; Enables or disables copying of PHP code (text segment) into HUGE PAGES. ; Under certain circumstances (if only a single global PHP process is ; started from which all others fork), this can increase performance ; by a tiny amount because TLB misses are reduced. On the other hand, this ; delays PHP startup, increases memory usage and degrades performance ; under memory pressure - use with care. ; Requires appropriate OS configuration. ;opcache.huge_code_pages=0 ; Validate cached file permissions. ;opcache.validate_permission=0 ; Prevent name collisions in chroot'ed environment. ;opcache.validate_root=0 ; If specified, it produces opcode dumps for debugging different stages of ; optimizations. ;opcache.opt_debug_level=0 ; Specifies a PHP script that is going to be compiled and executed at server ; start-up. ; https://php.net/opcache.preload ;opcache.preload= ; Preloading code as root is not allowed for security reasons. This directive ; facilitates to let the preloading to be run as another user. ; https://php.net/opcache.preload_user ;opcache.preload_user= ; Prevents caching files that are less than this number of seconds old. It ; protects from caching of incompletely updated files. In case all file updates ; on your site are atomic, you may increase performance by setting it to "0". ;opcache.file_update_protection=2 ; Absolute path used to store shared lockfiles (for *nix only). ;opcache.lockfile_path=/tmp [curl] ; A default value for the CURLOPT_CAINFO option. This is required to be an ; absolute path. ;curl.cainfo = [openssl] ; The location of a Certificate Authority (CA) file on the local filesystem ; to use when verifying the identity of SSL/TLS peers. Most users should ; not specify a value for this directive as PHP will attempt to use the ; OS-managed cert stores in its absence. If specified, this value may still ; be overridden on a per-stream basis via the "cafile" SSL stream context ; option. ;openssl.cafile= ; If openssl.cafile is not specified or if the CA file is not found, the ; directory pointed to by openssl.capath is searched for a suitable ; certificate. This value must be a correctly hashed certificate directory. ; Most users should not specify a value for this directive as PHP will ; attempt to use the OS-managed cert stores in its absence. If specified, ; this value may still be overridden on a per-stream basis via the "capath" ; SSL stream context option. ;openssl.capath= [ffi] ; FFI API restriction. Possible values: ; "preload" - enabled in CLI scripts and preloaded files (default) ; "false" - always disabled ; "true" - always enabled ;ffi.enable=preload ; List of headers files to preload, wildcard patterns allowed. ;ffi.preload= [Zend] zend_extension="/usr/local/ioncube/ioncube_loader_lin_8.4.so" ; fix for segfaults auto_globals_jit = Off cgi.fix_pathinfo = 1 mbstring.http_input = "pass" mbstring.http_output = "pass" mbstring.encoding_translation = 0 ; Enable Extensions extension=uploadprogress.so extension=imagick.so extension=redis.so ; APCu extension=apcu.so apc.enable_cli=1 apc.gc_ttl=300 apc.shm_segments=1 apc.shm_size=256M apc.slam_defense=0 apc.ttl=0 ; ================================================ FILE: aegir/conf/php/php85-cli.ini ================================================ [PHP] ;;;;;;;;;;;;;;;;;;; ; About php.ini ; ;;;;;;;;;;;;;;;;;;; ; PHP's initialization file, generally called php.ini, is responsible for ; configuring many of the aspects of PHP's behavior. ; PHP attempts to find and load this configuration from a number of locations. ; The following is a summary of its search order: ; 1. SAPI module specific location. ; 2. The PHPRC environment variable. ; 3. A number of predefined registry keys on Windows ; 4. Current working directory (except CLI) ; 5. The web server's directory (for SAPI modules), or directory of PHP ; (otherwise in Windows) ; 6. The directory from the --with-config-file-path compile time option, or the ; Windows directory (usually C:\windows) ; See the PHP docs for more specific information. ; https://php.net/configuration.file ; The syntax of the file is extremely simple. Whitespace and lines ; beginning with a semicolon are silently ignored (as you probably guessed). ; Section headers (e.g. [Foo]) are also silently ignored, even though ; they might mean something in the future. ; Directives following the section heading [PATH=/www/mysite] only ; apply to PHP files in the /www/mysite directory. Directives ; following the section heading [HOST=www.example.com] only apply to ; PHP files served from www.example.com. Directives set in these ; special sections cannot be overridden by user-defined INI files or ; at runtime. Currently, [PATH=] and [HOST=] sections only work under ; CGI/FastCGI. ; https://php.net/ini.sections ; Directives are specified using the following syntax: ; directive = value ; Directive names are *case sensitive* - foo=bar is different from FOO=bar. ; Directives are variables used to configure PHP or PHP extensions. ; There is no name validation. If PHP can't find an expected ; directive because it is not set or is mistyped, a default value will be used. ; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one ; of the INI constants (On, Off, True, False, Yes, No and None) or an expression ; (e.g. E_ALL & ~E_NOTICE), a quoted string ("bar"), or a reference to a ; previously set variable or directive (e.g. ${foo}) ; Expressions in the INI file are limited to bitwise operators and parentheses: ; | bitwise OR ; ^ bitwise XOR ; & bitwise AND ; ~ bitwise NOT ; ! boolean NOT ; Boolean flags can be turned on using the values 1, On, True or Yes. ; They can be turned off using the values 0, Off, False or No. ; An empty string can be denoted by simply not writing anything after the equal ; sign, or by using the None keyword: ; foo = ; sets foo to an empty string ; foo = None ; sets foo to an empty string ; foo = "None" ; sets foo to the string 'None' ; If you use constants in your value, and these constants belong to a ; dynamically loaded extension (either a PHP extension or a Zend extension), ; you may only use these constants *after* the line that loads the extension. ;;;;;;;;;;;;;;;;;;; ; About this file ; ;;;;;;;;;;;;;;;;;;; ; PHP comes packaged with two INI files. One that is recommended to be used ; in production environments and one that is recommended to be used in ; development environments. ; php.ini-production contains settings which hold security, performance and ; best practices at its core. But please be aware, these settings may break ; compatibility with older or less security-conscious applications. We ; recommending using the production ini in production and testing environments. ; php.ini-development is very similar to its production variant, except it is ; much more verbose when it comes to errors. We recommend using the ; development version only in development environments, as errors shown to ; application users can inadvertently leak otherwise secure information. ; This is the php.ini-production INI file. ;;;;;;;;;;;;;;;;;;; ; Quick Reference ; ;;;;;;;;;;;;;;;;;;; ; The following are all the settings which are different in either the production ; or development versions of the INIs with respect to PHP's default behavior. ; Please see the actual settings later in the document for more details as to why ; we recommend these changes in PHP's behavior. display_errors = Off ; Default Value: On ; Development Value: On ; Production Value: Off ; display_startup_errors ; Default Value: On ; Development Value: On ; Production Value: Off ; error_reporting ; Default Value: E_ALL ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED ; log_errors ; Default Value: Off ; Development Value: On ; Production Value: On ; max_input_time ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; mysqlnd.collect_memory_statistics ; Default Value: Off ; Development Value: On ; Production Value: Off ; output_buffering ; Default Value: Off ; Development Value: 4096 ; Production Value: 4096 ; request_order ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; session.gc_divisor ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; short_open_tag ; Default Value: On ; Development Value: Off ; Production Value: Off ; variables_order ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS" ; zend.assertions ; Default Value: 1 ; Development Value: 1 ; Production Value: -1 ; zend.exception_ignore_args ; Default Value: Off ; Development Value: Off ; Production Value: On ; zend.exception_string_param_max_len ; Default Value: 15 ; Development Value: 15 ; Production Value: 0 ;;;;;;;;;;;;;;;;;;;; ; php.ini Options ; ;;;;;;;;;;;;;;;;;;;; ; Name for user-defined php.ini (.htaccess) files. Default is ".user.ini" ;user_ini.filename = ".user.ini" ; To disable this feature set this option to an empty value user_ini.filename = ; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes) ;user_ini.cache_ttl = 300 ;;;;;;;;;;;;;;;;;;;; ; Language Options ; ;;;;;;;;;;;;;;;;;;;; ; Enable the PHP scripting language engine under Apache. ; https://php.net/engine engine = On ; This directive determines whether or not PHP will recognize code between ; tags as PHP source which should be processed as such. It is ; generally recommended that should be used and that this feature ; should be disabled, as enabling it may result in issues when generating XML ; documents, however this remains supported for backward compatibility reasons. ; Note that this directive does not control the would work. ; https://php.net/syntax-highlighting ;highlight.string = #DD0000 ;highlight.comment = #FF9900 ;highlight.keyword = #007700 ;highlight.default = #0000BB ;highlight.html = #000000 ; If enabled, the request will be allowed to complete even if the user aborts ; the request. Consider enabling it if executing long requests, which may end up ; being interrupted by the user or a browser timing out. PHP's default behavior ; is to disable this feature. ; https://php.net/ignore-user-abort ;ignore_user_abort = On ; Determines the size of the realpath cache to be used by PHP. This value should ; be increased on systems where PHP opens many files to reflect the quantity of ; the file operations performed. ; Note: if open_basedir is set, the cache is disabled ; https://php.net/realpath-cache-size realpath_cache_size=64M ; Duration of time, in seconds for which to cache realpath information for a given ; file or directory. For systems with rarely changing files, consider increasing this ; value. ; https://php.net/realpath-cache-ttl realpath_cache_ttl=5 ; Enables or disables the circular reference collector. ; https://php.net/zend.enable-gc zend.enable_gc = On ; If enabled, scripts may be written in encodings that are incompatible with ; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such ; encodings. To use this feature, mbstring extension must be enabled. ;zend.multibyte = Off ; Allows to set the default encoding for the scripts. This value will be used ; unless "declare(encoding=...)" directive appears at the top of the script. ; Only affects if zend.multibyte is set. ;zend.script_encoding = ; Allows to include or exclude arguments from stack traces generated for exceptions. ; In production, it is recommended to turn this setting on to prohibit the output ; of sensitive information in stack traces ; Default Value: Off ; Development Value: Off ; Production Value: On zend.exception_ignore_args = On ; Allows setting the maximum string length in an argument of a stringified stack trace ; to a value between 0 and 1000000. ; This has no effect when zend.exception_ignore_args is enabled. ; Default Value: 15 ; Development Value: 15 ; Production Value: 0 ; In production, it is recommended to set this to 0 to reduce the output ; of sensitive information in stack traces. zend.exception_string_param_max_len = 0 ;;;;;;;;;;;;;;;;; ; Miscellaneous ; ;;;;;;;;;;;;;;;;; ; Decides whether PHP may expose the fact that it is installed on the server ; (e.g. by adding its signature to the Web server header). It is no security ; threat in any way, but it makes it possible to determine whether you use PHP ; on your server or not. ; https://php.net/expose-php expose_php = On ;;;;;;;;;;;;;;;;;;; ; Resource Limits ; ;;;;;;;;;;;;;;;;;;; ; Maximum execution time of each script, in seconds ; https://php.net/max-execution-time ; Note: This directive is hardcoded to 0 for the CLI SAPI max_execution_time = 3600 ; Maximum amount of time each script may spend parsing request data. It's a good ; idea to limit this time on productions servers in order to eliminate unexpectedly ; long running scripts. ; Note: This directive is hardcoded to -1 for the CLI SAPI ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; https://php.net/max-input-time max_input_time = 3600 ; Maximum input variable nesting level ; https://php.net/max-input-nesting-level ;max_input_nesting_level = 64 ; How many GET/POST/COOKIE input variables may be accepted max_input_vars = 9999 ; How many multipart body parts (combined input variable and file uploads) may ; be accepted. ; Default Value: -1 (Sum of max_input_vars and max_file_uploads) ;max_multipart_body_parts = 1500 ; Maximum amount of memory a script may consume ; https://php.net/memory-limit memory_limit = 395M max_memory_limit = -1 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; Error handling and logging ; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; This directive informs PHP of which errors, warnings and notices you would like ; it to take action for. The recommended way of setting values for this ; directive is through the use of the error level constants and bitwise ; operators. The error level constants are below here for convenience as well as ; some common settings and their meanings. ; By default, PHP is set to take action on all errors, notices and warnings EXCEPT ; those related to E_NOTICE, which together cover best practices and ; recommended coding standards in PHP. For performance reasons, this is the ; recommend error reporting setting. Your production server shouldn't be wasting ; resources complaining about best practices and coding standards. That's what ; development servers and development settings are for. ; Note: The php.ini-development file has this setting as E_ALL. This ; means it pretty much reports everything which is exactly what you want during ; development and early testing. ; ; Error Level Constants: ; E_ALL - All errors and warnings ; E_ERROR - fatal run-time errors ; E_RECOVERABLE_ERROR - almost fatal run-time errors ; E_WARNING - run-time warnings (non-fatal errors) ; E_PARSE - compile-time parse errors ; E_NOTICE - run-time notices (these are warnings which often result ; from a bug in your code, but it's possible that it was ; intentional (e.g., using an uninitialized variable and ; relying on the fact it is automatically initialized to an ; empty string) ; E_CORE_ERROR - fatal errors that occur during PHP's initial startup ; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's ; initial startup ; E_COMPILE_ERROR - fatal compile-time errors ; E_COMPILE_WARNING - compile-time warnings (non-fatal errors) ; E_USER_ERROR - user-generated error message ; E_USER_WARNING - user-generated warning message ; E_USER_NOTICE - user-generated notice message ; E_DEPRECATED - warn about code that will not work in future versions ; of PHP ; E_USER_DEPRECATED - user-generated deprecation warnings ; ; Common Values: ; E_ALL (Show all errors, warnings and notices including coding standards.) ; E_ALL & ~E_NOTICE (Show all errors, except for notices) ; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors) ; Default Value: E_ALL ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED ; https://php.net/error-reporting error_reporting = 1 ; This directive controls whether or not and where PHP will output errors, ; notices and warnings too. Error output is very useful during development, but ; it could be very dangerous in production environments. Depending on the code ; which is triggering the error, sensitive information could potentially leak ; out of your application such as database usernames and passwords or worse. ; For production environments, we recommend logging errors rather than ; sending them to STDOUT. ; Possible Values: ; Off = Do not display any errors ; stderr = Display errors to STDERR (affects only CGI/CLI binaries!) ; On or stdout = Display errors to STDOUT ; Default Value: On ; Development Value: On ; Production Value: Off ; https://php.net/display-errors display_errors = Off ; The display of errors which occur during PHP's startup sequence are handled ; separately from display_errors. We strongly recommend you set this to 'off' ; for production servers to avoid leaking configuration details. ; Default Value: On ; Development Value: On ; Production Value: Off ; https://php.net/display-startup-errors display_startup_errors = Off ; Besides displaying errors, PHP can also log errors to locations such as a ; server-specific log, STDERR, or a location specified by the error_log ; directive found below. While errors should not be displayed on productions ; servers they should still be monitored and logging is a great way to do that. ; Default Value: Off ; Development Value: On ; Production Value: On ; https://php.net/log-errors log_errors = On ; Do not log repeated messages. Repeated errors must occur in same file on same ; line unless ignore_repeated_source is set true. ; https://php.net/ignore-repeated-errors ignore_repeated_errors = Off ; Ignore source of message when ignoring repeated messages. When this setting ; is On you will not log errors with repeated messages from different files or ; source lines. ; https://php.net/ignore-repeated-source ignore_repeated_source = Off ; This setting is off by default. ;report_zend_debug = 0 ; Turn off normal error reporting and emit XML-RPC error XML ; https://php.net/xmlrpc-errors ;xmlrpc_errors = 0 ; An XML-RPC faultCode ;xmlrpc_error_number = 0 ; When PHP displays or logs an error, it has the capability of formatting the ; error message as HTML for easier reading. This directive controls whether ; the error message is formatted as HTML or not. ; Note: This directive is hardcoded to Off for the CLI SAPI ; https://php.net/html-errors html_errors = Off ; If html_errors is set to On *and* docref_root is not empty, then PHP ; produces clickable error messages that direct to a page describing the error ; or function causing the error in detail. ; You can download a copy of the PHP manual from https://php.net/docs ; and change docref_root to the base URL of your local copy including the ; leading '/'. You must also specify the file extension being used including ; the dot. PHP's default behavior is to leave these settings empty, in which ; case no links to documentation are generated. ; Note: Never use this feature for production boxes. ; https://php.net/docref-root ; Examples ;docref_root = "/phpmanual/" ; https://php.net/docref-ext ;docref_ext = .html ; String to output before an error message. PHP's default behavior is to leave ; this setting blank. ; https://php.net/error-prepend-string ; Example: ;error_prepend_string = "" ; String to output after an error message. PHP's default behavior is to leave ; this setting blank. ; https://php.net/error-append-string ; Example: ;error_append_string = "" ; Log errors to specified file. PHP's default behavior is to leave this value ; empty. ; https://php.net/error-log ; Example: ;error_log = php_errors.log ; Log errors to syslog (Event Log on Windows). ;error_log = syslog error_log = /var/log/php/error_log_cli_85 ; The syslog ident is a string which is prepended to every message logged ; to syslog. Only used when error_log is set to syslog. ;syslog.ident = php ; The syslog facility is used to specify what type of program is logging ; the message. Only used when error_log is set to syslog. ;syslog.facility = user ; Set this to disable filtering control characters (the default). ; Some loggers only accept NVT-ASCII, others accept anything that's not ; control characters. If your logger accepts everything, then no filtering ; is needed at all. ; Allowed values are: ; ascii (all printable ASCII characters and NL) ; no-ctrl (all characters except control characters) ; all (all characters) ; raw (like "all", but messages are not split at newlines) ; https://php.net/syslog.filter ;syslog.filter = ascii ;windows.show_crt_warning ; Default value: 0 ; Development value: 0 ; Production value: 0 ; This directive controls whether PHP will output the backtrace of fatal errors. ; Default Value: On ; Development Value: On ; Production Value: On ;fatal_error_backtraces = On ;;;;;;;;;;;;;;;;; ; Data Handling ; ;;;;;;;;;;;;;;;;; ; The separator used in PHP generated URLs to separate arguments. ; PHP's default setting is "&". ; https://php.net/arg-separator.output ; Example: ;arg_separator.output = "&" ; List of separator(s) used by PHP to parse input URLs into variables. ; PHP's default setting is "&". ; NOTE: Every character in this directive is considered as separator! ; https://php.net/arg-separator.input ; Example: ;arg_separator.input = ";&" ; This directive determines which super global arrays are registered when PHP ; starts up. G,P,C,E & S are abbreviations for the following respective super ; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty ; paid for the registration of these arrays and because ENV is not as commonly ; used as the others, ENV is not recommended on productions servers. You ; can still get access to the environment variables through getenv() should you ; need to. ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS"; ; https://php.net/variables-order variables_order = "GPCS" ; This directive determines which super global data (G,P & C) should be ; registered into the super global array REQUEST. If so, it also determines ; the order in which that data is registered. The values for this directive ; are specified in the same manner as the variables_order directive, ; EXCEPT one. Leaving this value empty will cause PHP to use the value set ; in the variables_order directive. It does not mean it will leave the super ; globals array REQUEST empty. ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; https://php.net/request-order request_order = "GP" ; This directive determines whether PHP registers $argv & $argc each time it ; runs. $argv contains an array of all the arguments passed to PHP when a script ; is invoked. $argc contains an integer representing the number of arguments ; that were passed when the script was invoked. These arrays are extremely ; useful when running scripts from the command line. When this directive is ; enabled, registering these variables consumes CPU cycles and memory each time ; a script is executed. For security reasons, this feature should be disabled ; for non-CLI SAPIs. ; Note: This directive is ignored for the CLI SAPI ; This directive is deprecated. ; https://php.net/register-argc-argv register_argc_argv = Off ; When enabled, the ENV, REQUEST and SERVER variables are created when they're ; first used (Just In Time) instead of when the script starts. If these ; variables are not used within a script, having this directive on will result ; in a performance gain. The PHP directive register_argc_argv must be disabled ; for this directive to have any effect. ; https://php.net/auto-globals-jit auto_globals_jit = On ; Whether PHP will read the POST data. ; This option is enabled by default. ; Most likely, you won't want to disable this option globally. It causes $_POST ; and $_FILES to always be empty; the only way you will be able to read the ; POST data will be through the php://input stream wrapper. This can be useful ; to proxy requests or to process the POST data in a memory efficient fashion. ; https://php.net/enable-post-data-reading ;enable_post_data_reading = Off ; Maximum size of POST data that PHP will accept. ; Its value may be 0 to disable the limit. It is ignored if POST data reading ; is disabled through enable_post_data_reading. ; https://php.net/post-max-size post_max_size = 350M ; Automatically add files before PHP document. ; https://php.net/auto-prepend-file auto_prepend_file = ; Automatically add files after PHP document. ; https://php.net/auto-append-file auto_append_file = ; By default, PHP will output a media type using the Content-Type header. To ; disable this, simply set it to be empty. ; ; PHP's built-in default media type is set to text/html. ; https://php.net/default-mimetype default_mimetype = "text/html" ; PHP's default character set is set to UTF-8. ; https://php.net/default-charset default_charset = "UTF-8" ; PHP internal character encoding is set to empty. ; If empty, default_charset is used. ; https://php.net/internal-encoding ;internal_encoding = ; PHP input character encoding is set to empty. ; If empty, default_charset is used. ; https://php.net/input-encoding ;input_encoding = ; PHP output character encoding is set to empty. ; If empty, default_charset is used. ; See also output_buffer. ; https://php.net/output-encoding ;output_encoding = ;;;;;;;;;;;;;;;;;;;;;;;;; ; Paths and Directories ; ;;;;;;;;;;;;;;;;;;;;;;;;; ; UNIX: "/path1:/path2" ;include_path = ".:/php/includes" ; ; Windows: "\path1;\path2" ;include_path = ".;c:\php\includes" ; ; PHP's default setting for include_path is ".;/path/to/php/pear" ; https://php.net/include-path include_path = ".:/opt/php85/lib/php" ; The root of the PHP pages, used only if nonempty. ; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root ; if you are running php as a CGI under any web server (other than IIS) ; see documentation for security issues. The alternate is to use the ; cgi.force_redirect configuration below ; https://php.net/doc-root doc_root = ; The directory under which PHP opens the script using /~username used only ; if nonempty. ; https://php.net/user-dir user_dir = ; Directory in which the loadable extensions (modules) reside. ; https://php.net/extension-dir ;extension_dir = "./" ; On windows: ;extension_dir = "ext" extension_dir = "/opt/php85/lib/php/extensions/no-debug-non-zts-20250925/" ; Directory where the temporary files should be placed. ; Defaults to the system default (see sys_get_temp_dir) sys_temp_dir = "/tmp" ; Whether or not to enable the dl() function. The dl() function does NOT work ; properly in multithreaded servers, such as IIS or Zeus, and is automatically ; disabled on them. ; https://php.net/enable-dl enable_dl = Off ; cgi.force_redirect is necessary to provide security running PHP as a CGI under ; most web servers. Left undefined, PHP turns this on by default. You can ; turn it off here AT YOUR OWN RISK ; **You CAN safely turn this off for IIS, in fact, you MUST.** ; https://php.net/cgi.force-redirect ;cgi.force_redirect = 1 ; if cgi.nph is enabled it will force cgi to always sent Status: 200 with ; every request. PHP's default behavior is to disable this feature. ;cgi.nph = 1 ; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape ; (iPlanet) web servers, you MAY need to set an environment variable name that PHP ; will look for to know it is OK to continue execution. Setting this variable MAY ; cause security issues, KNOW WHAT YOU ARE DOING FIRST. ; https://php.net/cgi.redirect-status-env ;cgi.redirect_status_env = ; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's ; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok ; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting ; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting ; of zero causes PHP to behave as before. Default is 1. You should fix your scripts ; to use SCRIPT_FILENAME rather than PATH_TRANSLATED. ; https://php.net/cgi.fix-pathinfo ;cgi.fix_pathinfo=1 ; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside ; of the web tree and people will not be able to circumvent .htaccess security. ;cgi.discard_path=1 ; FastCGI under IIS supports the ability to impersonate ; security tokens of the calling client. This allows IIS to define the ; security context that the request runs under. mod_fastcgi under Apache ; does not currently support this feature (03/17/2002) ; Set to 1 if running under IIS. Default is zero. ; https://php.net/fastcgi.impersonate ;fastcgi.impersonate = 1 ; Prevent decoding of SCRIPT_FILENAME when using Apache ProxyPass or ; ProxyPassMatch. This should be used if script file paths are not stored ; in an encoded format on the file system. ; Default is 1. ;fastcgi.script_path_encoded = 0 ; Disable logging through FastCGI connection. PHP's default behavior is to enable ; this feature. ;fastcgi.logging = 0 ; cgi.rfc2616_headers configuration option tells PHP what type of headers to ; use when sending HTTP response code. If set to 0, PHP sends Status: header that ; is supported by Apache. When this option is set to 1, PHP will send ; RFC2616 compliant header. ; Default is zero. ; https://php.net/cgi.rfc2616-headers ;cgi.rfc2616_headers = 0 ; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #! ; (shebang) at the top of the running script. This line might be needed if the ; script support running both as stand-alone script and via PHP CGI<. PHP in CGI ; mode skips this line and ignores its content if this directive is turned on. ; https://php.net/cgi.check-shebang-line ;cgi.check_shebang_line=1 ;;;;;;;;;;;;;;;; ; File Uploads ; ;;;;;;;;;;;;;;;; ; Whether to allow HTTP file uploads. ; https://php.net/file-uploads file_uploads = On ; Temporary directory for HTTP uploaded files (will use system default if not ; specified). ; https://php.net/upload-tmp-dir upload_tmp_dir = /tmp ; Maximum allowed size for uploaded files. ; https://php.net/upload-max-filesize upload_max_filesize = 325M ; Maximum number of files that can be uploaded via a single request max_file_uploads = 50 ;;;;;;;;;;;;;;;;;; ; Fopen wrappers ; ;;;;;;;;;;;;;;;;;; ; Whether to allow the treatment of URLs (like http:// or ftp://) as files. ; https://php.net/allow-url-fopen allow_url_fopen = On ; Whether to allow include/require to open URLs (like https:// or ftp://) as files. ; https://php.net/allow-url-include allow_url_include = Off ; Define the anonymous ftp password (your email address). PHP's default setting ; for this is empty. ; https://php.net/from ;from="john@doe.com" ; Define the User-Agent string. PHP's default setting for this is empty. ; https://php.net/user-agent ;user_agent="PHP" ; Default timeout for socket based streams (seconds) ; https://php.net/default-socket-timeout default_socket_timeout = 3600 ; If your scripts have to deal with files from Macintosh systems, ; or you are running on a Mac and need to deal with files from ; unix or win32 systems, setting this flag will cause PHP to ; automatically detect the EOL character in those files so that ; fgets() and file() will work regardless of the source of the file. ; https://php.net/auto-detect-line-endings auto_detect_line_endings = On ;;;;;;;;;;;;;;;;;;;;;; ; Dynamic Extensions ; ;;;;;;;;;;;;;;;;;;;;;; ; If you wish to have an extension loaded automatically, use the following ; syntax: ; ; extension=modulename ; ; For example: ; ; extension=mysqli ; ; When the extension library to load is not located in the default extension ; directory, You may specify an absolute path to the library file: ; ; extension=/path/to/extension/mysqli.so ; ; Note : The syntax used in previous PHP versions ('extension=.so' and ; 'extension='php_.dll') is supported for legacy reasons and may be ; deprecated in a future PHP major version. So, when it is possible, please ; move to the new ('extension=) syntax. ; ; Notes for Windows environments : ; ; - Many DLL files are located in the ext/ ; extension folders as well as the separate PECL DLL download. ; Be sure to appropriately set the extension_dir directive. ; ;extension=bz2 ;extension=curl ;extension=exif ;extension=ffi ;extension=ftp ;extension=fileinfo ;extension=gd ;extension=gettext ;extension=gmp ;extension=intl ;extension=ldap ;extension=mbstring ;extension=mysqli ;extension=odbc ;extension=openssl ;extension=pdo_firebird ;extension=pdo_mysql ;extension=pdo_odbc ;extension=pdo_pgsql ;extension=pdo_sqlite ;extension=pgsql ;extension=shmop ; The MIBS data available in the PHP distribution must be installed. ; See https://www.php.net/manual/en/snmp.installation.php ;extension=snmp ;extension=soap ;extension=sockets ;extension=sodium ;extension=sqlite3 ;extension=tidy ;extension=xsl ;extension=zip ;zend_extension=opcache ;;;;;;;;;;;;;;;;;;; ; Module Settings ; ;;;;;;;;;;;;;;;;;;; [CLI Server] ; Whether the CLI web server uses ANSI color coding in its terminal output. cli_server.color = On [Date] ; Defines the default timezone used by the date functions ; https://php.net/date.timezone date.timezone = "UTC" ; https://php.net/date.default-latitude ;date.default_latitude = 31.7667 ; https://php.net/date.default-longitude ;date.default_longitude = 35.2333 ; https://php.net/date.sunrise-zenith ;date.sunrise_zenith = 90.833333 ; https://php.net/date.sunset-zenith ;date.sunset_zenith = 90.833333 [filter] ; https://php.net/filter.default ;filter.default = unsafe_raw ; https://php.net/filter.default-flags ;filter.default_flags = [iconv] ; Use of this INI entry is deprecated, use global input_encoding instead. ; If empty, default_charset or input_encoding or iconv.input_encoding is used. ; The precedence is: default_charset < input_encoding < iconv.input_encoding ;iconv.input_encoding = ; Use of this INI entry is deprecated, use global internal_encoding instead. ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;iconv.internal_encoding = ; Use of this INI entry is deprecated, use global output_encoding instead. ; If empty, default_charset or output_encoding or iconv.output_encoding is used. ; The precedence is: default_charset < output_encoding < iconv.output_encoding ; To use an output encoding conversion, iconv's output handler must be set ; otherwise output encoding conversion cannot be performed. ;iconv.output_encoding = [intl] ;intl.default_locale = ; This directive allows you to produce PHP errors when some error ; happens within intl functions. The value is the level of the error produced. ; Default is 0, which does not produce any errors. ; This directive is deprecated. ;intl.error_level = E_WARNING ; If enabled this directive indicates that when an error occurs within an ; intl function a IntlException should be thrown. ; Default is Off, which means errors need to be handled manually. ;intl.use_exceptions = On [sqlite3] ; Directory pointing to SQLite3 extensions ; https://php.net/sqlite3.extension-dir ;sqlite3.extension_dir = ; SQLite defensive mode flag (only available from SQLite 3.26+) ; When the defensive flag is enabled, language features that allow ordinary ; SQL to deliberately corrupt the database file are disabled. This forbids ; writing directly to the schema, shadow tables (eg. FTS data tables), or ; the sqlite_dbpage virtual table. ; https://www.sqlite.org/c3ref/c_dbconfig_defensive.html ; (for older SQLite versions, this flag has no use) ;sqlite3.defensive = 1 [Pcre] ; PCRE library backtracking limit. ; https://php.net/pcre.backtrack-limit ;pcre.backtrack_limit=100000 ; PCRE library recursion limit. ; Please note that if you set this value to a high number you may consume all ; the available process stack and eventually crash PHP (due to reaching the ; stack size limit imposed by the Operating System). ; https://php.net/pcre.recursion-limit ;pcre.recursion_limit=100000 ; Enables or disables JIT compilation of patterns. This requires the PCRE ; library to be compiled with JIT support. ;pcre.jit=1 [Pdo] ; Whether to pool ODBC connections. Can be one of "strict", "relaxed" or "off" ; https://php.net/pdo-odbc.connection-pooling ;pdo_odbc.connection_pooling=strict [Pdo_mysql] ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. pdo_mysql.default_socket= [Phar] ; https://php.net/phar.readonly ;phar.readonly = On ; https://php.net/phar.require-hash ;phar.require_hash = On ;phar.cache_list = [mail function] ; For Win32 only. ; https://php.net/smtp ;SMTP = localhost ; https://php.net/smtp-port ;smtp_port = 25 ; For Win32 only. ; https://php.net/sendmail-from ;sendmail_from = me@example.com ; For Unix only. You may supply arguments as well (default: "sendmail -t -i"). ; https://php.net/sendmail-path sendmail_path = /usr/sbin/sendmail -t -i ; Force the addition of the specified parameters to be passed as extra parameters ; to the sendmail binary. These parameters will always replace the value of ; the 5th parameter to mail(). ;mail.force_extra_parameters = ; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename mail.add_x_header = Off ; Use mixed LF and CRLF line separators to keep compatibility with some ; RFC 2822 non conformant MTA. mail.mixed_lf_and_crlf = Off ; Control line ending mode for mail messages and headers. ; Possible values: "crlf" (default), "lf", "mixed", "os" ; - crlf: Use CRLF line endings ; - lf: Use LF line endings only (converts CRLF in message to LF) ; - mixed: Same as mail.mixed_lf_and_crlf = On ; - os: Use CRLF on Windows, LF on other systems mail.cr_lf_mode = crlf ; The path to a log file that will log all mail() calls. Log entries include ; the full path of the script, line number, To address and headers. ;mail.log = ; Log mail to syslog (Event Log on Windows). ;mail.log = syslog [ODBC] ; https://php.net/odbc.default-db ;odbc.default_db = Not yet implemented ; https://php.net/odbc.default-user ;odbc.default_user = Not yet implemented ; https://php.net/odbc.default-pw ;odbc.default_pw = Not yet implemented ; Controls the ODBC cursor model. ; Default: SQL_CURSOR_STATIC (default). ;odbc.default_cursortype ; Allow or prevent persistent links. ; https://php.net/odbc.allow-persistent odbc.allow_persistent = On ; Check that a connection is still valid before reuse. ; https://php.net/odbc.check-persistent odbc.check_persistent = On ; Maximum number of persistent links. -1 means no limit. ; https://php.net/odbc.max-persistent odbc.max_persistent = -1 ; Maximum number of links (persistent + non-persistent). -1 means no limit. ; https://php.net/odbc.max-links odbc.max_links = -1 ; Handling of LONG fields. Returns number of bytes to variables. 0 means ; passthru. ; https://php.net/odbc.defaultlrl odbc.defaultlrl = 4096 ; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char. ; See the documentation on odbc_binmode and odbc_longreadlen for an explanation ; of odbc.defaultlrl and odbc.defaultbinmode ; https://php.net/odbc.defaultbinmode odbc.defaultbinmode = 1 [MySQLi] ; Maximum number of persistent links. -1 means no limit. ; https://php.net/mysqli.max-persistent mysqli.max_persistent = -1 ; Allow accessing, from PHP's perspective, local files with LOAD DATA statements ; https://php.net/mysqli.allow_local_infile ;mysqli.allow_local_infile = On ; It allows the user to specify a folder where files that can be sent via LOAD DATA ; LOCAL can exist. It is ignored if mysqli.allow_local_infile is enabled. ;mysqli.local_infile_directory = ; Allow or prevent persistent links. ; https://php.net/mysqli.allow-persistent mysqli.allow_persistent = On ; Maximum number of links. -1 means no limit. ; https://php.net/mysqli.max-links mysqli.max_links = -1 ; Default port number for mysqli_connect(). ; https://php.net/mysqli.default-port mysqli.default_port = 3306 ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. ; https://php.net/mysqli.default-socket mysqli.default_socket = ; Default host for mysqli_connect(). ; https://php.net/mysqli.default-host mysqli.default_host = ; Default user for mysqli_connect(). ; https://php.net/mysqli.default-user mysqli.default_user = ; Default password for mysqli_connect(). ; Note that this is generally a *bad* idea to store passwords in this file. ; *Any* user with PHP access can run 'echo get_cfg_var("mysqli.default_pw") ; and reveal this password! And of course, any users with read access to this ; file will be able to reveal the password as well. ; https://php.net/mysqli.default-pw mysqli.default_pw = ; If this option is enabled, closing a persistent connection will rollback ; any pending transactions of this connection, before it is put back ; into the persistent connection pool. ;mysqli.rollback_on_cached_plink = Off [mysqlnd] ; Enable / Disable collection of general statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. mysqlnd.collect_statistics = 0 ; Enable / Disable collection of memory usage statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. ; Default Value: Off ; Development Value: On ; Production Value: Off mysqlnd.collect_memory_statistics = Off ; Records communication from all extensions using mysqlnd to the specified log ; file. ; https://php.net/mysqlnd.debug ;mysqlnd.debug = ; Defines which queries will be logged. ;mysqlnd.log_mask = 0 ; Default size of the mysqlnd memory pool, which is used by result sets. mysqlnd.mempool_default_size = 64000 ; Size of a pre-allocated buffer used when sending commands to MySQL in bytes. mysqlnd.net_cmd_buffer_size = 8192 ; Size of a pre-allocated buffer used for reading data sent by the server in ; bytes. mysqlnd.net_read_buffer_size = 131072 ; Timeout for network requests in seconds. ;mysqlnd.net_read_timeout = 31536000 ; SHA-256 Authentication Plugin related. File with the MySQL server public RSA ; key. ;mysqlnd.sha256_server_public_key = [PostgreSQL] ; Allow or prevent persistent links. ; https://php.net/pgsql.allow-persistent pgsql.allow_persistent = On ; Detect broken persistent links always with pg_pconnect(). ; Auto reset feature requires a little overheads. ; https://php.net/pgsql.auto-reset-persistent pgsql.auto_reset_persistent = Off ; Maximum number of persistent links. -1 means no limit. ; https://php.net/pgsql.max-persistent pgsql.max_persistent = -1 ; Maximum number of links (persistent+non persistent). -1 means no limit. ; https://php.net/pgsql.max-links pgsql.max_links = -1 ; Ignore PostgreSQL backends Notice message or not. ; Notice message logging require a little overheads. ; https://php.net/pgsql.ignore-notice pgsql.ignore_notice = 0 ; Log PostgreSQL backends Notice message or not. ; Unless pgsql.ignore_notice=0, module cannot log notice message. ; https://php.net/pgsql.log-notice pgsql.log_notice = 0 [bcmath] ; Number of decimal digits for all bcmath functions. ; https://php.net/bcmath.scale bcmath.scale = 0 [browscap] ; https://php.net/browscap ;browscap = extra/browscap.ini [Session] ; Handler used to store/retrieve data. ; https://php.net/session.save-handler session.save_handler = files ; Argument passed to save_handler. In the case of files, this is the path ; where data files are stored. Note: Windows users have to change this ; variable in order to use PHP's session functions. ; ; The path can be defined as: ; ; session.save_path = "N;/path" ; ; where N is an integer. Instead of storing all the session files in ; /path, what this will do is use subdirectories N-levels deep, and ; store the session data in those directories. This is useful if ; your OS has problems with many files in one directory, and is ; a more efficient layout for servers that handle many sessions. ; ; NOTE 1: PHP will not create this directory structure automatically. ; You can use the script in the ext/session dir for that purpose. ; NOTE 2: See the section on garbage collection below if you choose to ; use subdirectories for session storage ; ; The file storage module creates files using mode 600 by default. ; You can change that by using ; ; session.save_path = "N;MODE;/path" ; ; where MODE is the octal representation of the mode. Note that this ; does not overwrite the process's umask. ; https://php.net/session.save-path session.save_path = "/opt/tmp" ; Whether to use strict session mode. ; Strict session mode does not accept an uninitialized session ID, and ; regenerates the session ID if the browser sends an uninitialized session ID. ; Strict mode protects applications from session fixation via a session adoption ; vulnerability. It is disabled by default for maximum compatibility, but ; enabling it is encouraged. ; https://wiki.php.net/rfc/strict_sessions session.use_strict_mode = 0 ; Whether to use cookies. ; https://php.net/session.use-cookies session.use_cookies = 1 ; https://php.net/session.cookie-secure ;session.cookie_secure = ; https://php.net/session.cookie-partitioned ;session.cookie_partitioned = 0 ; This option forces PHP to fetch and use a cookie for storing and maintaining ; the session id. We encourage this operation as it's very helpful in combating ; session hijacking when not specifying and managing your own session id. It is ; not the be-all and end-all of session hijacking defense, but it's a good start. ; https://php.net/session.use-only-cookies session.use_only_cookies = 1 ; Name of the session (used as cookie name). ; https://php.net/session.name session.name = PHPSESSID ; Initialize session on request startup. ; https://php.net/session.auto-start session.auto_start = 0 ; Lifetime in seconds of cookie or, if 0, until browser is restarted. ; https://php.net/session.cookie-lifetime session.cookie_lifetime = 0 ; The path for which the cookie is valid. ; https://php.net/session.cookie-path session.cookie_path = / ; The domain for which the cookie is valid. ; https://php.net/session.cookie-domain session.cookie_domain = ; Whether or not to add the httpOnly flag to the cookie, which makes it ; inaccessible to browser scripting languages such as JavaScript. ; https://php.net/session.cookie-httponly session.cookie_httponly = 1 ; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF) ; Current valid values are "Strict", "Lax" or "None". When using "None", ; make sure to include the quotes, as `none` is interpreted like `false` in ini files. ; https://tools.ietf.org/html/draft-west-first-party-cookies-07 session.cookie_samesite = ; Handler used to serialize data. php is the standard serializer of PHP. ; https://php.net/session.serialize-handler session.serialize_handler = php ; Defines the probability that the 'garbage collection' process is started on every ; session initialization. The probability is calculated by using gc_probability/gc_divisor, ; e.g. 1/100 means there is a 1% chance that the GC process starts on each request. ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; https://php.net/session.gc-probability session.gc_probability = 1 ; Defines the probability that the 'garbage collection' process is started on every ; session initialization. The probability is calculated by using gc_probability/gc_divisor, ; e.g. 1/100 means there is a 1% chance that the GC process starts on each request. ; For high volume production servers, using a value of 1000 is a more efficient approach. ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; https://php.net/session.gc-divisor session.gc_divisor = 1000 ; After this number of seconds, stored data will be seen as 'garbage' and ; cleaned up by the garbage collection process. ; https://php.net/session.gc-maxlifetime session.gc_maxlifetime = 1440 ; NOTE: If you are using the subdirectory option for storing session files ; (see session.save_path above), then garbage collection does *not* ; happen automatically. You will need to do your own garbage ; collection through a shell script, cron entry, or some other method. ; For example, the following script is the equivalent of setting ; session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes): ; find /path/to/sessions -cmin +24 -type f | xargs rm ; Check HTTP Referer to invalidate externally stored URLs containing ids. ; HTTP_REFERER has to contain this substring for the session to be ; considered as valid. ; https://php.net/session.referer-check session.referer_check = ; Set to {nocache,private,public,} to determine HTTP caching aspects ; or leave this empty to avoid sending anti-caching headers. ; https://php.net/session.cache-limiter session.cache_limiter = nocache ; Document expires after n minutes. ; https://php.net/session.cache-expire session.cache_expire = 180 ; trans sid support is disabled by default. ; Use of trans sid may risk your users' security. ; Use this option with caution. ; - User may send URL contains active session ID ; to other person via. email/irc/etc. ; - URL that contains active session ID may be stored ; in publicly accessible computer. ; - User may access your site with the same session ID ; always using URL stored in browser's history or bookmarks. ; https://php.net/session.use-trans-sid session.use_trans_sid = 0 ; The URL rewriter will look for URLs in a defined set of HTML tags. ; is special; if you include them here, the rewriter will ; add a hidden field with the info which is otherwise appended ; to URLs. tag's action attribute URL will not be modified ; unless it is specified. ; Note that all valid entries require a "=", even if no value follows. ; Default Value: "a=href,area=href,frame=src,form=" ; Development Value: "a=href,area=href,frame=src,form=" ; Production Value: "a=href,area=href,frame=src,form=" ; https://php.net/url-rewriter.tags session.trans_sid_tags = "a=href,area=href,frame=src,form=" ; URL rewriter does not rewrite absolute URLs by default. ; To enable rewrites for absolute paths, target hosts must be specified ; at RUNTIME. i.e. use ini_set() ; tags is special. PHP will check action attribute's URL regardless ; of session.trans_sid_tags setting. ; If no host is defined, HTTP_HOST will be used for allowed host. ; Example value: php.net,www.php.net,wiki.php.net ; Use "," for multiple hosts. No spaces are allowed. ; Default Value: "" ; Development Value: "" ; Production Value: "" ;session.trans_sid_hosts="" ; Enable upload progress tracking in $_SESSION ; Default Value: On ; Development Value: On ; Production Value: On ; https://php.net/session.upload-progress.enabled ;session.upload_progress.enabled = On ; Cleanup the progress information as soon as all POST data has been read ; (i.e. upload completed). ; Default Value: On ; Development Value: On ; Production Value: On ; https://php.net/session.upload-progress.cleanup ;session.upload_progress.cleanup = On ; A prefix used for the upload progress key in $_SESSION ; Default Value: "upload_progress_" ; Development Value: "upload_progress_" ; Production Value: "upload_progress_" ; https://php.net/session.upload-progress.prefix ;session.upload_progress.prefix = "upload_progress_" ; The index name (concatenated with the prefix) in $_SESSION ; containing the upload progress information ; Default Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Development Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Production Value: "PHP_SESSION_UPLOAD_PROGRESS" ; https://php.net/session.upload-progress.name ;session.upload_progress.name = "PHP_SESSION_UPLOAD_PROGRESS" ; How frequently the upload progress should be updated. ; Given either in percentages (per-file), or in bytes ; Default Value: "1%" ; Development Value: "1%" ; Production Value: "1%" ; https://php.net/session.upload-progress.freq ;session.upload_progress.freq = "1%" ; The minimum delay between updates, in seconds ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; https://php.net/session.upload-progress.min-freq ;session.upload_progress.min_freq = "1" ; Only write session data when session data is changed. Enabled by default. ; https://php.net/session.lazy-write ;session.lazy_write = On [Assertion] ; Switch whether to compile assertions at all (to have no overhead at run-time) ; -1: Do not compile at all ; 0: Jump over assertion at run-time ; 1: Execute assertions ; Changing from or to a negative value is only possible in php.ini! ; (For turning assertions on and off at run-time, toggle zend.assertions between the values 1 and 0) ; Default Value: 1 ; Development Value: 1 ; Production Value: -1 ; https://php.net/zend.assertions zend.assertions = -1 [COM] ; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs ; https://php.net/com.typelib-file ;com.typelib_file = ; allow Distributed-COM calls ; https://php.net/com.allow-dcom ;com.allow_dcom = true ; autoregister constants of a component's typelib on com_load() ; https://php.net/com.autoregister-typelib ;com.autoregister_typelib = true ; register constants casesensitive ; https://php.net/com.autoregister-casesensitive ;com.autoregister_casesensitive = false ; show warnings on duplicate constant registrations ; https://php.net/com.autoregister-verbose ;com.autoregister_verbose = true ; The default character set code-page to use when passing strings to and from COM objects. ; Default: system ANSI code page ;com.code_page= ; The version of the .NET framework to use. The value of the setting are the first three parts ; of the framework's version number, separated by dots, and prefixed with "v", e.g. "v4.0.30319". ;com.dotnet_version= [mbstring] ; language for internal character representation. ; This affects mb_send_mail() and mbstring.detect_order. ; https://php.net/mbstring.language ;mbstring.language = Japanese ; Use of this INI entry is deprecated, use global internal_encoding instead. ; internal/script encoding. ; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*) ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;mbstring.internal_encoding = ; Use of this INI entry is deprecated, use global input_encoding instead. ; http input encoding. ; mbstring.encoding_translation = On is needed to use this setting. ; If empty, default_charset or input_encoding or mbstring.input is used. ; The precedence is: default_charset < input_encoding < mbstring.http_input ; https://php.net/mbstring.http-input ;mbstring.http_input = ; Use of this INI entry is deprecated, use global output_encoding instead. ; http output encoding. ; mb_output_handler must be registered as output buffer to function. ; If empty, default_charset or output_encoding or mbstring.http_output is used. ; The precedence is: default_charset < output_encoding < mbstring.http_output ; To use an output encoding conversion, mbstring's output handler must be set ; otherwise output encoding conversion cannot be performed. ; https://php.net/mbstring.http-output ;mbstring.http_output = ; enable automatic encoding translation according to ; mbstring.internal_encoding setting. Input chars are ; converted to internal encoding by setting this to On. ; Note: Do _not_ use automatic encoding translation for ; portable libs/applications. ; https://php.net/mbstring.encoding-translation ;mbstring.encoding_translation = Off ; automatic encoding detection order. ; "auto" detect order is changed according to mbstring.language ; https://php.net/mbstring.detect-order ;mbstring.detect_order = auto ; substitute_character used when character cannot be converted ; one from another ; https://php.net/mbstring.substitute-character ;mbstring.substitute_character = none ; Enable strict encoding detection. ;mbstring.strict_detection = Off ; This directive specifies the regex pattern of content types for which mb_output_handler() ; is activated. ; Default: mbstring.http_output_conv_mimetypes=^(text/|application/xhtml\+xml) ;mbstring.http_output_conv_mimetypes= ; This directive specifies maximum stack depth for mbstring regular expressions. It is similar ; to the pcre.recursion_limit for PCRE. ;mbstring.regex_stack_limit=100000 ; This directive specifies maximum retry count for mbstring regular expressions. It is similar ; to the pcre.backtrack_limit for PCRE. ;mbstring.regex_retry_limit=1000000 [gd] ; Tell the jpeg decode to ignore warnings and try to create ; a gd image. The warning will then be displayed as notices ; disabled by default ; https://php.net/gd.jpeg-ignore-warning ;gd.jpeg_ignore_warning = 1 [exif] ; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS. ; With mbstring support this will automatically be converted into the encoding ; given by corresponding encode setting. When empty mbstring.internal_encoding ; is used. For the decode settings you can distinguish between motorola and ; intel byte order. A decode setting must not be empty. ; https://php.net/exif.encode-unicode ;exif.encode_unicode = ISO-8859-15 ; https://php.net/exif.decode-unicode-motorola ;exif.decode_unicode_motorola = UCS-2BE ; https://php.net/exif.decode-unicode-intel ;exif.decode_unicode_intel = UCS-2LE ; https://php.net/exif.encode-jis ;exif.encode_jis = ; https://php.net/exif.decode-jis-motorola ;exif.decode_jis_motorola = JIS ; https://php.net/exif.decode-jis-intel ;exif.decode_jis_intel = JIS [Tidy] ; The path to a default tidy configuration file to use when using tidy ; https://php.net/tidy.default-config ;tidy.default_config = /usr/local/lib/php/default.tcfg ; Should tidy clean and repair output automatically? ; WARNING: Do not use this option if you are generating non-html content ; such as dynamic images ; https://php.net/tidy.clean-output tidy.clean_output = Off [soap] ; Enables or disables WSDL caching feature. ; https://php.net/soap.wsdl-cache-enabled soap.wsdl_cache_enabled=1 ; Sets the directory name where SOAP extension will put cache files. ; https://php.net/soap.wsdl-cache-dir soap.wsdl_cache_dir="/tmp" ; (time to live) Sets the number of second while cached file will be used ; instead of original one. ; https://php.net/soap.wsdl-cache-ttl soap.wsdl_cache_ttl=86400 ; Sets the size of the cache limit. (Max. number of WSDL files to cache) soap.wsdl_cache_limit = 5 [sysvshm] ; A default size of the shared memory segment ;sysvshm.init_mem = 10000 [ldap] ; Sets the maximum number of open links or -1 for unlimited. ldap.max_links = -1 [dba] ;dba.default_handler= [opcache] ; Determines if Zend OPCache is enabled ;opcache.enable=1 ; Determines if Zend OPCache is enabled for the CLI version of PHP ;opcache.enable_cli=0 ; The OPcache shared memory storage size. ;opcache.memory_consumption=128 ; The amount of memory for interned strings in Mbytes. ;opcache.interned_strings_buffer=8 ; The maximum number of keys (scripts) in the OPcache hash table. ; Only numbers between 200 and 1000000 are allowed. ;opcache.max_accelerated_files=10000 ; The maximum percentage of "wasted" memory until a restart is scheduled. ;opcache.max_wasted_percentage=5 ; When this directive is enabled, the OPcache appends the current working ; directory to the script key, thus eliminating possible collisions between ; files with the same name (basename). Disabling the directive improves ; performance, but may break existing applications. ;opcache.use_cwd=1 ; When disabled, you must reset the OPcache manually or restart the ; webserver for changes to the filesystem to take effect. ;opcache.validate_timestamps=1 ; How often (in seconds) to check file timestamps for changes to the shared ; memory storage allocation. ("1" means validate once per second, but only ; once per request. "0" means always validate) ;opcache.revalidate_freq=2 ; Enables or disables file search in include_path optimization ;opcache.revalidate_path=0 ; If disabled, all PHPDoc comments are dropped from the code to reduce the ; size of the optimized code. ;opcache.save_comments=1 ; If enabled, compilation warnings (including notices and deprecations) will ; be recorded and replayed each time a file is included. Otherwise, compilation ; warnings will only be emitted when the file is first cached. ;opcache.record_warnings=0 ; Allow file existence override (file_exists, etc.) performance feature. ;opcache.enable_file_override=0 ; A bitmask, where each bit enables or disables the appropriate OPcache ; passes ;opcache.optimization_level=0x7FFFBFFF ;opcache.dups_fix=0 ; The location of the OPcache blacklist file (wildcards allowed). ; Each OPcache blacklist file is a text file that holds the names of files ; that should not be accelerated. The file format is to add each filename ; to a new line. The filename may be a full path or just a file prefix ; (i.e., /var/www/x blacklists all the files and directories in /var/www ; that start with 'x'). Line starting with a ; are ignored (comments). ;opcache.blacklist_filename= ; Allows exclusion of large files from being cached. By default all files ; are cached. ;opcache.max_file_size=0 ; How long to wait (in seconds) for a scheduled restart to begin if the cache ; is not being accessed. ;opcache.force_restart_timeout=180 ; OPcache error_log file name. Empty string assumes "stderr". ;opcache.error_log= ; All OPcache errors go to the Web server log. ; By default, only fatal errors (level 0) or errors (level 1) are logged. ; You can also enable warnings (level 2), info messages (level 3) or ; debug messages (level 4). ;opcache.log_verbosity_level=1 ; Preferred Shared Memory back-end. Leave empty and let the system decide. ;opcache.preferred_memory_model= ; Protect the shared memory from unexpected writing during script execution. ; Useful for internal debugging only. ;opcache.protect_memory=0 ; Allows calling OPcache API functions only from PHP scripts which path is ; started from specified string. The default "" means no restriction ;opcache.restrict_api= ; Mapping base of shared memory segments (for Windows only). All the PHP ; processes have to map shared memory into the same address space. This ; directive allows to manually fix the "Unable to reattach to base address" ; errors. ;opcache.mmap_base= ; Facilitates multiple OPcache instances per user (for Windows only). All PHP ; processes with the same cache ID and user share an OPcache instance. ;opcache.cache_id= ; Enables and sets the second level cache directory. ; It should improve performance when SHM memory is full, at server restart or ; SHM reset. The default "" disables file based caching. ;opcache.file_cache= ; Enables or disables read-only mode for the second level cache directory. ; It should improve performance for read-only containers, ; when the cache is pre-warmed and packaged alongside the application. ; Best used with `opcache.validate_timestamps=0`, `opcache.enable_file_override=1` ; and `opcache.file_cache_consistency_checks=0`. ; Note: A cache generated with a different build of PHP, a different file path, ; or different settings (including which extensions are loaded), may be ignored. ;opcache.file_cache_read_only=0 ; Enables or disables opcode caching in shared memory. ;opcache.file_cache_only=0 ; Enables or disables checksum validation when script loaded from file cache. ;opcache.file_cache_consistency_checks=1 ; Implies opcache.file_cache_only=1 for a certain process that failed to ; reattach to the shared memory (for Windows only). Explicitly enabled file ; cache is required. ;opcache.file_cache_fallback=1 ; Enables or disables copying of PHP code (text segment) into HUGE PAGES. ; Under certain circumstances (if only a single global PHP process is ; started from which all others fork), this can increase performance ; by a tiny amount because TLB misses are reduced. On the other hand, this ; delays PHP startup, increases memory usage and degrades performance ; under memory pressure - use with care. ; Requires appropriate OS configuration. ;opcache.huge_code_pages=0 ; Validate cached file permissions. ;opcache.validate_permission=0 ; Prevent name collisions in chroot'ed environment. ;opcache.validate_root=0 ; If specified, it produces opcode dumps for debugging different stages of ; optimizations. ;opcache.opt_debug_level=0 ; Specifies a PHP script that is going to be compiled and executed at server ; start-up. ; https://php.net/opcache.preload ;opcache.preload= ; Preloading code as root is not allowed for security reasons. This directive ; facilitates to let the preloading to be run as another user. ; https://php.net/opcache.preload_user ;opcache.preload_user= ; Prevents caching files that are less than this number of seconds old. It ; protects from caching of incompletely updated files. In case all file updates ; on your site are atomic, you may increase performance by setting it to "0". ;opcache.file_update_protection=2 ; Absolute path used to store shared lockfiles (for *nix only). ;opcache.lockfile_path=/tmp [curl] ; A default value for the CURLOPT_CAINFO option. This is required to be an ; absolute path. ;curl.cainfo = [openssl] ; The location of a Certificate Authority (CA) file on the local filesystem ; to use when verifying the identity of SSL/TLS peers. Most users should ; not specify a value for this directive as PHP will attempt to use the ; OS-managed cert stores in its absence. If specified, this value may still ; be overridden on a per-stream basis via the "cafile" SSL stream context ; option. ;openssl.cafile= ; If openssl.cafile is not specified or if the CA file is not found, the ; directory pointed to by openssl.capath is searched for a suitable ; certificate. This value must be a correctly hashed certificate directory. ; Most users should not specify a value for this directive as PHP will ; attempt to use the OS-managed cert stores in its absence. If specified, ; this value may still be overridden on a per-stream basis via the "capath" ; SSL stream context option. ;openssl.capath= ; The libctx is an OpenSSL library context. OpenSSL defines a default library ; context, but PHP OpenSSL also defines its own library context to avoid ; interference with other libraries using OpenSSL and to provide an independent ; context for each thread in ZTS. Possible values: ; "custom" - use a custom library context (default) ; "default" - use the default OpenSSL library context ;openssl.libctx=custom [ffi] ; FFI API restriction. Possible values: ; "preload" - enabled in CLI scripts and preloaded files (default) ; "false" - always disabled ; "true" - always enabled ;ffi.enable=preload ; List of headers files to preload, wildcard patterns allowed. ;ffi.preload= [Zend] ;zend_extension="/usr/local/ioncube/ioncube_loader_lin_8.5.so" ; fix for segfaults auto_globals_jit = Off cgi.fix_pathinfo = 1 mbstring.http_input = "pass" mbstring.http_output = "pass" mbstring.encoding_translation = 0 ; Enable Extensions extension=uploadprogress.so extension=imagick.so extension=redis.so ================================================ FILE: aegir/conf/php/php85-fpm ================================================ #!/bin/bash ### BEGIN INIT INFO # Provides: php85-fpm # Required-Start: $remote_fs $network # Required-Stop: $remote_fs $network # Default-Start: 2 3 4 5 # Default-Stop: 0 1 6 # Short-Description: starts php85-fpm # Description: starts the PHP FastCGI Process Manager daemon ### END INIT INFO prefix=/opt/php85 exec_prefix=${prefix} php_fpm_BIN=/opt/php85/sbin/php-fpm php_fpm_CONF=/opt/php85/etc/php85-fpm.conf php_fpm_PID=/run/php85-fpm.pid php_opts="--fpm-config $php_fpm_CONF --pid $php_fpm_PID -c /opt/php85/etc/php85.ini" wait_for_pid() { try=0 while test $try -lt 5; do case "$1" in 'created') if [ -f "$2" ]; then try='' break fi ;; 'removed') if [ ! -f "$2" ]; then try='' break fi ;; esac echo -n . try=`expr $try + 1` sleep 1 done } case "$1" in start) echo -n "Starting php85-fpm..." $php_fpm_BIN --daemonize $php_opts if [ "$?" != 0 ]; then echo " failed" exit 1 fi wait_for_pid created $php_fpm_PID if [ -n "$try" ]; then echo " failed" exit 1 else echo " done" fi ;; stop) echo -n "Gracefully shutting down php85-fpm..." if [ ! -r $php_fpm_PID ]; then echo "warning, no pid file found - php85-fpm is not running ?" exit 1 fi kill -QUIT `cat $php_fpm_PID` wait_for_pid removed $php_fpm_PID if [ -n "$try" ]; then echo " failed. Use force-quit" exit 1 else echo " done" fi ;; status) if [ ! -r $php_fpm_PID ]; then echo "php85-fpm is stopped" exit 0 fi PID=`cat $php_fpm_PID` if ps -p $PID | grep -q $PID; then echo "php85-fpm (pid $PID) is running..." else echo "php85-fpm dead but pid file exists" fi ;; force-quit) echo -n "Terminating php85-fpm..." if [ ! -r $php_fpm_PID ]; then echo "warning, no pid file found - php85-fpm is not running ?" exit 1 fi kill -TERM `cat $php_fpm_PID` wait_for_pid removed $php_fpm_PID if [ -n "$try" ]; then echo " failed" exit 1 else echo " done" fi ;; restart) $0 stop $0 start ;; reload) echo -n "Reloading service php85-fpm..." if [ ! -r $php_fpm_PID ]; then echo "warning, no pid file found - php85-fpm is not running ?" exit 1 fi kill -USR2 `cat $php_fpm_PID` echo " done" ;; configtest) $php_fpm_BIN -t ;; *) echo "Usage: $0 {start|stop|force-quit|restart|reload|status|configtest}" exit 1 ;; esac ================================================ FILE: aegir/conf/php/php85-fpm.conf ================================================ ;;;;;;;;;;;;;;;;;;;;; ; FPM Configuration ; ;;;;;;;;;;;;;;;;;;;;; ; All relative paths in this configuration file are relative to PHP's install ; prefix (/opt/php85). This prefix can be dynamically changed by using the ; '-p' argument from the command line. ; Include one or more files. If glob(3) exists, it is used to include a bunch of ; files from a glob(3) pattern. This directive can be used everywhere in the ; file. ; Relative path can also be used. They will be prefixed by: ; - the global prefix if it's been set (-p argument) ; - /opt/php85 otherwise ;include=etc/fpm.d/*.conf ;;;;;;;;;;;;;;;;;; ; Global Options ; ;;;;;;;;;;;;;;;;;; [global] ; Pid file ; Note: the default prefix is /opt/php85/var ; Default Value: none pid = /run/php85-fpm.pid ; Error log file ; If it's set to "syslog", log is sent to syslogd instead of being written ; in a local file. ; Note: the default prefix is /opt/php85/var ; Default Value: log/php-fpm.log error_log = /var/log/php/php85-fpm-error.log ; syslog_facility is used to specify what type of program is logging the ; message. This lets syslogd specify that messages from different facilities ; will be handled differently. ; See syslog(3) for possible values (ex daemon equiv LOG_DAEMON) ; Default Value: daemon syslog.facility = daemon ; syslog_ident is prepended to every message. If you have multiple FPM ; instances running on the same server, you can change the default value ; which must suit common needs. ; Default Value: php-fpm syslog.ident = php85-fpm ; Log level ; Possible Values: alert, error, warning, notice, debug ; Default Value: notice log_level = warning ; If this number of child processes exit with SIGSEGV or SIGBUS within the time ; interval set by emergency_restart_interval then FPM will restart. A value ; of '0' means 'Off'. ; Default Value: 0 emergency_restart_threshold = 5 ; Interval of time used by emergency_restart_interval to determine when ; a graceful restart will be initiated. This can be useful to work around ; accidental corruptions in an accelerator's shared memory. ; Available Units: s(econds), m(inutes), h(ours), or d(ays) ; Default Unit: seconds ; Default Value: 0 emergency_restart_interval = 1m ; Time limit for child processes to wait for a reaction on signals from master. ; Available units: s(econds), m(inutes), h(ours), or d(ays) ; Default Unit: seconds ; Default Value: 0 process_control_timeout = 5s ; The maximum number of processes FPM will fork. This has been design to control ; the global number of processes when using dynamic PM within a lot of pools. ; Use it with caution. ; Note: A value of 0 indicates no limit ; Default Value: 0 process.max = 0 ; Specify the nice(2) priority to apply to the master process (only if set) ; The value can vary from -19 (highest priority) to 20 (lower priority) ; Note: - It will only work if the FPM master process is launched as root ; - The pool process will inherit the master process priority ; unless it specified otherwise ; Default Value: no set ; process.priority = -19 ; Send FPM to background. Set to 'no' to keep FPM in foreground for debugging. ; Default Value: yes daemonize = yes ; Set open file descriptor rlimit for the master process. ; Default Value: system defined value ;rlimit_files = 1024 ; Set max core size rlimit for the master process. ; Possible Values: 'unlimited' or an integer greater or equal to 0 ; Default Value: system defined value ;rlimit_core = 0 ; Specify the event mechanism FPM will use. The following is available: ; - select (any POSIX os) ; - poll (any POSIX os) ; - epoll (linux >= 2.5.44) ; - kqueue (FreeBSD >= 4.1, OpenBSD >= 2.9, NetBSD >= 2.0) ; - /dev/poll (Solaris >= 7) ; - port (Solaris >= 10) ; Default Value: not set (auto detection) ;events.mechanism = epoll ;;;;;;;;;;;;;;;;;;;; ; Pool Definitions ; ;;;;;;;;;;;;;;;;;;;; ; Multiple pools of child processes may be started with different listening ; ports and different management options. The name of the pool will be ; used in logs and stats. There is no limitation on the number of pools which ; FPM can handle. Your system will tell you anyway :) include = /opt/php85/etc/pool.d/*.conf ================================================ FILE: aegir/conf/php/php85.ini ================================================ [PHP] ;;;;;;;;;;;;;;;;;;; ; About php.ini ; ;;;;;;;;;;;;;;;;;;; ; PHP's initialization file, generally called php.ini, is responsible for ; configuring many of the aspects of PHP's behavior. ; PHP attempts to find and load this configuration from a number of locations. ; The following is a summary of its search order: ; 1. SAPI module specific location. ; 2. The PHPRC environment variable. ; 3. A number of predefined registry keys on Windows ; 4. Current working directory (except CLI) ; 5. The web server's directory (for SAPI modules), or directory of PHP ; (otherwise in Windows) ; 6. The directory from the --with-config-file-path compile time option, or the ; Windows directory (usually C:\windows) ; See the PHP docs for more specific information. ; https://php.net/configuration.file ; The syntax of the file is extremely simple. Whitespace and lines ; beginning with a semicolon are silently ignored (as you probably guessed). ; Section headers (e.g. [Foo]) are also silently ignored, even though ; they might mean something in the future. ; Directives following the section heading [PATH=/www/mysite] only ; apply to PHP files in the /www/mysite directory. Directives ; following the section heading [HOST=www.example.com] only apply to ; PHP files served from www.example.com. Directives set in these ; special sections cannot be overridden by user-defined INI files or ; at runtime. Currently, [PATH=] and [HOST=] sections only work under ; CGI/FastCGI. ; https://php.net/ini.sections ; Directives are specified using the following syntax: ; directive = value ; Directive names are *case sensitive* - foo=bar is different from FOO=bar. ; Directives are variables used to configure PHP or PHP extensions. ; There is no name validation. If PHP can't find an expected ; directive because it is not set or is mistyped, a default value will be used. ; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one ; of the INI constants (On, Off, True, False, Yes, No and None) or an expression ; (e.g. E_ALL & ~E_NOTICE), a quoted string ("bar"), or a reference to a ; previously set variable or directive (e.g. ${foo}) ; Expressions in the INI file are limited to bitwise operators and parentheses: ; | bitwise OR ; ^ bitwise XOR ; & bitwise AND ; ~ bitwise NOT ; ! boolean NOT ; Boolean flags can be turned on using the values 1, On, True or Yes. ; They can be turned off using the values 0, Off, False or No. ; An empty string can be denoted by simply not writing anything after the equal ; sign, or by using the None keyword: ; foo = ; sets foo to an empty string ; foo = None ; sets foo to an empty string ; foo = "None" ; sets foo to the string 'None' ; If you use constants in your value, and these constants belong to a ; dynamically loaded extension (either a PHP extension or a Zend extension), ; you may only use these constants *after* the line that loads the extension. ;;;;;;;;;;;;;;;;;;; ; About this file ; ;;;;;;;;;;;;;;;;;;; ; PHP comes packaged with two INI files. One that is recommended to be used ; in production environments and one that is recommended to be used in ; development environments. ; php.ini-production contains settings which hold security, performance and ; best practices at its core. But please be aware, these settings may break ; compatibility with older or less security-conscious applications. We ; recommending using the production ini in production and testing environments. ; php.ini-development is very similar to its production variant, except it is ; much more verbose when it comes to errors. We recommend using the ; development version only in development environments, as errors shown to ; application users can inadvertently leak otherwise secure information. ; This is the php.ini-production INI file. ;;;;;;;;;;;;;;;;;;; ; Quick Reference ; ;;;;;;;;;;;;;;;;;;; ; The following are all the settings which are different in either the production ; or development versions of the INIs with respect to PHP's default behavior. ; Please see the actual settings later in the document for more details as to why ; we recommend these changes in PHP's behavior. display_errors = Off ; Default Value: On ; Development Value: On ; Production Value: Off ; display_startup_errors ; Default Value: On ; Development Value: On ; Production Value: Off ; error_reporting ; Default Value: E_ALL ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED ; log_errors ; Default Value: Off ; Development Value: On ; Production Value: On ; max_input_time ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; mysqlnd.collect_memory_statistics ; Default Value: Off ; Development Value: On ; Production Value: Off ; output_buffering ; Default Value: Off ; Development Value: 4096 ; Production Value: 4096 ; request_order ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; session.gc_divisor ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; short_open_tag ; Default Value: On ; Development Value: Off ; Production Value: Off ; variables_order ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS" ; zend.assertions ; Default Value: 1 ; Development Value: 1 ; Production Value: -1 ; zend.exception_ignore_args ; Default Value: Off ; Development Value: Off ; Production Value: On ; zend.exception_string_param_max_len ; Default Value: 15 ; Development Value: 15 ; Production Value: 0 ;;;;;;;;;;;;;;;;;;;; ; php.ini Options ; ;;;;;;;;;;;;;;;;;;;; ; Name for user-defined php.ini (.htaccess) files. Default is ".user.ini" ;user_ini.filename = ".user.ini" ; To disable this feature set this option to an empty value user_ini.filename = ; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes) ;user_ini.cache_ttl = 300 ;;;;;;;;;;;;;;;;;;;; ; Language Options ; ;;;;;;;;;;;;;;;;;;;; ; Enable the PHP scripting language engine under Apache. ; https://php.net/engine engine = On ; This directive determines whether or not PHP will recognize code between ; tags as PHP source which should be processed as such. It is ; generally recommended that should be used and that this feature ; should be disabled, as enabling it may result in issues when generating XML ; documents, however this remains supported for backward compatibility reasons. ; Note that this directive does not control the would work. ; https://php.net/syntax-highlighting ;highlight.string = #DD0000 ;highlight.comment = #FF9900 ;highlight.keyword = #007700 ;highlight.default = #0000BB ;highlight.html = #000000 ; If enabled, the request will be allowed to complete even if the user aborts ; the request. Consider enabling it if executing long requests, which may end up ; being interrupted by the user or a browser timing out. PHP's default behavior ; is to disable this feature. ; https://php.net/ignore-user-abort ;ignore_user_abort = On ; Determines the size of the realpath cache to be used by PHP. This value should ; be increased on systems where PHP opens many files to reflect the quantity of ; the file operations performed. ; Note: if open_basedir is set, the cache is disabled ; https://php.net/realpath-cache-size realpath_cache_size=64M ; Duration of time, in seconds for which to cache realpath information for a given ; file or directory. For systems with rarely changing files, consider increasing this ; value. ; https://php.net/realpath-cache-ttl realpath_cache_ttl=180 ; Enables or disables the circular reference collector. ; https://php.net/zend.enable-gc zend.enable_gc = On ; If enabled, scripts may be written in encodings that are incompatible with ; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such ; encodings. To use this feature, mbstring extension must be enabled. ;zend.multibyte = Off ; Allows to set the default encoding for the scripts. This value will be used ; unless "declare(encoding=...)" directive appears at the top of the script. ; Only affects if zend.multibyte is set. ;zend.script_encoding = ; Allows to include or exclude arguments from stack traces generated for exceptions. ; In production, it is recommended to turn this setting on to prohibit the output ; of sensitive information in stack traces ; Default Value: Off ; Development Value: Off ; Production Value: On zend.exception_ignore_args = On ; Allows setting the maximum string length in an argument of a stringified stack trace ; to a value between 0 and 1000000. ; This has no effect when zend.exception_ignore_args is enabled. ; Default Value: 15 ; Development Value: 15 ; Production Value: 0 ; In production, it is recommended to set this to 0 to reduce the output ; of sensitive information in stack traces. zend.exception_string_param_max_len = 0 ;;;;;;;;;;;;;;;;; ; Miscellaneous ; ;;;;;;;;;;;;;;;;; ; Decides whether PHP may expose the fact that it is installed on the server ; (e.g. by adding its signature to the Web server header). It is no security ; threat in any way, but it makes it possible to determine whether you use PHP ; on your server or not. ; https://php.net/expose-php expose_php = On ;;;;;;;;;;;;;;;;;;; ; Resource Limits ; ;;;;;;;;;;;;;;;;;;; ; Maximum execution time of each script, in seconds ; https://php.net/max-execution-time ; Note: This directive is hardcoded to 0 for the CLI SAPI max_execution_time = 180 ; Maximum amount of time each script may spend parsing request data. It's a good ; idea to limit this time on productions servers in order to eliminate unexpectedly ; long running scripts. ; Note: This directive is hardcoded to -1 for the CLI SAPI ; Default Value: -1 (Unlimited) ; Development Value: 60 (60 seconds) ; Production Value: 60 (60 seconds) ; https://php.net/max-input-time max_input_time = 180 ; Maximum input variable nesting level ; https://php.net/max-input-nesting-level ;max_input_nesting_level = 64 ; How many GET/POST/COOKIE input variables may be accepted max_input_vars = 9999 ; How many multipart body parts (combined input variable and file uploads) may ; be accepted. ; Default Value: -1 (Sum of max_input_vars and max_file_uploads) ;max_multipart_body_parts = 1500 ; Maximum amount of memory a script may consume ; https://php.net/memory-limit memory_limit = 395M max_memory_limit = 395M ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; Error handling and logging ; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; This directive informs PHP of which errors, warnings and notices you would like ; it to take action for. The recommended way of setting values for this ; directive is through the use of the error level constants and bitwise ; operators. The error level constants are below here for convenience as well as ; some common settings and their meanings. ; By default, PHP is set to take action on all errors, notices and warnings EXCEPT ; those related to E_NOTICE, which together cover best practices and ; recommended coding standards in PHP. For performance reasons, this is the ; recommend error reporting setting. Your production server shouldn't be wasting ; resources complaining about best practices and coding standards. That's what ; development servers and development settings are for. ; Note: The php.ini-development file has this setting as E_ALL. This ; means it pretty much reports everything which is exactly what you want during ; development and early testing. ; ; Error Level Constants: ; E_ALL - All errors and warnings ; E_ERROR - fatal run-time errors ; E_RECOVERABLE_ERROR - almost fatal run-time errors ; E_WARNING - run-time warnings (non-fatal errors) ; E_PARSE - compile-time parse errors ; E_NOTICE - run-time notices (these are warnings which often result ; from a bug in your code, but it's possible that it was ; intentional (e.g., using an uninitialized variable and ; relying on the fact it is automatically initialized to an ; empty string) ; E_CORE_ERROR - fatal errors that occur during PHP's initial startup ; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's ; initial startup ; E_COMPILE_ERROR - fatal compile-time errors ; E_COMPILE_WARNING - compile-time warnings (non-fatal errors) ; E_USER_ERROR - user-generated error message ; E_USER_WARNING - user-generated warning message ; E_USER_NOTICE - user-generated notice message ; E_DEPRECATED - warn about code that will not work in future versions ; of PHP ; E_USER_DEPRECATED - user-generated deprecation warnings ; ; Common Values: ; E_ALL (Show all errors, warnings and notices including coding standards.) ; E_ALL & ~E_NOTICE (Show all errors, except for notices) ; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors) ; Default Value: E_ALL ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED ; https://php.net/error-reporting error_reporting = E_ALL & ~E_DEPRECATED ; This directive controls whether or not and where PHP will output errors, ; notices and warnings too. Error output is very useful during development, but ; it could be very dangerous in production environments. Depending on the code ; which is triggering the error, sensitive information could potentially leak ; out of your application such as database usernames and passwords or worse. ; For production environments, we recommend logging errors rather than ; sending them to STDOUT. ; Possible Values: ; Off = Do not display any errors ; stderr = Display errors to STDERR (affects only CGI/CLI binaries!) ; On or stdout = Display errors to STDOUT ; Default Value: On ; Development Value: On ; Production Value: Off ; https://php.net/display-errors display_errors = Off ; The display of errors which occur during PHP's startup sequence are handled ; separately from display_errors. We strongly recommend you set this to 'off' ; for production servers to avoid leaking configuration details. ; Default Value: On ; Development Value: On ; Production Value: Off ; https://php.net/display-startup-errors display_startup_errors = Off ; Besides displaying errors, PHP can also log errors to locations such as a ; server-specific log, STDERR, or a location specified by the error_log ; directive found below. While errors should not be displayed on productions ; servers they should still be monitored and logging is a great way to do that. ; Default Value: Off ; Development Value: On ; Production Value: On ; https://php.net/log-errors log_errors = On ; Do not log repeated messages. Repeated errors must occur in same file on same ; line unless ignore_repeated_source is set true. ; https://php.net/ignore-repeated-errors ignore_repeated_errors = Off ; Ignore source of message when ignoring repeated messages. When this setting ; is On you will not log errors with repeated messages from different files or ; source lines. ; https://php.net/ignore-repeated-source ignore_repeated_source = Off ; This setting is off by default. ;report_zend_debug = 0 ; Turn off normal error reporting and emit XML-RPC error XML ; https://php.net/xmlrpc-errors ;xmlrpc_errors = 0 ; An XML-RPC faultCode ;xmlrpc_error_number = 0 ; When PHP displays or logs an error, it has the capability of formatting the ; error message as HTML for easier reading. This directive controls whether ; the error message is formatted as HTML or not. ; Note: This directive is hardcoded to Off for the CLI SAPI ; https://php.net/html-errors html_errors = Off ; If html_errors is set to On *and* docref_root is not empty, then PHP ; produces clickable error messages that direct to a page describing the error ; or function causing the error in detail. ; You can download a copy of the PHP manual from https://php.net/docs ; and change docref_root to the base URL of your local copy including the ; leading '/'. You must also specify the file extension being used including ; the dot. PHP's default behavior is to leave these settings empty, in which ; case no links to documentation are generated. ; Note: Never use this feature for production boxes. ; https://php.net/docref-root ; Examples ;docref_root = "/phpmanual/" ; https://php.net/docref-ext ;docref_ext = .html ; String to output before an error message. PHP's default behavior is to leave ; this setting blank. ; https://php.net/error-prepend-string ; Example: ;error_prepend_string = "" ; String to output after an error message. PHP's default behavior is to leave ; this setting blank. ; https://php.net/error-append-string ; Example: ;error_append_string = "" ; Log errors to specified file. PHP's default behavior is to leave this value ; empty. ; https://php.net/error-log ; Example: ;error_log = php_errors.log ; Log errors to syslog (Event Log on Windows). ;error_log = syslog error_log = /var/log/php/error_log_85 ; The syslog ident is a string which is prepended to every message logged ; to syslog. Only used when error_log is set to syslog. ;syslog.ident = php ; The syslog facility is used to specify what type of program is logging ; the message. Only used when error_log is set to syslog. ;syslog.facility = user ; Set this to disable filtering control characters (the default). ; Some loggers only accept NVT-ASCII, others accept anything that's not ; control characters. If your logger accepts everything, then no filtering ; is needed at all. ; Allowed values are: ; ascii (all printable ASCII characters and NL) ; no-ctrl (all characters except control characters) ; all (all characters) ; raw (like "all", but messages are not split at newlines) ; https://php.net/syslog.filter ;syslog.filter = ascii ;windows.show_crt_warning ; Default value: 0 ; Development value: 0 ; Production value: 0 ; This directive controls whether PHP will output the backtrace of fatal errors. ; Default Value: On ; Development Value: On ; Production Value: On ;fatal_error_backtraces = On ;;;;;;;;;;;;;;;;; ; Data Handling ; ;;;;;;;;;;;;;;;;; ; The separator used in PHP generated URLs to separate arguments. ; PHP's default setting is "&". ; https://php.net/arg-separator.output ; Example: ;arg_separator.output = "&" ; List of separator(s) used by PHP to parse input URLs into variables. ; PHP's default setting is "&". ; NOTE: Every character in this directive is considered as separator! ; https://php.net/arg-separator.input ; Example: ;arg_separator.input = ";&" ; This directive determines which super global arrays are registered when PHP ; starts up. G,P,C,E & S are abbreviations for the following respective super ; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty ; paid for the registration of these arrays and because ENV is not as commonly ; used as the others, ENV is not recommended on productions servers. You ; can still get access to the environment variables through getenv() should you ; need to. ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS"; ; https://php.net/variables-order variables_order = "GPCS" ; This directive determines which super global data (G,P & C) should be ; registered into the super global array REQUEST. If so, it also determines ; the order in which that data is registered. The values for this directive ; are specified in the same manner as the variables_order directive, ; EXCEPT one. Leaving this value empty will cause PHP to use the value set ; in the variables_order directive. It does not mean it will leave the super ; globals array REQUEST empty. ; Default Value: None ; Development Value: "GP" ; Production Value: "GP" ; https://php.net/request-order request_order = "GP" ; This directive determines whether PHP registers $argv & $argc each time it ; runs. $argv contains an array of all the arguments passed to PHP when a script ; is invoked. $argc contains an integer representing the number of arguments ; that were passed when the script was invoked. These arrays are extremely ; useful when running scripts from the command line. When this directive is ; enabled, registering these variables consumes CPU cycles and memory each time ; a script is executed. For security reasons, this feature should be disabled ; for non-CLI SAPIs. ; Note: This directive is ignored for the CLI SAPI ; This directive is deprecated. ; https://php.net/register-argc-argv register_argc_argv = Off ; When enabled, the ENV, REQUEST and SERVER variables are created when they're ; first used (Just In Time) instead of when the script starts. If these ; variables are not used within a script, having this directive on will result ; in a performance gain. The PHP directive register_argc_argv must be disabled ; for this directive to have any effect. ; https://php.net/auto-globals-jit auto_globals_jit = On ; Whether PHP will read the POST data. ; This option is enabled by default. ; Most likely, you won't want to disable this option globally. It causes $_POST ; and $_FILES to always be empty; the only way you will be able to read the ; POST data will be through the php://input stream wrapper. This can be useful ; to proxy requests or to process the POST data in a memory efficient fashion. ; https://php.net/enable-post-data-reading ;enable_post_data_reading = Off ; Maximum size of POST data that PHP will accept. ; Its value may be 0 to disable the limit. It is ignored if POST data reading ; is disabled through enable_post_data_reading. ; https://php.net/post-max-size post_max_size = 350M ; Automatically add files before PHP document. ; https://php.net/auto-prepend-file auto_prepend_file = ; Automatically add files after PHP document. ; https://php.net/auto-append-file auto_append_file = ; By default, PHP will output a media type using the Content-Type header. To ; disable this, simply set it to be empty. ; ; PHP's built-in default media type is set to text/html. ; https://php.net/default-mimetype default_mimetype = "text/html" ; PHP's default character set is set to UTF-8. ; https://php.net/default-charset default_charset = "UTF-8" ; PHP internal character encoding is set to empty. ; If empty, default_charset is used. ; https://php.net/internal-encoding ;internal_encoding = ; PHP input character encoding is set to empty. ; If empty, default_charset is used. ; https://php.net/input-encoding ;input_encoding = ; PHP output character encoding is set to empty. ; If empty, default_charset is used. ; See also output_buffer. ; https://php.net/output-encoding ;output_encoding = ;;;;;;;;;;;;;;;;;;;;;;;;; ; Paths and Directories ; ;;;;;;;;;;;;;;;;;;;;;;;;; ; UNIX: "/path1:/path2" ;include_path = ".:/php/includes" ; ; Windows: "\path1;\path2" ;include_path = ".;c:\php\includes" ; ; PHP's default setting for include_path is ".;/path/to/php/pear" ; https://php.net/include-path include_path = ".:/opt/php85/lib/php" ; The root of the PHP pages, used only if nonempty. ; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root ; if you are running php as a CGI under any web server (other than IIS) ; see documentation for security issues. The alternate is to use the ; cgi.force_redirect configuration below ; https://php.net/doc-root doc_root = ; The directory under which PHP opens the script using /~username used only ; if nonempty. ; https://php.net/user-dir user_dir = ; Directory in which the loadable extensions (modules) reside. ; https://php.net/extension-dir ;extension_dir = "./" ; On windows: ;extension_dir = "ext" extension_dir = "/opt/php85/lib/php/extensions/no-debug-non-zts-20250925/" ; Directory where the temporary files should be placed. ; Defaults to the system default (see sys_get_temp_dir) sys_temp_dir = "/tmp" ; Whether or not to enable the dl() function. The dl() function does NOT work ; properly in multithreaded servers, such as IIS or Zeus, and is automatically ; disabled on them. ; https://php.net/enable-dl enable_dl = Off ; cgi.force_redirect is necessary to provide security running PHP as a CGI under ; most web servers. Left undefined, PHP turns this on by default. You can ; turn it off here AT YOUR OWN RISK ; **You CAN safely turn this off for IIS, in fact, you MUST.** ; https://php.net/cgi.force-redirect ;cgi.force_redirect = 1 ; if cgi.nph is enabled it will force cgi to always sent Status: 200 with ; every request. PHP's default behavior is to disable this feature. ;cgi.nph = 1 ; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape ; (iPlanet) web servers, you MAY need to set an environment variable name that PHP ; will look for to know it is OK to continue execution. Setting this variable MAY ; cause security issues, KNOW WHAT YOU ARE DOING FIRST. ; https://php.net/cgi.redirect-status-env ;cgi.redirect_status_env = ; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's ; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok ; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting ; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting ; of zero causes PHP to behave as before. Default is 1. You should fix your scripts ; to use SCRIPT_FILENAME rather than PATH_TRANSLATED. ; https://php.net/cgi.fix-pathinfo ;cgi.fix_pathinfo=1 ; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside ; of the web tree and people will not be able to circumvent .htaccess security. ;cgi.discard_path=1 ; FastCGI under IIS supports the ability to impersonate ; security tokens of the calling client. This allows IIS to define the ; security context that the request runs under. mod_fastcgi under Apache ; does not currently support this feature (03/17/2002) ; Set to 1 if running under IIS. Default is zero. ; https://php.net/fastcgi.impersonate ;fastcgi.impersonate = 1 ; Prevent decoding of SCRIPT_FILENAME when using Apache ProxyPass or ; ProxyPassMatch. This should be used if script file paths are not stored ; in an encoded format on the file system. ; Default is 1. ;fastcgi.script_path_encoded = 0 ; Disable logging through FastCGI connection. PHP's default behavior is to enable ; this feature. ;fastcgi.logging = 0 ; cgi.rfc2616_headers configuration option tells PHP what type of headers to ; use when sending HTTP response code. If set to 0, PHP sends Status: header that ; is supported by Apache. When this option is set to 1, PHP will send ; RFC2616 compliant header. ; Default is zero. ; https://php.net/cgi.rfc2616-headers ;cgi.rfc2616_headers = 0 ; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #! ; (shebang) at the top of the running script. This line might be needed if the ; script support running both as stand-alone script and via PHP CGI<. PHP in CGI ; mode skips this line and ignores its content if this directive is turned on. ; https://php.net/cgi.check-shebang-line ;cgi.check_shebang_line=1 ;;;;;;;;;;;;;;;; ; File Uploads ; ;;;;;;;;;;;;;;;; ; Whether to allow HTTP file uploads. ; https://php.net/file-uploads file_uploads = On ; Temporary directory for HTTP uploaded files (will use system default if not ; specified). ; https://php.net/upload-tmp-dir upload_tmp_dir = /tmp ; Maximum allowed size for uploaded files. ; https://php.net/upload-max-filesize upload_max_filesize = 325M ; Maximum number of files that can be uploaded via a single request max_file_uploads = 50 ;;;;;;;;;;;;;;;;;; ; Fopen wrappers ; ;;;;;;;;;;;;;;;;;; ; Whether to allow the treatment of URLs (like http:// or ftp://) as files. ; https://php.net/allow-url-fopen allow_url_fopen = On ; Whether to allow include/require to open URLs (like https:// or ftp://) as files. ; https://php.net/allow-url-include allow_url_include = Off ; Define the anonymous ftp password (your email address). PHP's default setting ; for this is empty. ; https://php.net/from ;from="john@doe.com" ; Define the User-Agent string. PHP's default setting for this is empty. ; https://php.net/user-agent ;user_agent="PHP" ; Default timeout for socket based streams (seconds) ; https://php.net/default-socket-timeout default_socket_timeout = 180 ; If your scripts have to deal with files from Macintosh systems, ; or you are running on a Mac and need to deal with files from ; unix or win32 systems, setting this flag will cause PHP to ; automatically detect the EOL character in those files so that ; fgets() and file() will work regardless of the source of the file. ; https://php.net/auto-detect-line-endings auto_detect_line_endings = On ;;;;;;;;;;;;;;;;;;;;;; ; Dynamic Extensions ; ;;;;;;;;;;;;;;;;;;;;;; ; If you wish to have an extension loaded automatically, use the following ; syntax: ; ; extension=modulename ; ; For example: ; ; extension=mysqli ; ; When the extension library to load is not located in the default extension ; directory, You may specify an absolute path to the library file: ; ; extension=/path/to/extension/mysqli.so ; ; Note : The syntax used in previous PHP versions ('extension=.so' and ; 'extension='php_.dll') is supported for legacy reasons and may be ; deprecated in a future PHP major version. So, when it is possible, please ; move to the new ('extension=) syntax. ; ; Notes for Windows environments : ; ; - Many DLL files are located in the ext/ ; extension folders as well as the separate PECL DLL download. ; Be sure to appropriately set the extension_dir directive. ; ;extension=bz2 ;extension=curl ;extension=exif ;extension=ffi ;extension=ftp ;extension=fileinfo ;extension=gd ;extension=gettext ;extension=gmp ;extension=intl ;extension=ldap ;extension=mbstring ;extension=mysqli ;extension=odbc ;extension=openssl ;extension=pdo_firebird ;extension=pdo_mysql ;extension=pdo_odbc ;extension=pdo_pgsql ;extension=pdo_sqlite ;extension=pgsql ;extension=shmop ; The MIBS data available in the PHP distribution must be installed. ; See https://www.php.net/manual/en/snmp.installation.php ;extension=snmp ;extension=soap ;extension=sockets ;extension=sodium ;extension=sqlite3 ;extension=tidy ;extension=xsl ;extension=zip ;zend_extension=opcache ;;;;;;;;;;;;;;;;;;; ; Module Settings ; ;;;;;;;;;;;;;;;;;;; [CLI Server] ; Whether the CLI web server uses ANSI color coding in its terminal output. cli_server.color = On [Date] ; Defines the default timezone used by the date functions ; https://php.net/date.timezone date.timezone = "UTC" ; https://php.net/date.default-latitude ;date.default_latitude = 31.7667 ; https://php.net/date.default-longitude ;date.default_longitude = 35.2333 ; https://php.net/date.sunrise-zenith ;date.sunrise_zenith = 90.833333 ; https://php.net/date.sunset-zenith ;date.sunset_zenith = 90.833333 [filter] ; https://php.net/filter.default ;filter.default = unsafe_raw ; https://php.net/filter.default-flags ;filter.default_flags = [iconv] ; Use of this INI entry is deprecated, use global input_encoding instead. ; If empty, default_charset or input_encoding or iconv.input_encoding is used. ; The precedence is: default_charset < input_encoding < iconv.input_encoding ;iconv.input_encoding = ; Use of this INI entry is deprecated, use global internal_encoding instead. ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;iconv.internal_encoding = ; Use of this INI entry is deprecated, use global output_encoding instead. ; If empty, default_charset or output_encoding or iconv.output_encoding is used. ; The precedence is: default_charset < output_encoding < iconv.output_encoding ; To use an output encoding conversion, iconv's output handler must be set ; otherwise output encoding conversion cannot be performed. ;iconv.output_encoding = [intl] ;intl.default_locale = ; This directive allows you to produce PHP errors when some error ; happens within intl functions. The value is the level of the error produced. ; Default is 0, which does not produce any errors. ; This directive is deprecated. ;intl.error_level = E_WARNING ; If enabled this directive indicates that when an error occurs within an ; intl function a IntlException should be thrown. ; Default is Off, which means errors need to be handled manually. ;intl.use_exceptions = On [sqlite3] ; Directory pointing to SQLite3 extensions ; https://php.net/sqlite3.extension-dir ;sqlite3.extension_dir = ; SQLite defensive mode flag (only available from SQLite 3.26+) ; When the defensive flag is enabled, language features that allow ordinary ; SQL to deliberately corrupt the database file are disabled. This forbids ; writing directly to the schema, shadow tables (eg. FTS data tables), or ; the sqlite_dbpage virtual table. ; https://www.sqlite.org/c3ref/c_dbconfig_defensive.html ; (for older SQLite versions, this flag has no use) ;sqlite3.defensive = 1 [Pcre] ; PCRE library backtracking limit. ; https://php.net/pcre.backtrack-limit ;pcre.backtrack_limit=100000 ; PCRE library recursion limit. ; Please note that if you set this value to a high number you may consume all ; the available process stack and eventually crash PHP (due to reaching the ; stack size limit imposed by the Operating System). ; https://php.net/pcre.recursion-limit ;pcre.recursion_limit=100000 ; Enables or disables JIT compilation of patterns. This requires the PCRE ; library to be compiled with JIT support. ;pcre.jit=1 [Pdo] ; Whether to pool ODBC connections. Can be one of "strict", "relaxed" or "off" ; https://php.net/pdo-odbc.connection-pooling ;pdo_odbc.connection_pooling=strict [Pdo_mysql] ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. pdo_mysql.default_socket= [Phar] ; https://php.net/phar.readonly ;phar.readonly = On ; https://php.net/phar.require-hash ;phar.require_hash = On ;phar.cache_list = [mail function] ; For Win32 only. ; https://php.net/smtp ;SMTP = localhost ; https://php.net/smtp-port ;smtp_port = 25 ; For Win32 only. ; https://php.net/sendmail-from ;sendmail_from = me@example.com ; For Unix only. You may supply arguments as well (default: "sendmail -t -i"). ; https://php.net/sendmail-path sendmail_path = /usr/sbin/sendmail -t -i ; Force the addition of the specified parameters to be passed as extra parameters ; to the sendmail binary. These parameters will always replace the value of ; the 5th parameter to mail(). ;mail.force_extra_parameters = ; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename mail.add_x_header = Off ; Use mixed LF and CRLF line separators to keep compatibility with some ; RFC 2822 non conformant MTA. mail.mixed_lf_and_crlf = Off ; Control line ending mode for mail messages and headers. ; Possible values: "crlf" (default), "lf", "mixed", "os" ; - crlf: Use CRLF line endings ; - lf: Use LF line endings only (converts CRLF in message to LF) ; - mixed: Same as mail.mixed_lf_and_crlf = On ; - os: Use CRLF on Windows, LF on other systems mail.cr_lf_mode = crlf ; The path to a log file that will log all mail() calls. Log entries include ; the full path of the script, line number, To address and headers. ;mail.log = ; Log mail to syslog (Event Log on Windows). ;mail.log = syslog [ODBC] ; https://php.net/odbc.default-db ;odbc.default_db = Not yet implemented ; https://php.net/odbc.default-user ;odbc.default_user = Not yet implemented ; https://php.net/odbc.default-pw ;odbc.default_pw = Not yet implemented ; Controls the ODBC cursor model. ; Default: SQL_CURSOR_STATIC (default). ;odbc.default_cursortype ; Allow or prevent persistent links. ; https://php.net/odbc.allow-persistent odbc.allow_persistent = On ; Check that a connection is still valid before reuse. ; https://php.net/odbc.check-persistent odbc.check_persistent = On ; Maximum number of persistent links. -1 means no limit. ; https://php.net/odbc.max-persistent odbc.max_persistent = -1 ; Maximum number of links (persistent + non-persistent). -1 means no limit. ; https://php.net/odbc.max-links odbc.max_links = -1 ; Handling of LONG fields. Returns number of bytes to variables. 0 means ; passthru. ; https://php.net/odbc.defaultlrl odbc.defaultlrl = 4096 ; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char. ; See the documentation on odbc_binmode and odbc_longreadlen for an explanation ; of odbc.defaultlrl and odbc.defaultbinmode ; https://php.net/odbc.defaultbinmode odbc.defaultbinmode = 1 [MySQLi] ; Maximum number of persistent links. -1 means no limit. ; https://php.net/mysqli.max-persistent mysqli.max_persistent = -1 ; Allow accessing, from PHP's perspective, local files with LOAD DATA statements ; https://php.net/mysqli.allow_local_infile ;mysqli.allow_local_infile = On ; It allows the user to specify a folder where files that can be sent via LOAD DATA ; LOCAL can exist. It is ignored if mysqli.allow_local_infile is enabled. ;mysqli.local_infile_directory = ; Allow or prevent persistent links. ; https://php.net/mysqli.allow-persistent mysqli.allow_persistent = On ; Maximum number of links. -1 means no limit. ; https://php.net/mysqli.max-links mysqli.max_links = -1 ; Default port number for mysqli_connect(). ; https://php.net/mysqli.default-port mysqli.default_port = 3306 ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. ; https://php.net/mysqli.default-socket mysqli.default_socket = ; Default host for mysqli_connect(). ; https://php.net/mysqli.default-host mysqli.default_host = ; Default user for mysqli_connect(). ; https://php.net/mysqli.default-user mysqli.default_user = ; Default password for mysqli_connect(). ; Note that this is generally a *bad* idea to store passwords in this file. ; *Any* user with PHP access can run 'echo get_cfg_var("mysqli.default_pw") ; and reveal this password! And of course, any users with read access to this ; file will be able to reveal the password as well. ; https://php.net/mysqli.default-pw mysqli.default_pw = ; If this option is enabled, closing a persistent connection will rollback ; any pending transactions of this connection, before it is put back ; into the persistent connection pool. ;mysqli.rollback_on_cached_plink = Off [mysqlnd] ; Enable / Disable collection of general statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. mysqlnd.collect_statistics = 0 ; Enable / Disable collection of memory usage statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. ; Default Value: Off ; Development Value: On ; Production Value: Off mysqlnd.collect_memory_statistics = Off ; Records communication from all extensions using mysqlnd to the specified log ; file. ; https://php.net/mysqlnd.debug ;mysqlnd.debug = ; Defines which queries will be logged. ;mysqlnd.log_mask = 0 ; Default size of the mysqlnd memory pool, which is used by result sets. mysqlnd.mempool_default_size = 64000 ; Size of a pre-allocated buffer used when sending commands to MySQL in bytes. mysqlnd.net_cmd_buffer_size = 8192 ; Size of a pre-allocated buffer used for reading data sent by the server in ; bytes. mysqlnd.net_read_buffer_size = 131072 ; Timeout for network requests in seconds. ;mysqlnd.net_read_timeout = 31536000 ; SHA-256 Authentication Plugin related. File with the MySQL server public RSA ; key. ;mysqlnd.sha256_server_public_key = [PostgreSQL] ; Allow or prevent persistent links. ; https://php.net/pgsql.allow-persistent pgsql.allow_persistent = On ; Detect broken persistent links always with pg_pconnect(). ; Auto reset feature requires a little overheads. ; https://php.net/pgsql.auto-reset-persistent pgsql.auto_reset_persistent = Off ; Maximum number of persistent links. -1 means no limit. ; https://php.net/pgsql.max-persistent pgsql.max_persistent = -1 ; Maximum number of links (persistent+non persistent). -1 means no limit. ; https://php.net/pgsql.max-links pgsql.max_links = -1 ; Ignore PostgreSQL backends Notice message or not. ; Notice message logging require a little overheads. ; https://php.net/pgsql.ignore-notice pgsql.ignore_notice = 0 ; Log PostgreSQL backends Notice message or not. ; Unless pgsql.ignore_notice=0, module cannot log notice message. ; https://php.net/pgsql.log-notice pgsql.log_notice = 0 [bcmath] ; Number of decimal digits for all bcmath functions. ; https://php.net/bcmath.scale bcmath.scale = 0 [browscap] ; https://php.net/browscap ;browscap = extra/browscap.ini [Session] ; Handler used to store/retrieve data. ; https://php.net/session.save-handler session.save_handler = files ; Argument passed to save_handler. In the case of files, this is the path ; where data files are stored. Note: Windows users have to change this ; variable in order to use PHP's session functions. ; ; The path can be defined as: ; ; session.save_path = "N;/path" ; ; where N is an integer. Instead of storing all the session files in ; /path, what this will do is use subdirectories N-levels deep, and ; store the session data in those directories. This is useful if ; your OS has problems with many files in one directory, and is ; a more efficient layout for servers that handle many sessions. ; ; NOTE 1: PHP will not create this directory structure automatically. ; You can use the script in the ext/session dir for that purpose. ; NOTE 2: See the section on garbage collection below if you choose to ; use subdirectories for session storage ; ; The file storage module creates files using mode 600 by default. ; You can change that by using ; ; session.save_path = "N;MODE;/path" ; ; where MODE is the octal representation of the mode. Note that this ; does not overwrite the process's umask. ; https://php.net/session.save-path session.save_path = "/opt/tmp" ; Whether to use strict session mode. ; Strict session mode does not accept an uninitialized session ID, and ; regenerates the session ID if the browser sends an uninitialized session ID. ; Strict mode protects applications from session fixation via a session adoption ; vulnerability. It is disabled by default for maximum compatibility, but ; enabling it is encouraged. ; https://wiki.php.net/rfc/strict_sessions session.use_strict_mode = 0 ; Whether to use cookies. ; https://php.net/session.use-cookies session.use_cookies = 1 ; https://php.net/session.cookie-secure ;session.cookie_secure = ; https://php.net/session.cookie-partitioned ;session.cookie_partitioned = 0 ; This option forces PHP to fetch and use a cookie for storing and maintaining ; the session id. We encourage this operation as it's very helpful in combating ; session hijacking when not specifying and managing your own session id. It is ; not the be-all and end-all of session hijacking defense, but it's a good start. ; https://php.net/session.use-only-cookies session.use_only_cookies = 1 ; Name of the session (used as cookie name). ; https://php.net/session.name session.name = PHPSESSID ; Initialize session on request startup. ; https://php.net/session.auto-start session.auto_start = 0 ; Lifetime in seconds of cookie or, if 0, until browser is restarted. ; https://php.net/session.cookie-lifetime session.cookie_lifetime = 0 ; The path for which the cookie is valid. ; https://php.net/session.cookie-path session.cookie_path = / ; The domain for which the cookie is valid. ; https://php.net/session.cookie-domain session.cookie_domain = ; Whether or not to add the httpOnly flag to the cookie, which makes it ; inaccessible to browser scripting languages such as JavaScript. ; https://php.net/session.cookie-httponly session.cookie_httponly = 1 ; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF) ; Current valid values are "Strict", "Lax" or "None". When using "None", ; make sure to include the quotes, as `none` is interpreted like `false` in ini files. ; https://tools.ietf.org/html/draft-west-first-party-cookies-07 session.cookie_samesite = ; Handler used to serialize data. php is the standard serializer of PHP. ; https://php.net/session.serialize-handler session.serialize_handler = php ; Defines the probability that the 'garbage collection' process is started on every ; session initialization. The probability is calculated by using gc_probability/gc_divisor, ; e.g. 1/100 means there is a 1% chance that the GC process starts on each request. ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; https://php.net/session.gc-probability session.gc_probability = 1 ; Defines the probability that the 'garbage collection' process is started on every ; session initialization. The probability is calculated by using gc_probability/gc_divisor, ; e.g. 1/100 means there is a 1% chance that the GC process starts on each request. ; For high volume production servers, using a value of 1000 is a more efficient approach. ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 ; https://php.net/session.gc-divisor session.gc_divisor = 1000 ; After this number of seconds, stored data will be seen as 'garbage' and ; cleaned up by the garbage collection process. ; https://php.net/session.gc-maxlifetime session.gc_maxlifetime = 1440 ; NOTE: If you are using the subdirectory option for storing session files ; (see session.save_path above), then garbage collection does *not* ; happen automatically. You will need to do your own garbage ; collection through a shell script, cron entry, or some other method. ; For example, the following script is the equivalent of setting ; session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes): ; find /path/to/sessions -cmin +24 -type f | xargs rm ; Check HTTP Referer to invalidate externally stored URLs containing ids. ; HTTP_REFERER has to contain this substring for the session to be ; considered as valid. ; https://php.net/session.referer-check session.referer_check = ; Set to {nocache,private,public,} to determine HTTP caching aspects ; or leave this empty to avoid sending anti-caching headers. ; https://php.net/session.cache-limiter session.cache_limiter = nocache ; Document expires after n minutes. ; https://php.net/session.cache-expire session.cache_expire = 180 ; trans sid support is disabled by default. ; Use of trans sid may risk your users' security. ; Use this option with caution. ; - User may send URL contains active session ID ; to other person via. email/irc/etc. ; - URL that contains active session ID may be stored ; in publicly accessible computer. ; - User may access your site with the same session ID ; always using URL stored in browser's history or bookmarks. ; https://php.net/session.use-trans-sid session.use_trans_sid = 0 ; The URL rewriter will look for URLs in a defined set of HTML tags. ; is special; if you include them here, the rewriter will ; add a hidden field with the info which is otherwise appended ; to URLs. tag's action attribute URL will not be modified ; unless it is specified. ; Note that all valid entries require a "=", even if no value follows. ; Default Value: "a=href,area=href,frame=src,form=" ; Development Value: "a=href,area=href,frame=src,form=" ; Production Value: "a=href,area=href,frame=src,form=" ; https://php.net/url-rewriter.tags session.trans_sid_tags = "a=href,area=href,frame=src,form=" ; URL rewriter does not rewrite absolute URLs by default. ; To enable rewrites for absolute paths, target hosts must be specified ; at RUNTIME. i.e. use ini_set() ; tags is special. PHP will check action attribute's URL regardless ; of session.trans_sid_tags setting. ; If no host is defined, HTTP_HOST will be used for allowed host. ; Example value: php.net,www.php.net,wiki.php.net ; Use "," for multiple hosts. No spaces are allowed. ; Default Value: "" ; Development Value: "" ; Production Value: "" ;session.trans_sid_hosts="" ; Enable upload progress tracking in $_SESSION ; Default Value: On ; Development Value: On ; Production Value: On ; https://php.net/session.upload-progress.enabled ;session.upload_progress.enabled = On ; Cleanup the progress information as soon as all POST data has been read ; (i.e. upload completed). ; Default Value: On ; Development Value: On ; Production Value: On ; https://php.net/session.upload-progress.cleanup ;session.upload_progress.cleanup = On ; A prefix used for the upload progress key in $_SESSION ; Default Value: "upload_progress_" ; Development Value: "upload_progress_" ; Production Value: "upload_progress_" ; https://php.net/session.upload-progress.prefix ;session.upload_progress.prefix = "upload_progress_" ; The index name (concatenated with the prefix) in $_SESSION ; containing the upload progress information ; Default Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Development Value: "PHP_SESSION_UPLOAD_PROGRESS" ; Production Value: "PHP_SESSION_UPLOAD_PROGRESS" ; https://php.net/session.upload-progress.name ;session.upload_progress.name = "PHP_SESSION_UPLOAD_PROGRESS" ; How frequently the upload progress should be updated. ; Given either in percentages (per-file), or in bytes ; Default Value: "1%" ; Development Value: "1%" ; Production Value: "1%" ; https://php.net/session.upload-progress.freq ;session.upload_progress.freq = "1%" ; The minimum delay between updates, in seconds ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 ; https://php.net/session.upload-progress.min-freq ;session.upload_progress.min_freq = "1" ; Only write session data when session data is changed. Enabled by default. ; https://php.net/session.lazy-write ;session.lazy_write = On [Assertion] ; Switch whether to compile assertions at all (to have no overhead at run-time) ; -1: Do not compile at all ; 0: Jump over assertion at run-time ; 1: Execute assertions ; Changing from or to a negative value is only possible in php.ini! ; (For turning assertions on and off at run-time, toggle zend.assertions between the values 1 and 0) ; Default Value: 1 ; Development Value: 1 ; Production Value: -1 ; https://php.net/zend.assertions zend.assertions = -1 [COM] ; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs ; https://php.net/com.typelib-file ;com.typelib_file = ; allow Distributed-COM calls ; https://php.net/com.allow-dcom ;com.allow_dcom = true ; autoregister constants of a component's typelib on com_load() ; https://php.net/com.autoregister-typelib ;com.autoregister_typelib = true ; register constants casesensitive ; https://php.net/com.autoregister-casesensitive ;com.autoregister_casesensitive = false ; show warnings on duplicate constant registrations ; https://php.net/com.autoregister-verbose ;com.autoregister_verbose = true ; The default character set code-page to use when passing strings to and from COM objects. ; Default: system ANSI code page ;com.code_page= ; The version of the .NET framework to use. The value of the setting are the first three parts ; of the framework's version number, separated by dots, and prefixed with "v", e.g. "v4.0.30319". ;com.dotnet_version= [mbstring] ; language for internal character representation. ; This affects mb_send_mail() and mbstring.detect_order. ; https://php.net/mbstring.language ;mbstring.language = Japanese ; Use of this INI entry is deprecated, use global internal_encoding instead. ; internal/script encoding. ; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*) ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;mbstring.internal_encoding = ; Use of this INI entry is deprecated, use global input_encoding instead. ; http input encoding. ; mbstring.encoding_translation = On is needed to use this setting. ; If empty, default_charset or input_encoding or mbstring.input is used. ; The precedence is: default_charset < input_encoding < mbstring.http_input ; https://php.net/mbstring.http-input ;mbstring.http_input = ; Use of this INI entry is deprecated, use global output_encoding instead. ; http output encoding. ; mb_output_handler must be registered as output buffer to function. ; If empty, default_charset or output_encoding or mbstring.http_output is used. ; The precedence is: default_charset < output_encoding < mbstring.http_output ; To use an output encoding conversion, mbstring's output handler must be set ; otherwise output encoding conversion cannot be performed. ; https://php.net/mbstring.http-output ;mbstring.http_output = ; enable automatic encoding translation according to ; mbstring.internal_encoding setting. Input chars are ; converted to internal encoding by setting this to On. ; Note: Do _not_ use automatic encoding translation for ; portable libs/applications. ; https://php.net/mbstring.encoding-translation ;mbstring.encoding_translation = Off ; automatic encoding detection order. ; "auto" detect order is changed according to mbstring.language ; https://php.net/mbstring.detect-order ;mbstring.detect_order = auto ; substitute_character used when character cannot be converted ; one from another ; https://php.net/mbstring.substitute-character ;mbstring.substitute_character = none ; Enable strict encoding detection. ;mbstring.strict_detection = Off ; This directive specifies the regex pattern of content types for which mb_output_handler() ; is activated. ; Default: mbstring.http_output_conv_mimetypes=^(text/|application/xhtml\+xml) ;mbstring.http_output_conv_mimetypes= ; This directive specifies maximum stack depth for mbstring regular expressions. It is similar ; to the pcre.recursion_limit for PCRE. ;mbstring.regex_stack_limit=100000 ; This directive specifies maximum retry count for mbstring regular expressions. It is similar ; to the pcre.backtrack_limit for PCRE. ;mbstring.regex_retry_limit=1000000 [gd] ; Tell the jpeg decode to ignore warnings and try to create ; a gd image. The warning will then be displayed as notices ; disabled by default ; https://php.net/gd.jpeg-ignore-warning ;gd.jpeg_ignore_warning = 1 [exif] ; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS. ; With mbstring support this will automatically be converted into the encoding ; given by corresponding encode setting. When empty mbstring.internal_encoding ; is used. For the decode settings you can distinguish between motorola and ; intel byte order. A decode setting must not be empty. ; https://php.net/exif.encode-unicode ;exif.encode_unicode = ISO-8859-15 ; https://php.net/exif.decode-unicode-motorola ;exif.decode_unicode_motorola = UCS-2BE ; https://php.net/exif.decode-unicode-intel ;exif.decode_unicode_intel = UCS-2LE ; https://php.net/exif.encode-jis ;exif.encode_jis = ; https://php.net/exif.decode-jis-motorola ;exif.decode_jis_motorola = JIS ; https://php.net/exif.decode-jis-intel ;exif.decode_jis_intel = JIS [Tidy] ; The path to a default tidy configuration file to use when using tidy ; https://php.net/tidy.default-config ;tidy.default_config = /usr/local/lib/php/default.tcfg ; Should tidy clean and repair output automatically? ; WARNING: Do not use this option if you are generating non-html content ; such as dynamic images ; https://php.net/tidy.clean-output tidy.clean_output = Off [soap] ; Enables or disables WSDL caching feature. ; https://php.net/soap.wsdl-cache-enabled soap.wsdl_cache_enabled=1 ; Sets the directory name where SOAP extension will put cache files. ; https://php.net/soap.wsdl-cache-dir soap.wsdl_cache_dir="/tmp" ; (time to live) Sets the number of second while cached file will be used ; instead of original one. ; https://php.net/soap.wsdl-cache-ttl soap.wsdl_cache_ttl=86400 ; Sets the size of the cache limit. (Max. number of WSDL files to cache) soap.wsdl_cache_limit = 5 [sysvshm] ; A default size of the shared memory segment ;sysvshm.init_mem = 10000 [ldap] ; Sets the maximum number of open links or -1 for unlimited. ldap.max_links = -1 [dba] ;dba.default_handler= [opcache] ; Determines if Zend OPCache is enabled ;opcache.enable=1 ; Determines if Zend OPCache is enabled for the CLI version of PHP ;opcache.enable_cli=0 ; The OPcache shared memory storage size. ;opcache.memory_consumption=128 ; The amount of memory for interned strings in Mbytes. ;opcache.interned_strings_buffer=8 ; The maximum number of keys (scripts) in the OPcache hash table. ; Only numbers between 200 and 1000000 are allowed. ;opcache.max_accelerated_files=10000 ; The maximum percentage of "wasted" memory until a restart is scheduled. ;opcache.max_wasted_percentage=5 ; When this directive is enabled, the OPcache appends the current working ; directory to the script key, thus eliminating possible collisions between ; files with the same name (basename). Disabling the directive improves ; performance, but may break existing applications. ;opcache.use_cwd=1 ; When disabled, you must reset the OPcache manually or restart the ; webserver for changes to the filesystem to take effect. ;opcache.validate_timestamps=1 ; How often (in seconds) to check file timestamps for changes to the shared ; memory storage allocation. ("1" means validate once per second, but only ; once per request. "0" means always validate) ;opcache.revalidate_freq=2 ; Enables or disables file search in include_path optimization ;opcache.revalidate_path=0 ; If disabled, all PHPDoc comments are dropped from the code to reduce the ; size of the optimized code. ;opcache.save_comments=1 ; If enabled, compilation warnings (including notices and deprecations) will ; be recorded and replayed each time a file is included. Otherwise, compilation ; warnings will only be emitted when the file is first cached. ;opcache.record_warnings=0 ; Allow file existence override (file_exists, etc.) performance feature. ;opcache.enable_file_override=0 ; A bitmask, where each bit enables or disables the appropriate OPcache ; passes ;opcache.optimization_level=0x7FFFBFFF ;opcache.dups_fix=0 ; The location of the OPcache blacklist file (wildcards allowed). ; Each OPcache blacklist file is a text file that holds the names of files ; that should not be accelerated. The file format is to add each filename ; to a new line. The filename may be a full path or just a file prefix ; (i.e., /var/www/x blacklists all the files and directories in /var/www ; that start with 'x'). Line starting with a ; are ignored (comments). ;opcache.blacklist_filename= ; Allows exclusion of large files from being cached. By default all files ; are cached. ;opcache.max_file_size=0 ; How long to wait (in seconds) for a scheduled restart to begin if the cache ; is not being accessed. ;opcache.force_restart_timeout=180 ; OPcache error_log file name. Empty string assumes "stderr". ;opcache.error_log= ; All OPcache errors go to the Web server log. ; By default, only fatal errors (level 0) or errors (level 1) are logged. ; You can also enable warnings (level 2), info messages (level 3) or ; debug messages (level 4). ;opcache.log_verbosity_level=1 ; Preferred Shared Memory back-end. Leave empty and let the system decide. ;opcache.preferred_memory_model= ; Protect the shared memory from unexpected writing during script execution. ; Useful for internal debugging only. ;opcache.protect_memory=0 ; Allows calling OPcache API functions only from PHP scripts which path is ; started from specified string. The default "" means no restriction ;opcache.restrict_api= ; Mapping base of shared memory segments (for Windows only). All the PHP ; processes have to map shared memory into the same address space. This ; directive allows to manually fix the "Unable to reattach to base address" ; errors. ;opcache.mmap_base= ; Facilitates multiple OPcache instances per user (for Windows only). All PHP ; processes with the same cache ID and user share an OPcache instance. ;opcache.cache_id= ; Enables and sets the second level cache directory. ; It should improve performance when SHM memory is full, at server restart or ; SHM reset. The default "" disables file based caching. ;opcache.file_cache= ; Enables or disables read-only mode for the second level cache directory. ; It should improve performance for read-only containers, ; when the cache is pre-warmed and packaged alongside the application. ; Best used with `opcache.validate_timestamps=0`, `opcache.enable_file_override=1` ; and `opcache.file_cache_consistency_checks=0`. ; Note: A cache generated with a different build of PHP, a different file path, ; or different settings (including which extensions are loaded), may be ignored. ;opcache.file_cache_read_only=0 ; Enables or disables opcode caching in shared memory. ;opcache.file_cache_only=0 ; Enables or disables checksum validation when script loaded from file cache. ;opcache.file_cache_consistency_checks=1 ; Implies opcache.file_cache_only=1 for a certain process that failed to ; reattach to the shared memory (for Windows only). Explicitly enabled file ; cache is required. ;opcache.file_cache_fallback=1 ; Enables or disables copying of PHP code (text segment) into HUGE PAGES. ; Under certain circumstances (if only a single global PHP process is ; started from which all others fork), this can increase performance ; by a tiny amount because TLB misses are reduced. On the other hand, this ; delays PHP startup, increases memory usage and degrades performance ; under memory pressure - use with care. ; Requires appropriate OS configuration. ;opcache.huge_code_pages=0 ; Validate cached file permissions. ;opcache.validate_permission=0 ; Prevent name collisions in chroot'ed environment. ;opcache.validate_root=0 ; If specified, it produces opcode dumps for debugging different stages of ; optimizations. ;opcache.opt_debug_level=0 ; Specifies a PHP script that is going to be compiled and executed at server ; start-up. ; https://php.net/opcache.preload ;opcache.preload= ; Preloading code as root is not allowed for security reasons. This directive ; facilitates to let the preloading to be run as another user. ; https://php.net/opcache.preload_user ;opcache.preload_user= ; Prevents caching files that are less than this number of seconds old. It ; protects from caching of incompletely updated files. In case all file updates ; on your site are atomic, you may increase performance by setting it to "0". ;opcache.file_update_protection=2 ; Absolute path used to store shared lockfiles (for *nix only). ;opcache.lockfile_path=/tmp [curl] ; A default value for the CURLOPT_CAINFO option. This is required to be an ; absolute path. ;curl.cainfo = [openssl] ; The location of a Certificate Authority (CA) file on the local filesystem ; to use when verifying the identity of SSL/TLS peers. Most users should ; not specify a value for this directive as PHP will attempt to use the ; OS-managed cert stores in its absence. If specified, this value may still ; be overridden on a per-stream basis via the "cafile" SSL stream context ; option. ;openssl.cafile= ; If openssl.cafile is not specified or if the CA file is not found, the ; directory pointed to by openssl.capath is searched for a suitable ; certificate. This value must be a correctly hashed certificate directory. ; Most users should not specify a value for this directive as PHP will ; attempt to use the OS-managed cert stores in its absence. If specified, ; this value may still be overridden on a per-stream basis via the "capath" ; SSL stream context option. ;openssl.capath= ; The libctx is an OpenSSL library context. OpenSSL defines a default library ; context, but PHP OpenSSL also defines its own library context to avoid ; interference with other libraries using OpenSSL and to provide an independent ; context for each thread in ZTS. Possible values: ; "custom" - use a custom library context (default) ; "default" - use the default OpenSSL library context ;openssl.libctx=custom [ffi] ; FFI API restriction. Possible values: ; "preload" - enabled in CLI scripts and preloaded files (default) ; "false" - always disabled ; "true" - always enabled ;ffi.enable=preload ; List of headers files to preload, wildcard patterns allowed. ;ffi.preload= [Zend] ;zend_extension="/usr/local/ioncube/ioncube_loader_lin_8.5.so" ; fix for segfaults auto_globals_jit = Off cgi.fix_pathinfo = 1 mbstring.http_input = "pass" mbstring.http_output = "pass" mbstring.encoding_translation = 0 ; Enable Extensions extension=uploadprogress.so extension=imagick.so extension=redis.so ; APCu extension=apcu.so apc.enable_cli=1 apc.gc_ttl=300 apc.shm_segments=1 apc.shm_size=256M apc.slam_defense=0 apc.ttl=0 ; ================================================ FILE: aegir/conf/redis/redis-server ================================================ #!/bin/bash ### BEGIN INIT INFO # Provides: redis-server # Required-Start: $syslog $remote_fs # Required-Stop: $syslog $remote_fs # Should-Start: $local_fs # Should-Stop: $local_fs # Default-Start: 2 3 4 5 # Default-Stop: 0 1 6 # Short-Description: redis-server - Persistent key-value db # Description: redis-server - Persistent key-value db ### END INIT INFO PATH=/usr/local/bin:/usr/local/sbin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin:/usr/libexec DAEMON=/usr/bin/redis-server DAEMON_ARGS=/etc/redis/redis.conf NAME=redis-server DESC=redis-server PIDFILE=/run/redis/redis.pid test -x $DAEMON || exit 0 [ -d /run/redis ] || mkdir -p /run/redis [ -d /run/redis ] && chown -R redis:redis /run/redis maxclients=$(awk '/^[ \t]*maxclients[ \t]/ { print $2 }' /etc/redis/redis.conf) if [ ! -z "$maxclients" ] && [ "$maxclients" -gt 992 ]; then ulimit -n $((maxclients+32)) fi case "$1" in start) echo -n "Starting $DESC: " touch $PIDFILE chown redis:redis $PIDFILE if start-stop-daemon --start --quiet --umask 007 --pidfile $PIDFILE --chuid redis:redis --exec $DAEMON -- $DAEMON_ARGS then echo "$NAME." else echo "failed" fi ;; stop) echo -n "Stopping $DESC: " if start-stop-daemon --stop --retry 8 --quiet --oknodo --pidfile $PIDFILE --exec $DAEMON then echo "$NAME." else echo "failed" fi rm -f $PIDFILE sleep 1 ;; restart|force-reload) ${0} stop ${0} start ;; reload) echo -n "Reloading service ${NAME}..." if [ ! -r ${PIDFILE} ]; then echo "warning, no pid file found - ${NAME} is not running ?" exit 1 fi kill -USR2 `cat ${PIDFILE}` echo " done" ;; status) echo -n "$DESC is " if start-stop-daemon --stop --quiet --signal 0 --name ${NAME} --pidfile ${PIDFILE} then echo "running" else echo "not running" exit 1 fi ;; *) echo "Usage: service $NAME {start|stop|restart|reload|force-reload}" >&2 exit 1 ;; esac exit 0 ================================================ FILE: aegir/conf/redis/redis.conf ================================================ # Redis configuration file example. # # Note that in order to read the configuration file, Redis must be # started with the file path as first argument: # # ./redis-server /path/to/redis.conf # Note on units: when memory size is needed, it is possible to specify # it in the usual form of 1k 5GB 4M and so forth: # # 1k => 1000 bytes # 1kb => 1024 bytes # 1m => 1000000 bytes # 1mb => 1024*1024 bytes # 1g => 1000000000 bytes # 1gb => 1024*1024*1024 bytes # # units are case insensitive so 1GB 1Gb 1gB are all the same. ################################## INCLUDES ################################### # Include one or more other config files here. This is useful if you # have a standard template that goes to all Redis servers but also need # to customize a few per-server settings. Include files can include # other files, so use this wisely. # # Notice option "include" won't be rewritten by command "CONFIG REWRITE" # from admin or Redis Sentinel. Since Redis always uses the last processed # line as value of a configuration directive, you'd better put includes # at the beginning of this file to avoid overwriting config change at runtime. # # If instead you are interested in using includes to override configuration # options, it is better to use include as the last line. # # include /path/to/local.conf # include /path/to/other.conf ################################## MODULES ##################################### # Load modules at startup. If the server is not able to load modules # it will abort. It is possible to use multiple loadmodule directives. # # loadmodule /path/to/my_module.so # loadmodule /path/to/other_module.so ################################## NETWORK ##################################### # By default, if no "bind" configuration directive is specified, Redis listens # for connections from all the network interfaces available on the server. # It is possible to listen to just one or multiple selected interfaces using # the "bind" configuration directive, followed by one or more IP addresses. # # Examples: # # xbind 192.168.1.100 10.0.0.1 # xbind 127.0.0.1 ::1 # # ~~~ WARNING ~~~ If the computer running Redis is directly exposed to the # internet, binding to all the interfaces is dangerous and will expose the # instance to everybody on the internet. So by default we uncomment the # following bind directive, that will force Redis to listen only into # the IPv4 lookback interface address (this means Redis will be able to # accept connections only from clients running into the same computer it # is running). # # IF YOU ARE SURE YOU WANT YOUR INSTANCE TO LISTEN TO ALL THE INTERFACES # JUST COMMENT THE FOLLOWING LINE. # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ bind 127.0.0.1 # Protected mode is a layer of security protection, in order to avoid that # Redis instances left open on the internet are accessed and exploited. # # When protected mode is on and if: # # 1) The server is not binding explicitly to a set of addresses using the # "bind" directive. # 2) No password is configured. # # The server only accepts connections from clients connecting from the # IPv4 and IPv6 loopback addresses 127.0.0.1 and ::1, and from Unix domain # sockets. # # By default protected mode is enabled. You should disable it only if # you are sure you want clients from other hosts to connect to Redis # even if no authentication is configured, nor a specific set of interfaces # are explicitly listed using the "bind" directive. protected-mode no # Accept connections on the specified port, default is 6379 (IANA #815344). # If port 0 is specified Redis will not listen on a TCP socket. port 6379 # TCP listen() backlog. # # In high requests-per-second environments you need an high backlog in order # to avoid slow clients connections issues. Note that the Linux kernel # will silently truncate it to the value of /proc/sys/net/core/somaxconn so # make sure to raise both the value of somaxconn and tcp_max_syn_backlog # in order to get the desired effect. tcp-backlog 511 # Unix socket. # # Specify the path for the Unix socket that will be used to listen for # incoming connections. There is no default, so Redis will not listen # on a unix socket when not specified. # # unixsocket /run/redis/redis.sock # unixsocketperm 777 # Close the connection after a client is idle for N seconds (0 to disable) timeout 3600 # TCP keepalive. # # If non-zero, use SO_KEEPALIVE to send TCP ACKs to clients in absence # of communication. This is useful for two reasons: # # 1) Detect dead peers. # 2) Take the connection alive from the point of view of network # equipment in the middle. # # On Linux, the specified value (in seconds) is the period used to send ACKs. # Note that to close the connection the double of the time is needed. # On other kernels the period depends on the kernel configuration. # # A reasonable value for this option is 300 seconds, which is the new # Redis default starting with Redis 3.2.1. tcp-keepalive 300 ################################# GENERAL ##################################### # By default Redis does not run as a daemon. Use 'yes' if you need it. # Note that Redis will write a pid file in /run/redis.pid when daemonized. daemonize yes # If you run Redis from upstart or systemd, Redis can interact with your # supervision tree. Options: # supervised no - no supervision interaction # supervised upstart - signal upstart by putting Redis into SIGSTOP mode # supervised systemd - signal systemd by writing READY=1 to $NOTIFY_SOCKET # supervised auto - detect upstart or systemd method based on # UPSTART_JOB or NOTIFY_SOCKET environment variables # Note: these supervision methods only signal "process is ready." # They do not enable continuous liveness pings back to your supervisor. supervised no # If a pid file is specified, Redis writes it where specified at startup # and removes it at exit. # # When the server runs non daemonized, no pid file is created if none is # specified in the configuration. When the server is daemonized, the pid file # is used even if not specified, defaulting to "/run/redis.pid". # # Creating a pid file is best effort: if Redis is not able to create it # nothing bad happens, the server will start and run normally. pidfile /run/redis/redis.pid # Specify the server verbosity level. # This can be one of: # debug (a lot of information, useful for development/testing) # verbose (many rarely useful info, but not a mess like the debug level) # notice (moderately verbose, what you want in production probably) # warning (only very important / critical messages are logged) loglevel warning # Specify the log file name. Also the empty string can be used to force # Redis to log on the standard output. Note that if you use standard # output for logging but daemonize, logs will be sent to /dev/null logfile /var/log/redis/redis-server.log # To enable logging to the system logger, just set 'syslog-enabled' to yes, # and optionally update the other syslog parameters to suit your needs. # syslog-enabled no # Specify the syslog identity. # syslog-ident redis # Specify the syslog facility. Must be USER or between LOCAL0-LOCAL7. # syslog-facility local0 # Set the number of databases. The default database is DB 0, you can select # a different one on a per-connection basis using SELECT where # dbid is a number between 0 and 'databases'-1 databases 8 # By default Redis shows an ASCII art logo only when started to log to the # standard output and if the standard output is a TTY. Basically this means # that normally a logo is displayed only in interactive sessions. # # However it is possible to force the pre-4.0 behavior and always show a # ASCII art logo in startup logs by setting the following option to yes. always-show-logo yes ################################ SNAPSHOTTING ################################ # # Save the DB on disk: # # save # # Will save the DB if both the given number of seconds and the given # number of write operations against the DB occurred. # # In the example below the behaviour will be to save: # after 900 sec (15 min) if at least 1 key changed # after 300 sec (5 min) if at least 10 keys changed # after 60 sec if at least 10000 keys changed # # Note: you can disable saving completely by commenting out all "save" lines. # # It is also possible to remove all the previously configured save # points by adding a save directive with a single empty string argument # like in the following example: # # save "" # save 900 1 # save 300 10 # save 60 10000 # By default Redis will stop accepting writes if RDB snapshots are enabled # (at least one save point) and the latest background save failed. # This will make the user aware (in a hard way) that data is not persisting # on disk properly, otherwise chances are that no one will notice and some # disaster will happen. # # If the background saving process will start working again Redis will # automatically allow writes again. # # However if you have setup your proper monitoring of the Redis server # and persistence, you may want to disable this feature so that Redis will # continue to work as usual even if there are problems with disk, # permissions, and so forth. stop-writes-on-bgsave-error no # Compress string objects using LZF when dump .rdb databases? # For default that's set to 'yes' as it's almost always a win. # If you want to save some CPU in the saving child set it to 'no' but # the dataset will likely be bigger if you have compressible values or keys. rdbcompression yes # Since version 5 of RDB a CRC64 checksum is placed at the end of the file. # This makes the format more resistant to corruption but there is a performance # hit to pay (around 10%) when saving and loading RDB files, so you can disable it # for maximum performances. # # RDB files created with checksum disabled have a checksum of zero that will # tell the loading code to skip the check. rdbchecksum no # The filename where to dump the DB dbfilename dump.rdb # The working directory. # # The DB will be written inside this directory, with the filename specified # above using the 'dbfilename' configuration directive. # # The Append Only File will also be created inside this directory. # # Note that you must specify a directory here, not a file name. dir /var/lib/redis/ ################################# REPLICATION ################################# # Master-Slave replication. Use slaveof to make a Redis instance a copy of # another Redis server. A few things to understand ASAP about Redis replication. # # 1) Redis replication is asynchronous, but you can configure a master to # stop accepting writes if it appears to be not connected with at least # a given number of slaves. # 2) Redis slaves are able to perform a partial resynchronization with the # master if the replication link is lost for a relatively small amount of # time. You may want to configure the replication backlog size (see the next # sections of this file) with a sensible value depending on your needs. # 3) Replication is automatic and does not need user intervention. After a # network partition slaves automatically try to reconnect to masters # and resynchronize with them. # # slaveof # If the master is password protected (using the "requirepass" configuration # directive below) it is possible to tell the slave to authenticate before # starting the replication synchronization process, otherwise the master will # refuse the slave request. # # masterauth # When a slave loses its connection with the master, or when the replication # is still in progress, the slave can act in two different ways: # # 1) if slave-serve-stale-data is set to 'yes' (the default) the slave will # still reply to client requests, possibly with out of date data, or the # data set may just be empty if this is the first synchronization. # # 2) if slave-serve-stale-data is set to 'no' the slave will reply with # an error "SYNC with master in progress" to all the kind of commands # but to INFO and SLAVEOF. # slave-serve-stale-data yes # You can configure a slave instance to accept writes or not. Writing against # a slave instance may be useful to store some ephemeral data (because data # written on a slave will be easily deleted after resync with the master) but # may also cause problems if clients are writing to it because of a # misconfiguration. # # Since Redis 2.6 by default slaves are read-only. # # Note: read only slaves are not designed to be exposed to untrusted clients # on the internet. It's just a protection layer against misuse of the instance. # Still a read only slave exports by default all the administrative commands # such as CONFIG, DEBUG, and so forth. To a limited extent you can improve # security of read only slaves using 'rename-command' to shadow all the # administrative / dangerous commands. slave-read-only yes # Replication SYNC strategy: disk or socket. # # ------------------------------------------------------- # WARNING: DISKLESS REPLICATION IS EXPERIMENTAL CURRENTLY # ------------------------------------------------------- # # New slaves and reconnecting slaves that are not able to continue the replication # process just receiving differences, need to do what is called a "full # synchronization". An RDB file is transmitted from the master to the slaves. # The transmission can happen in two different ways: # # 1) Disk-backed: The Redis master creates a new process that writes the RDB # file on disk. Later the file is transferred by the parent # process to the slaves incrementally. # 2) Diskless: The Redis master creates a new process that directly writes the # RDB file to slave sockets, without touching the disk at all. # # With disk-backed replication, while the RDB file is generated, more slaves # can be queued and served with the RDB file as soon as the current child producing # the RDB file finishes its work. With diskless replication instead once # the transfer starts, new slaves arriving will be queued and a new transfer # will start when the current one terminates. # # When diskless replication is used, the master waits a configurable amount of # time (in seconds) before starting the transfer in the hope that multiple slaves # will arrive and the transfer can be parallelized. # # With slow disks and fast (large bandwidth) networks, diskless replication # works better. repl-diskless-sync no # When diskless replication is enabled, it is possible to configure the delay # the server waits in order to spawn the child that transfers the RDB via socket # to the slaves. # # This is important since once the transfer starts, it is not possible to serve # new slaves arriving, that will be queued for the next RDB transfer, so the server # waits a delay in order to let more slaves arrive. # # The delay is specified in seconds, and by default is 5 seconds. To disable # it entirely just set it to 0 seconds and the transfer will start ASAP. repl-diskless-sync-delay 5 # Slaves send PINGs to server in a predefined interval. It's possible to change # this interval with the repl_ping_slave_period option. The default value is 10 # seconds. # # repl-ping-slave-period 10 # The following option sets the replication timeout for: # # 1) Bulk transfer I/O during SYNC, from the point of view of slave. # 2) Master timeout from the point of view of slaves (data, pings). # 3) Slave timeout from the point of view of masters (REPLCONF ACK pings). # # It is important to make sure that this value is greater than the value # specified for repl-ping-slave-period otherwise a timeout will be detected # every time there is low traffic between the master and the slave. # # repl-timeout 60 # Disable TCP_NODELAY on the slave socket after SYNC? # # If you select "yes" Redis will use a smaller number of TCP packets and # less bandwidth to send data to slaves. But this can add a delay for # the data to appear on the slave side, up to 40 milliseconds with # Linux kernels using a default configuration. # # If you select "no" the delay for data to appear on the slave side will # be reduced but more bandwidth will be used for replication. # # By default we optimize for low latency, but in very high traffic conditions # or when the master and slaves are many hops away, turning this to "yes" may # be a good idea. repl-disable-tcp-nodelay no # Set the replication backlog size. The backlog is a buffer that accumulates # slave data when slaves are disconnected for some time, so that when a slave # wants to reconnect again, often a full resync is not needed, but a partial # resync is enough, just passing the portion of data the slave missed while # disconnected. # # The bigger the replication backlog, the longer the time the slave can be # disconnected and later be able to perform a partial resynchronization. # # The backlog is only allocated once there is at least a slave connected. # # repl-backlog-size 1mb # After a master has no longer connected slaves for some time, the backlog # will be freed. The following option configures the amount of seconds that # need to elapse, starting from the time the last slave disconnected, for # the backlog buffer to be freed. # # Note that slaves never free the backlog for timeout, since they may be # promoted to masters later, and should be able to correctly "partially # resynchronize" with the slaves: hence they should always accumulate backlog. # # A value of 0 means to never release the backlog. # # repl-backlog-ttl 3600 # The slave priority is an integer number published by Redis in the INFO output. # It is used by Redis Sentinel in order to select a slave to promote into a # master if the master is no longer working correctly. # # A slave with a low priority number is considered better for promotion, so # for instance if there are three slaves with priority 10, 100, 25 Sentinel will # pick the one with priority 10, that is the lowest. # # However a special priority of 0 marks the slave as not able to perform the # role of master, so a slave with priority of 0 will never be selected by # Redis Sentinel for promotion. # # By default the priority is 100. slave-priority 100 # It is possible for a master to stop accepting writes if there are less than # N slaves connected, having a lag less or equal than M seconds. # # The N slaves need to be in "online" state. # # The lag in seconds, that must be <= the specified value, is calculated from # the last ping received from the slave, that is usually sent every second. # # This option does not GUARANTEE that N replicas will accept the write, but # will limit the window of exposure for lost writes in case not enough slaves # are available, to the specified number of seconds. # # For example to require at least 3 slaves with a lag <= 10 seconds use: # # min-slaves-to-write 3 # min-slaves-max-lag 10 # # Setting one or the other to 0 disables the feature. # # By default min-slaves-to-write is set to 0 (feature disabled) and # min-slaves-max-lag is set to 10. # A Redis master is able to list the address and port of the attached # slaves in different ways. For example the "INFO replication" section # offers this information, which is used, among other tools, by # Redis Sentinel in order to discover slave instances. # Another place where this info is available is in the output of the # "ROLE" command of a master. # # The listed IP and address normally reported by a slave is obtained # in the following way: # # IP: The address is auto detected by checking the peer address # of the socket used by the slave to connect with the master. # # Port: The port is communicated by the slave during the replication # handshake, and is normally the port that the slave is using to # list for connections. # # However when port forwarding or Network Address Translation (NAT) is # used, the slave may be actually reachable via different IP and port # pairs. The following two options can be used by a slave in order to # report to its master a specific set of IP and port, so that both INFO # and ROLE will report those values. # # There is no need to use both the options if you need to override just # the port or the IP address. # # slave-announce-ip 5.5.5.5 # slave-announce-port 1234 ################################## SECURITY ################################### # Require clients to issue AUTH before processing any other # commands. This might be useful in environments in which you do not trust # others with access to the host running redis-server. # # This should stay commented out for backward compatibility and because most # people do not need auth (e.g. they run their own servers). # # Warning: since Redis is pretty fast an outside user can try up to # 150k passwords per second against a good box. This means that you should # use a very strong password otherwise it will be very easy to break. # # requirepass isfoobared # Command renaming. # # It is possible to change the name of dangerous commands in a shared # environment. For instance the CONFIG command may be renamed into something # hard to guess so that it will still be available for internal-use tools # but not available for general clients. # # Example: # # rename-command CONFIG b840fc02d524045429941cc15f59e41cb7be6c52 # # It is also possible to completely kill a command by renaming it into # an empty string: # # rename-command CONFIG "" # # Please note that changing the name of commands that are logged into the # AOF file or transmitted to slaves may cause problems. ################################### CLIENTS #################################### # Set the max number of connected clients at the same time. By default # this limit is set to 10000 clients, however if the Redis server is not # able to configure the process file limit to allow for the specified limit # the max number of allowed clients is set to the current file limit # minus 32 (as Redis reserves a few file descriptors for internal uses). # # Once the limit is reached Redis will close all the new connections sending # an error 'max number of clients reached'. # maxclients 4000 ############################## MEMORY MANAGEMENT ################################ # Set a memory usage limit to the specified amount of bytes. # When the memory limit is reached Redis will try to remove keys # according to the eviction policy selected (see maxmemory-policy). # # If Redis can't remove keys according to the policy, or if the policy is # set to 'noeviction', Redis will start to reply with errors to commands # that would use more memory, like SET, LPUSH, and so on, and will continue # to reply to read-only commands like GET. # # This option is usually useful when using Redis as an LRU or LFU cache, or to # set a hard memory limit for an instance (using the 'noeviction' policy). # # WARNING: If you have slaves attached to an instance with maxmemory on, # the size of the output buffers needed to feed the slaves are subtracted # from the used memory count, so that network problems / resyncs will # not trigger a loop where keys are evicted, and in turn the output # buffer of slaves is full with DELs of keys evicted triggering the deletion # of more keys, and so forth until the database is completely emptied. # # In short... if you have slaves attached it is suggested that you set a lower # limit for maxmemory so that there is some free RAM on the system for slave # output buffers (but this is not needed if the policy is 'noeviction'). # maxmemory 88MB # MAXMEMORY POLICY: how Redis will select what to remove when maxmemory # is reached. You can select among five behaviors: # # volatile-lru -> Evict using approximated LRU among the keys with an expire set. # allkeys-lru -> Evict any key using approximated LRU. # volatile-lfu -> Evict using approximated LFU among the keys with an expire set. # allkeys-lfu -> Evict any key using approximated LFU. # volatile-random -> Remove a random key among the ones with an expire set. # allkeys-random -> Remove a random key, any key. # volatile-ttl -> Remove the key with the nearest expire time (minor TTL) # noeviction -> Don't evict anything, just return an error on write operations. # # LRU means Least Recently Used # LFU means Least Frequently Used # # Both LRU, LFU and volatile-ttl are implemented using approximated # randomized algorithms. # # Note: with any of the above policies, Redis will return an error on write # operations, when there are no suitable keys for eviction. # # At the date of writing these commands are: set setnx setex append # incr decr rpush lpush rpushx lpushx linsert lset rpoplpush sadd # sinter sinterstore sunion sunionstore sdiff sdiffstore zadd zincrby # zunionstore zinterstore hset hsetnx hmset hincrby incrby decrby # getset mset msetnx exec sort # # The default is: noeviction # maxmemory-policy allkeys-lru # LRU, LFU and minimal TTL algorithms are not precise algorithms but approximated # algorithms (in order to save memory), so you can tune it for speed or # accuracy. For default Redis will check five keys and pick the one that was # used less recently, you can change the sample size using the following # configuration directive. # # The default of 5 produces good enough results. 10 Approximates very closely # true LRU but costs more CPU. 3 is faster but not very accurate. # # maxmemory-samples 5 ############################# LAZY FREEING #################################### # Redis has two primitives to delete keys. One is called DEL and is a blocking # deletion of the object. It means that the server stops processing new commands # in order to reclaim all the memory associated with an object in a synchronous # way. If the key deleted is associated with a small object, the time needed # in order to execute the DEL command is very small and comparable to most other # O(1) or O(log_N) commands in Redis. However if the key is associated with an # aggregated value containing millions of elements, the server can block for # a long time (even seconds) in order to complete the operation. # # For the above reasons Redis also offers non blocking deletion primitives # such as UNLINK (non blocking DEL) and the ASYNC option of FLUSHALL and # FLUSHDB commands, in order to reclaim memory in background. Those commands # are executed in constant time. Another thread will incrementally free the # object in the background as fast as possible. # # DEL, UNLINK and ASYNC option of FLUSHALL and FLUSHDB are user-controlled. # It's up to the design of the application to understand when it is a good # idea to use one or the other. However the Redis server sometimes has to # delete keys or flush the whole database as a side effect of other operations. # Specifically Redis deletes objects independently of a user call in the # following scenarios: # # 1) On eviction, because of the maxmemory and maxmemory policy configurations, # in order to make room for new data, without going over the specified # memory limit. # 2) Because of expire: when a key with an associated time to live (see the # EXPIRE command) must be deleted from memory. # 3) Because of a side effect of a command that stores data on a key that may # already exist. For example the RENAME command may delete the old key # content when it is replaced with another one. Similarly SUNIONSTORE # or SORT with STORE option may delete existing keys. The SET command # itself removes any old content of the specified key in order to replace # it with the specified string. # 4) During replication, when a slave performs a full resynchronization with # its master, the content of the whole database is removed in order to # load the RDB file just transfered. # # In all the above cases the default is to delete objects in a blocking way, # like if DEL was called. However you can configure each case specifically # in order to instead release memory in a non-blocking way like if UNLINK # was called, using the following configuration directives: lazyfree-lazy-eviction yes lazyfree-lazy-expire yes lazyfree-lazy-server-del yes slave-lazy-flush yes ############################## APPEND ONLY MODE ############################### # By default Redis asynchronously dumps the dataset on disk. This mode is # good enough in many applications, but an issue with the Redis process or # a power outage may result into a few minutes of writes lost (depending on # the configured save points). # # The Append Only File is an alternative persistence mode that provides # much better durability. For instance using the default data fsync policy # (see later in the config file) Redis can lose just one second of writes in a # dramatic event like a server power outage, or a single write if something # wrong with the Redis process itself happens, but the operating system is # still running correctly. # # AOF and RDB persistence can be enabled at the same time without problems. # If the AOF is enabled on startup Redis will load the AOF, that is the file # with the better durability guarantees. # # Please check http://redis.io/topics/persistence for more information. appendonly no # The name of the append only file (default: "appendonly.aof") appendfilename "appendonly.aof" # The fsync() call tells the Operating System to actually write data on disk # instead of waiting for more data in the output buffer. Some OS will really flush # data on disk, some other OS will just try to do it ASAP. # # Redis supports three different modes: # # no: don't fsync, just let the OS flush the data when it wants. Faster. # always: fsync after every write to the append only log. Slow, Safest. # everysec: fsync only one time every second. Compromise. # # The default is "everysec", as that's usually the right compromise between # speed and data safety. It's up to you to understand if you can relax this to # "no" that will let the operating system flush the output buffer when # it wants, for better performances (but if you can live with the idea of # some data loss consider the default persistence mode that's snapshotting), # or on the contrary, use "always" that's very slow but a bit safer than # everysec. # # More details please check the following article: # http://antirez.com/post/redis-persistence-demystified.html # # If unsure, use "everysec". # appendfsync always appendfsync everysec # appendfsync no # When the AOF fsync policy is set to always or everysec, and a background # saving process (a background save or AOF log background rewriting) is # performing a lot of I/O against the disk, in some Linux configurations # Redis may block too long on the fsync() call. Note that there is no fix for # this currently, as even performing fsync in a different thread will block # our synchronous write(2) call. # # In order to mitigate this problem it's possible to use the following option # that will prevent fsync() from being called in the main process while a # BGSAVE or BGREWRITEAOF is in progress. # # This means that while another child is saving, the durability of Redis is # the same as "appendfsync none". In practical terms, this means that it is # possible to lose up to 30 seconds of log in the worst scenario (with the # default Linux settings). # # If you have latency problems turn this to "yes". Otherwise leave it as # "no" that is the safest pick from the point of view of durability. no-appendfsync-on-rewrite no # Automatic rewrite of the append only file. # Redis is able to automatically rewrite the log file implicitly calling # BGREWRITEAOF when the AOF log size grows by the specified percentage. # # This is how it works: Redis remembers the size of the AOF file after the # latest rewrite (if no rewrite has happened since the restart, the size of # the AOF at startup is used). # # This base size is compared to the current size. If the current size is # bigger than the specified percentage, the rewrite is triggered. Also # you need to specify a minimal size for the AOF file to be rewritten, this # is useful to avoid rewriting the AOF file even if the percentage increase # is reached but it is still pretty small. # # Specify a percentage of zero in order to disable the automatic AOF # rewrite feature. auto-aof-rewrite-percentage 100 auto-aof-rewrite-min-size 64mb # An AOF file may be found to be truncated at the end during the Redis # startup process, when the AOF data gets loaded back into memory. # This may happen when the system where Redis is running # crashes, especially when an ext4 filesystem is mounted without the # data=ordered option (however this can't happen when Redis itself # crashes or aborts but the operating system still works correctly). # # Redis can either exit with an error when this happens, or load as much # data as possible (the default now) and start if the AOF file is found # to be truncated at the end. The following option controls this behavior. # # If aof-load-truncated is set to yes, a truncated AOF file is loaded and # the Redis server starts emitting a log to inform the user of the event. # Otherwise if the option is set to no, the server aborts with an error # and refuses to start. When the option is set to no, the user requires # to fix the AOF file using the "redis-check-aof" utility before to restart # the server. # # Note that if the AOF file will be found to be corrupted in the middle # the server will still exit with an error. This option only applies when # Redis will try to read more data from the AOF file but not enough bytes # will be found. aof-load-truncated yes # When rewriting the AOF file, Redis is able to use an RDB preamble in the # AOF file for faster rewrites and recoveries. When this option is turned # on the rewritten AOF file is composed of two different stanzas: # # [RDB file][AOF tail] # # When loading Redis recognizes that the AOF file starts with the "REDIS" # string and loads the prefixed RDB file, and continues loading the AOF # tail. # # This is currently turned off by default in order to avoid the surprise # of a format change, but will at some point be used as the default. aof-use-rdb-preamble no ################################ LUA SCRIPTING ############################### # Max execution time of a Lua script in milliseconds. # # If the maximum execution time is reached Redis will log that a script is # still in execution after the maximum allowed time and will start to # reply to queries with an error. # # When a long running script exceeds the maximum execution time only the # SCRIPT KILL and SHUTDOWN NOSAVE commands are available. The first can be # used to stop a script that did not yet called write commands. The second # is the only way to shut down the server in the case a write command was # already issued by the script but the user doesn't want to wait for the natural # termination of the script. # # Set it to 0 or a negative value for unlimited execution without warnings. lua-time-limit 5000 ################################ REDIS CLUSTER ############################### # # ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ # WARNING EXPERIMENTAL: Redis Cluster is considered to be stable code, however # in order to mark it as "mature" we need to wait for a non trivial percentage # of users to deploy it in production. # ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ # # Normal Redis instances can't be part of a Redis Cluster; only nodes that are # started as cluster nodes can. In order to start a Redis instance as a # cluster node enable the cluster support uncommenting the following: # # cluster-enabled yes # Every cluster node has a cluster configuration file. This file is not # intended to be edited by hand. It is created and updated by Redis nodes. # Every Redis Cluster node requires a different cluster configuration file. # Make sure that instances running in the same system do not have # overlapping cluster configuration file names. # # cluster-config-file nodes-6379.conf # Cluster node timeout is the amount of milliseconds a node must be unreachable # for it to be considered in failure state. # Most other internal time limits are multiple of the node timeout. # # cluster-node-timeout 15000 # A slave of a failing master will avoid to start a failover if its data # looks too old. # # There is no simple way for a slave to actually have an exact measure of # its "data age", so the following two checks are performed: # # 1) If there are multiple slaves able to failover, they exchange messages # in order to try to give an advantage to the slave with the best # replication offset (more data from the master processed). # Slaves will try to get their rank by offset, and apply to the start # of the failover a delay proportional to their rank. # # 2) Every single slave computes the time of the last interaction with # its master. This can be the last ping or command received (if the master # is still in the "connected" state), or the time that elapsed since the # disconnection with the master (if the replication link is currently down). # If the last interaction is too old, the slave will not try to failover # at all. # # The point "2" can be tuned by user. Specifically a slave will not perform # the failover if, since the last interaction with the master, the time # elapsed is greater than: # # (node-timeout * slave-validity-factor) + repl-ping-slave-period # # So for example if node-timeout is 30 seconds, and the slave-validity-factor # is 10, and assuming a default repl-ping-slave-period of 10 seconds, the # slave will not try to failover if it was not able to talk with the master # for longer than 310 seconds. # # A large slave-validity-factor may allow slaves with too old data to failover # a master, while a too small value may prevent the cluster from being able to # elect a slave at all. # # For maximum availability, it is possible to set the slave-validity-factor # to a value of 0, which means, that slaves will always try to failover the # master regardless of the last time they interacted with the master. # (However they'll always try to apply a delay proportional to their # offset rank). # # Zero is the only value able to guarantee that when all the partitions heal # the cluster will always be able to continue. # # cluster-slave-validity-factor 10 # Cluster slaves are able to migrate to orphaned masters, that are masters # that are left without working slaves. This improves the cluster ability # to resist to failures as otherwise an orphaned master can't be failed over # in case of failure if it has no working slaves. # # Slaves migrate to orphaned masters only if there are still at least a # given number of other working slaves for their old master. This number # is the "migration barrier". A migration barrier of 1 means that a slave # will migrate only if there is at least 1 other working slave for its master # and so forth. It usually reflects the number of slaves you want for every # master in your cluster. # # Default is 1 (slaves migrate only if their masters remain with at least # one slave). To disable migration just set it to a very large value. # A value of 0 can be set but is useful only for debugging and dangerous # in production. # # cluster-migration-barrier 1 # By default Redis Cluster nodes stop accepting queries if they detect there # is at least an hash slot uncovered (no available node is serving it). # This way if the cluster is partially down (for example a range of hash slots # are no longer covered) all the cluster becomes, eventually, unavailable. # It automatically returns available as soon as all the slots are covered again. # # However sometimes you want the subset of the cluster which is working, # to continue to accept queries for the part of the key space that is still # covered. In order to do so, just set the cluster-require-full-coverage # option to no. # # cluster-require-full-coverage yes # This option, when set to yes, prevents slaves from trying to failover its # master during master failures. However the master can still perform a # manual failover, if forced to do so. # # This is useful in different scenarios, especially in the case of multiple # data center operations, where we want one side to never be promoted if not # in the case of a total DC failure. # # cluster-slave-no-failover no # In order to setup your cluster make sure to read the documentation # available at http://redis.io web site. ########################## CLUSTER DOCKER/NAT support ######################## # In certain deployments, Redis Cluster nodes address discovery fails, because # addresses are NAT-ted or because ports are forwarded (the typical case is # Docker and other containers). # # In order to make Redis Cluster working in such environments, a static # configuration where each node knows its public address is needed. The # following two options are used for this scope, and are: # # * cluster-announce-ip # * cluster-announce-port # * cluster-announce-bus-port # # Each instruct the node about its address, client port, and cluster message # bus port. The information is then published in the header of the bus packets # so that other nodes will be able to correctly map the address of the node # publishing the information. # # If the above options are not used, the normal Redis Cluster auto-detection # will be used instead. # # Note that when remapped, the bus port may not be at the fixed offset of # clients port + 10000, so you can specify any port and bus-port depending # on how they get remapped. If the bus-port is not set, a fixed offset of # 10000 will be used as usually. # # Example: # # cluster-announce-ip 10.1.1.5 # cluster-announce-port 6379 # cluster-announce-bus-port 6380 ################################## SLOW LOG ################################### # The Redis Slow Log is a system to log queries that exceeded a specified # execution time. The execution time does not include the I/O operations # like talking with the client, sending the reply and so forth, # but just the time needed to actually execute the command (this is the only # stage of command execution where the thread is blocked and can not serve # other requests in the meantime). # # You can configure the slow log with two parameters: one tells Redis # what is the execution time, in microseconds, to exceed in order for the # command to get logged, and the other parameter is the length of the # slow log. When a new command is logged the oldest one is removed from the # queue of logged commands. # The following time is expressed in microseconds, so 1000000 is equivalent # to one second. Note that a negative number disables the slow log, while # a value of zero forces the logging of every command. slowlog-log-slower-than 10000 # There is no limit to this length. Just be aware that it will consume memory. # You can reclaim memory used by the slow log with SLOWLOG RESET. slowlog-max-len 128 ################################ LATENCY MONITOR ############################## # The Redis latency monitoring subsystem samples different operations # at runtime in order to collect data related to possible sources of # latency of a Redis instance. # # Via the LATENCY command this information is available to the user that can # print graphs and obtain reports. # # The system only logs operations that were performed in a time equal or # greater than the amount of milliseconds specified via the # latency-monitor-threshold configuration directive. When its value is set # to zero, the latency monitor is turned off. # # By default latency monitoring is disabled since it is mostly not needed # if you don't have latency issues, and collecting data has a performance # impact, that while very small, can be measured under big load. Latency # monitoring can easily be enabled at runtime using the command # "CONFIG SET latency-monitor-threshold " if needed. latency-monitor-threshold 0 ############################# EVENT NOTIFICATION ############################## # Redis can notify Pub/Sub clients about events happening in the key space. # This feature is documented at http://redis.io/topics/notifications # # For instance if keyspace events notification is enabled, and a client # performs a DEL operation on key "foo" stored in the Database 0, two # messages will be published via Pub/Sub: # # PUBLISH __keyspace@0__:foo del # PUBLISH __keyevent@0__:del foo # # It is possible to select the events that Redis will notify among a set # of classes. Every class is identified by a single character: # # K Keyspace events, published with __keyspace@__ prefix. # E Keyevent events, published with __keyevent@__ prefix. # g Generic commands (non-type specific) like DEL, EXPIRE, RENAME, ... # $ String commands # l List commands # s Set commands # h Hash commands # z Sorted set commands # x Expired events (events generated every time a key expires) # e Evicted events (events generated when a key is evicted for maxmemory) # A Alias for g$lshzxe, so that the "AKE" string means all the events. # # The "notify-keyspace-events" takes as argument a string that is composed # of zero or multiple characters. The empty string means that notifications # are disabled. # # Example: to enable list and generic events, from the point of view of the # event name, use: # # notify-keyspace-events Elg # # Example 2: to get the stream of the expired keys subscribing to channel # name __keyevent@0__:expired use: # # notify-keyspace-events Ex # # By default all notifications are disabled because most users don't need # this feature and the feature has some overhead. Note that if you don't # specify at least one of K or E, no events will be delivered. notify-keyspace-events "" ############################### ADVANCED CONFIG ############################### # Hashes are encoded using a memory efficient data structure when they have a # small number of entries, and the biggest entry does not exceed a given # threshold. These thresholds can be configured using the following directives. hash-max-ziplist-entries 512 hash-max-ziplist-value 64 # Lists are also encoded in a special way to save a lot of space. # The number of entries allowed per internal list node can be specified # as a fixed maximum size or a maximum number of elements. # For a fixed maximum size, use -5 through -1, meaning: # -5: max size: 64 Kb <-- not recommended for normal workloads # -4: max size: 32 Kb <-- not recommended # -3: max size: 16 Kb <-- probably not recommended # -2: max size: 8 Kb <-- good # -1: max size: 4 Kb <-- good # Positive numbers mean store up to _exactly_ that number of elements # per list node. # The highest performing option is usually -2 (8 Kb size) or -1 (4 Kb size), # but if your use case is unique, adjust the settings as necessary. list-max-ziplist-size -2 # Lists may also be compressed. # Compress depth is the number of quicklist ziplist nodes from *each* side of # the list to *exclude* from compression. The head and tail of the list # are always uncompressed for fast push/pop operations. Settings are: # 0: disable all list compression # 1: depth 1 means "don't start compressing until after 1 node into the list, # going from either the head or tail" # So: [head]->node->node->...->node->[tail] # [head], [tail] will always be uncompressed; inner nodes will compress. # 2: [head]->[next]->node->node->...->node->[prev]->[tail] # 2 here means: don't compress head or head->next or tail->prev or tail, # but compress all nodes between them. # 3: [head]->[next]->[next]->node->node->...->node->[prev]->[prev]->[tail] # etc. list-compress-depth 0 # Sets have a special encoding in just one case: when a set is composed # of just strings that happen to be integers in radix 10 in the range # of 64 bit signed integers. # The following configuration setting sets the limit in the size of the # set in order to use this special memory saving encoding. set-max-intset-entries 512 # Similarly to hashes and lists, sorted sets are also specially encoded in # order to save a lot of space. This encoding is only used when the length and # elements of a sorted set are below the following limits: zset-max-ziplist-entries 128 zset-max-ziplist-value 64 # HyperLogLog sparse representation bytes limit. The limit includes the # 16 bytes header. When an HyperLogLog using the sparse representation crosses # this limit, it is converted into the dense representation. # # A value greater than 16000 is totally useless, since at that point the # dense representation is more memory efficient. # # The suggested value is ~ 3000 in order to have the benefits of # the space efficient encoding without slowing down too much PFADD, # which is O(N) with the sparse encoding. The value can be raised to # ~ 10000 when CPU is not a concern, but space is, and the data set is # composed of many HyperLogLogs with cardinality in the 0 - 15000 range. hll-sparse-max-bytes 3000 # Active rehashing uses 1 millisecond every 100 milliseconds of CPU time in # order to help rehashing the main Redis hash table (the one mapping top-level # keys to values). The hash table implementation Redis uses (see dict.c) # performs a lazy rehashing: the more operation you run into a hash table # that is rehashing, the more rehashing "steps" are performed, so if the # server is idle the rehashing is never complete and some more memory is used # by the hash table. # # The default is to use this millisecond 10 times every second in order to # actively rehash the main dictionaries, freeing memory when possible. # # If unsure: # use "activerehashing no" if you have hard latency requirements and it is # not a good thing in your environment that Redis can reply from time to time # to queries with 2 milliseconds delay. # # use "activerehashing yes" if you don't have such hard requirements but # want to free memory asap when possible. activerehashing yes # The client output buffer limits can be used to force disconnection of clients # that are not reading data from the server fast enough for some reason (a # common reason is that a Pub/Sub client can't consume messages as fast as the # publisher can produce them). # # The limit can be set differently for the three different classes of clients: # # normal -> normal clients including MONITOR clients # slave -> slave clients # pubsub -> clients subscribed to at least one pubsub channel or pattern # # The syntax of every client-output-buffer-limit directive is the following: # # client-output-buffer-limit # # A client is immediately disconnected once the hard limit is reached, or if # the soft limit is reached and remains reached for the specified number of # seconds (continuously). # So for instance if the hard limit is 32 megabytes and the soft limit is # 16 megabytes / 10 seconds, the client will get disconnected immediately # if the size of the output buffers reach 32 megabytes, but will also get # disconnected if the client reaches 16 megabytes and continuously overcomes # the limit for 10 seconds. # # By default normal clients are not limited because they don't receive data # without asking (in a push way), but just after a request, so only # asynchronous clients may create a scenario where data is requested faster # than it can read. # # Instead there is a default limit for pubsub and slave clients, since # subscribers and slaves receive data in a push fashion. # # Both the hard or the soft limit can be disabled by setting them to zero. client-output-buffer-limit normal 0 0 0 client-output-buffer-limit slave 256mb 64mb 60 client-output-buffer-limit pubsub 32mb 8mb 60 # Client query buffers accumulate new commands. They are limited to a fixed # amount by default in order to avoid that a protocol desynchronization (for # instance due to a bug in the client) will lead to unbound memory usage in # the query buffer. However you can configure it here if you have very special # needs, such us huge multi/exec requests or alike. # # client-query-buffer-limit 1gb # In the Redis protocol, bulk requests, that are, elements representing single # strings, are normally limited ot 512 mb. However you can change this limit # here. # # proto-max-bulk-len 512mb # Redis calls an internal function to perform many background tasks, like # closing connections of clients in timeout, purging expired keys that are # never requested, and so forth. # # Not all tasks are performed with the same frequency, but Redis checks for # tasks to perform according to the specified "hz" value. # # By default "hz" is set to 10. Raising the value will use more CPU when # Redis is idle, but at the same time will make Redis more responsive when # there are many keys expiring at the same time, and timeouts may be # handled with more precision. # # The range is between 1 and 500, however a value over 100 is usually not # a good idea. Most users should use the default of 10 and raise this up to # 100 only in environments where very low latency is required. hz 10 # When a child rewrites the AOF file, if the following option is enabled # the file will be fsync-ed every 32 MB of data generated. This is useful # in order to commit the file to the disk more incrementally and avoid # big latency spikes. aof-rewrite-incremental-fsync yes # Redis LFU eviction (see maxmemory setting) can be tuned. However it is a good # idea to start with the default settings and only change them after investigating # how to improve the performances and how the keys LFU change over time, which # is possible to inspect via the OBJECT FREQ command. # # There are two tunable parameters in the Redis LFU implementation: the # counter logarithm factor and the counter decay time. It is important to # understand what the two parameters mean before changing them. # # The LFU counter is just 8 bits per key, it's maximum value is 255, so Redis # uses a probabilistic increment with logarithmic behavior. Given the value # of the old counter, when a key is accessed, the counter is incremented in # this way: # # 1. A random number R between 0 and 1 is extracted. # 2. A probability P is calculated as 1/(old_value*lfu_log_factor+1). # 3. The counter is incremented only if R < P. # # The default lfu-log-factor is 10. This is a table of how the frequency # counter changes with a different number of accesses with different # logarithmic factors: # # +--------+------------+------------+------------+------------+------------+ # | factor | 100 hits | 1000 hits | 100K hits | 1M hits | 10M hits | # +--------+------------+------------+------------+------------+------------+ # | 0 | 104 | 255 | 255 | 255 | 255 | # +--------+------------+------------+------------+------------+------------+ # | 1 | 18 | 49 | 255 | 255 | 255 | # +--------+------------+------------+------------+------------+------------+ # | 10 | 10 | 18 | 142 | 255 | 255 | # +--------+------------+------------+------------+------------+------------+ # | 100 | 8 | 11 | 49 | 143 | 255 | # +--------+------------+------------+------------+------------+------------+ # # NOTE: The above table was obtained by running the following commands: # # redis-benchmark -n 1000000 incr foo # redis-cli object freq foo # # NOTE 2: The counter initial value is 5 in order to give new objects a chance # to accumulate hits. # # The counter decay time is the time, in minutes, that must elapse in order # for the key counter to be divided by two (or decremented if it has a value # less <= 10). # # The default value for the lfu-decay-time is 1. A Special value of 0 means to # decay the counter every time it happens to be scanned. # # lfu-log-factor 10 # lfu-decay-time 1 ########################### ACTIVE DEFRAGMENTATION ####################### # # WARNING THIS FEATURE IS EXPERIMENTAL. However it was stress tested # even in production and manually tested by multiple engineers for some # time. # # What is active defragmentation? # ------------------------------- # # Active (online) defragmentation allows a Redis server to compact the # spaces left between small allocations and deallocations of data in memory, # thus allowing to reclaim back memory. # # Fragmentation is a natural process that happens with every allocator (but # less so with Jemalloc, fortunately) and certain workloads. Normally a server # restart is needed in order to lower the fragmentation, or at least to flush # away all the data and create it again. However thanks to this feature # implemented by Oran Agra for Redis 4.0 this process can happen at runtime # in an "hot" way, while the server is running. # # Basically when the fragmentation is over a certain level (see the # configuration options below) Redis will start to create new copies of the # values in contiguous memory regions by exploiting certain specific Jemalloc # features (in order to understand if an allocation is causing fragmentation # and to allocate it in a better place), and at the same time, will release the # old copies of the data. This process, repeated incrementally for all the keys # will cause the fragmentation to drop back to normal values. # # Important things to understand: # # 1. This feature is disabled by default, and only works if you compiled Redis # to use the copy of Jemalloc we ship with the source code of Redis. # This is the default with Linux builds. # # 2. You never need to enable this feature if you don't have fragmentation # issues. # # 3. Once you experience fragmentation, you can enable this feature when # needed with the command "CONFIG SET activedefrag yes". # # The configuration parameters are able to fine tune the behavior of the # defragmentation process. If you are not sure about what they mean it is # a good idea to leave the defaults untouched. # Enabled active defragmentation # activedefrag yes # Minimum amount of fragmentation waste to start active defrag # active-defrag-ignore-bytes 100mb # Minimum percentage of fragmentation to start active defrag # active-defrag-threshold-lower 10 # Maximum percentage of fragmentation at which we use maximum effort # active-defrag-threshold-upper 100 # Minimal effort for defrag in CPU percentage # active-defrag-cycle-min 25 # Maximal effort for defrag in CPU percentage # active-defrag-cycle-max 75 ================================================ FILE: aegir/conf/redis/redis4.conf ================================================ # Redis configuration file example. # # Note that in order to read the configuration file, Redis must be # started with the file path as first argument: # # ./redis-server /path/to/redis.conf # Note on units: when memory size is needed, it is possible to specify # it in the usual form of 1k 5GB 4M and so forth: # # 1k => 1000 bytes # 1kb => 1024 bytes # 1m => 1000000 bytes # 1mb => 1024*1024 bytes # 1g => 1000000000 bytes # 1gb => 1024*1024*1024 bytes # # units are case insensitive so 1GB 1Gb 1gB are all the same. ################################## INCLUDES ################################### # Include one or more other config files here. This is useful if you # have a standard template that goes to all Redis servers but also need # to customize a few per-server settings. Include files can include # other files, so use this wisely. # # Notice option "include" won't be rewritten by command "CONFIG REWRITE" # from admin or Redis Sentinel. Since Redis always uses the last processed # line as value of a configuration directive, you'd better put includes # at the beginning of this file to avoid overwriting config change at runtime. # # If instead you are interested in using includes to override configuration # options, it is better to use include as the last line. # # include /path/to/local.conf # include /path/to/other.conf ################################## MODULES ##################################### # Load modules at startup. If the server is not able to load modules # it will abort. It is possible to use multiple loadmodule directives. # # loadmodule /path/to/my_module.so # loadmodule /path/to/other_module.so ################################## NETWORK ##################################### # By default, if no "bind" configuration directive is specified, Redis listens # for connections from all the network interfaces available on the server. # It is possible to listen to just one or multiple selected interfaces using # the "bind" configuration directive, followed by one or more IP addresses. # # Examples: # # xbind 192.168.1.100 10.0.0.1 # xbind 127.0.0.1 ::1 # # ~~~ WARNING ~~~ If the computer running Redis is directly exposed to the # internet, binding to all the interfaces is dangerous and will expose the # instance to everybody on the internet. So by default we uncomment the # following bind directive, that will force Redis to listen only into # the IPv4 lookback interface address (this means Redis will be able to # accept connections only from clients running into the same computer it # is running). # # IF YOU ARE SURE YOU WANT YOUR INSTANCE TO LISTEN TO ALL THE INTERFACES # JUST COMMENT THE FOLLOWING LINE. # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ bind 127.0.0.1 # Protected mode is a layer of security protection, in order to avoid that # Redis instances left open on the internet are accessed and exploited. # # When protected mode is on and if: # # 1) The server is not binding explicitly to a set of addresses using the # "bind" directive. # 2) No password is configured. # # The server only accepts connections from clients connecting from the # IPv4 and IPv6 loopback addresses 127.0.0.1 and ::1, and from Unix domain # sockets. # # By default protected mode is enabled. You should disable it only if # you are sure you want clients from other hosts to connect to Redis # even if no authentication is configured, nor a specific set of interfaces # are explicitly listed using the "bind" directive. protected-mode no # Accept connections on the specified port, default is 6379 (IANA #815344). # If port 0 is specified Redis will not listen on a TCP socket. port 6379 # TCP listen() backlog. # # In high requests-per-second environments you need an high backlog in order # to avoid slow clients connections issues. Note that the Linux kernel # will silently truncate it to the value of /proc/sys/net/core/somaxconn so # make sure to raise both the value of somaxconn and tcp_max_syn_backlog # in order to get the desired effect. tcp-backlog 511 # Unix socket. # # Specify the path for the Unix socket that will be used to listen for # incoming connections. There is no default, so Redis will not listen # on a unix socket when not specified. # # unixsocket /run/redis/redis.sock # unixsocketperm 777 # Close the connection after a client is idle for N seconds (0 to disable) timeout 3600 # TCP keepalive. # # If non-zero, use SO_KEEPALIVE to send TCP ACKs to clients in absence # of communication. This is useful for two reasons: # # 1) Detect dead peers. # 2) Take the connection alive from the point of view of network # equipment in the middle. # # On Linux, the specified value (in seconds) is the period used to send ACKs. # Note that to close the connection the double of the time is needed. # On other kernels the period depends on the kernel configuration. # # A reasonable value for this option is 300 seconds, which is the new # Redis default starting with Redis 3.2.1. tcp-keepalive 300 ################################# GENERAL ##################################### # By default Redis does not run as a daemon. Use 'yes' if you need it. # Note that Redis will write a pid file in /run/redis.pid when daemonized. daemonize yes # If you run Redis from upstart or systemd, Redis can interact with your # supervision tree. Options: # supervised no - no supervision interaction # supervised upstart - signal upstart by putting Redis into SIGSTOP mode # supervised systemd - signal systemd by writing READY=1 to $NOTIFY_SOCKET # supervised auto - detect upstart or systemd method based on # UPSTART_JOB or NOTIFY_SOCKET environment variables # Note: these supervision methods only signal "process is ready." # They do not enable continuous liveness pings back to your supervisor. supervised no # If a pid file is specified, Redis writes it where specified at startup # and removes it at exit. # # When the server runs non daemonized, no pid file is created if none is # specified in the configuration. When the server is daemonized, the pid file # is used even if not specified, defaulting to "/run/redis.pid". # # Creating a pid file is best effort: if Redis is not able to create it # nothing bad happens, the server will start and run normally. pidfile /run/redis/redis.pid # Specify the server verbosity level. # This can be one of: # debug (a lot of information, useful for development/testing) # verbose (many rarely useful info, but not a mess like the debug level) # notice (moderately verbose, what you want in production probably) # warning (only very important / critical messages are logged) loglevel warning # Specify the log file name. Also the empty string can be used to force # Redis to log on the standard output. Note that if you use standard # output for logging but daemonize, logs will be sent to /dev/null logfile /var/log/redis/redis-server.log # To enable logging to the system logger, just set 'syslog-enabled' to yes, # and optionally update the other syslog parameters to suit your needs. # syslog-enabled no # Specify the syslog identity. # syslog-ident redis # Specify the syslog facility. Must be USER or between LOCAL0-LOCAL7. # syslog-facility local0 # Set the number of databases. The default database is DB 0, you can select # a different one on a per-connection basis using SELECT where # dbid is a number between 0 and 'databases'-1 databases 8 # By default Redis shows an ASCII art logo only when started to log to the # standard output and if the standard output is a TTY. Basically this means # that normally a logo is displayed only in interactive sessions. # # However it is possible to force the pre-4.0 behavior and always show a # ASCII art logo in startup logs by setting the following option to yes. always-show-logo yes ################################ SNAPSHOTTING ################################ # # Save the DB on disk: # # save # # Will save the DB if both the given number of seconds and the given # number of write operations against the DB occurred. # # In the example below the behaviour will be to save: # after 900 sec (15 min) if at least 1 key changed # after 300 sec (5 min) if at least 10 keys changed # after 60 sec if at least 10000 keys changed # # Note: you can disable saving completely by commenting out all "save" lines. # # It is also possible to remove all the previously configured save # points by adding a save directive with a single empty string argument # like in the following example: # # save "" # save 900 1 # save 300 10 # save 60 10000 # By default Redis will stop accepting writes if RDB snapshots are enabled # (at least one save point) and the latest background save failed. # This will make the user aware (in a hard way) that data is not persisting # on disk properly, otherwise chances are that no one will notice and some # disaster will happen. # # If the background saving process will start working again Redis will # automatically allow writes again. # # However if you have setup your proper monitoring of the Redis server # and persistence, you may want to disable this feature so that Redis will # continue to work as usual even if there are problems with disk, # permissions, and so forth. stop-writes-on-bgsave-error no # Compress string objects using LZF when dump .rdb databases? # For default that's set to 'yes' as it's almost always a win. # If you want to save some CPU in the saving child set it to 'no' but # the dataset will likely be bigger if you have compressible values or keys. rdbcompression yes # Since version 5 of RDB a CRC64 checksum is placed at the end of the file. # This makes the format more resistant to corruption but there is a performance # hit to pay (around 10%) when saving and loading RDB files, so you can disable it # for maximum performances. # # RDB files created with checksum disabled have a checksum of zero that will # tell the loading code to skip the check. rdbchecksum no # The filename where to dump the DB dbfilename dump.rdb # The working directory. # # The DB will be written inside this directory, with the filename specified # above using the 'dbfilename' configuration directive. # # The Append Only File will also be created inside this directory. # # Note that you must specify a directory here, not a file name. dir /var/lib/redis/ ################################# REPLICATION ################################# # Master-Slave replication. Use slaveof to make a Redis instance a copy of # another Redis server. A few things to understand ASAP about Redis replication. # # 1) Redis replication is asynchronous, but you can configure a master to # stop accepting writes if it appears to be not connected with at least # a given number of slaves. # 2) Redis slaves are able to perform a partial resynchronization with the # master if the replication link is lost for a relatively small amount of # time. You may want to configure the replication backlog size (see the next # sections of this file) with a sensible value depending on your needs. # 3) Replication is automatic and does not need user intervention. After a # network partition slaves automatically try to reconnect to masters # and resynchronize with them. # # slaveof # If the master is password protected (using the "requirepass" configuration # directive below) it is possible to tell the slave to authenticate before # starting the replication synchronization process, otherwise the master will # refuse the slave request. # # masterauth # When a slave loses its connection with the master, or when the replication # is still in progress, the slave can act in two different ways: # # 1) if slave-serve-stale-data is set to 'yes' (the default) the slave will # still reply to client requests, possibly with out of date data, or the # data set may just be empty if this is the first synchronization. # # 2) if slave-serve-stale-data is set to 'no' the slave will reply with # an error "SYNC with master in progress" to all the kind of commands # but to INFO and SLAVEOF. # slave-serve-stale-data yes # You can configure a slave instance to accept writes or not. Writing against # a slave instance may be useful to store some ephemeral data (because data # written on a slave will be easily deleted after resync with the master) but # may also cause problems if clients are writing to it because of a # misconfiguration. # # Since Redis 2.6 by default slaves are read-only. # # Note: read only slaves are not designed to be exposed to untrusted clients # on the internet. It's just a protection layer against misuse of the instance. # Still a read only slave exports by default all the administrative commands # such as CONFIG, DEBUG, and so forth. To a limited extent you can improve # security of read only slaves using 'rename-command' to shadow all the # administrative / dangerous commands. slave-read-only yes # Replication SYNC strategy: disk or socket. # # ------------------------------------------------------- # WARNING: DISKLESS REPLICATION IS EXPERIMENTAL CURRENTLY # ------------------------------------------------------- # # New slaves and reconnecting slaves that are not able to continue the replication # process just receiving differences, need to do what is called a "full # synchronization". An RDB file is transmitted from the master to the slaves. # The transmission can happen in two different ways: # # 1) Disk-backed: The Redis master creates a new process that writes the RDB # file on disk. Later the file is transferred by the parent # process to the slaves incrementally. # 2) Diskless: The Redis master creates a new process that directly writes the # RDB file to slave sockets, without touching the disk at all. # # With disk-backed replication, while the RDB file is generated, more slaves # can be queued and served with the RDB file as soon as the current child producing # the RDB file finishes its work. With diskless replication instead once # the transfer starts, new slaves arriving will be queued and a new transfer # will start when the current one terminates. # # When diskless replication is used, the master waits a configurable amount of # time (in seconds) before starting the transfer in the hope that multiple slaves # will arrive and the transfer can be parallelized. # # With slow disks and fast (large bandwidth) networks, diskless replication # works better. repl-diskless-sync no # When diskless replication is enabled, it is possible to configure the delay # the server waits in order to spawn the child that transfers the RDB via socket # to the slaves. # # This is important since once the transfer starts, it is not possible to serve # new slaves arriving, that will be queued for the next RDB transfer, so the server # waits a delay in order to let more slaves arrive. # # The delay is specified in seconds, and by default is 5 seconds. To disable # it entirely just set it to 0 seconds and the transfer will start ASAP. repl-diskless-sync-delay 5 # Slaves send PINGs to server in a predefined interval. It's possible to change # this interval with the repl_ping_slave_period option. The default value is 10 # seconds. # # repl-ping-slave-period 10 # The following option sets the replication timeout for: # # 1) Bulk transfer I/O during SYNC, from the point of view of slave. # 2) Master timeout from the point of view of slaves (data, pings). # 3) Slave timeout from the point of view of masters (REPLCONF ACK pings). # # It is important to make sure that this value is greater than the value # specified for repl-ping-slave-period otherwise a timeout will be detected # every time there is low traffic between the master and the slave. # # repl-timeout 60 # Disable TCP_NODELAY on the slave socket after SYNC? # # If you select "yes" Redis will use a smaller number of TCP packets and # less bandwidth to send data to slaves. But this can add a delay for # the data to appear on the slave side, up to 40 milliseconds with # Linux kernels using a default configuration. # # If you select "no" the delay for data to appear on the slave side will # be reduced but more bandwidth will be used for replication. # # By default we optimize for low latency, but in very high traffic conditions # or when the master and slaves are many hops away, turning this to "yes" may # be a good idea. repl-disable-tcp-nodelay no # Set the replication backlog size. The backlog is a buffer that accumulates # slave data when slaves are disconnected for some time, so that when a slave # wants to reconnect again, often a full resync is not needed, but a partial # resync is enough, just passing the portion of data the slave missed while # disconnected. # # The bigger the replication backlog, the longer the time the slave can be # disconnected and later be able to perform a partial resynchronization. # # The backlog is only allocated once there is at least a slave connected. # # repl-backlog-size 1mb # After a master has no longer connected slaves for some time, the backlog # will be freed. The following option configures the amount of seconds that # need to elapse, starting from the time the last slave disconnected, for # the backlog buffer to be freed. # # Note that slaves never free the backlog for timeout, since they may be # promoted to masters later, and should be able to correctly "partially # resynchronize" with the slaves: hence they should always accumulate backlog. # # A value of 0 means to never release the backlog. # # repl-backlog-ttl 3600 # The slave priority is an integer number published by Redis in the INFO output. # It is used by Redis Sentinel in order to select a slave to promote into a # master if the master is no longer working correctly. # # A slave with a low priority number is considered better for promotion, so # for instance if there are three slaves with priority 10, 100, 25 Sentinel will # pick the one with priority 10, that is the lowest. # # However a special priority of 0 marks the slave as not able to perform the # role of master, so a slave with priority of 0 will never be selected by # Redis Sentinel for promotion. # # By default the priority is 100. slave-priority 100 # It is possible for a master to stop accepting writes if there are less than # N slaves connected, having a lag less or equal than M seconds. # # The N slaves need to be in "online" state. # # The lag in seconds, that must be <= the specified value, is calculated from # the last ping received from the slave, that is usually sent every second. # # This option does not GUARANTEE that N replicas will accept the write, but # will limit the window of exposure for lost writes in case not enough slaves # are available, to the specified number of seconds. # # For example to require at least 3 slaves with a lag <= 10 seconds use: # # min-slaves-to-write 3 # min-slaves-max-lag 10 # # Setting one or the other to 0 disables the feature. # # By default min-slaves-to-write is set to 0 (feature disabled) and # min-slaves-max-lag is set to 10. # A Redis master is able to list the address and port of the attached # slaves in different ways. For example the "INFO replication" section # offers this information, which is used, among other tools, by # Redis Sentinel in order to discover slave instances. # Another place where this info is available is in the output of the # "ROLE" command of a master. # # The listed IP and address normally reported by a slave is obtained # in the following way: # # IP: The address is auto detected by checking the peer address # of the socket used by the slave to connect with the master. # # Port: The port is communicated by the slave during the replication # handshake, and is normally the port that the slave is using to # list for connections. # # However when port forwarding or Network Address Translation (NAT) is # used, the slave may be actually reachable via different IP and port # pairs. The following two options can be used by a slave in order to # report to its master a specific set of IP and port, so that both INFO # and ROLE will report those values. # # There is no need to use both the options if you need to override just # the port or the IP address. # # slave-announce-ip 5.5.5.5 # slave-announce-port 1234 ################################## SECURITY ################################### # Require clients to issue AUTH before processing any other # commands. This might be useful in environments in which you do not trust # others with access to the host running redis-server. # # This should stay commented out for backward compatibility and because most # people do not need auth (e.g. they run their own servers). # # Warning: since Redis is pretty fast an outside user can try up to # 150k passwords per second against a good box. This means that you should # use a very strong password otherwise it will be very easy to break. # # requirepass isfoobared # Command renaming. # # It is possible to change the name of dangerous commands in a shared # environment. For instance the CONFIG command may be renamed into something # hard to guess so that it will still be available for internal-use tools # but not available for general clients. # # Example: # # rename-command CONFIG b840fc02d524045429941cc15f59e41cb7be6c52 # # It is also possible to completely kill a command by renaming it into # an empty string: # # rename-command CONFIG "" # # Please note that changing the name of commands that are logged into the # AOF file or transmitted to slaves may cause problems. ################################### CLIENTS #################################### # Set the max number of connected clients at the same time. By default # this limit is set to 10000 clients, however if the Redis server is not # able to configure the process file limit to allow for the specified limit # the max number of allowed clients is set to the current file limit # minus 32 (as Redis reserves a few file descriptors for internal uses). # # Once the limit is reached Redis will close all the new connections sending # an error 'max number of clients reached'. # maxclients 4000 ############################## MEMORY MANAGEMENT ################################ # Set a memory usage limit to the specified amount of bytes. # When the memory limit is reached Redis will try to remove keys # according to the eviction policy selected (see maxmemory-policy). # # If Redis can't remove keys according to the policy, or if the policy is # set to 'noeviction', Redis will start to reply with errors to commands # that would use more memory, like SET, LPUSH, and so on, and will continue # to reply to read-only commands like GET. # # This option is usually useful when using Redis as an LRU or LFU cache, or to # set a hard memory limit for an instance (using the 'noeviction' policy). # # WARNING: If you have slaves attached to an instance with maxmemory on, # the size of the output buffers needed to feed the slaves are subtracted # from the used memory count, so that network problems / resyncs will # not trigger a loop where keys are evicted, and in turn the output # buffer of slaves is full with DELs of keys evicted triggering the deletion # of more keys, and so forth until the database is completely emptied. # # In short... if you have slaves attached it is suggested that you set a lower # limit for maxmemory so that there is some free RAM on the system for slave # output buffers (but this is not needed if the policy is 'noeviction'). # maxmemory 88MB # MAXMEMORY POLICY: how Redis will select what to remove when maxmemory # is reached. You can select among five behaviors: # # volatile-lru -> Evict using approximated LRU among the keys with an expire set. # allkeys-lru -> Evict any key using approximated LRU. # volatile-lfu -> Evict using approximated LFU among the keys with an expire set. # allkeys-lfu -> Evict any key using approximated LFU. # volatile-random -> Remove a random key among the ones with an expire set. # allkeys-random -> Remove a random key, any key. # volatile-ttl -> Remove the key with the nearest expire time (minor TTL) # noeviction -> Don't evict anything, just return an error on write operations. # # LRU means Least Recently Used # LFU means Least Frequently Used # # Both LRU, LFU and volatile-ttl are implemented using approximated # randomized algorithms. # # Note: with any of the above policies, Redis will return an error on write # operations, when there are no suitable keys for eviction. # # At the date of writing these commands are: set setnx setex append # incr decr rpush lpush rpushx lpushx linsert lset rpoplpush sadd # sinter sinterstore sunion sunionstore sdiff sdiffstore zadd zincrby # zunionstore zinterstore hset hsetnx hmset hincrby incrby decrby # getset mset msetnx exec sort # # The default is: noeviction # maxmemory-policy allkeys-lru # LRU, LFU and minimal TTL algorithms are not precise algorithms but approximated # algorithms (in order to save memory), so you can tune it for speed or # accuracy. For default Redis will check five keys and pick the one that was # used less recently, you can change the sample size using the following # configuration directive. # # The default of 5 produces good enough results. 10 Approximates very closely # true LRU but costs more CPU. 3 is faster but not very accurate. # # maxmemory-samples 5 ############################# LAZY FREEING #################################### # Redis has two primitives to delete keys. One is called DEL and is a blocking # deletion of the object. It means that the server stops processing new commands # in order to reclaim all the memory associated with an object in a synchronous # way. If the key deleted is associated with a small object, the time needed # in order to execute the DEL command is very small and comparable to most other # O(1) or O(log_N) commands in Redis. However if the key is associated with an # aggregated value containing millions of elements, the server can block for # a long time (even seconds) in order to complete the operation. # # For the above reasons Redis also offers non blocking deletion primitives # such as UNLINK (non blocking DEL) and the ASYNC option of FLUSHALL and # FLUSHDB commands, in order to reclaim memory in background. Those commands # are executed in constant time. Another thread will incrementally free the # object in the background as fast as possible. # # DEL, UNLINK and ASYNC option of FLUSHALL and FLUSHDB are user-controlled. # It's up to the design of the application to understand when it is a good # idea to use one or the other. However the Redis server sometimes has to # delete keys or flush the whole database as a side effect of other operations. # Specifically Redis deletes objects independently of a user call in the # following scenarios: # # 1) On eviction, because of the maxmemory and maxmemory policy configurations, # in order to make room for new data, without going over the specified # memory limit. # 2) Because of expire: when a key with an associated time to live (see the # EXPIRE command) must be deleted from memory. # 3) Because of a side effect of a command that stores data on a key that may # already exist. For example the RENAME command may delete the old key # content when it is replaced with another one. Similarly SUNIONSTORE # or SORT with STORE option may delete existing keys. The SET command # itself removes any old content of the specified key in order to replace # it with the specified string. # 4) During replication, when a slave performs a full resynchronization with # its master, the content of the whole database is removed in order to # load the RDB file just transfered. # # In all the above cases the default is to delete objects in a blocking way, # like if DEL was called. However you can configure each case specifically # in order to instead release memory in a non-blocking way like if UNLINK # was called, using the following configuration directives: lazyfree-lazy-eviction yes lazyfree-lazy-expire yes lazyfree-lazy-server-del yes slave-lazy-flush yes ############################## APPEND ONLY MODE ############################### # By default Redis asynchronously dumps the dataset on disk. This mode is # good enough in many applications, but an issue with the Redis process or # a power outage may result into a few minutes of writes lost (depending on # the configured save points). # # The Append Only File is an alternative persistence mode that provides # much better durability. For instance using the default data fsync policy # (see later in the config file) Redis can lose just one second of writes in a # dramatic event like a server power outage, or a single write if something # wrong with the Redis process itself happens, but the operating system is # still running correctly. # # AOF and RDB persistence can be enabled at the same time without problems. # If the AOF is enabled on startup Redis will load the AOF, that is the file # with the better durability guarantees. # # Please check http://redis.io/topics/persistence for more information. appendonly no # The name of the append only file (default: "appendonly.aof") appendfilename "appendonly.aof" # The fsync() call tells the Operating System to actually write data on disk # instead of waiting for more data in the output buffer. Some OS will really flush # data on disk, some other OS will just try to do it ASAP. # # Redis supports three different modes: # # no: don't fsync, just let the OS flush the data when it wants. Faster. # always: fsync after every write to the append only log. Slow, Safest. # everysec: fsync only one time every second. Compromise. # # The default is "everysec", as that's usually the right compromise between # speed and data safety. It's up to you to understand if you can relax this to # "no" that will let the operating system flush the output buffer when # it wants, for better performances (but if you can live with the idea of # some data loss consider the default persistence mode that's snapshotting), # or on the contrary, use "always" that's very slow but a bit safer than # everysec. # # More details please check the following article: # http://antirez.com/post/redis-persistence-demystified.html # # If unsure, use "everysec". # appendfsync always appendfsync everysec # appendfsync no # When the AOF fsync policy is set to always or everysec, and a background # saving process (a background save or AOF log background rewriting) is # performing a lot of I/O against the disk, in some Linux configurations # Redis may block too long on the fsync() call. Note that there is no fix for # this currently, as even performing fsync in a different thread will block # our synchronous write(2) call. # # In order to mitigate this problem it's possible to use the following option # that will prevent fsync() from being called in the main process while a # BGSAVE or BGREWRITEAOF is in progress. # # This means that while another child is saving, the durability of Redis is # the same as "appendfsync none". In practical terms, this means that it is # possible to lose up to 30 seconds of log in the worst scenario (with the # default Linux settings). # # If you have latency problems turn this to "yes". Otherwise leave it as # "no" that is the safest pick from the point of view of durability. no-appendfsync-on-rewrite no # Automatic rewrite of the append only file. # Redis is able to automatically rewrite the log file implicitly calling # BGREWRITEAOF when the AOF log size grows by the specified percentage. # # This is how it works: Redis remembers the size of the AOF file after the # latest rewrite (if no rewrite has happened since the restart, the size of # the AOF at startup is used). # # This base size is compared to the current size. If the current size is # bigger than the specified percentage, the rewrite is triggered. Also # you need to specify a minimal size for the AOF file to be rewritten, this # is useful to avoid rewriting the AOF file even if the percentage increase # is reached but it is still pretty small. # # Specify a percentage of zero in order to disable the automatic AOF # rewrite feature. auto-aof-rewrite-percentage 100 auto-aof-rewrite-min-size 64mb # An AOF file may be found to be truncated at the end during the Redis # startup process, when the AOF data gets loaded back into memory. # This may happen when the system where Redis is running # crashes, especially when an ext4 filesystem is mounted without the # data=ordered option (however this can't happen when Redis itself # crashes or aborts but the operating system still works correctly). # # Redis can either exit with an error when this happens, or load as much # data as possible (the default now) and start if the AOF file is found # to be truncated at the end. The following option controls this behavior. # # If aof-load-truncated is set to yes, a truncated AOF file is loaded and # the Redis server starts emitting a log to inform the user of the event. # Otherwise if the option is set to no, the server aborts with an error # and refuses to start. When the option is set to no, the user requires # to fix the AOF file using the "redis-check-aof" utility before to restart # the server. # # Note that if the AOF file will be found to be corrupted in the middle # the server will still exit with an error. This option only applies when # Redis will try to read more data from the AOF file but not enough bytes # will be found. aof-load-truncated yes # When rewriting the AOF file, Redis is able to use an RDB preamble in the # AOF file for faster rewrites and recoveries. When this option is turned # on the rewritten AOF file is composed of two different stanzas: # # [RDB file][AOF tail] # # When loading Redis recognizes that the AOF file starts with the "REDIS" # string and loads the prefixed RDB file, and continues loading the AOF # tail. # # This is currently turned off by default in order to avoid the surprise # of a format change, but will at some point be used as the default. aof-use-rdb-preamble no ################################ LUA SCRIPTING ############################### # Max execution time of a Lua script in milliseconds. # # If the maximum execution time is reached Redis will log that a script is # still in execution after the maximum allowed time and will start to # reply to queries with an error. # # When a long running script exceeds the maximum execution time only the # SCRIPT KILL and SHUTDOWN NOSAVE commands are available. The first can be # used to stop a script that did not yet called write commands. The second # is the only way to shut down the server in the case a write command was # already issued by the script but the user doesn't want to wait for the natural # termination of the script. # # Set it to 0 or a negative value for unlimited execution without warnings. lua-time-limit 5000 ################################ REDIS CLUSTER ############################### # # ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ # WARNING EXPERIMENTAL: Redis Cluster is considered to be stable code, however # in order to mark it as "mature" we need to wait for a non trivial percentage # of users to deploy it in production. # ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ # # Normal Redis instances can't be part of a Redis Cluster; only nodes that are # started as cluster nodes can. In order to start a Redis instance as a # cluster node enable the cluster support uncommenting the following: # # cluster-enabled yes # Every cluster node has a cluster configuration file. This file is not # intended to be edited by hand. It is created and updated by Redis nodes. # Every Redis Cluster node requires a different cluster configuration file. # Make sure that instances running in the same system do not have # overlapping cluster configuration file names. # # cluster-config-file nodes-6379.conf # Cluster node timeout is the amount of milliseconds a node must be unreachable # for it to be considered in failure state. # Most other internal time limits are multiple of the node timeout. # # cluster-node-timeout 15000 # A slave of a failing master will avoid to start a failover if its data # looks too old. # # There is no simple way for a slave to actually have an exact measure of # its "data age", so the following two checks are performed: # # 1) If there are multiple slaves able to failover, they exchange messages # in order to try to give an advantage to the slave with the best # replication offset (more data from the master processed). # Slaves will try to get their rank by offset, and apply to the start # of the failover a delay proportional to their rank. # # 2) Every single slave computes the time of the last interaction with # its master. This can be the last ping or command received (if the master # is still in the "connected" state), or the time that elapsed since the # disconnection with the master (if the replication link is currently down). # If the last interaction is too old, the slave will not try to failover # at all. # # The point "2" can be tuned by user. Specifically a slave will not perform # the failover if, since the last interaction with the master, the time # elapsed is greater than: # # (node-timeout * slave-validity-factor) + repl-ping-slave-period # # So for example if node-timeout is 30 seconds, and the slave-validity-factor # is 10, and assuming a default repl-ping-slave-period of 10 seconds, the # slave will not try to failover if it was not able to talk with the master # for longer than 310 seconds. # # A large slave-validity-factor may allow slaves with too old data to failover # a master, while a too small value may prevent the cluster from being able to # elect a slave at all. # # For maximum availability, it is possible to set the slave-validity-factor # to a value of 0, which means, that slaves will always try to failover the # master regardless of the last time they interacted with the master. # (However they'll always try to apply a delay proportional to their # offset rank). # # Zero is the only value able to guarantee that when all the partitions heal # the cluster will always be able to continue. # # cluster-slave-validity-factor 10 # Cluster slaves are able to migrate to orphaned masters, that are masters # that are left without working slaves. This improves the cluster ability # to resist to failures as otherwise an orphaned master can't be failed over # in case of failure if it has no working slaves. # # Slaves migrate to orphaned masters only if there are still at least a # given number of other working slaves for their old master. This number # is the "migration barrier". A migration barrier of 1 means that a slave # will migrate only if there is at least 1 other working slave for its master # and so forth. It usually reflects the number of slaves you want for every # master in your cluster. # # Default is 1 (slaves migrate only if their masters remain with at least # one slave). To disable migration just set it to a very large value. # A value of 0 can be set but is useful only for debugging and dangerous # in production. # # cluster-migration-barrier 1 # By default Redis Cluster nodes stop accepting queries if they detect there # is at least an hash slot uncovered (no available node is serving it). # This way if the cluster is partially down (for example a range of hash slots # are no longer covered) all the cluster becomes, eventually, unavailable. # It automatically returns available as soon as all the slots are covered again. # # However sometimes you want the subset of the cluster which is working, # to continue to accept queries for the part of the key space that is still # covered. In order to do so, just set the cluster-require-full-coverage # option to no. # # cluster-require-full-coverage yes # This option, when set to yes, prevents slaves from trying to failover its # master during master failures. However the master can still perform a # manual failover, if forced to do so. # # This is useful in different scenarios, especially in the case of multiple # data center operations, where we want one side to never be promoted if not # in the case of a total DC failure. # # cluster-slave-no-failover no # In order to setup your cluster make sure to read the documentation # available at http://redis.io web site. ########################## CLUSTER DOCKER/NAT support ######################## # In certain deployments, Redis Cluster nodes address discovery fails, because # addresses are NAT-ted or because ports are forwarded (the typical case is # Docker and other containers). # # In order to make Redis Cluster working in such environments, a static # configuration where each node knows its public address is needed. The # following two options are used for this scope, and are: # # * cluster-announce-ip # * cluster-announce-port # * cluster-announce-bus-port # # Each instruct the node about its address, client port, and cluster message # bus port. The information is then published in the header of the bus packets # so that other nodes will be able to correctly map the address of the node # publishing the information. # # If the above options are not used, the normal Redis Cluster auto-detection # will be used instead. # # Note that when remapped, the bus port may not be at the fixed offset of # clients port + 10000, so you can specify any port and bus-port depending # on how they get remapped. If the bus-port is not set, a fixed offset of # 10000 will be used as usually. # # Example: # # cluster-announce-ip 10.1.1.5 # cluster-announce-port 6379 # cluster-announce-bus-port 6380 ################################## SLOW LOG ################################### # The Redis Slow Log is a system to log queries that exceeded a specified # execution time. The execution time does not include the I/O operations # like talking with the client, sending the reply and so forth, # but just the time needed to actually execute the command (this is the only # stage of command execution where the thread is blocked and can not serve # other requests in the meantime). # # You can configure the slow log with two parameters: one tells Redis # what is the execution time, in microseconds, to exceed in order for the # command to get logged, and the other parameter is the length of the # slow log. When a new command is logged the oldest one is removed from the # queue of logged commands. # The following time is expressed in microseconds, so 1000000 is equivalent # to one second. Note that a negative number disables the slow log, while # a value of zero forces the logging of every command. slowlog-log-slower-than 10000 # There is no limit to this length. Just be aware that it will consume memory. # You can reclaim memory used by the slow log with SLOWLOG RESET. slowlog-max-len 128 ################################ LATENCY MONITOR ############################## # The Redis latency monitoring subsystem samples different operations # at runtime in order to collect data related to possible sources of # latency of a Redis instance. # # Via the LATENCY command this information is available to the user that can # print graphs and obtain reports. # # The system only logs operations that were performed in a time equal or # greater than the amount of milliseconds specified via the # latency-monitor-threshold configuration directive. When its value is set # to zero, the latency monitor is turned off. # # By default latency monitoring is disabled since it is mostly not needed # if you don't have latency issues, and collecting data has a performance # impact, that while very small, can be measured under big load. Latency # monitoring can easily be enabled at runtime using the command # "CONFIG SET latency-monitor-threshold " if needed. latency-monitor-threshold 0 ############################# EVENT NOTIFICATION ############################## # Redis can notify Pub/Sub clients about events happening in the key space. # This feature is documented at http://redis.io/topics/notifications # # For instance if keyspace events notification is enabled, and a client # performs a DEL operation on key "foo" stored in the Database 0, two # messages will be published via Pub/Sub: # # PUBLISH __keyspace@0__:foo del # PUBLISH __keyevent@0__:del foo # # It is possible to select the events that Redis will notify among a set # of classes. Every class is identified by a single character: # # K Keyspace events, published with __keyspace@__ prefix. # E Keyevent events, published with __keyevent@__ prefix. # g Generic commands (non-type specific) like DEL, EXPIRE, RENAME, ... # $ String commands # l List commands # s Set commands # h Hash commands # z Sorted set commands # x Expired events (events generated every time a key expires) # e Evicted events (events generated when a key is evicted for maxmemory) # A Alias for g$lshzxe, so that the "AKE" string means all the events. # # The "notify-keyspace-events" takes as argument a string that is composed # of zero or multiple characters. The empty string means that notifications # are disabled. # # Example: to enable list and generic events, from the point of view of the # event name, use: # # notify-keyspace-events Elg # # Example 2: to get the stream of the expired keys subscribing to channel # name __keyevent@0__:expired use: # # notify-keyspace-events Ex # # By default all notifications are disabled because most users don't need # this feature and the feature has some overhead. Note that if you don't # specify at least one of K or E, no events will be delivered. notify-keyspace-events "" ############################### ADVANCED CONFIG ############################### # Hashes are encoded using a memory efficient data structure when they have a # small number of entries, and the biggest entry does not exceed a given # threshold. These thresholds can be configured using the following directives. hash-max-ziplist-entries 512 hash-max-ziplist-value 64 # Lists are also encoded in a special way to save a lot of space. # The number of entries allowed per internal list node can be specified # as a fixed maximum size or a maximum number of elements. # For a fixed maximum size, use -5 through -1, meaning: # -5: max size: 64 Kb <-- not recommended for normal workloads # -4: max size: 32 Kb <-- not recommended # -3: max size: 16 Kb <-- probably not recommended # -2: max size: 8 Kb <-- good # -1: max size: 4 Kb <-- good # Positive numbers mean store up to _exactly_ that number of elements # per list node. # The highest performing option is usually -2 (8 Kb size) or -1 (4 Kb size), # but if your use case is unique, adjust the settings as necessary. list-max-ziplist-size -2 # Lists may also be compressed. # Compress depth is the number of quicklist ziplist nodes from *each* side of # the list to *exclude* from compression. The head and tail of the list # are always uncompressed for fast push/pop operations. Settings are: # 0: disable all list compression # 1: depth 1 means "don't start compressing until after 1 node into the list, # going from either the head or tail" # So: [head]->node->node->...->node->[tail] # [head], [tail] will always be uncompressed; inner nodes will compress. # 2: [head]->[next]->node->node->...->node->[prev]->[tail] # 2 here means: don't compress head or head->next or tail->prev or tail, # but compress all nodes between them. # 3: [head]->[next]->[next]->node->node->...->node->[prev]->[prev]->[tail] # etc. list-compress-depth 0 # Sets have a special encoding in just one case: when a set is composed # of just strings that happen to be integers in radix 10 in the range # of 64 bit signed integers. # The following configuration setting sets the limit in the size of the # set in order to use this special memory saving encoding. set-max-intset-entries 512 # Similarly to hashes and lists, sorted sets are also specially encoded in # order to save a lot of space. This encoding is only used when the length and # elements of a sorted set are below the following limits: zset-max-ziplist-entries 128 zset-max-ziplist-value 64 # HyperLogLog sparse representation bytes limit. The limit includes the # 16 bytes header. When an HyperLogLog using the sparse representation crosses # this limit, it is converted into the dense representation. # # A value greater than 16000 is totally useless, since at that point the # dense representation is more memory efficient. # # The suggested value is ~ 3000 in order to have the benefits of # the space efficient encoding without slowing down too much PFADD, # which is O(N) with the sparse encoding. The value can be raised to # ~ 10000 when CPU is not a concern, but space is, and the data set is # composed of many HyperLogLogs with cardinality in the 0 - 15000 range. hll-sparse-max-bytes 3000 # Active rehashing uses 1 millisecond every 100 milliseconds of CPU time in # order to help rehashing the main Redis hash table (the one mapping top-level # keys to values). The hash table implementation Redis uses (see dict.c) # performs a lazy rehashing: the more operation you run into a hash table # that is rehashing, the more rehashing "steps" are performed, so if the # server is idle the rehashing is never complete and some more memory is used # by the hash table. # # The default is to use this millisecond 10 times every second in order to # actively rehash the main dictionaries, freeing memory when possible. # # If unsure: # use "activerehashing no" if you have hard latency requirements and it is # not a good thing in your environment that Redis can reply from time to time # to queries with 2 milliseconds delay. # # use "activerehashing yes" if you don't have such hard requirements but # want to free memory asap when possible. activerehashing yes # The client output buffer limits can be used to force disconnection of clients # that are not reading data from the server fast enough for some reason (a # common reason is that a Pub/Sub client can't consume messages as fast as the # publisher can produce them). # # The limit can be set differently for the three different classes of clients: # # normal -> normal clients including MONITOR clients # slave -> slave clients # pubsub -> clients subscribed to at least one pubsub channel or pattern # # The syntax of every client-output-buffer-limit directive is the following: # # client-output-buffer-limit # # A client is immediately disconnected once the hard limit is reached, or if # the soft limit is reached and remains reached for the specified number of # seconds (continuously). # So for instance if the hard limit is 32 megabytes and the soft limit is # 16 megabytes / 10 seconds, the client will get disconnected immediately # if the size of the output buffers reach 32 megabytes, but will also get # disconnected if the client reaches 16 megabytes and continuously overcomes # the limit for 10 seconds. # # By default normal clients are not limited because they don't receive data # without asking (in a push way), but just after a request, so only # asynchronous clients may create a scenario where data is requested faster # than it can read. # # Instead there is a default limit for pubsub and slave clients, since # subscribers and slaves receive data in a push fashion. # # Both the hard or the soft limit can be disabled by setting them to zero. client-output-buffer-limit normal 0 0 0 client-output-buffer-limit slave 256mb 64mb 60 client-output-buffer-limit pubsub 32mb 8mb 60 # Client query buffers accumulate new commands. They are limited to a fixed # amount by default in order to avoid that a protocol desynchronization (for # instance due to a bug in the client) will lead to unbound memory usage in # the query buffer. However you can configure it here if you have very special # needs, such us huge multi/exec requests or alike. # # client-query-buffer-limit 1gb # In the Redis protocol, bulk requests, that are, elements representing single # strings, are normally limited ot 512 mb. However you can change this limit # here. # # proto-max-bulk-len 512mb # Redis calls an internal function to perform many background tasks, like # closing connections of clients in timeout, purging expired keys that are # never requested, and so forth. # # Not all tasks are performed with the same frequency, but Redis checks for # tasks to perform according to the specified "hz" value. # # By default "hz" is set to 10. Raising the value will use more CPU when # Redis is idle, but at the same time will make Redis more responsive when # there are many keys expiring at the same time, and timeouts may be # handled with more precision. # # The range is between 1 and 500, however a value over 100 is usually not # a good idea. Most users should use the default of 10 and raise this up to # 100 only in environments where very low latency is required. hz 10 # When a child rewrites the AOF file, if the following option is enabled # the file will be fsync-ed every 32 MB of data generated. This is useful # in order to commit the file to the disk more incrementally and avoid # big latency spikes. aof-rewrite-incremental-fsync yes # Redis LFU eviction (see maxmemory setting) can be tuned. However it is a good # idea to start with the default settings and only change them after investigating # how to improve the performances and how the keys LFU change over time, which # is possible to inspect via the OBJECT FREQ command. # # There are two tunable parameters in the Redis LFU implementation: the # counter logarithm factor and the counter decay time. It is important to # understand what the two parameters mean before changing them. # # The LFU counter is just 8 bits per key, it's maximum value is 255, so Redis # uses a probabilistic increment with logarithmic behavior. Given the value # of the old counter, when a key is accessed, the counter is incremented in # this way: # # 1. A random number R between 0 and 1 is extracted. # 2. A probability P is calculated as 1/(old_value*lfu_log_factor+1). # 3. The counter is incremented only if R < P. # # The default lfu-log-factor is 10. This is a table of how the frequency # counter changes with a different number of accesses with different # logarithmic factors: # # +--------+------------+------------+------------+------------+------------+ # | factor | 100 hits | 1000 hits | 100K hits | 1M hits | 10M hits | # +--------+------------+------------+------------+------------+------------+ # | 0 | 104 | 255 | 255 | 255 | 255 | # +--------+------------+------------+------------+------------+------------+ # | 1 | 18 | 49 | 255 | 255 | 255 | # +--------+------------+------------+------------+------------+------------+ # | 10 | 10 | 18 | 142 | 255 | 255 | # +--------+------------+------------+------------+------------+------------+ # | 100 | 8 | 11 | 49 | 143 | 255 | # +--------+------------+------------+------------+------------+------------+ # # NOTE: The above table was obtained by running the following commands: # # redis-benchmark -n 1000000 incr foo # redis-cli object freq foo # # NOTE 2: The counter initial value is 5 in order to give new objects a chance # to accumulate hits. # # The counter decay time is the time, in minutes, that must elapse in order # for the key counter to be divided by two (or decremented if it has a value # less <= 10). # # The default value for the lfu-decay-time is 1. A Special value of 0 means to # decay the counter every time it happens to be scanned. # # lfu-log-factor 10 # lfu-decay-time 1 ########################### ACTIVE DEFRAGMENTATION ####################### # # WARNING THIS FEATURE IS EXPERIMENTAL. However it was stress tested # even in production and manually tested by multiple engineers for some # time. # # What is active defragmentation? # ------------------------------- # # Active (online) defragmentation allows a Redis server to compact the # spaces left between small allocations and deallocations of data in memory, # thus allowing to reclaim back memory. # # Fragmentation is a natural process that happens with every allocator (but # less so with Jemalloc, fortunately) and certain workloads. Normally a server # restart is needed in order to lower the fragmentation, or at least to flush # away all the data and create it again. However thanks to this feature # implemented by Oran Agra for Redis 4.0 this process can happen at runtime # in an "hot" way, while the server is running. # # Basically when the fragmentation is over a certain level (see the # configuration options below) Redis will start to create new copies of the # values in contiguous memory regions by exploiting certain specific Jemalloc # features (in order to understand if an allocation is causing fragmentation # and to allocate it in a better place), and at the same time, will release the # old copies of the data. This process, repeated incrementally for all the keys # will cause the fragmentation to drop back to normal values. # # Important things to understand: # # 1. This feature is disabled by default, and only works if you compiled Redis # to use the copy of Jemalloc we ship with the source code of Redis. # This is the default with Linux builds. # # 2. You never need to enable this feature if you don't have fragmentation # issues. # # 3. Once you experience fragmentation, you can enable this feature when # needed with the command "CONFIG SET activedefrag yes". # # The configuration parameters are able to fine tune the behavior of the # defragmentation process. If you are not sure about what they mean it is # a good idea to leave the defaults untouched. # Enabled active defragmentation # activedefrag yes # Minimum amount of fragmentation waste to start active defrag # active-defrag-ignore-bytes 100mb # Minimum percentage of fragmentation to start active defrag # active-defrag-threshold-lower 10 # Maximum percentage of fragmentation at which we use maximum effort # active-defrag-threshold-upper 100 # Minimal effort for defrag in CPU percentage # active-defrag-cycle-min 25 # Maximal effort for defrag in CPU percentage # active-defrag-cycle-max 75 ================================================ FILE: aegir/conf/redis/redis5.conf ================================================ # Redis configuration file example. # # Note that in order to read the configuration file, Redis must be # started with the file path as first argument: # # ./redis-server /path/to/redis.conf # Note on units: when memory size is needed, it is possible to specify # it in the usual form of 1k 5GB 4M and so forth: # # 1k => 1000 bytes # 1kb => 1024 bytes # 1m => 1000000 bytes # 1mb => 1024*1024 bytes # 1g => 1000000000 bytes # 1gb => 1024*1024*1024 bytes # # units are case insensitive so 1GB 1Gb 1gB are all the same. ################################## INCLUDES ################################### # Include one or more other config files here. This is useful if you # have a standard template that goes to all Redis servers but also need # to customize a few per-server settings. Include files can include # other files, so use this wisely. # # Notice option "include" won't be rewritten by command "CONFIG REWRITE" # from admin or Redis Sentinel. Since Redis always uses the last processed # line as value of a configuration directive, you'd better put includes # at the beginning of this file to avoid overwriting config change at runtime. # # If instead you are interested in using includes to override configuration # options, it is better to use include as the last line. # # include /path/to/local.conf # include /path/to/other.conf ################################## MODULES ##################################### # Load modules at startup. If the server is not able to load modules # it will abort. It is possible to use multiple loadmodule directives. # # loadmodule /path/to/my_module.so # loadmodule /path/to/other_module.so ################################## NETWORK ##################################### # By default, if no "bind" configuration directive is specified, Redis listens # for connections from all the network interfaces available on the server. # It is possible to listen to just one or multiple selected interfaces using # the "bind" configuration directive, followed by one or more IP addresses. # # Examples: # # xbind 192.168.1.100 10.0.0.1 # xbind 127.0.0.1 ::1 # # ~~~ WARNING ~~~ If the computer running Redis is directly exposed to the # internet, binding to all the interfaces is dangerous and will expose the # instance to everybody on the internet. So by default we uncomment the # following bind directive, that will force Redis to listen only into # the IPv4 loopback interface address (this means Redis will be able to # accept connections only from clients running into the same computer it # is running). # # IF YOU ARE SURE YOU WANT YOUR INSTANCE TO LISTEN TO ALL THE INTERFACES # JUST COMMENT THE FOLLOWING LINE. # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ bind 127.0.0.1 # Protected mode is a layer of security protection, in order to avoid that # Redis instances left open on the internet are accessed and exploited. # # When protected mode is on and if: # # 1) The server is not binding explicitly to a set of addresses using the # "bind" directive. # 2) No password is configured. # # The server only accepts connections from clients connecting from the # IPv4 and IPv6 loopback addresses 127.0.0.1 and ::1, and from Unix domain # sockets. # # By default protected mode is enabled. You should disable it only if # you are sure you want clients from other hosts to connect to Redis # even if no authentication is configured, nor a specific set of interfaces # are explicitly listed using the "bind" directive. protected-mode no # Accept connections on the specified port, default is 6379 (IANA #815344). # If port 0 is specified Redis will not listen on a TCP socket. port 6379 # TCP listen() backlog. # # In high requests-per-second environments you need an high backlog in order # to avoid slow clients connections issues. Note that the Linux kernel # will silently truncate it to the value of /proc/sys/net/core/somaxconn so # make sure to raise both the value of somaxconn and tcp_max_syn_backlog # in order to get the desired effect. tcp-backlog 511 # Unix socket. # # Specify the path for the Unix socket that will be used to listen for # incoming connections. There is no default, so Redis will not listen # on a unix socket when not specified. # # unixsocket /run/redis/redis.sock # unixsocketperm 777 # Close the connection after a client is idle for N seconds (0 to disable) timeout 3600 # TCP keepalive. # # If non-zero, use SO_KEEPALIVE to send TCP ACKs to clients in absence # of communication. This is useful for two reasons: # # 1) Detect dead peers. # 2) Take the connection alive from the point of view of network # equipment in the middle. # # On Linux, the specified value (in seconds) is the period used to send ACKs. # Note that to close the connection the double of the time is needed. # On other kernels the period depends on the kernel configuration. # # A reasonable value for this option is 300 seconds, which is the new # Redis default starting with Redis 3.2.1. tcp-keepalive 300 ################################# GENERAL ##################################### # By default Redis does not run as a daemon. Use 'yes' if you need it. # Note that Redis will write a pid file in /run/redis.pid when daemonized. daemonize yes # If you run Redis from upstart or systemd, Redis can interact with your # supervision tree. Options: # supervised no - no supervision interaction # supervised upstart - signal upstart by putting Redis into SIGSTOP mode # supervised systemd - signal systemd by writing READY=1 to $NOTIFY_SOCKET # supervised auto - detect upstart or systemd method based on # UPSTART_JOB or NOTIFY_SOCKET environment variables # Note: these supervision methods only signal "process is ready." # They do not enable continuous liveness pings back to your supervisor. supervised no # If a pid file is specified, Redis writes it where specified at startup # and removes it at exit. # # When the server runs non daemonized, no pid file is created if none is # specified in the configuration. When the server is daemonized, the pid file # is used even if not specified, defaulting to "/run/redis.pid". # # Creating a pid file is best effort: if Redis is not able to create it # nothing bad happens, the server will start and run normally. pidfile /run/redis/redis.pid # Specify the server verbosity level. # This can be one of: # debug (a lot of information, useful for development/testing) # verbose (many rarely useful info, but not a mess like the debug level) # notice (moderately verbose, what you want in production probably) # warning (only very important / critical messages are logged) loglevel warning # Specify the log file name. Also the empty string can be used to force # Redis to log on the standard output. Note that if you use standard # output for logging but daemonize, logs will be sent to /dev/null logfile /var/log/redis/redis-server.log # To enable logging to the system logger, just set 'syslog-enabled' to yes, # and optionally update the other syslog parameters to suit your needs. # syslog-enabled no # Specify the syslog identity. # syslog-ident redis # Specify the syslog facility. Must be USER or between LOCAL0-LOCAL7. # syslog-facility local0 # Set the number of databases. The default database is DB 0, you can select # a different one on a per-connection basis using SELECT where # dbid is a number between 0 and 'databases'-1 databases 8 # By default Redis shows an ASCII art logo only when started to log to the # standard output and if the standard output is a TTY. Basically this means # that normally a logo is displayed only in interactive sessions. # # However it is possible to force the pre-4.0 behavior and always show a # ASCII art logo in startup logs by setting the following option to yes. always-show-logo yes ################################ SNAPSHOTTING ################################ # # Save the DB on disk: # # save # # Will save the DB if both the given number of seconds and the given # number of write operations against the DB occurred. # # In the example below the behaviour will be to save: # after 900 sec (15 min) if at least 1 key changed # after 300 sec (5 min) if at least 10 keys changed # after 60 sec if at least 10000 keys changed # # Note: you can disable saving completely by commenting out all "save" lines. # # It is also possible to remove all the previously configured save # points by adding a save directive with a single empty string argument # like in the following example: # # save "" # save 900 1 # save 300 10 # save 60 10000 # By default Redis will stop accepting writes if RDB snapshots are enabled # (at least one save point) and the latest background save failed. # This will make the user aware (in a hard way) that data is not persisting # on disk properly, otherwise chances are that no one will notice and some # disaster will happen. # # If the background saving process will start working again Redis will # automatically allow writes again. # # However if you have setup your proper monitoring of the Redis server # and persistence, you may want to disable this feature so that Redis will # continue to work as usual even if there are problems with disk, # permissions, and so forth. stop-writes-on-bgsave-error no # Compress string objects using LZF when dump .rdb databases? # For default that's set to 'yes' as it's almost always a win. # If you want to save some CPU in the saving child set it to 'no' but # the dataset will likely be bigger if you have compressible values or keys. rdbcompression yes # Since version 5 of RDB a CRC64 checksum is placed at the end of the file. # This makes the format more resistant to corruption but there is a performance # hit to pay (around 10%) when saving and loading RDB files, so you can disable it # for maximum performances. # # RDB files created with checksum disabled have a checksum of zero that will # tell the loading code to skip the check. rdbchecksum no # The filename where to dump the DB dbfilename dump.rdb # The working directory. # # The DB will be written inside this directory, with the filename specified # above using the 'dbfilename' configuration directive. # # The Append Only File will also be created inside this directory. # # Note that you must specify a directory here, not a file name. dir /var/lib/redis/ ################################# REPLICATION ################################# # Master-Replica replication. Use replicaof to make a Redis instance a copy of # another Redis server. A few things to understand ASAP about Redis replication. # # +------------------+ +---------------+ # | Master | ---> | Replica | # | (receive writes) | | (exact copy) | # +------------------+ +---------------+ # # 1) Redis replication is asynchronous, but you can configure a master to # stop accepting writes if it appears to be not connected with at least # a given number of replicas. # 2) Redis replicas are able to perform a partial resynchronization with the # master if the replication link is lost for a relatively small amount of # time. You may want to configure the replication backlog size (see the next # sections of this file) with a sensible value depending on your needs. # 3) Replication is automatic and does not need user intervention. After a # network partition replicas automatically try to reconnect to masters # and resynchronize with them. # # replicaof # If the master is password protected (using the "requirepass" configuration # directive below) it is possible to tell the replica to authenticate before # starting the replication synchronization process, otherwise the master will # refuse the replica request. # # masterauth # When a replica loses its connection with the master, or when the replication # is still in progress, the replica can act in two different ways: # # 1) if replica-serve-stale-data is set to 'yes' (the default) the replica will # still reply to client requests, possibly with out of date data, or the # data set may just be empty if this is the first synchronization. # # 2) if replica-serve-stale-data is set to 'no' the replica will reply with # an error "SYNC with master in progress" to all the kind of commands # but to INFO, replicaOF, AUTH, PING, SHUTDOWN, REPLCONF, ROLE, CONFIG, # SUBSCRIBE, UNSUBSCRIBE, PSUBSCRIBE, PUNSUBSCRIBE, PUBLISH, PUBSUB, # COMMAND, POST, HOST: and LATENCY. # replica-serve-stale-data yes # You can configure a replica instance to accept writes or not. Writing against # a replica instance may be useful to store some ephemeral data (because data # written on a replica will be easily deleted after resync with the master) but # may also cause problems if clients are writing to it because of a # misconfiguration. # # Since Redis 2.6 by default replicas are read-only. # # Note: read only replicas are not designed to be exposed to untrusted clients # on the internet. It's just a protection layer against misuse of the instance. # Still a read only replica exports by default all the administrative commands # such as CONFIG, DEBUG, and so forth. To a limited extent you can improve # security of read only replicas using 'rename-command' to shadow all the # administrative / dangerous commands. replica-read-only yes # Replication SYNC strategy: disk or socket. # # ------------------------------------------------------- # WARNING: DISKLESS REPLICATION IS EXPERIMENTAL CURRENTLY # ------------------------------------------------------- # # New replicas and reconnecting replicas that are not able to continue the replication # process just receiving differences, need to do what is called a "full # synchronization". An RDB file is transmitted from the master to the replicas. # The transmission can happen in two different ways: # # 1) Disk-backed: The Redis master creates a new process that writes the RDB # file on disk. Later the file is transferred by the parent # process to the replicas incrementally. # 2) Diskless: The Redis master creates a new process that directly writes the # RDB file to replica sockets, without touching the disk at all. # # With disk-backed replication, while the RDB file is generated, more replicas # can be queued and served with the RDB file as soon as the current child producing # the RDB file finishes its work. With diskless replication instead once # the transfer starts, new replicas arriving will be queued and a new transfer # will start when the current one terminates. # # When diskless replication is used, the master waits a configurable amount of # time (in seconds) before starting the transfer in the hope that multiple replicas # will arrive and the transfer can be parallelized. # # With slow disks and fast (large bandwidth) networks, diskless replication # works better. repl-diskless-sync no # When diskless replication is enabled, it is possible to configure the delay # the server waits in order to spawn the child that transfers the RDB via socket # to the replicas. # # This is important since once the transfer starts, it is not possible to serve # new replicas arriving, that will be queued for the next RDB transfer, so the server # waits a delay in order to let more replicas arrive. # # The delay is specified in seconds, and by default is 5 seconds. To disable # it entirely just set it to 0 seconds and the transfer will start ASAP. repl-diskless-sync-delay 5 # Replicas send PINGs to server in a predefined interval. It's possible to change # this interval with the repl_ping_replica_period option. The default value is 10 # seconds. # # repl-ping-replica-period 10 # The following option sets the replication timeout for: # # 1) Bulk transfer I/O during SYNC, from the point of view of replica. # 2) Master timeout from the point of view of replicas (data, pings). # 3) Replica timeout from the point of view of masters (REPLCONF ACK pings). # # It is important to make sure that this value is greater than the value # specified for repl-ping-replica-period otherwise a timeout will be detected # every time there is low traffic between the master and the replica. # # repl-timeout 60 # Disable TCP_NODELAY on the replica socket after SYNC? # # If you select "yes" Redis will use a smaller number of TCP packets and # less bandwidth to send data to replicas. But this can add a delay for # the data to appear on the replica side, up to 40 milliseconds with # Linux kernels using a default configuration. # # If you select "no" the delay for data to appear on the replica side will # be reduced but more bandwidth will be used for replication. # # By default we optimize for low latency, but in very high traffic conditions # or when the master and replicas are many hops away, turning this to "yes" may # be a good idea. repl-disable-tcp-nodelay no # Set the replication backlog size. The backlog is a buffer that accumulates # replica data when replicas are disconnected for some time, so that when a replica # wants to reconnect again, often a full resync is not needed, but a partial # resync is enough, just passing the portion of data the replica missed while # disconnected. # # The bigger the replication backlog, the longer the time the replica can be # disconnected and later be able to perform a partial resynchronization. # # The backlog is only allocated once there is at least a replica connected. # # repl-backlog-size 1mb # After a master has no longer connected replicas for some time, the backlog # will be freed. The following option configures the amount of seconds that # need to elapse, starting from the time the last replica disconnected, for # the backlog buffer to be freed. # # Note that replicas never free the backlog for timeout, since they may be # promoted to masters later, and should be able to correctly "partially # resynchronize" with the replicas: hence they should always accumulate backlog. # # A value of 0 means to never release the backlog. # # repl-backlog-ttl 3600 # The replica priority is an integer number published by Redis in the INFO output. # It is used by Redis Sentinel in order to select a replica to promote into a # master if the master is no longer working correctly. # # A replica with a low priority number is considered better for promotion, so # for instance if there are three replicas with priority 10, 100, 25 Sentinel will # pick the one with priority 10, that is the lowest. # # However a special priority of 0 marks the replica as not able to perform the # role of master, so a replica with priority of 0 will never be selected by # Redis Sentinel for promotion. # # By default the priority is 100. replica-priority 100 # It is possible for a master to stop accepting writes if there are less than # N replicas connected, having a lag less or equal than M seconds. # # The N replicas need to be in "online" state. # # The lag in seconds, that must be <= the specified value, is calculated from # the last ping received from the replica, that is usually sent every second. # # This option does not GUARANTEE that N replicas will accept the write, but # will limit the window of exposure for lost writes in case not enough replicas # are available, to the specified number of seconds. # # For example to require at least 3 replicas with a lag <= 10 seconds use: # # min-replicas-to-write 3 # min-replicas-max-lag 10 # # Setting one or the other to 0 disables the feature. # # By default min-replicas-to-write is set to 0 (feature disabled) and # min-replicas-max-lag is set to 10. # A Redis master is able to list the address and port of the attached # replicas in different ways. For example the "INFO replication" section # offers this information, which is used, among other tools, by # Redis Sentinel in order to discover replica instances. # Another place where this info is available is in the output of the # "ROLE" command of a master. # # The listed IP and address normally reported by a replica is obtained # in the following way: # # IP: The address is auto detected by checking the peer address # of the socket used by the replica to connect with the master. # # Port: The port is communicated by the replica during the replication # handshake, and is normally the port that the replica is using to # listen for connections. # # However when port forwarding or Network Address Translation (NAT) is # used, the replica may be actually reachable via different IP and port # pairs. The following two options can be used by a replica in order to # report to its master a specific set of IP and port, so that both INFO # and ROLE will report those values. # # There is no need to use both the options if you need to override just # the port or the IP address. # # replica-announce-ip 5.5.5.5 # replica-announce-port 1234 ################################## SECURITY ################################### # Require clients to issue AUTH before processing any other # commands. This might be useful in environments in which you do not trust # others with access to the host running redis-server. # # This should stay commented out for backward compatibility and because most # people do not need auth (e.g. they run their own servers). # # Warning: since Redis is pretty fast an outside user can try up to # 150k passwords per second against a good box. This means that you should # use a very strong password otherwise it will be very easy to break. # # requirepass isfoobared # Command renaming. # # It is possible to change the name of dangerous commands in a shared # environment. For instance the CONFIG command may be renamed into something # hard to guess so that it will still be available for internal-use tools # but not available for general clients. # # Example: # # rename-command CONFIG b840fc02d524045429941cc15f59e41cb7be6c52 # # It is also possible to completely kill a command by renaming it into # an empty string: # # rename-command CONFIG "" # # Please note that changing the name of commands that are logged into the # AOF file or transmitted to replicas may cause problems. ################################### CLIENTS #################################### # Set the max number of connected clients at the same time. By default # this limit is set to 10000 clients, however if the Redis server is not # able to configure the process file limit to allow for the specified limit # the max number of allowed clients is set to the current file limit # minus 32 (as Redis reserves a few file descriptors for internal uses). # # Once the limit is reached Redis will close all the new connections sending # an error 'max number of clients reached'. # maxclients 4000 ############################## MEMORY MANAGEMENT ################################ # Set a memory usage limit to the specified amount of bytes. # When the memory limit is reached Redis will try to remove keys # according to the eviction policy selected (see maxmemory-policy). # # If Redis can't remove keys according to the policy, or if the policy is # set to 'noeviction', Redis will start to reply with errors to commands # that would use more memory, like SET, LPUSH, and so on, and will continue # to reply to read-only commands like GET. # # This option is usually useful when using Redis as an LRU or LFU cache, or to # set a hard memory limit for an instance (using the 'noeviction' policy). # # WARNING: If you have replicas attached to an instance with maxmemory on, # the size of the output buffers needed to feed the replicas are subtracted # from the used memory count, so that network problems / resyncs will # not trigger a loop where keys are evicted, and in turn the output # buffer of replicas is full with DELs of keys evicted triggering the deletion # of more keys, and so forth until the database is completely emptied. # # In short... if you have replicas attached it is suggested that you set a lower # limit for maxmemory so that there is some free RAM on the system for replica # output buffers (but this is not needed if the policy is 'noeviction'). # maxmemory 88MB # MAXMEMORY POLICY: how Redis will select what to remove when maxmemory # is reached. You can select among five behaviors: # # volatile-lru -> Evict using approximated LRU among the keys with an expire set. # allkeys-lru -> Evict any key using approximated LRU. # volatile-lfu -> Evict using approximated LFU among the keys with an expire set. # allkeys-lfu -> Evict any key using approximated LFU. # volatile-random -> Remove a random key among the ones with an expire set. # allkeys-random -> Remove a random key, any key. # volatile-ttl -> Remove the key with the nearest expire time (minor TTL) # noeviction -> Don't evict anything, just return an error on write operations. # # LRU means Least Recently Used # LFU means Least Frequently Used # # Both LRU, LFU and volatile-ttl are implemented using approximated # randomized algorithms. # # Note: with any of the above policies, Redis will return an error on write # operations, when there are no suitable keys for eviction. # # At the date of writing these commands are: set setnx setex append # incr decr rpush lpush rpushx lpushx linsert lset rpoplpush sadd # sinter sinterstore sunion sunionstore sdiff sdiffstore zadd zincrby # zunionstore zinterstore hset hsetnx hmset hincrby incrby decrby # getset mset msetnx exec sort # # The default is: noeviction # maxmemory-policy allkeys-lru # LRU, LFU and minimal TTL algorithms are not precise algorithms but approximated # algorithms (in order to save memory), so you can tune it for speed or # accuracy. For default Redis will check five keys and pick the one that was # used less recently, you can change the sample size using the following # configuration directive. # # The default of 5 produces good enough results. 10 Approximates very closely # true LRU but costs more CPU. 3 is faster but not very accurate. # # maxmemory-samples 5 # Starting from Redis 5, by default a replica will ignore its maxmemory setting # (unless it is promoted to master after a failover or manually). It means # that the eviction of keys will be just handled by the master, sending the # DEL commands to the replica as keys evict in the master side. # # This behavior ensures that masters and replicas stay consistent, and is usually # what you want, however if your replica is writable, or you want the replica to have # a different memory setting, and you are sure all the writes performed to the # replica are idempotent, then you may change this default (but be sure to understand # what you are doing). # # Note that since the replica by default does not evict, it may end using more # memory than the one set via maxmemory (there are certain buffers that may # be larger on the replica, or data structures may sometimes take more memory and so # forth). So make sure you monitor your replicas and make sure they have enough # memory to never hit a real out-of-memory condition before the master hits # the configured maxmemory setting. # # replica-ignore-maxmemory yes ############################# LAZY FREEING #################################### # Redis has two primitives to delete keys. One is called DEL and is a blocking # deletion of the object. It means that the server stops processing new commands # in order to reclaim all the memory associated with an object in a synchronous # way. If the key deleted is associated with a small object, the time needed # in order to execute the DEL command is very small and comparable to most other # O(1) or O(log_N) commands in Redis. However if the key is associated with an # aggregated value containing millions of elements, the server can block for # a long time (even seconds) in order to complete the operation. # # For the above reasons Redis also offers non blocking deletion primitives # such as UNLINK (non blocking DEL) and the ASYNC option of FLUSHALL and # FLUSHDB commands, in order to reclaim memory in background. Those commands # are executed in constant time. Another thread will incrementally free the # object in the background as fast as possible. # # DEL, UNLINK and ASYNC option of FLUSHALL and FLUSHDB are user-controlled. # It's up to the design of the application to understand when it is a good # idea to use one or the other. However the Redis server sometimes has to # delete keys or flush the whole database as a side effect of other operations. # Specifically Redis deletes objects independently of a user call in the # following scenarios: # # 1) On eviction, because of the maxmemory and maxmemory policy configurations, # in order to make room for new data, without going over the specified # memory limit. # 2) Because of expire: when a key with an associated time to live (see the # EXPIRE command) must be deleted from memory. # 3) Because of a side effect of a command that stores data on a key that may # already exist. For example the RENAME command may delete the old key # content when it is replaced with another one. Similarly SUNIONSTORE # or SORT with STORE option may delete existing keys. The SET command # itself removes any old content of the specified key in order to replace # it with the specified string. # 4) During replication, when a replica performs a full resynchronization with # its master, the content of the whole database is removed in order to # load the RDB file just transferred. # # In all the above cases the default is to delete objects in a blocking way, # like if DEL was called. However you can configure each case specifically # in order to instead release memory in a non-blocking way like if UNLINK # was called, using the following configuration directives: lazyfree-lazy-eviction yes lazyfree-lazy-expire yes lazyfree-lazy-server-del yes replica-lazy-flush yes ############################## APPEND ONLY MODE ############################### # By default Redis asynchronously dumps the dataset on disk. This mode is # good enough in many applications, but an issue with the Redis process or # a power outage may result into a few minutes of writes lost (depending on # the configured save points). # # The Append Only File is an alternative persistence mode that provides # much better durability. For instance using the default data fsync policy # (see later in the config file) Redis can lose just one second of writes in a # dramatic event like a server power outage, or a single write if something # wrong with the Redis process itself happens, but the operating system is # still running correctly. # # AOF and RDB persistence can be enabled at the same time without problems. # If the AOF is enabled on startup Redis will load the AOF, that is the file # with the better durability guarantees. # # Please check http://redis.io/topics/persistence for more information. appendonly no # The name of the append only file (default: "appendonly.aof") appendfilename "appendonly.aof" # The fsync() call tells the Operating System to actually write data on disk # instead of waiting for more data in the output buffer. Some OS will really flush # data on disk, some other OS will just try to do it ASAP. # # Redis supports three different modes: # # no: don't fsync, just let the OS flush the data when it wants. Faster. # always: fsync after every write to the append only log. Slow, Safest. # everysec: fsync only one time every second. Compromise. # # The default is "everysec", as that's usually the right compromise between # speed and data safety. It's up to you to understand if you can relax this to # "no" that will let the operating system flush the output buffer when # it wants, for better performances (but if you can live with the idea of # some data loss consider the default persistence mode that's snapshotting), # or on the contrary, use "always" that's very slow but a bit safer than # everysec. # # More details please check the following article: # http://antirez.com/post/redis-persistence-demystified.html # # If unsure, use "everysec". # appendfsync always appendfsync everysec # appendfsync no # When the AOF fsync policy is set to always or everysec, and a background # saving process (a background save or AOF log background rewriting) is # performing a lot of I/O against the disk, in some Linux configurations # Redis may block too long on the fsync() call. Note that there is no fix for # this currently, as even performing fsync in a different thread will block # our synchronous write(2) call. # # In order to mitigate this problem it's possible to use the following option # that will prevent fsync() from being called in the main process while a # BGSAVE or BGREWRITEAOF is in progress. # # This means that while another child is saving, the durability of Redis is # the same as "appendfsync none". In practical terms, this means that it is # possible to lose up to 30 seconds of log in the worst scenario (with the # default Linux settings). # # If you have latency problems turn this to "yes". Otherwise leave it as # "no" that is the safest pick from the point of view of durability. no-appendfsync-on-rewrite no # Automatic rewrite of the append only file. # Redis is able to automatically rewrite the log file implicitly calling # BGREWRITEAOF when the AOF log size grows by the specified percentage. # # This is how it works: Redis remembers the size of the AOF file after the # latest rewrite (if no rewrite has happened since the restart, the size of # the AOF at startup is used). # # This base size is compared to the current size. If the current size is # bigger than the specified percentage, the rewrite is triggered. Also # you need to specify a minimal size for the AOF file to be rewritten, this # is useful to avoid rewriting the AOF file even if the percentage increase # is reached but it is still pretty small. # # Specify a percentage of zero in order to disable the automatic AOF # rewrite feature. auto-aof-rewrite-percentage 100 auto-aof-rewrite-min-size 64mb # An AOF file may be found to be truncated at the end during the Redis # startup process, when the AOF data gets loaded back into memory. # This may happen when the system where Redis is running # crashes, especially when an ext4 filesystem is mounted without the # data=ordered option (however this can't happen when Redis itself # crashes or aborts but the operating system still works correctly). # # Redis can either exit with an error when this happens, or load as much # data as possible (the default now) and start if the AOF file is found # to be truncated at the end. The following option controls this behavior. # # If aof-load-truncated is set to yes, a truncated AOF file is loaded and # the Redis server starts emitting a log to inform the user of the event. # Otherwise if the option is set to no, the server aborts with an error # and refuses to start. When the option is set to no, the user requires # to fix the AOF file using the "redis-check-aof" utility before to restart # the server. # # Note that if the AOF file will be found to be corrupted in the middle # the server will still exit with an error. This option only applies when # Redis will try to read more data from the AOF file but not enough bytes # will be found. aof-load-truncated yes # When rewriting the AOF file, Redis is able to use an RDB preamble in the # AOF file for faster rewrites and recoveries. When this option is turned # on the rewritten AOF file is composed of two different stanzas: # # [RDB file][AOF tail] # # When loading Redis recognizes that the AOF file starts with the "REDIS" # string and loads the prefixed RDB file, and continues loading the AOF # tail. aof-use-rdb-preamble yes ################################ LUA SCRIPTING ############################### # Max execution time of a Lua script in milliseconds. # # If the maximum execution time is reached Redis will log that a script is # still in execution after the maximum allowed time and will start to # reply to queries with an error. # # When a long running script exceeds the maximum execution time only the # SCRIPT KILL and SHUTDOWN NOSAVE commands are available. The first can be # used to stop a script that did not yet called write commands. The second # is the only way to shut down the server in the case a write command was # already issued by the script but the user doesn't want to wait for the natural # termination of the script. # # Set it to 0 or a negative value for unlimited execution without warnings. lua-time-limit 5000 ################################ REDIS CLUSTER ############################### # Normal Redis instances can't be part of a Redis Cluster; only nodes that are # started as cluster nodes can. In order to start a Redis instance as a # cluster node enable the cluster support uncommenting the following: # # cluster-enabled yes # Every cluster node has a cluster configuration file. This file is not # intended to be edited by hand. It is created and updated by Redis nodes. # Every Redis Cluster node requires a different cluster configuration file. # Make sure that instances running in the same system do not have # overlapping cluster configuration file names. # # cluster-config-file nodes-6379.conf # Cluster node timeout is the amount of milliseconds a node must be unreachable # for it to be considered in failure state. # Most other internal time limits are multiple of the node timeout. # # cluster-node-timeout 15000 # A replica of a failing master will avoid to start a failover if its data # looks too old. # # There is no simple way for a replica to actually have an exact measure of # its "data age", so the following two checks are performed: # # 1) If there are multiple replicas able to failover, they exchange messages # in order to try to give an advantage to the replica with the best # replication offset (more data from the master processed). # Replicas will try to get their rank by offset, and apply to the start # of the failover a delay proportional to their rank. # # 2) Every single replica computes the time of the last interaction with # its master. This can be the last ping or command received (if the master # is still in the "connected" state), or the time that elapsed since the # disconnection with the master (if the replication link is currently down). # If the last interaction is too old, the replica will not try to failover # at all. # # The point "2" can be tuned by user. Specifically a replica will not perform # the failover if, since the last interaction with the master, the time # elapsed is greater than: # # (node-timeout * replica-validity-factor) + repl-ping-replica-period # # So for example if node-timeout is 30 seconds, and the replica-validity-factor # is 10, and assuming a default repl-ping-replica-period of 10 seconds, the # replica will not try to failover if it was not able to talk with the master # for longer than 310 seconds. # # A large replica-validity-factor may allow replicas with too old data to failover # a master, while a too small value may prevent the cluster from being able to # elect a replica at all. # # For maximum availability, it is possible to set the replica-validity-factor # to a value of 0, which means, that replicas will always try to failover the # master regardless of the last time they interacted with the master. # (However they'll always try to apply a delay proportional to their # offset rank). # # Zero is the only value able to guarantee that when all the partitions heal # the cluster will always be able to continue. # # cluster-replica-validity-factor 10 # Cluster replicas are able to migrate to orphaned masters, that are masters # that are left without working replicas. This improves the cluster ability # to resist to failures as otherwise an orphaned master can't be failed over # in case of failure if it has no working replicas. # # Replicas migrate to orphaned masters only if there are still at least a # given number of other working replicas for their old master. This number # is the "migration barrier". A migration barrier of 1 means that a replica # will migrate only if there is at least 1 other working replica for its master # and so forth. It usually reflects the number of replicas you want for every # master in your cluster. # # Default is 1 (replicas migrate only if their masters remain with at least # one replica). To disable migration just set it to a very large value. # A value of 0 can be set but is useful only for debugging and dangerous # in production. # # cluster-migration-barrier 1 # By default Redis Cluster nodes stop accepting queries if they detect there # is at least an hash slot uncovered (no available node is serving it). # This way if the cluster is partially down (for example a range of hash slots # are no longer covered) all the cluster becomes, eventually, unavailable. # It automatically returns available as soon as all the slots are covered again. # # However sometimes you want the subset of the cluster which is working, # to continue to accept queries for the part of the key space that is still # covered. In order to do so, just set the cluster-require-full-coverage # option to no. # # cluster-require-full-coverage yes # This option, when set to yes, prevents replicas from trying to failover its # master during master failures. However the master can still perform a # manual failover, if forced to do so. # # This is useful in different scenarios, especially in the case of multiple # data center operations, where we want one side to never be promoted if not # in the case of a total DC failure. # # cluster-replica-no-failover no # In order to setup your cluster make sure to read the documentation # available at http://redis.io web site. ########################## CLUSTER DOCKER/NAT support ######################## # In certain deployments, Redis Cluster nodes address discovery fails, because # addresses are NAT-ted or because ports are forwarded (the typical case is # Docker and other containers). # # In order to make Redis Cluster working in such environments, a static # configuration where each node knows its public address is needed. The # following two options are used for this scope, and are: # # * cluster-announce-ip # * cluster-announce-port # * cluster-announce-bus-port # # Each instruct the node about its address, client port, and cluster message # bus port. The information is then published in the header of the bus packets # so that other nodes will be able to correctly map the address of the node # publishing the information. # # If the above options are not used, the normal Redis Cluster auto-detection # will be used instead. # # Note that when remapped, the bus port may not be at the fixed offset of # clients port + 10000, so you can specify any port and bus-port depending # on how they get remapped. If the bus-port is not set, a fixed offset of # 10000 will be used as usually. # # Example: # # cluster-announce-ip 10.1.1.5 # cluster-announce-port 6379 # cluster-announce-bus-port 6380 ################################## SLOW LOG ################################### # The Redis Slow Log is a system to log queries that exceeded a specified # execution time. The execution time does not include the I/O operations # like talking with the client, sending the reply and so forth, # but just the time needed to actually execute the command (this is the only # stage of command execution where the thread is blocked and can not serve # other requests in the meantime). # # You can configure the slow log with two parameters: one tells Redis # what is the execution time, in microseconds, to exceed in order for the # command to get logged, and the other parameter is the length of the # slow log. When a new command is logged the oldest one is removed from the # queue of logged commands. # The following time is expressed in microseconds, so 1000000 is equivalent # to one second. Note that a negative number disables the slow log, while # a value of zero forces the logging of every command. slowlog-log-slower-than 10000 # There is no limit to this length. Just be aware that it will consume memory. # You can reclaim memory used by the slow log with SLOWLOG RESET. slowlog-max-len 128 ################################ LATENCY MONITOR ############################## # The Redis latency monitoring subsystem samples different operations # at runtime in order to collect data related to possible sources of # latency of a Redis instance. # # Via the LATENCY command this information is available to the user that can # print graphs and obtain reports. # # The system only logs operations that were performed in a time equal or # greater than the amount of milliseconds specified via the # latency-monitor-threshold configuration directive. When its value is set # to zero, the latency monitor is turned off. # # By default latency monitoring is disabled since it is mostly not needed # if you don't have latency issues, and collecting data has a performance # impact, that while very small, can be measured under big load. Latency # monitoring can easily be enabled at runtime using the command # "CONFIG SET latency-monitor-threshold " if needed. latency-monitor-threshold 0 ############################# EVENT NOTIFICATION ############################## # Redis can notify Pub/Sub clients about events happening in the key space. # This feature is documented at http://redis.io/topics/notifications # # For instance if keyspace events notification is enabled, and a client # performs a DEL operation on key "foo" stored in the Database 0, two # messages will be published via Pub/Sub: # # PUBLISH __keyspace@0__:foo del # PUBLISH __keyevent@0__:del foo # # It is possible to select the events that Redis will notify among a set # of classes. Every class is identified by a single character: # # K Keyspace events, published with __keyspace@__ prefix. # E Keyevent events, published with __keyevent@__ prefix. # g Generic commands (non-type specific) like DEL, EXPIRE, RENAME, ... # $ String commands # l List commands # s Set commands # h Hash commands # z Sorted set commands # x Expired events (events generated every time a key expires) # e Evicted events (events generated when a key is evicted for maxmemory) # A Alias for g$lshzxe, so that the "AKE" string means all the events. # # The "notify-keyspace-events" takes as argument a string that is composed # of zero or multiple characters. The empty string means that notifications # are disabled. # # Example: to enable list and generic events, from the point of view of the # event name, use: # # notify-keyspace-events Elg # # Example 2: to get the stream of the expired keys subscribing to channel # name __keyevent@0__:expired use: # # notify-keyspace-events Ex # # By default all notifications are disabled because most users don't need # this feature and the feature has some overhead. Note that if you don't # specify at least one of K or E, no events will be delivered. notify-keyspace-events "" ############################### ADVANCED CONFIG ############################### # Hashes are encoded using a memory efficient data structure when they have a # small number of entries, and the biggest entry does not exceed a given # threshold. These thresholds can be configured using the following directives. hash-max-ziplist-entries 512 hash-max-ziplist-value 64 # Lists are also encoded in a special way to save a lot of space. # The number of entries allowed per internal list node can be specified # as a fixed maximum size or a maximum number of elements. # For a fixed maximum size, use -5 through -1, meaning: # -5: max size: 64 Kb <-- not recommended for normal workloads # -4: max size: 32 Kb <-- not recommended # -3: max size: 16 Kb <-- probably not recommended # -2: max size: 8 Kb <-- good # -1: max size: 4 Kb <-- good # Positive numbers mean store up to _exactly_ that number of elements # per list node. # The highest performing option is usually -2 (8 Kb size) or -1 (4 Kb size), # but if your use case is unique, adjust the settings as necessary. list-max-ziplist-size -2 # Lists may also be compressed. # Compress depth is the number of quicklist ziplist nodes from *each* side of # the list to *exclude* from compression. The head and tail of the list # are always uncompressed for fast push/pop operations. Settings are: # 0: disable all list compression # 1: depth 1 means "don't start compressing until after 1 node into the list, # going from either the head or tail" # So: [head]->node->node->...->node->[tail] # [head], [tail] will always be uncompressed; inner nodes will compress. # 2: [head]->[next]->node->node->...->node->[prev]->[tail] # 2 here means: don't compress head or head->next or tail->prev or tail, # but compress all nodes between them. # 3: [head]->[next]->[next]->node->node->...->node->[prev]->[prev]->[tail] # etc. list-compress-depth 0 # Sets have a special encoding in just one case: when a set is composed # of just strings that happen to be integers in radix 10 in the range # of 64 bit signed integers. # The following configuration setting sets the limit in the size of the # set in order to use this special memory saving encoding. set-max-intset-entries 512 # Similarly to hashes and lists, sorted sets are also specially encoded in # order to save a lot of space. This encoding is only used when the length and # elements of a sorted set are below the following limits: zset-max-ziplist-entries 128 zset-max-ziplist-value 64 # HyperLogLog sparse representation bytes limit. The limit includes the # 16 bytes header. When an HyperLogLog using the sparse representation crosses # this limit, it is converted into the dense representation. # # A value greater than 16000 is totally useless, since at that point the # dense representation is more memory efficient. # # The suggested value is ~ 3000 in order to have the benefits of # the space efficient encoding without slowing down too much PFADD, # which is O(N) with the sparse encoding. The value can be raised to # ~ 10000 when CPU is not a concern, but space is, and the data set is # composed of many HyperLogLogs with cardinality in the 0 - 15000 range. hll-sparse-max-bytes 3000 # Streams macro node max size / items. The stream data structure is a radix # tree of big nodes that encode multiple items inside. Using this configuration # it is possible to configure how big a single node can be in bytes, and the # maximum number of items it may contain before switching to a new node when # appending new stream entries. If any of the following settings are set to # zero, the limit is ignored, so for instance it is possible to set just a # max entires limit by setting max-bytes to 0 and max-entries to the desired # value. stream-node-max-bytes 4096 stream-node-max-entries 100 # Active rehashing uses 1 millisecond every 100 milliseconds of CPU time in # order to help rehashing the main Redis hash table (the one mapping top-level # keys to values). The hash table implementation Redis uses (see dict.c) # performs a lazy rehashing: the more operation you run into a hash table # that is rehashing, the more rehashing "steps" are performed, so if the # server is idle the rehashing is never complete and some more memory is used # by the hash table. # # The default is to use this millisecond 10 times every second in order to # actively rehash the main dictionaries, freeing memory when possible. # # If unsure: # use "activerehashing no" if you have hard latency requirements and it is # not a good thing in your environment that Redis can reply from time to time # to queries with 2 milliseconds delay. # # use "activerehashing yes" if you don't have such hard requirements but # want to free memory asap when possible. activerehashing yes # The client output buffer limits can be used to force disconnection of clients # that are not reading data from the server fast enough for some reason (a # common reason is that a Pub/Sub client can't consume messages as fast as the # publisher can produce them). # # The limit can be set differently for the three different classes of clients: # # normal -> normal clients including MONITOR clients # replica -> replica clients # pubsub -> clients subscribed to at least one pubsub channel or pattern # # The syntax of every client-output-buffer-limit directive is the following: # # client-output-buffer-limit # # A client is immediately disconnected once the hard limit is reached, or if # the soft limit is reached and remains reached for the specified number of # seconds (continuously). # So for instance if the hard limit is 32 megabytes and the soft limit is # 16 megabytes / 10 seconds, the client will get disconnected immediately # if the size of the output buffers reach 32 megabytes, but will also get # disconnected if the client reaches 16 megabytes and continuously overcomes # the limit for 10 seconds. # # By default normal clients are not limited because they don't receive data # without asking (in a push way), but just after a request, so only # asynchronous clients may create a scenario where data is requested faster # than it can read. # # Instead there is a default limit for pubsub and replica clients, since # subscribers and replicas receive data in a push fashion. # # Both the hard or the soft limit can be disabled by setting them to zero. client-output-buffer-limit normal 0 0 0 client-output-buffer-limit replica 256mb 64mb 60 client-output-buffer-limit pubsub 32mb 8mb 60 # Client query buffers accumulate new commands. They are limited to a fixed # amount by default in order to avoid that a protocol desynchronization (for # instance due to a bug in the client) will lead to unbound memory usage in # the query buffer. However you can configure it here if you have very special # needs, such us huge multi/exec requests or alike. # # client-query-buffer-limit 1gb # In the Redis protocol, bulk requests, that are, elements representing single # strings, are normally limited ot 512 mb. However you can change this limit # here. # # proto-max-bulk-len 512mb # Redis calls an internal function to perform many background tasks, like # closing connections of clients in timeout, purging expired keys that are # never requested, and so forth. # # Not all tasks are performed with the same frequency, but Redis checks for # tasks to perform according to the specified "hz" value. # # By default "hz" is set to 10. Raising the value will use more CPU when # Redis is idle, but at the same time will make Redis more responsive when # there are many keys expiring at the same time, and timeouts may be # handled with more precision. # # The range is between 1 and 500, however a value over 100 is usually not # a good idea. Most users should use the default of 10 and raise this up to # 100 only in environments where very low latency is required. hz 10 # Normally it is useful to have an HZ value which is proportional to the # number of clients connected. This is useful in order, for instance, to # avoid too many clients are processed for each background task invocation # in order to avoid latency spikes. # # Since the default HZ value by default is conservatively set to 10, Redis # offers, and enables by default, the ability to use an adaptive HZ value # which will temporary raise when there are many connected clients. # # When dynamic HZ is enabled, the actual configured HZ will be used as # as a baseline, but multiples of the configured HZ value will be actually # used as needed once more clients are connected. In this way an idle # instance will use very little CPU time while a busy instance will be # more responsive. dynamic-hz yes # When a child rewrites the AOF file, if the following option is enabled # the file will be fsync-ed every 32 MB of data generated. This is useful # in order to commit the file to the disk more incrementally and avoid # big latency spikes. aof-rewrite-incremental-fsync yes # When redis saves RDB file, if the following option is enabled # the file will be fsync-ed every 32 MB of data generated. This is useful # in order to commit the file to the disk more incrementally and avoid # big latency spikes. rdb-save-incremental-fsync yes # Redis LFU eviction (see maxmemory setting) can be tuned. However it is a good # idea to start with the default settings and only change them after investigating # how to improve the performances and how the keys LFU change over time, which # is possible to inspect via the OBJECT FREQ command. # # There are two tunable parameters in the Redis LFU implementation: the # counter logarithm factor and the counter decay time. It is important to # understand what the two parameters mean before changing them. # # The LFU counter is just 8 bits per key, it's maximum value is 255, so Redis # uses a probabilistic increment with logarithmic behavior. Given the value # of the old counter, when a key is accessed, the counter is incremented in # this way: # # 1. A random number R between 0 and 1 is extracted. # 2. A probability P is calculated as 1/(old_value*lfu_log_factor+1). # 3. The counter is incremented only if R < P. # # The default lfu-log-factor is 10. This is a table of how the frequency # counter changes with a different number of accesses with different # logarithmic factors: # # +--------+------------+------------+------------+------------+------------+ # | factor | 100 hits | 1000 hits | 100K hits | 1M hits | 10M hits | # +--------+------------+------------+------------+------------+------------+ # | 0 | 104 | 255 | 255 | 255 | 255 | # +--------+------------+------------+------------+------------+------------+ # | 1 | 18 | 49 | 255 | 255 | 255 | # +--------+------------+------------+------------+------------+------------+ # | 10 | 10 | 18 | 142 | 255 | 255 | # +--------+------------+------------+------------+------------+------------+ # | 100 | 8 | 11 | 49 | 143 | 255 | # +--------+------------+------------+------------+------------+------------+ # # NOTE: The above table was obtained by running the following commands: # # redis-benchmark -n 1000000 incr foo # redis-cli object freq foo # # NOTE 2: The counter initial value is 5 in order to give new objects a chance # to accumulate hits. # # The counter decay time is the time, in minutes, that must elapse in order # for the key counter to be divided by two (or decremented if it has a value # less <= 10). # # The default value for the lfu-decay-time is 1. A Special value of 0 means to # decay the counter every time it happens to be scanned. # # lfu-log-factor 10 # lfu-decay-time 1 ########################### ACTIVE DEFRAGMENTATION ####################### # # WARNING THIS FEATURE IS EXPERIMENTAL. However it was stress tested # even in production and manually tested by multiple engineers for some # time. # # What is active defragmentation? # ------------------------------- # # Active (online) defragmentation allows a Redis server to compact the # spaces left between small allocations and deallocations of data in memory, # thus allowing to reclaim back memory. # # Fragmentation is a natural process that happens with every allocator (but # less so with Jemalloc, fortunately) and certain workloads. Normally a server # restart is needed in order to lower the fragmentation, or at least to flush # away all the data and create it again. However thanks to this feature # implemented by Oran Agra for Redis 4.0 this process can happen at runtime # in an "hot" way, while the server is running. # # Basically when the fragmentation is over a certain level (see the # configuration options below) Redis will start to create new copies of the # values in contiguous memory regions by exploiting certain specific Jemalloc # features (in order to understand if an allocation is causing fragmentation # and to allocate it in a better place), and at the same time, will release the # old copies of the data. This process, repeated incrementally for all the keys # will cause the fragmentation to drop back to normal values. # # Important things to understand: # # 1. This feature is disabled by default, and only works if you compiled Redis # to use the copy of Jemalloc we ship with the source code of Redis. # This is the default with Linux builds. # # 2. You never need to enable this feature if you don't have fragmentation # issues. # # 3. Once you experience fragmentation, you can enable this feature when # needed with the command "CONFIG SET activedefrag yes". # # The configuration parameters are able to fine tune the behavior of the # defragmentation process. If you are not sure about what they mean it is # a good idea to leave the defaults untouched. # Enabled active defragmentation # activedefrag yes # Minimum amount of fragmentation waste to start active defrag # active-defrag-ignore-bytes 100mb # Minimum percentage of fragmentation to start active defrag # active-defrag-threshold-lower 10 # Maximum percentage of fragmentation at which we use maximum effort # active-defrag-threshold-upper 100 # Minimal effort for defrag in CPU percentage # active-defrag-cycle-min 5 # Maximal effort for defrag in CPU percentage # active-defrag-cycle-max 75 # Maximum number of set/hash/zset/list fields that will be processed from # the main dictionary scan # active-defrag-max-scan-fields 1000 ================================================ FILE: aegir/conf/redis/redis6.conf ================================================ # Redis configuration file example. # # Note that in order to read the configuration file, Redis must be # started with the file path as first argument: # # ./redis-server /path/to/redis.conf # Note on units: when memory size is needed, it is possible to specify # it in the usual form of 1k 5GB 4M and so forth: # # 1k => 1000 bytes # 1kb => 1024 bytes # 1m => 1000000 bytes # 1mb => 1024*1024 bytes # 1g => 1000000000 bytes # 1gb => 1024*1024*1024 bytes # # units are case insensitive so 1GB 1Gb 1gB are all the same. ################################## INCLUDES ################################### # Include one or more other config files here. This is useful if you # have a standard template that goes to all Redis servers but also need # to customize a few per-server settings. Include files can include # other files, so use this wisely. # # Note that option "include" won't be rewritten by command "CONFIG REWRITE" # from admin or Redis Sentinel. Since Redis always uses the last processed # line as value of a configuration directive, you'd better put includes # at the beginning of this file to avoid overwriting config change at runtime. # # If instead you are interested in using includes to override configuration # options, it is better to use include as the last line. # # include /path/to/local.conf # include /path/to/other.conf ################################## MODULES ##################################### # Load modules at startup. If the server is not able to load modules # it will abort. It is possible to use multiple loadmodule directives. # # loadmodule /path/to/my_module.so # loadmodule /path/to/other_module.so ################################## NETWORK ##################################### # By default, if no "bind" configuration directive is specified, Redis listens # for connections from all available network interfaces on the host machine. # It is possible to listen to just one or multiple selected interfaces using # the "bind" configuration directive, followed by one or more IP addresses. # Each address can be prefixed by "-", which means that redis will not fail to # start if the address is not available. Being not available only refers to # addresses that does not correspond to any network interfece. Addresses that # are already in use will always fail, and unsupported protocols will always BE # silently skipped. # # Examples: # # xbind 192.168.1.100 10.0.0.1 # listens on two specific IPv4 addresses # xbind 127.0.0.1 ::1 # listens on loopback IPv4 and IPv6 # xbind * -::* # like the default, all available interfaces # # ~~~ WARNING ~~~ If the computer running Redis is directly exposed to the # internet, binding to all the interfaces is dangerous and will expose the # instance to everybody on the internet. So by default we uncomment the # following bind directive, that will force Redis to listen only on the # IPv4 and IPv6 (if available) loopback interface addresses (this means Redis # will only be able to accept client connections from the same host that it is # running on). # # IF YOU ARE SURE YOU WANT YOUR INSTANCE TO LISTEN TO ALL THE INTERFACES # JUST COMMENT OUT THE FOLLOWING LINE. # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ bind 127.0.0.1 # Protected mode is a layer of security protection, in order to avoid that # Redis instances left open on the internet are accessed and exploited. # # When protected mode is on and if: # # 1) The server is not binding explicitly to a set of addresses using the # "bind" directive. # 2) No password is configured. # # The server only accepts connections from clients connecting from the # IPv4 and IPv6 loopback addresses 127.0.0.1 and ::1, and from Unix domain # sockets. # # By default protected mode is enabled. You should disable it only if # you are sure you want clients from other hosts to connect to Redis # even if no authentication is configured, nor a specific set of interfaces # are explicitly listed using the "bind" directive. protected-mode no # Accept connections on the specified port, default is 6379 (IANA #815344). # If port 0 is specified Redis will not listen on a TCP socket. port 6379 # TCP listen() backlog. # # In high requests-per-second environments you need a high backlog in order # to avoid slow clients connection issues. Note that the Linux kernel # will silently truncate it to the value of /proc/sys/net/core/somaxconn so # make sure to raise both the value of somaxconn and tcp_max_syn_backlog # in order to get the desired effect. tcp-backlog 511 # Unix socket. # # Specify the path for the Unix socket that will be used to listen for # incoming connections. There is no default, so Redis will not listen # on a unix socket when not specified. # # unixsocket /run/redis/redis.sock # unixsocketperm 777 # Close the connection after a client is idle for N seconds (0 to disable) timeout 900 # TCP keepalive. # # If non-zero, use SO_KEEPALIVE to send TCP ACKs to clients in absence # of communication. This is useful for two reasons: # # 1) Detect dead peers. # 2) Force network equipment in the middle to consider the connection to be # alive. # # On Linux, the specified value (in seconds) is the period used to send ACKs. # Note that to close the connection the double of the time is needed. # On other kernels the period depends on the kernel configuration. # # A reasonable value for this option is 300 seconds, which is the new # Redis default starting with Redis 3.2.1. tcp-keepalive 300 ################################# TLS/SSL ##################################### # By default, TLS/SSL is disabled. To enable it, the "tls-port" configuration # directive can be used to define TLS-listening ports. To enable TLS on the # default port, use: # # port 0 # tls-port 6379 # Configure a X.509 certificate and private key to use for authenticating the # server to connected clients, masters or cluster peers. These files should be # PEM formatted. # # tls-cert-file redis.crt # tls-key-file redis.key # # If the key file is encrypted using a passphrase, it can be included here # as well. # # tls-key-file-pass secret # Normally Redis uses the same certificate for both server functions (accepting # connections) and client functions (replicating from a master, establishing # cluster bus connections, etc.). # # Sometimes certificates are issued with attributes that designate them as # client-only or server-only certificates. In that case it may be desired to use # different certificates for incoming (server) and outgoing (client) # connections. To do that, use the following directives: # # tls-client-cert-file client.crt # tls-client-key-file client.key # # If the key file is encrypted using a passphrase, it can be included here # as well. # # tls-client-key-file-pass secret # Configure a DH parameters file to enable Diffie-Hellman (DH) key exchange, # required by older versions of OpenSSL (<3.0). Newer versions do not require # this configuration and recommend against it. # # tls-dh-params-file redis.dh # Configure a CA certificate(s) bundle or directory to authenticate TLS/SSL # clients and peers. Redis requires an explicit configuration of at least one # of these, and will not implicitly use the system wide configuration. # # tls-ca-cert-file ca.crt # tls-ca-cert-dir /etc/ssl/certs # By default, clients (including replica servers) on a TLS port are required # to authenticate using valid client side certificates. # # If "no" is specified, client certificates are not required and not accepted. # If "optional" is specified, client certificates are accepted and must be # valid if provided, but are not required. # # tls-auth-clients no # tls-auth-clients optional # By default, a Redis replica does not attempt to establish a TLS connection # with its master. # # Use the following directive to enable TLS on replication links. # # tls-replication yes # By default, the Redis Cluster bus uses a plain TCP connection. To enable # TLS for the bus protocol, use the following directive: # # tls-cluster yes # By default, only TLSv1.2 and TLSv1.3 are enabled and it is highly recommended # that older formally deprecated versions are kept disabled to reduce the attack surface. # You can explicitly specify TLS versions to support. # Allowed values are case insensitive and include "TLSv1", "TLSv1.1", "TLSv1.2", # "TLSv1.3" (OpenSSL >= 1.1.1) or any combination. # To enable only TLSv1.2 and TLSv1.3, use: # # tls-protocols "TLSv1.2 TLSv1.3" # Configure allowed ciphers. See the ciphers(1ssl) manpage for more information # about the syntax of this string. # # Note: this configuration applies only to <= TLSv1.2. # # tls-ciphers DEFAULT:!MEDIUM # Configure allowed TLSv1.3 ciphersuites. See the ciphers(1ssl) manpage for more # information about the syntax of this string, and specifically for TLSv1.3 # ciphersuites. # # tls-ciphersuites TLS_CHACHA20_POLY1305_SHA256 # When choosing a cipher, use the server's preference instead of the client # preference. By default, the server follows the client's preference. # # tls-prefer-server-ciphers yes # By default, TLS session caching is enabled to allow faster and less expensive # reconnections by clients that support it. Use the following directive to disable # caching. # # tls-session-caching no # Change the default number of TLS sessions cached. A zero value sets the cache # to unlimited size. The default size is 20480. # # tls-session-cache-size 5000 # Change the default timeout of cached TLS sessions. The default timeout is 300 # seconds. # # tls-session-cache-timeout 60 ################################# GENERAL ##################################### # By default Redis does not run as a daemon. Use 'yes' if you need it. # Note that Redis will write a pid file in /run/redis.pid when daemonized. # When Redis is supervised by upstart or systemd, this parameter has no impact. daemonize yes # If you run Redis from upstart or systemd, Redis can interact with your # supervision tree. Options: # supervised no - no supervision interaction # supervised upstart - signal upstart by putting Redis into SIGSTOP mode # requires "expect stop" in your upstart job config # supervised systemd - signal systemd by writing READY=1 to $NOTIFY_SOCKET # on startup, and updating Redis status on a regular # basis. # supervised auto - detect upstart or systemd method based on # UPSTART_JOB or NOTIFY_SOCKET environment variables # Note: these supervision methods only signal "process is ready." # They do not enable continuous pings back to your supervisor. # # The default is "no". To run under upstart/systemd, you can simply uncomment # the line below: # # supervised auto # If a pid file is specified, Redis writes it where specified at startup # and removes it at exit. # # When the server runs non daemonized, no pid file is created if none is # specified in the configuration. When the server is daemonized, the pid file # is used even if not specified, defaulting to "/run/redis.pid". # # Creating a pid file is best effort: if Redis is not able to create it # nothing bad happens, the server will start and run normally. # # Note that on modern Linux systems "/run/redis.pid" is more conforming # and should be used instead. pidfile /run/redis/redis.pid # Specify the server verbosity level. # This can be one of: # debug (a lot of information, useful for development/testing) # verbose (many rarely useful info, but not a mess like the debug level) # notice (moderately verbose, what you want in production probably) # warning (only very important / critical messages are logged) loglevel warning # Specify the log file name. Also the empty string can be used to force # Redis to log on the standard output. Note that if you use standard # output for logging but daemonize, logs will be sent to /dev/null logfile /var/log/redis/redis-server.log # To enable logging to the system logger, just set 'syslog-enabled' to yes, # and optionally update the other syslog parameters to suit your needs. # syslog-enabled no # Specify the syslog identity. # syslog-ident redis # Specify the syslog facility. Must be USER or between LOCAL0-LOCAL7. # syslog-facility local0 # To disable the built in crash log, which will possibly produce cleaner core # dumps when they are needed, uncomment the following: # # crash-log-enabled no # To disable the fast memory check that's run as part of the crash log, which # will possibly let redis terminate sooner, uncomment the following: # # crash-memcheck-enabled no # Set the number of databases. The default database is DB 0, you can select # a different one on a per-connection basis using SELECT where # dbid is a number between 0 and 'databases'-1 databases 8 # By default Redis shows an ASCII art logo only when started to log to the # standard output and if the standard output is a TTY and syslog logging is # disabled. Basically this means that normally a logo is displayed only in # interactive sessions. # # However it is possible to force the pre-4.0 behavior and always show a # ASCII art logo in startup logs by setting the following option to yes. always-show-logo no # By default, Redis modifies the process title (as seen in 'top' and 'ps') to # provide some runtime information. It is possible to disable this and leave # the process name as executed by setting the following to no. set-proc-title yes # When changing the process title, Redis uses the following template to construct # the modified title. # # Template variables are specified in curly brackets. The following variables are # supported: # # {title} Name of process as executed if parent, or type of child process. # {listen-addr} Bind address or '*' followed by TCP or TLS port listening on, or # Unix socket if only that's available. # {server-mode} Special mode, i.e. "[sentinel]" or "[cluster]". # {port} TCP port listening on, or 0. # {tls-port} TLS port listening on, or 0. # {unixsocket} Unix domain socket listening on, or "". # {config-file} Name of configuration file used. # proc-title-template "{title} {listen-addr} {server-mode}" ################################ SNAPSHOTTING ################################ # Save the DB to disk. # # save # # Redis will save the DB if both the given number of seconds and the given # number of write operations against the DB occurred. # # Snapshotting can be completely disabled with a single empty string argument # as in following example: # # save "" # # Unless specified otherwise, by default Redis will save the DB: # * After 3600 seconds (an hour) if at least 1 key changed # * After 300 seconds (5 minutes) if at least 100 keys changed # * After 60 seconds if at least 10000 keys changed # # You can set these explicitly by uncommenting the three following lines. # # save 3600 1 # save 300 100 # save 60 10000 # By default Redis will stop accepting writes if RDB snapshots are enabled # (at least one save point) and the latest background save failed. # This will make the user aware (in a hard way) that data is not persisting # on disk properly, otherwise chances are that no one will notice and some # disaster will happen. # # If the background saving process will start working again Redis will # automatically allow writes again. # # However if you have setup your proper monitoring of the Redis server # and persistence, you may want to disable this feature so that Redis will # continue to work as usual even if there are problems with disk, # permissions, and so forth. stop-writes-on-bgsave-error no # Compress string objects using LZF when dump .rdb databases? # By default compression is enabled as it's almost always a win. # If you want to save some CPU in the saving child set it to 'no' but # the dataset will likely be bigger if you have compressible values or keys. rdbcompression yes # Since version 5 of RDB a CRC64 checksum is placed at the end of the file. # This makes the format more resistant to corruption but there is a performance # hit to pay (around 10%) when saving and loading RDB files, so you can disable it # for maximum performances. # # RDB files created with checksum disabled have a checksum of zero that will # tell the loading code to skip the check. rdbchecksum no # Enables or disables full sanitation checks for ziplist and listpack etc when # loading an RDB or RESTORE payload. This reduces the chances of a assertion or # crash later on while processing commands. # Options: # no - Never perform full sanitation # yes - Always perform full sanitation # clients - Perform full sanitation only for user connections. # Excludes: RDB files, RESTORE commands received from the master # connection, and client connections which have the # skip-sanitize-payload ACL flag. # The default should be 'clients' but since it currently affects cluster # resharding via MIGRATE, it is temporarily set to 'no' by default. # # sanitize-dump-payload no # The filename where to dump the DB dbfilename dump.rdb # Remove RDB files used by replication in instances without persistence # enabled. By default this option is disabled, however there are environments # where for regulations or other security concerns, RDB files persisted on # disk by masters in order to feed replicas, or stored on disk by replicas # in order to load them for the initial synchronization, should be deleted # ASAP. Note that this option ONLY WORKS in instances that have both AOF # and RDB persistence disabled, otherwise is completely ignored. # # An alternative (and sometimes better) way to obtain the same effect is # to use diskless replication on both master and replicas instances. However # in the case of replicas, diskless is not always an option. rdb-del-sync-files no # The working directory. # # The DB will be written inside this directory, with the filename specified # above using the 'dbfilename' configuration directive. # # The Append Only File will also be created inside this directory. # # Note that you must specify a directory here, not a file name. dir /var/lib/redis/ ################################# REPLICATION ################################# # Master-Replica replication. Use replicaof to make a Redis instance a copy of # another Redis server. A few things to understand ASAP about Redis replication. # # +------------------+ +---------------+ # | Master | ---> | Replica | # | (receive writes) | | (exact copy) | # +------------------+ +---------------+ # # 1) Redis replication is asynchronous, but you can configure a master to # stop accepting writes if it appears to be not connected with at least # a given number of replicas. # 2) Redis replicas are able to perform a partial resynchronization with the # master if the replication link is lost for a relatively small amount of # time. You may want to configure the replication backlog size (see the next # sections of this file) with a sensible value depending on your needs. # 3) Replication is automatic and does not need user intervention. After a # network partition replicas automatically try to reconnect to masters # and resynchronize with them. # # replicaof # If the master is password protected (using the "requirepass" configuration # directive below) it is possible to tell the replica to authenticate before # starting the replication synchronization process, otherwise the master will # refuse the replica request. # # masterauth # # However this is not enough if you are using Redis ACLs (for Redis version # 6 or greater), and the default user is not capable of running the PSYNC # command and/or other commands needed for replication. In this case it's # better to configure a special user to use with replication, and specify the # masteruser configuration as such: # # masteruser # # When masteruser is specified, the replica will authenticate against its # master using the new AUTH form: AUTH . # When a replica loses its connection with the master, or when the replication # is still in progress, the replica can act in two different ways: # # 1) if replica-serve-stale-data is set to 'yes' (the default) the replica will # still reply to client requests, possibly with out of date data, or the # data set may just be empty if this is the first synchronization. # # 2) If replica-serve-stale-data is set to 'no' the replica will reply with # an error "SYNC with master in progress" to all commands except: # INFO, REPLICAOF, AUTH, PING, SHUTDOWN, REPLCONF, ROLE, CONFIG, SUBSCRIBE, # UNSUBSCRIBE, PSUBSCRIBE, PUNSUBSCRIBE, PUBLISH, PUBSUB, COMMAND, POST, # HOST and LATENCY. # replica-serve-stale-data yes # You can configure a replica instance to accept writes or not. Writing against # a replica instance may be useful to store some ephemeral data (because data # written on a replica will be easily deleted after resync with the master) but # may also cause problems if clients are writing to it because of a # misconfiguration. # # Since Redis 2.6 by default replicas are read-only. # # Note: read only replicas are not designed to be exposed to untrusted clients # on the internet. It's just a protection layer against misuse of the instance. # Still a read only replica exports by default all the administrative commands # such as CONFIG, DEBUG, and so forth. To a limited extent you can improve # security of read only replicas using 'rename-command' to shadow all the # administrative / dangerous commands. replica-read-only yes # Replication SYNC strategy: disk or socket. # # New replicas and reconnecting replicas that are not able to continue the # replication process just receiving differences, need to do what is called a # "full synchronization". An RDB file is transmitted from the master to the # replicas. # # The transmission can happen in two different ways: # # 1) Disk-backed: The Redis master creates a new process that writes the RDB # file on disk. Later the file is transferred by the parent # process to the replicas incrementally. # 2) Diskless: The Redis master creates a new process that directly writes the # RDB file to replica sockets, without touching the disk at all. # # With disk-backed replication, while the RDB file is generated, more replicas # can be queued and served with the RDB file as soon as the current child # producing the RDB file finishes its work. With diskless replication instead # once the transfer starts, new replicas arriving will be queued and a new # transfer will start when the current one terminates. # # When diskless replication is used, the master waits a configurable amount of # time (in seconds) before starting the transfer in the hope that multiple # replicas will arrive and the transfer can be parallelized. # # With slow disks and fast (large bandwidth) networks, diskless replication # works better. repl-diskless-sync no # When diskless replication is enabled, it is possible to configure the delay # the server waits in order to spawn the child that transfers the RDB via socket # to the replicas. # # This is important since once the transfer starts, it is not possible to serve # new replicas arriving, that will be queued for the next RDB transfer, so the # server waits a delay in order to let more replicas arrive. # # The delay is specified in seconds, and by default is 5 seconds. To disable # it entirely just set it to 0 seconds and the transfer will start ASAP. repl-diskless-sync-delay 5 # ----------------------------------------------------------------------------- # WARNING: RDB diskless load is experimental. Since in this setup the replica # does not immediately store an RDB on disk, it may cause data loss during # failovers. RDB diskless load + Redis modules not handling I/O reads may also # cause Redis to abort in case of I/O errors during the initial synchronization # stage with the master. Use only if you know what you are doing. # ----------------------------------------------------------------------------- # # Replica can load the RDB it reads from the replication link directly from the # socket, or store the RDB to a file and read that file after it was completely # received from the master. # # In many cases the disk is slower than the network, and storing and loading # the RDB file may increase replication time (and even increase the master's # Copy on Write memory and salve buffers). # However, parsing the RDB file directly from the socket may mean that we have # to flush the contents of the current database before the full rdb was # received. For this reason we have the following options: # # "disabled" - Don't use diskless load (store the rdb file to the disk first) # "on-empty-db" - Use diskless load only when it is completely safe. # "swapdb" - Keep a copy of the current db contents in RAM while parsing # the data directly from the socket. note that this requires # sufficient memory, if you don't have it, you risk an OOM kill. repl-diskless-load disabled # Replicas send PINGs to server in a predefined interval. It's possible to # change this interval with the repl_ping_replica_period option. The default # value is 10 seconds. # # repl-ping-replica-period 10 # The following option sets the replication timeout for: # # 1) Bulk transfer I/O during SYNC, from the point of view of replica. # 2) Master timeout from the point of view of replicas (data, pings). # 3) Replica timeout from the point of view of masters (REPLCONF ACK pings). # # It is important to make sure that this value is greater than the value # specified for repl-ping-replica-period otherwise a timeout will be detected # every time there is low traffic between the master and the replica. The default # value is 60 seconds. # # repl-timeout 60 # Disable TCP_NODELAY on the replica socket after SYNC? # # If you select "yes" Redis will use a smaller number of TCP packets and # less bandwidth to send data to replicas. But this can add a delay for # the data to appear on the replica side, up to 40 milliseconds with # Linux kernels using a default configuration. # # If you select "no" the delay for data to appear on the replica side will # be reduced but more bandwidth will be used for replication. # # By default we optimize for low latency, but in very high traffic conditions # or when the master and replicas are many hops away, turning this to "yes" may # be a good idea. repl-disable-tcp-nodelay no # Set the replication backlog size. The backlog is a buffer that accumulates # replica data when replicas are disconnected for some time, so that when a # replica wants to reconnect again, often a full resync is not needed, but a # partial resync is enough, just passing the portion of data the replica # missed while disconnected. # # The bigger the replication backlog, the longer the replica can endure the # disconnect and later be able to perform a partial resynchronization. # # The backlog is only allocated if there is at least one replica connected. # # repl-backlog-size 1mb # After a master has no connected replicas for some time, the backlog will be # freed. The following option configures the amount of seconds that need to # elapse, starting from the time the last replica disconnected, for the backlog # buffer to be freed. # # Note that replicas never free the backlog for timeout, since they may be # promoted to masters later, and should be able to correctly "partially # resynchronize" with other replicas: hence they should always accumulate backlog. # # A value of 0 means to never release the backlog. # # repl-backlog-ttl 3600 # The replica priority is an integer number published by Redis in the INFO # output. It is used by Redis Sentinel in order to select a replica to promote # into a master if the master is no longer working correctly. # # A replica with a low priority number is considered better for promotion, so # for instance if there are three replicas with priority 10, 100, 25 Sentinel # will pick the one with priority 10, that is the lowest. # # However a special priority of 0 marks the replica as not able to perform the # role of master, so a replica with priority of 0 will never be selected by # Redis Sentinel for promotion. # # By default the priority is 100. replica-priority 100 # ----------------------------------------------------------------------------- # By default, Redis Sentinel includes all replicas in its reports. A replica # can be excluded from Redis Sentinel's announcements. An unannounced replica # will be ignored by the 'sentinel replicas ' command and won't be # exposed to Redis Sentinel's clients. # # This option does not change the behavior of replica-priority. Even with # replica-announced set to 'no', the replica can be promoted to master. To # prevent this behavior, set replica-priority to 0. # # replica-announced yes # It is possible for a master to stop accepting writes if there are less than # N replicas connected, having a lag less or equal than M seconds. # # The N replicas need to be in "online" state. # # The lag in seconds, that must be <= the specified value, is calculated from # the last ping received from the replica, that is usually sent every second. # # This option does not GUARANTEE that N replicas will accept the write, but # will limit the window of exposure for lost writes in case not enough replicas # are available, to the specified number of seconds. # # For example to require at least 3 replicas with a lag <= 10 seconds use: # # min-replicas-to-write 3 # min-replicas-max-lag 10 # # Setting one or the other to 0 disables the feature. # # By default min-replicas-to-write is set to 0 (feature disabled) and # min-replicas-max-lag is set to 10. # A Redis master is able to list the address and port of the attached # replicas in different ways. For example the "INFO replication" section # offers this information, which is used, among other tools, by # Redis Sentinel in order to discover replica instances. # Another place where this info is available is in the output of the # "ROLE" command of a master. # # The listed IP address and port normally reported by a replica is # obtained in the following way: # # IP: The address is auto detected by checking the peer address # of the socket used by the replica to connect with the master. # # Port: The port is communicated by the replica during the replication # handshake, and is normally the port that the replica is using to # listen for connections. # # However when port forwarding or Network Address Translation (NAT) is # used, the replica may actually be reachable via different IP and port # pairs. The following two options can be used by a replica in order to # report to its master a specific set of IP and port, so that both INFO # and ROLE will report those values. # # There is no need to use both the options if you need to override just # the port or the IP address. # # replica-announce-ip 5.5.5.5 # replica-announce-port 1234 ############################### KEYS TRACKING ################################# # Redis implements server assisted support for client side caching of values. # This is implemented using an invalidation table that remembers, using # a radix key indexed by key name, what clients have which keys. In turn # this is used in order to send invalidation messages to clients. Please # check this page to understand more about the feature: # # https://redis.io/topics/client-side-caching # # When tracking is enabled for a client, all the read only queries are assumed # to be cached: this will force Redis to store information in the invalidation # table. When keys are modified, such information is flushed away, and # invalidation messages are sent to the clients. However if the workload is # heavily dominated by reads, Redis could use more and more memory in order # to track the keys fetched by many clients. # # For this reason it is possible to configure a maximum fill value for the # invalidation table. By default it is set to 1M of keys, and once this limit # is reached, Redis will start to evict keys in the invalidation table # even if they were not modified, just to reclaim memory: this will in turn # force the clients to invalidate the cached values. Basically the table # maximum size is a trade off between the memory you want to spend server # side to track information about who cached what, and the ability of clients # to retain cached objects in memory. # # If you set the value to 0, it means there are no limits, and Redis will # retain as many keys as needed in the invalidation table. # In the "stats" INFO section, you can find information about the number of # keys in the invalidation table at every given moment. # # Note: when key tracking is used in broadcasting mode, no memory is used # in the server side so this setting is useless. # # tracking-table-max-keys 1000000 ################################## SECURITY ################################### # Warning: since Redis is pretty fast, an outside user can try up to # 1 million passwords per second against a modern box. This means that you # should use very strong passwords, otherwise they will be very easy to break. # Note that because the password is really a shared secret between the client # and the server, and should not be memorized by any human, the password # can be easily a long string from /dev/urandom or whatever, so by using a # long and unguessable password no brute force attack will be possible. # Redis ACL users are defined in the following format: # # user ... acl rules ... # # For example: # # user worker +@list +@connection ~jobs:* on >ffa9203c493aa99 # # The special username "default" is used for new connections. If this user # has the "nopass" rule, then new connections will be immediately authenticated # as the "default" user without the need of any password provided via the # AUTH command. Otherwise if the "default" user is not flagged with "nopass" # the connections will start in not authenticated state, and will require # AUTH (or the HELLO command AUTH option) in order to be authenticated and # start to work. # # The ACL rules that describe what a user can do are the following: # # on Enable the user: it is possible to authenticate as this user. # off Disable the user: it's no longer possible to authenticate # with this user, however the already authenticated connections # will still work. # skip-sanitize-payload RESTORE dump-payload sanitation is skipped. # sanitize-payload RESTORE dump-payload is sanitized (default). # + Allow the execution of that command # - Disallow the execution of that command # +@ Allow the execution of all the commands in such category # with valid categories are like @admin, @set, @sortedset, ... # and so forth, see the full list in the server.c file where # the Redis command table is described and defined. # The special category @all means all the commands, but currently # present in the server, and that will be loaded in the future # via modules. # +|subcommand Allow a specific subcommand of an otherwise # disabled command. Note that this form is not # allowed as negative like -DEBUG|SEGFAULT, but # only additive starting with "+". # allcommands Alias for +@all. Note that it implies the ability to execute # all the future commands loaded via the modules system. # nocommands Alias for -@all. # ~ Add a pattern of keys that can be mentioned as part of # commands. For instance ~* allows all the keys. The pattern # is a glob-style pattern like the one of KEYS. # It is possible to specify multiple patterns. # allkeys Alias for ~* # resetkeys Flush the list of allowed keys patterns. # & Add a glob-style pattern of Pub/Sub channels that can be # accessed by the user. It is possible to specify multiple channel # patterns. # allchannels Alias for &* # resetchannels Flush the list of allowed channel patterns. # > Add this password to the list of valid password for the user. # For example >mypass will add "mypass" to the list. # This directive clears the "nopass" flag (see later). # < Remove this password from the list of valid passwords. # nopass All the set passwords of the user are removed, and the user # is flagged as requiring no password: it means that every # password will work against this user. If this directive is # used for the default user, every new connection will be # immediately authenticated with the default user without # any explicit AUTH command required. Note that the "resetpass" # directive will clear this condition. # resetpass Flush the list of allowed passwords. Moreover removes the # "nopass" status. After "resetpass" the user has no associated # passwords and there is no way to authenticate without adding # some password (or setting it as "nopass" later). # reset Performs the following actions: resetpass, resetkeys, off, # -@all. The user returns to the same state it has immediately # after its creation. # # ACL rules can be specified in any order: for instance you can start with # passwords, then flags, or key patterns. However note that the additive # and subtractive rules will CHANGE MEANING depending on the ordering. # For instance see the following example: # # user alice on +@all -DEBUG ~* >somepassword # # This will allow "alice" to use all the commands with the exception of the # DEBUG command, since +@all added all the commands to the set of the commands # alice can use, and later DEBUG was removed. However if we invert the order # of two ACL rules the result will be different: # # user alice on -DEBUG +@all ~* >somepassword # # Now DEBUG was removed when alice had yet no commands in the set of allowed # commands, later all the commands are added, so the user will be able to # execute everything. # # Basically ACL rules are processed left-to-right. # # For more information about ACL configuration please refer to # the Redis web site at https://redis.io/topics/acl # ACL LOG # # The ACL Log tracks failed commands and authentication events associated # with ACLs. The ACL Log is useful to troubleshoot failed commands blocked # by ACLs. The ACL Log is stored in memory. You can reclaim memory with # ACL LOG RESET. Define the maximum entry length of the ACL Log below. acllog-max-len 128 # Using an external ACL file # # Instead of configuring users here in this file, it is possible to use # a stand-alone file just listing users. The two methods cannot be mixed: # if you configure users here and at the same time you activate the external # ACL file, the server will refuse to start. # # The format of the external ACL user file is exactly the same as the # format that is used inside redis.conf to describe users. # # aclfile /etc/redis/users.acl # IMPORTANT NOTE: starting with Redis 6 "requirepass" is just a compatibility # layer on top of the new ACL system. The option effect will be just setting # the password for the default user. Clients will still authenticate using # AUTH as usually, or more explicitly with AUTH default # if they follow the new protocol: both will work. # # The requirepass is not compatable with aclfile option and the ACL LOAD # command, these will cause requirepass to be ignored. # # requirepass isfoobared # New users are initialized with restrictive permissions by default, via the # equivalent of this ACL rule 'off resetkeys -@all'. Starting with Redis 6.2, it # is possible to manage access to Pub/Sub channels with ACL rules as well. The # default Pub/Sub channels permission if new users is controlled by the # acl-pubsub-default configuration directive, which accepts one of these values: # # allchannels: grants access to all Pub/Sub channels # resetchannels: revokes access to all Pub/Sub channels # # To ensure backward compatibility while upgrading Redis 6.0, acl-pubsub-default # defaults to the 'allchannels' permission. # # Future compatibility note: it is very likely that in a future version of Redis # the directive's default of 'allchannels' will be changed to 'resetchannels' in # order to provide better out-of-the-box Pub/Sub security. Therefore, it is # recommended that you explicitly define Pub/Sub permissions for all users # rather then rely on implicit default values. Once you've set explicit # Pub/Sub for all existing users, you should uncomment the following line. # # acl-pubsub-default resetchannels # Command renaming (DEPRECATED). # # ------------------------------------------------------------------------ # WARNING: avoid using this option if possible. Instead use ACLs to remove # commands from the default user, and put them only in some admin user you # create for administrative purposes. # ------------------------------------------------------------------------ # # It is possible to change the name of dangerous commands in a shared # environment. For instance the CONFIG command may be renamed into something # hard to guess so that it will still be available for internal-use tools # but not available for general clients. # # Example: # # rename-command CONFIG b840fc02d524045429941cc15f59e41cb7be6c52 # # It is also possible to completely kill a command by renaming it into # an empty string: # # rename-command CONFIG "" # # Please note that changing the name of commands that are logged into the # AOF file or transmitted to replicas may cause problems. ################################### CLIENTS #################################### # Set the max number of connected clients at the same time. By default # this limit is set to 10000 clients, however if the Redis server is not # able to configure the process file limit to allow for the specified limit # the max number of allowed clients is set to the current file limit # minus 32 (as Redis reserves a few file descriptors for internal uses). # # Once the limit is reached Redis will close all the new connections sending # an error 'max number of clients reached'. # # IMPORTANT: When Redis Cluster is used, the max number of connections is also # shared with the cluster bus: every node in the cluster will use two # connections, one incoming and another outgoing. It is important to size the # limit accordingly in case of very large clusters. # maxclients 4000 ############################## MEMORY MANAGEMENT ################################ # Set a memory usage limit to the specified amount of bytes. # When the memory limit is reached Redis will try to remove keys # according to the eviction policy selected (see maxmemory-policy). # # If Redis can't remove keys according to the policy, or if the policy is # set to 'noeviction', Redis will start to reply with errors to commands # that would use more memory, like SET, LPUSH, and so on, and will continue # to reply to read-only commands like GET. # # This option is usually useful when using Redis as an LRU or LFU cache, or to # set a hard memory limit for an instance (using the 'noeviction' policy). # # WARNING: If you have replicas attached to an instance with maxmemory on, # the size of the output buffers needed to feed the replicas are subtracted # from the used memory count, so that network problems / resyncs will # not trigger a loop where keys are evicted, and in turn the output # buffer of replicas is full with DELs of keys evicted triggering the deletion # of more keys, and so forth until the database is completely emptied. # # In short... if you have replicas attached it is suggested that you set a lower # limit for maxmemory so that there is some free RAM on the system for replica # output buffers (but this is not needed if the policy is 'noeviction'). # maxmemory 88MB # MAXMEMORY POLICY: how Redis will select what to remove when maxmemory # is reached. You can select one from the following behaviors: # # volatile-lru -> Evict using approximated LRU, only keys with an expire set. # allkeys-lru -> Evict any key using approximated LRU. # volatile-lfu -> Evict using approximated LFU, only keys with an expire set. # allkeys-lfu -> Evict any key using approximated LFU. # volatile-random -> Remove a random key having an expire set. # allkeys-random -> Remove a random key, any key. # volatile-ttl -> Remove the key with the nearest expire time (minor TTL) # noeviction -> Don't evict anything, just return an error on write operations. # # LRU means Least Recently Used # LFU means Least Frequently Used # # Both LRU, LFU and volatile-ttl are implemented using approximated # randomized algorithms. # # Note: with any of the above policies, when there are no suitable keys for # eviction, Redis will return an error on write operations that require # more memory. These are usually commands that create new keys, add data or # modify existing keys. A few examples are: SET, INCR, HSET, LPUSH, SUNIONSTORE, # SORT (due to the STORE argument), and EXEC (if the transaction includes any # command that requires memory). # # The default is: noeviction # maxmemory-policy allkeys-lru # LRU, LFU and minimal TTL algorithms are not precise algorithms but approximated # algorithms (in order to save memory), so you can tune it for speed or # accuracy. By default Redis will check five keys and pick the one that was # used least recently, you can change the sample size using the following # configuration directive. # # The default of 5 produces good enough results. 10 Approximates very closely # true LRU but costs more CPU. 3 is faster but not very accurate. # # maxmemory-samples 5 # Eviction processing is designed to function well with the default setting. # If there is an unusually large amount of write traffic, this value may need to # be increased. Decreasing this value may reduce latency at the risk of # eviction processing effectiveness # 0 = minimum latency, 10 = default, 100 = process without regard to latency # # maxmemory-eviction-tenacity 10 # Starting from Redis 5, by default a replica will ignore its maxmemory setting # (unless it is promoted to master after a failover or manually). It means # that the eviction of keys will be just handled by the master, sending the # DEL commands to the replica as keys evict in the master side. # # This behavior ensures that masters and replicas stay consistent, and is usually # what you want, however if your replica is writable, or you want the replica # to have a different memory setting, and you are sure all the writes performed # to the replica are idempotent, then you may change this default (but be sure # to understand what you are doing). # # Note that since the replica by default does not evict, it may end using more # memory than the one set via maxmemory (there are certain buffers that may # be larger on the replica, or data structures may sometimes take more memory # and so forth). So make sure you monitor your replicas and make sure they # have enough memory to never hit a real out-of-memory condition before the # master hits the configured maxmemory setting. # # replica-ignore-maxmemory yes # Redis reclaims expired keys in two ways: upon access when those keys are # found to be expired, and also in background, in what is called the # "active expire key". The key space is slowly and interactively scanned # looking for expired keys to reclaim, so that it is possible to free memory # of keys that are expired and will never be accessed again in a short time. # # The default effort of the expire cycle will try to avoid having more than # ten percent of expired keys still in memory, and will try to avoid consuming # more than 25% of total memory and to add latency to the system. However # it is possible to increase the expire "effort" that is normally set to # "1", to a greater value, up to the value "10". At its maximum value the # system will use more CPU, longer cycles (and technically may introduce # more latency), and will tolerate less already expired keys still present # in the system. It's a tradeoff between memory, CPU and latency. # # active-expire-effort 1 ############################# LAZY FREEING #################################### # Redis has two primitives to delete keys. One is called DEL and is a blocking # deletion of the object. It means that the server stops processing new commands # in order to reclaim all the memory associated with an object in a synchronous # way. If the key deleted is associated with a small object, the time needed # in order to execute the DEL command is very small and comparable to most other # O(1) or O(log_N) commands in Redis. However if the key is associated with an # aggregated value containing millions of elements, the server can block for # a long time (even seconds) in order to complete the operation. # # For the above reasons Redis also offers non blocking deletion primitives # such as UNLINK (non blocking DEL) and the ASYNC option of FLUSHALL and # FLUSHDB commands, in order to reclaim memory in background. Those commands # are executed in constant time. Another thread will incrementally free the # object in the background as fast as possible. # # DEL, UNLINK and ASYNC option of FLUSHALL and FLUSHDB are user-controlled. # It's up to the design of the application to understand when it is a good # idea to use one or the other. However the Redis server sometimes has to # delete keys or flush the whole database as a side effect of other operations. # Specifically Redis deletes objects independently of a user call in the # following scenarios: # # 1) On eviction, because of the maxmemory and maxmemory policy configurations, # in order to make room for new data, without going over the specified # memory limit. # 2) Because of expire: when a key with an associated time to live (see the # EXPIRE command) must be deleted from memory. # 3) Because of a side effect of a command that stores data on a key that may # already exist. For example the RENAME command may delete the old key # content when it is replaced with another one. Similarly SUNIONSTORE # or SORT with STORE option may delete existing keys. The SET command # itself removes any old content of the specified key in order to replace # it with the specified string. # 4) During replication, when a replica performs a full resynchronization with # its master, the content of the whole database is removed in order to # load the RDB file just transferred. # # In all the above cases the default is to delete objects in a blocking way, # like if DEL was called. However you can configure each case specifically # in order to instead release memory in a non-blocking way like if UNLINK # was called, using the following configuration directives. lazyfree-lazy-eviction yes lazyfree-lazy-expire yes lazyfree-lazy-server-del yes replica-lazy-flush yes # It is also possible, for the case when to replace the user code DEL calls # with UNLINK calls is not easy, to modify the default behavior of the DEL # command to act exactly like UNLINK, using the following configuration # directive: lazyfree-lazy-user-del yes # FLUSHDB, FLUSHALL, and SCRIPT FLUSH support both asynchronous and synchronous # deletion, which can be controlled by passing the [SYNC|ASYNC] flags into the # commands. When neither flag is passed, this directive will be used to determine # if the data should be deleted asynchronously. lazyfree-lazy-user-flush yes ################################ THREADED I/O ################################# # Redis is mostly single threaded, however there are certain threaded # operations such as UNLINK, slow I/O accesses and other things that are # performed on side threads. # # Now it is also possible to handle Redis clients socket reads and writes # in different I/O threads. Since especially writing is so slow, normally # Redis users use pipelining in order to speed up the Redis performances per # core, and spawn multiple instances in order to scale more. Using I/O # threads it is possible to easily speedup two times Redis without resorting # to pipelining nor sharding of the instance. # # By default threading is disabled, we suggest enabling it only in machines # that have at least 4 or more cores, leaving at least one spare core. # Using more than 8 threads is unlikely to help much. We also recommend using # threaded I/O only if you actually have performance problems, with Redis # instances being able to use a quite big percentage of CPU time, otherwise # there is no point in using this feature. # # So for instance if you have a four cores boxes, try to use 2 or 3 I/O # threads, if you have a 8 cores, try to use 6 threads. In order to # enable I/O threads use the following configuration directive: # # io-threads 4 # # Setting io-threads to 1 will just use the main thread as usual. # When I/O threads are enabled, we only use threads for writes, that is # to thread the write(2) syscall and transfer the client buffers to the # socket. However it is also possible to enable threading of reads and # protocol parsing using the following configuration directive, by setting # it to yes: # # io-threads-do-reads no # # Usually threading reads doesn't help much. # # NOTE 1: This configuration directive cannot be changed at runtime via # CONFIG SET. Aso this feature currently does not work when SSL is # enabled. # # NOTE 2: If you want to test the Redis speedup using redis-benchmark, make # sure you also run the benchmark itself in threaded mode, using the # --threads option to match the number of Redis threads, otherwise you'll not # be able to notice the improvements. ############################ KERNEL OOM CONTROL ############################## # On Linux, it is possible to hint the kernel OOM killer on what processes # should be killed first when out of memory. # # Enabling this feature makes Redis actively control the oom_score_adj value # for all its processes, depending on their role. The default scores will # attempt to have background child processes killed before all others, and # replicas killed before masters. # # Redis supports three options: # # no: Don't make changes to oom-score-adj (default). # yes: Alias to "relative" see below. # absolute: Values in oom-score-adj-values are written as is to the kernel. # relative: Values are used relative to the initial value of oom_score_adj when # the server starts and are then clamped to a range of -1000 to 1000. # Because typically the initial value is 0, they will often match the # absolute values. oom-score-adj no # When oom-score-adj is used, this directive controls the specific values used # for master, replica and background child processes. Values range -2000 to # 2000 (higher means more likely to be killed). # # Unprivileged processes (not root, and without CAP_SYS_RESOURCE capabilities) # can freely increase their value, but not decrease it below its initial # settings. This means that setting oom-score-adj to "relative" and setting the # oom-score-adj-values to positive values will always succeed. oom-score-adj-values 0 200 800 #################### KERNEL transparent hugepage CONTROL ###################### # Usually the kernel Transparent Huge Pages control is set to "madvise" or # or "never" by default (/sys/kernel/mm/transparent_hugepage/enabled), in which # case this config has no effect. On systems in which it is set to "always", # redis will attempt to disable it specifically for the redis process in order # to avoid latency problems specifically with fork(2) and CoW. # If for some reason you prefer to keep it enabled, you can set this config to # "no" and the kernel global to "always". disable-thp yes ############################## APPEND ONLY MODE ############################### # By default Redis asynchronously dumps the dataset on disk. This mode is # good enough in many applications, but an issue with the Redis process or # a power outage may result into a few minutes of writes lost (depending on # the configured save points). # # The Append Only File is an alternative persistence mode that provides # much better durability. For instance using the default data fsync policy # (see later in the config file) Redis can lose just one second of writes in a # dramatic event like a server power outage, or a single write if something # wrong with the Redis process itself happens, but the operating system is # still running correctly. # # AOF and RDB persistence can be enabled at the same time without problems. # If the AOF is enabled on startup Redis will load the AOF, that is the file # with the better durability guarantees. # # Please check https://redis.io/topics/persistence for more information. appendonly no # The name of the append only file (default: "appendonly.aof") appendfilename "appendonly.aof" # The fsync() call tells the Operating System to actually write data on disk # instead of waiting for more data in the output buffer. Some OS will really flush # data on disk, some other OS will just try to do it ASAP. # # Redis supports three different modes: # # no: don't fsync, just let the OS flush the data when it wants. Faster. # always: fsync after every write to the append only log. Slow, Safest. # everysec: fsync only one time every second. Compromise. # # The default is "everysec", as that's usually the right compromise between # speed and data safety. It's up to you to understand if you can relax this to # "no" that will let the operating system flush the output buffer when # it wants, for better performances (but if you can live with the idea of # some data loss consider the default persistence mode that's snapshotting), # or on the contrary, use "always" that's very slow but a bit safer than # everysec. # # More details please check the following article: # http://antirez.com/post/redis-persistence-demystified.html # # If unsure, use "everysec". # appendfsync always appendfsync everysec # appendfsync no # When the AOF fsync policy is set to always or everysec, and a background # saving process (a background save or AOF log background rewriting) is # performing a lot of I/O against the disk, in some Linux configurations # Redis may block too long on the fsync() call. Note that there is no fix for # this currently, as even performing fsync in a different thread will block # our synchronous write(2) call. # # In order to mitigate this problem it's possible to use the following option # that will prevent fsync() from being called in the main process while a # BGSAVE or BGREWRITEAOF is in progress. # # This means that while another child is saving, the durability of Redis is # the same as "appendfsync none". In practical terms, this means that it is # possible to lose up to 30 seconds of log in the worst scenario (with the # default Linux settings). # # If you have latency problems turn this to "yes". Otherwise leave it as # "no" that is the safest pick from the point of view of durability. no-appendfsync-on-rewrite no # Automatic rewrite of the append only file. # Redis is able to automatically rewrite the log file implicitly calling # BGREWRITEAOF when the AOF log size grows by the specified percentage. # # This is how it works: Redis remembers the size of the AOF file after the # latest rewrite (if no rewrite has happened since the restart, the size of # the AOF at startup is used). # # This base size is compared to the current size. If the current size is # bigger than the specified percentage, the rewrite is triggered. Also # you need to specify a minimal size for the AOF file to be rewritten, this # is useful to avoid rewriting the AOF file even if the percentage increase # is reached but it is still pretty small. # # Specify a percentage of zero in order to disable the automatic AOF # rewrite feature. auto-aof-rewrite-percentage 100 auto-aof-rewrite-min-size 64mb # An AOF file may be found to be truncated at the end during the Redis # startup process, when the AOF data gets loaded back into memory. # This may happen when the system where Redis is running # crashes, especially when an ext4 filesystem is mounted without the # data=ordered option (however this can't happen when Redis itself # crashes or aborts but the operating system still works correctly). # # Redis can either exit with an error when this happens, or load as much # data as possible (the default now) and start if the AOF file is found # to be truncated at the end. The following option controls this behavior. # # If aof-load-truncated is set to yes, a truncated AOF file is loaded and # the Redis server starts emitting a log to inform the user of the event. # Otherwise if the option is set to no, the server aborts with an error # and refuses to start. When the option is set to no, the user requires # to fix the AOF file using the "redis-check-aof" utility before to restart # the server. # # Note that if the AOF file will be found to be corrupted in the middle # the server will still exit with an error. This option only applies when # Redis will try to read more data from the AOF file but not enough bytes # will be found. aof-load-truncated yes # When rewriting the AOF file, Redis is able to use an RDB preamble in the # AOF file for faster rewrites and recoveries. When this option is turned # on the rewritten AOF file is composed of two different stanzas: # # [RDB file][AOF tail] # # When loading, Redis recognizes that the AOF file starts with the "REDIS" # string and loads the prefixed RDB file, then continues loading the AOF # tail. aof-use-rdb-preamble yes ################################ LUA SCRIPTING ############################### # Max execution time of a Lua script in milliseconds. # # If the maximum execution time is reached Redis will log that a script is # still in execution after the maximum allowed time and will start to # reply to queries with an error. # # When a long running script exceeds the maximum execution time only the # SCRIPT KILL and SHUTDOWN NOSAVE commands are available. The first can be # used to stop a script that did not yet call any write commands. The second # is the only way to shut down the server in the case a write command was # already issued by the script but the user doesn't want to wait for the natural # termination of the script. # # Set it to 0 or a negative value for unlimited execution without warnings. lua-time-limit 5000 ################################ REDIS CLUSTER ############################### # Normal Redis instances can't be part of a Redis Cluster; only nodes that are # started as cluster nodes can. In order to start a Redis instance as a # cluster node enable the cluster support uncommenting the following: # # cluster-enabled yes # Every cluster node has a cluster configuration file. This file is not # intended to be edited by hand. It is created and updated by Redis nodes. # Every Redis Cluster node requires a different cluster configuration file. # Make sure that instances running in the same system do not have # overlapping cluster configuration file names. # # cluster-config-file nodes-6379.conf # Cluster node timeout is the amount of milliseconds a node must be unreachable # for it to be considered in failure state. # Most other internal time limits are a multiple of the node timeout. # # cluster-node-timeout 15000 # A replica of a failing master will avoid to start a failover if its data # looks too old. # # There is no simple way for a replica to actually have an exact measure of # its "data age", so the following two checks are performed: # # 1) If there are multiple replicas able to failover, they exchange messages # in order to try to give an advantage to the replica with the best # replication offset (more data from the master processed). # Replicas will try to get their rank by offset, and apply to the start # of the failover a delay proportional to their rank. # # 2) Every single replica computes the time of the last interaction with # its master. This can be the last ping or command received (if the master # is still in the "connected" state), or the time that elapsed since the # disconnection with the master (if the replication link is currently down). # If the last interaction is too old, the replica will not try to failover # at all. # # The point "2" can be tuned by user. Specifically a replica will not perform # the failover if, since the last interaction with the master, the time # elapsed is greater than: # # (node-timeout * cluster-replica-validity-factor) + repl-ping-replica-period # # So for example if node-timeout is 30 seconds, and the cluster-replica-validity-factor # is 10, and assuming a default repl-ping-replica-period of 10 seconds, the # replica will not try to failover if it was not able to talk with the master # for longer than 310 seconds. # # A large cluster-replica-validity-factor may allow replicas with too old data to failover # a master, while a too small value may prevent the cluster from being able to # elect a replica at all. # # For maximum availability, it is possible to set the cluster-replica-validity-factor # to a value of 0, which means, that replicas will always try to failover the # master regardless of the last time they interacted with the master. # (However they'll always try to apply a delay proportional to their # offset rank). # # Zero is the only value able to guarantee that when all the partitions heal # the cluster will always be able to continue. # # cluster-replica-validity-factor 10 # Cluster replicas are able to migrate to orphaned masters, that are masters # that are left without working replicas. This improves the cluster ability # to resist to failures as otherwise an orphaned master can't be failed over # in case of failure if it has no working replicas. # # Replicas migrate to orphaned masters only if there are still at least a # given number of other working replicas for their old master. This number # is the "migration barrier". A migration barrier of 1 means that a replica # will migrate only if there is at least 1 other working replica for its master # and so forth. It usually reflects the number of replicas you want for every # master in your cluster. # # Default is 1 (replicas migrate only if their masters remain with at least # one replica). To disable migration just set it to a very large value or # set cluster-allow-replica-migration to 'no'. # A value of 0 can be set but is useful only for debugging and dangerous # in production. # # cluster-migration-barrier 1 # Turning off this option allows to use less automatic cluster configuration. # It both disables migration to orphaned masters and migration from masters # that became empty. # # Default is 'yes' (allow automatic migrations). # # cluster-allow-replica-migration yes # By default Redis Cluster nodes stop accepting queries if they detect there # is at least a hash slot uncovered (no available node is serving it). # This way if the cluster is partially down (for example a range of hash slots # are no longer covered) all the cluster becomes, eventually, unavailable. # It automatically returns available as soon as all the slots are covered again. # # However sometimes you want the subset of the cluster which is working, # to continue to accept queries for the part of the key space that is still # covered. In order to do so, just set the cluster-require-full-coverage # option to no. # # cluster-require-full-coverage yes # This option, when set to yes, prevents replicas from trying to failover its # master during master failures. However the replica can still perform a # manual failover, if forced to do so. # # This is useful in different scenarios, especially in the case of multiple # data center operations, where we want one side to never be promoted if not # in the case of a total DC failure. # # cluster-replica-no-failover no # This option, when set to yes, allows nodes to serve read traffic while the # the cluster is in a down state, as long as it believes it owns the slots. # # This is useful for two cases. The first case is for when an application # doesn't require consistency of data during node failures or network partitions. # One example of this is a cache, where as long as the node has the data it # should be able to serve it. # # The second use case is for configurations that don't meet the recommended # three shards but want to enable cluster mode and scale later. A # master outage in a 1 or 2 shard configuration causes a read/write outage to the # entire cluster without this option set, with it set there is only a write outage. # Without a quorum of masters, slot ownership will not change automatically. # # cluster-allow-reads-when-down no # In order to setup your cluster make sure to read the documentation # available at https://redis.io web site. ########################## CLUSTER DOCKER/NAT support ######################## # In certain deployments, Redis Cluster nodes address discovery fails, because # addresses are NAT-ted or because ports are forwarded (the typical case is # Docker and other containers). # # In order to make Redis Cluster working in such environments, a static # configuration where each node knows its public address is needed. The # following four options are used for this scope, and are: # # * cluster-announce-ip # * cluster-announce-port # * cluster-announce-tls-port # * cluster-announce-bus-port # # Each instructs the node about its address, client ports (for connections # without and with TLS) and cluster message bus port. The information is then # published in the header of the bus packets so that other nodes will be able to # correctly map the address of the node publishing the information. # # If cluster-tls is set to yes and cluster-announce-tls-port is omitted or set # to zero, then cluster-announce-port refers to the TLS port. Note also that # cluster-announce-tls-port has no effect if cluster-tls is set to no. # # If the above options are not used, the normal Redis Cluster auto-detection # will be used instead. # # Note that when remapped, the bus port may not be at the fixed offset of # clients port + 10000, so you can specify any port and bus-port depending # on how they get remapped. If the bus-port is not set, a fixed offset of # 10000 will be used as usual. # # Example: # # cluster-announce-ip 10.1.1.5 # cluster-announce-tls-port 6379 # cluster-announce-port 0 # cluster-announce-bus-port 6380 ################################## SLOW LOG ################################### # The Redis Slow Log is a system to log queries that exceeded a specified # execution time. The execution time does not include the I/O operations # like talking with the client, sending the reply and so forth, # but just the time needed to actually execute the command (this is the only # stage of command execution where the thread is blocked and can not serve # other requests in the meantime). # # You can configure the slow log with two parameters: one tells Redis # what is the execution time, in microseconds, to exceed in order for the # command to get logged, and the other parameter is the length of the # slow log. When a new command is logged the oldest one is removed from the # queue of logged commands. # The following time is expressed in microseconds, so 1000000 is equivalent # to one second. Note that a negative number disables the slow log, while # a value of zero forces the logging of every command. slowlog-log-slower-than 10000 # There is no limit to this length. Just be aware that it will consume memory. # You can reclaim memory used by the slow log with SLOWLOG RESET. slowlog-max-len 128 ################################ LATENCY MONITOR ############################## # The Redis latency monitoring subsystem samples different operations # at runtime in order to collect data related to possible sources of # latency of a Redis instance. # # Via the LATENCY command this information is available to the user that can # print graphs and obtain reports. # # The system only logs operations that were performed in a time equal or # greater than the amount of milliseconds specified via the # latency-monitor-threshold configuration directive. When its value is set # to zero, the latency monitor is turned off. # # By default latency monitoring is disabled since it is mostly not needed # if you don't have latency issues, and collecting data has a performance # impact, that while very small, can be measured under big load. Latency # monitoring can easily be enabled at runtime using the command # "CONFIG SET latency-monitor-threshold " if needed. latency-monitor-threshold 0 ############################# EVENT NOTIFICATION ############################## # Redis can notify Pub/Sub clients about events happening in the key space. # This feature is documented at https://redis.io/topics/notifications # # For instance if keyspace events notification is enabled, and a client # performs a DEL operation on key "foo" stored in the Database 0, two # messages will be published via Pub/Sub: # # PUBLISH __keyspace@0__:foo del # PUBLISH __keyevent@0__:del foo # # It is possible to select the events that Redis will notify among a set # of classes. Every class is identified by a single character: # # K Keyspace events, published with __keyspace@__ prefix. # E Keyevent events, published with __keyevent@__ prefix. # g Generic commands (non-type specific) like DEL, EXPIRE, RENAME, ... # $ String commands # l List commands # s Set commands # h Hash commands # z Sorted set commands # x Expired events (events generated every time a key expires) # e Evicted events (events generated when a key is evicted for maxmemory) # t Stream commands # d Module key type events # m Key-miss events (Note: It is not included in the 'A' class) # A Alias for g$lshzxetd, so that the "AKE" string means all the events # (Except key-miss events which are excluded from 'A' due to their # unique nature). # # The "notify-keyspace-events" takes as argument a string that is composed # of zero or multiple characters. The empty string means that notifications # are disabled. # # Example: to enable list and generic events, from the point of view of the # event name, use: # # notify-keyspace-events Elg # # Example 2: to get the stream of the expired keys subscribing to channel # name __keyevent@0__:expired use: # # notify-keyspace-events Ex # # By default all notifications are disabled because most users don't need # this feature and the feature has some overhead. Note that if you don't # specify at least one of K or E, no events will be delivered. notify-keyspace-events "" ############################### GOPHER SERVER ################################# # Redis contains an implementation of the Gopher protocol, as specified in # the RFC 1436 (https://www.ietf.org/rfc/rfc1436.txt). # # The Gopher protocol was very popular in the late '90s. It is an alternative # to the web, and the implementation both server and client side is so simple # that the Redis server has just 100 lines of code in order to implement this # support. # # What do you do with Gopher nowadays? Well Gopher never *really* died, and # lately there is a movement in order for the Gopher more hierarchical content # composed of just plain text documents to be resurrected. Some want a simpler # internet, others believe that the mainstream internet became too much # controlled, and it's cool to create an alternative space for people that # want a bit of fresh air. # # Anyway for the 10nth birthday of the Redis, we gave it the Gopher protocol # as a gift. # # --- HOW IT WORKS? --- # # The Redis Gopher support uses the inline protocol of Redis, and specifically # two kind of inline requests that were anyway illegal: an empty request # or any request that starts with "/" (there are no Redis commands starting # with such a slash). Normal RESP2/RESP3 requests are completely out of the # path of the Gopher protocol implementation and are served as usual as well. # # If you open a connection to Redis when Gopher is enabled and send it # a string like "/foo", if there is a key named "/foo" it is served via the # Gopher protocol. # # In order to create a real Gopher "hole" (the name of a Gopher site in Gopher # talking), you likely need a script like the following: # # https://github.com/antirez/gopher2redis # # --- SECURITY WARNING --- # # If you plan to put Redis on the internet in a publicly accessible address # to server Gopher pages MAKE SURE TO SET A PASSWORD to the instance. # Once a password is set: # # 1. The Gopher server (when enabled, not by default) will still serve # content via Gopher. # 2. However other commands cannot be called before the client will # authenticate. # # So use the 'requirepass' option to protect your instance. # # Note that Gopher is not currently supported when 'io-threads-do-reads' # is enabled. # # To enable Gopher support, uncomment the following line and set the option # from no (the default) to yes. # # gopher-enabled no ############################### ADVANCED CONFIG ############################### # Hashes are encoded using a memory efficient data structure when they have a # small number of entries, and the biggest entry does not exceed a given # threshold. These thresholds can be configured using the following directives. hash-max-ziplist-entries 512 hash-max-ziplist-value 64 # Lists are also encoded in a special way to save a lot of space. # The number of entries allowed per internal list node can be specified # as a fixed maximum size or a maximum number of elements. # For a fixed maximum size, use -5 through -1, meaning: # -5: max size: 64 Kb <-- not recommended for normal workloads # -4: max size: 32 Kb <-- not recommended # -3: max size: 16 Kb <-- probably not recommended # -2: max size: 8 Kb <-- good # -1: max size: 4 Kb <-- good # Positive numbers mean store up to _exactly_ that number of elements # per list node. # The highest performing option is usually -2 (8 Kb size) or -1 (4 Kb size), # but if your use case is unique, adjust the settings as necessary. list-max-ziplist-size -2 # Lists may also be compressed. # Compress depth is the number of quicklist ziplist nodes from *each* side of # the list to *exclude* from compression. The head and tail of the list # are always uncompressed for fast push/pop operations. Settings are: # 0: disable all list compression # 1: depth 1 means "don't start compressing until after 1 node into the list, # going from either the head or tail" # So: [head]->node->node->...->node->[tail] # [head], [tail] will always be uncompressed; inner nodes will compress. # 2: [head]->[next]->node->node->...->node->[prev]->[tail] # 2 here means: don't compress head or head->next or tail->prev or tail, # but compress all nodes between them. # 3: [head]->[next]->[next]->node->node->...->node->[prev]->[prev]->[tail] # etc. list-compress-depth 0 # Sets have a special encoding in just one case: when a set is composed # of just strings that happen to be integers in radix 10 in the range # of 64 bit signed integers. # The following configuration setting sets the limit in the size of the # set in order to use this special memory saving encoding. set-max-intset-entries 512 # Similarly to hashes and lists, sorted sets are also specially encoded in # order to save a lot of space. This encoding is only used when the length and # elements of a sorted set are below the following limits: zset-max-ziplist-entries 128 zset-max-ziplist-value 64 # HyperLogLog sparse representation bytes limit. The limit includes the # 16 bytes header. When an HyperLogLog using the sparse representation crosses # this limit, it is converted into the dense representation. # # A value greater than 16000 is totally useless, since at that point the # dense representation is more memory efficient. # # The suggested value is ~ 3000 in order to have the benefits of # the space efficient encoding without slowing down too much PFADD, # which is O(N) with the sparse encoding. The value can be raised to # ~ 10000 when CPU is not a concern, but space is, and the data set is # composed of many HyperLogLogs with cardinality in the 0 - 15000 range. hll-sparse-max-bytes 3000 # Streams macro node max size / items. The stream data structure is a radix # tree of big nodes that encode multiple items inside. Using this configuration # it is possible to configure how big a single node can be in bytes, and the # maximum number of items it may contain before switching to a new node when # appending new stream entries. If any of the following settings are set to # zero, the limit is ignored, so for instance it is possible to set just a # max entries limit by setting max-bytes to 0 and max-entries to the desired # value. stream-node-max-bytes 4096 stream-node-max-entries 100 # Active rehashing uses 1 millisecond every 100 milliseconds of CPU time in # order to help rehashing the main Redis hash table (the one mapping top-level # keys to values). The hash table implementation Redis uses (see dict.c) # performs a lazy rehashing: the more operation you run into a hash table # that is rehashing, the more rehashing "steps" are performed, so if the # server is idle the rehashing is never complete and some more memory is used # by the hash table. # # The default is to use this millisecond 10 times every second in order to # actively rehash the main dictionaries, freeing memory when possible. # # If unsure: # use "activerehashing no" if you have hard latency requirements and it is # not a good thing in your environment that Redis can reply from time to time # to queries with 2 milliseconds delay. # # use "activerehashing yes" if you don't have such hard requirements but # want to free memory asap when possible. activerehashing yes # The client output buffer limits can be used to force disconnection of clients # that are not reading data from the server fast enough for some reason (a # common reason is that a Pub/Sub client can't consume messages as fast as the # publisher can produce them). # # The limit can be set differently for the three different classes of clients: # # normal -> normal clients including MONITOR clients # replica -> replica clients # pubsub -> clients subscribed to at least one pubsub channel or pattern # # The syntax of every client-output-buffer-limit directive is the following: # # client-output-buffer-limit # # A client is immediately disconnected once the hard limit is reached, or if # the soft limit is reached and remains reached for the specified number of # seconds (continuously). # So for instance if the hard limit is 32 megabytes and the soft limit is # 16 megabytes / 10 seconds, the client will get disconnected immediately # if the size of the output buffers reach 32 megabytes, but will also get # disconnected if the client reaches 16 megabytes and continuously overcomes # the limit for 10 seconds. # # By default normal clients are not limited because they don't receive data # without asking (in a push way), but just after a request, so only # asynchronous clients may create a scenario where data is requested faster # than it can read. # # Instead there is a default limit for pubsub and replica clients, since # subscribers and replicas receive data in a push fashion. # # Both the hard or the soft limit can be disabled by setting them to zero. client-output-buffer-limit normal 0 0 0 client-output-buffer-limit replica 256mb 64mb 60 client-output-buffer-limit pubsub 32mb 8mb 60 # Client query buffers accumulate new commands. They are limited to a fixed # amount by default in order to avoid that a protocol desynchronization (for # instance due to a bug in the client) will lead to unbound memory usage in # the query buffer. However you can configure it here if you have very special # needs, such us huge multi/exec requests or alike. # # client-query-buffer-limit 1gb # In the Redis protocol, bulk requests, that are, elements representing single # strings, are normally limited to 512 mb. However you can change this limit # here, but must be 1mb or greater # # proto-max-bulk-len 512mb # Redis calls an internal function to perform many background tasks, like # closing connections of clients in timeout, purging expired keys that are # never requested, and so forth. # # Not all tasks are performed with the same frequency, but Redis checks for # tasks to perform according to the specified "hz" value. # # By default "hz" is set to 10. Raising the value will use more CPU when # Redis is idle, but at the same time will make Redis more responsive when # there are many keys expiring at the same time, and timeouts may be # handled with more precision. # # The range is between 1 and 500, however a value over 100 is usually not # a good idea. Most users should use the default of 10 and raise this up to # 100 only in environments where very low latency is required. hz 10 # Normally it is useful to have an HZ value which is proportional to the # number of clients connected. This is useful in order, for instance, to # avoid too many clients are processed for each background task invocation # in order to avoid latency spikes. # # Since the default HZ value by default is conservatively set to 10, Redis # offers, and enables by default, the ability to use an adaptive HZ value # which will temporarily raise when there are many connected clients. # # When dynamic HZ is enabled, the actual configured HZ will be used # as a baseline, but multiples of the configured HZ value will be actually # used as needed once more clients are connected. In this way an idle # instance will use very little CPU time while a busy instance will be # more responsive. dynamic-hz yes # When a child rewrites the AOF file, if the following option is enabled # the file will be fsync-ed every 32 MB of data generated. This is useful # in order to commit the file to the disk more incrementally and avoid # big latency spikes. aof-rewrite-incremental-fsync yes # When redis saves RDB file, if the following option is enabled # the file will be fsync-ed every 32 MB of data generated. This is useful # in order to commit the file to the disk more incrementally and avoid # big latency spikes. rdb-save-incremental-fsync yes # Redis LFU eviction (see maxmemory setting) can be tuned. However it is a good # idea to start with the default settings and only change them after investigating # how to improve the performances and how the keys LFU change over time, which # is possible to inspect via the OBJECT FREQ command. # # There are two tunable parameters in the Redis LFU implementation: the # counter logarithm factor and the counter decay time. It is important to # understand what the two parameters mean before changing them. # # The LFU counter is just 8 bits per key, it's maximum value is 255, so Redis # uses a probabilistic increment with logarithmic behavior. Given the value # of the old counter, when a key is accessed, the counter is incremented in # this way: # # 1. A random number R between 0 and 1 is extracted. # 2. A probability P is calculated as 1/(old_value*lfu_log_factor+1). # 3. The counter is incremented only if R < P. # # The default lfu-log-factor is 10. This is a table of how the frequency # counter changes with a different number of accesses with different # logarithmic factors: # # +--------+------------+------------+------------+------------+------------+ # | factor | 100 hits | 1000 hits | 100K hits | 1M hits | 10M hits | # +--------+------------+------------+------------+------------+------------+ # | 0 | 104 | 255 | 255 | 255 | 255 | # +--------+------------+------------+------------+------------+------------+ # | 1 | 18 | 49 | 255 | 255 | 255 | # +--------+------------+------------+------------+------------+------------+ # | 10 | 10 | 18 | 142 | 255 | 255 | # +--------+------------+------------+------------+------------+------------+ # | 100 | 8 | 11 | 49 | 143 | 255 | # +--------+------------+------------+------------+------------+------------+ # # NOTE: The above table was obtained by running the following commands: # # redis-benchmark -n 1000000 incr foo # redis-cli object freq foo # # NOTE 2: The counter initial value is 5 in order to give new objects a chance # to accumulate hits. # # The counter decay time is the time, in minutes, that must elapse in order # for the key counter to be divided by two (or decremented if it has a value # less <= 10). # # The default value for the lfu-decay-time is 1. A special value of 0 means to # decay the counter every time it happens to be scanned. # # lfu-log-factor 10 # lfu-decay-time 1 ########################### ACTIVE DEFRAGMENTATION ####################### # # What is active defragmentation? # ------------------------------- # # Active (online) defragmentation allows a Redis server to compact the # spaces left between small allocations and deallocations of data in memory, # thus allowing to reclaim back memory. # # Fragmentation is a natural process that happens with every allocator (but # less so with Jemalloc, fortunately) and certain workloads. Normally a server # restart is needed in order to lower the fragmentation, or at least to flush # away all the data and create it again. However thanks to this feature # implemented by Oran Agra for Redis 4.0 this process can happen at runtime # in a "hot" way, while the server is running. # # Basically when the fragmentation is over a certain level (see the # configuration options below) Redis will start to create new copies of the # values in contiguous memory regions by exploiting certain specific Jemalloc # features (in order to understand if an allocation is causing fragmentation # and to allocate it in a better place), and at the same time, will release the # old copies of the data. This process, repeated incrementally for all the keys # will cause the fragmentation to drop back to normal values. # # Important things to understand: # # 1. This feature is disabled by default, and only works if you compiled Redis # to use the copy of Jemalloc we ship with the source code of Redis. # This is the default with Linux builds. # # 2. You never need to enable this feature if you don't have fragmentation # issues. # # 3. Once you experience fragmentation, you can enable this feature when # needed with the command "CONFIG SET activedefrag yes". # # The configuration parameters are able to fine tune the behavior of the # defragmentation process. If you are not sure about what they mean it is # a good idea to leave the defaults untouched. # Enabled active defragmentation # activedefrag no # Minimum amount of fragmentation waste to start active defrag # active-defrag-ignore-bytes 100mb # Minimum percentage of fragmentation to start active defrag # active-defrag-threshold-lower 10 # Maximum percentage of fragmentation at which we use maximum effort # active-defrag-threshold-upper 100 # Minimal effort for defrag in CPU percentage, to be used when the lower # threshold is reached # active-defrag-cycle-min 1 # Maximal effort for defrag in CPU percentage, to be used when the upper # threshold is reached # active-defrag-cycle-max 25 # Maximum number of set/hash/zset/list fields that will be processed from # the main dictionary scan # active-defrag-max-scan-fields 1000 # Jemalloc background thread for purging will be enabled by default jemalloc-bg-thread yes # It is possible to pin different threads and processes of Redis to specific # CPUs in your system, in order to maximize the performances of the server. # This is useful both in order to pin different Redis threads in different # CPUs, but also in order to make sure that multiple Redis instances running # in the same host will be pinned to different CPUs. # # Normally you can do this using the "taskset" command, however it is also # possible to this via Redis configuration directly, both in Linux and FreeBSD. # # You can pin the server/IO threads, bio threads, aof rewrite child process, and # the bgsave child process. The syntax to specify the cpu list is the same as # the taskset command: # # Set redis server/io threads to cpu affinity 0,2,4,6: # server_cpulist 0-7:2 # # Set bio threads to cpu affinity 1,3: # bio_cpulist 1,3 # # Set aof rewrite child process to cpu affinity 8,9,10,11: # aof_rewrite_cpulist 8-11 # # Set bgsave child process to cpu affinity 1,10,11 # bgsave_cpulist 1,10-11 # In some cases redis will emit warnings and even refuse to start if it detects # that the system is in bad state, it is possible to suppress these warnings # by setting the following config which takes a space delimited list of warnings # to suppress # # ignore-warnings ARM64-COW-BUG ================================================ FILE: aegir/conf/redis/redis7.conf ================================================ # Redis configuration file example. # # Note that in order to read the configuration file, Redis must be # started with the file path as first argument: # # ./redis-server /path/to/redis.conf # Note on units: when memory size is needed, it is possible to specify # it in the usual form of 1k 5GB 4M and so forth: # # 1k => 1000 bytes # 1kb => 1024 bytes # 1m => 1000000 bytes # 1mb => 1024*1024 bytes # 1g => 1000000000 bytes # 1gb => 1024*1024*1024 bytes # # units are case insensitive so 1GB 1Gb 1gB are all the same. ################################## INCLUDES ################################### # Include one or more other config files here. This is useful if you # have a standard template that goes to all Redis servers but also need # to customize a few per-server settings. Include files can include # other files, so use this wisely. # # Note that option "include" won't be rewritten by command "CONFIG REWRITE" # from admin or Redis Sentinel. Since Redis always uses the last processed # line as value of a configuration directive, you'd better put includes # at the beginning of this file to avoid overwriting config change at runtime. # # If instead you are interested in using includes to override configuration # options, it is better to use include as the last line. # # Included paths may contain wildcards. All files matching the wildcards will # be included in alphabetical order. # Note that if an include path contains a wildcards but no files match it when # the server is started, the include statement will be ignored and no error will # be emitted. It is safe, therefore, to include wildcard files from empty # directories. # # include /path/to/local.conf # include /path/to/other.conf # include /path/to/fragments/*.conf # ################################## MODULES ##################################### # Load modules at startup. If the server is not able to load modules # it will abort. It is possible to use multiple loadmodule directives. # # loadmodule /path/to/my_module.so # loadmodule /path/to/other_module.so ################################## NETWORK ##################################### # By default, if no "bind" configuration directive is specified, Redis listens # for connections from all available network interfaces on the host machine. # It is possible to listen to just one or multiple selected interfaces using # the "bind" configuration directive, followed by one or more IP addresses. # Each address can be prefixed by "-", which means that redis will not fail to # start if the address is not available. Being not available only refers to # addresses that does not correspond to any network interface. Addresses that # are already in use will always fail, and unsupported protocols will always BE # silently skipped. # # Examples: # # xbind 192.168.1.100 10.0.0.1 # listens on two specific IPv4 addresses # xbind 127.0.0.1 ::1 # listens on loopback IPv4 and IPv6 # xbind * -::* # like the default, all available interfaces # # ~~~ WARNING ~~~ If the computer running Redis is directly exposed to the # internet, binding to all the interfaces is dangerous and will expose the # instance to everybody on the internet. So by default we uncomment the # following bind directive, that will force Redis to listen only on the # IPv4 and IPv6 (if available) loopback interface addresses (this means Redis # will only be able to accept client connections from the same host that it is # running on). # # IF YOU ARE SURE YOU WANT YOUR INSTANCE TO LISTEN TO ALL THE INTERFACES # COMMENT OUT THE FOLLOWING LINE. # # You will also need to set a password unless you explicitly disable protected # mode. # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ bind 127.0.0.1 # By default, outgoing connections (from replica to master, from Sentinel to # instances, cluster bus, etc.) are not bound to a specific local address. In # most cases, this means the operating system will handle that based on routing # and the interface through which the connection goes out. # # Using bind-source-addr it is possible to configure a specific address to bind # to, which may also affect how the connection gets routed. # # Example: # # bind-source-addr 10.0.0.1 # Protected mode is a layer of security protection, in order to avoid that # Redis instances left open on the internet are accessed and exploited. # # When protected mode is on and the default user has no password, the server # only accepts local connections from the IPv4 address (127.0.0.1), IPv6 address # (::1) or Unix domain sockets. # # By default protected mode is enabled. You should disable it only if # you are sure you want clients from other hosts to connect to Redis # even if no authentication is configured. protected-mode yes # Redis uses default hardened security configuration directives to reduce the # attack surface on innocent users. Therefore, several sensitive configuration # directives are immutable, and some potentially-dangerous commands are blocked. # # Configuration directives that control files that Redis writes to (e.g., 'dir' # and 'dbfilename') and that aren't usually modified during runtime # are protected by making them immutable. # # Commands that can increase the attack surface of Redis and that aren't usually # called by users are blocked by default. # # These can be exposed to either all connections or just local ones by setting # each of the configs listed below to either of these values: # # no - Block for any connection (remain immutable) # yes - Allow for any connection (no protection) # local - Allow only for local connections. Ones originating from the # IPv4 address (127.0.0.1), IPv6 address (::1) or Unix domain sockets. # # enable-protected-configs no # enable-debug-command no # enable-module-command no # Accept connections on the specified port, default is 6379 (IANA #815344). # If port 0 is specified Redis will not listen on a TCP socket. port 6379 # TCP listen() backlog. # # In high requests-per-second environments you need a high backlog in order # to avoid slow clients connection issues. Note that the Linux kernel # will silently truncate it to the value of /proc/sys/net/core/somaxconn so # make sure to raise both the value of somaxconn and tcp_max_syn_backlog # in order to get the desired effect. tcp-backlog 511 # Unix socket. # # Specify the path for the Unix socket that will be used to listen for # incoming connections. There is no default, so Redis will not listen # on a unix socket when not specified. # # unixsocket /run/redis/redis.sock # unixsocketperm 777 # Close the connection after a client is idle for N seconds (0 to disable) timeout 900 # TCP keepalive. # # If non-zero, use SO_KEEPALIVE to send TCP ACKs to clients in absence # of communication. This is useful for two reasons: # # 1) Detect dead peers. # 2) Force network equipment in the middle to consider the connection to be # alive. # # On Linux, the specified value (in seconds) is the period used to send ACKs. # Note that to close the connection the double of the time is needed. # On other kernels the period depends on the kernel configuration. # # A reasonable value for this option is 300 seconds, which is the new # Redis default starting with Redis 3.2.1. tcp-keepalive 300 # Apply OS-specific mechanism to mark the listening socket with the specified # ID, to support advanced routing and filtering capabilities. # # On Linux, the ID represents a connection mark. # On FreeBSD, the ID represents a socket cookie ID. # On OpenBSD, the ID represents a route table ID. # # The default value is 0, which implies no marking is required. # socket-mark-id 0 ################################# TLS/SSL ##################################### # By default, TLS/SSL is disabled. To enable it, the "tls-port" configuration # directive can be used to define TLS-listening ports. To enable TLS on the # default port, use: # # port 0 # tls-port 6379 # Configure a X.509 certificate and private key to use for authenticating the # server to connected clients, masters or cluster peers. These files should be # PEM formatted. # # tls-cert-file redis.crt # tls-key-file redis.key # # If the key file is encrypted using a passphrase, it can be included here # as well. # # tls-key-file-pass secret # Normally Redis uses the same certificate for both server functions (accepting # connections) and client functions (replicating from a master, establishing # cluster bus connections, etc.). # # Sometimes certificates are issued with attributes that designate them as # client-only or server-only certificates. In that case it may be desired to use # different certificates for incoming (server) and outgoing (client) # connections. To do that, use the following directives: # # tls-client-cert-file client.crt # tls-client-key-file client.key # # If the key file is encrypted using a passphrase, it can be included here # as well. # # tls-client-key-file-pass secret # Configure a DH parameters file to enable Diffie-Hellman (DH) key exchange, # required by older versions of OpenSSL (<3.0). Newer versions do not require # this configuration and recommend against it. # # tls-dh-params-file redis.dh # Configure a CA certificate(s) bundle or directory to authenticate TLS/SSL # clients and peers. Redis requires an explicit configuration of at least one # of these, and will not implicitly use the system wide configuration. # # tls-ca-cert-file ca.crt # tls-ca-cert-dir /etc/ssl/certs # By default, clients (including replica servers) on a TLS port are required # to authenticate using valid client side certificates. # # If "no" is specified, client certificates are not required and not accepted. # If "optional" is specified, client certificates are accepted and must be # valid if provided, but are not required. # # tls-auth-clients no # tls-auth-clients optional # By default, a Redis replica does not attempt to establish a TLS connection # with its master. # # Use the following directive to enable TLS on replication links. # # tls-replication yes # By default, the Redis Cluster bus uses a plain TCP connection. To enable # TLS for the bus protocol, use the following directive: # # tls-cluster yes # By default, only TLSv1.2 and TLSv1.3 are enabled and it is highly recommended # that older formally deprecated versions are kept disabled to reduce the attack surface. # You can explicitly specify TLS versions to support. # Allowed values are case insensitive and include "TLSv1", "TLSv1.1", "TLSv1.2", # "TLSv1.3" (OpenSSL >= 1.1.1) or any combination. # To enable only TLSv1.2 and TLSv1.3, use: # # tls-protocols "TLSv1.2 TLSv1.3" # Configure allowed ciphers. See the ciphers(1ssl) manpage for more information # about the syntax of this string. # # Note: this configuration applies only to <= TLSv1.2. # # tls-ciphers DEFAULT:!MEDIUM # Configure allowed TLSv1.3 ciphersuites. See the ciphers(1ssl) manpage for more # information about the syntax of this string, and specifically for TLSv1.3 # ciphersuites. # # tls-ciphersuites TLS_CHACHA20_POLY1305_SHA256 # When choosing a cipher, use the server's preference instead of the client # preference. By default, the server follows the client's preference. # # tls-prefer-server-ciphers yes # By default, TLS session caching is enabled to allow faster and less expensive # reconnections by clients that support it. Use the following directive to disable # caching. # # tls-session-caching no # Change the default number of TLS sessions cached. A zero value sets the cache # to unlimited size. The default size is 20480. # # tls-session-cache-size 5000 # Change the default timeout of cached TLS sessions. The default timeout is 300 # seconds. # # tls-session-cache-timeout 60 ################################# GENERAL ##################################### # By default Redis does not run as a daemon. Use 'yes' if you need it. # Note that Redis will write a pid file in /run/redis.pid when daemonized. # When Redis is supervised by upstart or systemd, this parameter has no impact. daemonize yes # If you run Redis from upstart or systemd, Redis can interact with your # supervision tree. Options: # supervised no - no supervision interaction # supervised upstart - signal upstart by putting Redis into SIGSTOP mode # requires "expect stop" in your upstart job config # supervised systemd - signal systemd by writing READY=1 to $NOTIFY_SOCKET # on startup, and updating Redis status on a regular # basis. # supervised auto - detect upstart or systemd method based on # UPSTART_JOB or NOTIFY_SOCKET environment variables # Note: these supervision methods only signal "process is ready." # They do not enable continuous pings back to your supervisor. # # The default is "no". To run under upstart/systemd, you can simply uncomment # the line below: # # supervised auto # If a pid file is specified, Redis writes it where specified at startup # and removes it at exit. # # When the server runs non daemonized, no pid file is created if none is # specified in the configuration. When the server is daemonized, the pid file # is used even if not specified, defaulting to "/run/redis.pid". # # Creating a pid file is best effort: if Redis is not able to create it # nothing bad happens, the server will start and run normally. # # Note that on modern Linux systems "/run/redis.pid" is more conforming # and should be used instead. pidfile /run/redis/redis.pid # Specify the server verbosity level. # This can be one of: # debug (a lot of information, useful for development/testing) # verbose (many rarely useful info, but not a mess like the debug level) # notice (moderately verbose, what you want in production probably) # warning (only very important / critical messages are logged) loglevel warning # Specify the log file name. Also the empty string can be used to force # Redis to log on the standard output. Note that if you use standard # output for logging but daemonize, logs will be sent to /dev/null logfile /var/log/redis/redis-server.log # To enable logging to the system logger, just set 'syslog-enabled' to yes, # and optionally update the other syslog parameters to suit your needs. # syslog-enabled no # Specify the syslog identity. # syslog-ident redis # Specify the syslog facility. Must be USER or between LOCAL0-LOCAL7. # syslog-facility local0 # To disable the built in crash log, which will possibly produce cleaner core # dumps when they are needed, uncomment the following: # # crash-log-enabled no # To disable the fast memory check that's run as part of the crash log, which # will possibly let redis terminate sooner, uncomment the following: # # crash-memcheck-enabled no # Set the number of databases. The default database is DB 0, you can select # a different one on a per-connection basis using SELECT where # dbid is a number between 0 and 'databases'-1 databases 8 # By default Redis shows an ASCII art logo only when started to log to the # standard output and if the standard output is a TTY and syslog logging is # disabled. Basically this means that normally a logo is displayed only in # interactive sessions. # # However it is possible to force the pre-4.0 behavior and always show a # ASCII art logo in startup logs by setting the following option to yes. always-show-logo no # By default, Redis modifies the process title (as seen in 'top' and 'ps') to # provide some runtime information. It is possible to disable this and leave # the process name as executed by setting the following to no. set-proc-title yes # When changing the process title, Redis uses the following template to construct # the modified title. # # Template variables are specified in curly brackets. The following variables are # supported: # # {title} Name of process as executed if parent, or type of child process. # {listen-addr} Bind address or '*' followed by TCP or TLS port listening on, or # Unix socket if only that's available. # {server-mode} Special mode, i.e. "[sentinel]" or "[cluster]". # {port} TCP port listening on, or 0. # {tls-port} TLS port listening on, or 0. # {unixsocket} Unix domain socket listening on, or "". # {config-file} Name of configuration file used. # proc-title-template "{title} {listen-addr} {server-mode}" ################################ SNAPSHOTTING ################################ # Save the DB to disk. # # save [ ...] # # Redis will save the DB if the given number of seconds elapsed and it # surpassed the given number of write operations against the DB. # # Snapshotting can be completely disabled with a single empty string argument # as in following example: # # save "" # # Unless specified otherwise, by default Redis will save the DB: # * After 3600 seconds (an hour) if at least 1 change was performed # * After 300 seconds (5 minutes) if at least 100 changes were performed # * After 60 seconds if at least 10000 changes were performed # # You can set these explicitly by uncommenting the following line. # # save 3600 1 300 100 60 10000 # By default Redis will stop accepting writes if RDB snapshots are enabled # (at least one save point) and the latest background save failed. # This will make the user aware (in a hard way) that data is not persisting # on disk properly, otherwise chances are that no one will notice and some # disaster will happen. # # If the background saving process will start working again Redis will # automatically allow writes again. # # However if you have setup your proper monitoring of the Redis server # and persistence, you may want to disable this feature so that Redis will # continue to work as usual even if there are problems with disk, # permissions, and so forth. stop-writes-on-bgsave-error no # Compress string objects using LZF when dump .rdb databases? # By default compression is enabled as it's almost always a win. # If you want to save some CPU in the saving child set it to 'no' but # the dataset will likely be bigger if you have compressible values or keys. rdbcompression yes # Since version 5 of RDB a CRC64 checksum is placed at the end of the file. # This makes the format more resistant to corruption but there is a performance # hit to pay (around 10%) when saving and loading RDB files, so you can disable it # for maximum performances. # # RDB files created with checksum disabled have a checksum of zero that will # tell the loading code to skip the check. rdbchecksum no # Enables or disables full sanitization checks for ziplist and listpack etc when # loading an RDB or RESTORE payload. This reduces the chances of a assertion or # crash later on while processing commands. # Options: # no - Never perform full sanitization # yes - Always perform full sanitization # clients - Perform full sanitization only for user connections. # Excludes: RDB files, RESTORE commands received from the master # connection, and client connections which have the # skip-sanitize-payload ACL flag. # The default should be 'clients' but since it currently affects cluster # resharding via MIGRATE, it is temporarily set to 'no' by default. # # sanitize-dump-payload no # The filename where to dump the DB dbfilename dump.rdb # Remove RDB files used by replication in instances without persistence # enabled. By default this option is disabled, however there are environments # where for regulations or other security concerns, RDB files persisted on # disk by masters in order to feed replicas, or stored on disk by replicas # in order to load them for the initial synchronization, should be deleted # ASAP. Note that this option ONLY WORKS in instances that have both AOF # and RDB persistence disabled, otherwise is completely ignored. # # An alternative (and sometimes better) way to obtain the same effect is # to use diskless replication on both master and replicas instances. However # in the case of replicas, diskless is not always an option. rdb-del-sync-files no # The working directory. # # The DB will be written inside this directory, with the filename specified # above using the 'dbfilename' configuration directive. # # The Append Only File will also be created inside this directory. # # Note that you must specify a directory here, not a file name. dir /var/lib/redis/ ################################# REPLICATION ################################# # Master-Replica replication. Use replicaof to make a Redis instance a copy of # another Redis server. A few things to understand ASAP about Redis replication. # # +------------------+ +---------------+ # | Master | ---> | Replica | # | (receive writes) | | (exact copy) | # +------------------+ +---------------+ # # 1) Redis replication is asynchronous, but you can configure a master to # stop accepting writes if it appears to be not connected with at least # a given number of replicas. # 2) Redis replicas are able to perform a partial resynchronization with the # master if the replication link is lost for a relatively small amount of # time. You may want to configure the replication backlog size (see the next # sections of this file) with a sensible value depending on your needs. # 3) Replication is automatic and does not need user intervention. After a # network partition replicas automatically try to reconnect to masters # and resynchronize with them. # # replicaof # If the master is password protected (using the "requirepass" configuration # directive below) it is possible to tell the replica to authenticate before # starting the replication synchronization process, otherwise the master will # refuse the replica request. # # masterauth # # However this is not enough if you are using Redis ACLs (for Redis version # 6 or greater), and the default user is not capable of running the PSYNC # command and/or other commands needed for replication. In this case it's # better to configure a special user to use with replication, and specify the # masteruser configuration as such: # # masteruser # # When masteruser is specified, the replica will authenticate against its # master using the new AUTH form: AUTH . # When a replica loses its connection with the master, or when the replication # is still in progress, the replica can act in two different ways: # # 1) if replica-serve-stale-data is set to 'yes' (the default) the replica will # still reply to client requests, possibly with out of date data, or the # data set may just be empty if this is the first synchronization. # # 2) If replica-serve-stale-data is set to 'no' the replica will reply with error # "MASTERDOWN Link with MASTER is down and replica-serve-stale-data is set to 'no'" # to all data access commands, excluding commands such as: # INFO, REPLICAOF, AUTH, SHUTDOWN, REPLCONF, ROLE, CONFIG, SUBSCRIBE, # UNSUBSCRIBE, PSUBSCRIBE, PUNSUBSCRIBE, PUBLISH, PUBSUB, COMMAND, POST, # HOST and LATENCY. # replica-serve-stale-data yes # You can configure a replica instance to accept writes or not. Writing against # a replica instance may be useful to store some ephemeral data (because data # written on a replica will be easily deleted after resync with the master) but # may also cause problems if clients are writing to it because of a # misconfiguration. # # Since Redis 2.6 by default replicas are read-only. # # Note: read only replicas are not designed to be exposed to untrusted clients # on the internet. It's just a protection layer against misuse of the instance. # Still a read only replica exports by default all the administrative commands # such as CONFIG, DEBUG, and so forth. To a limited extent you can improve # security of read only replicas using 'rename-command' to shadow all the # administrative / dangerous commands. replica-read-only yes # Replication SYNC strategy: disk or socket. # # New replicas and reconnecting replicas that are not able to continue the # replication process just receiving differences, need to do what is called a # "full synchronization". An RDB file is transmitted from the master to the # replicas. # # The transmission can happen in two different ways: # # 1) Disk-backed: The Redis master creates a new process that writes the RDB # file on disk. Later the file is transferred by the parent # process to the replicas incrementally. # 2) Diskless: The Redis master creates a new process that directly writes the # RDB file to replica sockets, without touching the disk at all. # # With disk-backed replication, while the RDB file is generated, more replicas # can be queued and served with the RDB file as soon as the current child # producing the RDB file finishes its work. With diskless replication instead # once the transfer starts, new replicas arriving will be queued and a new # transfer will start when the current one terminates. # # When diskless replication is used, the master waits a configurable amount of # time (in seconds) before starting the transfer in the hope that multiple # replicas will arrive and the transfer can be parallelized. # # With slow disks and fast (large bandwidth) networks, diskless replication # works better. repl-diskless-sync yes # When diskless replication is enabled, it is possible to configure the delay # the server waits in order to spawn the child that transfers the RDB via socket # to the replicas. # # This is important since once the transfer starts, it is not possible to serve # new replicas arriving, that will be queued for the next RDB transfer, so the # server waits a delay in order to let more replicas arrive. # # The delay is specified in seconds, and by default is 5 seconds. To disable # it entirely just set it to 0 seconds and the transfer will start ASAP. repl-diskless-sync-delay 5 # When diskless replication is enabled with a delay, it is possible to let # the replication start before the maximum delay is reached if the maximum # number of replicas expected have connected. Default of 0 means that the # maximum is not defined and Redis will wait the full delay. repl-diskless-sync-max-replicas 0 # ----------------------------------------------------------------------------- # WARNING: RDB diskless load is experimental. Since in this setup the replica # does not immediately store an RDB on disk, it may cause data loss during # failovers. RDB diskless load + Redis modules not handling I/O reads may also # cause Redis to abort in case of I/O errors during the initial synchronization # stage with the master. Use only if you know what you are doing. # ----------------------------------------------------------------------------- # # Replica can load the RDB it reads from the replication link directly from the # socket, or store the RDB to a file and read that file after it was completely # received from the master. # # In many cases the disk is slower than the network, and storing and loading # the RDB file may increase replication time (and even increase the master's # Copy on Write memory and replica buffers). # However, parsing the RDB file directly from the socket may mean that we have # to flush the contents of the current database before the full rdb was # received. For this reason we have the following options: # # "disabled" - Don't use diskless load (store the rdb file to the disk first) # "on-empty-db" - Use diskless load only when it is completely safe. # "swapdb" - Keep current db contents in RAM while parsing the data directly # from the socket. Replicas in this mode can keep serving current # data set while replication is in progress, except for cases where # they can't recognize master as having a data set from same # replication history. # Note that this requires sufficient memory, if you don't have it, # you risk an OOM kill. repl-diskless-load disabled # Master send PINGs to its replicas in a predefined interval. It's possible to # change this interval with the repl_ping_replica_period option. The default # value is 10 seconds. # # repl-ping-replica-period 10 # The following option sets the replication timeout for: # # 1) Bulk transfer I/O during SYNC, from the point of view of replica. # 2) Master timeout from the point of view of replicas (data, pings). # 3) Replica timeout from the point of view of masters (REPLCONF ACK pings). # # It is important to make sure that this value is greater than the value # specified for repl-ping-replica-period otherwise a timeout will be detected # every time there is low traffic between the master and the replica. The default # value is 60 seconds. # # repl-timeout 60 # Disable TCP_NODELAY on the replica socket after SYNC? # # If you select "yes" Redis will use a smaller number of TCP packets and # less bandwidth to send data to replicas. But this can add a delay for # the data to appear on the replica side, up to 40 milliseconds with # Linux kernels using a default configuration. # # If you select "no" the delay for data to appear on the replica side will # be reduced but more bandwidth will be used for replication. # # By default we optimize for low latency, but in very high traffic conditions # or when the master and replicas are many hops away, turning this to "yes" may # be a good idea. repl-disable-tcp-nodelay no # Set the replication backlog size. The backlog is a buffer that accumulates # replica data when replicas are disconnected for some time, so that when a # replica wants to reconnect again, often a full resync is not needed, but a # partial resync is enough, just passing the portion of data the replica # missed while disconnected. # # The bigger the replication backlog, the longer the replica can endure the # disconnect and later be able to perform a partial resynchronization. # # The backlog is only allocated if there is at least one replica connected. # # repl-backlog-size 1mb # After a master has no connected replicas for some time, the backlog will be # freed. The following option configures the amount of seconds that need to # elapse, starting from the time the last replica disconnected, for the backlog # buffer to be freed. # # Note that replicas never free the backlog for timeout, since they may be # promoted to masters later, and should be able to correctly "partially # resynchronize" with other replicas: hence they should always accumulate backlog. # # A value of 0 means to never release the backlog. # # repl-backlog-ttl 3600 # The replica priority is an integer number published by Redis in the INFO # output. It is used by Redis Sentinel in order to select a replica to promote # into a master if the master is no longer working correctly. # # A replica with a low priority number is considered better for promotion, so # for instance if there are three replicas with priority 10, 100, 25 Sentinel # will pick the one with priority 10, that is the lowest. # # However a special priority of 0 marks the replica as not able to perform the # role of master, so a replica with priority of 0 will never be selected by # Redis Sentinel for promotion. # # By default the priority is 100. replica-priority 100 # The propagation error behavior controls how Redis will behave when it is # unable to handle a command being processed in the replication stream from a master # or processed while reading from an AOF file. Errors that occur during propagation # are unexpected, and can cause data inconsistency. However, there are edge cases # in earlier versions of Redis where it was possible for the server to replicate or persist # commands that would fail on future versions. For this reason the default behavior # is to ignore such errors and continue processing commands. # # If an application wants to ensure there is no data divergence, this configuration # should be set to 'panic' instead. The value can also be set to 'panic-on-replicas' # to only panic when a replica encounters an error on the replication stream. One of # these two panic values will become the default value in the future once there are # sufficient safety mechanisms in place to prevent false positive crashes. # # propagation-error-behavior ignore # Replica ignore disk write errors controls the behavior of a replica when it is # unable to persist a write command received from its master to disk. By default, # this configuration is set to 'no' and will crash the replica in this condition. # It is not recommended to change this default, however in order to be compatible # with older versions of Redis this config can be toggled to 'yes' which will just # log a warning and execute the write command it got from the master. # # replica-ignore-disk-write-errors no # ----------------------------------------------------------------------------- # By default, Redis Sentinel includes all replicas in its reports. A replica # can be excluded from Redis Sentinel's announcements. An unannounced replica # will be ignored by the 'sentinel replicas ' command and won't be # exposed to Redis Sentinel's clients. # # This option does not change the behavior of replica-priority. Even with # replica-announced set to 'no', the replica can be promoted to master. To # prevent this behavior, set replica-priority to 0. # # replica-announced yes # It is possible for a master to stop accepting writes if there are less than # N replicas connected, having a lag less or equal than M seconds. # # The N replicas need to be in "online" state. # # The lag in seconds, that must be <= the specified value, is calculated from # the last ping received from the replica, that is usually sent every second. # # This option does not GUARANTEE that N replicas will accept the write, but # will limit the window of exposure for lost writes in case not enough replicas # are available, to the specified number of seconds. # # For example to require at least 3 replicas with a lag <= 10 seconds use: # # min-replicas-to-write 3 # min-replicas-max-lag 10 # # Setting one or the other to 0 disables the feature. # # By default min-replicas-to-write is set to 0 (feature disabled) and # min-replicas-max-lag is set to 10. # A Redis master is able to list the address and port of the attached # replicas in different ways. For example the "INFO replication" section # offers this information, which is used, among other tools, by # Redis Sentinel in order to discover replica instances. # Another place where this info is available is in the output of the # "ROLE" command of a master. # # The listed IP address and port normally reported by a replica is # obtained in the following way: # # IP: The address is auto detected by checking the peer address # of the socket used by the replica to connect with the master. # # Port: The port is communicated by the replica during the replication # handshake, and is normally the port that the replica is using to # listen for connections. # # However when port forwarding or Network Address Translation (NAT) is # used, the replica may actually be reachable via different IP and port # pairs. The following two options can be used by a replica in order to # report to its master a specific set of IP and port, so that both INFO # and ROLE will report those values. # # There is no need to use both the options if you need to override just # the port or the IP address. # # replica-announce-ip 5.5.5.5 # replica-announce-port 1234 ############################### KEYS TRACKING ################################# # Redis implements server assisted support for client side caching of values. # This is implemented using an invalidation table that remembers, using # a radix key indexed by key name, what clients have which keys. In turn # this is used in order to send invalidation messages to clients. Please # check this page to understand more about the feature: # # https://redis.io/topics/client-side-caching # # When tracking is enabled for a client, all the read only queries are assumed # to be cached: this will force Redis to store information in the invalidation # table. When keys are modified, such information is flushed away, and # invalidation messages are sent to the clients. However if the workload is # heavily dominated by reads, Redis could use more and more memory in order # to track the keys fetched by many clients. # # For this reason it is possible to configure a maximum fill value for the # invalidation table. By default it is set to 1M of keys, and once this limit # is reached, Redis will start to evict keys in the invalidation table # even if they were not modified, just to reclaim memory: this will in turn # force the clients to invalidate the cached values. Basically the table # maximum size is a trade off between the memory you want to spend server # side to track information about who cached what, and the ability of clients # to retain cached objects in memory. # # If you set the value to 0, it means there are no limits, and Redis will # retain as many keys as needed in the invalidation table. # In the "stats" INFO section, you can find information about the number of # keys in the invalidation table at every given moment. # # Note: when key tracking is used in broadcasting mode, no memory is used # in the server side so this setting is useless. # # tracking-table-max-keys 1000000 ################################## SECURITY ################################### # Warning: since Redis is pretty fast, an outside user can try up to # 1 million passwords per second against a modern box. This means that you # should use very strong passwords, otherwise they will be very easy to break. # Note that because the password is really a shared secret between the client # and the server, and should not be memorized by any human, the password # can be easily a long string from /dev/urandom or whatever, so by using a # long and unguessable password no brute force attack will be possible. # Redis ACL users are defined in the following format: # # user ... acl rules ... # # For example: # # user worker +@list +@connection ~jobs:* on >ffa9203c493aa99 # # The special username "default" is used for new connections. If this user # has the "nopass" rule, then new connections will be immediately authenticated # as the "default" user without the need of any password provided via the # AUTH command. Otherwise if the "default" user is not flagged with "nopass" # the connections will start in not authenticated state, and will require # AUTH (or the HELLO command AUTH option) in order to be authenticated and # start to work. # # The ACL rules that describe what a user can do are the following: # # on Enable the user: it is possible to authenticate as this user. # off Disable the user: it's no longer possible to authenticate # with this user, however the already authenticated connections # will still work. # skip-sanitize-payload RESTORE dump-payload sanitization is skipped. # sanitize-payload RESTORE dump-payload is sanitized (default). # + Allow the execution of that command. # May be used with `|` for allowing subcommands (e.g "+config|get") # - Disallow the execution of that command. # May be used with `|` for blocking subcommands (e.g "-config|set") # +@ Allow the execution of all the commands in such category # with valid categories are like @admin, @set, @sortedset, ... # and so forth, see the full list in the server.c file where # the Redis command table is described and defined. # The special category @all means all the commands, but currently # present in the server, and that will be loaded in the future # via modules. # +|first-arg Allow a specific first argument of an otherwise # disabled command. It is only supported on commands with # no sub-commands, and is not allowed as negative form # like -SELECT|1, only additive starting with "+". This # feature is deprecated and may be removed in the future. # allcommands Alias for +@all. Note that it implies the ability to execute # all the future commands loaded via the modules system. # nocommands Alias for -@all. # ~ Add a pattern of keys that can be mentioned as part of # commands. For instance ~* allows all the keys. The pattern # is a glob-style pattern like the one of KEYS. # It is possible to specify multiple patterns. # %R~ Add key read pattern that specifies which keys can be read # from. # %W~ Add key write pattern that specifies which keys can be # written to. # allkeys Alias for ~* # resetkeys Flush the list of allowed keys patterns. # & Add a glob-style pattern of Pub/Sub channels that can be # accessed by the user. It is possible to specify multiple channel # patterns. # allchannels Alias for &* # resetchannels Flush the list of allowed channel patterns. # > Add this password to the list of valid password for the user. # For example >mypass will add "mypass" to the list. # This directive clears the "nopass" flag (see later). # < Remove this password from the list of valid passwords. # nopass All the set passwords of the user are removed, and the user # is flagged as requiring no password: it means that every # password will work against this user. If this directive is # used for the default user, every new connection will be # immediately authenticated with the default user without # any explicit AUTH command required. Note that the "resetpass" # directive will clear this condition. # resetpass Flush the list of allowed passwords. Moreover removes the # "nopass" status. After "resetpass" the user has no associated # passwords and there is no way to authenticate without adding # some password (or setting it as "nopass" later). # reset Performs the following actions: resetpass, resetkeys, off, # -@all. The user returns to the same state it has immediately # after its creation. # () Create a new selector with the options specified within the # parentheses and attach it to the user. Each option should be # space separated. The first character must be ( and the last # character must be ). # clearselectors Remove all of the currently attached selectors. # Note this does not change the "root" user permissions, # which are the permissions directly applied onto the # user (outside the parentheses). # # ACL rules can be specified in any order: for instance you can start with # passwords, then flags, or key patterns. However note that the additive # and subtractive rules will CHANGE MEANING depending on the ordering. # For instance see the following example: # # user alice on +@all -DEBUG ~* >somepassword # # This will allow "alice" to use all the commands with the exception of the # DEBUG command, since +@all added all the commands to the set of the commands # alice can use, and later DEBUG was removed. However if we invert the order # of two ACL rules the result will be different: # # user alice on -DEBUG +@all ~* >somepassword # # Now DEBUG was removed when alice had yet no commands in the set of allowed # commands, later all the commands are added, so the user will be able to # execute everything. # # Basically ACL rules are processed left-to-right. # # The following is a list of command categories and their meanings: # * keyspace - Writing or reading from keys, databases, or their metadata # in a type agnostic way. Includes DEL, RESTORE, DUMP, RENAME, EXISTS, DBSIZE, # KEYS, EXPIRE, TTL, FLUSHALL, etc. Commands that may modify the keyspace, # key or metadata will also have `write` category. Commands that only read # the keyspace, key or metadata will have the `read` category. # * read - Reading from keys (values or metadata). Note that commands that don't # interact with keys, will not have either `read` or `write`. # * write - Writing to keys (values or metadata) # * admin - Administrative commands. Normal applications will never need to use # these. Includes REPLICAOF, CONFIG, DEBUG, SAVE, MONITOR, ACL, SHUTDOWN, etc. # * dangerous - Potentially dangerous (each should be considered with care for # various reasons). This includes FLUSHALL, MIGRATE, RESTORE, SORT, KEYS, # CLIENT, DEBUG, INFO, CONFIG, SAVE, REPLICAOF, etc. # * connection - Commands affecting the connection or other connections. # This includes AUTH, SELECT, COMMAND, CLIENT, ECHO, PING, etc. # * blocking - Potentially blocking the connection until released by another # command. # * fast - Fast O(1) commands. May loop on the number of arguments, but not the # number of elements in the key. # * slow - All commands that are not Fast. # * pubsub - PUBLISH / SUBSCRIBE related # * transaction - WATCH / MULTI / EXEC related commands. # * scripting - Scripting related. # * set - Data type: sets related. # * sortedset - Data type: zsets related. # * list - Data type: lists related. # * hash - Data type: hashes related. # * string - Data type: strings related. # * bitmap - Data type: bitmaps related. # * hyperloglog - Data type: hyperloglog related. # * geo - Data type: geo related. # * stream - Data type: streams related. # # For more information about ACL configuration please refer to # the Redis web site at https://redis.io/topics/acl # ACL LOG # # The ACL Log tracks failed commands and authentication events associated # with ACLs. The ACL Log is useful to troubleshoot failed commands blocked # by ACLs. The ACL Log is stored in memory. You can reclaim memory with # ACL LOG RESET. Define the maximum entry length of the ACL Log below. acllog-max-len 128 # Using an external ACL file # # Instead of configuring users here in this file, it is possible to use # a stand-alone file just listing users. The two methods cannot be mixed: # if you configure users here and at the same time you activate the external # ACL file, the server will refuse to start. # # The format of the external ACL user file is exactly the same as the # format that is used inside redis.conf to describe users. # # aclfile /etc/redis/users.acl # IMPORTANT NOTE: starting with Redis 6 "requirepass" is just a compatibility # layer on top of the new ACL system. The option effect will be just setting # the password for the default user. Clients will still authenticate using # AUTH as usually, or more explicitly with AUTH default # if they follow the new protocol: both will work. # # The requirepass is not compatible with aclfile option and the ACL LOAD # command, these will cause requirepass to be ignored. # # requirepass isfoobared # New users are initialized with restrictive permissions by default, via the # equivalent of this ACL rule 'off resetkeys -@all'. Starting with Redis 6.2, it # is possible to manage access to Pub/Sub channels with ACL rules as well. The # default Pub/Sub channels permission if new users is controlled by the # acl-pubsub-default configuration directive, which accepts one of these values: # # allchannels: grants access to all Pub/Sub channels # resetchannels: revokes access to all Pub/Sub channels # # From Redis 7.0, acl-pubsub-default defaults to 'resetchannels' permission. # # acl-pubsub-default resetchannels # Command renaming (DEPRECATED). # # ------------------------------------------------------------------------ # WARNING: avoid using this option if possible. Instead use ACLs to remove # commands from the default user, and put them only in some admin user you # create for administrative purposes. # ------------------------------------------------------------------------ # # It is possible to change the name of dangerous commands in a shared # environment. For instance the CONFIG command may be renamed into something # hard to guess so that it will still be available for internal-use tools # but not available for general clients. # # Example: # # rename-command CONFIG b840fc02d524045429941cc15f59e41cb7be6c52 # # It is also possible to completely kill a command by renaming it into # an empty string: # # rename-command CONFIG "" # # Please note that changing the name of commands that are logged into the # AOF file or transmitted to replicas may cause problems. ################################### CLIENTS #################################### # Set the max number of connected clients at the same time. By default # this limit is set to 10000 clients, however if the Redis server is not # able to configure the process file limit to allow for the specified limit # the max number of allowed clients is set to the current file limit # minus 32 (as Redis reserves a few file descriptors for internal uses). # # Once the limit is reached Redis will close all the new connections sending # an error 'max number of clients reached'. # # IMPORTANT: When Redis Cluster is used, the max number of connections is also # shared with the cluster bus: every node in the cluster will use two # connections, one incoming and another outgoing. It is important to size the # limit accordingly in case of very large clusters. # maxclients 4000 ############################## MEMORY MANAGEMENT ################################ # Set a memory usage limit to the specified amount of bytes. # When the memory limit is reached Redis will try to remove keys # according to the eviction policy selected (see maxmemory-policy). # # If Redis can't remove keys according to the policy, or if the policy is # set to 'noeviction', Redis will start to reply with errors to commands # that would use more memory, like SET, LPUSH, and so on, and will continue # to reply to read-only commands like GET. # # This option is usually useful when using Redis as an LRU or LFU cache, or to # set a hard memory limit for an instance (using the 'noeviction' policy). # # WARNING: If you have replicas attached to an instance with maxmemory on, # the size of the output buffers needed to feed the replicas are subtracted # from the used memory count, so that network problems / resyncs will # not trigger a loop where keys are evicted, and in turn the output # buffer of replicas is full with DELs of keys evicted triggering the deletion # of more keys, and so forth until the database is completely emptied. # # In short... if you have replicas attached it is suggested that you set a lower # limit for maxmemory so that there is some free RAM on the system for replica # output buffers (but this is not needed if the policy is 'noeviction'). # maxmemory 88MB # MAXMEMORY POLICY: how Redis will select what to remove when maxmemory # is reached. You can select one from the following behaviors: # # volatile-lru -> Evict using approximated LRU, only keys with an expire set. # allkeys-lru -> Evict any key using approximated LRU. # volatile-lfu -> Evict using approximated LFU, only keys with an expire set. # allkeys-lfu -> Evict any key using approximated LFU. # volatile-random -> Remove a random key having an expire set. # allkeys-random -> Remove a random key, any key. # volatile-ttl -> Remove the key with the nearest expire time (minor TTL) # noeviction -> Don't evict anything, just return an error on write operations. # # LRU means Least Recently Used # LFU means Least Frequently Used # # Both LRU, LFU and volatile-ttl are implemented using approximated # randomized algorithms. # # Note: with any of the above policies, when there are no suitable keys for # eviction, Redis will return an error on write operations that require # more memory. These are usually commands that create new keys, add data or # modify existing keys. A few examples are: SET, INCR, HSET, LPUSH, SUNIONSTORE, # SORT (due to the STORE argument), and EXEC (if the transaction includes any # command that requires memory). # # The default is: noeviction # maxmemory-policy allkeys-lru # LRU, LFU and minimal TTL algorithms are not precise algorithms but approximated # algorithms (in order to save memory), so you can tune it for speed or # accuracy. By default Redis will check five keys and pick the one that was # used least recently, you can change the sample size using the following # configuration directive. # # The default of 5 produces good enough results. 10 Approximates very closely # true LRU but costs more CPU. 3 is faster but not very accurate. # # maxmemory-samples 5 # Eviction processing is designed to function well with the default setting. # If there is an unusually large amount of write traffic, this value may need to # be increased. Decreasing this value may reduce latency at the risk of # eviction processing effectiveness # 0 = minimum latency, 10 = default, 100 = process without regard to latency # # maxmemory-eviction-tenacity 10 # Starting from Redis 5, by default a replica will ignore its maxmemory setting # (unless it is promoted to master after a failover or manually). It means # that the eviction of keys will be just handled by the master, sending the # DEL commands to the replica as keys evict in the master side. # # This behavior ensures that masters and replicas stay consistent, and is usually # what you want, however if your replica is writable, or you want the replica # to have a different memory setting, and you are sure all the writes performed # to the replica are idempotent, then you may change this default (but be sure # to understand what you are doing). # # Note that since the replica by default does not evict, it may end using more # memory than the one set via maxmemory (there are certain buffers that may # be larger on the replica, or data structures may sometimes take more memory # and so forth). So make sure you monitor your replicas and make sure they # have enough memory to never hit a real out-of-memory condition before the # master hits the configured maxmemory setting. # # replica-ignore-maxmemory yes # Redis reclaims expired keys in two ways: upon access when those keys are # found to be expired, and also in background, in what is called the # "active expire key". The key space is slowly and interactively scanned # looking for expired keys to reclaim, so that it is possible to free memory # of keys that are expired and will never be accessed again in a short time. # # The default effort of the expire cycle will try to avoid having more than # ten percent of expired keys still in memory, and will try to avoid consuming # more than 25% of total memory and to add latency to the system. However # it is possible to increase the expire "effort" that is normally set to # "1", to a greater value, up to the value "10". At its maximum value the # system will use more CPU, longer cycles (and technically may introduce # more latency), and will tolerate less already expired keys still present # in the system. It's a tradeoff between memory, CPU and latency. # # active-expire-effort 1 ############################# LAZY FREEING #################################### # Redis has two primitives to delete keys. One is called DEL and is a blocking # deletion of the object. It means that the server stops processing new commands # in order to reclaim all the memory associated with an object in a synchronous # way. If the key deleted is associated with a small object, the time needed # in order to execute the DEL command is very small and comparable to most other # O(1) or O(log_N) commands in Redis. However if the key is associated with an # aggregated value containing millions of elements, the server can block for # a long time (even seconds) in order to complete the operation. # # For the above reasons Redis also offers non blocking deletion primitives # such as UNLINK (non blocking DEL) and the ASYNC option of FLUSHALL and # FLUSHDB commands, in order to reclaim memory in background. Those commands # are executed in constant time. Another thread will incrementally free the # object in the background as fast as possible. # # DEL, UNLINK and ASYNC option of FLUSHALL and FLUSHDB are user-controlled. # It's up to the design of the application to understand when it is a good # idea to use one or the other. However the Redis server sometimes has to # delete keys or flush the whole database as a side effect of other operations. # Specifically Redis deletes objects independently of a user call in the # following scenarios: # # 1) On eviction, because of the maxmemory and maxmemory policy configurations, # in order to make room for new data, without going over the specified # memory limit. # 2) Because of expire: when a key with an associated time to live (see the # EXPIRE command) must be deleted from memory. # 3) Because of a side effect of a command that stores data on a key that may # already exist. For example the RENAME command may delete the old key # content when it is replaced with another one. Similarly SUNIONSTORE # or SORT with STORE option may delete existing keys. The SET command # itself removes any old content of the specified key in order to replace # it with the specified string. # 4) During replication, when a replica performs a full resynchronization with # its master, the content of the whole database is removed in order to # load the RDB file just transferred. # # In all the above cases the default is to delete objects in a blocking way, # like if DEL was called. However you can configure each case specifically # in order to instead release memory in a non-blocking way like if UNLINK # was called, using the following configuration directives. lazyfree-lazy-eviction yes lazyfree-lazy-expire yes lazyfree-lazy-server-del yes replica-lazy-flush yes # It is also possible, for the case when to replace the user code DEL calls # with UNLINK calls is not easy, to modify the default behavior of the DEL # command to act exactly like UNLINK, using the following configuration # directive: lazyfree-lazy-user-del yes # FLUSHDB, FLUSHALL, SCRIPT FLUSH and FUNCTION FLUSH support both asynchronous and synchronous # deletion, which can be controlled by passing the [SYNC|ASYNC] flags into the # commands. When neither flag is passed, this directive will be used to determine # if the data should be deleted asynchronously. lazyfree-lazy-user-flush yes ################################ THREADED I/O ################################# # Redis is mostly single threaded, however there are certain threaded # operations such as UNLINK, slow I/O accesses and other things that are # performed on side threads. # # Now it is also possible to handle Redis clients socket reads and writes # in different I/O threads. Since especially writing is so slow, normally # Redis users use pipelining in order to speed up the Redis performances per # core, and spawn multiple instances in order to scale more. Using I/O # threads it is possible to easily speedup two times Redis without resorting # to pipelining nor sharding of the instance. # # By default threading is disabled, we suggest enabling it only in machines # that have at least 4 or more cores, leaving at least one spare core. # Using more than 8 threads is unlikely to help much. We also recommend using # threaded I/O only if you actually have performance problems, with Redis # instances being able to use a quite big percentage of CPU time, otherwise # there is no point in using this feature. # # So for instance if you have a four cores boxes, try to use 2 or 3 I/O # threads, if you have a 8 cores, try to use 6 threads. In order to # enable I/O threads use the following configuration directive: # # io-threads 4 # # Setting io-threads to 1 will just use the main thread as usual. # When I/O threads are enabled, we only use threads for writes, that is # to thread the write(2) syscall and transfer the client buffers to the # socket. However it is also possible to enable threading of reads and # protocol parsing using the following configuration directive, by setting # it to yes: # # io-threads-do-reads no # # Usually threading reads doesn't help much. # # NOTE 1: This configuration directive cannot be changed at runtime via # CONFIG SET. Also, this feature currently does not work when SSL is # enabled. # # NOTE 2: If you want to test the Redis speedup using redis-benchmark, make # sure you also run the benchmark itself in threaded mode, using the # --threads option to match the number of Redis threads, otherwise you'll not # be able to notice the improvements. ############################ KERNEL OOM CONTROL ############################## # On Linux, it is possible to hint the kernel OOM killer on what processes # should be killed first when out of memory. # # Enabling this feature makes Redis actively control the oom_score_adj value # for all its processes, depending on their role. The default scores will # attempt to have background child processes killed before all others, and # replicas killed before masters. # # Redis supports these options: # # no: Don't make changes to oom-score-adj (default). # yes: Alias to "relative" see below. # absolute: Values in oom-score-adj-values are written as is to the kernel. # relative: Values are used relative to the initial value of oom_score_adj when # the server starts and are then clamped to a range of -1000 to 1000. # Because typically the initial value is 0, they will often match the # absolute values. oom-score-adj no # When oom-score-adj is used, this directive controls the specific values used # for master, replica and background child processes. Values range -2000 to # 2000 (higher means more likely to be killed). # # Unprivileged processes (not root, and without CAP_SYS_RESOURCE capabilities) # can freely increase their value, but not decrease it below its initial # settings. This means that setting oom-score-adj to "relative" and setting the # oom-score-adj-values to positive values will always succeed. oom-score-adj-values 0 200 800 #################### KERNEL transparent hugepage CONTROL ###################### # Usually the kernel Transparent Huge Pages control is set to "madvise" or # or "never" by default (/sys/kernel/mm/transparent_hugepage/enabled), in which # case this config has no effect. On systems in which it is set to "always", # redis will attempt to disable it specifically for the redis process in order # to avoid latency problems specifically with fork(2) and CoW. # If for some reason you prefer to keep it enabled, you can set this config to # "no" and the kernel global to "always". disable-thp yes ############################## APPEND ONLY MODE ############################### # By default Redis asynchronously dumps the dataset on disk. This mode is # good enough in many applications, but an issue with the Redis process or # a power outage may result into a few minutes of writes lost (depending on # the configured save points). # # The Append Only File is an alternative persistence mode that provides # much better durability. For instance using the default data fsync policy # (see later in the config file) Redis can lose just one second of writes in a # dramatic event like a server power outage, or a single write if something # wrong with the Redis process itself happens, but the operating system is # still running correctly. # # AOF and RDB persistence can be enabled at the same time without problems. # If the AOF is enabled on startup Redis will load the AOF, that is the file # with the better durability guarantees. # # Please check https://redis.io/topics/persistence for more information. appendonly no # The base name of the append only file. # # Redis 7 and newer use a set of append-only files to persist the dataset # and changes applied to it. There are two basic types of files in use: # # - Base files, which are a snapshot representing the complete state of the # dataset at the time the file was created. Base files can be either in # the form of RDB (binary serialized) or AOF (textual commands). # - Incremental files, which contain additional commands that were applied # to the dataset following the previous file. # # In addition, manifest files are used to track the files and the order in # which they were created and should be applied. # # Append-only file names are created by Redis following a specific pattern. # The file name's prefix is based on the 'appendfilename' configuration # parameter, followed by additional information about the sequence and type. # # For example, if appendfilename is set to appendonly.aof, the following file # names could be derived: # # - appendonly.aof.1.base.rdb as a base file. # - appendonly.aof.1.incr.aof, appendonly.aof.2.incr.aof as incremental files. # - appendonly.aof.manifest as a manifest file. appendfilename "appendonly.aof" # For convenience, Redis stores all persistent append-only files in a dedicated # directory. The name of the directory is determined by the appenddirname # configuration parameter. appenddirname "appendonlydir" # The fsync() call tells the Operating System to actually write data on disk # instead of waiting for more data in the output buffer. Some OS will really flush # data on disk, some other OS will just try to do it ASAP. # # Redis supports three different modes: # # no: don't fsync, just let the OS flush the data when it wants. Faster. # always: fsync after every write to the append only log. Slow, Safest. # everysec: fsync only one time every second. Compromise. # # The default is "everysec", as that's usually the right compromise between # speed and data safety. It's up to you to understand if you can relax this to # "no" that will let the operating system flush the output buffer when # it wants, for better performances (but if you can live with the idea of # some data loss consider the default persistence mode that's snapshotting), # or on the contrary, use "always" that's very slow but a bit safer than # everysec. # # More details please check the following article: # http://antirez.com/post/redis-persistence-demystified.html # # If unsure, use "everysec". # appendfsync always appendfsync everysec # appendfsync no # When the AOF fsync policy is set to always or everysec, and a background # saving process (a background save or AOF log background rewriting) is # performing a lot of I/O against the disk, in some Linux configurations # Redis may block too long on the fsync() call. Note that there is no fix for # this currently, as even performing fsync in a different thread will block # our synchronous write(2) call. # # In order to mitigate this problem it's possible to use the following option # that will prevent fsync() from being called in the main process while a # BGSAVE or BGREWRITEAOF is in progress. # # This means that while another child is saving, the durability of Redis is # the same as "appendfsync no". In practical terms, this means that it is # possible to lose up to 30 seconds of log in the worst scenario (with the # default Linux settings). # # If you have latency problems turn this to "yes". Otherwise leave it as # "no" that is the safest pick from the point of view of durability. no-appendfsync-on-rewrite no # Automatic rewrite of the append only file. # Redis is able to automatically rewrite the log file implicitly calling # BGREWRITEAOF when the AOF log size grows by the specified percentage. # # This is how it works: Redis remembers the size of the AOF file after the # latest rewrite (if no rewrite has happened since the restart, the size of # the AOF at startup is used). # # This base size is compared to the current size. If the current size is # bigger than the specified percentage, the rewrite is triggered. Also # you need to specify a minimal size for the AOF file to be rewritten, this # is useful to avoid rewriting the AOF file even if the percentage increase # is reached but it is still pretty small. # # Specify a percentage of zero in order to disable the automatic AOF # rewrite feature. auto-aof-rewrite-percentage 100 auto-aof-rewrite-min-size 64mb # An AOF file may be found to be truncated at the end during the Redis # startup process, when the AOF data gets loaded back into memory. # This may happen when the system where Redis is running # crashes, especially when an ext4 filesystem is mounted without the # data=ordered option (however this can't happen when Redis itself # crashes or aborts but the operating system still works correctly). # # Redis can either exit with an error when this happens, or load as much # data as possible (the default now) and start if the AOF file is found # to be truncated at the end. The following option controls this behavior. # # If aof-load-truncated is set to yes, a truncated AOF file is loaded and # the Redis server starts emitting a log to inform the user of the event. # Otherwise if the option is set to no, the server aborts with an error # and refuses to start. When the option is set to no, the user requires # to fix the AOF file using the "redis-check-aof" utility before to restart # the server. # # Note that if the AOF file will be found to be corrupted in the middle # the server will still exit with an error. This option only applies when # Redis will try to read more data from the AOF file but not enough bytes # will be found. aof-load-truncated yes # Redis can create append-only base files in either RDB or AOF formats. Using # the RDB format is always faster and more efficient, and disabling it is only # supported for backward compatibility purposes. aof-use-rdb-preamble yes # Redis supports recording timestamp annotations in the AOF to support restoring # the data from a specific point-in-time. However, using this capability changes # the AOF format in a way that may not be compatible with existing AOF parsers. aof-timestamp-enabled no ################################ SHUTDOWN ##################################### # Maximum time to wait for replicas when shutting down, in seconds. # # During shut down, a grace period allows any lagging replicas to catch up with # the latest replication offset before the master exists. This period can # prevent data loss, especially for deployments without configured disk backups. # # The 'shutdown-timeout' value is the grace period's duration in seconds. It is # only applicable when the instance has replicas. To disable the feature, set # the value to 0. # # shutdown-timeout 10 # When Redis receives a SIGINT or SIGTERM, shutdown is initiated and by default # an RDB snapshot is written to disk in a blocking operation if save points are configured. # The options used on signaled shutdown can include the following values: # default: Saves RDB snapshot only if save points are configured. # Waits for lagging replicas to catch up. # save: Forces a DB saving operation even if no save points are configured. # nosave: Prevents DB saving operation even if one or more save points are configured. # now: Skips waiting for lagging replicas. # force: Ignores any errors that would normally prevent the server from exiting. # # Any combination of values is allowed as long as "save" and "nosave" are not set simultaneously. # Example: "nosave force now" # # shutdown-on-sigint default # shutdown-on-sigterm default ################ NON-DETERMINISTIC LONG BLOCKING COMMANDS ##################### # Maximum time in milliseconds for EVAL scripts, functions and in some cases # modules' commands before Redis can start processing or rejecting other clients. # # If the maximum execution time is reached Redis will start to reply to most # commands with a BUSY error. # # In this state Redis will only allow a handful of commands to be executed. # For instance, SCRIPT KILL, FUNCTION KILL, SHUTDOWN NOSAVE and possibly some # module specific 'allow-busy' commands. # # SCRIPT KILL and FUNCTION KILL will only be able to stop a script that did not # yet call any write commands, so SHUTDOWN NOSAVE may be the only way to stop # the server in the case a write command was already issued by the script when # the user doesn't want to wait for the natural termination of the script. # # The default is 5 seconds. It is possible to set it to 0 or a negative value # to disable this mechanism (uninterrupted execution). Note that in the past # this config had a different name, which is now an alias, so both of these do # the same: # lua-time-limit 5000 # busy-reply-threshold 5000 ################################ REDIS CLUSTER ############################### # Normal Redis instances can't be part of a Redis Cluster; only nodes that are # started as cluster nodes can. In order to start a Redis instance as a # cluster node enable the cluster support uncommenting the following: # # cluster-enabled yes # Every cluster node has a cluster configuration file. This file is not # intended to be edited by hand. It is created and updated by Redis nodes. # Every Redis Cluster node requires a different cluster configuration file. # Make sure that instances running in the same system do not have # overlapping cluster configuration file names. # # cluster-config-file nodes-6379.conf # Cluster node timeout is the amount of milliseconds a node must be unreachable # for it to be considered in failure state. # Most other internal time limits are a multiple of the node timeout. # # cluster-node-timeout 15000 # The cluster port is the port that the cluster bus will listen for inbound connections on. When set # to the default value, 0, it will be bound to the command port + 10000. Setting this value requires # you to specify the cluster bus port when executing cluster meet. # cluster-port 0 # A replica of a failing master will avoid to start a failover if its data # looks too old. # # There is no simple way for a replica to actually have an exact measure of # its "data age", so the following two checks are performed: # # 1) If there are multiple replicas able to failover, they exchange messages # in order to try to give an advantage to the replica with the best # replication offset (more data from the master processed). # Replicas will try to get their rank by offset, and apply to the start # of the failover a delay proportional to their rank. # # 2) Every single replica computes the time of the last interaction with # its master. This can be the last ping or command received (if the master # is still in the "connected" state), or the time that elapsed since the # disconnection with the master (if the replication link is currently down). # If the last interaction is too old, the replica will not try to failover # at all. # # The point "2" can be tuned by user. Specifically a replica will not perform # the failover if, since the last interaction with the master, the time # elapsed is greater than: # # (node-timeout * cluster-replica-validity-factor) + repl-ping-replica-period # # So for example if node-timeout is 30 seconds, and the cluster-replica-validity-factor # is 10, and assuming a default repl-ping-replica-period of 10 seconds, the # replica will not try to failover if it was not able to talk with the master # for longer than 310 seconds. # # A large cluster-replica-validity-factor may allow replicas with too old data to failover # a master, while a too small value may prevent the cluster from being able to # elect a replica at all. # # For maximum availability, it is possible to set the cluster-replica-validity-factor # to a value of 0, which means, that replicas will always try to failover the # master regardless of the last time they interacted with the master. # (However they'll always try to apply a delay proportional to their # offset rank). # # Zero is the only value able to guarantee that when all the partitions heal # the cluster will always be able to continue. # # cluster-replica-validity-factor 10 # Cluster replicas are able to migrate to orphaned masters, that are masters # that are left without working replicas. This improves the cluster ability # to resist to failures as otherwise an orphaned master can't be failed over # in case of failure if it has no working replicas. # # Replicas migrate to orphaned masters only if there are still at least a # given number of other working replicas for their old master. This number # is the "migration barrier". A migration barrier of 1 means that a replica # will migrate only if there is at least 1 other working replica for its master # and so forth. It usually reflects the number of replicas you want for every # master in your cluster. # # Default is 1 (replicas migrate only if their masters remain with at least # one replica). To disable migration just set it to a very large value or # set cluster-allow-replica-migration to 'no'. # A value of 0 can be set but is useful only for debugging and dangerous # in production. # # cluster-migration-barrier 1 # Turning off this option allows to use less automatic cluster configuration. # It both disables migration to orphaned masters and migration from masters # that became empty. # # Default is 'yes' (allow automatic migrations). # # cluster-allow-replica-migration yes # By default Redis Cluster nodes stop accepting queries if they detect there # is at least a hash slot uncovered (no available node is serving it). # This way if the cluster is partially down (for example a range of hash slots # are no longer covered) all the cluster becomes, eventually, unavailable. # It automatically returns available as soon as all the slots are covered again. # # However sometimes you want the subset of the cluster which is working, # to continue to accept queries for the part of the key space that is still # covered. In order to do so, just set the cluster-require-full-coverage # option to no. # # cluster-require-full-coverage yes # This option, when set to yes, prevents replicas from trying to failover its # master during master failures. However the replica can still perform a # manual failover, if forced to do so. # # This is useful in different scenarios, especially in the case of multiple # data center operations, where we want one side to never be promoted if not # in the case of a total DC failure. # # cluster-replica-no-failover no # This option, when set to yes, allows nodes to serve read traffic while the # cluster is in a down state, as long as it believes it owns the slots. # # This is useful for two cases. The first case is for when an application # doesn't require consistency of data during node failures or network partitions. # One example of this is a cache, where as long as the node has the data it # should be able to serve it. # # The second use case is for configurations that don't meet the recommended # three shards but want to enable cluster mode and scale later. A # master outage in a 1 or 2 shard configuration causes a read/write outage to the # entire cluster without this option set, with it set there is only a write outage. # Without a quorum of masters, slot ownership will not change automatically. # # cluster-allow-reads-when-down no # This option, when set to yes, allows nodes to serve pubsub shard traffic while # the cluster is in a down state, as long as it believes it owns the slots. # # This is useful if the application would like to use the pubsub feature even when # the cluster global stable state is not OK. If the application wants to make sure only # one shard is serving a given channel, this feature should be kept as yes. # # cluster-allow-pubsubshard-when-down yes # Cluster link send buffer limit is the limit on the memory usage of an individual # cluster bus link's send buffer in bytes. Cluster links would be freed if they exceed # this limit. This is to primarily prevent send buffers from growing unbounded on links # toward slow peers (E.g. PubSub messages being piled up). # This limit is disabled by default. Enable this limit when 'mem_cluster_links' INFO field # and/or 'send-buffer-allocated' entries in the 'CLUSTER LINKS` command output continuously increase. # Minimum limit of 1gb is recommended so that cluster link buffer can fit in at least a single # PubSub message by default. (client-query-buffer-limit default value is 1gb) # # cluster-link-sendbuf-limit 0 # Clusters can configure their announced hostname using this config. This is a common use case for # applications that need to use TLS Server Name Indication (SNI) or dealing with DNS based # routing. By default this value is only shown as additional metadata in the CLUSTER SLOTS # command, but can be changed using 'cluster-preferred-endpoint-type' config. This value is # communicated along the clusterbus to all nodes, setting it to an empty string will remove # the hostname and also propagate the removal. # # cluster-announce-hostname "" # Clusters can advertise how clients should connect to them using either their IP address, # a user defined hostname, or by declaring they have no endpoint. Which endpoint is # shown as the preferred endpoint is set by using the cluster-preferred-endpoint-type # config with values 'ip', 'hostname', or 'unknown-endpoint'. This value controls how # the endpoint returned for MOVED/ASKING requests as well as the first field of CLUSTER SLOTS. # If the preferred endpoint type is set to hostname, but no announced hostname is set, a '?' # will be returned instead. # # When a cluster advertises itself as having an unknown endpoint, it's indicating that # the server doesn't know how clients can reach the cluster. This can happen in certain # networking situations where there are multiple possible routes to the node, and the # server doesn't know which one the client took. In this case, the server is expecting # the client to reach out on the same endpoint it used for making the last request, but use # the port provided in the response. # # cluster-preferred-endpoint-type ip # In order to setup your cluster make sure to read the documentation # available at https://redis.io web site. ########################## CLUSTER DOCKER/NAT support ######################## # In certain deployments, Redis Cluster nodes address discovery fails, because # addresses are NAT-ted or because ports are forwarded (the typical case is # Docker and other containers). # # In order to make Redis Cluster working in such environments, a static # configuration where each node knows its public address is needed. The # following four options are used for this scope, and are: # # * cluster-announce-ip # * cluster-announce-port # * cluster-announce-tls-port # * cluster-announce-bus-port # # Each instructs the node about its address, client ports (for connections # without and with TLS) and cluster message bus port. The information is then # published in the header of the bus packets so that other nodes will be able to # correctly map the address of the node publishing the information. # # If cluster-tls is set to yes and cluster-announce-tls-port is omitted or set # to zero, then cluster-announce-port refers to the TLS port. Note also that # cluster-announce-tls-port has no effect if cluster-tls is set to no. # # If the above options are not used, the normal Redis Cluster auto-detection # will be used instead. # # Note that when remapped, the bus port may not be at the fixed offset of # clients port + 10000, so you can specify any port and bus-port depending # on how they get remapped. If the bus-port is not set, a fixed offset of # 10000 will be used as usual. # # Example: # # cluster-announce-ip 10.1.1.5 # cluster-announce-tls-port 6379 # cluster-announce-port 0 # cluster-announce-bus-port 6380 ################################## SLOW LOG ################################### # The Redis Slow Log is a system to log queries that exceeded a specified # execution time. The execution time does not include the I/O operations # like talking with the client, sending the reply and so forth, # but just the time needed to actually execute the command (this is the only # stage of command execution where the thread is blocked and can not serve # other requests in the meantime). # # You can configure the slow log with two parameters: one tells Redis # what is the execution time, in microseconds, to exceed in order for the # command to get logged, and the other parameter is the length of the # slow log. When a new command is logged the oldest one is removed from the # queue of logged commands. # The following time is expressed in microseconds, so 1000000 is equivalent # to one second. Note that a negative number disables the slow log, while # a value of zero forces the logging of every command. slowlog-log-slower-than 10000 # There is no limit to this length. Just be aware that it will consume memory. # You can reclaim memory used by the slow log with SLOWLOG RESET. slowlog-max-len 128 ################################ LATENCY MONITOR ############################## # The Redis latency monitoring subsystem samples different operations # at runtime in order to collect data related to possible sources of # latency of a Redis instance. # # Via the LATENCY command this information is available to the user that can # print graphs and obtain reports. # # The system only logs operations that were performed in a time equal or # greater than the amount of milliseconds specified via the # latency-monitor-threshold configuration directive. When its value is set # to zero, the latency monitor is turned off. # # By default latency monitoring is disabled since it is mostly not needed # if you don't have latency issues, and collecting data has a performance # impact, that while very small, can be measured under big load. Latency # monitoring can easily be enabled at runtime using the command # "CONFIG SET latency-monitor-threshold " if needed. latency-monitor-threshold 0 ################################ LATENCY TRACKING ############################## # The Redis extended latency monitoring tracks the per command latencies and enables # exporting the percentile distribution via the INFO latencystats command, # and cumulative latency distributions (histograms) via the LATENCY command. # # By default, the extended latency monitoring is enabled since the overhead # of keeping track of the command latency is very small. # latency-tracking yes # By default the exported latency percentiles via the INFO latencystats command # are the p50, p99, and p999. # latency-tracking-info-percentiles 50 99 99.9 ############################# EVENT NOTIFICATION ############################## # Redis can notify Pub/Sub clients about events happening in the key space. # This feature is documented at https://redis.io/topics/notifications # # For instance if keyspace events notification is enabled, and a client # performs a DEL operation on key "foo" stored in the Database 0, two # messages will be published via Pub/Sub: # # PUBLISH __keyspace@0__:foo del # PUBLISH __keyevent@0__:del foo # # It is possible to select the events that Redis will notify among a set # of classes. Every class is identified by a single character: # # K Keyspace events, published with __keyspace@__ prefix. # E Keyevent events, published with __keyevent@__ prefix. # g Generic commands (non-type specific) like DEL, EXPIRE, RENAME, ... # $ String commands # l List commands # s Set commands # h Hash commands # z Sorted set commands # x Expired events (events generated every time a key expires) # e Evicted events (events generated when a key is evicted for maxmemory) # n New key events (Note: not included in the 'A' class) # t Stream commands # d Module key type events # m Key-miss events (Note: It is not included in the 'A' class) # A Alias for g$lshzxetd, so that the "AKE" string means all the events # (Except key-miss events which are excluded from 'A' due to their # unique nature). # # The "notify-keyspace-events" takes as argument a string that is composed # of zero or multiple characters. The empty string means that notifications # are disabled. # # Example: to enable list and generic events, from the point of view of the # event name, use: # # notify-keyspace-events Elg # # Example 2: to get the stream of the expired keys subscribing to channel # name __keyevent@0__:expired use: # # notify-keyspace-events Ex # # By default all notifications are disabled because most users don't need # this feature and the feature has some overhead. Note that if you don't # specify at least one of K or E, no events will be delivered. notify-keyspace-events "" ############################### ADVANCED CONFIG ############################### # Hashes are encoded using a memory efficient data structure when they have a # small number of entries, and the biggest entry does not exceed a given # threshold. These thresholds can be configured using the following directives. hash-max-listpack-entries 512 hash-max-listpack-value 64 # Lists are also encoded in a special way to save a lot of space. # The number of entries allowed per internal list node can be specified # as a fixed maximum size or a maximum number of elements. # For a fixed maximum size, use -5 through -1, meaning: # -5: max size: 64 Kb <-- not recommended for normal workloads # -4: max size: 32 Kb <-- not recommended # -3: max size: 16 Kb <-- probably not recommended # -2: max size: 8 Kb <-- good # -1: max size: 4 Kb <-- good # Positive numbers mean store up to _exactly_ that number of elements # per list node. # The highest performing option is usually -2 (8 Kb size) or -1 (4 Kb size), # but if your use case is unique, adjust the settings as necessary. list-max-listpack-size -2 # Lists may also be compressed. # Compress depth is the number of quicklist ziplist nodes from *each* side of # the list to *exclude* from compression. The head and tail of the list # are always uncompressed for fast push/pop operations. Settings are: # 0: disable all list compression # 1: depth 1 means "don't start compressing until after 1 node into the list, # going from either the head or tail" # So: [head]->node->node->...->node->[tail] # [head], [tail] will always be uncompressed; inner nodes will compress. # 2: [head]->[next]->node->node->...->node->[prev]->[tail] # 2 here means: don't compress head or head->next or tail->prev or tail, # but compress all nodes between them. # 3: [head]->[next]->[next]->node->node->...->node->[prev]->[prev]->[tail] # etc. list-compress-depth 0 # Sets have a special encoding in just one case: when a set is composed # of just strings that happen to be integers in radix 10 in the range # of 64 bit signed integers. # The following configuration setting sets the limit in the size of the # set in order to use this special memory saving encoding. set-max-intset-entries 512 # Similarly to hashes and lists, sorted sets are also specially encoded in # order to save a lot of space. This encoding is only used when the length and # elements of a sorted set are below the following limits: zset-max-listpack-entries 128 zset-max-listpack-value 64 # HyperLogLog sparse representation bytes limit. The limit includes the # 16 bytes header. When an HyperLogLog using the sparse representation crosses # this limit, it is converted into the dense representation. # # A value greater than 16000 is totally useless, since at that point the # dense representation is more memory efficient. # # The suggested value is ~ 3000 in order to have the benefits of # the space efficient encoding without slowing down too much PFADD, # which is O(N) with the sparse encoding. The value can be raised to # ~ 10000 when CPU is not a concern, but space is, and the data set is # composed of many HyperLogLogs with cardinality in the 0 - 15000 range. hll-sparse-max-bytes 3000 # Streams macro node max size / items. The stream data structure is a radix # tree of big nodes that encode multiple items inside. Using this configuration # it is possible to configure how big a single node can be in bytes, and the # maximum number of items it may contain before switching to a new node when # appending new stream entries. If any of the following settings are set to # zero, the limit is ignored, so for instance it is possible to set just a # max entries limit by setting max-bytes to 0 and max-entries to the desired # value. stream-node-max-bytes 4096 stream-node-max-entries 100 # Active rehashing uses 1 millisecond every 100 milliseconds of CPU time in # order to help rehashing the main Redis hash table (the one mapping top-level # keys to values). The hash table implementation Redis uses (see dict.c) # performs a lazy rehashing: the more operation you run into a hash table # that is rehashing, the more rehashing "steps" are performed, so if the # server is idle the rehashing is never complete and some more memory is used # by the hash table. # # The default is to use this millisecond 10 times every second in order to # actively rehash the main dictionaries, freeing memory when possible. # # If unsure: # use "activerehashing no" if you have hard latency requirements and it is # not a good thing in your environment that Redis can reply from time to time # to queries with 2 milliseconds delay. # # use "activerehashing yes" if you don't have such hard requirements but # want to free memory asap when possible. activerehashing yes # The client output buffer limits can be used to force disconnection of clients # that are not reading data from the server fast enough for some reason (a # common reason is that a Pub/Sub client can't consume messages as fast as the # publisher can produce them). # # The limit can be set differently for the three different classes of clients: # # normal -> normal clients including MONITOR clients # replica -> replica clients # pubsub -> clients subscribed to at least one pubsub channel or pattern # # The syntax of every client-output-buffer-limit directive is the following: # # client-output-buffer-limit # # A client is immediately disconnected once the hard limit is reached, or if # the soft limit is reached and remains reached for the specified number of # seconds (continuously). # So for instance if the hard limit is 32 megabytes and the soft limit is # 16 megabytes / 10 seconds, the client will get disconnected immediately # if the size of the output buffers reach 32 megabytes, but will also get # disconnected if the client reaches 16 megabytes and continuously overcomes # the limit for 10 seconds. # # By default normal clients are not limited because they don't receive data # without asking (in a push way), but just after a request, so only # asynchronous clients may create a scenario where data is requested faster # than it can read. # # Instead there is a default limit for pubsub and replica clients, since # subscribers and replicas receive data in a push fashion. # # Note that it doesn't make sense to set the replica clients output buffer # limit lower than the repl-backlog-size config (partial sync will succeed # and then replica will get disconnected). # Such a configuration is ignored (the size of repl-backlog-size will be used). # This doesn't have memory consumption implications since the replica client # will share the backlog buffers memory. # # Both the hard or the soft limit can be disabled by setting them to zero. client-output-buffer-limit normal 0 0 0 client-output-buffer-limit replica 256mb 64mb 60 client-output-buffer-limit pubsub 32mb 8mb 60 # Client query buffers accumulate new commands. They are limited to a fixed # amount by default in order to avoid that a protocol desynchronization (for # instance due to a bug in the client) will lead to unbound memory usage in # the query buffer. However you can configure it here if you have very special # needs, such us huge multi/exec requests or alike. # # client-query-buffer-limit 1gb # In some scenarios client connections can hog up memory leading to OOM # errors or data eviction. To avoid this we can cap the accumulated memory # used by all client connections (all pubsub and normal clients). Once we # reach that limit connections will be dropped by the server freeing up # memory. The server will attempt to drop the connections using the most # memory first. We call this mechanism "client eviction". # # Client eviction is configured using the maxmemory-clients setting as follows: # 0 - client eviction is disabled (default) # # A memory value can be used for the client eviction threshold, # for example: # maxmemory-clients 1g # # A percentage value (between 1% and 100%) means the client eviction threshold # is based on a percentage of the maxmemory setting. For example to set client # eviction at 5% of maxmemory: # maxmemory-clients 5% # In the Redis protocol, bulk requests, that are, elements representing single # strings, are normally limited to 512 mb. However you can change this limit # here, but must be 1mb or greater # # proto-max-bulk-len 512mb # Redis calls an internal function to perform many background tasks, like # closing connections of clients in timeout, purging expired keys that are # never requested, and so forth. # # Not all tasks are performed with the same frequency, but Redis checks for # tasks to perform according to the specified "hz" value. # # By default "hz" is set to 10. Raising the value will use more CPU when # Redis is idle, but at the same time will make Redis more responsive when # there are many keys expiring at the same time, and timeouts may be # handled with more precision. # # The range is between 1 and 500, however a value over 100 is usually not # a good idea. Most users should use the default of 10 and raise this up to # 100 only in environments where very low latency is required. hz 10 # Normally it is useful to have an HZ value which is proportional to the # number of clients connected. This is useful in order, for instance, to # avoid too many clients are processed for each background task invocation # in order to avoid latency spikes. # # Since the default HZ value by default is conservatively set to 10, Redis # offers, and enables by default, the ability to use an adaptive HZ value # which will temporarily raise when there are many connected clients. # # When dynamic HZ is enabled, the actual configured HZ will be used # as a baseline, but multiples of the configured HZ value will be actually # used as needed once more clients are connected. In this way an idle # instance will use very little CPU time while a busy instance will be # more responsive. dynamic-hz yes # When a child rewrites the AOF file, if the following option is enabled # the file will be fsync-ed every 4 MB of data generated. This is useful # in order to commit the file to the disk more incrementally and avoid # big latency spikes. aof-rewrite-incremental-fsync yes # When redis saves RDB file, if the following option is enabled # the file will be fsync-ed every 4 MB of data generated. This is useful # in order to commit the file to the disk more incrementally and avoid # big latency spikes. rdb-save-incremental-fsync yes # Redis LFU eviction (see maxmemory setting) can be tuned. However it is a good # idea to start with the default settings and only change them after investigating # how to improve the performances and how the keys LFU change over time, which # is possible to inspect via the OBJECT FREQ command. # # There are two tunable parameters in the Redis LFU implementation: the # counter logarithm factor and the counter decay time. It is important to # understand what the two parameters mean before changing them. # # The LFU counter is just 8 bits per key, it's maximum value is 255, so Redis # uses a probabilistic increment with logarithmic behavior. Given the value # of the old counter, when a key is accessed, the counter is incremented in # this way: # # 1. A random number R between 0 and 1 is extracted. # 2. A probability P is calculated as 1/(old_value*lfu_log_factor+1). # 3. The counter is incremented only if R < P. # # The default lfu-log-factor is 10. This is a table of how the frequency # counter changes with a different number of accesses with different # logarithmic factors: # # +--------+------------+------------+------------+------------+------------+ # | factor | 100 hits | 1000 hits | 100K hits | 1M hits | 10M hits | # +--------+------------+------------+------------+------------+------------+ # | 0 | 104 | 255 | 255 | 255 | 255 | # +--------+------------+------------+------------+------------+------------+ # | 1 | 18 | 49 | 255 | 255 | 255 | # +--------+------------+------------+------------+------------+------------+ # | 10 | 10 | 18 | 142 | 255 | 255 | # +--------+------------+------------+------------+------------+------------+ # | 100 | 8 | 11 | 49 | 143 | 255 | # +--------+------------+------------+------------+------------+------------+ # # NOTE: The above table was obtained by running the following commands: # # redis-benchmark -n 1000000 incr foo # redis-cli object freq foo # # NOTE 2: The counter initial value is 5 in order to give new objects a chance # to accumulate hits. # # The counter decay time is the time, in minutes, that must elapse in order # for the key counter to be divided by two (or decremented if it has a value # less <= 10). # # The default value for the lfu-decay-time is 1. A special value of 0 means to # decay the counter every time it happens to be scanned. # # lfu-log-factor 10 # lfu-decay-time 1 ########################### ACTIVE DEFRAGMENTATION ####################### # # What is active defragmentation? # ------------------------------- # # Active (online) defragmentation allows a Redis server to compact the # spaces left between small allocations and deallocations of data in memory, # thus allowing to reclaim back memory. # # Fragmentation is a natural process that happens with every allocator (but # less so with Jemalloc, fortunately) and certain workloads. Normally a server # restart is needed in order to lower the fragmentation, or at least to flush # away all the data and create it again. However thanks to this feature # implemented by Oran Agra for Redis 4.0 this process can happen at runtime # in a "hot" way, while the server is running. # # Basically when the fragmentation is over a certain level (see the # configuration options below) Redis will start to create new copies of the # values in contiguous memory regions by exploiting certain specific Jemalloc # features (in order to understand if an allocation is causing fragmentation # and to allocate it in a better place), and at the same time, will release the # old copies of the data. This process, repeated incrementally for all the keys # will cause the fragmentation to drop back to normal values. # # Important things to understand: # # 1. This feature is disabled by default, and only works if you compiled Redis # to use the copy of Jemalloc we ship with the source code of Redis. # This is the default with Linux builds. # # 2. You never need to enable this feature if you don't have fragmentation # issues. # # 3. Once you experience fragmentation, you can enable this feature when # needed with the command "CONFIG SET activedefrag yes". # # The configuration parameters are able to fine tune the behavior of the # defragmentation process. If you are not sure about what they mean it is # a good idea to leave the defaults untouched. # Active defragmentation is disabled by default # activedefrag no # Minimum amount of fragmentation waste to start active defrag # active-defrag-ignore-bytes 100mb # Minimum percentage of fragmentation to start active defrag # active-defrag-threshold-lower 10 # Maximum percentage of fragmentation at which we use maximum effort # active-defrag-threshold-upper 100 # Minimal effort for defrag in CPU percentage, to be used when the lower # threshold is reached # active-defrag-cycle-min 1 # Maximal effort for defrag in CPU percentage, to be used when the upper # threshold is reached # active-defrag-cycle-max 25 # Maximum number of set/hash/zset/list fields that will be processed from # the main dictionary scan # active-defrag-max-scan-fields 1000 # Jemalloc background thread for purging will be enabled by default jemalloc-bg-thread yes # It is possible to pin different threads and processes of Redis to specific # CPUs in your system, in order to maximize the performances of the server. # This is useful both in order to pin different Redis threads in different # CPUs, but also in order to make sure that multiple Redis instances running # in the same host will be pinned to different CPUs. # # Normally you can do this using the "taskset" command, however it is also # possible to this via Redis configuration directly, both in Linux and FreeBSD. # # You can pin the server/IO threads, bio threads, aof rewrite child process, and # the bgsave child process. The syntax to specify the cpu list is the same as # the taskset command: # # Set redis server/io threads to cpu affinity 0,2,4,6: # server_cpulist 0-7:2 # # Set bio threads to cpu affinity 1,3: # bio_cpulist 1,3 # # Set aof rewrite child process to cpu affinity 8,9,10,11: # aof_rewrite_cpulist 8-11 # # Set bgsave child process to cpu affinity 1,10,11 # bgsave_cpulist 1,10-11 # In some cases redis will emit warnings and even refuse to start if it detects # that the system is in bad state, it is possible to suppress these warnings # by setting the following config which takes a space delimited list of warnings # to suppress # # ignore-warnings ARM64-COW-BUG ================================================ FILE: aegir/conf/solr9/analysis-extras.mod ================================================ # Solr module: analysis-extras name=analysis-extras lib.dir=../../modules/analysis-extras/lib class=org.apache.solr.core.SolrResourceLoader ================================================ FILE: aegir/conf/solr9/analytics.mod ================================================ # Solr module: analytics name=analytics lib.dir=../../modules/analytics/lib class=org.apache.solr.core.SolrResourceLoader ================================================ FILE: aegir/conf/solr9/clustering.mod ================================================ # Solr module: clustering name=clustering lib.dir=../../modules/clustering/lib class=org.apache.solr.core.SolrResourceLoader ================================================ FILE: aegir/conf/solr9/cross-dc.mod ================================================ # Solr module: cross-dc name=cross-dc lib.dir=../../modules/cross-dc/lib class=org.apache.solr.core.SolrResourceLoader ================================================ FILE: aegir/conf/solr9/extraction.mod ================================================ # Solr module: extraction name=extraction lib.dir=../../modules/extraction/lib class=org.apache.solr.core.SolrResourceLoader ================================================ FILE: aegir/conf/solr9/gcs-repository.mod ================================================ # Solr module: gcs-repository name=gcs-repository lib.dir=../../modules/gcs-repository/lib class=org.apache.solr.core.SolrResourceLoader ================================================ FILE: aegir/conf/solr9/hadoop-auth.mod ================================================ # Solr module: hadoop-auth name=hadoop-auth lib.dir=../../modules/hadoop-auth/lib class=org.apache.solr.core.SolrResourceLoader ================================================ FILE: aegir/conf/solr9/hdfs.mod ================================================ # Solr module: hdfs name=hdfs lib.dir=../../modules/hdfs/lib class=org.apache.solr.core.SolrResourceLoader ================================================ FILE: aegir/conf/solr9/jaegertracer-configurator.mod ================================================ # Solr module: jaegertracer-configurator name=jaegertracer-configurator lib.dir=../../modules/jaegertracer-configurator/lib class=org.apache.solr.core.SolrResourceLoader ================================================ FILE: aegir/conf/solr9/jwt-auth.mod ================================================ # Solr module: jwt-auth name=jwt-auth lib.dir=../../modules/jwt-auth/lib class=org.apache.solr.core.SolrResourceLoader ================================================ FILE: aegir/conf/solr9/langid.mod ================================================ # Solr module: langid name=langid lib.dir=../../modules/langid/lib class=org.apache.solr.core.SolrResourceLoader ================================================ FILE: aegir/conf/solr9/llm.mod ================================================ # Solr module: llm name=llm lib.dir=../../modules/llm/lib class=org.apache.solr.core.SolrResourceLoader ================================================ FILE: aegir/conf/solr9/ltr.mod ================================================ # Solr module: ltr name=ltr lib.dir=../../modules/ltr/lib class=org.apache.solr.core.SolrResourceLoader ================================================ FILE: aegir/conf/solr9/opentelemetry.mod ================================================ # Solr module: opentelemetry name=opentelemetry lib.dir=../../modules/opentelemetry/lib class=org.apache.solr.core.SolrResourceLoader ================================================ FILE: aegir/conf/solr9/s3-repository.mod ================================================ # Solr module: s3-repository name=s3-repository lib.dir=../../modules/s3-repository/lib class=org.apache.solr.core.SolrResourceLoader ================================================ FILE: aegir/conf/solr9/scripting.mod ================================================ # Solr module: scripting name=scripting lib.dir=../../modules/scripting/lib class=org.apache.solr.core.SolrResourceLoader ================================================ FILE: aegir/conf/solr9/sql.mod ================================================ # Solr module: sql name=sql lib.dir=../../modules/sql/lib class=org.apache.solr.core.SolrResourceLoader ================================================ FILE: aegir/conf/tpl/migration.html ================================================ Server Migration

Server Migration

We are performing server migration and will be back shortly
================================================ FILE: aegir/conf/tpl/robots.txt ================================================ # # robots.txt # # This file is to prevent the crawling and indexing of certain parts # of your site by web crawlers and spiders run by sites like Yahoo! # and Google. By telling these "robots" where not to go on your site, # you save bandwidth and server resources. # # This file will be ignored unless it is at the root of your host: # Used: http://example.com/robots.txt # Ignored: http://example.com/site/robots.txt # # For more information about the robots.txt standard, see: # http://www.robotstxt.org/robotstxt.html # # For syntax checking, see: # http://www.sxw.org.uk/computing/robots/check.html User-agent: * Crawl-delay: 10 # CSS, JS, Images Allow: /misc/*.css$ Allow: /misc/*.css? Allow: /misc/*.js$ Allow: /misc/*.js? Allow: /misc/*.gif Allow: /misc/*.jpg Allow: /misc/*.jpeg Allow: /misc/*.png Allow: /modules/*.css$ Allow: /modules/*.css? Allow: /modules/*.js$ Allow: /modules/*.js? Allow: /modules/*.gif Allow: /modules/*.jpg Allow: /modules/*.jpeg Allow: /modules/*.png Allow: /profiles/*.css$ Allow: /profiles/*.css? Allow: /profiles/*.js$ Allow: /profiles/*.js? Allow: /profiles/*.gif Allow: /profiles/*.jpg Allow: /profiles/*.jpeg Allow: /profiles/*.png Allow: /themes/*.css$ Allow: /themes/*.css? Allow: /themes/*.js$ Allow: /themes/*.js? Allow: /themes/*.gif Allow: /themes/*.jpg Allow: /themes/*.jpeg Allow: /themes/*.png # Directories Disallow: /includes/ Disallow: /misc/ Disallow: /modules/ Disallow: /profiles/ Disallow: /scripts/ Disallow: /themes/ # Files Disallow: /boost_stats.php Disallow: /CHANGELOG.txt Disallow: /cron.php Disallow: /INSTALL.mysql.txt Disallow: /INSTALL.pgsql.txt Disallow: /INSTALL.sqlite.txt Disallow: /install.php Disallow: /INSTALL.txt Disallow: /LICENSE.txt Disallow: /MAINTAINERS.txt Disallow: /update.php Disallow: /UPGRADE.txt Disallow: /xmlrpc.php # Paths (clean URLs) Disallow: /admin/ Disallow: /comment/reply/ Disallow: /filter/tips/ Disallow: /node/add/ Disallow: /search/ Disallow: /user/register/ Disallow: /user/password/ Disallow: /user/login/ Disallow: /user/logout/ # Paths (no clean URLs) Disallow: /?q=admin/ Disallow: /?q=comment/reply/ Disallow: /?q=filter/tips/ Disallow: /?q=node/add/ Disallow: /?q=search/ Disallow: /?q=user/password/ Disallow: /?q=user/register/ Disallow: /?q=user/login/ Disallow: /?q=user/logout/ ================================================ FILE: aegir/conf/tpl/setupmail.txt ================================================ Hello, Welcome to your new Ægir control panel, designed for easy Drupal multi-site deployment, development, and management. Your Ægir control panel [version boa.version] is available at: https://aegir.url.name This Email Covers: 1. Logging into your Ægir control panel 2. Deploying Ægir default websites 3. Adding modules & themes 4. Managing your databases 5. Advanced user information 6. Articles and video tutorials Please read this email thoroughly. It contains important information required to properly leverage all your available Ægir features. ---------------------------------------- 1. LOGGING INTO YOUR AEGIR CONTROL PANEL ---------------------------------------- To access your control panel, visit this URL: https://aegir.url.name If your account has been migrated, use the previous username and password you have already used before, or reset your password using your email address as your username at: https://aegir.url.name/user/password Please double-check your spam folder to ensure all emails are delivered. ---------------------------------------- 2. DEPLOYING YOUR WEBSITES ---------------------------------------- Log into the control panel and start exploring how Ægir works. We are ready to assist and guide you step by step, so please don’t hesitate to ask questions! To create a new site: 1. Click the Add Site tab. 2. After adding a site, click the Home icon on the site's node in Ægir to access the admin area. If the Home icon no longer links to the one-time login page, run the "Reset password" task on the site's node, and once complete, click the Home icon again. For more details on site import and platform management, refer to: - Import Your Sites to Ægir: https://omega8.cc/import-your-sites-to-aegir-in-8-easy-steps-109 - Add Custom Platform: https://omega8.cc/how-to-add-custom-platform-properly-140 - Drupal Site Upgrade Workflow: https://omega8.cc/your-drupal-site-upgrade-safe-workflow-298 To make a site "live" using any domain name, point its A or CNAME DNS record to your Ægir instance public IP address: yourdomain.com. IN A 166.84.6.231 subdomain.yourdomain.com. IN CNAME aegir.url.name. For test sites, use any subdomain in *.aegir.url.name, e.g., http://atrium.aegir.url.name. Need assistance with site import? Contact us: https://omega8.cc/contact ---------------------------------------- 3. ADDING MODULES & THEMES ---------------------------------------- To add modules/themes: 1. Log into your FTPS/SSH/SFTP account: host: aegir.url.name user: dragon.ftp pass: FN8rXcQn port: 21 (FTPS) port: 22 (SSH/SFTP) 2. Type "help" when logged in via SSH to see all available shell commands. 3. Change your password via SSH with the "passwd" command every 3 months. Note: Use Explicit TLS mode with port 21 for FTPS and port 22 for SFTP (unless your Ægir instance uses a non-standard SSH port). Refer to Compatible FTP-SSL/TLS Clients: https://omega8.cc/dev/ftp-tls.txt for more information. ---------------------------------------- 4. MANAGING YOUR DATABASES ---------------------------------------- Manage your databases via the Adminer Manager web interface, using credentials available in each site's drushrc.php file: Adminer Manager URL: https://aegir.url.name/sqladmin/ Note: Keep the SSH session active with a continuous command (e.g., ping -i 30 google.com) to maintain database access. Use a desktop SQL manager that supports SSH tunneling, as remote access over MySQL port 3306 is not available for security reasons. For a video tutorial, visit: http://bit.ly/om8rsql You can also manage databases via command line with Drush commands or tools like mysql and mysqldump. ---------------------------------------- 5. ADVANCED USER INFORMATION ---------------------------------------- How-To Information: Check the built-in docs in your account at ~/static/control/README.txt. Directory Information: - Your home directory contains subdirectories in ~/platforms for different platform releases. - Use symlinks in ~/clients/client-name/ to find all your sites directly. Custom Platform Information: - Upload custom Drupal platforms to ~/static/platforms in separate subdirectories. - Enable custom platforms via the "Add platform" option in your Ægir control panel. Note: Only Pressflow (LTS) core-based platforms are allowed for Drupal 6.x versions; standard Drupal core can be used for Drupal 7 and newer versions. ---------------------------------------- 6. ARTICLES & VIDEO TUTORIALS ---------------------------------------- Video Tutorials: http://bit.ly/aegir8cc Site Import & Development: - Development Library: https://learn.omega8.cc/library/development - Good to Know: https://learn.omega8.cc/library/good-to-know Performance Information: - Performance Library: https://learn.omega8.cc/library/performance - Tips & Tricks: https://learn.omega8.cc/library/tips-and-tricks Useful Hints: Problems & Solutions: https://learn.omega8.cc/library/problems-solutions Recommended Articles: - Biggest Misunderstanding Ever: https://learn.omega8.cc/the-biggest-misunderstanding-ever-122 - Best Recipes for Disaster: https://learn.omega8.cc/the-best-recipes-for-disaster-139 - Good Habits to Learn: https://learn.omega8.cc/are-there-any-specific-good-habits-to-learn-116 For further assistance, contact us: https://omega8.cc/contact Thank you, The Omega8.cc Team ================================================ FILE: aegir/conf/tpl/uc.html ================================================ Under Construction

Under Construction
================================================ FILE: aegir/conf/tpl/upgrademail.txt ================================================ Hello, We are pleased to inform you that your Ægir instance has been successfully upgraded to our new HTTP/3 Edition [boa.version] @=> The future of 100% Open Source Drupal hosting is brighter than ever! With BOA-5.9.1 PRO/LTS, we proudly deliver full HTTP/3 and KTLS support — a fundamental change in the way modern browsers communicate with modern HTTPS web servers — along with the latest OpenSSL 3.5 LTS, which made it possible, and many critical security and bug fixes related to system components. @=> Key Improvements Explained HTTP/3 and KTLS support. If you run Drupal sites that should feel fast and responsive (and stay that way during spikes), this is genuinely good news. Why is this a big deal? What should visitors notice? Read the full story: https://github.com/omega8cc/boa/tree/5.x-dev/HTTP3.md @=> Usage disk/sql limits x2 + Aero and Archive plans added to hosted BOA It's worth mentioning that our hosted BOA plans have received a huge upgrade: several new locations have been added around the world, our vendors are now local (instead of the previous US-only hyperscalers), and an entirely new Archive Tier has been added for those looking to host collections of low-traffic sites at low cost. Take a look if you are interested: https://omega8.cc/hosted @=> Going Local with Infrastructure We’ve expanded our network considerably to meet the growing expectations of the Data Sovereignty movement. This isn’t just about adding more cities to our hosting map — it’s also about going local with infrastructure wherever we can. We no longer rely solely on big-name vendors and hyperscalers. Instead, we’re gradually migrating to local providers and data centers in every country where we offer hosted BOA for Drupal. For example, in Canada you can now choose not only Toronto, but also Montreal, Calgary, and Vancouver. In Australia, it’s no longer just Sydney — we also offer Adelaide, Brisbane, and Perth. We’ve also added an excellent facility in New Zealand. Of course, we continue to support our original Singapore location and still offer EU, UK, and US options. @=> 4 NEW, 12 UPDATED, 32 TOTAL Drupal distros/platforms available While most of you typically build your own codebases/platforms with Composer these days, we still deliver a list of 32 platforms ready to use in your Ægir. Since these platforms are updated only with BOA releases, they are not really intended for production use per se, because you typically need a faster lifecycle to keep your sites secure. However, they provide a wide range of testing playgrounds, because you can install only those you wish to test or use, and reinstall if needed, with the help of our BOA-only feature that allows you to upgrade your Ægir on demand with two simple control files, as described in the built-in docs you can always find in ~/static/control/README.txt. The complete list of 32 can be found at: https://github.com/omega8cc/boa/blob/5.x-dev/docs/PLATFORMS.md @=> You can access your upgraded Ægir instance at the following URL: https://aegir.url.name @=> For detailed information about the upgrade, please refer to: BOA Changelog: https://bit.ly/boa-changelog @=> Please check also the built-in documentation in your account: ~/static/control/README.txt Thank you for choosing Ægir! Best regards, The BOA Dev Team ================================================ FILE: aegir/conf/valkey/valkey-server ================================================ #!/bin/bash ### BEGIN INIT INFO # Provides: valkey-server # Required-Start: $syslog $remote_fs # Required-Stop: $syslog $remote_fs # Should-Start: $local_fs # Should-Stop: $local_fs # Default-Start: 2 3 4 5 # Default-Stop: 0 1 6 # Short-Description: valkey-server - Persistent key-value db # Description: valkey-server - Persistent key-value db ### END INIT INFO PATH=/usr/local/bin:/usr/local/sbin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin DAEMON=/usr/bin/valkey-server DAEMON_ARGS=/etc/valkey/valkey.conf NAME=valkey-server DESC=valkey-server PIDFILE=/run/valkey/valkey.pid test -x $DAEMON || exit 0 [ -d /run/valkey ] || mkdir -p /run/valkey [ -d /run/valkey ] && chown -R valkey:valkey /run/valkey maxclients=$(awk '/^[ \t]*maxclients[ \t]/ { print $2 }' /etc/valkey/valkey.conf) if [ ! -z "$maxclients" ] && [ "$maxclients" -gt 992 ]; then ulimit -n $((maxclients+32)) fi case "$1" in start) echo -n "Starting $DESC: " touch $PIDFILE chown valkey:valkey $PIDFILE if start-stop-daemon --start --quiet --umask 007 --pidfile $PIDFILE --chuid valkey:valkey --exec $DAEMON -- $DAEMON_ARGS then echo "$NAME." else echo "failed" fi ;; stop) echo -n "Stopping $DESC: " if start-stop-daemon --stop --retry 8 --quiet --oknodo --pidfile $PIDFILE --exec $DAEMON then echo "$NAME." else echo "failed" fi rm -f $PIDFILE sleep 1 ;; restart|force-reload) ${0} stop ${0} start ;; reload) echo -n "Reloading service ${NAME}..." if [ ! -r ${PIDFILE} ]; then echo "warning, no pid file found - ${NAME} is not running ?" exit 1 fi kill -USR2 `cat ${PIDFILE}` echo " done" ;; status) echo -n "$DESC is " if start-stop-daemon --stop --quiet --signal 0 --name ${NAME} --pidfile ${PIDFILE} then echo "running" else echo "not running" exit 1 fi ;; *) echo "Usage: service $NAME {start|stop|restart|reload|force-reload}" >&2 exit 1 ;; esac exit 0 ================================================ FILE: aegir/conf/valkey/valkey7.conf ================================================ # Valkey configuration file example. # # Note that in order to read the configuration file, the server must be # started with the file path as first argument: # # ./valkey-server /path/to/valkey.conf # Note on units: when memory size is needed, it is possible to specify # it in the usual form of 1k 5GB 4M and so forth: # # 1k => 1000 bytes # 1kb => 1024 bytes # 1m => 1000000 bytes # 1mb => 1024*1024 bytes # 1g => 1000000000 bytes # 1gb => 1024*1024*1024 bytes # # units are case insensitive so 1GB 1Gb 1gB are all the same. ################################## INCLUDES ################################### # Include one or more other config files here. This is useful if you # have a standard template that goes to all servers but also need # to customize a few per-server settings. Include files can include # other files, so use this wisely. # # Note that option "include" won't be rewritten by command "CONFIG REWRITE" # from admin or Sentinel. Since the server always uses the last processed # line as value of a configuration directive, you'd better put includes # at the beginning of this file to avoid overwriting config change at runtime. # # If instead you are interested in using includes to override configuration # options, it is better to use include as the last line. # # Included paths may contain wildcards. All files matching the wildcards will # be included in alphabetical order. # Note that if an include path contains a wildcards but no files match it when # the server is started, the include statement will be ignored and no error will # be emitted. It is safe, therefore, to include wildcard files from empty # directories. # # include /path/to/local.conf # include /path/to/other.conf # include /path/to/fragments/*.conf # ################################## MODULES ##################################### # Load modules at startup. If the server is not able to load modules # it will abort. It is possible to use multiple loadmodule directives. # # loadmodule /path/to/my_module.so # loadmodule /path/to/other_module.so ################################## NETWORK ##################################### # By default, if no "bind" configuration directive is specified, the server listens # for connections from all available network interfaces on the host machine. # It is possible to listen to just one or multiple selected interfaces using # the "bind" configuration directive, followed by one or more IP addresses. # Each address can be prefixed by "-", which means that the server will not fail to # start if the address is not available. Being not available only refers to # addresses that does not correspond to any network interface. Addresses that # are already in use will always fail, and unsupported protocols will always be # silently skipped. # # Examples: # # xbind 192.168.1.100 10.0.0.1 # listens on two specific IPv4 addresses # xbind 127.0.0.1 ::1 # listens on loopback IPv4 and IPv6 # xbind * -::* # like the default, all available interfaces # # ~~~ WARNING ~~~ If the computer running the server is directly exposed to the # internet, binding to all the interfaces is dangerous and will expose the # instance to everybody on the internet. So by default we uncomment the # following bind directive, that will force the server to listen only on the # IPv4 and IPv6 (if available) loopback interface addresses (this means the server # will only be able to accept client connections from the same host that it is # running on). # # IF YOU ARE SURE YOU WANT YOUR INSTANCE TO LISTEN TO ALL THE INTERFACES # COMMENT OUT THE FOLLOWING LINE. # # You will also need to set a password unless you explicitly disable protected # mode. # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ bind 127.0.0.1 # By default, outgoing connections (from replica to master, from Sentinel to # instances, cluster bus, etc.) are not bound to a specific local address. In # most cases, this means the operating system will handle that based on routing # and the interface through which the connection goes out. # # Using bind-source-addr it is possible to configure a specific address to bind # to, which may also affect how the connection gets routed. # # Example: # # bind-source-addr 10.0.0.1 # Protected mode is a layer of security protection, in order to avoid that # the server instances left open on the internet are accessed and exploited. # # When protected mode is on and the default user has no password, the server # only accepts local connections from the IPv4 address (127.0.0.1), IPv6 address # (::1) or Unix domain sockets. # # By default protected mode is enabled. You should disable it only if # you are sure you want clients from other hosts to connect to the server # even if no authentication is configured. protected-mode yes # The server uses default hardened security configuration directives to reduce the # attack surface on innocent users. Therefore, several sensitive configuration # directives are immutable, and some potentially-dangerous commands are blocked. # # Configuration directives that control files that the server writes to (e.g., 'dir' # and 'dbfilename') and that aren't usually modified during runtime # are protected by making them immutable. # # Commands that can increase the attack surface of the server and that aren't usually # called by users are blocked by default. # # These can be exposed to either all connections or just local ones by setting # each of the configs listed below to either of these values: # # no - Block for any connection (remain immutable) # yes - Allow for any connection (no protection) # local - Allow only for local connections. Ones originating from the # IPv4 address (127.0.0.1), IPv6 address (::1) or Unix domain sockets. # # enable-protected-configs no # enable-debug-command no # enable-module-command no # Accept connections on the specified port, default is 6379 (IANA #815344). # If port 0 is specified the server will not listen on a TCP socket. port 6379 # TCP listen() backlog. # # In high requests-per-second environments you need a high backlog in order # to avoid slow clients connection issues. Note that the Linux kernel # will silently truncate it to the value of /proc/sys/net/core/somaxconn so # make sure to raise both the value of somaxconn and tcp_max_syn_backlog # in order to get the desired effect. tcp-backlog 511 # Unix socket. # # Specify the path for the Unix socket that will be used to listen for # incoming connections. There is no default, so the server will not listen # on a unix socket when not specified. # # unixsocket /run/valkey/valkey.sock # unixsocketperm 777 # Close the connection after a client is idle for N seconds (0 to disable) timeout 900 # TCP keepalive. # # If non-zero, use SO_KEEPALIVE to send TCP ACKs to clients in absence # of communication. This is useful for two reasons: # # 1) Detect dead peers. # 2) Force network equipment in the middle to consider the connection to be # alive. # # On Linux, the specified value (in seconds) is the period used to send ACKs. # Note that to close the connection the double of the time is needed. # On other kernels the period depends on the kernel configuration. tcp-keepalive 300 # Apply OS-specific mechanism to mark the listening socket with the specified # ID, to support advanced routing and filtering capabilities. # # On Linux, the ID represents a connection mark. # On FreeBSD, the ID represents a socket cookie ID. # On OpenBSD, the ID represents a route table ID. # # The default value is 0, which implies no marking is required. # socket-mark-id 0 ################################# TLS/SSL ##################################### # By default, TLS/SSL is disabled. To enable it, the "tls-port" configuration # directive can be used to define TLS-listening ports. To enable TLS on the # default port, use: # # port 0 # tls-port 6379 # Configure a X.509 certificate and private key to use for authenticating the # server to connected clients, masters or cluster peers. These files should be # PEM formatted. # # tls-cert-file valkey.crt # tls-key-file valkey.key # # If the key file is encrypted using a passphrase, it can be included here # as well. # # tls-key-file-pass secret # Normally the server uses the same certificate for both server functions (accepting # connections) and client functions (replicating from a master, establishing # cluster bus connections, etc.). # # Sometimes certificates are issued with attributes that designate them as # client-only or server-only certificates. In that case it may be desired to use # different certificates for incoming (server) and outgoing (client) # connections. To do that, use the following directives: # # tls-client-cert-file client.crt # tls-client-key-file client.key # # If the key file is encrypted using a passphrase, it can be included here # as well. # # tls-client-key-file-pass secret # Configure a DH parameters file to enable Diffie-Hellman (DH) key exchange, # required by older versions of OpenSSL (<3.0). Newer versions do not require # this configuration and recommend against it. # # tls-dh-params-file valkey.dh # Configure a CA certificate(s) bundle or directory to authenticate TLS/SSL # clients and peers. The server requires an explicit configuration of at least one # of these, and will not implicitly use the system wide configuration. # # tls-ca-cert-file ca.crt # tls-ca-cert-dir /etc/ssl/certs # By default, clients (including replica servers) on a TLS port are required # to authenticate using valid client side certificates. # # If "no" is specified, client certificates are not required and not accepted. # If "optional" is specified, client certificates are accepted and must be # valid if provided, but are not required. # # tls-auth-clients no # tls-auth-clients optional # By default, a replica does not attempt to establish a TLS connection # with its master. # # Use the following directive to enable TLS on replication links. # # tls-replication yes # By default, the cluster bus uses a plain TCP connection. To enable # TLS for the bus protocol, use the following directive: # # tls-cluster yes # By default, only TLSv1.2 and TLSv1.3 are enabled and it is highly recommended # that older formally deprecated versions are kept disabled to reduce the attack surface. # You can explicitly specify TLS versions to support. # Allowed values are case insensitive and include "TLSv1", "TLSv1.1", "TLSv1.2", # "TLSv1.3" (OpenSSL >= 1.1.1) or any combination. # To enable only TLSv1.2 and TLSv1.3, use: # # tls-protocols "TLSv1.2 TLSv1.3" # Configure allowed ciphers. See the ciphers(1ssl) manpage for more information # about the syntax of this string. # # Note: this configuration applies only to <= TLSv1.2. # # tls-ciphers DEFAULT:!MEDIUM # Configure allowed TLSv1.3 ciphersuites. See the ciphers(1ssl) manpage for more # information about the syntax of this string, and specifically for TLSv1.3 # ciphersuites. # # tls-ciphersuites TLS_CHACHA20_POLY1305_SHA256 # When choosing a cipher, use the server's preference instead of the client # preference. By default, the server follows the client's preference. # # tls-prefer-server-ciphers yes # By default, TLS session caching is enabled to allow faster and less expensive # reconnections by clients that support it. Use the following directive to disable # caching. # # tls-session-caching no # Change the default number of TLS sessions cached. A zero value sets the cache # to unlimited size. The default size is 20480. # # tls-session-cache-size 5000 # Change the default timeout of cached TLS sessions. The default timeout is 300 # seconds. # # tls-session-cache-timeout 60 ################################# GENERAL ##################################### # By default the server does not run as a daemon. Use 'yes' if you need it. # Note that the server will write a pid file in /run/valkey/valkey.pid when daemonized. # When the server is supervised by upstart or systemd, this parameter has no impact. daemonize yes # If you run the server from upstart or systemd, the server can interact with your # supervision tree. Options: # supervised no - no supervision interaction # supervised upstart - signal upstart by putting the server into SIGSTOP mode # requires "expect stop" in your upstart job config # supervised systemd - signal systemd by writing READY=1 to $NOTIFY_SOCKET # on startup, and updating the server status on a regular # basis. # supervised auto - detect upstart or systemd method based on # UPSTART_JOB or NOTIFY_SOCKET environment variables # Note: these supervision methods only signal "process is ready." # They do not enable continuous pings back to your supervisor. # # The default is "no". To run under upstart/systemd, you can simply uncomment # the line below: # # supervised auto # If a pid file is specified, the server writes it where specified at startup # and removes it at exit. # # When the server runs non daemonized, no pid file is created if none is # specified in the configuration. When the server is daemonized, the pid file # is used even if not specified, defaulting to "/run/valkey/valkey.pid". # # Creating a pid file is best effort: if the server is not able to create it # nothing bad happens, the server will start and run normally. # # Note that on modern Linux systems "/run/valkey/valkey.pid" is more conforming # and should be used instead. pidfile /run/valkey/valkey.pid # Specify the server verbosity level. # This can be one of: # debug (a lot of information, useful for development/testing) # verbose (many rarely useful info, but not a mess like the debug level) # notice (moderately verbose, what you want in production probably) # warning (only very important / critical messages are logged) # nothing (nothing is logged) loglevel warning # Specify the log file name. Also the empty string can be used to force # the server to log on the standard output. Note that if you use standard # output for logging but daemonize, logs will be sent to /dev/null logfile /var/log/valkey/valkey-server.log # To enable logging to the system logger, just set 'syslog-enabled' to yes, # and optionally update the other syslog parameters to suit your needs. # syslog-enabled no # Specify the syslog identity. # syslog-ident valkey # Specify the syslog facility. Must be USER or between LOCAL0-LOCAL7. # syslog-facility local0 # To disable the built in crash log, which will possibly produce cleaner core # dumps when they are needed, uncomment the following: # # crash-log-enabled no # To disable the fast memory check that's run as part of the crash log, which # will possibly let the server terminate sooner, uncomment the following: # # crash-memcheck-enabled no # Set the number of databases. The default database is DB 0, you can select # a different one on a per-connection basis using SELECT where # dbid is a number between 0 and 'databases'-1 databases 8 # By default the server shows an ASCII art logo only when started to log to the # standard output and if the standard output is a TTY and syslog logging is # disabled. Basically this means that normally a logo is displayed only in # interactive sessions. # # However it is possible to force the pre-4.0 behavior and always show a # ASCII art logo in startup logs by setting the following option to yes. always-show-logo no # By default, the server modifies the process title (as seen in 'top' and 'ps') to # provide some runtime information. It is possible to disable this and leave # the process name as executed by setting the following to no. set-proc-title yes # When changing the process title, the server uses the following template to construct # the modified title. # # Template variables are specified in curly brackets. The following variables are # supported: # # {title} Name of process as executed if parent, or type of child process. # {listen-addr} Bind address or '*' followed by TCP or TLS port listening on, or # Unix socket if only that's available. # {server-mode} Special mode, i.e. "[sentinel]" or "[cluster]". # {port} TCP port listening on, or 0. # {tls-port} TLS port listening on, or 0. # {unixsocket} Unix domain socket listening on, or "". # {config-file} Name of configuration file used. # proc-title-template "{title} {listen-addr} {server-mode}" # Set the local environment which is used for string comparison operations, and # also affect the performance of Lua scripts. Empty String indicates the locale # is derived from the environment variables. locale-collate "" ################################ SNAPSHOTTING ################################ # Save the DB to disk. # # save [ ...] # # The server will save the DB if the given number of seconds elapsed and it # surpassed the given number of write operations against the DB. # # Snapshotting can be completely disabled with a single empty string argument # as in following example: # # save "" # # Unless specified otherwise, by default the server will save the DB: # * After 3600 seconds (an hour) if at least 1 change was performed # * After 300 seconds (5 minutes) if at least 100 changes were performed # * After 60 seconds if at least 10000 changes were performed # # You can set these explicitly by uncommenting the following line. # # save 3600 1 300 100 60 10000 # By default the server will stop accepting writes if RDB snapshots are enabled # (at least one save point) and the latest background save failed. # This will make the user aware (in a hard way) that data is not persisting # on disk properly, otherwise chances are that no one will notice and some # disaster will happen. # # If the background saving process will start working again, the server will # automatically allow writes again. # # However if you have setup your proper monitoring of the server # and persistence, you may want to disable this feature so that the server will # continue to work as usual even if there are problems with disk, # permissions, and so forth. stop-writes-on-bgsave-error no # Compress string objects using LZF when dump .rdb databases? # By default compression is enabled as it's almost always a win. # If you want to save some CPU in the saving child set it to 'no' but # the dataset will likely be bigger if you have compressible values or keys. rdbcompression yes # Since version 5 of RDB a CRC64 checksum is placed at the end of the file. # This makes the format more resistant to corruption but there is a performance # hit to pay (around 10%) when saving and loading RDB files, so you can disable it # for maximum performances. # # RDB files created with checksum disabled have a checksum of zero that will # tell the loading code to skip the check. rdbchecksum no # Enables or disables full sanitization checks for ziplist and listpack etc when # loading an RDB or RESTORE payload. This reduces the chances of a assertion or # crash later on while processing commands. # Options: # no - Never perform full sanitization # yes - Always perform full sanitization # clients - Perform full sanitization only for user connections. # Excludes: RDB files, RESTORE commands received from the master # connection, and client connections which have the # skip-sanitize-payload ACL flag. # The default should be 'clients' but since it currently affects cluster # resharding via MIGRATE, it is temporarily set to 'no' by default. # # sanitize-dump-payload no # The filename where to dump the DB dbfilename dump.rdb # Remove RDB files used by replication in instances without persistence # enabled. By default this option is disabled, however there are environments # where for regulations or other security concerns, RDB files persisted on # disk by masters in order to feed replicas, or stored on disk by replicas # in order to load them for the initial synchronization, should be deleted # ASAP. Note that this option ONLY WORKS in instances that have both AOF # and RDB persistence disabled, otherwise is completely ignored. # # An alternative (and sometimes better) way to obtain the same effect is # to use diskless replication on both master and replicas instances. However # in the case of replicas, diskless is not always an option. rdb-del-sync-files no # The working directory. # # The DB will be written inside this directory, with the filename specified # above using the 'dbfilename' configuration directive. # # The Append Only File will also be created inside this directory. # # Note that you must specify a directory here, not a file name. dir /var/lib/valkey/ ################################# REPLICATION ################################# # Master-Replica replication. Use replicaof to make a server a copy of # another server. A few things to understand ASAP about replication. # # +------------------+ +---------------+ # | Master | ---> | Replica | # | (receive writes) | | (exact copy) | # +------------------+ +---------------+ # # 1) Replication is asynchronous, but you can configure a master to # stop accepting writes if it appears to be not connected with at least # a given number of replicas. # 2) Replicas are able to perform a partial resynchronization with the # master if the replication link is lost for a relatively small amount of # time. You may want to configure the replication backlog size (see the next # sections of this file) with a sensible value depending on your needs. # 3) Replication is automatic and does not need user intervention. After a # network partition replicas automatically try to reconnect to masters # and resynchronize with them. # # replicaof # If the master is password protected (using the "requirepass" configuration # directive below) it is possible to tell the replica to authenticate before # starting the replication synchronization process, otherwise the master will # refuse the replica request. # # masterauth # # However this is not enough if you are using ACLs # and the default user is not capable of running the PSYNC # command and/or other commands needed for replication. In this case it's # better to configure a special user to use with replication, and specify the # masteruser configuration as such: # # masteruser # # When masteruser is specified, the replica will authenticate against its # master using the new AUTH form: AUTH . # When a replica loses its connection with the master, or when the replication # is still in progress, the replica can act in two different ways: # # 1) if replica-serve-stale-data is set to 'yes' (the default) the replica will # still reply to client requests, possibly with out of date data, or the # data set may just be empty if this is the first synchronization. # # 2) If replica-serve-stale-data is set to 'no' the replica will reply with error # "MASTERDOWN Link with MASTER is down and replica-serve-stale-data is set to 'no'" # to all data access commands, excluding commands such as: # INFO, REPLICAOF, AUTH, SHUTDOWN, REPLCONF, ROLE, CONFIG, SUBSCRIBE, # UNSUBSCRIBE, PSUBSCRIBE, PUNSUBSCRIBE, PUBLISH, PUBSUB, COMMAND, POST, # HOST and LATENCY. # replica-serve-stale-data yes # You can configure a replica instance to accept writes or not. Writing against # a replica instance may be useful to store some ephemeral data (because data # written on a replica will be easily deleted after resync with the master) but # may also cause problems if clients are writing to it because of a # misconfiguration. # # By default, replicas are read-only. # # Note: read only replicas are not designed to be exposed to untrusted clients # on the internet. It's just a protection layer against misuse of the instance. # Still a read only replica exports by default all the administrative commands # such as CONFIG, DEBUG, and so forth. To a limited extent you can improve # security of read only replicas using 'rename-command' to shadow all the # administrative / dangerous commands. replica-read-only yes # Replication SYNC strategy: disk or socket. # # New replicas and reconnecting replicas that are not able to continue the # replication process just receiving differences, need to do what is called a # "full synchronization". An RDB file is transmitted from the master to the # replicas. # # The transmission can happen in two different ways: # # 1) Disk-backed: The master creates a new process that writes the RDB # file on disk. Later the file is transferred by the parent # process to the replicas incrementally. # 2) Diskless: The master creates a new process that directly writes the # RDB file to replica sockets, without touching the disk at all. # # With disk-backed replication, while the RDB file is generated, more replicas # can be queued and served with the RDB file as soon as the current child # producing the RDB file finishes its work. With diskless replication instead # once the transfer starts, new replicas arriving will be queued and a new # transfer will start when the current one terminates. # # When diskless replication is used, the master waits a configurable amount of # time (in seconds) before starting the transfer in the hope that multiple # replicas will arrive and the transfer can be parallelized. # # With slow disks and fast (large bandwidth) networks, diskless replication # works better. repl-diskless-sync yes # When diskless replication is enabled, it is possible to configure the delay # the server waits in order to spawn the child that transfers the RDB via socket # to the replicas. # # This is important since once the transfer starts, it is not possible to serve # new replicas arriving, that will be queued for the next RDB transfer, so the # server waits a delay in order to let more replicas arrive. # # The delay is specified in seconds, and by default is 5 seconds. To disable # it entirely just set it to 0 seconds and the transfer will start ASAP. repl-diskless-sync-delay 5 # When diskless replication is enabled with a delay, it is possible to let # the replication start before the maximum delay is reached if the maximum # number of replicas expected have connected. Default of 0 means that the # maximum is not defined and the server will wait the full delay. repl-diskless-sync-max-replicas 0 # ----------------------------------------------------------------------------- # WARNING: Since in this setup the replica does not immediately store an RDB on # disk, it may cause data loss during failovers. RDB diskless load + server # modules not handling I/O reads may cause the server to abort in case of I/O errors # during the initial synchronization stage with the master. # ----------------------------------------------------------------------------- # # Replica can load the RDB it reads from the replication link directly from the # socket, or store the RDB to a file and read that file after it was completely # received from the master. # # In many cases the disk is slower than the network, and storing and loading # the RDB file may increase replication time (and even increase the master's # Copy on Write memory and replica buffers). # However, when parsing the RDB file directly from the socket, in order to avoid # data loss it's only safe to flush the current dataset when the new dataset is # fully loaded in memory, resulting in higher memory usage. # For this reason we have the following options: # # "disabled" - Don't use diskless load (store the rdb file to the disk first) # "swapdb" - Keep current db contents in RAM while parsing the data directly # from the socket. Replicas in this mode can keep serving current # dataset while replication is in progress, except for cases where # they can't recognize master as having a data set from same # replication history. # Note that this requires sufficient memory, if you don't have it, # you risk an OOM kill. # "on-empty-db" - Use diskless load only when current dataset is empty. This is # safer and avoid having old and new dataset loaded side by side # during replication. repl-diskless-load disabled # Master send PINGs to its replicas in a predefined interval. It's possible to # change this interval with the repl_ping_replica_period option. The default # value is 10 seconds. # # repl-ping-replica-period 10 # The following option sets the replication timeout for: # # 1) Bulk transfer I/O during SYNC, from the point of view of replica. # 2) Master timeout from the point of view of replicas (data, pings). # 3) Replica timeout from the point of view of masters (REPLCONF ACK pings). # # It is important to make sure that this value is greater than the value # specified for repl-ping-replica-period otherwise a timeout will be detected # every time there is low traffic between the master and the replica. The default # value is 60 seconds. # # repl-timeout 60 # Disable TCP_NODELAY on the replica socket after SYNC? # # If you select "yes", the server will use a smaller number of TCP packets and # less bandwidth to send data to replicas. But this can add a delay for # the data to appear on the replica side, up to 40 milliseconds with # Linux kernels using a default configuration. # # If you select "no" the delay for data to appear on the replica side will # be reduced but more bandwidth will be used for replication. # # By default we optimize for low latency, but in very high traffic conditions # or when the master and replicas are many hops away, turning this to "yes" may # be a good idea. repl-disable-tcp-nodelay no # Set the replication backlog size. The backlog is a buffer that accumulates # replica data when replicas are disconnected for some time, so that when a # replica wants to reconnect again, often a full resync is not needed, but a # partial resync is enough, just passing the portion of data the replica # missed while disconnected. # # The bigger the replication backlog, the longer the replica can endure the # disconnect and later be able to perform a partial resynchronization. # # The backlog is only allocated if there is at least one replica connected. # # repl-backlog-size 1mb # After a master has no connected replicas for some time, the backlog will be # freed. The following option configures the amount of seconds that need to # elapse, starting from the time the last replica disconnected, for the backlog # buffer to be freed. # # Note that replicas never free the backlog for timeout, since they may be # promoted to masters later, and should be able to correctly "partially # resynchronize" with other replicas: hence they should always accumulate backlog. # # A value of 0 means to never release the backlog. # # repl-backlog-ttl 3600 # The replica priority is an integer number published by the server in the INFO # output. It is used by Sentinel in order to select a replica to promote # into a master if the master is no longer working correctly. # # A replica with a low priority number is considered better for promotion, so # for instance if there are three replicas with priority 10, 100, 25 Sentinel # will pick the one with priority 10, that is the lowest. # # However a special priority of 0 marks the replica as not able to perform the # role of master, so a replica with priority of 0 will never be selected by # Sentinel for promotion. # # By default the priority is 100. replica-priority 100 # The propagation error behavior controls how the server will behave when it is # unable to handle a command being processed in the replication stream from a master # or processed while reading from an AOF file. Errors that occur during propagation # are unexpected, and can cause data inconsistency. # # If an application wants to ensure there is no data divergence, this configuration # should be set to 'panic' instead. The value can also be set to 'panic-on-replicas' # to only panic when a replica encounters an error on the replication stream. One of # these two panic values will become the default value in the future once there are # sufficient safety mechanisms in place to prevent false positive crashes. # # propagation-error-behavior ignore # Replica ignore disk write errors controls the behavior of a replica when it is # unable to persist a write command received from its master to disk. By default, # this configuration is set to 'no' and will crash the replica in this condition. # It is not recommended to change this default. # # replica-ignore-disk-write-errors no # ----------------------------------------------------------------------------- # By default, Sentinel includes all replicas in its reports. A replica # can be excluded from Sentinel's announcements. An unannounced replica # will be ignored by the 'sentinel replicas ' command and won't be # exposed to Sentinel's clients. # # This option does not change the behavior of replica-priority. Even with # replica-announced set to 'no', the replica can be promoted to master. To # prevent this behavior, set replica-priority to 0. # # replica-announced yes # It is possible for a master to stop accepting writes if there are less than # N replicas connected, having a lag less or equal than M seconds. # # The N replicas need to be in "online" state. # # The lag in seconds, that must be <= the specified value, is calculated from # the last ping received from the replica, that is usually sent every second. # # This option does not GUARANTEE that N replicas will accept the write, but # will limit the window of exposure for lost writes in case not enough replicas # are available, to the specified number of seconds. # # For example to require at least 3 replicas with a lag <= 10 seconds use: # # min-replicas-to-write 3 # min-replicas-max-lag 10 # # Setting one or the other to 0 disables the feature. # # By default min-replicas-to-write is set to 0 (feature disabled) and # min-replicas-max-lag is set to 10. # A master is able to list the address and port of the attached # replicas in different ways. For example the "INFO replication" section # offers this information, which is used, among other tools, by # Sentinel in order to discover replica instances. # Another place where this info is available is in the output of the # "ROLE" command of a master. # # The listed IP address and port normally reported by a replica is # obtained in the following way: # # IP: The address is auto detected by checking the peer address # of the socket used by the replica to connect with the master. # # Port: The port is communicated by the replica during the replication # handshake, and is normally the port that the replica is using to # listen for connections. # # However when port forwarding or Network Address Translation (NAT) is # used, the replica may actually be reachable via different IP and port # pairs. The following two options can be used by a replica in order to # report to its master a specific set of IP and port, so that both INFO # and ROLE will report those values. # # There is no need to use both the options if you need to override just # the port or the IP address. # # replica-announce-ip 5.5.5.5 # replica-announce-port 1234 ############################### KEYS TRACKING ################################# # The client side caching of values is assisted via server-side support. # This is implemented using an invalidation table that remembers, using # a radix key indexed by key name, what clients have which keys. In turn # this is used in order to send invalidation messages to clients. Please # check this page to understand more about the feature: # # https://valkey.io/topics/client-side-caching # # When tracking is enabled for a client, all the read only queries are assumed # to be cached: this will force the server to store information in the invalidation # table. When keys are modified, such information is flushed away, and # invalidation messages are sent to the clients. However if the workload is # heavily dominated by reads, the server could use more and more memory in order # to track the keys fetched by many clients. # # For this reason it is possible to configure a maximum fill value for the # invalidation table. By default it is set to 1M of keys, and once this limit # is reached, the server will start to evict keys in the invalidation table # even if they were not modified, just to reclaim memory: this will in turn # force the clients to invalidate the cached values. Basically the table # maximum size is a trade off between the memory you want to spend server # side to track information about who cached what, and the ability of clients # to retain cached objects in memory. # # If you set the value to 0, it means there are no limits, and the server will # retain as many keys as needed in the invalidation table. # In the "stats" INFO section, you can find information about the number of # keys in the invalidation table at every given moment. # # Note: when key tracking is used in broadcasting mode, no memory is used # in the server side so this setting is useless. # # tracking-table-max-keys 1000000 ################################## SECURITY ################################### # Warning: since the server is pretty fast, an outside user can try up to # 1 million passwords per second against a modern box. This means that you # should use very strong passwords, otherwise they will be very easy to break. # Note that because the password is really a shared secret between the client # and the server, and should not be memorized by any human, the password # can be easily a long string from /dev/urandom or whatever, so by using a # long and unguessable password no brute force attack will be possible. # ACL users are defined in the following format: # # user ... acl rules ... # # For example: # # user worker +@list +@connection ~jobs:* on >ffa9203c493aa99 # # The special username "default" is used for new connections. If this user # has the "nopass" rule, then new connections will be immediately authenticated # as the "default" user without the need of any password provided via the # AUTH command. Otherwise if the "default" user is not flagged with "nopass" # the connections will start in not authenticated state, and will require # AUTH (or the HELLO command AUTH option) in order to be authenticated and # start to work. # # The ACL rules that describe what a user can do are the following: # # on Enable the user: it is possible to authenticate as this user. # off Disable the user: it's no longer possible to authenticate # with this user, however the already authenticated connections # will still work. # skip-sanitize-payload RESTORE dump-payload sanitization is skipped. # sanitize-payload RESTORE dump-payload is sanitized (default). # + Allow the execution of that command. # May be used with `|` for allowing subcommands (e.g "+config|get") # - Disallow the execution of that command. # May be used with `|` for blocking subcommands (e.g "-config|set") # +@ Allow the execution of all the commands in such category # with valid categories are like @admin, @set, @sortedset, ... # and so forth, see the full list in the server.c file where # the server command table is described and defined. # The special category @all means all the commands, but currently # present in the server, and that will be loaded in the future # via modules. # +|first-arg Allow a specific first argument of an otherwise # disabled command. It is only supported on commands with # no sub-commands, and is not allowed as negative form # like -SELECT|1, only additive starting with "+". This # feature is deprecated and may be removed in the future. # allcommands Alias for +@all. Note that it implies the ability to execute # all the future commands loaded via the modules system. # nocommands Alias for -@all. # ~ Add a pattern of keys that can be mentioned as part of # commands. For instance ~* allows all the keys. The pattern # is a glob-style pattern like the one of KEYS. # It is possible to specify multiple patterns. # %R~ Add key read pattern that specifies which keys can be read # from. # %W~ Add key write pattern that specifies which keys can be # written to. # allkeys Alias for ~* # resetkeys Flush the list of allowed keys patterns. # & Add a glob-style pattern of Pub/Sub channels that can be # accessed by the user. It is possible to specify multiple channel # patterns. # allchannels Alias for &* # resetchannels Flush the list of allowed channel patterns. # > Add this password to the list of valid password for the user. # For example >mypass will add "mypass" to the list. # This directive clears the "nopass" flag (see later). # < Remove this password from the list of valid passwords. # nopass All the set passwords of the user are removed, and the user # is flagged as requiring no password: it means that every # password will work against this user. If this directive is # used for the default user, every new connection will be # immediately authenticated with the default user without # any explicit AUTH command required. Note that the "resetpass" # directive will clear this condition. # resetpass Flush the list of allowed passwords. Moreover removes the # "nopass" status. After "resetpass" the user has no associated # passwords and there is no way to authenticate without adding # some password (or setting it as "nopass" later). # reset Performs the following actions: resetpass, resetkeys, resetchannels, # allchannels (if acl-pubsub-default is set), off, clearselectors, -@all. # The user returns to the same state it has immediately after its creation. # () Create a new selector with the options specified within the # parentheses and attach it to the user. Each option should be # space separated. The first character must be ( and the last # character must be ). # clearselectors Remove all of the currently attached selectors. # Note this does not change the "root" user permissions, # which are the permissions directly applied onto the # user (outside the parentheses). # # ACL rules can be specified in any order: for instance you can start with # passwords, then flags, or key patterns. However note that the additive # and subtractive rules will CHANGE MEANING depending on the ordering. # For instance see the following example: # # user alice on +@all -DEBUG ~* >somepassword # # This will allow "alice" to use all the commands with the exception of the # DEBUG command, since +@all added all the commands to the set of the commands # alice can use, and later DEBUG was removed. However if we invert the order # of two ACL rules the result will be different: # # user alice on -DEBUG +@all ~* >somepassword # # Now DEBUG was removed when alice had yet no commands in the set of allowed # commands, later all the commands are added, so the user will be able to # execute everything. # # Basically ACL rules are processed left-to-right. # # The following is a list of command categories and their meanings: # * keyspace - Writing or reading from keys, databases, or their metadata # in a type agnostic way. Includes DEL, RESTORE, DUMP, RENAME, EXISTS, DBSIZE, # KEYS, EXPIRE, TTL, FLUSHALL, etc. Commands that may modify the keyspace, # key or metadata will also have `write` category. Commands that only read # the keyspace, key or metadata will have the `read` category. # * read - Reading from keys (values or metadata). Note that commands that don't # interact with keys, will not have either `read` or `write`. # * write - Writing to keys (values or metadata) # * admin - Administrative commands. Normal applications will never need to use # these. Includes REPLICAOF, CONFIG, DEBUG, SAVE, MONITOR, ACL, SHUTDOWN, etc. # * dangerous - Potentially dangerous (each should be considered with care for # various reasons). This includes FLUSHALL, MIGRATE, RESTORE, SORT, KEYS, # CLIENT, DEBUG, INFO, CONFIG, SAVE, REPLICAOF, etc. # * connection - Commands affecting the connection or other connections. # This includes AUTH, SELECT, COMMAND, CLIENT, ECHO, PING, etc. # * blocking - Potentially blocking the connection until released by another # command. # * fast - Fast O(1) commands. May loop on the number of arguments, but not the # number of elements in the key. # * slow - All commands that are not Fast. # * pubsub - PUBLISH / SUBSCRIBE related # * transaction - WATCH / MULTI / EXEC related commands. # * scripting - Scripting related. # * set - Data type: sets related. # * sortedset - Data type: zsets related. # * list - Data type: lists related. # * hash - Data type: hashes related. # * string - Data type: strings related. # * bitmap - Data type: bitmaps related. # * hyperloglog - Data type: hyperloglog related. # * geo - Data type: geo related. # * stream - Data type: streams related. # # For more information about ACL configuration please refer to # the Valkey web site at https://valkey.io/topics/acl # ACL LOG # # The ACL Log tracks failed commands and authentication events associated # with ACLs. The ACL Log is useful to troubleshoot failed commands blocked # by ACLs. The ACL Log is stored in memory. You can reclaim memory with # ACL LOG RESET. Define the maximum entry length of the ACL Log below. acllog-max-len 128 # Using an external ACL file # # Instead of configuring users here in this file, it is possible to use # a stand-alone file just listing users. The two methods cannot be mixed: # if you configure users here and at the same time you activate the external # ACL file, the server will refuse to start. # # The format of the external ACL user file is exactly the same as the # format that is used inside valkey.conf to describe users. # # aclfile /etc/valkey/users.acl # IMPORTANT NOTE: "requirepass" is just a compatibility # layer on top of the new ACL system. The option effect will be just setting # the password for the default user. Clients will still authenticate using # AUTH as usually, or more explicitly with AUTH default # if they follow the new protocol: both will work. # # The requirepass is not compatible with aclfile option and the ACL LOAD # command, these will cause requirepass to be ignored. # user default on >isfoobared allcommands allkeys # The default Pub/Sub channels permission for new users is controlled by the # acl-pubsub-default configuration directive, which accepts one of these values: # # allchannels: grants access to all Pub/Sub channels # resetchannels: revokes access to all Pub/Sub channels # # acl-pubsub-default defaults to 'resetchannels' permission. # # acl-pubsub-default resetchannels # Command renaming (DEPRECATED). # # ------------------------------------------------------------------------ # WARNING: avoid using this option if possible. Instead use ACLs to remove # commands from the default user, and put them only in some admin user you # create for administrative purposes. # ------------------------------------------------------------------------ # # It is possible to change the name of dangerous commands in a shared # environment. For instance the CONFIG command may be renamed into something # hard to guess so that it will still be available for internal-use tools # but not available for general clients. # # Example: # # rename-command CONFIG b840fc02d524045429941cc15f59e41cb7be6c52 # # It is also possible to completely kill a command by renaming it into # an empty string: # # rename-command CONFIG "" # # Please note that changing the name of commands that are logged into the # AOF file or transmitted to replicas may cause problems. ################################### CLIENTS #################################### # Set the max number of connected clients at the same time. By default # this limit is set to 10000 clients, however if the server is not # able to configure the process file limit to allow for the specified limit # the max number of allowed clients is set to the current file limit # minus 32 (as the server reserves a few file descriptors for internal uses). # # Once the limit is reached the server will close all the new connections sending # an error 'max number of clients reached'. # # IMPORTANT: With a cluster-enabled setup, the max number of connections is also # shared with the cluster bus: every node in the cluster will use two # connections, one incoming and another outgoing. It is important to size the # limit accordingly in case of very large clusters. # maxclients 4000 ############################## MEMORY MANAGEMENT ################################ # Set a memory usage limit to the specified amount of bytes. # When the memory limit is reached the server will try to remove keys # according to the eviction policy selected (see maxmemory-policy). # # If the server can't remove keys according to the policy, or if the policy is # set to 'noeviction', the server will start to reply with errors to commands # that would use more memory, like SET, LPUSH, and so on, and will continue # to reply to read-only commands like GET. # # This option is usually useful when using the server as an LRU or LFU cache, or to # set a hard memory limit for an instance (using the 'noeviction' policy). # # WARNING: If you have replicas attached to an instance with maxmemory on, # the size of the output buffers needed to feed the replicas are subtracted # from the used memory count, so that network problems / resyncs will # not trigger a loop where keys are evicted, and in turn the output # buffer of replicas is full with DELs of keys evicted triggering the deletion # of more keys, and so forth until the database is completely emptied. # # In short... if you have replicas attached it is suggested that you set a lower # limit for maxmemory so that there is some free RAM on the system for replica # output buffers (but this is not needed if the policy is 'noeviction'). # maxmemory 88MB # MAXMEMORY POLICY: how the server will select what to remove when maxmemory # is reached. You can select one from the following behaviors: # # volatile-lru -> Evict using approximated LRU, only keys with an expire set. # allkeys-lru -> Evict any key using approximated LRU. # volatile-lfu -> Evict using approximated LFU, only keys with an expire set. # allkeys-lfu -> Evict any key using approximated LFU. # volatile-random -> Remove a random key having an expire set. # allkeys-random -> Remove a random key, any key. # volatile-ttl -> Remove the key with the nearest expire time (minor TTL) # noeviction -> Don't evict anything, just return an error on write operations. # # LRU means Least Recently Used # LFU means Least Frequently Used # # Both LRU, LFU and volatile-ttl are implemented using approximated # randomized algorithms. # # Note: with any of the above policies, when there are no suitable keys for # eviction, the server will return an error on write operations that require # more memory. These are usually commands that create new keys, add data or # modify existing keys. A few examples are: SET, INCR, HSET, LPUSH, SUNIONSTORE, # SORT (due to the STORE argument), and EXEC (if the transaction includes any # command that requires memory). # # The default is: noeviction # maxmemory-policy allkeys-lru # LRU, LFU and minimal TTL algorithms are not precise algorithms but approximated # algorithms (in order to save memory), so you can tune it for speed or # accuracy. By default the server will check five keys and pick the one that was # used least recently, you can change the sample size using the following # configuration directive. # # The default of 5 produces good enough results. 10 Approximates very closely # true LRU but costs more CPU. 3 is faster but not very accurate. # # maxmemory-samples 5 # Eviction processing is designed to function well with the default setting. # If there is an unusually large amount of write traffic, this value may need to # be increased. Decreasing this value may reduce latency at the risk of # eviction processing effectiveness # 0 = minimum latency, 10 = default, 100 = process without regard to latency # # maxmemory-eviction-tenacity 10 # By default a replica will ignore its maxmemory setting # (unless it is promoted to master after a failover or manually). It means # that the eviction of keys will be just handled by the master, sending the # DEL commands to the replica as keys evict in the master side. # # This behavior ensures that masters and replicas stay consistent, and is usually # what you want, however if your replica is writable, or you want the replica # to have a different memory setting, and you are sure all the writes performed # to the replica are idempotent, then you may change this default (but be sure # to understand what you are doing). # # Note that since the replica by default does not evict, it may end using more # memory than the one set via maxmemory (there are certain buffers that may # be larger on the replica, or data structures may sometimes take more memory # and so forth). So make sure you monitor your replicas and make sure they # have enough memory to never hit a real out-of-memory condition before the # master hits the configured maxmemory setting. # # replica-ignore-maxmemory yes # The server reclaims expired keys in two ways: upon access when those keys are # found to be expired, and also in background, in what is called the # "active expire key". The key space is slowly and interactively scanned # looking for expired keys to reclaim, so that it is possible to free memory # of keys that are expired and will never be accessed again in a short time. # # The default effort of the expire cycle will try to avoid having more than # ten percent of expired keys still in memory, and will try to avoid consuming # more than 25% of total memory and to add latency to the system. However # it is possible to increase the expire "effort" that is normally set to # "1", to a greater value, up to the value "10". At its maximum value the # system will use more CPU, longer cycles (and technically may introduce # more latency), and will tolerate less already expired keys still present # in the system. It's a tradeoff between memory, CPU and latency. # # active-expire-effort 1 ############################# LAZY FREEING #################################### # The server has two primitives to delete keys. One is called DEL and is a blocking # deletion of the object. It means that the server stops processing new commands # in order to reclaim all the memory associated with an object in a synchronous # way. If the key deleted is associated with a small object, the time needed # in order to execute the DEL command is very small and comparable to most other # O(1) or O(log_N) commands in the server. However if the key is associated with an # aggregated value containing millions of elements, the server can block for # a long time (even seconds) in order to complete the operation. # # For the above reasons the server also offers non blocking deletion primitives # such as UNLINK (non blocking DEL) and the ASYNC option of FLUSHALL and # FLUSHDB commands, in order to reclaim memory in background. Those commands # are executed in constant time. Another thread will incrementally free the # object in the background as fast as possible. # # DEL, UNLINK and ASYNC option of FLUSHALL and FLUSHDB are user-controlled. # It's up to the design of the application to understand when it is a good # idea to use one or the other. However the server sometimes has to # delete keys or flush the whole database as a side effect of other operations. # Specifically the server deletes objects independently of a user call in the # following scenarios: # # 1) On eviction, because of the maxmemory and maxmemory policy configurations, # in order to make room for new data, without going over the specified # memory limit. # 2) Because of expire: when a key with an associated time to live (see the # EXPIRE command) must be deleted from memory. # 3) Because of a side effect of a command that stores data on a key that may # already exist. For example the RENAME command may delete the old key # content when it is replaced with another one. Similarly SUNIONSTORE # or SORT with STORE option may delete existing keys. The SET command # itself removes any old content of the specified key in order to replace # it with the specified string. # 4) During replication, when a replica performs a full resynchronization with # its master, the content of the whole database is removed in order to # load the RDB file just transferred. # # In all the above cases the default is to delete objects in a blocking way, # like if DEL was called. However you can configure each case specifically # in order to instead release memory in a non-blocking way like if UNLINK # was called, using the following configuration directives. lazyfree-lazy-eviction yes lazyfree-lazy-expire yes lazyfree-lazy-server-del yes replica-lazy-flush yes # It is also possible, for the case when to replace the user code DEL calls # with UNLINK calls is not easy, to modify the default behavior of the DEL # command to act exactly like UNLINK, using the following configuration # directive: lazyfree-lazy-user-del yes # FLUSHDB, FLUSHALL, SCRIPT FLUSH and FUNCTION FLUSH support both asynchronous and synchronous # deletion, which can be controlled by passing the [SYNC|ASYNC] flags into the # commands. When neither flag is passed, this directive will be used to determine # if the data should be deleted asynchronously. lazyfree-lazy-user-flush yes ################################ THREADED I/O ################################# # The server is mostly single threaded, however there are certain threaded # operations such as UNLINK, slow I/O accesses and other things that are # performed on side threads. # # Now it is also possible to handle the server clients socket reads and writes # in different I/O threads. Since especially writing is so slow, normally # users use pipelining in order to speed up the server performances per # core, and spawn multiple instances in order to scale more. Using I/O # threads it is possible to easily speedup two times the server without resorting # to pipelining nor sharding of the instance. # # By default threading is disabled, we suggest enabling it only in machines # that have at least 4 or more cores, leaving at least one spare core. # Using more than 8 threads is unlikely to help much. We also recommend using # threaded I/O only if you actually have performance problems, with # instances being able to use a quite big percentage of CPU time, otherwise # there is no point in using this feature. # # So for instance if you have a four cores boxes, try to use 2 or 3 I/O # threads, if you have a 8 cores, try to use 6 threads. In order to # enable I/O threads use the following configuration directive: # # io-threads 4 # # Setting io-threads to 1 will just use the main thread as usual. # When I/O threads are enabled, we only use threads for writes, that is # to thread the write(2) syscall and transfer the client buffers to the # socket. However it is also possible to enable threading of reads and # protocol parsing using the following configuration directive, by setting # it to yes: # # io-threads-do-reads no # # Usually threading reads doesn't help much. # # NOTE 1: This configuration directive cannot be changed at runtime via # CONFIG SET. Also, this feature currently does not work when SSL is # enabled. # # NOTE 2: If you want to test the server speedup using valkey-benchmark, make # sure you also run the benchmark itself in threaded mode, using the # --threads option to match the number of server threads, otherwise you'll not # be able to notice the improvements. ############################ KERNEL OOM CONTROL ############################## # On Linux, it is possible to hint the kernel OOM killer on what processes # should be killed first when out of memory. # # Enabling this feature makes the server actively control the oom_score_adj value # for all its processes, depending on their role. The default scores will # attempt to have background child processes killed before all others, and # replicas killed before masters. # # The server supports these options: # # no: Don't make changes to oom-score-adj (default). # yes: Alias to "relative" see below. # absolute: Values in oom-score-adj-values are written as is to the kernel. # relative: Values are used relative to the initial value of oom_score_adj when # the server starts and are then clamped to a range of -1000 to 1000. # Because typically the initial value is 0, they will often match the # absolute values. oom-score-adj no # When oom-score-adj is used, this directive controls the specific values used # for master, replica and background child processes. Values range -2000 to # 2000 (higher means more likely to be killed). # # Unprivileged processes (not root, and without CAP_SYS_RESOURCE capabilities) # can freely increase their value, but not decrease it below its initial # settings. This means that setting oom-score-adj to "relative" and setting the # oom-score-adj-values to positive values will always succeed. oom-score-adj-values 0 200 800 #################### KERNEL transparent hugepage CONTROL ###################### # Usually the kernel Transparent Huge Pages control is set to "madvise" or # "never" by default (/sys/kernel/mm/transparent_hugepage/enabled), in which # case this config has no effect. On systems in which it is set to "always", # the server will attempt to disable it specifically for the server process in order # to avoid latency problems specifically with fork(2) and CoW. # If for some reason you prefer to keep it enabled, you can set this config to # "no" and the kernel global to "always". disable-thp yes ############################## APPEND ONLY MODE ############################### # By default the server asynchronously dumps the dataset on disk. This mode is # good enough in many applications, but an issue with the server process or # a power outage may result into a few minutes of writes lost (depending on # the configured save points). # # The Append Only File is an alternative persistence mode that provides # much better durability. For instance using the default data fsync policy # (see later in the config file) the server can lose just one second of writes in a # dramatic event like a server power outage, or a single write if something # wrong with the process itself happens, but the operating system is # still running correctly. # # AOF and RDB persistence can be enabled at the same time without problems. # If the AOF is enabled on startup the server will load the AOF, that is the file # with the better durability guarantees. # # Please check https://valkey.io/topics/persistence for more information. appendonly no # The base name of the append only file. # # The server uses a set of append-only files to persist the dataset # and changes applied to it. There are two basic types of files in use: # # - Base files, which are a snapshot representing the complete state of the # dataset at the time the file was created. Base files can be either in # the form of RDB (binary serialized) or AOF (textual commands). # - Incremental files, which contain additional commands that were applied # to the dataset following the previous file. # # In addition, manifest files are used to track the files and the order in # which they were created and should be applied. # # Append-only file names are created by the server following a specific pattern. # The file name's prefix is based on the 'appendfilename' configuration # parameter, followed by additional information about the sequence and type. # # For example, if appendfilename is set to appendonly.aof, the following file # names could be derived: # # - appendonly.aof.1.base.rdb as a base file. # - appendonly.aof.1.incr.aof, appendonly.aof.2.incr.aof as incremental files. # - appendonly.aof.manifest as a manifest file. appendfilename "appendonly.aof" # For convenience, the server stores all persistent append-only files in a dedicated # directory. The name of the directory is determined by the appenddirname # configuration parameter. appenddirname "appendonlydir" # The fsync() call tells the Operating System to actually write data on disk # instead of waiting for more data in the output buffer. Some OS will really flush # data on disk, some other OS will just try to do it ASAP. # # The server supports three different modes: # # no: don't fsync, just let the OS flush the data when it wants. Faster. # always: fsync after every write to the append only log. Slow, Safest. # everysec: fsync only one time every second. Compromise. # # The default is "everysec", as that's usually the right compromise between # speed and data safety. It's up to you to understand if you can relax this to # "no" that will let the operating system flush the output buffer when # it wants, for better performances (but if you can live with the idea of # some data loss consider the default persistence mode that's snapshotting), # or on the contrary, use "always" that's very slow but a bit safer than # everysec. # # More details please check the following article: # http://antirez.com/post/redis-persistence-demystified.html # # If unsure, use "everysec". # appendfsync always appendfsync everysec # appendfsync no # When the AOF fsync policy is set to always or everysec, and a background # saving process (a background save or AOF log background rewriting) is # performing a lot of I/O against the disk, in some Linux configurations # the server may block too long on the fsync() call. Note that there is no fix for # this currently, as even performing fsync in a different thread will block # our synchronous write(2) call. # # In order to mitigate this problem it's possible to use the following option # that will prevent fsync() from being called in the main process while a # BGSAVE or BGREWRITEAOF is in progress. # # This means that while another child is saving, the durability of the server is # the same as "appendfsync no". In practical terms, this means that it is # possible to lose up to 30 seconds of log in the worst scenario (with the # default Linux settings). # # If you have latency problems turn this to "yes". Otherwise leave it as # "no" that is the safest pick from the point of view of durability. no-appendfsync-on-rewrite no # Automatic rewrite of the append only file. # The server is able to automatically rewrite the log file implicitly calling # BGREWRITEAOF when the AOF log size grows by the specified percentage. # # This is how it works: The server remembers the size of the AOF file after the # latest rewrite (if no rewrite has happened since the restart, the size of # the AOF at startup is used). # # This base size is compared to the current size. If the current size is # bigger than the specified percentage, the rewrite is triggered. Also # you need to specify a minimal size for the AOF file to be rewritten, this # is useful to avoid rewriting the AOF file even if the percentage increase # is reached but it is still pretty small. # # Specify a percentage of zero in order to disable the automatic AOF # rewrite feature. auto-aof-rewrite-percentage 100 auto-aof-rewrite-min-size 64mb # An AOF file may be found to be truncated at the end during the server # startup process, when the AOF data gets loaded back into memory. # This may happen when the system where the server is running # crashes, especially when an ext4 filesystem is mounted without the # data=ordered option (however this can't happen when the server itself # crashes or aborts but the operating system still works correctly). # # The server can either exit with an error when this happens, or load as much # data as possible (the default now) and start if the AOF file is found # to be truncated at the end. The following option controls this behavior. # # If aof-load-truncated is set to yes, a truncated AOF file is loaded and # the server starts emitting a log to inform the user of the event. # Otherwise if the option is set to no, the server aborts with an error # and refuses to start. When the option is set to no, the user requires # to fix the AOF file using the "valkey-check-aof" utility before to restart # the server. # # Note that if the AOF file will be found to be corrupted in the middle # the server will still exit with an error. This option only applies when # the server will try to read more data from the AOF file but not enough bytes # will be found. aof-load-truncated yes # The server can create append-only base files in either RDB or AOF formats. Using # the RDB format is always faster and more efficient, and disabling it is only # supported for backward compatibility purposes. aof-use-rdb-preamble yes # The server supports recording timestamp annotations in the AOF to support restoring # the data from a specific point-in-time. However, using this capability changes # the AOF format in a way that may not be compatible with existing AOF parsers. aof-timestamp-enabled no ################################ SHUTDOWN ##################################### # Maximum time to wait for replicas when shutting down, in seconds. # # During shut down, a grace period allows any lagging replicas to catch up with # the latest replication offset before the master exits. This period can # prevent data loss, especially for deployments without configured disk backups. # # The 'shutdown-timeout' value is the grace period's duration in seconds. It is # only applicable when the instance has replicas. To disable the feature, set # the value to 0. # # shutdown-timeout 10 # When the server receives a SIGINT or SIGTERM, shutdown is initiated and by default # an RDB snapshot is written to disk in a blocking operation if save points are configured. # The options used on signaled shutdown can include the following values: # default: Saves RDB snapshot only if save points are configured. # Waits for lagging replicas to catch up. # save: Forces a DB saving operation even if no save points are configured. # nosave: Prevents DB saving operation even if one or more save points are configured. # now: Skips waiting for lagging replicas. # force: Ignores any errors that would normally prevent the server from exiting. # # Any combination of values is allowed as long as "save" and "nosave" are not set simultaneously. # Example: "nosave force now" # # shutdown-on-sigint default # shutdown-on-sigterm default ################ NON-DETERMINISTIC LONG BLOCKING COMMANDS ##################### # Maximum time in milliseconds for EVAL scripts, functions and in some cases # modules' commands before the server can start processing or rejecting other clients. # # If the maximum execution time is reached the server will start to reply to most # commands with a BUSY error. # # In this state the server will only allow a handful of commands to be executed. # For instance, SCRIPT KILL, FUNCTION KILL, SHUTDOWN NOSAVE and possibly some # module specific 'allow-busy' commands. # # SCRIPT KILL and FUNCTION KILL will only be able to stop a script that did not # yet call any write commands, so SHUTDOWN NOSAVE may be the only way to stop # the server in the case a write command was already issued by the script when # the user doesn't want to wait for the natural termination of the script. # # The default is 5 seconds. It is possible to set it to 0 or a negative value # to disable this mechanism (uninterrupted execution). Note that in the past # this config had a different name, which is now an alias, so both of these do # the same: # lua-time-limit 5000 # busy-reply-threshold 5000 ################################ VALKEY CLUSTER ############################### # Normal server instances can't be part of a cluster; only nodes that are # started as cluster nodes can. In order to start a server instance as a # cluster node enable the cluster support uncommenting the following: # # cluster-enabled yes # Every cluster node has a cluster configuration file. This file is not # intended to be edited by hand. It is created and updated by each node. # Every cluster node requires a different cluster configuration file. # Make sure that instances running in the same system do not have # overlapping cluster configuration file names. # # cluster-config-file nodes-6379.conf # Cluster node timeout is the amount of milliseconds a node must be unreachable # for it to be considered in failure state. # Most other internal time limits are a multiple of the node timeout. # # cluster-node-timeout 15000 # The cluster port is the port that the cluster bus will listen for inbound connections on. When set # to the default value, 0, it will be bound to the command port + 10000. Setting this value requires # you to specify the cluster bus port when executing cluster meet. # cluster-port 0 # A replica of a failing master will avoid to start a failover if its data # looks too old. # # There is no simple way for a replica to actually have an exact measure of # its "data age", so the following two checks are performed: # # 1) If there are multiple replicas able to failover, they exchange messages # in order to try to give an advantage to the replica with the best # replication offset (more data from the master processed). # Replicas will try to get their rank by offset, and apply to the start # of the failover a delay proportional to their rank. # # 2) Every single replica computes the time of the last interaction with # its master. This can be the last ping or command received (if the master # is still in the "connected" state), or the time that elapsed since the # disconnection with the master (if the replication link is currently down). # If the last interaction is too old, the replica will not try to failover # at all. # # The point "2" can be tuned by user. Specifically a replica will not perform # the failover if, since the last interaction with the master, the time # elapsed is greater than: # # (node-timeout * cluster-replica-validity-factor) + repl-ping-replica-period # # So for example if node-timeout is 30 seconds, and the cluster-replica-validity-factor # is 10, and assuming a default repl-ping-replica-period of 10 seconds, the # replica will not try to failover if it was not able to talk with the master # for longer than 310 seconds. # # A large cluster-replica-validity-factor may allow replicas with too old data to failover # a master, while a too small value may prevent the cluster from being able to # elect a replica at all. # # For maximum availability, it is possible to set the cluster-replica-validity-factor # to a value of 0, which means, that replicas will always try to failover the # master regardless of the last time they interacted with the master. # (However they'll always try to apply a delay proportional to their # offset rank). # # Zero is the only value able to guarantee that when all the partitions heal # the cluster will always be able to continue. # # cluster-replica-validity-factor 10 # Cluster replicas are able to migrate to orphaned masters, that are masters # that are left without working replicas. This improves the cluster ability # to resist to failures as otherwise an orphaned master can't be failed over # in case of failure if it has no working replicas. # # Replicas migrate to orphaned masters only if there are still at least a # given number of other working replicas for their old master. This number # is the "migration barrier". A migration barrier of 1 means that a replica # will migrate only if there is at least 1 other working replica for its master # and so forth. It usually reflects the number of replicas you want for every # master in your cluster. # # Default is 1 (replicas migrate only if their masters remain with at least # one replica). To disable migration just set it to a very large value or # set cluster-allow-replica-migration to 'no'. # A value of 0 can be set but is useful only for debugging and dangerous # in production. # # cluster-migration-barrier 1 # Turning off this option allows to use less automatic cluster configuration. # It both disables migration to orphaned masters and migration from masters # that became empty. # # Default is 'yes' (allow automatic migrations). # # cluster-allow-replica-migration yes # By default cluster nodes stop accepting queries if they detect there # is at least a hash slot uncovered (no available node is serving it). # This way if the cluster is partially down (for example a range of hash slots # are no longer covered) all the cluster becomes, eventually, unavailable. # It automatically returns available as soon as all the slots are covered again. # # However sometimes you want the subset of the cluster which is working, # to continue to accept queries for the part of the key space that is still # covered. In order to do so, just set the cluster-require-full-coverage # option to no. # # cluster-require-full-coverage yes # This option, when set to yes, prevents replicas from trying to failover its # master during master failures. However the replica can still perform a # manual failover, if forced to do so. # # This is useful in different scenarios, especially in the case of multiple # data center operations, where we want one side to never be promoted if not # in the case of a total DC failure. # # cluster-replica-no-failover no # This option, when set to yes, allows nodes to serve read traffic while the # cluster is in a down state, as long as it believes it owns the slots. # # This is useful for two cases. The first case is for when an application # doesn't require consistency of data during node failures or network partitions. # One example of this is a cache, where as long as the node has the data it # should be able to serve it. # # The second use case is for configurations that don't meet the recommended # three shards but want to enable cluster mode and scale later. A # master outage in a 1 or 2 shard configuration causes a read/write outage to the # entire cluster without this option set, with it set there is only a write outage. # Without a quorum of masters, slot ownership will not change automatically. # # cluster-allow-reads-when-down no # This option, when set to yes, allows nodes to serve pubsub shard traffic while # the cluster is in a down state, as long as it believes it owns the slots. # # This is useful if the application would like to use the pubsub feature even when # the cluster global stable state is not OK. If the application wants to make sure only # one shard is serving a given channel, this feature should be kept as yes. # # cluster-allow-pubsubshard-when-down yes # Cluster link send buffer limit is the limit on the memory usage of an individual # cluster bus link's send buffer in bytes. Cluster links would be freed if they exceed # this limit. This is to primarily prevent send buffers from growing unbounded on links # toward slow peers (E.g. PubSub messages being piled up). # This limit is disabled by default. Enable this limit when 'mem_cluster_links' INFO field # and/or 'send-buffer-allocated' entries in the 'CLUSTER LINKS` command output continuously increase. # Minimum limit of 1gb is recommended so that cluster link buffer can fit in at least a single # PubSub message by default. (client-query-buffer-limit default value is 1gb) # # cluster-link-sendbuf-limit 0 # Clusters can configure their announced hostname using this config. This is a common use case for # applications that need to use TLS Server Name Indication (SNI) or dealing with DNS based # routing. By default this value is only shown as additional metadata in the CLUSTER SLOTS # command, but can be changed using 'cluster-preferred-endpoint-type' config. This value is # communicated along the clusterbus to all nodes, setting it to an empty string will remove # the hostname and also propagate the removal. # # cluster-announce-hostname "" # Clusters can configure an optional nodename to be used in addition to the node ID for # debugging and admin information. This name is broadcasted between nodes, so will be used # in addition to the node ID when reporting cross node events such as node failures. # cluster-announce-human-nodename "" # Clusters can advertise how clients should connect to them using either their IP address, # a user defined hostname, or by declaring they have no endpoint. Which endpoint is # shown as the preferred endpoint is set by using the cluster-preferred-endpoint-type # config with values 'ip', 'hostname', or 'unknown-endpoint'. This value controls how # the endpoint returned for MOVED/ASKING requests as well as the first field of CLUSTER SLOTS. # If the preferred endpoint type is set to hostname, but no announced hostname is set, a '?' # will be returned instead. # # When a cluster advertises itself as having an unknown endpoint, it's indicating that # the server doesn't know how clients can reach the cluster. This can happen in certain # networking situations where there are multiple possible routes to the node, and the # server doesn't know which one the client took. In this case, the server is expecting # the client to reach out on the same endpoint it used for making the last request, but use # the port provided in the response. # # cluster-preferred-endpoint-type ip # In order to setup your cluster make sure to read the documentation # available at https://valkey.io web site. ########################## CLUSTER DOCKER/NAT support ######################## # In certain deployments, cluster node's address discovery fails, because # addresses are NAT-ted or because ports are forwarded (the typical case is # Docker and other containers). # # In order to make a cluster work in such environments, a static # configuration where each node knows its public address is needed. The # following four options are used for this scope, and are: # # * cluster-announce-ip # * cluster-announce-port # * cluster-announce-tls-port # * cluster-announce-bus-port # # Each instructs the node about its address, client ports (for connections # without and with TLS) and cluster message bus port. The information is then # published in the header of the bus packets so that other nodes will be able to # correctly map the address of the node publishing the information. # # If tls-cluster is set to yes and cluster-announce-tls-port is omitted or set # to zero, then cluster-announce-port refers to the TLS port. Note also that # cluster-announce-tls-port has no effect if tls-cluster is set to no. # # If the above options are not used, the normal cluster auto-detection # will be used instead. # # Note that when remapped, the bus port may not be at the fixed offset of # clients port + 10000, so you can specify any port and bus-port depending # on how they get remapped. If the bus-port is not set, a fixed offset of # 10000 will be used as usual. # # Example: # # cluster-announce-ip 10.1.1.5 # cluster-announce-tls-port 6379 # cluster-announce-port 0 # cluster-announce-bus-port 6380 ################################## SLOW LOG ################################### # The server Slow Log is a system to log queries that exceeded a specified # execution time. The execution time does not include the I/O operations # like talking with the client, sending the reply and so forth, # but just the time needed to actually execute the command (this is the only # stage of command execution where the thread is blocked and can not serve # other requests in the meantime). # # You can configure the slow log with two parameters: one tells the server # what is the execution time, in microseconds, to exceed in order for the # command to get logged, and the other parameter is the length of the # slow log. When a new command is logged the oldest one is removed from the # queue of logged commands. # The following time is expressed in microseconds, so 1000000 is equivalent # to one second. Note that a negative number disables the slow log, while # a value of zero forces the logging of every command. slowlog-log-slower-than 10000 # There is no limit to this length. Just be aware that it will consume memory. # You can reclaim memory used by the slow log with SLOWLOG RESET. slowlog-max-len 128 ################################ LATENCY MONITOR ############################## # The server latency monitoring subsystem samples different operations # at runtime in order to collect data related to possible sources of # latency of a server instance. # # Via the LATENCY command this information is available to the user that can # print graphs and obtain reports. # # The system only logs operations that were performed in a time equal or # greater than the amount of milliseconds specified via the # latency-monitor-threshold configuration directive. When its value is set # to zero, the latency monitor is turned off. # # By default latency monitoring is disabled since it is mostly not needed # if you don't have latency issues, and collecting data has a performance # impact, that while very small, can be measured under big load. Latency # monitoring can easily be enabled at runtime using the command # "CONFIG SET latency-monitor-threshold " if needed. latency-monitor-threshold 0 ################################ LATENCY TRACKING ############################## # The server's extended latency monitoring tracks the per command latencies and enables # exporting the percentile distribution via the INFO latencystats command, # and cumulative latency distributions (histograms) via the LATENCY command. # # By default, the extended latency monitoring is enabled since the overhead # of keeping track of the command latency is very small. # latency-tracking yes # By default the exported latency percentiles via the INFO latencystats command # are the p50, p99, and p999. # latency-tracking-info-percentiles 50 99 99.9 ############################# EVENT NOTIFICATION ############################## # The server can notify Pub/Sub clients about events happening in the key space. # This feature is documented at https://valkey.io/topics/notifications # # For instance if keyspace events notification is enabled, and a client # performs a DEL operation on key "foo" stored in the Database 0, two # messages will be published via Pub/Sub: # # PUBLISH __keyspace@0__:foo del # PUBLISH __keyevent@0__:del foo # # It is possible to select the events that the server will notify among a set # of classes. Every class is identified by a single character: # # K Keyspace events, published with __keyspace@__ prefix. # E Keyevent events, published with __keyevent@__ prefix. # g Generic commands (non-type specific) like DEL, EXPIRE, RENAME, ... # $ String commands # l List commands # s Set commands # h Hash commands # z Sorted set commands # x Expired events (events generated every time a key expires) # e Evicted events (events generated when a key is evicted for maxmemory) # n New key events (Note: not included in the 'A' class) # t Stream commands # d Module key type events # m Key-miss events (Note: It is not included in the 'A' class) # A Alias for g$lshzxetd, so that the "AKE" string means all the events # (Except key-miss events which are excluded from 'A' due to their # unique nature). # # The "notify-keyspace-events" takes as argument a string that is composed # of zero or multiple characters. The empty string means that notifications # are disabled. # # Example: to enable list and generic events, from the point of view of the # event name, use: # # notify-keyspace-events Elg # # Example 2: to get the stream of the expired keys subscribing to channel # name __keyevent@0__:expired use: # # notify-keyspace-events Ex # # By default all notifications are disabled because most users don't need # this feature and the feature has some overhead. Note that if you don't # specify at least one of K or E, no events will be delivered. notify-keyspace-events "" ############################### ADVANCED CONFIG ############################### # Hashes are encoded using a memory efficient data structure when they have a # small number of entries, and the biggest entry does not exceed a given # threshold. These thresholds can be configured using the following directives. hash-max-listpack-entries 512 hash-max-listpack-value 64 # Lists are also encoded in a special way to save a lot of space. # The number of entries allowed per internal list node can be specified # as a fixed maximum size or a maximum number of elements. # For a fixed maximum size, use -5 through -1, meaning: # -5: max size: 64 Kb <-- not recommended for normal workloads # -4: max size: 32 Kb <-- not recommended # -3: max size: 16 Kb <-- probably not recommended # -2: max size: 8 Kb <-- good # -1: max size: 4 Kb <-- good # Positive numbers mean store up to _exactly_ that number of elements # per list node. # The highest performing option is usually -2 (8 Kb size) or -1 (4 Kb size), # but if your use case is unique, adjust the settings as necessary. list-max-listpack-size -2 # Lists may also be compressed. # Compress depth is the number of quicklist ziplist nodes from *each* side of # the list to *exclude* from compression. The head and tail of the list # are always uncompressed for fast push/pop operations. Settings are: # 0: disable all list compression # 1: depth 1 means "don't start compressing until after 1 node into the list, # going from either the head or tail" # So: [head]->node->node->...->node->[tail] # [head], [tail] will always be uncompressed; inner nodes will compress. # 2: [head]->[next]->node->node->...->node->[prev]->[tail] # 2 here means: don't compress head or head->next or tail->prev or tail, # but compress all nodes between them. # 3: [head]->[next]->[next]->node->node->...->node->[prev]->[prev]->[tail] # etc. list-compress-depth 0 # Sets have a special encoding when a set is composed # of just strings that happen to be integers in radix 10 in the range # of 64 bit signed integers. # The following configuration setting sets the limit in the size of the # set in order to use this special memory saving encoding. set-max-intset-entries 512 # Sets containing non-integer values are also encoded using a memory efficient # data structure when they have a small number of entries, and the biggest entry # does not exceed a given threshold. These thresholds can be configured using # the following directives. set-max-listpack-entries 128 set-max-listpack-value 64 # Similarly to hashes and lists, sorted sets are also specially encoded in # order to save a lot of space. This encoding is only used when the length and # elements of a sorted set are below the following limits: zset-max-listpack-entries 128 zset-max-listpack-value 64 # HyperLogLog sparse representation bytes limit. The limit includes the # 16 bytes header. When a HyperLogLog using the sparse representation crosses # this limit, it is converted into the dense representation. # # A value greater than 16000 is totally useless, since at that point the # dense representation is more memory efficient. # # The suggested value is ~ 3000 in order to have the benefits of # the space efficient encoding without slowing down too much PFADD, # which is O(N) with the sparse encoding. The value can be raised to # ~ 10000 when CPU is not a concern, but space is, and the data set is # composed of many HyperLogLogs with cardinality in the 0 - 15000 range. hll-sparse-max-bytes 3000 # Streams macro node max size / items. The stream data structure is a radix # tree of big nodes that encode multiple items inside. Using this configuration # it is possible to configure how big a single node can be in bytes, and the # maximum number of items it may contain before switching to a new node when # appending new stream entries. If any of the following settings are set to # zero, the limit is ignored, so for instance it is possible to set just a # max entries limit by setting max-bytes to 0 and max-entries to the desired # value. stream-node-max-bytes 4096 stream-node-max-entries 100 # Active rehashing uses 1 millisecond every 100 milliseconds of CPU time in # order to help rehashing the main server hash table (the one mapping top-level # keys to values). The hash table implementation the server uses (see dict.c) # performs a lazy rehashing: the more operation you run into a hash table # that is rehashing, the more rehashing "steps" are performed, so if the # server is idle the rehashing is never complete and some more memory is used # by the hash table. # # The default is to use this millisecond 10 times every second in order to # actively rehash the main dictionaries, freeing memory when possible. # # If unsure: # use "activerehashing no" if you have hard latency requirements and it is # not a good thing in your environment that the server can reply from time to time # to queries with 2 milliseconds delay. # # use "activerehashing yes" if you don't have such hard requirements but # want to free memory asap when possible. activerehashing yes # The client output buffer limits can be used to force disconnection of clients # that are not reading data from the server fast enough for some reason (a # common reason is that a Pub/Sub client can't consume messages as fast as the # publisher can produce them). # # The limit can be set differently for the three different classes of clients: # # normal -> normal clients including MONITOR clients # replica -> replica clients # pubsub -> clients subscribed to at least one pubsub channel or pattern # # The syntax of every client-output-buffer-limit directive is the following: # # client-output-buffer-limit # # A client is immediately disconnected once the hard limit is reached, or if # the soft limit is reached and remains reached for the specified number of # seconds (continuously). # So for instance if the hard limit is 32 megabytes and the soft limit is # 16 megabytes / 10 seconds, the client will get disconnected immediately # if the size of the output buffers reach 32 megabytes, but will also get # disconnected if the client reaches 16 megabytes and continuously overcomes # the limit for 10 seconds. # # By default normal clients are not limited because they don't receive data # without asking (in a push way), but just after a request, so only # asynchronous clients may create a scenario where data is requested faster # than it can read. # # Instead there is a default limit for pubsub and replica clients, since # subscribers and replicas receive data in a push fashion. # # Note that it doesn't make sense to set the replica clients output buffer # limit lower than the repl-backlog-size config (partial sync will succeed # and then replica will get disconnected). # Such a configuration is ignored (the size of repl-backlog-size will be used). # This doesn't have memory consumption implications since the replica client # will share the backlog buffers memory. # # Both the hard or the soft limit can be disabled by setting them to zero. client-output-buffer-limit normal 0 0 0 client-output-buffer-limit replica 256mb 64mb 60 client-output-buffer-limit pubsub 32mb 8mb 60 # Client query buffers accumulate new commands. They are limited to a fixed # amount by default in order to avoid that a protocol desynchronization (for # instance due to a bug in the client) will lead to unbound memory usage in # the query buffer. However you can configure it here if you have very special # needs, such us huge multi/exec requests or alike. # # client-query-buffer-limit 1gb # In some scenarios client connections can hog up memory leading to OOM # errors or data eviction. To avoid this we can cap the accumulated memory # used by all client connections (all pubsub and normal clients). Once we # reach that limit connections will be dropped by the server freeing up # memory. The server will attempt to drop the connections using the most # memory first. We call this mechanism "client eviction". # # Client eviction is configured using the maxmemory-clients setting as follows: # 0 - client eviction is disabled (default) # # A memory value can be used for the client eviction threshold, # for example: # maxmemory-clients 1g # # A percentage value (between 1% and 100%) means the client eviction threshold # is based on a percentage of the maxmemory setting. For example to set client # eviction at 5% of maxmemory: # maxmemory-clients 5% # In the server protocol, bulk requests, that are, elements representing single # strings, are normally limited to 512 mb. However you can change this limit # here, but must be 1mb or greater # # proto-max-bulk-len 512mb # The server calls an internal function to perform many background tasks, like # closing connections of clients in timeout, purging expired keys that are # never requested, and so forth. # # Not all tasks are performed with the same frequency, but the server checks for # tasks to perform according to the specified "hz" value. # # By default "hz" is set to 10. Raising the value will use more CPU when # the server is idle, but at the same time will make the server more responsive when # there are many keys expiring at the same time, and timeouts may be # handled with more precision. # # The range is between 1 and 500, however a value over 100 is usually not # a good idea. Most users should use the default of 10 and raise this up to # 100 only in environments where very low latency is required. hz 10 # Normally it is useful to have an HZ value which is proportional to the # number of clients connected. This is useful in order, for instance, to # avoid too many clients are processed for each background task invocation # in order to avoid latency spikes. # # Since the default HZ value by default is conservatively set to 10, the server # offers, and enables by default, the ability to use an adaptive HZ value # which will temporarily raise when there are many connected clients. # # When dynamic HZ is enabled, the actual configured HZ will be used # as a baseline, but multiples of the configured HZ value will be actually # used as needed once more clients are connected. In this way an idle # instance will use very little CPU time while a busy instance will be # more responsive. dynamic-hz yes # When a child rewrites the AOF file, if the following option is enabled # the file will be fsync-ed every 4 MB of data generated. This is useful # in order to commit the file to the disk more incrementally and avoid # big latency spikes. aof-rewrite-incremental-fsync yes # When the server saves RDB file, if the following option is enabled # the file will be fsync-ed every 4 MB of data generated. This is useful # in order to commit the file to the disk more incrementally and avoid # big latency spikes. rdb-save-incremental-fsync yes # The server's LFU eviction (see maxmemory setting) can be tuned. However it is a good # idea to start with the default settings and only change them after investigating # how to improve the performances and how the keys LFU change over time, which # is possible to inspect via the OBJECT FREQ command. # # There are two tunable parameters in the server LFU implementation: the # counter logarithm factor and the counter decay time. It is important to # understand what the two parameters mean before changing them. # # The LFU counter is just 8 bits per key, it's maximum value is 255, so the server # uses a probabilistic increment with logarithmic behavior. Given the value # of the old counter, when a key is accessed, the counter is incremented in # this way: # # 1. A random number R between 0 and 1 is extracted. # 2. A probability P is calculated as 1/(old_value*lfu_log_factor+1). # 3. The counter is incremented only if R < P. # # The default lfu-log-factor is 10. This is a table of how the frequency # counter changes with a different number of accesses with different # logarithmic factors: # # +--------+------------+------------+------------+------------+------------+ # | factor | 100 hits | 1000 hits | 100K hits | 1M hits | 10M hits | # +--------+------------+------------+------------+------------+------------+ # | 0 | 104 | 255 | 255 | 255 | 255 | # +--------+------------+------------+------------+------------+------------+ # | 1 | 18 | 49 | 255 | 255 | 255 | # +--------+------------+------------+------------+------------+------------+ # | 10 | 10 | 18 | 142 | 255 | 255 | # +--------+------------+------------+------------+------------+------------+ # | 100 | 8 | 11 | 49 | 143 | 255 | # +--------+------------+------------+------------+------------+------------+ # # NOTE: The above table was obtained by running the following commands: # # valkey-benchmark -n 1000000 incr foo # valkey-cli object freq foo # # NOTE 2: The counter initial value is 5 in order to give new objects a chance # to accumulate hits. # # The counter decay time is the time, in minutes, that must elapse in order # for the key counter to be decremented. # # The default value for the lfu-decay-time is 1. A special value of 0 means we # will never decay the counter. # # lfu-log-factor 10 # lfu-decay-time 1 ########################### ACTIVE DEFRAGMENTATION ####################### # # What is active defragmentation? # ------------------------------- # # Active (online) defragmentation allows a server to compact the # spaces left between small allocations and deallocations of data in memory, # thus allowing to reclaim back memory. # # Fragmentation is a natural process that happens with every allocator (but # less so with Jemalloc, fortunately) and certain workloads. Normally a server # restart is needed in order to lower the fragmentation, or at least to flush # away all the data and create it again. However thanks to this feature # implemented by Oran Agra, this process can happen at runtime # in a "hot" way, while the server is running. # # Basically when the fragmentation is over a certain level (see the # configuration options below) the server will start to create new copies of the # values in contiguous memory regions by exploiting certain specific Jemalloc # features (in order to understand if an allocation is causing fragmentation # and to allocate it in a better place), and at the same time, will release the # old copies of the data. This process, repeated incrementally for all the keys # will cause the fragmentation to drop back to normal values. # # Important things to understand: # # 1. This feature is disabled by default, and only works if you compiled the server # to use the copy of Jemalloc we ship with the source code of the server. # This is the default with Linux builds. # # 2. You never need to enable this feature if you don't have fragmentation # issues. # # 3. Once you experience fragmentation, you can enable this feature when # needed with the command "CONFIG SET activedefrag yes". # # The configuration parameters are able to fine tune the behavior of the # defragmentation process. If you are not sure about what they mean it is # a good idea to leave the defaults untouched. # Active defragmentation is disabled by default # activedefrag no # Minimum amount of fragmentation waste to start active defrag # active-defrag-ignore-bytes 100mb # Minimum percentage of fragmentation to start active defrag # active-defrag-threshold-lower 10 # Maximum percentage of fragmentation at which we use maximum effort # active-defrag-threshold-upper 100 # Minimal effort for defrag in CPU percentage, to be used when the lower # threshold is reached # active-defrag-cycle-min 1 # Maximal effort for defrag in CPU percentage, to be used when the upper # threshold is reached # active-defrag-cycle-max 25 # Maximum number of set/hash/zset/list fields that will be processed from # the main dictionary scan # active-defrag-max-scan-fields 1000 # Jemalloc background thread for purging will be enabled by default jemalloc-bg-thread yes # It is possible to pin different threads and processes of the server to specific # CPUs in your system, in order to maximize the performances of the server. # This is useful both in order to pin different server threads in different # CPUs, but also in order to make sure that multiple server instances running # in the same host will be pinned to different CPUs. # # Normally you can do this using the "taskset" command, however it is also # possible to do this via the server configuration directly, both in Linux and FreeBSD. # # You can pin the server/IO threads, bio threads, aof rewrite child process, and # the bgsave child process. The syntax to specify the cpu list is the same as # the taskset command: # # Set redis server/io threads to cpu affinity 0,2,4,6: # server_cpulist 0-7:2 # # Set bio threads to cpu affinity 1,3: # bio_cpulist 1,3 # # Set aof rewrite child process to cpu affinity 8,9,10,11: # aof_rewrite_cpulist 8-11 # # Set bgsave child process to cpu affinity 1,10,11 # bgsave_cpulist 1,10-11 # In some cases the server will emit warnings and even refuse to start if it detects # that the system is in bad state, it is possible to suppress these warnings # by setting the following config which takes a space delimited list of warnings # to suppress # # ignore-warnings ARM64-COW-BUG ================================================ FILE: aegir/conf/valkey/valkey8.conf ================================================ # Valkey configuration file example. # # Note that in order to read the configuration file, the server must be # started with the file path as first argument: # # ./valkey-server /path/to/valkey.conf # Note on units: when memory size is needed, it is possible to specify # it in the usual form of 1k 5GB 4M and so forth: # # 1k => 1000 bytes # 1kb => 1024 bytes # 1m => 1000000 bytes # 1mb => 1024*1024 bytes # 1g => 1000000000 bytes # 1gb => 1024*1024*1024 bytes # # units are case insensitive so 1GB 1Gb 1gB are all the same. ################################## INCLUDES ################################### # Include one or more other config files here. This is useful if you # have a standard template that goes to all servers but also need # to customize a few per-server settings. Include files can include # other files, so use this wisely. # # Note that option "include" won't be rewritten by command "CONFIG REWRITE" # from admin or Sentinel. Since the server always uses the last processed # line as value of a configuration directive, you'd better put includes # at the beginning of this file to avoid overwriting config change at runtime. # # If instead you are interested in using includes to override configuration # options, it is better to use include as the last line. # # Included paths may contain wildcards. All files matching the wildcards will # be included in alphabetical order. # Note that if an include path contains a wildcards but no files match it when # the server is started, the include statement will be ignored and no error will # be emitted. It is safe, therefore, to include wildcard files from empty # directories. # # include /path/to/local.conf # include /path/to/other.conf # include /path/to/fragments/*.conf # ################################## MODULES ##################################### # Load modules at startup. If the server is not able to load modules # it will abort. It is possible to use multiple loadmodule directives. # # loadmodule /path/to/my_module.so # loadmodule /path/to/other_module.so # loadmodule /path/to/args_module.so [arg [arg ...]] ################################## NETWORK ##################################### # By default, if no "bind" configuration directive is specified, the server listens # for connections from all available network interfaces on the host machine. # It is possible to listen to just one or multiple selected interfaces using # the "bind" configuration directive, followed by one or more IP addresses. # Each address can be prefixed by "-", which means that the server will not fail to # start if the address is not available. Being not available only refers to # addresses that does not correspond to any network interface. Addresses that # are already in use will always fail, and unsupported protocols will always be # silently skipped. # # Examples: # # xbind 192.168.1.100 10.0.0.1 # listens on two specific IPv4 addresses # xbind 127.0.0.1 ::1 # listens on loopback IPv4 and IPv6 # xbind * -::* # like the default, all available interfaces # # ~~~ WARNING ~~~ If the computer running the server is directly exposed to the # internet, binding to all the interfaces is dangerous and will expose the # instance to everybody on the internet. So by default we uncomment the # following bind directive, that will force the server to listen only on the # IPv4 and IPv6 (if available) loopback interface addresses (this means the server # will only be able to accept client connections from the same host that it is # running on). # # IF YOU ARE SURE YOU WANT YOUR INSTANCE TO LISTEN TO ALL THE INTERFACES # COMMENT OUT THE FOLLOWING LINE. # # You will also need to set a password unless you explicitly disable protected # mode. # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ bind 127.0.0.1 # By default, outgoing connections (from replica to primary, from Sentinel to # instances, cluster bus, etc.) are not bound to a specific local address. In # most cases, this means the operating system will handle that based on routing # and the interface through which the connection goes out. # # Using bind-source-addr it is possible to configure a specific address to bind # to, which may also affect how the connection gets routed. # # Example: # # bind-source-addr 10.0.0.1 # Protected mode is a layer of security protection, in order to avoid that # the server instances left open on the internet are accessed and exploited. # # When protected mode is on and the default user has no password, the server # only accepts local connections from the IPv4 address (127.0.0.1), IPv6 address # (::1) or Unix domain sockets. # # By default protected mode is enabled. You should disable it only if # you are sure you want clients from other hosts to connect to the server # even if no authentication is configured. protected-mode yes # The server uses default hardened security configuration directives to reduce the # attack surface on innocent users. Therefore, several sensitive configuration # directives are immutable, and some potentially-dangerous commands are blocked. # # Configuration directives that control files that the server writes to (e.g., 'dir' # and 'dbfilename') and that aren't usually modified during runtime # are protected by making them immutable. # # Commands that can increase the attack surface of the server and that aren't usually # called by users are blocked by default. # # These can be exposed to either all connections or just local ones by setting # each of the configs listed below to either of these values: # # no - Block for any connection (remain immutable) # yes - Allow for any connection (no protection) # local - Allow only for local connections. Ones originating from the # IPv4 address (127.0.0.1), IPv6 address (::1) or Unix domain sockets. # # enable-protected-configs no # enable-debug-command no # enable-module-command no # Accept connections on the specified port, default is 6379 (IANA #815344). # If port 0 is specified the server will not listen on a TCP socket. port 6379 # TCP listen() backlog. # # In high requests-per-second environments you need a high backlog in order # to avoid slow clients connection issues. Note that the Linux kernel # will silently truncate it to the value of /proc/sys/net/core/somaxconn so # make sure to raise both the value of somaxconn and tcp_max_syn_backlog # in order to get the desired effect. tcp-backlog 511 # Unix socket. # # Specify the path for the Unix socket that will be used to listen for # incoming connections. There is no default, so the server will not listen # on a unix socket when not specified. # # unixsocket /run/valkey/valkey.sock # unixsocketgroup valkey # unixsocketperm 777 # Close the connection after a client is idle for N seconds (0 to disable) timeout 900 # TCP keepalive. # # If non-zero, use SO_KEEPALIVE to send TCP ACKs to clients in absence # of communication. This is useful for two reasons: # # 1) Detect dead peers. # 2) Force network equipment in the middle to consider the connection to be # alive. # # On Linux, the specified value (in seconds) is the period used to send ACKs. # Note that to close the connection the double of the time is needed. # On other kernels the period depends on the kernel configuration. tcp-keepalive 300 # Apply OS-specific mechanism to mark the listening socket with the specified # ID, to support advanced routing and filtering capabilities. # # On Linux, the ID represents a connection mark. # On FreeBSD, the ID represents a socket cookie ID. # On OpenBSD, the ID represents a route table ID. # # The default value is 0, which implies no marking is required. # socket-mark-id 0 ################################# TLS/SSL ##################################### # By default, TLS/SSL is disabled. To enable it, the "tls-port" configuration # directive can be used to define TLS-listening ports. To enable TLS on the # default port, use: # # port 0 # tls-port 6379 # Configure a X.509 certificate and private key to use for authenticating the # server to connected clients, primaries or cluster peers. These files should be # PEM formatted. # # tls-cert-file valkey.crt # tls-key-file valkey.key # # If the key file is encrypted using a passphrase, it can be included here # as well. # # tls-key-file-pass secret # Normally the server uses the same certificate for both server functions (accepting # connections) and client functions (replicating from a primary, establishing # cluster bus connections, etc.). # # Sometimes certificates are issued with attributes that designate them as # client-only or server-only certificates. In that case it may be desired to use # different certificates for incoming (server) and outgoing (client) # connections. To do that, use the following directives: # # tls-client-cert-file client.crt # tls-client-key-file client.key # # If the key file is encrypted using a passphrase, it can be included here # as well. # # tls-client-key-file-pass secret # Configure a DH parameters file to enable Diffie-Hellman (DH) key exchange, # required by older versions of OpenSSL (<3.0). Newer versions do not require # this configuration and recommend against it. # # tls-dh-params-file valkey.dh # Configure a CA certificate(s) bundle or directory to authenticate TLS/SSL # clients and peers. The server requires an explicit configuration of at least one # of these, and will not implicitly use the system wide configuration. # # tls-ca-cert-file ca.crt # tls-ca-cert-dir /etc/ssl/certs # By default, clients (including replica servers) on a TLS port are required # to authenticate using valid client side certificates. # # If "no" is specified, client certificates are not required and not accepted. # If "optional" is specified, client certificates are accepted and must be # valid if provided, but are not required. # # tls-auth-clients no # tls-auth-clients optional # By default, a replica does not attempt to establish a TLS connection # with its primary. # # Use the following directive to enable TLS on replication links. # # tls-replication yes # By default, the cluster bus uses a plain TCP connection. To enable # TLS for the bus protocol, use the following directive: # # tls-cluster yes # By default, only TLSv1.2 and TLSv1.3 are enabled and it is highly recommended # that older formally deprecated versions are kept disabled to reduce the attack surface. # You can explicitly specify TLS versions to support. # Allowed values are case insensitive and include "TLSv1", "TLSv1.1", "TLSv1.2", # "TLSv1.3" (OpenSSL >= 1.1.1) or any combination. # To enable only TLSv1.2 and TLSv1.3, use: # # tls-protocols "TLSv1.2 TLSv1.3" # Configure allowed ciphers. See the ciphers(1ssl) manpage for more information # about the syntax of this string. # # Note: this configuration applies only to <= TLSv1.2. # # tls-ciphers DEFAULT:!MEDIUM # Configure allowed TLSv1.3 ciphersuites. See the ciphers(1ssl) manpage for more # information about the syntax of this string, and specifically for TLSv1.3 # ciphersuites. # # tls-ciphersuites TLS_CHACHA20_POLY1305_SHA256 # When choosing a cipher, use the server's preference instead of the client # preference. By default, the server follows the client's preference. # # tls-prefer-server-ciphers yes # By default, TLS session caching is enabled to allow faster and less expensive # reconnections by clients that support it. Use the following directive to disable # caching. # # tls-session-caching no # Change the default number of TLS sessions cached. A zero value sets the cache # to unlimited size. The default size is 20480. # # tls-session-cache-size 5000 # Change the default timeout of cached TLS sessions. The default timeout is 300 # seconds. # # tls-session-cache-timeout 60 ################################### RDMA ###################################### # Valkey Over RDMA is experimental, it may be changed or be removed in any minor or major version. # By default, RDMA is disabled. To enable it, the "rdma-port" configuration # directive can be used to define RDMA-listening ports. # # rdma-port 6379 # rdma-bind 192.168.1.100 # The RDMA receive transfer buffer is 1M by default. It can be set between 64K and 16M. # Note that page size aligned size is preferred. # # rdma-rx-size 1048576 # The RDMA completion queue will use the completion vector to signal completion events # via hardware interrupts. A large number of hardware interrupts can affect CPU performance. # It is possible to tune the performance using rdma-completion-vector. # # Example 1. a) Pin hardware interrupt vectors [0, 3] to CPU [0, 3]. # b) Set CPU affinity for valkey to CPU [4, X]. # c) Any valkey server uses a random RDMA completion vector [-1]. # All valkey servers will not affect each other and will be isolated from kernel interrupts. # # SYS SYS SYS SYS VALKEY VALKEY VALKEY # | | | | | | | # CPU0 CPU1 CPU2 CPU3 CPU4 CPU5 ... CPUX # | | | | # INTR0 INTR1 INTR2 INTR3 # # Example 2. a) 1:1 pin hardware interrupt vectors [0, X] to CPU [0, X]. # b) Set CPU affinity for valkey [M] to CPU [M]. # c) Valkey server [M] uses RDMA completion vector [M]. # A single CPU [M] handles hardware interrupts, the RDMA completion vector [M], # and the valkey server [M] within its context only. # This avoids overhead and function calls across multiple CPUs, fully isolating # each valkey server from one another. # # VALKEY VALKEY VALKEY VALKEY VALKEY VALKEY VALKEY # | | | | | | | # CPU0 CPU1 CPU2 CPU3 CPU4 CPU5 ... CPUX # | | | | | | | # INTR0 INTR1 INTR2 INTR3 INTR4 INTR5 INTRX # # Use 0 and positive numbers to specify the RDMA completion vector, or specify -1 to allow # the server to use a random vector for a new connection. The default vector is -1. # # rdma-completion-vector 0 ################################# GENERAL ##################################### # By default the server does not run as a daemon. Use 'yes' if you need it. # Note that the server will write a pid file in /run/valkey/valkey.pid when daemonized. # When the server is supervised by upstart or systemd, this parameter has no impact. daemonize yes # If you run the server from upstart or systemd, the server can interact with your # supervision tree. Options: # supervised no - no supervision interaction # supervised upstart - signal upstart by putting the server into SIGSTOP mode # requires "expect stop" in your upstart job config # supervised systemd - signal systemd by writing READY=1 to $NOTIFY_SOCKET # on startup, and updating the server status on a regular # basis. # supervised auto - detect upstart or systemd method based on # UPSTART_JOB or NOTIFY_SOCKET environment variables # Note: these supervision methods only signal "process is ready." # They do not enable continuous pings back to your supervisor. # # The default is "no". To run under upstart/systemd, you can simply uncomment # the line below: # # supervised auto # If a pid file is specified, the server writes it where specified at startup # and removes it at exit. # # When the server runs non daemonized, no pid file is created if none is # specified in the configuration. When the server is daemonized, the pid file # is used even if not specified, defaulting to "/run/valkey/valkey.pid". # # Creating a pid file is best effort: if the server is not able to create it # nothing bad happens, the server will start and run normally. # # Note that on modern Linux systems "/run/valkey/valkey.pid" is more conforming # and should be used instead. pidfile /run/valkey/valkey.pid # Specify the server verbosity level. # This can be one of: # debug (a lot of information, useful for development/testing) # verbose (many rarely useful info, but not a mess like the debug level) # notice (moderately verbose, what you want in production probably) # warning (only very important / critical messages are logged) # nothing (nothing is logged) loglevel warning # Specify the logging format. # This can be one of: # # - legacy: the default, traditional log format # - logfmt: a structured log format; see https://www.brandur.org/logfmt # # log-format legacy # Specify the timestamp format used in logs using 'log-timestamp-format'. # # - legacy: default format # - iso8601: ISO 8601 extended date and time with time zone, on the form # yyyy-mm-ddThh:mm:ss.sss±hh:mm # - milliseconds: milliseconds since the epoch # # log-timestamp-format legacy # Specify the log file name. Also the empty string can be used to force # the server to log on the standard output. Note that if you use standard # output for logging but daemonize, logs will be sent to /dev/null logfile /var/log/valkey/valkey-server.log # To enable logging to the system logger, just set 'syslog-enabled' to yes, # and optionally update the other syslog parameters to suit your needs. # syslog-enabled no # Specify the syslog identity. # syslog-ident valkey # Specify the syslog facility. Must be USER or between LOCAL0-LOCAL7. # syslog-facility local0 # To disable the built in crash log, which will possibly produce cleaner core # dumps when they are needed, uncomment the following: # # crash-log-enabled no # To disable the fast memory check that's run as part of the crash log, which # will possibly let the server terminate sooner, uncomment the following: # # crash-memcheck-enabled no # Set the number of databases. The default database is DB 0, you can select # a different one on a per-connection basis using SELECT where # dbid is a number between 0 and 'databases'-1 databases 8 # By default the server shows an ASCII art logo only when started to log to the # standard output and if the standard output is a TTY and syslog logging is # disabled. Basically this means that normally a logo is displayed only in # interactive sessions. # # However it is possible to force the pre-4.0 behavior and always show a # ASCII art logo in startup logs by setting the following option to yes. always-show-logo no # User data, including keys, values, client names, and ACL usernames, can be # logged as part of assertions and other error cases. To prevent sensitive user # information, such as PII, from being recorded in the server log file, this # user data is hidden from the log by default. If you need to log user data for # debugging or troubleshooting purposes, you can disable this feature by # changing the config value to no. hide-user-data-from-log yes # By default, the server modifies the process title (as seen in 'top' and 'ps') to # provide some runtime information. It is possible to disable this and leave # the process name as executed by setting the following to no. set-proc-title yes # When changing the process title, the server uses the following template to construct # the modified title. # # Template variables are specified in curly brackets. The following variables are # supported: # # {title} Name of process as executed if parent, or type of child process. # {listen-addr} Bind address or '*' followed by TCP or TLS port listening on, or # Unix socket if only that's available. # {server-mode} Special mode, i.e. "[sentinel]" or "[cluster]". # {port} TCP port listening on, or 0. # {tls-port} TLS port listening on, or 0. # {unixsocket} Unix domain socket listening on, or "". # {config-file} Name of configuration file used. # proc-title-template "{title} {listen-addr} {server-mode}" # Set the local environment which is used for string comparison operations, and # also affect the performance of Lua scripts. Empty String indicates the locale # is derived from the environment variables. locale-collate "" # Valkey is largely compatible with Redis OSS, apart from a few cases where # Valkey identifies itself itself as "Valkey" rather than "Redis". Extended # Redis OSS compatibility mode makes Valkey pretend to be Redis. Enable this # only if you have problems with tools or clients. This is a temporary # configuration added in Valkey 8.0 and is scheduled to have no effect in Valkey # 9.0 and be completely removed in Valkey 10.0. # extended-redis-compatibility yes ################################ SNAPSHOTTING ################################ # Save the DB to disk. # # save [ ...] # # The server will save the DB if the given number of seconds elapsed and it # surpassed the given number of write operations against the DB. # # Snapshotting can be completely disabled with a single empty string argument # as in following example: # # save "" # # Unless specified otherwise, by default the server will save the DB: # * After 3600 seconds (an hour) if at least 1 change was performed # * After 300 seconds (5 minutes) if at least 100 changes were performed # * After 60 seconds if at least 10000 changes were performed # # You can set these explicitly by uncommenting the following line. # # save 3600 1 300 100 60 10000 # By default the server will stop accepting writes if RDB snapshots are enabled # (at least one save point) and the latest background save failed. # This will make the user aware (in a hard way) that data is not persisting # on disk properly, otherwise chances are that no one will notice and some # disaster will happen. # # If the background saving process will start working again, the server will # automatically allow writes again. # # However if you have setup your proper monitoring of the server # and persistence, you may want to disable this feature so that the server will # continue to work as usual even if there are problems with disk, # permissions, and so forth. stop-writes-on-bgsave-error no # Compress string objects using LZF when dump .rdb databases? # By default compression is enabled as it's almost always a win. # If you want to save some CPU in the saving child set it to 'no' but # the dataset will likely be bigger if you have compressible values or keys. rdbcompression yes # Since version 5 of RDB a CRC64 checksum is placed at the end of the file. # This makes the format more resistant to corruption but there is a performance # hit to pay (around 10%) when saving and loading RDB files, so you can disable it # for maximum performances. # # RDB files created with checksum disabled have a checksum of zero that will # tell the loading code to skip the check. rdbchecksum no # Valkey can try to load an RDB dump produced by a future version of Valkey. # This can only work on a best-effort basis, because future RDB versions may # contain information that's not known to the current version. If no new features # are used, it may be possible to import the data produced by a later version, # but loading is aborted if unknown information is encountered. Possible values # are 'strict' and 'relaxed'. This also applies to replication and the RESTORE # command. rdb-version-check relaxed # Enables or disables full sanitization checks for ziplist and listpack etc when # loading an RDB or RESTORE payload. This reduces the chances of a assertion or # crash later on while processing commands. # Options: # no - Never perform full sanitization # yes - Always perform full sanitization # clients - Perform full sanitization only for user connections. # Excludes: RDB files, RESTORE commands received from the primary # connection, and client connections which have the # skip-sanitize-payload ACL flag. # The default should be 'clients' but since it currently affects cluster # resharding via MIGRATE, it is temporarily set to 'no' by default. # # sanitize-dump-payload no # The filename where to dump the DB dbfilename dump.rdb # Remove RDB files used by replication in instances without persistence # enabled. By default this option is disabled, however there are environments # where for regulations or other security concerns, RDB files persisted on # disk by primaries in order to feed replicas, or stored on disk by replicas # in order to load them for the initial synchronization, should be deleted # ASAP. Note that this option ONLY WORKS in instances that have both AOF # and RDB persistence disabled, otherwise is completely ignored. # # An alternative (and sometimes better) way to obtain the same effect is # to use diskless replication on both primary and replicas instances. However # in the case of replicas, diskless is not always an option. rdb-del-sync-files no # The working directory. # # The server log is written relative this directory, if the 'logfile' # configuration directive is a relative path. # # The DB will be written inside this directory, with the filename specified # above using the 'dbfilename' configuration directive. # # The Append Only File will also be created inside this directory. # # The Cluster config file is written relative this directory, if the # 'cluster-config-file' configuration directive is a relative path. # # Note that you must specify a directory here, not a file name. # Note that modifying 'dir' during runtime may have unexpected behavior, # for example when a child process is running, related file operations may # have unexpected effects. dir /var/lib/valkey/ ################################# REPLICATION ################################# # Master-Replica replication. Use replicaof to make a server a copy of # another server. A few things to understand ASAP about replication. # # +------------------+ +---------------+ # | Master | ---> | Replica | # | (receive writes) | | (exact copy) | # +------------------+ +---------------+ # # 1) Replication is asynchronous, but you can configure a primary to # stop accepting writes if it appears to be not connected with at least # a given number of replicas. # 2) Replicas are able to perform a partial resynchronization with the # primary if the replication link is lost for a relatively small amount of # time. You may want to configure the replication backlog size (see the next # sections of this file) with a sensible value depending on your needs. # 3) Replication is automatic and does not need user intervention. After a # network partition replicas automatically try to reconnect to primaries # and resynchronize with them. # # replicaof # If the primary is password protected (using the "requirepass" configuration # directive below) it is possible to tell the replica to authenticate before # starting the replication synchronization process, otherwise the primary will # refuse the replica request. # # primaryauth # # However this is not enough if you are using ACLs # and the default user is not capable of running the PSYNC # command and/or other commands needed for replication. In this case it's # better to configure a special user to use with replication, and specify the # primaryuser configuration as such: # # primaryuser # # When primaryuser is specified, the replica will authenticate against its # primary using the new AUTH form: AUTH . # When a replica loses its connection with the primary, or when the replication # is still in progress, the replica can act in two different ways: # # 1) if replica-serve-stale-data is set to 'yes' (the default) the replica will # still reply to client requests, possibly with out of date data, or the # data set may just be empty if this is the first synchronization. # # 2) If replica-serve-stale-data is set to 'no' the replica will reply with error # "MASTERDOWN Link with MASTER is down and replica-serve-stale-data is set to 'no'" # to all data access commands, excluding commands such as: # INFO, REPLICAOF, AUTH, SHUTDOWN, REPLCONF, ROLE, CONFIG, SUBSCRIBE, # UNSUBSCRIBE, PSUBSCRIBE, PUNSUBSCRIBE, PUBLISH, PUBSUB, COMMAND, POST, # HOST and LATENCY. # replica-serve-stale-data yes # You can configure a replica instance to accept writes or not. Writing against # a replica instance may be useful to store some ephemeral data (because data # written on a replica will be easily deleted after resync with the primary) but # may also cause problems if clients are writing to it because of a # misconfiguration. # # By default, replicas are read-only. # # Note: read only replicas are not designed to be exposed to untrusted clients # on the internet. It's just a protection layer against misuse of the instance. # Still a read only replica exports by default all the administrative commands # such as CONFIG, DEBUG, and so forth. To a limited extent you can improve # security of read only replicas using 'rename-command' to shadow all the # administrative / dangerous commands. replica-read-only yes # Replication SYNC strategy: disk or socket. # # New replicas and reconnecting replicas that are not able to continue the # replication process just receiving differences, need to do what is called a # "full synchronization". An RDB file is transmitted from the primary to the # replicas. # # The transmission can happen in two different ways: # # 1) Disk-backed: The primary creates a new process that writes the RDB # file on disk. Later the file is transferred by the parent # process to the replicas incrementally. # 2) Diskless: The primary creates a new process that directly writes the # RDB file to replica sockets, without touching the disk at all. # # With disk-backed replication, while the RDB file is generated, more replicas # can be queued and served with the RDB file as soon as the current child # producing the RDB file finishes its work. With diskless replication instead # once the transfer starts, new replicas arriving will be queued and a new # transfer will start when the current one terminates. # # When diskless replication is used, the primary waits a configurable amount of # time (in seconds) before starting the transfer in the hope that multiple # replicas will arrive and the transfer can be parallelized. # # With slow disks and fast (large bandwidth) networks, diskless replication # works better. repl-diskless-sync yes # When diskless replication is enabled, it is possible to configure the delay # the server waits in order to spawn the child that transfers the RDB via socket # to the replicas. # # This is important since once the transfer starts, it is not possible to serve # new replicas arriving, that will be queued for the next RDB transfer, so the # server waits a delay in order to let more replicas arrive. # # The delay is specified in seconds, and by default is 5 seconds. To disable # it entirely just set it to 0 seconds and the transfer will start ASAP. repl-diskless-sync-delay 5 # When diskless replication is enabled with a delay, it is possible to let # the replication start before the maximum delay is reached if the maximum # number of replicas expected have connected. Default of 0 means that the # maximum is not defined and the server will wait the full delay. repl-diskless-sync-max-replicas 0 # ----------------------------------------------------------------------------- # WARNING: Since in this setup the replica does not immediately store an RDB on # disk, it may cause data loss during failovers. RDB diskless load + server # modules not handling I/O reads may cause the server to abort in case of I/O errors # during the initial synchronization stage with the primary. # ----------------------------------------------------------------------------- # # Replica can load the RDB it reads from the replication link directly from the # socket, or store the RDB to a file and read that file after it was completely # received from the primary. # # In many cases the disk is slower than the network, and storing and loading # the RDB file may increase replication time (and even increase the primary's # Copy on Write memory and replica buffers). # However, when parsing the RDB file directly from the socket, in order to avoid # data loss it's only safe to flush the current dataset when the new dataset is # fully loaded in memory, resulting in higher memory usage. # For this reason we have the following options: # # "disabled" - Don't use diskless load (store the rdb file to the disk first) # "swapdb" - Keep current db contents in RAM while parsing the data directly # from the socket. Replicas in this mode can keep serving current # dataset while replication is in progress, except for cases where # they can't recognize primary as having a data set from same # replication history. # Note that this requires sufficient memory, if you don't have it, # you risk an OOM kill. # "on-empty-db" - Use diskless load only when current dataset is empty. This is # safer and avoid having old and new dataset loaded side by side # during replication. # "flush-before-load" - [dangerous] Flush all data before parsing. Note that if # there's a problem before the replication succeeded you may # lose all your data. repl-diskless-load disabled # This dual channel replication sync feature optimizes the full synchronization process # between a primary and its replicas. When enabled, it reduces both memory and CPU load # on the primary server. # # How it works: # 1. During full sync, instead of accumulating replication data on the primary server, # the data is sent directly to the syncing replica. # 2. The primary's background save (bgsave) process streams the RDB snapshot directly # to the replica over a separate connection. # # Tradeoff: # While this approach reduces load on the primary, it shifts the burden of storing # the replication buffer to the replica. This means the replica must have sufficient # memory to accommodate the buffer during synchronization. However, this tradeoff is # generally beneficial as it prevents potential performance degradation on the primary # server, which is typically handling more critical operations. # # When toggling this configuration on or off during an ongoing synchronization process, # it does not change the already running sync method. The new configuration will take # effect only for subsequent synchronization processes. dual-channel-replication-enabled no # Master send PINGs to its replicas in a predefined interval. It's possible to # change this interval with the repl_ping_replica_period option. The default # value is 10 seconds. # # repl-ping-replica-period 10 # The following option sets the replication timeout for: # # 1) Bulk transfer I/O during SYNC, from the point of view of replica. # 2) Master timeout from the point of view of replicas (data, pings). # 3) Replica timeout from the point of view of primaries (REPLCONF ACK pings). # # It is important to make sure that this value is greater than the value # specified for repl-ping-replica-period otherwise a timeout will be detected # every time there is low traffic between the primary and the replica. The default # value is 60 seconds. # # repl-timeout 60 # Disable TCP_NODELAY on the replica socket after SYNC? # # If you select "yes", the server will use a smaller number of TCP packets and # less bandwidth to send data to replicas. But this can add a delay for # the data to appear on the replica side, up to 40 milliseconds with # Linux kernels using a default configuration. # # If you select "no" the delay for data to appear on the replica side will # be reduced but more bandwidth will be used for replication. # # By default we optimize for low latency, but in very high traffic conditions # or when the primary and replicas are many hops away, turning this to "yes" may # be a good idea. repl-disable-tcp-nodelay no # Set the replication backlog size. The backlog is a buffer that accumulates # replica data when replicas are disconnected for some time, so that when a # replica wants to reconnect again, often a full resync is not needed, but a # partial resync is enough, just passing the portion of data the replica # missed while disconnected. # # The bigger the replication backlog, the longer the replica can endure the # disconnect and later be able to perform a partial resynchronization. # # The backlog is only allocated if there is at least one replica connected. # # repl-backlog-size 1mb # After a primary has no connected replicas for some time, the backlog will be # freed. The following option configures the amount of seconds that need to # elapse, starting from the time the last replica disconnected, for the backlog # buffer to be freed. # # Note that replicas never free the backlog for timeout, since they may be # promoted to primaries later, and should be able to correctly "partially # resynchronize" with other replicas: hence they should always accumulate backlog. # # A value of 0 means to never release the backlog. # # repl-backlog-ttl 3600 # The replica priority is an integer number published by the server in the INFO # output. It is used by Sentinel in order to select a replica to promote # into a primary if the primary is no longer working correctly. # # A replica with a low priority number is considered better for promotion, so # for instance if there are three replicas with priority 10, 100, 25 Sentinel # will pick the one with priority 10, that is the lowest. # # However a special priority of 0 marks the replica as not able to perform the # role of primary, so a replica with priority of 0 will never be selected by # Sentinel for promotion. # # By default the priority is 100. replica-priority 100 # The propagation error behavior controls how the server will behave when it is # unable to handle a command being processed in the replication stream from a primary # or processed while reading from an AOF file. Errors that occur during propagation # are unexpected, and can cause data inconsistency. # # If an application wants to ensure there is no data divergence, this configuration # should be set to 'panic' instead. The value can also be set to 'panic-on-replicas' # to only panic when a replica encounters an error on the replication stream. One of # these two panic values will become the default value in the future once there are # sufficient safety mechanisms in place to prevent false positive crashes. # # propagation-error-behavior ignore # Replica ignore disk write errors controls the behavior of a replica when it is # unable to persist a write command received from its primary to disk. By default, # this configuration is set to 'no' and will crash the replica in this condition. # It is not recommended to change this default. # # replica-ignore-disk-write-errors no # Make the primary forbid expiration and eviction. # This is useful for sync tools, because expiration and eviction may cause the data corruption. # Sync tools can mark their connections as importing source by CLIENT IMPORT-SOURCE. # NOTICE: Clients should avoid writing the same key on the source server and the destination server. # # import-mode no # ----------------------------------------------------------------------------- # By default, Sentinel includes all replicas in its reports. A replica # can be excluded from Sentinel's announcements. An unannounced replica # will be ignored by the 'sentinel replicas ' command and won't be # exposed to Sentinel's clients. # # This option does not change the behavior of replica-priority. Even with # replica-announced set to 'no', the replica can be promoted to primary. To # prevent this behavior, set replica-priority to 0. # # replica-announced yes # It is possible for a primary to stop accepting writes if there are less than # N replicas connected, having a lag less or equal than M seconds. # # The N replicas need to be in "online" state. # # The lag in seconds, that must be <= the specified value, is calculated from # the last ping received from the replica, that is usually sent every second. # # This option does not GUARANTEE that N replicas will accept the write, but # will limit the window of exposure for lost writes in case not enough replicas # are available, to the specified number of seconds. # # For example to require at least 3 replicas with a lag <= 10 seconds use: # # min-replicas-to-write 3 # min-replicas-max-lag 10 # # Setting one or the other to 0 disables the feature. # # By default min-replicas-to-write is set to 0 (feature disabled) and # min-replicas-max-lag is set to 10. # A primary is able to list the address and port of the attached # replicas in different ways. For example the "INFO replication" section # offers this information, which is used, among other tools, by # Sentinel in order to discover replica instances. # Another place where this info is available is in the output of the # "ROLE" command of a primary. # # The listed IP address and port normally reported by a replica is # obtained in the following way: # # IP: The address is auto detected by checking the peer address # of the socket used by the replica to connect with the primary. # # Port: The port is communicated by the replica during the replication # handshake, and is normally the port that the replica is using to # listen for connections. # # However when port forwarding or Network Address Translation (NAT) is # used, the replica may actually be reachable via different IP and port # pairs. The following two options can be used by a replica in order to # report to its primary a specific set of IP and port, so that both INFO # and ROLE will report those values. # # There is no need to use both the options if you need to override just # the port or the IP address. # # replica-announce-ip 5.5.5.5 # replica-announce-port 1234 ############################### KEYS TRACKING ################################# # The client side caching of values is assisted via server-side support. # This is implemented using an invalidation table that remembers, using # a radix key indexed by key name, what clients have which keys. In turn # this is used in order to send invalidation messages to clients. Please # check this page to understand more about the feature: # # https://valkey.io/topics/client-side-caching # # When tracking is enabled for a client, all the read only queries are assumed # to be cached: this will force the server to store information in the invalidation # table. When keys are modified, such information is flushed away, and # invalidation messages are sent to the clients. However if the workload is # heavily dominated by reads, the server could use more and more memory in order # to track the keys fetched by many clients. # # For this reason it is possible to configure a maximum fill value for the # invalidation table. By default it is set to 1M of keys, and once this limit # is reached, the server will start to evict keys in the invalidation table # even if they were not modified, just to reclaim memory: this will in turn # force the clients to invalidate the cached values. Basically the table # maximum size is a trade off between the memory you want to spend server # side to track information about who cached what, and the ability of clients # to retain cached objects in memory. # # If you set the value to 0, it means there are no limits, and the server will # retain as many keys as needed in the invalidation table. # In the "stats" INFO section, you can find information about the number of # keys in the invalidation table at every given moment. # # Note: when key tracking is used in broadcasting mode, no memory is used # in the server side so this setting is useless. # # tracking-table-max-keys 1000000 ################################## SECURITY ################################### # Warning: since the server is pretty fast, an outside user can try up to # 1 million passwords per second against a modern box. This means that you # should use very strong passwords, otherwise they will be very easy to break. # Note that because the password is really a shared secret between the client # and the server, and should not be memorized by any human, the password # can be easily a long string from /dev/urandom or whatever, so by using a # long and unguessable password no brute force attack will be possible. # ACL users are defined in the following format: # # user ... acl rules ... # # For example: # # user worker +@list +@connection ~jobs:* on >ffa9203c493aa99 # # The special username "default" is used for new connections. If this user # has the "nopass" rule, then new connections will be immediately authenticated # as the "default" user without the need of any password provided via the # AUTH command. Otherwise if the "default" user is not flagged with "nopass" # the connections will start in not authenticated state, and will require # AUTH (or the HELLO command AUTH option) in order to be authenticated and # start to work. # # The ACL rules that describe what a user can do are the following: # # on Enable the user: it is possible to authenticate as this user. # off Disable the user: it's no longer possible to authenticate # with this user, however the already authenticated connections # will still work. # skip-sanitize-payload RESTORE dump-payload sanitization is skipped. # sanitize-payload RESTORE dump-payload is sanitized (default). # + Allow the execution of that command. # May be used with `|` for allowing subcommands (e.g "+config|get") # - Disallow the execution of that command. # May be used with `|` for blocking subcommands (e.g "-config|set") # +@ Allow the execution of all the commands in such category # with valid categories are like @admin, @set, @sortedset, ... # and so forth, see the full list in the server.c file where # the server command table is described and defined. # The special category @all means all the commands, but currently # present in the server, and that will be loaded in the future # via modules. # +|first-arg Allow a specific first argument of an otherwise # disabled command. It is only supported on commands with # no sub-commands, and is not allowed as negative form # like -SELECT|1, only additive starting with "+". This # feature is deprecated and may be removed in the future. # allcommands Alias for +@all. Note that it implies the ability to execute # all the future commands loaded via the modules system. # nocommands Alias for -@all. # ~ Add a pattern of keys that can be mentioned as part of # commands. For instance ~* allows all the keys. The pattern # is a glob-style pattern like the one of KEYS. # It is possible to specify multiple patterns. # %R~ Add key read pattern that specifies which keys can be read # from. # %W~ Add key write pattern that specifies which keys can be # written to. # allkeys Alias for ~* # resetkeys Flush the list of allowed keys patterns. # & Add a glob-style pattern of Pub/Sub channels that can be # accessed by the user. It is possible to specify multiple channel # patterns. # allchannels Alias for &* # resetchannels Flush the list of allowed channel patterns. # > Add this password to the list of valid password for the user. # For example >mypass will add "mypass" to the list. # This directive clears the "nopass" flag (see later). # < Remove this password from the list of valid passwords. # nopass All the set passwords of the user are removed, and the user # is flagged as requiring no password: it means that every # password will work against this user. If this directive is # used for the default user, every new connection will be # immediately authenticated with the default user without # any explicit AUTH command required. Note that the "resetpass" # directive will clear this condition. # resetpass Flush the list of allowed passwords. Moreover removes the # "nopass" status. After "resetpass" the user has no associated # passwords and there is no way to authenticate without adding # some password (or setting it as "nopass" later). # reset Performs the following actions: resetpass, resetkeys, resetchannels, # allchannels (if acl-pubsub-default is set), off, clearselectors, -@all. # The user returns to the same state it has immediately after its creation. # () Create a new selector with the options specified within the # parentheses and attach it to the user. Each option should be # space separated. The first character must be ( and the last # character must be ). # clearselectors Remove all of the currently attached selectors. # Note this does not change the "root" user permissions, # which are the permissions directly applied onto the # user (outside the parentheses). # # ACL rules can be specified in any order: for instance you can start with # passwords, then flags, or key patterns. However note that the additive # and subtractive rules will CHANGE MEANING depending on the ordering. # For instance see the following example: # # user alice on +@all -DEBUG ~* >somepassword # # This will allow "alice" to use all the commands with the exception of the # DEBUG command, since +@all added all the commands to the set of the commands # alice can use, and later DEBUG was removed. However if we invert the order # of two ACL rules the result will be different: # # user alice on -DEBUG +@all ~* >somepassword # # Now DEBUG was removed when alice had yet no commands in the set of allowed # commands, later all the commands are added, so the user will be able to # execute everything. # # Basically ACL rules are processed left-to-right. # # The following is a list of command categories and their meanings: # * keyspace - Writing or reading from keys, databases, or their metadata # in a type agnostic way. Includes DEL, RESTORE, DUMP, RENAME, EXISTS, DBSIZE, # KEYS, EXPIRE, TTL, FLUSHALL, etc. Commands that may modify the keyspace, # key or metadata will also have `write` category. Commands that only read # the keyspace, key or metadata will have the `read` category. # * read - Reading from keys (values or metadata). Note that commands that don't # interact with keys, will not have either `read` or `write`. # * write - Writing to keys (values or metadata) # * admin - Administrative commands. Normal applications will never need to use # these. Includes REPLICAOF, CONFIG, DEBUG, SAVE, MONITOR, ACL, SHUTDOWN, etc. # * dangerous - Potentially dangerous (each should be considered with care for # various reasons). This includes FLUSHALL, MIGRATE, RESTORE, SORT, KEYS, # CLIENT, DEBUG, INFO, CONFIG, SAVE, REPLICAOF, etc. # * connection - Commands affecting the connection or other connections. # This includes AUTH, SELECT, COMMAND, CLIENT, ECHO, PING, etc. # * blocking - Potentially blocking the connection until released by another # command. # * fast - Fast O(1) commands. May loop on the number of arguments, but not the # number of elements in the key. # * slow - All commands that are not Fast. # * pubsub - PUBLISH / SUBSCRIBE related # * transaction - WATCH / MULTI / EXEC related commands. # * scripting - Scripting related. # * set - Data type: sets related. # * sortedset - Data type: zsets related. # * list - Data type: lists related. # * hash - Data type: hashes related. # * string - Data type: strings related. # * bitmap - Data type: bitmaps related. # * hyperloglog - Data type: hyperloglog related. # * geo - Data type: geo related. # * stream - Data type: streams related. # # For more information about ACL configuration please refer to # the Valkey web site at https://valkey.io/topics/acl # ACL LOG # # The ACL Log tracks failed commands and authentication events associated # with ACLs. The ACL Log is useful to troubleshoot failed commands blocked # by ACLs. The ACL Log is stored in memory. You can reclaim memory with # ACL LOG RESET. Define the maximum entry length of the ACL Log below. acllog-max-len 128 # Using an external ACL file # # Instead of configuring users here in this file, it is possible to use # a stand-alone file just listing users. The two methods cannot be mixed: # if you configure users here and at the same time you activate the external # ACL file, the server will refuse to start. # # The format of the external ACL user file is exactly the same as the # format that is used inside valkey.conf to describe users. # # aclfile /etc/valkey/users.acl # IMPORTANT NOTE: "requirepass" is just a compatibility # layer on top of the new ACL system. The option effect will be just setting # the password for the default user. Clients will still authenticate using # AUTH as usually, or more explicitly with AUTH default # if they follow the new protocol: both will work. # # The requirepass is not compatible with aclfile option and the ACL LOAD # command, these will cause requirepass to be ignored. # user default on >isfoobared allcommands allkeys # The default Pub/Sub channels permission for new users is controlled by the # acl-pubsub-default configuration directive, which accepts one of these values: # # allchannels: grants access to all Pub/Sub channels # resetchannels: revokes access to all Pub/Sub channels # # acl-pubsub-default defaults to 'resetchannels' permission. # # acl-pubsub-default resetchannels # Command renaming (DEPRECATED). # # ------------------------------------------------------------------------ # WARNING: avoid using this option if possible. Instead use ACLs to remove # commands from the default user, and put them only in some admin user you # create for administrative purposes. # ------------------------------------------------------------------------ # # It is possible to change the name of dangerous commands in a shared # environment. For instance the CONFIG command may be renamed into something # hard to guess so that it will still be available for internal-use tools # but not available for general clients. # # Example: # # rename-command CONFIG b840fc02d524045429941cc15f59e41cb7be6c52 # # It is also possible to completely kill a command by renaming it into # an empty string: # # rename-command CONFIG "" # # Please note that changing the name of commands that are logged into the # AOF file or transmitted to replicas may cause problems. ################################### CLIENTS #################################### # Set the max number of connected clients at the same time. By default # this limit is set to 10000 clients, however if the server is not # able to configure the process file limit to allow for the specified limit # the max number of allowed clients is set to the current file limit # minus 32 (as the server reserves a few file descriptors for internal uses). # # Once the limit is reached the server will close all the new connections sending # an error 'max number of clients reached'. # # IMPORTANT: With a cluster-enabled setup, the max number of connections is also # shared with the cluster bus: every node in the cluster will use two # connections, one incoming and another outgoing. It is important to size the # limit accordingly in case of very large clusters. # maxclients 4000 ############################## MEMORY MANAGEMENT ################################ # Set a memory usage limit to the specified amount of bytes. # When the memory limit is reached the server will try to remove keys # according to the eviction policy selected (see maxmemory-policy). # # If the server can't remove keys according to the policy, or if the policy is # set to 'noeviction', the server will start to reply with errors to commands # that would use more memory, like SET, LPUSH, and so on, and will continue # to reply to read-only commands like GET. # # This option is usually useful when using the server as an LRU or LFU cache, or to # set a hard memory limit for an instance (using the 'noeviction' policy). # # WARNING: If you have replicas attached to an instance with maxmemory on, # the size of the output buffers needed to feed the replicas are subtracted # from the used memory count, so that network problems / resyncs will # not trigger a loop where keys are evicted, and in turn the output # buffer of replicas is full with DELs of keys evicted triggering the deletion # of more keys, and so forth until the database is completely emptied. # # In short... if you have replicas attached it is suggested that you set a lower # limit for maxmemory so that there is some free RAM on the system for replica # output buffers (but this is not needed if the policy is 'noeviction'). # maxmemory 88MB # MAXMEMORY POLICY: how the server will select what to remove when maxmemory # is reached. You can select one from the following behaviors: # # volatile-lru -> Evict using approximated LRU, only keys with an expire set. # allkeys-lru -> Evict any key using approximated LRU. # volatile-lfu -> Evict using approximated LFU, only keys with an expire set. # allkeys-lfu -> Evict any key using approximated LFU. # volatile-random -> Remove a random key having an expire set. # allkeys-random -> Remove a random key, any key. # volatile-ttl -> Remove the key with the nearest expire time (minor TTL) # noeviction -> Don't evict anything, just return an error on write operations. # # LRU means Least Recently Used # LFU means Least Frequently Used # # Both LRU, LFU and volatile-ttl are implemented using approximated # randomized algorithms. # # Note: with any of the above policies, when there are no suitable keys for # eviction, the server will return an error on write operations that require # more memory. These are usually commands that create new keys, add data or # modify existing keys. A few examples are: SET, INCR, HSET, LPUSH, SUNIONSTORE, # SORT (due to the STORE argument), and EXEC (if the transaction includes any # command that requires memory). # # The default is: noeviction # maxmemory-policy allkeys-lru # LRU, LFU and minimal TTL algorithms are not precise algorithms but approximated # algorithms (in order to save memory), so you can tune it for speed or # accuracy. By default the server will check five keys and pick the one that was # used least recently, you can change the sample size using the following # configuration directive. # # The default of 5 produces good enough results. 10 Approximates very closely # true LRU but costs more CPU. 3 is faster but not very accurate. The maximum # value that can be set is 64. # # maxmemory-samples 5 # Eviction processing is designed to function well with the default setting. # If there is an unusually large amount of write traffic, this value may need to # be increased. Decreasing this value may reduce latency at the risk of # eviction processing effectiveness # 0 = minimum latency, 10 = default, 100 = process without regard to latency # # maxmemory-eviction-tenacity 10 # By default a replica will ignore its maxmemory setting # (unless it is promoted to primary after a failover or manually). It means # that the eviction of keys will be just handled by the primary, sending the # DEL commands to the replica as keys evict in the primary side. # # This behavior ensures that primaries and replicas stay consistent, and is usually # what you want, however if your replica is writable, or you want the replica # to have a different memory setting, and you are sure all the writes performed # to the replica are idempotent, then you may change this default (but be sure # to understand what you are doing). # # Note that since the replica by default does not evict, it may end using more # memory than the one set via maxmemory (there are certain buffers that may # be larger on the replica, or data structures may sometimes take more memory # and so forth). So make sure you monitor your replicas and make sure they # have enough memory to never hit a real out-of-memory condition before the # primary hits the configured maxmemory setting. # # replica-ignore-maxmemory yes # The server reclaims expired keys in two ways: upon access when those keys are # found to be expired, and also in the background, in what is called the # "active expire key". The key space is slowly and incrementally scanned # looking for expired keys to reclaim, so that it is possible to free memory # of keys that are expired and will never be accessed again in a short time. # # The default effort of the expire cycle will try to avoid having more than # ten percent of expired keys still in memory, and will try to avoid consuming # more than 25% of total memory and to add latency to the system. However # it is possible to increase the expire "effort" that is normally set to # "1", to a greater value, up to the value "10". At its maximum value the # system will use more CPU, longer cycles (and technically may introduce # more latency), and will tolerate less already expired keys still present # in the system. It's a tradeoff between memory, CPU and latency. # # active-expire-effort 1 ############################# LAZY FREEING #################################### # When keys are deleted, the served has historically freed their memory using # blocking operations. It means that the server stopped processing new commands # in order to reclaim all the memory associated with an object in a synchronous # way. If the key deleted is associated with a small object, the time needed # in order to execute the DEL command is very small and comparable to most other # O(1) or O(log_N) commands in the server. However if the key is associated with an # aggregated value containing millions of elements, the server can block for # a long time (even seconds) in order to complete the operation. # # For the above reasons, lazy freeing (or asynchronous freeing), has been # introduced. With lazy freeing, keys are deleted in constant time. Another # thread will incrementally free the object in the background as fast as # possible. # # Starting from Valkey 8.0, lazy freeing is enabled by default. It is possible # to retain the synchronous freeing behaviour by setting the lazyfree related # configuration directives to 'no'. # Commands like DEL, FLUSHALL and FLUSHDB delete keys, but the server can also # delete keys or flush the whole database as a side effect of other operations. # Specifically the server deletes objects independently of a user call in the # following scenarios: # # 1) On eviction, because of the maxmemory and maxmemory policy configurations, # in order to make room for new data, without going over the specified # memory limit. # 2) Because of expire: when a key with an associated time to live (see the # EXPIRE command) must be deleted from memory. # 3) Because of a side effect of a command that stores data on a key that may # already exist. For example the RENAME command may delete the old key # content when it is replaced with another one. Similarly SUNIONSTORE # or SORT with STORE option may delete existing keys. The SET command # itself removes any old content of the specified key in order to replace # it with the specified string. # 4) During replication, when a replica performs a full resynchronization with # its primary, the content of the whole database is removed in order to # load the RDB file just transferred. # # In all the above cases, the default is to release memory in a non-blocking # way. lazyfree-lazy-eviction yes lazyfree-lazy-expire yes lazyfree-lazy-server-del yes replica-lazy-flush yes # For keys deleted using the DEL command, lazy freeing is controlled by the # configuration directive 'lazyfree-lazy-user-del'. The default is 'yes'. The # UNLINK command is identical to the DEL command, except that UNLINK always # frees the memory lazily, regardless of this configuration directive: lazyfree-lazy-user-del yes # FLUSHDB, FLUSHALL, SCRIPT FLUSH and FUNCTION FLUSH support both asynchronous and synchronous # deletion, which can be controlled by passing the [SYNC|ASYNC] flags into the # commands. When neither flag is passed, this directive will be used to determine # if the data should be deleted asynchronously. # # When a replica performs a node reset via CLUSTER RESET, the entire # database content is removed to allow the node to become an empty primary. # This directive also determines whether the data should be deleted asynchronously. # # There are many problems with running flush synchronously. Even in single CPU # environments, the thread managers should balance between the freeing and # serving incoming requests. The default value is yes. lazyfree-lazy-user-flush yes ################################ THREADED I/O ################################# # The server is mostly single threaded, however there are certain threaded # operations such as UNLINK, slow I/O accesses and other things that are # performed on side threads. # # Now it is also possible to handle the server clients socket reads and writes # in different I/O threads. Since especially writing is so slow, normally # users use pipelining in order to speed up the server performances per # core, and spawn multiple instances in order to scale more. Using I/O # threads it is possible to easily speedup two times the server without resorting # to pipelining nor sharding of the instance. # # By default threading is disabled, we suggest enabling it only in machines # that have at least 3 or more cores, leaving at least one spare core. # We also recommend using threaded I/O only if you actually have performance problems, with # instances being able to use a quite big percentage of CPU time, otherwise # there is no point in using this feature. # # So for instance if you have a four cores boxes, try to use 2 or 3 I/O # threads, if you have a 8 cores, try to use 6 threads. In order to # enable I/O threads use the following configuration directive: # # io-threads 4 # # Setting io-threads to 1 will just use the main thread as usual. # When I/O threads are enabled, we use threads for reads and writes, that is # to thread the write and read syscall and transfer the client buffers to the # socket and to enable threading of reads and protocol parsing. # # When multiple commands are parsed by the I/O threads and ready for execution, # we take advantage of knowing the next set of commands and prefetch their # required dictionary entries in a batch. This reduces memory access costs. # # The optimal batch size depends on the specific workflow of the user. # The default batch size is 16, which can be modified using the # 'prefetch-batch-max-size' config. # # When the config is set to 0, prefetching is disabled. # # prefetch-batch-max-size 16 # # NOTE: # 1. The 'io-threads-do-reads' config is deprecated and has no effect. Please # avoid using this config if possible. # # 2. If you want to test the server speedup using valkey-benchmark, make # sure you also run the benchmark itself in threaded mode, using the # --threads option to match the number of server threads, otherwise you'll not # be able to notice the improvements. ############################ KERNEL OOM CONTROL ############################## # On Linux, it is possible to hint the kernel OOM killer on what processes # should be killed first when out of memory. # # Enabling this feature makes the server actively control the oom_score_adj value # for all its processes, depending on their role. The default scores will # attempt to have background child processes killed before all others, and # replicas killed before primaries. # # The server supports these options: # # no: Don't make changes to oom-score-adj (default). # yes: Alias to "relative" see below. # absolute: Values in oom-score-adj-values are written as is to the kernel. # relative: Values are used relative to the initial value of oom_score_adj when # the server starts and are then clamped to a range of -1000 to 1000. # Because typically the initial value is 0, they will often match the # absolute values. oom-score-adj no # When oom-score-adj is used, this directive controls the specific values used # for primary, replica and background child processes. Values range -2000 to # 2000 (higher means more likely to be killed). # # Unprivileged processes (not root, and without CAP_SYS_RESOURCE capabilities) # can freely increase their value, but not decrease it below its initial # settings. This means that setting oom-score-adj to "relative" and setting the # oom-score-adj-values to positive values will always succeed. oom-score-adj-values 0 200 800 #################### KERNEL transparent hugepage CONTROL ###################### # Usually the kernel Transparent Huge Pages control is set to "madvise" or # "never" by default (/sys/kernel/mm/transparent_hugepage/enabled), in which # case this config has no effect. On systems in which it is set to "always", # the server will attempt to disable it specifically for the server process in order # to avoid latency problems specifically with fork(2) and CoW. # If for some reason you prefer to keep it enabled, you can set this config to # "no" and the kernel global to "always". disable-thp yes ############################## APPEND ONLY MODE ############################### # By default the server asynchronously dumps the dataset on disk. This mode is # good enough in many applications, but an issue with the server process or # a power outage may result into a few minutes of writes lost (depending on # the configured save points). # # The Append Only File is an alternative persistence mode that provides # much better durability. For instance using the default data fsync policy # (see later in the config file) the server can lose just one second of writes in a # dramatic event like a server power outage, or a single write if something # wrong with the process itself happens, but the operating system is # still running correctly. # # AOF and RDB persistence can be enabled at the same time without problems. # If the AOF is enabled on startup the server will load the AOF, that is the file # with the better durability guarantees. # # Note that changing this value in a config file of an existing database and # restarting the server can lead to data loss. A conversion needs to be done # by setting it via CONFIG command on a live server first. # # Please check https://valkey.io/topics/persistence for more information. appendonly no # The base name of the append only file. # # The server uses a set of append-only files to persist the dataset # and changes applied to it. There are two basic types of files in use: # # - Base files, which are a snapshot representing the complete state of the # dataset at the time the file was created. Base files can be either in # the form of RDB (binary serialized) or AOF (textual commands). # - Incremental files, which contain additional commands that were applied # to the dataset following the previous file. # # In addition, manifest files are used to track the files and the order in # which they were created and should be applied. # # Append-only file names are created by the server following a specific pattern. # The file name's prefix is based on the 'appendfilename' configuration # parameter, followed by additional information about the sequence and type. # # For example, if appendfilename is set to appendonly.aof, the following file # names could be derived: # # - appendonly.aof.1.base.rdb as a base file. # - appendonly.aof.1.incr.aof, appendonly.aof.2.incr.aof as incremental files. # - appendonly.aof.manifest as a manifest file. appendfilename "appendonly.aof" # For convenience, the server stores all persistent append-only files in a dedicated # directory. The name of the directory is determined by the appenddirname # configuration parameter. appenddirname "appendonlydir" # The fsync() call tells the Operating System to actually write data on disk # instead of waiting for more data in the output buffer. Some OS will really flush # data on disk, some other OS will just try to do it ASAP. # # The server supports three different modes: # # no: don't fsync, just let the OS flush the data when it wants. Faster. # always: fsync after every write to the append only log. Slow, Safest. # everysec: fsync only one time every second. Compromise. # # The default is "everysec", as that's usually the right compromise between # speed and data safety. It's up to you to understand if you can relax this to # "no" that will let the operating system flush the output buffer when # it wants, for better performances (but if you can live with the idea of # some data loss consider the default persistence mode that's snapshotting), # or on the contrary, use "always" that's very slow but a bit safer than # everysec. # # More details please check the following article: # http://antirez.com/post/redis-persistence-demystified.html # # If unsure, use "everysec". # appendfsync always appendfsync everysec # appendfsync no # When the AOF fsync policy is set to always or everysec, and a background # saving process (a background save or AOF log background rewriting) is # performing a lot of I/O against the disk, in some Linux configurations # the server may block too long on the fsync() call. Note that there is no fix for # this currently, as even performing fsync in a different thread will block # our synchronous write(2) call. # # In order to mitigate this problem it's possible to use the following option # that will prevent fsync() from being called in the main process while a # BGSAVE or BGREWRITEAOF is in progress. # # This means that while another child is saving, the durability of the server is # the same as "appendfsync no". In practical terms, this means that it is # possible to lose up to 30 seconds of log in the worst scenario (with the # default Linux settings). # # If you have latency problems turn this to "yes". Otherwise leave it as # "no" that is the safest pick from the point of view of durability. no-appendfsync-on-rewrite no # Automatic rewrite of the append only file. # The server is able to automatically rewrite the log file implicitly calling # BGREWRITEAOF when the AOF log size grows by the specified percentage. # # This is how it works: The server remembers the size of the AOF file after the # latest rewrite (if no rewrite has happened since the restart, the size of # the AOF at startup is used). # # This base size is compared to the current size. If the current size is # bigger than the specified percentage, the rewrite is triggered. Also # you need to specify a minimal size for the AOF file to be rewritten, this # is useful to avoid rewriting the AOF file even if the percentage increase # is reached but it is still pretty small. # # Specify a percentage of zero in order to disable the automatic AOF # rewrite feature. auto-aof-rewrite-percentage 100 auto-aof-rewrite-min-size 64mb # An AOF file may be found to be truncated at the end during the server # startup process, when the AOF data gets loaded back into memory. # This may happen when the system where the server is running # crashes, especially when an ext4 filesystem is mounted without the # data=ordered option (however this can't happen when the server itself # crashes or aborts but the operating system still works correctly). # # The server can either exit with an error when this happens, or load as much # data as possible (the default now) and start if the AOF file is found # to be truncated at the end. The following option controls this behavior. # # If aof-load-truncated is set to yes, a truncated AOF file is loaded and # the server starts emitting a log to inform the user of the event. # Otherwise if the option is set to no, the server aborts with an error # and refuses to start. When the option is set to no, the user requires # to fix the AOF file using the "valkey-check-aof" utility before to restart # the server. # # Note that if the AOF file will be found to be corrupted in the middle # the server will still exit with an error. This option only applies when # the server will try to read more data from the AOF file but not enough bytes # will be found. aof-load-truncated yes # The server can create append-only base files in either RDB or AOF formats. Using # the RDB format is always faster and more efficient, and disabling it is only # supported for backward compatibility purposes. aof-use-rdb-preamble yes # The server supports recording timestamp annotations in the AOF to support restoring # the data from a specific point-in-time. However, using this capability changes # the AOF format in a way that may not be compatible with existing AOF parsers. aof-timestamp-enabled no ################################ SHUTDOWN ##################################### # Maximum time to wait for replicas when shutting down, in seconds. # # During shut down, a grace period allows any lagging replicas to catch up with # the latest replication offset before the primary exits. This period can # prevent data loss, especially for deployments without configured disk backups. # # The 'shutdown-timeout' value is the grace period's duration in seconds. It is # only applicable when the instance has replicas. To disable the feature, set # the value to 0. # # shutdown-timeout 10 # When the server receives a SIGINT or SIGTERM, shutdown is initiated and by default # an RDB snapshot is written to disk in a blocking operation if save points are configured. # The options used on signaled shutdown can include the following values: # default: Saves RDB snapshot only if save points are configured. # Waits for lagging replicas to catch up. # save: Forces a DB saving operation even if no save points are configured. # nosave: Prevents DB saving operation even if one or more save points are configured. # now: Skips waiting for lagging replicas. # force: Ignores any errors that would normally prevent the server from exiting. # # Any combination of values is allowed as long as "save" and "nosave" are not set simultaneously. # Example: "nosave force now" # # shutdown-on-sigint default # shutdown-on-sigterm default ################ NON-DETERMINISTIC LONG BLOCKING COMMANDS ##################### # Maximum time in milliseconds for EVAL scripts, functions and in some cases # modules' commands before the server can start processing or rejecting other clients. # # If the maximum execution time is reached the server will start to reply to most # commands with a BUSY error. # # In this state the server will only allow a handful of commands to be executed. # For instance, SCRIPT KILL, FUNCTION KILL, SHUTDOWN NOSAVE and possibly some # module specific 'allow-busy' commands. # # SCRIPT KILL and FUNCTION KILL will only be able to stop a script that did not # yet call any write commands, so SHUTDOWN NOSAVE may be the only way to stop # the server in the case a write command was already issued by the script when # the user doesn't want to wait for the natural termination of the script. # # The default is 5 seconds. It is possible to set it to 0 or a negative value # to disable this mechanism (uninterrupted execution). Note that in the past # this config had a different name, which is now an alias, so both of these do # the same: # lua-time-limit 5000 # busy-reply-threshold 5000 ################################ VALKEY CLUSTER ############################### # Normal server instances can't be part of a cluster; only nodes that are # started as cluster nodes can. In order to start a server instance as a # cluster node enable the cluster support uncommenting the following: # # cluster-enabled yes # Every cluster node has a cluster configuration file. This file is not # intended to be edited by hand. It is created and updated by each node. # Every cluster node requires a different cluster configuration file. # Make sure that instances running in the same system do not have # overlapping cluster configuration file names. # # cluster-config-file nodes-6379.conf # Cluster node timeout is the amount of milliseconds a node must be unreachable # for it to be considered in failure state. # Most other internal time limits are a multiple of the node timeout. # # cluster-node-timeout 15000 # The cluster port is the port that the cluster bus will listen for inbound connections on. When set # to the default value, 0, it will be bound to the command port + 10000. Setting this value requires # you to specify the cluster bus port when executing cluster meet. # cluster-port 0 # A replica of a failing primary will avoid to start a failover if its data # looks too old. # # There is no simple way for a replica to actually have an exact measure of # its "data age", so the following two checks are performed: # # 1) If there are multiple replicas able to failover, they exchange messages # in order to try to give an advantage to the replica with the best # replication offset (more data from the primary processed). # Replicas will try to get their rank by offset, and apply to the start # of the failover a delay proportional to their rank. # # 2) Every single replica computes the time of the last interaction with # its primary. This can be the last ping or command received (if the primary # is still in the "connected" state), or the time that elapsed since the # disconnection with the primary (if the replication link is currently down). # If the last interaction is too old, the replica will not try to failover # at all. # # The point "2" can be tuned by user. Specifically a replica will not perform # the failover if, since the last interaction with the primary, the time # elapsed is greater than: # # (node-timeout * cluster-replica-validity-factor) + repl-ping-replica-period # # So for example if node-timeout is 30 seconds, and the cluster-replica-validity-factor # is 10, and assuming a default repl-ping-replica-period of 10 seconds, the # replica will not try to failover if it was not able to talk with the primary # for longer than 310 seconds. # # A large cluster-replica-validity-factor may allow replicas with too old data to failover # a primary, while a too small value may prevent the cluster from being able to # elect a replica at all. # # For maximum availability, it is possible to set the cluster-replica-validity-factor # to a value of 0, which means, that replicas will always try to failover the # primary regardless of the last time they interacted with the primary. # (However they'll always try to apply a delay proportional to their # offset rank). # # Zero is the only value able to guarantee that when all the partitions heal # the cluster will always be able to continue. # # cluster-replica-validity-factor 10 # Cluster replicas are able to migrate to orphaned primaries, that are primaries # that are left without working replicas. This improves the cluster ability # to resist to failures as otherwise an orphaned primary can't be failed over # in case of failure if it has no working replicas. # # Replicas migrate to orphaned primaries only if there are still at least a # given number of other working replicas for their old primary. This number # is the "migration barrier". A migration barrier of 1 means that a replica # will migrate only if there is at least 1 other working replica for its primary # and so forth. It usually reflects the number of replicas you want for every # primary in your cluster. # # Default is 1 (replicas migrate only if their primaries remain with at least # one replica). To disable migration just set it to a very large value or # set cluster-allow-replica-migration to 'no'. # A value of 0 can be set but is useful only for debugging and dangerous # in production. # # cluster-migration-barrier 1 # Turning off this option allows to use less automatic cluster configuration. # It disables migration of replicas to orphaned primaries. Masters that become # empty due to losing their last slots to another primary will not automatically # replicate from the primary that took over their last slots. Instead, they will # remain as empty primaries without any slots. # # Default is 'yes' (allow automatic migrations). # # cluster-allow-replica-migration yes # By default cluster nodes stop accepting queries if they detect there # is at least a hash slot uncovered (no available node is serving it). # This way if the cluster is partially down (for example a range of hash slots # are no longer covered) all the cluster becomes, eventually, unavailable. # It automatically returns available as soon as all the slots are covered again. # # However sometimes you want the subset of the cluster which is working, # to continue to accept queries for the part of the key space that is still # covered. In order to do so, just set the cluster-require-full-coverage # option to no. # # cluster-require-full-coverage yes # This option, when set to yes, prevents replicas from trying to failover its # primary during primary failures. However the replica can still perform a # manual failover, if forced to do so. # # This is useful in different scenarios, especially in the case of multiple # data center operations, where we want one side to never be promoted if not # in the case of a total DC failure. # # cluster-replica-no-failover no # The timeout in milliseconds for cluster manual failover. If a manual failover # does not complete within the specified time, both the replica and the primary # will abort it. # # A manual failover is a special kind of failover that is usually executed when # there are no actual failures, and we wish to swap the current primary with one # of its replicas in a safe way, without any window for data loss. # # To avoid data loss, the primary and the replica need to wait for each other for # a period of time, the primary need to pause the clients writes to stop processing # traffic. The default failover timeout is 5000ms, it is possible to configure the # timeout and decide how long the primary will pause in the worst case scenario, # i.e. the manual failover timed out due to the insufficient votes. # # Check https://valkey.io/commands/cluster-failover/ for more information. # # cluster-manual-failover-timeout 5000 # This option, when set to yes, allows nodes to serve read traffic while the # cluster is in a down state, as long as it believes it owns the slots. # # This is useful for two cases. The first case is for when an application # doesn't require consistency of data during node failures or network partitions. # One example of this is a cache, where as long as the node has the data it # should be able to serve it. # # The second use case is for configurations that don't meet the recommended # three shards but want to enable cluster mode and scale later. A # primary outage in a 1 or 2 shard configuration causes a read/write outage to the # entire cluster without this option set, with it set there is only a write outage. # Without a quorum of primaries, slot ownership will not change automatically. # # cluster-allow-reads-when-down no # This option, when set to yes, allows nodes to serve pubsub shard traffic while # the cluster is in a down state, as long as it believes it owns the slots. # # This is useful if the application would like to use the pubsub feature even when # the cluster global stable state is not OK. If the application wants to make sure only # one shard is serving a given channel, this feature should be kept as yes. # # cluster-allow-pubsubshard-when-down yes # Cluster link send buffer limit is the limit on the memory usage of an individual # cluster bus link's send buffer in bytes. Cluster links would be freed if they exceed # this limit. This is to primarily prevent send buffers from growing unbounded on links # toward slow peers (E.g. PubSub messages being piled up). # This limit is disabled by default. Enable this limit when 'mem_cluster_links' INFO field # and/or 'send-buffer-allocated' entries in the 'CLUSTER LINKS` command output continuously increase. # Minimum limit of 1gb is recommended so that cluster link buffer can fit in at least a single # PubSub message by default. (client-query-buffer-limit default value is 1gb) # # cluster-link-sendbuf-limit 0 # Clusters can configure their announced hostname using this config. This is a common use case for # applications that need to use TLS Server Name Indication (SNI) or dealing with DNS based # routing. By default this value is only shown as additional metadata in the CLUSTER SLOTS # command, but can be changed using 'cluster-preferred-endpoint-type' config. This value is # communicated along the clusterbus to all nodes, setting it to an empty string will remove # the hostname and also propagate the removal. # # cluster-announce-hostname "" # Clusters can configure an optional nodename to be used in addition to the node ID for # debugging and admin information. This name is broadcasted between nodes, so will be used # in addition to the node ID when reporting cross node events such as node failures. # cluster-announce-human-nodename "" # Clusters can advertise how clients should connect to them using either their IP address, # a user defined hostname, or by declaring they have no endpoint. Which endpoint is # shown as the preferred endpoint is set by using the cluster-preferred-endpoint-type # config with values 'ip', 'hostname', or 'unknown-endpoint'. This value controls how # the endpoint returned for MOVED/ASKING requests as well as the first field of CLUSTER SLOTS. # If the preferred endpoint type is set to hostname, but no announced hostname is set, a '?' # will be returned instead. # # When a cluster advertises itself as having an unknown endpoint, it's indicating that # the server doesn't know how clients can reach the cluster. This can happen in certain # networking situations where there are multiple possible routes to the node, and the # server doesn't know which one the client took. In this case, the server is expecting # the client to reach out on the same endpoint it used for making the last request, but use # the port provided in the response. # # cluster-preferred-endpoint-type ip # The cluster blacklist is used when removing a node from the cluster completely. # When CLUSTER FORGET is called for a node, that node is put into the blacklist for # some time so that when gossip messages are received from other nodes that still # remember it, it is not re-added. This gives time for CLUSTER FORGET to be sent to # every node in the cluster. The blacklist TTL is 60 seconds by default, which should # be sufficient for most clusters, but you may considering increasing this if you see # nodes getting re-added while using CLUSTER FORGET. # # cluster-blacklist-ttl 60 # Clusters can be configured to track per-slot resource statistics, # which are accessible by the CLUSTER SLOT-STATS command. # # By default, the 'cluster-slot-stats-enabled' is disabled, and only 'key-count' is captured. # By enabling the 'cluster-slot-stats-enabled' config, the cluster will begin to capture advanced statistics. # These statistics can be leveraged to assess general slot usage trends, identify hot / cold slots, # migrate slots for a balanced cluster workload, and / or re-write application logic to better utilize slots. # # cluster-slot-stats-enabled no # In order to setup your cluster make sure to read the documentation # available at https://valkey.io web site. ########################## CLUSTER DOCKER/NAT support ######################## # In certain deployments, cluster node's address discovery fails, because # addresses are NAT-ted or because ports are forwarded (the typical case is # Docker and other containers). # # In order to make a cluster work in such environments, a static # configuration where each node knows its public address is needed. The # following options are used for this scope, and are: # # * cluster-announce-ip # * cluster-announce-client-ipv4 # * cluster-announce-client-ipv6 # * cluster-announce-port # * cluster-announce-tls-port # * cluster-announce-bus-port # # Each instructs the node about its address, possibly other addresses to expose # to clients, client ports (for connections without and with TLS) and cluster # message bus port. The information is then published in the bus packets so that # other nodes will be able to correctly map the address of the node publishing # the information. # # If tls-cluster is set to yes and cluster-announce-tls-port is omitted or set # to zero, then cluster-announce-port refers to the TLS port. Note also that # cluster-announce-tls-port has no effect if tls-cluster is set to no. # # If cluster-announce-client-ipv4 and cluster-announce-client-ipv6 are omitted, # then cluster-announce-ip is exposed to clients. # # If the above options are not used, the normal cluster auto-detection # will be used instead. # # Note that when remapped, the bus port may not be at the fixed offset of # clients port + 10000, so you can specify any port and bus-port depending # on how they get remapped. If the bus-port is not set, a fixed offset of # 10000 will be used as usual. # # Example: # # cluster-announce-ip 10.1.1.5 # cluster-announce-client-ipv4 123.123.123.5 # cluster-announce-client-ipv6 2001:db8::8a2e:370:7334 # cluster-announce-tls-port 6379 # cluster-announce-port 0 # cluster-announce-bus-port 6380 ################################## COMMAND LOG ################################### # The Command Log system is used to record commands that consume significant resources # during server operation, including CPU, memory, and network bandwidth. # These commands and the data they access may lead to abnormal instance operations, # the commandlog can help users quickly and intuitively locate issues. # # Currently, three types of command logs are supported: # # SLOW: Logs commands that exceed a specified execution time. This excludes time spent # on I/O operations like client communication and focuses solely on the command's # processing time, where the main thread is blocked. # # LARGE-REQUEST: Logs commands with requests exceeding a defined size. This helps # identify potentially problematic commands that send excessive data to the server. # # LARGE-REPLY: Logs commands that generate replies exceeding a defined size. This # helps identify commands that return unusually large amounts of data, which may # impact network performance or client processing. # # Each log type has two key parameters: # 1. A threshold value that determines when a command is logged. This threshold is specific # to the type of log (e.g., execution time, request size, or reply size). A negative value disables # logging. A value of 0 logs all commands. # 2. A maximum length that specifies the number of entries to retain in the log. Increasing # the length allows more entries to be stored but consumes additional memory. To clear all # entries for a specific log type and reclaim memory, use the `COMMANDLOG RESET` # subcommand followed by the log type. # # SLOW Command Logs # The SLOW log records commands that exceed a specified execution time. The execution time # does not include I/O operations, such as client communication or sending responses. # It only measures the time spent executing the command, during which the thread is blocked # and cannot handle other requests. # # The threshold is measured in microseconds. # # Backward Compatibility: The parameter `slowlog-log-slower-than` is still supported but # deprecated in favor of `commandlog-slow-execution`. commandlog-execution-slower-than 10000 # There is no limit to this length. Just be aware that it will consume memory. # You can reclaim memory used by the slow log with SLOWLOG RESET or COMMANDLOG RESET SLOW. commandlog-slow-execution-max-len 128 # # LARGE_REQUEST Command Logs # The LARGE_REQUEST log tracks commands with requests exceeding a specified size. The request size # includes the command itself and all its arguments. For example, in `SET KEY VALUE`, the size is # determined by the combined size of the key and value. Commands that consume excessive network # bandwidth or query buffer space are recorded here. # # The threshold is measured in bytes. commandlog-request-larger-than 1048576 # Record the number of commands. commandlog-large-request-max-len 128 # # LARGE_REPLY Command Logs # The LARGE_REPLY log records commands that produce replies exceeding a specified size. These replies # may consume significant network bandwidth or client output buffer space. Examples include commands # like `KEYS` or `HGETALL` that return large datasets. Even a `GET` command may qualify if the value # is substantial. # # The threshold is measured in bytes. commandlog-reply-larger-than 1048576 commandlog-large-reply-max-len 128 ################################ LATENCY MONITOR ############################## # The server latency monitoring subsystem samples different operations # at runtime in order to collect data related to possible sources of # latency of a server instance. # # Via the LATENCY command this information is available to the user that can # print graphs and obtain reports. # # The system only logs operations that were performed in a time equal or # greater than the amount of milliseconds specified via the # latency-monitor-threshold configuration directive. When its value is set # to zero, the latency monitor is turned off. # # By default latency monitoring is disabled since it is mostly not needed # if you don't have latency issues, and collecting data has a performance # impact, that while very small, can be measured under big load. Latency # monitoring can easily be enabled at runtime using the command # "CONFIG SET latency-monitor-threshold " if needed. latency-monitor-threshold 0 ################################ LATENCY TRACKING ############################## # The server's extended latency monitoring tracks the per command latencies and enables # exporting the percentile distribution via the INFO latencystats command, # and cumulative latency distributions (histograms) via the LATENCY command. # # By default, the extended latency monitoring is enabled since the overhead # of keeping track of the command latency is very small. # latency-tracking yes # By default the exported latency percentiles via the INFO latencystats command # are the p50, p99, and p999. # latency-tracking-info-percentiles 50 99 99.9 ############################# EVENT NOTIFICATION ############################## # The server can notify Pub/Sub clients about events happening in the key space. # This feature is documented at https://valkey.io/topics/notifications # # For instance if keyspace events notification is enabled, and a client # performs a DEL operation on key "foo" stored in the Database 0, two # messages will be published via Pub/Sub: # # PUBLISH __keyspace@0__:foo del # PUBLISH __keyevent@0__:del foo # # It is possible to select the events that the server will notify among a set # of classes. Every class is identified by a single character: # # K Keyspace events, published with __keyspace@__ prefix. # E Keyevent events, published with __keyevent@__ prefix. # g Generic commands (non-type specific) like DEL, EXPIRE, RENAME, ... # $ String commands # l List commands # s Set commands # h Hash commands # z Sorted set commands # x Expired events (events generated every time a key expires) # e Evicted events (events generated when a key is evicted for maxmemory) # n New key events (Note: not included in the 'A' class) # t Stream commands # d Module key type events # m Key-miss events (Note: It is not included in the 'A' class) # A Alias for g$lshzxetd, so that the "AKE" string means all the events # (Except key-miss events which are excluded from 'A' due to their # unique nature). # # The "notify-keyspace-events" takes as argument a string that is composed # of zero or multiple characters. The empty string means that notifications # are disabled. # # Example: to enable list and generic events, from the point of view of the # event name, use: # # notify-keyspace-events Elg # # Example 2: to get the stream of the expired keys subscribing to channel # name __keyevent@0__:expired use: # # notify-keyspace-events Ex # # By default all notifications are disabled because most users don't need # this feature and the feature has some overhead. Note that if you don't # specify at least one of K or E, no events will be delivered. notify-keyspace-events "" ############################### ADVANCED CONFIG ############################### # Hashes are encoded using a memory efficient data structure when they have a # small number of entries, and the biggest entry does not exceed a given # threshold. These thresholds can be configured using the following directives. hash-max-listpack-entries 512 hash-max-listpack-value 64 # Lists are also encoded in a special way to save a lot of space. # The number of entries allowed per internal list node can be specified # as a fixed maximum size or a maximum number of elements. # For a fixed maximum size, use -5 through -1, meaning: # -5: max size: 64 Kb <-- not recommended for normal workloads # -4: max size: 32 Kb <-- not recommended # -3: max size: 16 Kb <-- probably not recommended # -2: max size: 8 Kb <-- good # -1: max size: 4 Kb <-- good # Positive numbers mean store up to _exactly_ that number of elements # per list node. # The highest performing option is usually -2 (8 Kb size) or -1 (4 Kb size), # but if your use case is unique, adjust the settings as necessary. list-max-listpack-size -2 # Lists may also be compressed. # Compress depth is the number of quicklist ziplist nodes from *each* side of # the list to *exclude* from compression. The head and tail of the list # are always uncompressed for fast push/pop operations. Settings are: # 0: disable all list compression # 1: depth 1 means "don't start compressing until after 1 node into the list, # going from either the head or tail" # So: [head]->node->node->...->node->[tail] # [head], [tail] will always be uncompressed; inner nodes will compress. # 2: [head]->[next]->node->node->...->node->[prev]->[tail] # 2 here means: don't compress head or head->next or tail->prev or tail, # but compress all nodes between them. # 3: [head]->[next]->[next]->node->node->...->node->[prev]->[prev]->[tail] # etc. list-compress-depth 0 # Sets have a special encoding when a set is composed # of just strings that happen to be integers in radix 10 in the range # of 64 bit signed integers. # The following configuration setting sets the limit in the size of the # set in order to use this special memory saving encoding. set-max-intset-entries 512 # Sets containing non-integer values are also encoded using a memory efficient # data structure when they have a small number of entries, and the biggest entry # does not exceed a given threshold. These thresholds can be configured using # the following directives. set-max-listpack-entries 128 set-max-listpack-value 64 # Similarly to hashes and lists, sorted sets are also specially encoded in # order to save a lot of space. This encoding is only used when the length and # elements of a sorted set are below the following limits: zset-max-listpack-entries 128 zset-max-listpack-value 64 # HyperLogLog sparse representation bytes limit. The limit includes the # 16 bytes header. When a HyperLogLog using the sparse representation crosses # this limit, it is converted into the dense representation. # # A value greater than 16000 is totally useless, since at that point the # dense representation is more memory efficient. # # The suggested value is ~ 3000 in order to have the benefits of # the space efficient encoding without slowing down too much PFADD, # which is O(N) with the sparse encoding. The value can be raised to # ~ 10000 when CPU is not a concern, but space is, and the data set is # composed of many HyperLogLogs with cardinality in the 0 - 15000 range. hll-sparse-max-bytes 3000 # Streams macro node max size / items. The stream data structure is a radix # tree of big nodes that encode multiple items inside. Using this configuration # it is possible to configure how big a single node can be in bytes, and the # maximum number of items it may contain before switching to a new node when # appending new stream entries. If any of the following settings are set to # zero, the limit is ignored, so for instance it is possible to set just a # max entries limit by setting max-bytes to 0 and max-entries to the desired # value. stream-node-max-bytes 4096 stream-node-max-entries 100 # Active rehashing uses 1% of the CPU time to help perform incremental rehashing # of the main server hash tables, the ones mapping top-level keys to values. # # If active rehashing is disabled and rehashing is needed, a hash table is # rehashed one "step" on every operation performed on the hash table (add, find, # etc.), so if the server is idle, the rehashing may never complete and some # more memory is used by the hash tables. Active rehashing helps prevent this. # # Active rehashing runs as a background task. Depending on the value of 'hz', # the frequency at which the server performs background tasks, active rehashing # can cause the server to freeze for a short time. For example, if 'hz' is set # to 10, active rehashing runs for up to one millisecond every 100 milliseconds. # If a freeze of one millisecond is not acceptable, you can increase 'hz' to let # active rehashing run more often. If instead 'hz' is set to 100, active # rehashing runs up to only 100 microseconds every 10 milliseconds. The total is # still 1% of the time. activerehashing yes # The client output buffer limits can be used to force disconnection of clients # that are not reading data from the server fast enough for some reason (a # common reason is that a Pub/Sub client can't consume messages as fast as the # publisher can produce them). # # The limit can be set differently for the three different classes of clients: # # normal -> normal clients including MONITOR clients # replica -> replica clients # pubsub -> clients subscribed to at least one pubsub channel or pattern # # The syntax of every client-output-buffer-limit directive is the following: # # client-output-buffer-limit # # A client is immediately disconnected once the hard limit is reached, or if # the soft limit is reached and remains reached for the specified number of # seconds (continuously). # So for instance if the hard limit is 32 megabytes and the soft limit is # 16 megabytes / 10 seconds, the client will get disconnected immediately # if the size of the output buffers reach 32 megabytes, but will also get # disconnected if the client reaches 16 megabytes and continuously overcomes # the limit for 10 seconds. # # By default normal clients are not limited because they don't receive data # without asking (in a push way), but just after a request, so only # asynchronous clients may create a scenario where data is requested faster # than it can read. # # Instead there is a default limit for pubsub and replica clients, since # subscribers and replicas receive data in a push fashion. # # Note that it doesn't make sense to set the replica clients output buffer # limit lower than the repl-backlog-size config (partial sync will succeed # and then replica will get disconnected). # Such a configuration is ignored (the size of repl-backlog-size will be used). # This doesn't have memory consumption implications since the replica client # will share the backlog buffers memory. # # Both the hard or the soft limit can be disabled by setting them to zero. client-output-buffer-limit normal 0 0 0 client-output-buffer-limit replica 256mb 64mb 60 client-output-buffer-limit pubsub 32mb 8mb 60 # Client query buffers accumulate new commands. They are limited to a fixed # amount by default in order to avoid that a protocol desynchronization (for # instance due to a bug in the client) will lead to unbound memory usage in # the query buffer. However you can configure it here if you have very special # needs, such as a command with huge argument, or huge multi/exec requests or alike. # # client-query-buffer-limit 1gb # In some scenarios client connections can hog up memory leading to OOM # errors or data eviction. To avoid this we can cap the accumulated memory # used by all client connections (all pubsub and normal clients). Once we # reach that limit connections will be dropped by the server freeing up # memory. The server will attempt to drop the connections using the most # memory first. We call this mechanism "client eviction". # # Client eviction is configured using the maxmemory-clients setting as follows: # 0 - client eviction is disabled (default) # # A memory value can be used for the client eviction threshold, # for example: # maxmemory-clients 1g # # A percentage value (between 1% and 100%) means the client eviction threshold # is based on a percentage of the maxmemory setting. For example to set client # eviction at 5% of maxmemory: # maxmemory-clients 5% # In the server protocol, bulk requests, that are, elements representing single # strings, are normally limited to 512 mb. However you can change this limit # here, but must be 1mb or greater # # proto-max-bulk-len 512mb # The server calls an internal function to perform many background tasks, like # closing connections of clients in timeout, purging expired keys that are # never requested, and so forth. # # Not all tasks are performed with the same frequency, but the server checks for # tasks to perform according to the specified "hz" value. # # By default "hz" is set to 10. Raising the value will use more CPU when # the server is idle, but at the same time will make the server more responsive when # there are many keys expiring at the same time, and timeouts may be # handled with more precision. # # The range is between 1 and 500, however a value over 100 is usually not # a good idea. Most users should use the default of 10 and raise this up to # 100 only in environments where very low latency is required. hz 10 # When a child rewrites the AOF file, if the following option is enabled # the file will be fsync-ed every 4 MB of data generated. This is useful # in order to commit the file to the disk more incrementally and avoid # big latency spikes. aof-rewrite-incremental-fsync yes # When the server saves RDB file, if the following option is enabled # the file will be fsync-ed every 4 MB of data generated. This is useful # in order to commit the file to the disk more incrementally and avoid # big latency spikes. rdb-save-incremental-fsync yes # The server's LFU eviction (see maxmemory setting) can be tuned. However it is a good # idea to start with the default settings and only change them after investigating # how to improve the performances and how the keys LFU change over time, which # is possible to inspect via the OBJECT FREQ command. # # There are two tunable parameters in the server LFU implementation: the # counter logarithm factor and the counter decay time. It is important to # understand what the two parameters mean before changing them. # # The LFU counter is just 8 bits per key, it's maximum value is 255, so the server # uses a probabilistic increment with logarithmic behavior. Given the value # of the old counter, when a key is accessed, the counter is incremented in # this way: # # 1. A random number R between 0 and 1 is extracted. # 2. A probability P is calculated as 1/(old_value*lfu_log_factor+1). # 3. The counter is incremented only if R < P. # # The default lfu-log-factor is 10. This is a table of how the frequency # counter changes with a different number of accesses with different # logarithmic factors: # # +--------+------------+------------+------------+------------+------------+ # | factor | 100 hits | 1000 hits | 100K hits | 1M hits | 10M hits | # +--------+------------+------------+------------+------------+------------+ # | 0 | 104 | 255 | 255 | 255 | 255 | # +--------+------------+------------+------------+------------+------------+ # | 1 | 18 | 49 | 255 | 255 | 255 | # +--------+------------+------------+------------+------------+------------+ # | 10 | 10 | 18 | 142 | 255 | 255 | # +--------+------------+------------+------------+------------+------------+ # | 100 | 8 | 11 | 49 | 143 | 255 | # +--------+------------+------------+------------+------------+------------+ # # NOTE: The above table was obtained by running the following commands: # # valkey-benchmark -n 1000000 incr foo # valkey-cli object freq foo # # NOTE 2: The counter initial value is 5 in order to give new objects a chance # to accumulate hits. # # The counter decay time is the time, in minutes, that must elapse in order # for the key counter to be decremented. # # The default value for the lfu-decay-time is 1. A special value of 0 means we # will never decay the counter. # # lfu-log-factor 10 # lfu-decay-time 1 # The maximum number of new client connections accepted per event-loop cycle. This configuration # is set independently for TLS connections. # # By default, up to 10 new connection will be accepted per event-loop cycle for normal connections # and up to 1 new connection per event-loop cycle for TLS connections. # # Adjusting this to a larger number can slightly improve efficiency for new connections # at the risk of causing timeouts for regular commands on established connections. It is # not advised to change this without ensuring that all clients have limited connection # pools and exponential backoff in the case of command/connection timeouts. # # If your application is establishing a large number of new connections per second you should # also consider tuning the value of tcp-backlog, which allows the kernel to buffer more # pending connections before dropping or rejecting connections. # # max-new-connections-per-cycle 10 # max-new-tls-connections-per-cycle 1 ########################### ACTIVE DEFRAGMENTATION ####################### # # What is active defragmentation? # ------------------------------- # # Active (online) defragmentation allows a server to compact the # spaces left between small allocations and deallocations of data in memory, # thus allowing to reclaim back memory. # # Fragmentation is a natural process that happens with every allocator (but # less so with Jemalloc, fortunately) and certain workloads. Normally a server # restart is needed in order to lower the fragmentation, or at least to flush # away all the data and create it again. However thanks to this feature, this # process can happen at runtime in a "hot" way, while the server is running. # # Basically when the fragmentation is over a certain level (see the # configuration options below) the server will start to create new copies of the # values in contiguous memory regions by exploiting certain specific Jemalloc # features (in order to understand if an allocation is causing fragmentation # and to allocate it in a better place), and at the same time, will release the # old copies of the data. This process, repeated incrementally for all the keys # will cause the fragmentation to drop back to normal values. # # Important things to understand: # # 1. This feature is disabled by default, and only works if you compiled the server # to use the copy of Jemalloc we ship with the source code of the server. # This is the default with Linux builds. # # 2. You never need to enable this feature if you don't have fragmentation # issues. # # 3. Once you experience fragmentation, you can enable this feature when # needed with the command "CONFIG SET activedefrag yes". # # The configuration parameters are able to fine tune the behavior of the # defragmentation process. If you are not sure about what they mean it is # a good idea to leave the defaults untouched. # Active defragmentation is disabled by default # activedefrag no # Minimum amount of fragmentation waste to start active defrag # active-defrag-ignore-bytes 100mb # Minimum percentage of fragmentation to start active defrag # active-defrag-threshold-lower 10 # Maximum percentage of fragmentation at which we use maximum effort # active-defrag-threshold-upper 100 # Minimal effort for defrag in CPU percentage, not cycle time as the name might # suggest, to be used when the lower threshold is reached. # active-defrag-cycle-min 1 # Maximal effort for defrag in CPU percentage, not cycle time as the name might # suggest, to be used when the upper threshold is reached. # active-defrag-cycle-max 25 # Maximum number of set/hash/zset/list fields that will be processed from # the main dictionary scan # active-defrag-max-scan-fields 1000 # The time spent (in microseconds) of the periodic active defrag process. This # affects the latency impact of active defrag on client commands. Smaller numbers # will result in less latency impact at the cost of increased defrag overhead. # active-defrag-cycle-us 500 # Jemalloc background thread for purging will be enabled by default jemalloc-bg-thread yes # It is possible to pin different threads and processes of the server to specific # CPUs in your system, in order to maximize the performances of the server. # This is useful both in order to pin different server threads in different # CPUs, but also in order to make sure that multiple server instances running # in the same host will be pinned to different CPUs. # # Normally you can do this using the "taskset" command, however it is also # possible to do this via the server configuration directly, both in Linux and FreeBSD. # # You can pin the server/IO threads, bio threads, aof rewrite child process, and # the bgsave child process. The syntax to specify the cpu list is the same as # the taskset command: # # Set server/io threads to cpu affinity 0,2,4,6: # server-cpulist 0-7:2 # # Set bio threads to cpu affinity 1,3: # bio-cpulist 1,3 # # Set aof rewrite child process to cpu affinity 8,9,10,11: # aof-rewrite-cpulist 8-11 # # Set bgsave child process to cpu affinity 1,10,11 # bgsave-cpulist 1,10-11 # In some cases the server will emit warnings and even refuse to start if it detects # that the system is in bad state, it is possible to suppress these warnings # by setting the following config which takes a space delimited list of warnings # to suppress # # ignore-warnings ARM64-COW-BUG # Inform Valkey of the availability zone if running in a cloud environment. Currently # this is exposed in the INFO and HELLO commands for clients to use. Default is # the empty string. # # availability-zone "zone-name" ================================================ FILE: aegir/conf/valkey/valkey9.conf ================================================ # Valkey configuration file example. # # Note that in order to read the configuration file, the server must be # started with the file path as first argument: # # ./valkey-server /path/to/valkey.conf # Note on units: when memory size is needed, it is possible to specify # it in the usual form of 1k 5GB 4M and so forth: # # 1k => 1000 bytes # 1kb => 1024 bytes # 1m => 1000000 bytes # 1mb => 1024*1024 bytes # 1g => 1000000000 bytes # 1gb => 1024*1024*1024 bytes # # units are case insensitive so 1GB 1Gb 1gB are all the same. ################################## INCLUDES ################################### # Include one or more other config files here. This is useful if you # have a standard template that goes to all servers but also need # to customize a few per-server settings. Include files can include # other files, so use this wisely. # # Note that option "include" won't be rewritten by command "CONFIG REWRITE" # from admin or Sentinel. Since the server always uses the last processed # line as value of a configuration directive, you'd better put includes # at the beginning of this file to avoid overwriting config change at runtime. # # If instead you are interested in using includes to override configuration # options, it is better to use include as the last line. # # Included paths may contain wildcards. All files matching the wildcards will # be included in alphabetical order. # Note that if an include path contains a wildcards but no files match it when # the server is started, the include statement will be ignored and no error will # be emitted. It is safe, therefore, to include wildcard files from empty # directories. # # include /path/to/local.conf # include /path/to/other.conf # include /path/to/fragments/*.conf # ################################## MODULES ##################################### # Load modules at startup. If the server is not able to load modules # it will abort. It is possible to use multiple loadmodule directives. # # loadmodule /path/to/my_module.so # loadmodule /path/to/other_module.so # loadmodule /path/to/args_module.so [arg [arg ...]] ################################## NETWORK ##################################### # By default, if no "bind" configuration directive is specified, the server listens # for connections from all available network interfaces on the host machine. # It is possible to listen to just one or multiple selected interfaces using # the "bind" configuration directive, followed by one or more IP addresses. # Each address can be prefixed by "-", which means that the server will not fail to # start if the address is not available. Being not available only refers to # addresses that does not correspond to any network interface. Addresses that # are already in use will always fail, and unsupported protocols will always be # silently skipped. # # Examples: # # xbind 192.168.1.100 10.0.0.1 # listens on two specific IPv4 addresses # xbind 127.0.0.1 ::1 # listens on loopback IPv4 and IPv6 # xbind * -::* # like the default, all available interfaces # # ~~~ WARNING ~~~ If the computer running the server is directly exposed to the # internet, binding to all the interfaces is dangerous and will expose the # instance to everybody on the internet. So by default we uncomment the # following bind directive, that will force the server to listen only on the # IPv4 and IPv6 (if available) loopback interface addresses (this means the server # will only be able to accept client connections from the same host that it is # running on). # # IF YOU ARE SURE YOU WANT YOUR INSTANCE TO LISTEN TO ALL THE INTERFACES # COMMENT OUT THE FOLLOWING LINE. # # You will also need to set a password unless you explicitly disable protected # mode. # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ bind 127.0.0.1 # By default, outgoing connections (from replica to primary, from Sentinel to # instances, cluster bus, etc.) are not bound to a specific local address. In # most cases, this means the operating system will handle that based on routing # and the interface through which the connection goes out. # # Using bind-source-addr it is possible to configure a specific address to bind # to, which may also affect how the connection gets routed. # # Example: # # bind-source-addr 10.0.0.1 # Protected mode is a layer of security protection, in order to avoid that # the server instances left open on the internet are accessed and exploited. # # When protected mode is on and the default user has no password, the server # only accepts local connections from the IPv4 address (127.0.0.1), IPv6 address # (::1) or Unix domain sockets. # # By default protected mode is enabled. You should disable it only if # you are sure you want clients from other hosts to connect to the server # even if no authentication is configured. protected-mode yes # The server uses default hardened security configuration directives to reduce the # attack surface on innocent users. Therefore, several sensitive configuration # directives are immutable, and some potentially-dangerous commands are blocked. # # Configuration directives that control files that the server writes to (e.g., 'dir' # and 'dbfilename') and that aren't usually modified during runtime # are protected by making them immutable. # # Commands that can increase the attack surface of the server and that aren't usually # called by users are blocked by default. # # These can be exposed to either all connections or just local ones by setting # each of the configs listed below to either of these values: # # no - Block for any connection (remain immutable) # yes - Allow for any connection (no protection) # local - Allow only for local connections. Ones originating from the # IPv4 address (127.0.0.1), IPv6 address (::1) or Unix domain sockets. # # enable-protected-configs no # enable-debug-command no # enable-module-command no # Accept connections on the specified port, default is 6379 (IANA #815344). # If port 0 is specified the server will not listen on a TCP socket. port 6379 # TCP listen() backlog. # # In high requests-per-second environments you need a high backlog in order # to avoid slow clients connection issues. Note that the Linux kernel # will silently truncate it to the value of /proc/sys/net/core/somaxconn so # make sure to raise both the value of somaxconn and tcp_max_syn_backlog # in order to get the desired effect. tcp-backlog 511 # Multipath TCP (MPTCP) # # MPTCP splits a single TCP connection into subflows over multiple interfaces or paths. # It enables bandwidth aggregation, failover, and improved reliability. # When set to 'yes', clients will be able to use MPTCP if requested. When not # requested, regular TCP can be used like before. # Note: MPTCP is supported in the mainline Linux kernel starting from version 5.6. # # mptcp yes # Unix socket. # # Specify the path for the Unix socket that will be used to listen for # incoming connections. There is no default, so the server will not listen # on a unix socket when not specified. # # unixsocket /run/valkey/valkey.sock # unixsocketgroup valkey # unixsocketperm 777 # Close the connection after a client is idle for N seconds (0 to disable) timeout 900 # TCP keepalive. # # If non-zero, use SO_KEEPALIVE to send TCP ACKs to clients in absence # of communication. This is useful for two reasons: # # 1) Detect dead peers. # 2) Force network equipment in the middle to consider the connection to be # alive. # # On Linux, the specified value (in seconds) is the period used to send ACKs. # Note that to close the connection the double of the time is needed. # On other kernels the period depends on the kernel configuration. tcp-keepalive 300 # Apply OS-specific mechanism to mark the listening socket with the specified # ID, to support advanced routing and filtering capabilities. # # On Linux, the ID represents a connection mark. # On FreeBSD, the ID represents a socket cookie ID. # On OpenBSD, the ID represents a route table ID. # # The default value is 0, which implies no marking is required. # socket-mark-id 0 ################################# TLS/SSL ##################################### # By default, TLS/SSL is disabled. To enable it, the "tls-port" configuration # directive can be used to define TLS-listening ports. To enable TLS on the # default port, use: # # port 0 # tls-port 6379 # Configure a X.509 certificate and private key to use for authenticating the # server to connected clients, primaries or cluster peers. These files should be # PEM formatted. # # tls-cert-file valkey.crt # tls-key-file valkey.key # # If the key file is encrypted using a passphrase, it can be included here # as well. # # tls-key-file-pass secret # Normally the server uses the same certificate for both server functions (accepting # connections) and client functions (replicating from a primary, establishing # cluster bus connections, etc.). # # Sometimes certificates are issued with attributes that designate them as # client-only or server-only certificates. In that case it may be desired to use # different certificates for incoming (server) and outgoing (client) # connections. To do that, use the following directives: # # tls-client-cert-file client.crt # tls-client-key-file client.key # # If the key file is encrypted using a passphrase, it can be included here # as well. # # tls-client-key-file-pass secret # Configure a DH parameters file to enable Diffie-Hellman (DH) key exchange, # required by older versions of OpenSSL (<3.0). Newer versions do not require # this configuration and recommend against it. # # tls-dh-params-file valkey.dh # Configure a CA certificate(s) bundle or directory to authenticate TLS/SSL # clients and peers. The server requires an explicit configuration of at least one # of these, and will not implicitly use the system wide configuration. # # tls-ca-cert-file ca.crt # tls-ca-cert-dir /etc/ssl/certs # By default, clients (including replica servers) on a TLS port are required # to authenticate using valid client side certificates. # # If "no" is specified, client certificates are not required and not accepted. # If "optional" is specified, client certificates are accepted and must be # valid if provided, but are not required. # # tls-auth-clients no # tls-auth-clients optional # Automatically authenticate TLS clients as Valkey users based on their # certificates. # # If set to a field like "CN", the server will extract the corresponding field # from the client's TLS certificate and attempt to find a Valkey user with the # same name. If a matching user is found, the client is automatically # authenticated as that user during the TLS handshake. If no matching user is # found, the client is connected as the unauthenticated default user. Set to # "off" to disable automatic user authentication via certificate fields. # # Supported values: CN, off. Default: off. # # tls-auth-clients-user CN # By default, a replica does not attempt to establish a TLS connection # with its primary. # # Use the following directive to enable TLS on replication links. # # tls-replication yes # By default, the cluster bus uses a plain TCP connection. To enable # TLS for the bus protocol, use the following directive: # # tls-cluster yes # By default, only TLSv1.2 and TLSv1.3 are enabled and it is highly recommended # that older formally deprecated versions are kept disabled to reduce the attack surface. # You can explicitly specify TLS versions to support. # Allowed values are case insensitive and include "TLSv1", "TLSv1.1", "TLSv1.2", # "TLSv1.3" (OpenSSL >= 1.1.1) or any combination. # To enable only TLSv1.2 and TLSv1.3, use: # # tls-protocols "TLSv1.2 TLSv1.3" # Configure allowed ciphers. See the ciphers(1ssl) manpage for more information # about the syntax of this string. # # Note: this configuration applies only to <= TLSv1.2. # # tls-ciphers DEFAULT:!MEDIUM # Configure allowed TLSv1.3 ciphersuites. See the ciphers(1ssl) manpage for more # information about the syntax of this string, and specifically for TLSv1.3 # ciphersuites. # # tls-ciphersuites TLS_CHACHA20_POLY1305_SHA256 # When choosing a cipher, use the server's preference instead of the client # preference. By default, the server follows the client's preference. # # tls-prefer-server-ciphers yes # By default, TLS session caching is enabled to allow faster and less expensive # reconnections by clients that support it. Use the following directive to disable # caching. # # tls-session-caching no # Change the default number of TLS sessions cached. A zero value sets the cache # to unlimited size. The default size is 20480. # # tls-session-cache-size 5000 # Change the default timeout of cached TLS sessions. The default timeout is 300 # seconds. # # tls-session-cache-timeout 60 ################################### RDMA ###################################### # Valkey Over RDMA is experimental, it may be changed or be removed in any minor or major version. # By default, RDMA is disabled. To enable it, the "rdma-port" configuration # directive can be used to define RDMA-listening ports. # # rdma-port 6379 # rdma-bind 192.168.1.100 # The RDMA receive transfer buffer is 1M by default. It can be set between 64K and 16M. # Note that page size aligned size is preferred. # # rdma-rx-size 1048576 # The RDMA completion queue will use the completion vector to signal completion events # via hardware interrupts. A large number of hardware interrupts can affect CPU performance. # It is possible to tune the performance using rdma-completion-vector. # # Example 1. a) Pin hardware interrupt vectors [0, 3] to CPU [0, 3]. # b) Set CPU affinity for valkey to CPU [4, X]. # c) Any valkey server uses a random RDMA completion vector [-1]. # All valkey servers will not affect each other and will be isolated from kernel interrupts. # # SYS SYS SYS SYS VALKEY VALKEY VALKEY # | | | | | | | # CPU0 CPU1 CPU2 CPU3 CPU4 CPU5 ... CPUX # | | | | # INTR0 INTR1 INTR2 INTR3 # # Example 2. a) 1:1 pin hardware interrupt vectors [0, X] to CPU [0, X]. # b) Set CPU affinity for valkey [M] to CPU [M]. # c) Valkey server [M] uses RDMA completion vector [M]. # A single CPU [M] handles hardware interrupts, the RDMA completion vector [M], # and the valkey server [M] within its context only. # This avoids overhead and function calls across multiple CPUs, fully isolating # each valkey server from one another. # # VALKEY VALKEY VALKEY VALKEY VALKEY VALKEY VALKEY # | | | | | | | # CPU0 CPU1 CPU2 CPU3 CPU4 CPU5 ... CPUX # | | | | | | | # INTR0 INTR1 INTR2 INTR3 INTR4 INTR5 INTRX # # Use 0 and positive numbers to specify the RDMA completion vector, or specify -1 to allow # the server to use a random vector for a new connection. The default vector is -1. # # rdma-completion-vector 0 ################################# GENERAL ##################################### # By default the server does not run as a daemon. Use 'yes' if you need it. # Note that the server will write a pid file in /run/valkey/valkey.pid when daemonized. # When the server is supervised by upstart or systemd, this parameter has no impact. daemonize yes # If you run the server from upstart or systemd, the server can interact with your # supervision tree. Options: # supervised no - no supervision interaction # supervised upstart - signal upstart by putting the server into SIGSTOP mode # requires "expect stop" in your upstart job config # supervised systemd - signal systemd by writing READY=1 to $NOTIFY_SOCKET # on startup, and updating the server status on a regular # basis. # supervised auto - detect upstart or systemd method based on # UPSTART_JOB or NOTIFY_SOCKET environment variables # Note: these supervision methods only signal "process is ready." # They do not enable continuous pings back to your supervisor. # # The default is "no". To run under upstart/systemd, you can simply uncomment # the line below: # # supervised auto # If a pid file is specified, the server writes it where specified at startup # and removes it at exit. # # When the server runs non daemonized, no pid file is created if none is # specified in the configuration. When the server is daemonized, the pid file # is used even if not specified, defaulting to "/run/valkey/valkey.pid". # # Creating a pid file is best effort: if the server is not able to create it # nothing bad happens, the server will start and run normally. # # Note that on modern Linux systems "/run/valkey/valkey.pid" is more conforming # and should be used instead. pidfile /run/valkey/valkey.pid # Specify the server verbosity level. # This can be one of: # debug (a lot of information, useful for development/testing) # verbose (many rarely useful info, but not a mess like the debug level) # notice (moderately verbose, what you want in production probably) # warning (only very important / critical messages are logged) # nothing (nothing is logged) loglevel warning # Specify the logging format. # This can be one of: # # - legacy: the default, traditional log format # - logfmt: a structured log format; see https://www.brandur.org/logfmt # # log-format legacy # Specify the timestamp format used in logs using 'log-timestamp-format'. # # - legacy: default format # - iso8601: ISO 8601 extended date and time with time zone, on the form # yyyy-mm-ddThh:mm:ss.sss±hh:mm # - milliseconds: milliseconds since the epoch # # log-timestamp-format legacy # Specify the log file name. Also the empty string can be used to force # the server to log on the standard output. Note that if you use standard # output for logging but daemonize, logs will be sent to /dev/null logfile /var/log/valkey/valkey-server.log # To enable logging to the system logger, just set 'syslog-enabled' to yes, # and optionally update the other syslog parameters to suit your needs. # syslog-enabled no # Specify the syslog identity. # syslog-ident valkey # Specify the syslog facility. Must be USER or between LOCAL0-LOCAL7. # syslog-facility local0 # To disable the built in crash log, which will possibly produce cleaner core # dumps when they are needed, uncomment the following: # # crash-log-enabled no # To disable the fast memory check that's run as part of the crash log, which # will possibly let the server terminate sooner, uncomment the following: # # crash-memcheck-enabled no # Set the number of databases. The default database is DB 0, you can select # a different one on a per-connection basis using SELECT where # dbid is a number between 0 and 'databases'-1 # Note: This setting is ignored in cluster mode. Use `cluster-databases` instead. databases 8 # By default the server shows an ASCII art logo only when started to log to the # standard output and if the standard output is a TTY and syslog logging is # disabled. Basically this means that normally a logo is displayed only in # interactive sessions. # # However it is possible to force the pre-4.0 behavior and always show a # ASCII art logo in startup logs by setting the following option to yes. always-show-logo no # User data, including keys, values, client names, and ACL usernames, can be # logged as part of assertions and other error cases. To prevent sensitive user # information, such as PII, from being recorded in the server log file, this # user data is hidden from the log by default. If you need to log user data for # debugging or troubleshooting purposes, you can disable this feature by # changing the config value to no. hide-user-data-from-log yes # By default, the server modifies the process title (as seen in 'top' and 'ps') to # provide some runtime information. It is possible to disable this and leave # the process name as executed by setting the following to no. set-proc-title yes # When changing the process title, the server uses the following template to construct # the modified title. # # Template variables are specified in curly brackets. The following variables are # supported: # # {title} Name of process as executed if parent, or type of child process. # {listen-addr} Bind address or '*' followed by TCP or TLS port listening on, or # Unix socket if only that's available. # {server-mode} Special mode, i.e. "[sentinel]" or "[cluster]". # {port} TCP port listening on, or 0. # {tls-port} TLS port listening on, or 0. # {unixsocket} Unix domain socket listening on, or "". # {config-file} Name of configuration file used. # proc-title-template "{title} {listen-addr} {server-mode}" # Set the local environment which is used for string comparison operations, and # also affect the performance of Lua scripts. Empty String indicates the locale # is derived from the environment variables. locale-collate "" # Valkey is largely compatible with Redis OSS, apart from a few cases where # Valkey identifies itself as "Valkey" rather than "Redis". Extended # Redis OSS compatibility mode makes Valkey pretend to be Redis. Enable this # only if you have problems with tools or clients. This is a temporary # configuration added in Valkey 8.0 and is scheduled to have no effect and # will be removed in a future version. # extended-redis-compatibility yes ################################ SNAPSHOTTING ################################ # Save the DB to disk. # # save [ ...] # # The server will save the DB if the given number of seconds elapsed and it # surpassed the given number of write operations against the DB. # # Snapshotting can be completely disabled with a single empty string argument # as in following example: # save "" # # Unless specified otherwise, by default the server will save the DB: # * After 3600 seconds (an hour) if at least 1 change was performed # * After 300 seconds (5 minutes) if at least 100 changes were performed # * After 60 seconds if at least 10000 changes were performed # # You can set these explicitly by uncommenting the following line. # # save 3600 1 300 100 60 10000 # By default the server will stop accepting writes if RDB snapshots are enabled # (at least one save point) and the latest background save failed. # This will make the user aware (in a hard way) that data is not persisting # on disk properly, otherwise chances are that no one will notice and some # disaster will happen. # # If the background saving process will start working again, the server will # automatically allow writes again. # # However if you have setup your proper monitoring of the server # and persistence, you may want to disable this feature so that the server will # continue to work as usual even if there are problems with disk, # permissions, and so forth. stop-writes-on-bgsave-error no # Compress string objects using LZF when dump .rdb databases? # By default compression is enabled as it's almost always a win. # If you want to save some CPU in the saving child set it to 'no' but # the dataset will likely be bigger if you have compressible values or keys. rdbcompression yes # Since version 5 of RDB a CRC64 checksum is placed at the end of the file. # This makes the format more resistant to corruption but there is a performance # hit to pay (around 10%) when saving and loading RDB files, so you can disable it # for maximum performances. # # RDB files created with checksum disabled have a checksum of zero that will # tell the loading code to skip the check. rdbchecksum no # Valkey can try to load an RDB dump produced by a future version of Valkey. # This can only work on a best-effort basis, because future RDB versions may # contain information that's not known to the current version. If no new features # are used, it may be possible to import the data produced by a later version, # but loading is aborted if unknown information is encountered. Possible values # are 'strict' and 'relaxed'. This also applies to replication and the RESTORE # command. rdb-version-check relaxed # Enables or disables full sanitization checks for ziplist and listpack etc when # loading an RDB or RESTORE payload. This reduces the chances of a assertion or # crash later on while processing commands. # Options: # no - Never perform full sanitization # yes - Always perform full sanitization # clients - Perform full sanitization only for user connections. # Excludes: RDB files, RESTORE commands received from the primary # connection, and client connections which have the # skip-sanitize-payload ACL flag. # The default should be 'clients' but since it currently affects cluster # resharding via MIGRATE, it is temporarily set to 'no' by default. # # sanitize-dump-payload no # The filename where to dump the DB dbfilename dump.rdb # Remove RDB files used by replication in instances without persistence # enabled. By default this option is disabled, however there are environments # where for regulations or other security concerns, RDB files persisted on # disk by primaries in order to feed replicas, or stored on disk by replicas # in order to load them for the initial synchronization, should be deleted # ASAP. Note that this option ONLY WORKS in instances that have both AOF # and RDB persistence disabled, otherwise is completely ignored. # # An alternative (and sometimes better) way to obtain the same effect is # to use diskless replication on both primary and replicas instances. However # in the case of replicas, diskless is not always an option. rdb-del-sync-files no # The working directory. # # The server log is written relative this directory, if the 'logfile' # configuration directive is a relative path. # # The DB will be written inside this directory, with the filename specified # above using the 'dbfilename' configuration directive. # # The Append Only File will also be created inside this directory. # # The Cluster config file is written relative this directory, if the # 'cluster-config-file' configuration directive is a relative path. # # Note that you must specify a directory here, not a file name. # Note that modifying 'dir' during runtime may have unexpected behavior, # for example when a child process is running, related file operations may # have unexpected effects. dir /var/lib/valkey/ ################################# REPLICATION ################################# # Master-Replica replication. Use replicaof to make a server a copy of # another server. A few things to understand ASAP about replication. # # +------------------+ +---------------+ # | Master | ---> | Replica | # | (receive writes) | | (exact copy) | # +------------------+ +---------------+ # # 1) Replication is asynchronous, but you can configure a primary to # stop accepting writes if it appears to be not connected with at least # a given number of replicas. # 2) Replicas are able to perform a partial resynchronization with the # primary if the replication link is lost for a relatively small amount of # time. You may want to configure the replication backlog size (see the next # sections of this file) with a sensible value depending on your needs. # 3) Replication is automatic and does not need user intervention. After a # network partition replicas automatically try to reconnect to primaries # and resynchronize with them. # # replicaof # If the primary is password protected (using the "requirepass" configuration # directive below) it is possible to tell the replica to authenticate before # starting the replication synchronization process, otherwise the primary will # refuse the replica request. # # primaryauth # # However this is not enough if you are using ACLs # and the default user is not capable of running the PSYNC # command and/or other commands needed for replication. In this case it's # better to configure a special user to use with replication, and specify the # primaryuser configuration as such: # # primaryuser # # When primaryuser is specified, the replica will authenticate against its # primary using the new AUTH form: AUTH . # When a replica loses its connection with the primary, or when the replication # is still in progress, the replica can act in two different ways: # # 1) if replica-serve-stale-data is set to 'yes' (the default) the replica will # still reply to client requests, possibly with out of date data, or the # data set may just be empty if this is the first synchronization. # # 2) If replica-serve-stale-data is set to 'no' the replica will reply with error # "MASTERDOWN Link with MASTER is down and replica-serve-stale-data is set to 'no'" # to all data access commands, excluding commands such as: # INFO, REPLICAOF, AUTH, SHUTDOWN, REPLCONF, ROLE, CONFIG, SUBSCRIBE, # UNSUBSCRIBE, PSUBSCRIBE, PUNSUBSCRIBE, PUBLISH, PUBSUB, COMMAND, POST, # HOST and LATENCY. # replica-serve-stale-data yes # You can configure a replica instance to accept writes or not. Writing against # a replica instance may be useful to store some ephemeral data (because data # written on a replica will be easily deleted after resync with the primary) but # may also cause problems if clients are writing to it because of a # misconfiguration. # # By default, replicas are read-only. # # Note: read only replicas are not designed to be exposed to untrusted clients # on the internet. It's just a protection layer against misuse of the instance. # Still a read only replica exports by default all the administrative commands # such as CONFIG, DEBUG, and so forth. To a limited extent you can improve # security of read only replicas using 'rename-command' to shadow all the # administrative / dangerous commands. replica-read-only yes # Replication SYNC strategy: disk or socket. # # New replicas and reconnecting replicas that are not able to continue the # replication process just receiving differences, need to do what is called a # "full synchronization". An RDB file is transmitted from the primary to the # replicas. # # The transmission can happen in two different ways: # # 1) Disk-backed: The primary creates a new process that writes the RDB # file on disk. Later the file is transferred by the parent # process to the replicas incrementally. # 2) Diskless: The primary creates a new process that directly writes the # RDB file to replica sockets, without touching the disk at all. # # With disk-backed replication, while the RDB file is generated, more replicas # can be queued and served with the RDB file as soon as the current child # producing the RDB file finishes its work. With diskless replication instead # once the transfer starts, new replicas arriving will be queued and a new # transfer will start when the current one terminates. # # When diskless replication is used, the primary waits a configurable amount of # time (in seconds) before starting the transfer in the hope that multiple # replicas will arrive and the transfer can be parallelized. # # With slow disks and fast (large bandwidth) networks, diskless replication # works better. repl-diskless-sync yes # When diskless replication is enabled, it is possible to configure the delay # the server waits in order to spawn the child that transfers the RDB via socket # to the replicas. # # This is important since once the transfer starts, it is not possible to serve # new replicas arriving, that will be queued for the next RDB transfer, so the # server waits a delay in order to let more replicas arrive. # # The delay is specified in seconds, and by default is 5 seconds. To disable # it entirely just set it to 0 seconds and the transfer will start ASAP. repl-diskless-sync-delay 5 # When diskless replication is enabled with a delay, it is possible to let # the replication start before the maximum delay is reached if the maximum # number of replicas expected have connected. Default of 0 means that the # maximum is not defined and the server will wait the full delay. repl-diskless-sync-max-replicas 0 # ----------------------------------------------------------------------------- # WARNING: Since in this setup the replica does not immediately store an RDB on # disk, it may cause data loss during failovers. RDB diskless load + server # modules not handling I/O reads may cause the server to abort in case of I/O errors # during the initial synchronization stage with the primary. # ----------------------------------------------------------------------------- # # Replica can load the RDB it reads from the replication link directly from the # socket, or store the RDB to a file and read that file after it was completely # received from the primary. # # In many cases the disk is slower than the network, and storing and loading # the RDB file may increase replication time (and even increase the primary's # Copy on Write memory and replica buffers). # However, when parsing the RDB file directly from the socket, in order to avoid # data loss it's only safe to flush the current dataset when the new dataset is # fully loaded in memory, resulting in higher memory usage. # For this reason we have the following options: # # "disabled" - Don't use diskless load (store the rdb file to the disk first) # "swapdb" - Keep current db contents in RAM while parsing the data directly # from the socket. Replicas in this mode can keep serving current # dataset while replication is in progress, except for cases where # they can't recognize primary as having a data set from same # replication history. # Note that this requires sufficient memory, if you don't have it, # you risk an OOM kill. # "on-empty-db" - Use diskless load only when current dataset is empty. This is # safer and avoid having old and new dataset loaded side by side # during replication. # "flush-before-load" - [dangerous] Flush all data before parsing. Note that if # there's a problem before the replication succeeded you may # lose all your data. repl-diskless-load disabled # This dual channel replication sync feature optimizes the full synchronization process # between a primary and its replicas. When enabled, it reduces both memory and CPU load # on the primary server. # # How it works: # 1. During full sync, instead of accumulating replication data on the primary server, # the data is sent directly to the syncing replica. # 2. The primary's background save (bgsave) process streams the RDB snapshot directly # to the replica over a separate connection. # # Tradeoff: # While this approach reduces load on the primary, it shifts the burden of storing # the replication buffer to the replica. This means the replica must have sufficient # memory to accommodate the buffer during synchronization. However, this tradeoff is # generally beneficial as it prevents potential performance degradation on the primary # server, which is typically handling more critical operations. # # When toggling this configuration on or off during an ongoing synchronization process, # it does not change the already running sync method. The new configuration will take # effect only for subsequent synchronization processes. dual-channel-replication-enabled no # Master send PINGs to its replicas in a predefined interval. It's possible to # change this interval with the repl_ping_replica_period option. The default # value is 10 seconds. # # repl-ping-replica-period 10 # The following option sets the replication timeout for: # # 1) Bulk transfer I/O during SYNC, from the point of view of replica. # 2) Master timeout from the point of view of replicas (data, pings). # 3) Replica timeout from the point of view of primaries (REPLCONF ACK pings). # # It is important to make sure that this value is greater than the value # specified for repl-ping-replica-period otherwise a timeout will be detected # every time there is low traffic between the primary and the replica. The default # value is 60 seconds. # # repl-timeout 60 # Disable TCP_NODELAY on the replica socket after SYNC? # # If you select "yes", the server will use a smaller number of TCP packets and # less bandwidth to send data to replicas. But this can add a delay for # the data to appear on the replica side, up to 40 milliseconds with # Linux kernels using a default configuration. # # If you select "no" the delay for data to appear on the replica side will # be reduced but more bandwidth will be used for replication. # # By default we optimize for low latency, but in very high traffic conditions # or when the primary and replicas are many hops away, turning this to "yes" may # be a good idea. repl-disable-tcp-nodelay no # Enables MPTCP for the replica's connection to the primary. # # An MPTCP connection is established between the primary and the replica if # the replica has set 'repl-mptcp yes' and the primary has set 'mptcp yes'. # Otherwise, it will automatically and implicitly fall back to a regular TCP # connection. # # repl-mptcp no # Set the replication backlog size. The backlog is a buffer that accumulates # replica data when replicas are disconnected for some time, so that when a # replica wants to reconnect again, often a full resync is not needed, but a # partial resync is enough, just passing the portion of data the replica # missed while disconnected. # # The bigger the replication backlog, the longer the replica can endure the # disconnect and later be able to perform a partial resynchronization. # # The backlog is only allocated if there is at least one replica connected. # # repl-backlog-size 10mb # After a primary has no connected replicas for some time, the backlog will be # freed. The following option configures the amount of seconds that need to # elapse, starting from the time the last replica disconnected, for the backlog # buffer to be freed. # # Note that replicas never free the backlog for timeout, since they may be # promoted to primaries later, and should be able to correctly "partially # resynchronize" with other replicas: hence they should always accumulate backlog. # # A value of 0 means to never release the backlog. # # repl-backlog-ttl 3600 # The replica priority is an integer number published by the server in the INFO # output. It is used by Sentinel in order to select a replica to promote # into a primary if the primary is no longer working correctly. # # A replica with a low priority number is considered better for promotion, so # for instance if there are three replicas with priority 10, 100, 25 Sentinel # will pick the one with priority 10, that is the lowest. # # However a special priority of 0 marks the replica as not able to perform the # role of primary, so a replica with priority of 0 will never be selected by # Sentinel for promotion. # # By default the priority is 100. replica-priority 100 # The propagation error behavior controls how the server will behave when it is # unable to handle a command being processed in the replication stream from a primary # or processed while reading from an AOF file. Errors that occur during propagation # are unexpected, and can cause data inconsistency. # # If an application wants to ensure there is no data divergence, this configuration # should be set to 'panic' instead. The value can also be set to 'panic-on-replicas' # to only panic when a replica encounters an error on the replication stream. One of # these two panic values will become the default value in the future once there are # sufficient safety mechanisms in place to prevent false positive crashes. # # propagation-error-behavior ignore # Replica ignore disk write errors controls the behavior of a replica when it is # unable to persist a write command received from its primary to disk. By default, # this configuration is set to 'no' and will crash the replica in this condition. # It is not recommended to change this default. # # replica-ignore-disk-write-errors no # Make the primary forbid expiration and eviction. # This is useful for sync tools, because expiration and eviction may cause the data corruption. # Sync tools can mark their connections as importing source by CLIENT IMPORT-SOURCE. # NOTICE: Clients should avoid writing the same key on the source server and the destination server. # # import-mode no # ----------------------------------------------------------------------------- # By default, Sentinel includes all replicas in its reports. A replica # can be excluded from Sentinel's announcements. An unannounced replica # will be ignored by the 'sentinel replicas ' command and won't be # exposed to Sentinel's clients. # # This option does not change the behavior of replica-priority. Even with # replica-announced set to 'no', the replica can be promoted to primary. To # prevent this behavior, set replica-priority to 0. # # replica-announced yes # It is possible for a primary to stop accepting writes if there are less than # N replicas connected, having a lag less or equal than M seconds. # # The N replicas need to be in "online" state. # # The lag in seconds, that must be <= the specified value, is calculated from # the last ping received from the replica, that is usually sent every second. # # This option does not GUARANTEE that N replicas will accept the write, but # will limit the window of exposure for lost writes in case not enough replicas # are available, to the specified number of seconds. # # For example to require at least 3 replicas with a lag <= 10 seconds use: # # min-replicas-to-write 3 # min-replicas-max-lag 10 # # Setting one or the other to 0 disables the feature. # # By default min-replicas-to-write is set to 0 (feature disabled) and # min-replicas-max-lag is set to 10. # A primary is able to list the address and port of the attached # replicas in different ways. For example the "INFO replication" section # offers this information, which is used, among other tools, by # Sentinel in order to discover replica instances. # Another place where this info is available is in the output of the # "ROLE" command of a primary. # # The listed IP address and port normally reported by a replica is # obtained in the following way: # # IP: The address is auto detected by checking the peer address # of the socket used by the replica to connect with the primary. # # Port: The port is communicated by the replica during the replication # handshake, and is normally the port that the replica is using to # listen for connections. # # However when port forwarding or Network Address Translation (NAT) is # used, the replica may actually be reachable via different IP and port # pairs. The following two options can be used by a replica in order to # report to its primary a specific set of IP and port, so that both INFO # and ROLE will report those values. # # There is no need to use both the options if you need to override just # the port or the IP address. # # replica-announce-ip 5.5.5.5 # replica-announce-port 1234 ############################### KEYS TRACKING ################################# # The client side caching of values is assisted via server-side support. # This is implemented using an invalidation table that remembers, using # a radix key indexed by key name, what clients have which keys. In turn # this is used in order to send invalidation messages to clients. Please # check this page to understand more about the feature: # # https://valkey.io/topics/client-side-caching # # When tracking is enabled for a client, all the read only queries are assumed # to be cached: this will force the server to store information in the invalidation # table. When keys are modified, such information is flushed away, and # invalidation messages are sent to the clients. However if the workload is # heavily dominated by reads, the server could use more and more memory in order # to track the keys fetched by many clients. # # For this reason it is possible to configure a maximum fill value for the # invalidation table. By default it is set to 1M of keys, and once this limit # is reached, the server will start to evict keys in the invalidation table # even if they were not modified, just to reclaim memory: this will in turn # force the clients to invalidate the cached values. Basically the table # maximum size is a trade off between the memory you want to spend server # side to track information about who cached what, and the ability of clients # to retain cached objects in memory. # # If you set the value to 0, it means there are no limits, and the server will # retain as many keys as needed in the invalidation table. # In the "stats" INFO section, you can find information about the number of # keys in the invalidation table at every given moment. # # Note: when key tracking is used in broadcasting mode, no memory is used # in the server side so this setting is useless. # # tracking-table-max-keys 1000000 ################################## SECURITY ################################### # Warning: since the server is pretty fast, an outside user can try up to # 1 million passwords per second against a modern box. This means that you # should use very strong passwords, otherwise they will be very easy to break. # Note that because the password is really a shared secret between the client # and the server, and should not be memorized by any human, the password # can be easily a long string from /dev/urandom or whatever, so by using a # long and unguessable password no brute force attack will be possible. # ACL users are defined in the following format: # # user ... acl rules ... # # For example: # # user worker +@list +@connection ~jobs:* on >ffa9203c493aa99 # # The special username "default" is used for new connections. If this user # has the "nopass" rule, then new connections will be immediately authenticated # as the "default" user without the need of any password provided via the # AUTH command. Otherwise if the "default" user is not flagged with "nopass" # the connections will start in not authenticated state, and will require # AUTH (or the HELLO command AUTH option) in order to be authenticated and # start to work. # # The ACL rules that describe what a user can do are the following: # # on Enable the user: it is possible to authenticate as this user. # off Disable the user: it's no longer possible to authenticate # with this user, however the already authenticated connections # will still work. # skip-sanitize-payload RESTORE dump-payload sanitization is skipped. # sanitize-payload RESTORE dump-payload is sanitized (default). # + Allow the execution of that command. # May be used with `|` for allowing subcommands (e.g "+config|get") # - Disallow the execution of that command. # May be used with `|` for blocking subcommands (e.g "-config|set") # +@ Allow the execution of all the commands in such category # with valid categories are like @admin, @set, @sortedset, ... # and so forth, see the full list in the server.c file where # the server command table is described and defined. # The special category @all means all the commands, but currently # present in the server, and that will be loaded in the future # via modules. # +|first-arg Allow a specific first argument of an otherwise # disabled command. It is only supported on commands with # no sub-commands, and is not allowed as negative form # like -SELECT|1, only additive starting with "+". This # feature is deprecated and may be removed in the future. # allcommands Alias for +@all. Note that it implies the ability to execute # all the future commands loaded via the modules system. # nocommands Alias for -@all. # ~ Add a pattern of keys that can be mentioned as part of # commands. For instance ~* allows all the keys. The pattern # is a glob-style pattern like the one of KEYS. # It is possible to specify multiple patterns. # %R~ Add key read pattern that specifies which keys can be read # from. # %W~ Add key write pattern that specifies which keys can be # written to. # allkeys Alias for ~* # resetkeys Flush the list of allowed keys patterns. # & Add a glob-style pattern of Pub/Sub channels that can be # accessed by the user. It is possible to specify multiple channel # patterns. # allchannels Alias for &* # resetchannels Flush the list of allowed channel patterns. # > Add this password to the list of valid password for the user. # For example >mypass will add "mypass" to the list. # This directive clears the "nopass" flag (see later). # < Remove this password from the list of valid passwords. # nopass All the set passwords of the user are removed, and the user # is flagged as requiring no password: it means that every # password will work against this user. If this directive is # used for the default user, every new connection will be # immediately authenticated with the default user without # any explicit AUTH command required. Note that the "resetpass" # directive will clear this condition. # resetpass Flush the list of allowed passwords. Moreover removes the # "nopass" status. After "resetpass" the user has no associated # passwords and there is no way to authenticate without adding # some password (or setting it as "nopass" later). # reset Performs the following actions: resetpass, resetkeys, resetchannels, # allchannels (if acl-pubsub-default is set), off, clearselectors, -@all. # The user returns to the same state it has immediately after its creation. # () Create a new selector with the options specified within the # parentheses and attach it to the user. Each option should be # space separated. The first character must be ( and the last # character must be ). # clearselectors Remove all of the currently attached selectors. # Note this does not change the "root" user permissions, # which are the permissions directly applied onto the # user (outside the parentheses). # # ACL rules can be specified in any order: for instance you can start with # passwords, then flags, or key patterns. However note that the additive # and subtractive rules will CHANGE MEANING depending on the ordering. # For instance see the following example: # # user alice on +@all -DEBUG ~* >somepassword # # This will allow "alice" to use all the commands with the exception of the # DEBUG command, since +@all added all the commands to the set of the commands # alice can use, and later DEBUG was removed. However if we invert the order # of two ACL rules the result will be different: # # user alice on -DEBUG +@all ~* >somepassword # # Now DEBUG was removed when alice had yet no commands in the set of allowed # commands, later all the commands are added, so the user will be able to # execute everything. # # Basically ACL rules are processed left-to-right. # # The following is a list of command categories and their meanings: # * keyspace - Writing or reading from keys, databases, or their metadata # in a type agnostic way. Includes DEL, RESTORE, DUMP, RENAME, EXISTS, DBSIZE, # KEYS, EXPIRE, TTL, FLUSHALL, etc. Commands that may modify the keyspace, # key or metadata will also have `write` category. Commands that only read # the keyspace, key or metadata will have the `read` category. # * read - Reading from keys (values or metadata). Note that commands that don't # interact with keys, will not have either `read` or `write`. # * write - Writing to keys (values or metadata) # * admin - Administrative commands. Normal applications will never need to use # these. Includes REPLICAOF, CONFIG, DEBUG, SAVE, MONITOR, ACL, SHUTDOWN, etc. # * dangerous - Potentially dangerous (each should be considered with care for # various reasons). This includes FLUSHALL, MIGRATE, RESTORE, SORT, KEYS, # CLIENT, DEBUG, INFO, CONFIG, SAVE, REPLICAOF, etc. # * connection - Commands affecting the connection or other connections. # This includes AUTH, SELECT, COMMAND, CLIENT, ECHO, PING, etc. # * blocking - Potentially blocking the connection until released by another # command. # * fast - Fast O(1) commands. May loop on the number of arguments, but not the # number of elements in the key. # * slow - All commands that are not Fast. # * pubsub - PUBLISH / SUBSCRIBE related # * transaction - WATCH / MULTI / EXEC related commands. # * scripting - Scripting related. # * set - Data type: sets related. # * sortedset - Data type: zsets related. # * list - Data type: lists related. # * hash - Data type: hashes related. # * string - Data type: strings related. # * bitmap - Data type: bitmaps related. # * hyperloglog - Data type: hyperloglog related. # * geo - Data type: geo related. # * stream - Data type: streams related. # # For more information about ACL configuration please refer to # the Valkey web site at https://valkey.io/topics/acl # ACL LOG # # The ACL Log tracks failed commands and authentication events associated # with ACLs. The ACL Log is useful to troubleshoot failed commands blocked # by ACLs. The ACL Log is stored in memory. You can reclaim memory with # ACL LOG RESET. Define the maximum entry length of the ACL Log below. acllog-max-len 128 # Using an external ACL file # # Instead of configuring users here in this file, it is possible to use # a stand-alone file just listing users. The two methods cannot be mixed: # if you configure users here and at the same time you activate the external # ACL file, the server will refuse to start. # # The format of the external ACL user file is exactly the same as the # format that is used inside valkey.conf to describe users. # # aclfile /etc/valkey/users.acl # IMPORTANT NOTE: "requirepass" is just a compatibility # layer on top of the new ACL system. The option effect will be just setting # the password for the default user. Clients will still authenticate using # AUTH as usually, or more explicitly with AUTH default # if they follow the new protocol: both will work. # # The requirepass is not compatible with aclfile option and the ACL LOAD # command, these will cause requirepass to be ignored. # user default on >isfoobared allcommands allkeys # The default Pub/Sub channels permission for new users is controlled by the # acl-pubsub-default configuration directive, which accepts one of these values: # # allchannels: grants access to all Pub/Sub channels # resetchannels: revokes access to all Pub/Sub channels # # acl-pubsub-default defaults to 'resetchannels' permission. # # acl-pubsub-default resetchannels # Command renaming (DEPRECATED). # # ------------------------------------------------------------------------ # WARNING: avoid using this option if possible. Instead use ACLs to remove # commands from the default user, and put them only in some admin user you # create for administrative purposes. # ------------------------------------------------------------------------ # # It is possible to change the name of dangerous commands in a shared # environment. For instance the CONFIG command may be renamed into something # hard to guess so that it will still be available for internal-use tools # but not available for general clients. # # Example: # # rename-command CONFIG b840fc02d524045429941cc15f59e41cb7be6c52 # # It is also possible to completely kill a command by renaming it into # an empty string: # # rename-command CONFIG "" # # Please note that changing the name of commands that are logged into the # AOF file or transmitted to replicas may cause problems. ################################### CLIENTS #################################### # Set the max number of connected clients at the same time. By default # this limit is set to 10000 clients, however if the server is not # able to configure the process file limit to allow for the specified limit # the max number of allowed clients is set to the current file limit # minus 32 (as the server reserves a few file descriptors for internal uses). # # Once the limit is reached the server will close all the new connections sending # an error 'max number of clients reached'. # # IMPORTANT: With a cluster-enabled setup, the max number of connections is also # shared with the cluster bus: every node in the cluster will use two # connections, one incoming and another outgoing. It is important to size the # limit accordingly in case of very large clusters. # maxclients 4000 ############################## MEMORY MANAGEMENT ################################ # Set a memory usage limit to the specified amount of bytes. # When the memory limit is reached the server will try to remove keys # according to the eviction policy selected (see maxmemory-policy). # # If the server can't remove keys according to the policy, or if the policy is # set to 'noeviction', the server will start to reply with errors to commands # that would use more memory, like SET, LPUSH, and so on, and will continue # to reply to read-only commands like GET. # # This option is usually useful when using the server as an LRU or LFU cache, or to # set a hard memory limit for an instance (using the 'noeviction' policy). # # WARNING: If you have replicas attached to an instance with maxmemory on, # the size of the output buffers needed to feed the replicas are subtracted # from the used memory count, so that network problems / resyncs will # not trigger a loop where keys are evicted, and in turn the output # buffer of replicas is full with DELs of keys evicted triggering the deletion # of more keys, and so forth until the database is completely emptied. # # In short... if you have replicas attached it is suggested that you set a lower # limit for maxmemory so that there is some free RAM on the system for replica # output buffers (but this is not needed if the policy is 'noeviction'). # maxmemory 88MB # MAXMEMORY POLICY: how the server will select what to remove when maxmemory # is reached. You can select one from the following behaviors: # # volatile-lru -> Evict using approximated LRU, only keys with an expire set. # allkeys-lru -> Evict any key using approximated LRU. # volatile-lfu -> Evict using approximated LFU, only keys with an expire set. # allkeys-lfu -> Evict any key using approximated LFU. # volatile-random -> Remove a random key having an expire set. # allkeys-random -> Remove a random key, any key. # volatile-ttl -> Remove the key with the nearest expire time (minor TTL) # noeviction -> Don't evict anything, just return an error on write operations. # # LRU means Least Recently Used # LFU means Least Frequently Used # # Both LRU, LFU and volatile-ttl are implemented using approximated # randomized algorithms. # # Note: with any of the above policies, when there are no suitable keys for # eviction, the server will return an error on write operations that require # more memory. These are usually commands that create new keys, add data or # modify existing keys. A few examples are: SET, INCR, HSET, LPUSH, SUNIONSTORE, # SORT (due to the STORE argument), and EXEC (if the transaction includes any # command that requires memory). # # The default is: noeviction # maxmemory-policy allkeys-lru # LRU, LFU and minimal TTL algorithms are not precise algorithms but approximated # algorithms (in order to save memory), so you can tune it for speed or # accuracy. By default the server will check five keys and pick the one that was # used least recently, you can change the sample size using the following # configuration directive. # # The default of 5 produces good enough results. 10 Approximates very closely # true LRU but costs more CPU. 3 is faster but not very accurate. The maximum # value that can be set is 64. # # maxmemory-samples 5 # Eviction processing is designed to function well with the default setting. # If there is an unusually large amount of write traffic, this value may need to # be increased. Decreasing this value may reduce latency at the risk of # eviction processing effectiveness # 0 = minimum latency, 10 = default, 100 = process without regard to latency # # maxmemory-eviction-tenacity 10 # By default a replica will ignore its maxmemory setting # (unless it is promoted to primary after a failover or manually). It means # that the eviction of keys will be just handled by the primary, sending the # DEL commands to the replica as keys evict in the primary side. # # This behavior ensures that primaries and replicas stay consistent, and is usually # what you want, however if your replica is writable, or you want the replica # to have a different memory setting, and you are sure all the writes performed # to the replica are idempotent, then you may change this default (but be sure # to understand what you are doing). # # Note that since the replica by default does not evict, it may end using more # memory than the one set via maxmemory (there are certain buffers that may # be larger on the replica, or data structures may sometimes take more memory # and so forth). So make sure you monitor your replicas and make sure they # have enough memory to never hit a real out-of-memory condition before the # primary hits the configured maxmemory setting. # # replica-ignore-maxmemory yes # The server reclaims expired keys in two ways: upon access when those keys are # found to be expired, and also in the background, in what is called the # "active expire key". The key space is slowly and incrementally scanned # looking for expired keys to reclaim, so that it is possible to free memory # of keys that are expired and will never be accessed again in a short time. # # The default effort of the expire cycle will try to avoid having more than # ten percent of expired keys still in memory, and will try to avoid consuming # more than 25% of total memory and to add latency to the system. However # it is possible to increase the expire "effort" that is normally set to # "1", to a greater value, up to the value "10". At its maximum value the # system will use more CPU, longer cycles (and technically may introduce # more latency), and will tolerate less already expired keys still present # in the system. It's a tradeoff between memory, CPU and latency. # # active-expire-effort 1 ############################# LAZY FREEING #################################### # When keys are deleted, the served has historically freed their memory using # blocking operations. It means that the server stopped processing new commands # in order to reclaim all the memory associated with an object in a synchronous # way. If the key deleted is associated with a small object, the time needed # in order to execute the DEL command is very small and comparable to most other # O(1) or O(log_N) commands in the server. However if the key is associated with an # aggregated value containing millions of elements, the server can block for # a long time (even seconds) in order to complete the operation. # # For the above reasons, lazy freeing (or asynchronous freeing), has been # introduced. With lazy freeing, keys are deleted in constant time. Another # thread will incrementally free the object in the background as fast as # possible. # # Starting from Valkey 8.0, lazy freeing is enabled by default. It is possible # to retain the synchronous freeing behaviour by setting the lazyfree related # configuration directives to 'no'. # Commands like DEL, FLUSHALL and FLUSHDB delete keys, but the server can also # delete keys or flush the whole database as a side effect of other operations. # Specifically the server deletes objects independently of a user call in the # following scenarios: # # 1) On eviction, because of the maxmemory and maxmemory policy configurations, # in order to make room for new data, without going over the specified # memory limit. # 2) Because of expire: when a key with an associated time to live (see the # EXPIRE command) must be deleted from memory. # 3) Because of a side effect of a command that stores data on a key that may # already exist. For example the RENAME command may delete the old key # content when it is replaced with another one. Similarly SUNIONSTORE # or SORT with STORE option may delete existing keys. The SET command # itself removes any old content of the specified key in order to replace # it with the specified string. # 4) During replication, when a replica performs a full resynchronization with # its primary, the content of the whole database is removed in order to # load the RDB file just transferred. # # In all the above cases, the default is to release memory in a non-blocking # way. lazyfree-lazy-eviction yes lazyfree-lazy-expire yes lazyfree-lazy-server-del yes replica-lazy-flush yes # For keys deleted using the DEL command, lazy freeing is controlled by the # configuration directive 'lazyfree-lazy-user-del'. The default is 'yes'. The # UNLINK command is identical to the DEL command, except that UNLINK always # frees the memory lazily, regardless of this configuration directive: lazyfree-lazy-user-del yes # FLUSHDB, FLUSHALL, SCRIPT FLUSH and FUNCTION FLUSH support both asynchronous and synchronous # deletion, which can be controlled by passing the [SYNC|ASYNC] flags into the # commands. When neither flag is passed, this directive will be used to determine # if the data should be deleted asynchronously. # # When a replica performs a node reset via CLUSTER RESET, the entire # database content is removed to allow the node to become an empty primary. # This directive also determines whether the data should be deleted asynchronously. # # There are many problems with running flush synchronously. Even in single CPU # environments, the thread managers should balance between the freeing and # serving incoming requests. The default value is yes. lazyfree-lazy-user-flush yes ################################ THREADED I/O ################################# # The server is mostly single threaded, however there are certain threaded # operations such as UNLINK, slow I/O accesses and other things that are # performed on side threads. # # Now it is also possible to handle the server clients socket reads and writes # in different I/O threads. Since especially writing is so slow, normally # users use pipelining in order to speed up the server performances per # core, and spawn multiple instances in order to scale more. Using I/O # threads it is possible to easily speedup two times the server without resorting # to pipelining nor sharding of the instance. # # By default threading is disabled, we suggest enabling it only in machines # that have at least 3 or more cores, leaving at least one spare core. # We also recommend using threaded I/O only if you actually have performance problems, with # instances being able to use a quite big percentage of CPU time, otherwise # there is no point in using this feature. # # So for instance if you have a four cores boxes, try to use 2 or 3 I/O # threads, if you have a 8 cores, try to use 6 threads. In order to # enable I/O threads use the following configuration directive: # # io-threads 4 # # Setting io-threads to 1 will just use the main thread as usual. # When I/O threads are enabled, we use threads for reads and writes, that is # to thread the write and read syscall and transfer the client buffers to the # socket and to enable threading of reads and protocol parsing. # # # NOTE: # 1. The 'io-threads-do-reads' config is deprecated and has no effect. Please # avoid using this config if possible. # # 2. If you want to test the server speedup using valkey-benchmark, make # sure you also run the benchmark itself in threaded mode, using the # --threads option to match the number of server threads, otherwise you'll not # be able to notice the improvements. ############################ KERNEL OOM CONTROL ############################## # On Linux, it is possible to hint the kernel OOM killer on what processes # should be killed first when out of memory. # # Enabling this feature makes the server actively control the oom_score_adj value # for all its processes, depending on their role. The default scores will # attempt to have background child processes killed before all others, and # replicas killed before primaries. # # The server supports these options: # # no: Don't make changes to oom-score-adj (default). # yes: Alias to "relative" see below. # absolute: Values in oom-score-adj-values are written as is to the kernel. # relative: Values are used relative to the initial value of oom_score_adj when # the server starts and are then clamped to a range of -1000 to 1000. # Because typically the initial value is 0, they will often match the # absolute values. oom-score-adj no # When oom-score-adj is used, this directive controls the specific values used # for primary, replica and background child processes. Values range -2000 to # 2000 (higher means more likely to be killed). # # Unprivileged processes (not root, and without CAP_SYS_RESOURCE capabilities) # can freely increase their value, but not decrease it below its initial # settings. This means that setting oom-score-adj to "relative" and setting the # oom-score-adj-values to positive values will always succeed. oom-score-adj-values 0 200 800 #################### KERNEL transparent hugepage CONTROL ###################### # Usually the kernel Transparent Huge Pages control is set to "madvise" or # "never" by default (/sys/kernel/mm/transparent_hugepage/enabled), in which # case this config has no effect. On systems in which it is set to "always", # the server will attempt to disable it specifically for the server process in order # to avoid latency problems specifically with fork(2) and CoW. # If for some reason you prefer to keep it enabled, you can set this config to # "no" and the kernel global to "always". disable-thp yes ############################## APPEND ONLY MODE ############################### # By default the server asynchronously dumps the dataset on disk. This mode is # good enough in many applications, but an issue with the server process or # a power outage may result into a few minutes of writes lost (depending on # the configured save points). # # The Append Only File is an alternative persistence mode that provides # much better durability. For instance using the default data fsync policy # (see later in the config file) the server can lose just one second of writes in a # dramatic event like a server power outage, or a single write if something # wrong with the process itself happens, but the operating system is # still running correctly. # # AOF and RDB persistence can be enabled at the same time without problems. # If the AOF is enabled on startup the server will load the AOF, that is the file # with the better durability guarantees. # # Note that changing this value in a config file of an existing database and # restarting the server can lead to data loss. A conversion needs to be done # by setting it via CONFIG command on a live server first. # # Please check https://valkey.io/topics/persistence for more information. appendonly no # The base name of the append only file. # # The server uses a set of append-only files to persist the dataset # and changes applied to it. There are two basic types of files in use: # # - Base files, which are a snapshot representing the complete state of the # dataset at the time the file was created. Base files can be either in # the form of RDB (binary serialized) or AOF (textual commands). # - Incremental files, which contain additional commands that were applied # to the dataset following the previous file. # # In addition, manifest files are used to track the files and the order in # which they were created and should be applied. # # Append-only file names are created by the server following a specific pattern. # The file name's prefix is based on the 'appendfilename' configuration # parameter, followed by additional information about the sequence and type. # # For example, if appendfilename is set to appendonly.aof, the following file # names could be derived: # # - appendonly.aof.1.base.rdb as a base file. # - appendonly.aof.1.incr.aof, appendonly.aof.2.incr.aof as incremental files. # - appendonly.aof.manifest as a manifest file. appendfilename "appendonly.aof" # For convenience, the server stores all persistent append-only files in a dedicated # directory. The name of the directory is determined by the appenddirname # configuration parameter. appenddirname "appendonlydir" # The fsync() call tells the Operating System to actually write data on disk # instead of waiting for more data in the output buffer. Some OS will really flush # data on disk, some other OS will just try to do it ASAP. # # The server supports three different modes: # # no: don't fsync, just let the OS flush the data when it wants. Faster. # always: fsync after every write to the append only log. Slow, Safest. # everysec: fsync only one time every second. Compromise. # # The default is "everysec", as that's usually the right compromise between # speed and data safety. It's up to you to understand if you can relax this to # "no" that will let the operating system flush the output buffer when # it wants, for better performances (but if you can live with the idea of # some data loss consider the default persistence mode that's snapshotting), # or on the contrary, use "always" that's very slow but a bit safer than # everysec. # # More details please check the following article: # http://antirez.com/post/redis-persistence-demystified.html # # If unsure, use "everysec". # appendfsync always appendfsync everysec # appendfsync no # When the AOF fsync policy is set to always or everysec, and a background # saving process (a background save or AOF log background rewriting) is # performing a lot of I/O against the disk, in some Linux configurations # the server may block too long on the fsync() call. Note that there is no fix for # this currently, as even performing fsync in a different thread will block # our synchronous write(2) call. # # In order to mitigate this problem it's possible to use the following option # that will prevent fsync() from being called in the main process while a # BGSAVE or BGREWRITEAOF is in progress. # # This means that while another child is saving, the durability of the server is # the same as "appendfsync no". In practical terms, this means that it is # possible to lose up to 30 seconds of log in the worst scenario (with the # default Linux settings). # # If you have latency problems turn this to "yes". Otherwise leave it as # "no" that is the safest pick from the point of view of durability. no-appendfsync-on-rewrite no # Automatic rewrite of the append only file. # The server is able to automatically rewrite the log file implicitly calling # BGREWRITEAOF when the AOF log size grows by the specified percentage. # # This is how it works: The server remembers the size of the AOF file after the # latest rewrite (if no rewrite has happened since the restart, the size of # the AOF at startup is used). # # This base size is compared to the current size. If the current size is # bigger than the specified percentage, the rewrite is triggered. Also # you need to specify a minimal size for the AOF file to be rewritten, this # is useful to avoid rewriting the AOF file even if the percentage increase # is reached but it is still pretty small. # # Specify a percentage of zero in order to disable the automatic AOF # rewrite feature. auto-aof-rewrite-percentage 100 auto-aof-rewrite-min-size 64mb # An AOF file may be found to be truncated at the end during the server # startup process, when the AOF data gets loaded back into memory. # This may happen when the system where the server is running # crashes, especially when an ext4 filesystem is mounted without the # data=ordered option (however this can't happen when the server itself # crashes or aborts but the operating system still works correctly). # # The server can either exit with an error when this happens, or load as much # data as possible (the default now) and start if the AOF file is found # to be truncated at the end. The following option controls this behavior. # # If aof-load-truncated is set to yes, a truncated AOF file is loaded and # the server starts emitting a log to inform the user of the event. # Otherwise if the option is set to no, the server aborts with an error # and refuses to start. When the option is set to no, the user requires # to fix the AOF file using the "valkey-check-aof" utility before to restart # the server. # # Note that if the AOF file will be found to be corrupted in the middle # the server will still exit with an error. This option only applies when # the server will try to read more data from the AOF file but not enough bytes # will be found. aof-load-truncated yes # The server can create append-only base files in either RDB or AOF formats. Using # the RDB format is always faster and more efficient, and disabling it is only # supported for backward compatibility purposes. aof-use-rdb-preamble yes # The server supports recording timestamp annotations in the AOF to support restoring # the data from a specific point-in-time. However, using this capability changes # the AOF format in a way that may not be compatible with existing AOF parsers. aof-timestamp-enabled no ################################ SHUTDOWN ##################################### # Maximum time to wait for replicas when shutting down, in seconds. # # During shut down, a grace period allows any lagging replicas to catch up with # the latest replication offset before the primary exits. This period can # prevent data loss, especially for deployments without configured disk backups. # # The 'shutdown-timeout' value is the grace period's duration in seconds. It is # only applicable when the instance has replicas. To disable the feature, set # the value to 0. # # shutdown-timeout 10 # When the server receives a SIGINT or SIGTERM, shutdown is initiated and by default # an RDB snapshot is written to disk in a blocking operation if save points are configured. # The options used on signaled shutdown can include the following values: # # default: Saves RDB snapshot only if save points are configured. # Waits for lagging replicas to catch up. # save: Forces a DB saving operation even if no save points are configured. # nosave: Prevents DB saving operation even if one or more save points are configured. # now: Skips waiting for lagging replicas. # force: Ignores any errors that would normally prevent the server from exiting. # safe: Shut down only when safe. Note that safe cannot prevent force, in the case of # force, safe will print the relevant logs. The definition of safe may be different # in different modes. Here are the definitions: # * In cluster mode, it is unsafe to shut down a primary with slots, and may cause # the cluster to go down. # failover: In cluster mode, when shutting down a primary, it can proactively # initiate a manual failover. This promotes one of its replicas to # primary before shutdown, resulting in a quicker and safer transition # than relying on an automatic failover. For a replica to be eligible # for this promotion, it must be fully synchronized with the primary # node at the time of the shutdown signal after waiting up to the # configured shutdown-timeout. If no such replica is found, this # proactive failover will not occur. # # Any combination of values is allowed as long as "save" and "nosave" are not set simultaneously. # Example: "nosave force now" # # shutdown-on-sigint default # shutdown-on-sigterm default ################ NON-DETERMINISTIC LONG BLOCKING COMMANDS ##################### # Maximum time in milliseconds for EVAL scripts, functions and in some cases # modules' commands before the server can start processing or rejecting other clients. # # If the maximum execution time is reached the server will start to reply to most # commands with a BUSY error. # # In this state the server will only allow a handful of commands to be executed. # For instance, SCRIPT KILL, FUNCTION KILL, SHUTDOWN NOSAVE and possibly some # module specific 'allow-busy' commands. # # SCRIPT KILL and FUNCTION KILL will only be able to stop a script that did not # yet call any write commands, so SHUTDOWN NOSAVE may be the only way to stop # the server in the case a write command was already issued by the script when # the user doesn't want to wait for the natural termination of the script. # # The default is 5 seconds. It is possible to set it to 0 or a negative value # to disable this mechanism (uninterrupted execution). Note that in the past # this config had a different name, which is now an alias, so both of these do # the same: # lua-time-limit 5000 # busy-reply-threshold 5000 ################################ VALKEY CLUSTER ############################### # Normal server instances can't be part of a cluster; only nodes that are # started as cluster nodes can. In order to start a server instance as a # cluster node enable the cluster support uncommenting the following: # # cluster-enabled yes # Every cluster node has a cluster configuration file. This file is not # intended to be edited by hand. It is created and updated by each node. # Every cluster node requires a different cluster configuration file. # Make sure that instances running in the same system do not have # overlapping cluster configuration file names. # # cluster-config-file nodes-6379.conf # Cluster node timeout is the amount of milliseconds a node must be unreachable # for it to be considered in failure state. # Most other internal time limits are a multiple of the node timeout. # # cluster-node-timeout 15000 # The cluster port is the port that the cluster bus will listen for inbound connections on. When set # to the default value, 0, it will be bound to the command port + 10000. Setting this value requires # you to specify the cluster bus port when executing cluster meet. # cluster-port 0 # A replica of a failing primary will avoid to start a failover if its data # looks too old. # # There is no simple way for a replica to actually have an exact measure of # its "data age", so the following two checks are performed: # # 1) If there are multiple replicas able to failover, they exchange messages # in order to try to give an advantage to the replica with the best # replication offset (more data from the primary processed). # Replicas will try to get their rank by offset, and apply to the start # of the failover a delay proportional to their rank. # # 2) Every single replica computes the time of the last interaction with # its primary. This can be the last ping or command received (if the primary # is still in the "connected" state), or the time that elapsed since the # disconnection with the primary (if the replication link is currently down). # If the last interaction is too old, the replica will not try to failover # at all. # # The point "2" can be tuned by user. Specifically a replica will not perform # the failover if, since the last interaction with the primary, the time # elapsed is greater than: # # (node-timeout * cluster-replica-validity-factor) + repl-ping-replica-period # # So for example if node-timeout is 30 seconds, and the cluster-replica-validity-factor # is 10, and assuming a default repl-ping-replica-period of 10 seconds, the # replica will not try to failover if it was not able to talk with the primary # for longer than 310 seconds. # # A large cluster-replica-validity-factor may allow replicas with too old data to failover # a primary, while a too small value may prevent the cluster from being able to # elect a replica at all. # # For maximum availability, it is possible to set the cluster-replica-validity-factor # to a value of 0, which means, that replicas will always try to failover the # primary regardless of the last time they interacted with the primary. # (However they'll always try to apply a delay proportional to their # offset rank). # # Zero is the only value able to guarantee that when all the partitions heal # the cluster will always be able to continue. # # cluster-replica-validity-factor 10 # Cluster replicas are able to migrate to orphaned primaries, that are primaries # that are left without working replicas. This improves the cluster ability # to resist to failures as otherwise an orphaned primary can't be failed over # in case of failure if it has no working replicas. # # Replicas migrate to orphaned primaries only if there are still at least a # given number of other working replicas for their old primary. This number # is the "migration barrier". A migration barrier of 1 means that a replica # will migrate only if there is at least 1 other working replica for its primary # and so forth. It usually reflects the number of replicas you want for every # primary in your cluster. # # Default is 1 (replicas migrate only if their primaries remain with at least # one replica). To disable migration just set it to a very large value or # set cluster-allow-replica-migration to 'no'. # A value of 0 can be set but is useful only for debugging and dangerous # in production. # # cluster-migration-barrier 1 # Turning off this option allows to use less automatic cluster configuration. # It disables migration of replicas to orphaned primaries. Masters that become # empty due to losing their last slots to another primary will not automatically # replicate from the primary that took over their last slots. Instead, they will # remain as empty primaries without any slots. # # Default is 'yes' (allow automatic migrations). # # cluster-allow-replica-migration yes # By default cluster nodes stop accepting queries if they detect there # is at least a hash slot uncovered (no available node is serving it). # This way if the cluster is partially down (for example a range of hash slots # are no longer covered) all the cluster becomes, eventually, unavailable. # It automatically returns available as soon as all the slots are covered again. # # However sometimes you want the subset of the cluster which is working, # to continue to accept queries for the part of the key space that is still # covered. In order to do so, just set the cluster-require-full-coverage # option to no. # # cluster-require-full-coverage yes # This option, when set to yes, prevents replicas from trying to failover its # primary during primary failures. However the replica can still perform a # manual failover, if forced to do so. # # This is useful in different scenarios, especially in the case of multiple # data center operations, where we want one side to never be promoted if not # in the case of a total DC failure. # # cluster-replica-no-failover no # The timeout in milliseconds for cluster manual failover. If a manual failover # does not complete within the specified time, both the replica and the primary # will abort it. Note that this timeout is also used for the finalization of # migrations initiated with the CLUSTER MIGRATESLOTS command. # # A manual failover is a special kind of failover that is usually executed when # there are no actual failures, and we wish to swap the current primary with one # of its replicas in a safe way, without any window for data loss. # # To avoid data loss, the primary and the replica need to wait for each other for # a period of time, the primary need to pause the clients writes to stop processing # traffic. The default failover timeout is 5000ms, it is possible to configure the # timeout and decide how long the primary will pause in the worst case scenario, # i.e. the manual failover timed out due to the insufficient votes. # # Check https://valkey.io/commands/cluster-failover/ for more information. # # cluster-manual-failover-timeout 5000 # This option, when set to yes, allows nodes to serve read traffic while the # cluster is in a down state, as long as it believes it owns the slots. # # This is useful for two cases. The first case is for when an application # doesn't require consistency of data during node failures or network partitions. # One example of this is a cache, where as long as the node has the data it # should be able to serve it. # # The second use case is for configurations that don't meet the recommended # three shards but want to enable cluster mode and scale later. A # primary outage in a 1 or 2 shard configuration causes a read/write outage to the # entire cluster without this option set, with it set there is only a write outage. # Without a quorum of primaries, slot ownership will not change automatically. # # cluster-allow-reads-when-down no # This option, when set to yes, allows nodes to serve pubsub shard traffic while # the cluster is in a down state, as long as it believes it owns the slots. # # This is useful if the application would like to use the pubsub feature even when # the cluster global stable state is not OK. If the application wants to make sure only # one shard is serving a given channel, this feature should be kept as yes. # # cluster-allow-pubsubshard-when-down yes # Cluster link send buffer limit is the limit on the memory usage of an individual # cluster bus link's send buffer in bytes. Cluster links would be freed if they exceed # this limit. This is to primarily prevent send buffers from growing unbounded on links # toward slow peers (E.g. PubSub messages being piled up). # This limit is disabled by default. Enable this limit when 'mem_cluster_links' INFO field # and/or 'send-buffer-allocated' entries in the 'CLUSTER LINKS` command output continuously increase. # Minimum limit of 1gb is recommended so that cluster link buffer can fit in at least a single # PubSub message by default. (client-query-buffer-limit default value is 1gb) # # cluster-link-sendbuf-limit 0 # Clusters can configure their announced hostname using this config. This is a common use case for # applications that need to use TLS Server Name Indication (SNI) or dealing with DNS based # routing. By default this value is only shown as additional metadata in the CLUSTER SLOTS # command, but can be changed using 'cluster-preferred-endpoint-type' config. This value is # communicated along the clusterbus to all nodes, setting it to an empty string will remove # the hostname and also propagate the removal. # # cluster-announce-hostname "" # Clusters can configure an optional nodename to be used in addition to the node ID for # debugging and admin information. This name is broadcasted between nodes, so will be used # in addition to the node ID when reporting cross node events such as node failures. # cluster-announce-human-nodename "" # Clusters can advertise how clients should connect to them using either their IP address, # a user defined hostname, or by declaring they have no endpoint. Which endpoint is # shown as the preferred endpoint is set by using the cluster-preferred-endpoint-type # config with values 'ip', 'hostname', or 'unknown-endpoint'. This value controls how # the endpoint returned for MOVED/ASKING requests as well as the first field of CLUSTER SLOTS. # If the preferred endpoint type is set to hostname, but no announced hostname is set, a '?' # will be returned instead. # # When a cluster advertises itself as having an unknown endpoint, it's indicating that # the server doesn't know how clients can reach the cluster. This can happen in certain # networking situations where there are multiple possible routes to the node, and the # server doesn't know which one the client took. In this case, the server is expecting # the client to reach out on the same endpoint it used for making the last request, but use # the port provided in the response. # # cluster-preferred-endpoint-type ip # The cluster blacklist is used when removing a node from the cluster completely. # When CLUSTER FORGET is called for a node, that node is put into the blacklist for # some time so that when gossip messages are received from other nodes that still # remember it, it is not re-added. This gives time for CLUSTER FORGET to be sent to # every node in the cluster. The blacklist TTL is 60 seconds by default, which should # be sufficient for most clusters, but you may considering increasing this if you see # nodes getting re-added while using CLUSTER FORGET. # # cluster-blacklist-ttl 60 # Clusters can be configured to track per-slot resource statistics, # which are accessible by the CLUSTER SLOT-STATS command. # # By default, the 'cluster-slot-stats-enabled' is disabled, and only 'key-count' is captured. # By enabling the 'cluster-slot-stats-enabled' config, the cluster will begin to capture advanced statistics. # These statistics can be leveraged to assess general slot usage trends, identify hot / cold slots, # migrate slots for a balanced cluster workload, and / or re-write application logic to better utilize slots. # # cluster-slot-stats-enabled no # Slot migrations using the CLUSTER MIGRATESLOTS command will generate an in-memory migration log on both # the source and target nodes of the migration. These can be observed with CLUSTER GETSLOTMIGRATIONS. # 'cluster-slot-migration-log-max-len' allows the maximum length of this log to be specified. Only # migrations that are completed will be considered for removal. # # cluster-slot-migration-log-max-len 1000 # During the CLUSTER MIGRATESLOTS command execution, the source node needs to pause itself and allow all # writes to be fully processed by the target node. The amount of data remaining in the buffer on the # source node when this pause happens will affect how long this pause takes. # 'slot-migration-max-failover-repl-bytes' allows the pause to wait until there are at most this # many bytes in the output buffer. Setting this to -1 will disable this limit, and 0 will require # no data be in the source output buffer (although this is not a guaranatee the data is fully # received by the target). # # slot-migration-max-failover-repl-bytes 0 # In order to setup your cluster make sure to read the documentation # available at https://valkey.io web site. ########################## CLUSTER DOCKER/NAT support ######################## # In certain deployments, cluster node's address discovery fails, because # addresses are NAT-ted or because ports are forwarded (the typical case is # Docker and other containers). # # In order to make a cluster work in such environments, a static # configuration where each node knows its public address is needed. The # following options are used for this scope, and are: # # * cluster-announce-ip # * cluster-announce-client-ipv4 # * cluster-announce-client-ipv6 # * cluster-announce-port # * cluster-announce-tls-port # * cluster-announce-bus-port # * cluster-announce-client-port # * cluster-announce-client-tls-port # # Each instructs the node about its address, possibly other addresses to expose # to clients, client ports (for connections without and with TLS) and cluster # message bus port. The information is then published in the bus packets so that # other nodes will be able to correctly map the address of the node publishing # the information. # # If tls-cluster is set to yes and cluster-announce-tls-port is omitted or set # to zero, then cluster-announce-port refers to the TLS port. Note also that # cluster-announce-tls-port has no effect if tls-cluster is set to no. # # If cluster-announce-client-ipv4 and cluster-announce-client-ipv6 are omitted, # then cluster-announce-ip is exposed to clients. # # If the port that clients will use to connect to Valkey is different than # the one other valkey nodes in the cluster will connect to it on, either # through special networking rules or because Valkey is behind a load balancer, # you can configure the port that clients will see by setting # cluster-announce-client-port or cluster-announce-client-tls-port. # # If the above options are not used, the normal cluster auto-detection # will be used instead. # # Note that when remapped, the bus port may not be at the fixed offset of # clients port + 10000, so you can specify any port and bus-port depending # on how they get remapped. If the bus-port is not set, a fixed offset of # 10000 will be used as usual. # # Example: # # cluster-announce-ip 10.1.1.5 # cluster-announce-client-ipv4 123.123.123.5 # cluster-announce-client-ipv6 2001:db8::8a2e:370:7334 # cluster-announce-tls-port 6379 # cluster-announce-port 0 # cluster-announce-bus-port 6380 # cluster-announce-client-tls-port 6479 # cluster-announce-client-port 0 # Set the number of databases in cluster mode. The default database is DB 0, # you can select a different one on a per-connection basis using SELECT where # dbid is a number between 0 and 'cluster-databases'-1. # cluster-databases 1 ################################## COMMAND LOG ################################### # The Command Log system is used to record commands that consume significant resources # during server operation, including CPU, memory, and network bandwidth. # These commands and the data they access may lead to abnormal instance operations, # the commandlog can help users quickly and intuitively locate issues. # # Currently, three types of command logs are supported: # # SLOW: Logs commands that exceed a specified execution time. This excludes time spent # on I/O operations like client communication and focuses solely on the command's # processing time, where the main thread is blocked. # # LARGE-REQUEST: Logs commands with requests exceeding a defined size. This helps # identify potentially problematic commands that send excessive data to the server. # # LARGE-REPLY: Logs commands that generate replies exceeding a defined size. This # helps identify commands that return unusually large amounts of data, which may # impact network performance or client processing. # # Each log type has two key parameters: # 1. A threshold value that determines when a command is logged. This threshold is specific # to the type of log (e.g., execution time, request size, or reply size). A negative value disables # logging. A value of 0 logs all commands. # 2. A maximum length that specifies the number of entries to retain in the log. Increasing # the length allows more entries to be stored but consumes additional memory. To clear all # entries for a specific log type and reclaim memory, use the `COMMANDLOG RESET` # subcommand followed by the log type. # # SLOW Command Logs # The SLOW log records commands that exceed a specified execution time. The execution time # does not include I/O operations, such as client communication or sending responses. # It only measures the time spent executing the command, during which the thread is blocked # and cannot handle other requests. # # The threshold is measured in microseconds. # # Backward Compatibility: The parameters `slowlog-log-slower-than` and `slowlog-max-len` # are still supported but deprecated in favor of these commandlog parameters. # # The following time is expressed in microseconds, so 1000000 is equivalent to 1 second. # Note that -1 disables the slow log, while 0 forces logging of every command. commandlog-execution-slower-than 10000 # Record the number of commands. # There is no limit to this length. Just be aware that it will consume memory. # You can reclaim memory used by the slow log with SLOWLOG RESET or COMMANDLOG RESET SLOW. commandlog-slow-execution-max-len 128 # # LARGE_REQUEST Command Logs # The LARGE_REQUEST log tracks commands with requests exceeding a specified size. The request size # includes the command itself and all its arguments. For example, in `SET KEY VALUE`, the size is # determined by the combined size of the key and value. Commands that consume excessive network # bandwidth or query buffer space are recorded here. # # The threshold is measured in bytes. # Note that -1 disables the large request log, while 0 forces logging of every command. commandlog-request-larger-than 1048576 # Record the number of commands. # There is no limit to this length. Just be aware that it will consume memory. # You can reclaim memory used by the large request log with COMMANDLOG RESET LARGE-REQUEST. commandlog-large-request-max-len 128 # # LARGE_REPLY Command Logs # The LARGE_REPLY log records commands that produce replies exceeding a specified size. These replies # may consume significant network bandwidth or client output buffer space. Examples include commands # like `KEYS` or `HGETALL` that return large datasets. Even a `GET` command may qualify if the value # is substantial. # # The threshold is measured in bytes. # Note that -1 disables the large reply log, while 0 forces logging of every command. # Enabling this feature (values other than -1) has performance implications # when I/O threads are used due to additional tracking overhead. # Consider using -1 to disable if large reply monitoring is not needed. commandlog-reply-larger-than 1048576 # Record the number of commands. # There is no limit to this length. Just be aware that it will consume memory. # You can reclaim memory used by the large reply log with COMMANDLOG RESET LARGE-REPLY. commandlog-large-reply-max-len 128 ################################ LATENCY MONITOR ############################## # The server latency monitoring subsystem samples different operations # at runtime in order to collect data related to possible sources of # latency of a server instance. # # Via the LATENCY command this information is available to the user that can # print graphs and obtain reports. # # The system only logs operations that were performed in a time equal or # greater than the amount of milliseconds specified via the # latency-monitor-threshold configuration directive. When its value is set # to zero, the latency monitor is turned off. # # By default latency monitoring is disabled since it is mostly not needed # if you don't have latency issues, and collecting data has a performance # impact, that while very small, can be measured under big load. Latency # monitoring can easily be enabled at runtime using the command # "CONFIG SET latency-monitor-threshold " if needed. latency-monitor-threshold 0 ################################ LATENCY TRACKING ############################## # The server's extended latency monitoring tracks the per command latencies and enables # exporting the percentile distribution via the INFO latencystats command, # and cumulative latency distributions (histograms) via the LATENCY command. # # By default, the extended latency monitoring is enabled since the overhead # of keeping track of the command latency is very small. # latency-tracking yes # By default the exported latency percentiles via the INFO latencystats command # are the p50, p99, and p999. # latency-tracking-info-percentiles 50 99 99.9 ############################# EVENT NOTIFICATION ############################## # The server can notify Pub/Sub clients about events happening in the key space. # This feature is documented at https://valkey.io/topics/notifications # # For instance if keyspace events notification is enabled, and a client # performs a DEL operation on key "foo" stored in the Database 0, two # messages will be published via Pub/Sub: # # PUBLISH __keyspace@0__:foo del # PUBLISH __keyevent@0__:del foo # # It is possible to select the events that the server will notify among a set # of classes. Every class is identified by a single character: # # K Keyspace events, published with __keyspace@__ prefix. # E Keyevent events, published with __keyevent@__ prefix. # g Generic commands (non-type specific) like DEL, EXPIRE, RENAME, ... # $ String commands # l List commands # s Set commands # h Hash commands # z Sorted set commands # x Expired events (events generated every time a key expires) # e Evicted events (events generated when a key is evicted for maxmemory) # n New key events (Note: not included in the 'A' class) # t Stream commands # d Module key type events # m Key-miss events (Note: It is not included in the 'A' class) # A Alias for g$lshzxetd, so that the "AKE" string means all the events # (Except key-miss events which are excluded from 'A' due to their # unique nature). # # The "notify-keyspace-events" takes as argument a string that is composed # of zero or multiple characters. The empty string means that notifications # are disabled. # # Example: to enable list and generic events, from the point of view of the # event name, use: # # notify-keyspace-events Elg # # Example 2: to get the stream of the expired keys subscribing to channel # name __keyevent@0__:expired use: # # notify-keyspace-events Ex # # By default all notifications are disabled because most users don't need # this feature and the feature has some overhead. Note that if you don't # specify at least one of K or E, no events will be delivered. notify-keyspace-events "" ############################### ADVANCED CONFIG ############################### # Hashes are encoded using a memory efficient data structure when they have a # small number of entries, and the biggest entry does not exceed a given # threshold. These thresholds can be configured using the following directives. hash-max-listpack-entries 512 hash-max-listpack-value 64 # Lists are also encoded in a special way to save a lot of space. # The number of entries allowed per internal list node can be specified # as a fixed maximum size or a maximum number of elements. # For a fixed maximum size, use -5 through -1, meaning: # -5: max size: 64 Kb <-- not recommended for normal workloads # -4: max size: 32 Kb <-- not recommended # -3: max size: 16 Kb <-- probably not recommended # -2: max size: 8 Kb <-- good # -1: max size: 4 Kb <-- good # Positive numbers mean store up to _exactly_ that number of elements # per list node. # The highest performing option is usually -2 (8 Kb size) or -1 (4 Kb size), # but if your use case is unique, adjust the settings as necessary. list-max-listpack-size -2 # Lists may also be compressed. # Compress depth is the number of quicklist ziplist nodes from *each* side of # the list to *exclude* from compression. The head and tail of the list # are always uncompressed for fast push/pop operations. Settings are: # 0: disable all list compression # 1: depth 1 means "don't start compressing until after 1 node into the list, # going from either the head or tail" # So: [head]->node->node->...->node->[tail] # [head], [tail] will always be uncompressed; inner nodes will compress. # 2: [head]->[next]->node->node->...->node->[prev]->[tail] # 2 here means: don't compress head or head->next or tail->prev or tail, # but compress all nodes between them. # 3: [head]->[next]->[next]->node->node->...->node->[prev]->[prev]->[tail] # etc. list-compress-depth 0 # Sets have a special encoding when a set is composed # of just strings that happen to be integers in radix 10 in the range # of 64 bit signed integers. # The following configuration setting sets the limit in the size of the # set in order to use this special memory saving encoding. set-max-intset-entries 512 # Sets containing non-integer values are also encoded using a memory efficient # data structure when they have a small number of entries, and the biggest entry # does not exceed a given threshold. These thresholds can be configured using # the following directives. set-max-listpack-entries 128 set-max-listpack-value 64 # Similarly to hashes and lists, sorted sets are also specially encoded in # order to save a lot of space. This encoding is only used when the length and # elements of a sorted set are below the following limits: zset-max-listpack-entries 128 zset-max-listpack-value 64 # HyperLogLog sparse representation bytes limit. The limit includes the # 16 bytes header. When a HyperLogLog using the sparse representation crosses # this limit, it is converted into the dense representation. # # A value greater than 16000 is totally useless, since at that point the # dense representation is more memory efficient. # # The suggested value is ~ 3000 in order to have the benefits of # the space efficient encoding without slowing down too much PFADD, # which is O(N) with the sparse encoding. The value can be raised to # ~ 10000 when CPU is not a concern, but space is, and the data set is # composed of many HyperLogLogs with cardinality in the 0 - 15000 range. hll-sparse-max-bytes 3000 # Streams macro node max size / items. The stream data structure is a radix # tree of big nodes that encode multiple items inside. Using this configuration # it is possible to configure how big a single node can be in bytes, and the # maximum number of items it may contain before switching to a new node when # appending new stream entries. If any of the following settings are set to # zero, the limit is ignored, so for instance it is possible to set just a # max entries limit by setting max-bytes to 0 and max-entries to the desired # value. stream-node-max-bytes 4096 stream-node-max-entries 100 # Active rehashing uses 1% of the CPU time to help perform incremental rehashing # of the main server hash tables, the ones mapping top-level keys to values. # # If active rehashing is disabled and rehashing is needed, a hash table is # rehashed one "step" on every operation performed on the hash table (add, find, # etc.), so if the server is idle, the rehashing may never complete and some # more memory is used by the hash tables. Active rehashing helps prevent this. # # Active rehashing runs as a background task. Depending on the value of 'hz', # the frequency at which the server performs background tasks, active rehashing # can cause the server to freeze for a short time. For example, if 'hz' is set # to 10, active rehashing runs for up to one millisecond every 100 milliseconds. # If a freeze of one millisecond is not acceptable, you can increase 'hz' to let # active rehashing run more often. If instead 'hz' is set to 100, active # rehashing runs up to only 100 microseconds every 10 milliseconds. The total is # still 1% of the time. activerehashing yes # The client output buffer limits can be used to force disconnection of clients # that are not reading data from the server fast enough for some reason (a # common reason is that a Pub/Sub client can't consume messages as fast as the # publisher can produce them). # # The limit can be set differently for the three different classes of clients: # # normal -> normal clients including MONITOR clients # replica -> replica clients # pubsub -> clients subscribed to at least one pubsub channel or pattern # # The syntax of every client-output-buffer-limit directive is the following: # # client-output-buffer-limit # # A client is immediately disconnected once the hard limit is reached, or if # the soft limit is reached and remains reached for the specified number of # seconds (continuously). # So for instance if the hard limit is 32 megabytes and the soft limit is # 16 megabytes / 10 seconds, the client will get disconnected immediately # if the size of the output buffers reach 32 megabytes, but will also get # disconnected if the client reaches 16 megabytes and continuously overcomes # the limit for 10 seconds. # # By default normal clients are not limited because they don't receive data # without asking (in a push way), but just after a request, so only # asynchronous clients may create a scenario where data is requested faster # than it can read. # # Instead there is a default limit for pubsub and replica clients, since # subscribers and replicas receive data in a push fashion. # # Note that it doesn't make sense to set the replica clients output buffer # limit lower than the repl-backlog-size config (partial sync will succeed # and then replica will get disconnected). # Such a configuration is ignored (the size of repl-backlog-size will be used). # This doesn't have memory consumption implications since the replica client # will share the backlog buffers memory. # # Both the hard or the soft limit can be disabled by setting them to zero. client-output-buffer-limit normal 0 0 0 client-output-buffer-limit replica 256mb 64mb 60 client-output-buffer-limit pubsub 32mb 8mb 60 # Client query buffers accumulate new commands. They are limited to a fixed # amount by default in order to avoid that a protocol desynchronization (for # instance due to a bug in the client) will lead to unbound memory usage in # the query buffer. However you can configure it here if you have very special # needs, such as a command with huge argument, or huge multi/exec requests or alike. # # client-query-buffer-limit 1gb # In some scenarios client connections can hog up memory leading to OOM # errors or data eviction. To avoid this we can cap the accumulated memory # used by all client connections (all pubsub and normal clients). Once we # reach that limit connections will be dropped by the server freeing up # memory. The server will attempt to drop the connections using the most # memory first. We call this mechanism "client eviction". # # Client eviction is configured using the maxmemory-clients setting as follows: # 0 - client eviction is disabled (default) # # A memory value can be used for the client eviction threshold, # for example: # maxmemory-clients 1g # # A percentage value (between 1% and 100%) means the client eviction threshold # is based on a percentage of the maxmemory setting. For example to set client # eviction at 5% of maxmemory: # maxmemory-clients 5% # In the server protocol, bulk requests, that are, elements representing single # strings, are normally limited to 512 mb. However you can change this limit # here, but must be 1mb or greater # # proto-max-bulk-len 512mb # The server calls an internal function to perform many background tasks, like # closing connections of clients in timeout, purging expired keys that are # never requested, and so forth. # # Not all tasks are performed with the same frequency, but the server checks for # tasks to perform according to the specified "hz" value. # # By default "hz" is set to 10. Raising the value will use more CPU when # the server is idle, but at the same time will make the server more responsive when # there are many keys expiring at the same time, and timeouts may be # handled with more precision. # # The range is between 1 and 500, however a value over 100 is usually not # a good idea. Most users should use the default of 10 and raise this up to # 100 only in environments where very low latency is required. hz 10 # When a child rewrites the AOF file, if the following option is enabled # the file will be fsync-ed every 4 MB of data generated. This is useful # in order to commit the file to the disk more incrementally and avoid # big latency spikes. aof-rewrite-incremental-fsync yes # When the server saves RDB file, if the following option is enabled # the file will be fsync-ed every 4 MB of data generated. This is useful # in order to commit the file to the disk more incrementally and avoid # big latency spikes. rdb-save-incremental-fsync yes # The server's LFU eviction (see maxmemory setting) can be tuned. However it is a good # idea to start with the default settings and only change them after investigating # how to improve the performances and how the keys LFU change over time, which # is possible to inspect via the OBJECT FREQ command. # # There are two tunable parameters in the server LFU implementation: the # counter logarithm factor and the counter decay time. It is important to # understand what the two parameters mean before changing them. # # The LFU counter is just 8 bits per key, it's maximum value is 255, so the server # uses a probabilistic increment with logarithmic behavior. Given the value # of the old counter, when a key is accessed, the counter is incremented in # this way: # # 1. A random number R between 0 and 1 is extracted. # 2. A probability P is calculated as 1/(old_value*lfu_log_factor+1). # 3. The counter is incremented only if R < P. # # The default lfu-log-factor is 10. This is a table of how the frequency # counter changes with a different number of accesses with different # logarithmic factors: # # +--------+------------+------------+------------+------------+------------+ # | factor | 100 hits | 1000 hits | 100K hits | 1M hits | 10M hits | # +--------+------------+------------+------------+------------+------------+ # | 0 | 104 | 255 | 255 | 255 | 255 | # +--------+------------+------------+------------+------------+------------+ # | 1 | 18 | 49 | 255 | 255 | 255 | # +--------+------------+------------+------------+------------+------------+ # | 10 | 10 | 18 | 142 | 255 | 255 | # +--------+------------+------------+------------+------------+------------+ # | 100 | 8 | 11 | 49 | 143 | 255 | # +--------+------------+------------+------------+------------+------------+ # # NOTE: The above table was obtained by running the following commands: # # valkey-benchmark -n 1000000 incr foo # valkey-cli object freq foo # # NOTE 2: The counter initial value is 5 in order to give new objects a chance # to accumulate hits. # # The counter decay time is the time, in minutes, that must elapse in order # for the key counter to be decremented. # # The default value for the lfu-decay-time is 1. A special value of 0 means we # will never decay the counter. # # lfu-log-factor 10 # lfu-decay-time 1 # The maximum number of new client connections accepted per event-loop cycle. This configuration # is set independently for TLS connections. # # By default, up to 10 new connection will be accepted per event-loop cycle for normal connections # and up to 1 new connection per event-loop cycle for TLS connections. # # Adjusting this to a larger number can slightly improve efficiency for new connections # at the risk of causing timeouts for regular commands on established connections. It is # not advised to change this without ensuring that all clients have limited connection # pools and exponential backoff in the case of command/connection timeouts. # # If your application is establishing a large number of new connections per second you should # also consider tuning the value of tcp-backlog, which allows the kernel to buffer more # pending connections before dropping or rejecting connections. # # max-new-connections-per-cycle 10 # max-new-tls-connections-per-cycle 1 # Memory prefetching is used when multiple commands are parsed and ready for # execution. We take advantage of knowing the next set of commands and prefetch # their required hash table entries in a batch. This reduces the time spent on # memory accesses. # # When I/O threads are used, the keys of multiple commands from multiple clients # are prefetched together. When I/O threads are not used, only the commands from # a single client's command pipeline is prefetched. # # The optimal batch size depends on the specific workflow of the user and on the # hardware used. The default batch size is 16, which can be modified using the # 'prefetch-batch-max-size' config. # # When the config is set to 0, prefetching is disabled. # # prefetch-batch-max-size 16 ########################### ACTIVE DEFRAGMENTATION ####################### # # What is active defragmentation? # ------------------------------- # # Active (online) defragmentation allows a server to compact the # spaces left between small allocations and deallocations of data in memory, # thus allowing to reclaim back memory. # # Fragmentation is a natural process that happens with every allocator (but # less so with Jemalloc, fortunately) and certain workloads. Normally a server # restart is needed in order to lower the fragmentation, or at least to flush # away all the data and create it again. However thanks to this feature, this # process can happen at runtime in a "hot" way, while the server is running. # # Basically when the fragmentation is over a certain level (see the # configuration options below) the server will start to create new copies of the # values in contiguous memory regions by exploiting certain specific Jemalloc # features (in order to understand if an allocation is causing fragmentation # and to allocate it in a better place), and at the same time, will release the # old copies of the data. This process, repeated incrementally for all the keys # will cause the fragmentation to drop back to normal values. # # Important things to understand: # # 1. This feature is disabled by default, and only works if you compiled the server # to use the copy of Jemalloc we ship with the source code of the server. # This is the default with Linux builds. # # 2. You never need to enable this feature if you don't have fragmentation # issues. # # 3. Once you experience fragmentation, you can enable this feature when # needed with the command "CONFIG SET activedefrag yes". # # The configuration parameters are able to fine tune the behavior of the # defragmentation process. If you are not sure about what they mean it is # a good idea to leave the defaults untouched. # Active defragmentation is disabled by default # activedefrag no # Minimum amount of fragmentation waste to start active defrag # active-defrag-ignore-bytes 100mb # Minimum percentage of fragmentation to start active defrag # active-defrag-threshold-lower 10 # Maximum percentage of fragmentation at which we use maximum effort # active-defrag-threshold-upper 100 # Minimal effort for defrag in CPU percentage, not cycle time as the name might # suggest, to be used when the lower threshold is reached. # active-defrag-cycle-min 1 # Maximal effort for defrag in CPU percentage, not cycle time as the name might # suggest, to be used when the upper threshold is reached. # active-defrag-cycle-max 25 # Maximum number of set/hash/zset/list fields that will be processed from # the main dictionary scan # active-defrag-max-scan-fields 1000 # The time spent (in microseconds) of the periodic active defrag process. This # affects the latency impact of active defrag on client commands. Smaller numbers # will result in less latency impact at the cost of increased defrag overhead. # active-defrag-cycle-us 500 # Jemalloc background thread for purging will be enabled by default jemalloc-bg-thread yes # It is possible to pin different threads and processes of the server to specific # CPUs in your system, in order to maximize the performances of the server. # This is useful both in order to pin different server threads in different # CPUs, but also in order to make sure that multiple server instances running # in the same host will be pinned to different CPUs. # # Normally you can do this using the "taskset" command, however it is also # possible to do this via the server configuration directly, both in Linux and FreeBSD. # # You can pin the server/IO threads, bio threads, aof rewrite child process, # bgsave child process and the slot migration process. # The syntax to specify the cpu list is the same as the taskset command: # # Set server/io threads to cpu affinity 0,2,4,6: # server-cpulist 0-7:2 # # Set bio threads to cpu affinity 1,3: # bio-cpulist 1,3 # # Set aof rewrite child process to cpu affinity 8,9,10,11: # aof-rewrite-cpulist 8-11 # # Set bgsave (or slot migration) child process to cpu affinity 1,10,11: # bgsave-cpulist 1,10-11 # In some cases the server will emit warnings and even refuse to start if it detects # that the system is in bad state, it is possible to suppress these warnings # by setting the following config which takes a space delimited list of warnings # to suppress # # ignore-warnings ARM64-COW-BUG # Inform Valkey of the availability zone if running in a cloud environment. Currently # this is exposed in the INFO and HELLO commands for clients to use. Default is # the empty string. # # availability-zone "zone-name" ================================================ FILE: aegir/conf/var/boa.bashrc.txt ================================================ #------------------------------------------------------------- # BOA default .bashrc #------------------------------------------------------------- ulimit -S -c 0 set -o notify set -o ignoreeof shopt -s cdspell shopt -s cdable_vars shopt -s checkhash shopt -s checkwinsize shopt -s sourcepath shopt -s no_empty_cmd_completion shopt -s cmdhist shopt -s histappend histreedit histverify shopt -u mailwarn unset MAILCHECK HISTCONTROL=ignoredups:ignorespace export PATH=$PATH:/usr/local/bin:/opt/local/bin case "$TERM" in xterm*|rxvt*|vt100) export PS1='\h:\w\$ ' ;; *) ;; esac # workaround for immediate refresh in screen session if [ -n "$STY" ]; then alias mc='TERM=dumb mc' else alias mc='mc' fi if [ -x /usr/bin/dircolors ]; then test -r ~/.dircolors && eval "$(dircolors -b ~/.dircolors)" || eval "$(dircolors -b)" alias ll="ls -l --group-directories-first --color=auto" alias ls='ls -hF --color=auto' # add colors for filetype recognition alias la='ls -Al --color=auto' # show hidden files alias lx='ls -lXB --color=auto' # sort by extension alias lk='ls -lSr --color=auto' # sort by size, biggest last alias lc='ls -ltcr --color=auto' # sort by and show change time, most recent last alias lu='ls -ltur --color=auto' # sort by and show access time, most recent last alias lt='ls -ltr --color=auto' # sort by date, most recent last alias lr='ls -lR --color=auto' # recursive ls alias dir='dir --color=auto' # add colors alias vdir='vdir --color=auto' # add colors alias grep='grep --color=auto' # add colors alias fgrep='fgrep --color=auto' # add colors alias egrep='egrep --color=auto' # add colors else alias ll="ls -l --group-directories-first" alias ls='ls -hF' # filetype recognition alias la='ls -Al' # show hidden files alias lx='ls -lXB' # sort by extension alias lk='ls -lSr' # sort by size, biggest last alias lc='ls -ltcr' # sort by and show change time, most recent last alias lu='ls -ltur' # sort by and show access time, most recent last alias lt='ls -ltr' # sort by date, most recent last alias lr='ls -lR' # recursive ls fi alias df='df -kTPh' alias wget='wget --no-check-certificate' function xtitle() { case "$TERM" in xterm*|rxvt*) echo -n -e "\033]0;$*\007" ;; *) ;; esac } _L_HOST="$(cat /etc/hostname 2>/dev/null | tr -d '\n' || hostname -f 2>/dev/null)" alias top='xtitle $_L_HOST System Monitor && top' alias htop='xtitle $_L_HOST System Monitor && htop' alias mytop='xtitle $_L_HOST SQL Monitor && mytop' alias make='xtitle Making $(basename $PWD) ; make SHELL=/bin/bash' function extract() { if [ -f $1 ]; then case $1 in *.tar.bz2) tar xjf $1 ;; *.tar.gz) tar xzf $1 ;; *.bz2) bunzip2 $1 ;; *.rar) unrar x $1 ;; *.gz) gunzip -q $1 ;; *.tar) tar xf $1 ;; *.tbz2) tar xjf $1 ;; *.tgz) tar xzf $1 ;; *.zip) unzip -qq $1 ;; *.Z) uncompress $1 ;; *.7z) 7z x $1 ;; *) echo "'$1' cannot be extracted via >extract<" ;; esac else echo "'$1' is not a valid file" fi } if [ -f ~/.bash_aliases ]; then . ~/.bash_aliases fi umask 022 ================================================ FILE: aegir/conf/var/clean-boa-env ================================================ #!/bin/bash ### BEGIN INIT INFO # Provides: clean-boa-env # Required-Start: $remote_fs $syslog # Required-Stop: $remote_fs $syslog # Default-Start: 2 3 4 5 # Default-Stop: 0 1 6 # Short-Description: safeguard to remove auto-healing pid files after reboot etc. # Description: safeguard to remove auto-healing pid files after reboot etc. ### END INIT INFO PATH=/usr/local/bin:/usr/local/sbin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin:/usr/libexec NAME=clean-boa-env DESC=clean-boa-env PIDFILE=/run/clean-boa-env.pid case "$1" in start) echo -n "Starting $DESC: " if [ -L "/bin/sh" ]; then _WEB_SH="$(readlink -n /bin/sh)" if [ -x "/bin/dash" ] || [ -x "/usr/bin/dash" ]; then if [ "${_WEB_SH}" != "/bin/dash" ]; then if [ -x "/usr/bin/dash" ] && [ ! -L "/usr/bin/dash" ]; then if [ -L "/usr/bin/sh" ]; then ln -sfn /usr/bin/dash /usr/bin/sh fi if [ -L "/bin/sh" ]; then ln -sfn /usr/bin/dash /bin/sh fi fi if [ -x "/bin/dash" ] && [ ! -L "/bin/dash" ]; then if [ -L "/usr/bin/sh" ]; then ln -sfn /bin/dash /usr/bin/sh fi if [ -L "/bin/sh" ]; then ln -sfn /bin/dash /bin/sh fi fi fi elif [ -x "/bin/bash" ] || [ -x "/usr/bin/bash" ]; then if [ "${_WEB_SH}" != "/bin/bash" ]; then if [ -x "/usr/bin/bash" ] && [ ! -L "/usr/bin/bash" ]; then if [ -L "/usr/bin/sh" ]; then ln -sfn /usr/bin/bash /usr/bin/sh fi if [ -L "/bin/sh" ]; then ln -sfn /usr/bin/bash /bin/sh fi fi if [ -x "/bin/bash" ] && [ ! -L "/bin/bash" ]; then if [ -L "/usr/bin/sh" ]; then ln -sfn /bin/bash /usr/bin/sh fi if [ -L "/bin/sh" ]; then ln -sfn /bin/bash /bin/sh fi fi fi fi fi _RAM_AUTO_FILE="/sys/devices/system/memory/auto_online_blocks" if [ -f "${_RAM_AUTO_FILE}" ]; then if grep -qx offline "${_RAM_AUTO_FILE}"; then echo online > "${_RAM_AUTO_FILE}" fi fi for _CPU_DIR in /sys/devices/system/cpu/cpu[0-9]* do _CPU=${_CPU_DIR##*/} _CPU_STATE_FILE="${_CPU_DIR}/online" if [ -f "${_CPU_STATE_FILE}" ]; then if grep -qx 0 "${_CPU_STATE_FILE}"; then echo 1 > "${_CPU_STATE_FILE}" fi fi done for _RAM_DIR in /sys/devices/system/memory/memory[0-9]* do _RAM=${_RAM_DIR##*/} _RAM_STATE_FILE="${_RAM_DIR}/state" if [ -f "${_RAM_STATE_FILE}" ]; then if grep -qx offline "${_RAM_STATE_FILE}"; then echo online > "${_RAM_STATE_FILE}" fi fi done if [ -e "/root/.run-to-excalibur.cnf" ]; then if [ -x "/opt/local/bin/autoexcalibur" ]; then nohup /opt/local/bin/autoexcalibur > /dev/null 2>&1 & fi elif [ -e "/root/.run-to-daedalus.cnf" ]; then if [ -x "/opt/local/bin/autodaedalus" ]; then nohup /opt/local/bin/autodaedalus > /dev/null 2>&1 & fi elif [ -e "/root/.run-to-chimaera.cnf" ]; then if [ -x "/opt/local/bin/autochimaera" ]; then nohup /opt/local/bin/autochimaera > /dev/null 2>&1 & fi elif [ -e "/root/.run-to-beowulf.cnf" ]; then if [ -x "/opt/local/bin/autobeowulf" ]; then nohup /opt/local/bin/autobeowulf > /dev/null 2>&1 & fi fi touch $PIDFILE [ -e "/run/boa_wait.pid" ] && rm -f /run/boa_wait.pid [ -e "/run/boa_run.pid" ] && rm -f /run/boa_run.pid [ -e "/run/manage_ltd_users.pid" ] && rm -f /run/manage_ltd_users.pid [ -e "/run/daily-fix.pid" ] && rm -f /run/daily-fix.pid [ -e "/run/boa_cron_wait.pid" ] && rm -f /run/boa_cron_wait.pid ;; stop) echo -n "Stopping $DESC: " if [ -L "/bin/sh" ]; then _WEB_SH="$(readlink -n /bin/sh)" if [ -x "/bin/dash" ]; then if [ "${_WEB_SH}" != "/bin/dash" ]; then ln -sfn /bin/dash /bin/sh if [ -e "/usr/bin/sh" ]; then ln -sfn /bin/dash /usr/bin/sh fi fi else if [ "${_WEB_SH}" != "/bin/bash" ]; then ln -sfn /bin/bash /bin/sh if [ -e "/usr/bin/sh" ]; then ln -sfn /bin/bash /usr/bin/sh fi fi fi fi _REBOOT_ONE_TEST=$(ls -la /root/.run-auto-major-os-reboot*-one.cnf 2>&1) _REBOOT_TWO_TEST=$(ls -la /root/.run-auto-major-os-reboot*-two.cnf 2>&1) if [[ "${_REBOOT_ONE_TEST}" =~ "No such file" ]] \ && [[ "${_REBOOT_TWO_TEST}" =~ "No such file" ]]; then service cron stop &> /dev/null killall cron &> /dev/null pkill -9 -f second.sh pkill -9 -f runner.sh pkill -9 -f minute.sh echo "Cron has been stopped" if [ ! -e "/root/.allow.clamav.cnf" ] || [ -e "/root/.deny.clamav.cnf" ]; then if [ -e "/etc/init.d/clamav-daemon" ]; then update-rc.d -f clamav-daemon remove &> /dev/null fi if [ -e "/etc/init.d/clamav-freshclam" ]; then update-rc.d -f clamav-freshclam remove &> /dev/null fi fi pkill -9 -f avahi-daemon pkill -9 -f clamd pkill -9 -f freshclam pkill -9 -f java rm -f /run/clamav/* echo "Java/Solr/Clamav have been stopped" service nginx stop &> /dev/null killall nginx &> /dev/null killall php &> /dev/null pkill -9 -f php-fpm echo "Nginx, PHP-CLI and PHP-FPM have been stopped" csf -df &> /dev/null csf -tf &> /dev/null echo "Firewall has been purged" if [ -e "/root/.my.pass.txt" ]; then _SQL_PSWD=$(cat /root/.my.pass.txt 2>/dev/null | tr -d '\n') _IS_MYSQLD_RUNNING=$(pgrep -f /usr/sbin/mysqld) if [ ! -z "${_IS_MYSQLD_RUNNING}" ] && [ ! -z "${_SQL_PSWD}" ]; then echo "Preparing MySQLD for quick shutdown..." _DBS_TEST="$(which mysql)" if [ ! -z "${_DBS_TEST}" ]; then _DB_SERVER_TEST=$(mysql -V 2>&1) fi if [[ "${_DB_SERVER_TEST}" =~ "Ver 8.4." ]]; then _DB_V=8.4 elif [[ "${_DB_SERVER_TEST}" =~ "Ver 8.0." ]]; then _DB_V=8.0 elif [[ "${_DB_SERVER_TEST}" =~ "Distrib 5.7." ]]; then _DB_V=5.7 fi mysql -u root -e "SET GLOBAL innodb_max_dirty_pages_pct = 0;" &> /dev/null mysql -u root -e "SET GLOBAL innodb_change_buffering = 'none';" &> /dev/null mysql -u root -e "SET GLOBAL innodb_buffer_pool_dump_at_shutdown = 1;" &> /dev/null mysql -u root -e "SET GLOBAL innodb_io_capacity=3000;" &> /dev/null mysql -u root -e "SET GLOBAL innodb_io_capacity_max=6000;" &> /dev/null if [ "${_DB_V}" = "5.7" ]; then mysql -u root -e "SET GLOBAL innodb_buffer_pool_dump_pct = 100;" &> /dev/null mysql -u root -e "SET GLOBAL innodb_buffer_pool_dump_now = ON;" &> /dev/null fi mysql -u root -e "SET GLOBAL innodb_fast_shutdown = 1;" &> /dev/null echo "Stopping MySQLD now..." service mysql stop &> /dev/null wait echo "MySQLD stopped" else echo "MySQLD already stopped" fi fi fi [ -e "/run/boa_wait.pid" ] && rm -f /run/boa_wait.pid [ -e "/run/boa_run.pid" ] && rm -f /run/boa_run.pid [ -e "/run/manage_ltd_users.pid" ] && rm -f /run/manage_ltd_users.pid [ -e "/run/daily-fix.pid" ] && rm -f /run/daily-fix.pid [ -e "/run/boa_cron_wait.pid" ] && rm -f /run/boa_cron_wait.pid rm -f $PIDFILE ;; restart|force-reload) ${0} stop ${0} start ;; *) echo "Usage: service $NAME {start|stop|restart|force-reload}" >&2 exit 0 ;; esac exit 0 ================================================ FILE: aegir/conf/var/crossdomain.xml ================================================ ================================================ FILE: aegir/conf/var/csf.conf ================================================ ############################################################################### # SECTION:Initial Settings ############################################################################### # Testing flag - enables a CRON job that clears iptables incase of # configuration problems when you start csf. This should be enabled until you # are sure that the firewall works - i.e. incase you get locked out of your # server! Then do remember to set it to 0 and restart csf when you're sure # everything is OK. Stopping csf will remove the line from /etc/crontab # # lfd will not start while this is enabled TESTING = "0" # The interval for the crontab in minutes. Since this uses the system clock the # CRON job will run at the interval past the hour and not from when you issue # the start command. Therefore an interval of 5 minutes means the firewall # will be cleared in 0-5 minutes from the firewall start TESTING_INTERVAL = "5" # SECURITY WARNING # ================ # # Unfortunately, syslog and rsyslog allow end-users to log messages to some # system logs via the same unix socket that other local services use. This # means that any log line shown in these system logs that syslog or rsyslog # maintain can be spoofed (they are exactly the same as real log lines). # # Since some of the features of lfd rely on such log lines, spoofed messages # can cause false-positive matches which can lead to confusion at best, or # blocking of any innocent IP address or making the server inaccessible at # worst. # # Any option that relies on the log entries in the files listed in # /etc/syslog.conf and /etc/rsyslog.conf should therefore be considered # vulnerable to exploitation by end-users and scripts run by end-users. # # NOTE: Not all log files are affected as they may not use syslog/rsyslog # # The option RESTRICT_SYSLOG disables all these features that rely on affected # logs. These options are: # LF_SSHD LF_FTPD LF_IMAPD LF_POP3D LF_BIND LF_SUHOSIN LF_SSH_EMAIL_ALERT # LF_SU_EMAIL_ALERT LF_CONSOLE_EMAIL_ALERT LF_DISTATTACK LF_DISTFTP # LT_POP3D LT_IMAPD PS_INTERVAL UID_INTERVAL WEBMIN_LOG LF_WEBMIN_EMAIL_ALERT # PORTKNOCKING_ALERT LF_SUDO_EMAIL_ALERT # # This list of options use the logs but are not disabled by RESTRICT_SYSLOG: # ST_ENABLE SYSLOG_CHECK LOGSCANNER CUSTOM*_LOG # # The following options are still enabled by default on new installations so # that, on balance, csf/lfd still provides expected levels of security: # LF_SSHD LF_FTPD LF_POP3D LF_IMAPD LF_SSH_EMAIL_ALERT LF_SU_EMAIL_ALERT # # If you set RESTRICT_SYSLOG to "0" or "2" and enable any of the options listed # above, it should be done with the knowledge that any of the those options # that are enabled could be triggered by spoofed log lines and lead to the # server being inaccessible in the worst case. If you do not want to take that # risk you should set RESTRICT_SYSLOG to "1" and those features will not work # but you will not be protected from the exploits that they normally help block # # The recommended setting for RESTRICT_SYSLOG is "3" to restrict who can access # the syslog/rsyslog unix socket. # # For further advice on how to help mitigate these issues, see # /etc/csf/readme.txt # # 0 = Allow those options listed above to be used and configured # 1 = Disable all the options listed above and prevent them from being used # 2 = Disable only alerts about this feature and do nothing else # 3 = Restrict syslog/rsyslog access to RESTRICT_SYSLOG_GROUP ** RECOMMENDED ** RESTRICT_SYSLOG = "3" # The following setting is used if RESTRICT_SYSLOG is set to 3. It restricts # write access to the syslog/rsyslog unix socket(s). The group must not already # exists in /etc/group before setting RESTRICT_SYSLOG to 3, so set the option # to a unique name for the server # # You can add users to this group by changing /etc/csf/csf.syslogusers and then # restarting lfd afterwards. This will create the system group and add the # users from csf.syslogusers if they exist to that group and will change the # permissions on the syslog/rsyslog unix socket(s). The socket(s) will be # monitored and the permissions re-applied should syslog/rsyslog be restarted # # Using this option will prevent some legitimate logging, e.g. end-user cron # job logs # # If you want to revert RESTRICT_SYSLOG to another option and disable this # feature, change the setting of RESTRICT_SYSLOG and then restart lfd and then # syslog/rsyslog and the unix sockets will be reset RESTRICT_SYSLOG_GROUP = "mysyslog" # This options restricts the ability to modify settings within this file from # the csf UI. Should the parent control panel be compromised, these restricted # options could be used to further compromise the server. For this reason we # recommend leaving this option set to at least "1" and if any of the # restricted items need to be changed, they are done so from the root shell # # 0 = Unrestricted UI # 1 = Restricted UI # 2 = Disabled UI RESTRICT_UI = "1" # Enabling auto updates creates a cron job called /etc/cron.d/csf_update which # runs once per day to see if there is an update to csf+lfd and upgrades if # available and restarts csf and lfd # # You should check for new version announcements at http://blog.configserver.com AUTO_UPDATES = "0" ############################################################################### # SECTION:IPv4 Port Settings ############################################################################### # Lists of ports in the following comma separated lists can be added using a # colon (e.g. 30000:35000). # Some kernel/iptables setups do not perform stateful connection tracking # correctly (typically some virtual servers or custom compiled kernels), so a # SPI firewall will not function correctly. If this happens, LF_SPI can be set # to 0 to reconfigure csf as a static firewall. # # As connection tracking will not be configured, applications that rely on it # will not function unless all outgoing ports are opened. Therefore, all # outgoing connections will be allowed once all other tests have completed. So # TCP_OUT, UDP_OUT and ICMP_OUT will not have any affect. # # If you allow incoming DNS lookups you may need to use the following # directive in the options{} section of your named.conf: # # query-source port 53; # # This will force incoming DNS traffic only through port 53 # # Disabling this option will break firewall functionality that relies on # stateful packet inspection (e.g. DNAT, PACKET_FILTER) and makes the firewall # less secure # # This option should be set to "1" in all other circumstances LF_SPI = "1" # Allow incoming TCP ports TCP_IN = "20,21,22,24,53,80,110,143,443,465,587,993,995,2401,5280,9418,30000:50000" # Allow outgoing TCP ports TCP_OUT = "20,21,22,25,53,80,110,143,222,389,443,465,587,636,873,993,995,1129,1935,2195,2222,2401,2525,3268,3306,5280,5432,8081,8443,9418,9998,11371,27017,30000:50000,5201:5210" # Allow incoming UDP ports UDP_IN = "20,21,53,123,33434:33523,443" # Allow outgoing UDP ports # To allow outgoing traceroute add 33434:33523 to this list UDP_OUT = "20,21,53,123,33434:33523" # Allow incoming PING. Disabling PING will likely break external uptime # monitoring ICMP_IN = "1" # Set the per IP address incoming ICMP packet rate for PING requests. This # ratelimits PING requests which if exceeded results in silently rejected # packets. Disable or increase this value if you are seeing PING drops that you # do not want # # To disable rate limiting set to "0", otherwise set according to the iptables # documentation for the limit module. For example, "1/s" will limit to one # packet per second ICMP_IN_RATE = "1/s" # Allow outgoing PING # # Unless there is a specific reason, this option should NOT be disabled as it # could break OS functionality ICMP_OUT = "1" # Set the per IP address outgoing ICMP packet rate for PING requests. This # ratelimits PING requests which if exceeded results in silently rejected # packets. Disable or increase this value if you are seeing PING drops that you # do not want # # Unless there is a specific reason, this option should NOT be enabled as it # could break OS functionality # # To disable rate limiting set to "0", otherwise set according to the iptables # documentation for the limit module. For example, "1/s" will limit to one # packet per second ICMP_OUT_RATE = "1/s" # For those with PCI Compliance tools that state that ICMP timestamps (type 13) # should be dropped, you can enable the following option. Otherwise, there # appears to be little evidence that it has anything to do with a security risk # and can impact network performance, so should be left disabled by everyone # else ICMP_TIMESTAMPDROP = "0" ############################################################################### # SECTION:IPv6 Port Settings ############################################################################### # IPv6: (Requires ip6tables) # # Pre v2.6.20 kernels do not perform stateful connection tracking, so a static # firewall is configured as a fallback instead if IPV6_SPI is set to 0 below # # Supported: # Temporary ACCEPT/DENY, GLOBAL_DENY, GLOBAL_ALLOW, SMTP_BLOCK, LF_PERMBLOCK, # PACKET_FILTER, Advanced Allow/Deny Filters, RELAY_*, CLUSTER_*, CC6_LOOKUPS, # SYNFLOOD, LF_NETBLOCK # # Supported if CC6_LOOKUPS and CC_LOOKUPS are enabled # CC_DENY, CC_ALLOW, CC_ALLOW_FILTER, CC_IGNORE, CC_ALLOW_PORTS, CC_DENY_PORTS, # CC_ALLOW_SMTPAUTH # # Supported if ip6tables >= 1.4.3: # PORTFLOOD, CONNLIMIT # # Supported if ip6tables >= 1.4.17 and perl module IO::Socket::INET6 is # installed: # MESSENGER DOCKER SMTP_REDIRECT # # Not supported: # ICMP_IN, ICMP_OUT # IPV6 = "1" # IPv6 uses icmpv6 packets very heavily. By default, csf will allow all icmpv6 # traffic in the INPUT and OUTPUT chains. However, this could increase the risk # of icmpv6 attacks. To restrict incoming icmpv6, set to "1" but may break some # connection types IPV6_ICMP_STRICT = "1" # Pre v2.6.20 kernel must set this option to "0" as no working state module is # present, so a static firewall is configured as a fallback # # A workaround has been added for CentOS/RedHat v5 and custom kernels that do # not support IPv6 connection tracking by opening ephemeral port range # 32768:61000. This is only applied if IPV6_SPI is not enabled. This is the # same workaround implemented by RedHat in the sample default IPv6 rules # # As connection tracking will not be configured, applications that rely on it # will not function unless all outgoing ports are opened. Therefore, all # outgoing connections will be allowed once all other tests have completed. So # TCP6_OUT, UDP6_OUT and ICMP6_OUT will not have any affect. # # If you allow incoming ipv6 DNS lookups you may need to use the following # directive in the options{} section of your named.conf: # # query-source-v6 port 53; # # This will force ipv6 incoming DNS traffic only through port 53 # # These changes are not necessary if the SPI firewall is used IPV6_SPI = "1" # Allow incoming IPv6 TCP ports TCP6_IN = "53" # Allow outgoing IPv6 TCP ports TCP6_OUT = "53" # Allow incoming IPv6 UDP ports UDP6_IN = "53" # Allow outgoing IPv6 UDP ports # To allow outgoing traceroute add 33434:33523 to this list UDP6_OUT = "53" ############################################################################### # SECTION:General Settings ############################################################################### # By default, csf will auto-configure iptables to filter all traffic except on # the loopback device. If you only want iptables rules applied to a specific # NIC, then list it here (e.g. eth1, or eth+) ETH_DEVICE = "" # By adding a device to this option, ip6tables can be configured only on the # specified device. Otherwise, ETH_DEVICE and then the default setting will be # used ETH6_DEVICE = "" # If you don't want iptables rules applied to specific NICs, then list them in # a comma separated list (e.g "eth1,eth2") ETH_DEVICE_SKIP = "" # This option should be enabled unless the kernel does not support the # "conntrack" module # # To use the deprecated iptables "state" module, change this to 0 USE_CONNTRACK = "1" # Enable ftp helper via the iptables CT target on supporting kernels (v2.6.34+) # instead of the current method via /proc/sys/net/netfilter/nf_conntrack_helper # This will also remove the RELATED target from the global state iptables rule # # This is not needed (and will be ignored) if LF_SPI/IPV6_SPI is disabled or # the raw tables do not exist. The USE_CONNTRACK option should be enabled # # To enable this option, set it to your FTP server listening port number # (normally 21), do NOT set it to "1" USE_FTPHELPER = "0" # Check whether syslog is running. Many of the lfd checks require syslog to be # running correctly. This test will send a coded message to syslog every # SYSLOG_CHECK seconds. lfd will check SYSLOG_LOG log lines for the coded # message. If it fails to do so within SYSLOG_CHECK seconds an alert using # syslogalert.txt is sent # # A value of between 300 and 3600 seconds is suggested. Set to 0 to disable SYSLOG_CHECK = "0" # Enable this option if you want lfd to ignore (i.e. don't block) IP addresses # listed in csf.allow in addition to csf.ignore (the default). This option # should be used with caution as it would mean that IP's allowed through the # firewall from infected PC's could launch attacks on the server that lfd # would ignore IGNORE_ALLOW = "0" # Enable the following option if you want to apply strict iptables rules to DNS # traffic (i.e. relying on iptables connection tracking). Enabling this option # could cause DNS resolution issues both to and from the server but could help # prevent abuse of the local DNS server DNS_STRICT = "0" # Enable the following option if you want to apply strict iptables rules to DNS # traffic between the server and the nameservers listed in /etc/resolv.conf # Enabling this option could cause DNS resolution issues both to and from the # server but could help prevent abuse of the local DNS server DNS_STRICT_NS = "0" # Limit the number of IP's kept in the /etc/csf/csf.deny file # # Care should be taken when increasing this value on servers with low memory # resources or hard limits (such as Virtuozzo/OpenVZ) as too many rules (in the # thousands) can sometimes cause network slowdown # # The value set here is the maximum number of IPs/CIDRs allowed # if the limit is reached, the entries will be rotated so that the oldest # entries (i.e. the ones at the top) will be removed and the latest is added. # The limit is only checked when using csf -d (which is what lfd also uses) # Set to 0 to disable limiting # # For implementations wishing to set this value significantly higher, we # recommend using the IPSET option DENY_IP_LIMIT = "9000" # Limit the number of IP's kept in the temprary IP ban list. If the limit is # reached the oldest IP's in the ban list will be removed and allowed # regardless of the amount of time remaining for the block # Set to 0 to disable limiting DENY_TEMP_IP_LIMIT = "300" # Enable login failure detection daemon (lfd). If set to 0 none of the # following settings will have any effect as the daemon won't start. LF_DAEMON = "1" # Check whether csf appears to have been stopped and restart if necessary, # unless TESTING is enabled above. The check is done every 300 seconds LF_CSF = "1" # This option uses IPTABLES_SAVE, IPTABLES_RESTORE and IP6TABLES_SAVE, # IP6TABLES_RESTORE in two ways: # # 1. On a clean server reboot the entire csf iptables configuration is saved # and then restored where possible to provide a near instant firewall # startup[*] # # 2. On csf restart or lfd reloading tables, CC_* as well as SPAMHAUS, DSHIELD, # BOGON, TOR are loaded using this method in a fraction of the time than if # this setting is disabled # # [*]Not supported on all OS platforms # # Set to "0" to disable this functionality FASTSTART = "0" # This option allows you to use ipset v6+ for the following csf options: # CC_* and /etc/csf/csf.blocklist, /etc/csf/csf.allow, /etc/csf/csf.deny, # GLOBAL_DENY, GLOBAL_ALLOW, DYNDNS, GLOBAL_DYNDNS, MESSENGER # # ipset will only be used with the above options when listing IPs and CIDRs. # Advanced Allow Filters and temporary blocks use traditional iptables # # Using ipset moves the onus of ip matching against large lists away from # iptables rules and to a purpose built and optimised database matching # utility. It also simplifies the switching in of updated lists # # To use this option you must have a fully functioning installation of ipset # installed either via rpm or source from http://ipset.netfilter.org/ # # Note: Using ipset has many advantages, some disadvantages are that you will # no longer see packet and byte counts against IPs and it makes identifying # blocked/allowed IPs that little bit harder # # Note: If you mainly use IP address only entries in csf.deny, you can increase # the value of DENY_IP_LIMIT significantly if you wish # # Note: It's highly unlikely that ipset will function on Virtuozzo/OpenVZ # containers even if it has been installed # # If you find any problems, please post on forums.configserver.com with full # details of the issue LF_IPSET = "1" # Versions of iptables greater or equal to v1.4.20 should support the --wait # option. This forces iptables commands that use the option to wait until a # lock by any other process using iptables completes, rather than simply # failing # # Enabling this feature will add the --wait option to iptables commands # # NOTE: The disadvantage of using this option is that any iptables command that # uses it will hang until the lock is released. This could cause a cascade of # hung processes trying to issue iptables commands. To try and avoid this issue # csf uses a last ditch timeout, WAITLOCK_TIMEOUT in seconds, that will trigger # a failure if reached WAITLOCK = "1" WAITLOCK_TIMEOUT = "300" # The following sets the hashsize for ipset sets, which must be a power of 2. # # Note: Increasing this value will consume more memory for all sets # Default: "1024" LF_IPSET_HASHSIZE = "1024" # The following sets the maxelem for ipset sets. # # Note: Increasing this value will consume more memory for all sets # Default: "65536" LF_IPSET_MAXELEM = "65536" # If you enable this option then whenever a CLI request to restart csf is used # lfd will restart csf instead within LF_PARSE seconds # # This feature can be helpful for restarting configurations that cannot use # FASTSTART LFDSTART = "1" # Enable verbose output of iptables commands VERBOSE = "1" # Drop out of order packets and packets in an INVALID state in iptables # connection tracking PACKET_FILTER = "1" # Perform reverse DNS lookups on IP addresses. (See also CC_LOOKUPS) LF_LOOKUPS = "1" # Custom styling is possible in the csf UI. See the readme.txt for more # information under "UI skinning and Mobile View" # # This option enables the use of custom styling. If the styling fails to work # correctly, e.g. custom styling does not take into account a change in the # standard csf UI, then disabling this option will return the standard UI STYLE_CUSTOM = "1" # This option disables the presence of the Mobile View in the csf UI STYLE_MOBILE = "1" ############################################################################### # SECTION:SMTP Settings ############################################################################### # Block outgoing SMTP except for root, exim and mailman (forces scripts/users # to use the exim/sendmail binary instead of sockets access). This replaces the # protection as WHM > Tweak Settings > SMTP Tweaks # # This option uses the iptables ipt_owner/xt_owner module and must be loaded # for it to work. It may not be available on some VPS platforms # # Note: Run /etc/csf/csftest.pl to check whether this option will function on # this server SMTP_BLOCK = "1" # If SMTP_BLOCK is enabled but you want to allow local connections to port 25 # on the server (e.g. for webmail or web scripts) then enable this option to # allow outgoing SMTP connections to the loopback device SMTP_ALLOWLOCAL = "0" # This option redirects outgoing SMTP connections destined for remote servers # for non-bypass users to the local SMTP server to force local relaying of # email. Such email may require authentication (SMTP AUTH) SMTP_REDIRECT = "0" # This is a comma separated list of the ports to block. You should list all # ports that exim is configured to listen on SMTP_PORTS = "25" # Always allow the following comma separated users and groups to bypass # SMTP_BLOCK # # Note: root (UID:0) is always allowed SMTP_ALLOWUSER = "postfix" SMTP_ALLOWGROUP = "" # This option will only allow SMTP AUTH to be advertised to the IP addresses # listed in /etc/csf/csf.smtpauth on EXIM mail servers # # The additional option CC_ALLOW_SMTPAUTH can be used with this option to # additionally restrict access to specific countries # # This is to help limit attempts at distributed attacks against SMTP AUTH which # are difficult to achive since port 25 needs to be open to relay email # # The reason why this works is that if EXIM does not advertise SMTP AUTH on a # connection, then SMTP AUTH will not accept logins, defeating the attacks # without restricting mail relaying # # Note: csf and lfd must be restarted if /etc/csf/csf.smtpauth is modified so # that the lookup file in /etc/exim.smtpauth is regenerated from the # information from /etc/csf/csf.smtpauth plus any countries listed in # CC_ALLOW_SMTPAUTH # # NOTE: To make this option work you MUST make the modifications to exim.conf # as explained in "Exim SMTP AUTH Restriction" section in /etc/csf/readme.txt # after enabling the option here, otherwise this option will not work # # To enable this option, set to 1 and make the exim configuration changes # To disable this option, set to 0 and undo the exim configuration changes SMTPAUTH_RESTRICT = "0" ############################################################################### # SECTION:Port Flood Settings ############################################################################### # Enable SYN Flood Protection. This option configures iptables to offer some # protection from tcp SYN packet DOS attempts. You should set the RATE so that # false-positives are kept to a minimum otherwise visitors may see connection # issues (check /var/log/messages for *SYNFLOOD Blocked*). See the iptables # man page for the correct --limit rate syntax # # Note: This option should ONLY be enabled if you know you are under a SYN # flood attack as it will slow down all new connections from any IP address to # the server if triggered SYNFLOOD = "0" SYNFLOOD_RATE = "100/s" SYNFLOOD_BURST = "150" # Connection Limit Protection. This option configures iptables to offer more # protection from DOS attacks against specific ports. It can also be used as a # way to simply limit resource usage by IP address to specific server services. # This option limits the number of concurrent new connections per IP address # that can be made to specific ports # # This feature does not work on servers that do not have the iptables module # xt_connlimit loaded. Typically, this will be with MONOLITHIC kernels. VPS # server admins should check with their VPS host provider that the iptables # module is included # # For further information and syntax refer to the Connection Limit Protection # section of the csf readme.txt # # Note: Run /etc/csf/csftest.pl to check whether this option will function on # this server CONNLIMIT = "24;99,22;99,80;9999,443;9999,53;99" # Port Flood Protection. This option configures iptables to offer protection # from DOS attacks against specific ports. This option limits the number of # new connections per time interval that can be made to specific ports # # This feature does not work on servers that do not have the iptables module # ipt_recent loaded. Typically, this will be with MONOLITHIC kernels. VPS # server admins should check with their VPS host provider that the iptables # module is included # # For further information and syntax refer to the Port Flood Protection # section of the csf readme.txt # # Note: Run /etc/csf/csftest.pl to check whether this option will function on # this server PORTFLOOD = "24;tcp;99;60,22;tcp;99;60,1433;tcp;1;900" # Outgoing UDP Flood Protection. This option limits outbound UDP packet floods. # These typically originate from exploit scripts uploaded through vulnerable # web scripts. Care should be taken on servers that use services that utilise # high levels of UDP outbound traffic, such as SNMP, so you may need to alter # the UDPFLOOD_LIMIT and UDPFLOOD_BURST options to suit your environment # # We recommend enabling User ID Tracking (UID_INTERVAL) with this feature UDPFLOOD = "0" UDPFLOOD_LIMIT = "100/s" UDPFLOOD_BURST = "500" # This is a list of usernames that should not be rate limited, such as "named" # to prevent bind traffic from being limited. # # Note: root (UID:0) is always allowed UDPFLOOD_ALLOWUSER = "named" ############################################################################### # SECTION:Logging Settings ############################################################################### # Log lfd messages to SYSLOG in addition to /var/log/lfd.log. You must have the # perl module Sys::Syslog installed to use this feature SYSLOG = "0" # Drop target for incoming iptables rules. This can be set to either DROP or # REJECT. REJECT will send back an error packet, DROP will not respond at all. # REJECT is more polite, however it does provide extra information to a hacker # and lets them know that a firewall is blocking their attempts. DROP hangs # their connection, thereby frustrating attempts to port scan the server DROP = "DROP" # Drop target for outgoing iptables rules. This can be set to either DROP or # REJECT as with DROP, however as such connections are from this server it is # better to REJECT connections to closed ports rather than to DROP them. This # helps to immediately free up server resources rather than tying them up until # a connection times out. It also tells the process making the connection that # it has immediately failed # # It is possible that some monolithic kernels may not support the REJECT # target. If this is the case, csf checks before using REJECT and falls back to # using DROP, issuing a warning to set this to DROP instead DROP_OUT = "REJECT" # Enable logging of dropped connections to blocked ports to syslog, usually # /var/log/messages. This option needs to be enabled to use Port Scan Tracking DROP_LOGGING = "1" # Enable logging of dropped incoming connections from blocked IP addresses # # This option will be disabled if you enable Port Scan Tracking (PS_INTERVAL) DROP_IP_LOGGING = "0" # Enable logging of dropped outgoing connections # # Note: Only outgoing SYN packets for TCP connections are logged, other # protocols log all packets # # We recommend that you enable this option DROP_OUT_LOGGING = "1" # Together with DROP_OUT_LOGGING enabled, this option logs the UID connecting # out (where available) which can help track abuse DROP_UID_LOGGING = "1" # Only log incoming reserved port dropped connections (0:1023). This can reduce # the amount of log noise from dropped connections, but will affect options # such as Port Scan Tracking (PS_INTERVAL) DROP_ONLYRES = "0" # Commonly blocked ports that you do not want logging as they tend to just fill # up the log file. These ports are specifically blocked (applied to TCP and UDP # protocols) for incoming connections DROP_NOLOG = "67,68,111,113,135:139,445,500,513,520" # Log packets dropped by the packet filtering option PACKET_FILTER DROP_PF_LOGGING = "0" # Log packets dropped by the Connection Limit Protection option CONNLIMIT. If # this is enabled and Port Scan Tracking (PS_INTERVAL) is also enabled, IP # addresses breaking the Connection Limit Protection will be blocked CONNLIMIT_LOGGING = "0" # Enable logging of UDP floods. This should be enabled, especially with User ID # Tracking enabled UDPFLOOD_LOGGING = "1" # Send an alert if log file flooding is detected which causes lfd to skip log # lines to prevent lfd from looping. If this alert is sent you should check the # reported log file for the reason for the flooding LOGFLOOD_ALERT = "1" ############################################################################### # SECTION:Reporting Settings ############################################################################### # By default, lfd will send alert emails using the relevant alert template to # the To: address configured within that template. Setting the following # option will override the configured To: field in all lfd alert emails # # Leave this option empty to use the To: field setting in each alert template LF_ALERT_TO = "notify@omega8.cc" # By default, lfd will send alert emails using the relevant alert template from # the From: address configured within that template. Setting the following # option will override the configured From: field in all lfd alert emails # # Leave this option empty to use the From: field setting in each alert template LF_ALERT_FROM = "" # By default, lfd will send all alerts using the SENDMAIL binary. To send using # SMTP directly, you can set the following to a relaying SMTP server, e.g. # "127.0.0.1". Leave this setting blank to use SENDMAIL LF_ALERT_SMTP = "" # Block Reporting. lfd can run an external script when it performs and IP # address block following for example a login failure. The following setting # is to the full path of the external script which must be executable. See # readme.txt for format details # # Leave this setting blank to disable BLOCK_REPORT = "" # To also run an external script when a temporary block is unblocked. The # following setting can be the full path of the external script which must be # executable. See readme.txt for format details # # Leave this setting blank to disable UNBLOCK_REPORT = "" # In addition to the standard lfd email alerts, you can additionally enable the # sending of X-ARF reports (see http://www.xarf.org/specification.html). Only # block alert messages will be sent. The reports use our schema at: # https://download.configserver.com/abuse_login-attack_0.2.json # # These reports are in a format accepted by many Netblock owners and should # help them investigate abuse. This option is not designed to automatically # forward these reports to the Netblock owners and should be checked for # false-positive blocks before reporting # # If available, the report will also include the abuse contact for the IP from # the Abusix Contact DB: https://abusix.com/contactdb.html # # Note: The following block types are not reported through this feature: # LF_PERMBLOCK, LF_NETBLOCK, LF_DISTATTACK, LF_DISTFTP, RT_*_ALERT X_ARF = "0" # By default, lfd will send emails from the root forwarder. Setting the # following option will override this X_ARF_FROM = "" # By default, lfd will send emails to the root forwarder. Setting the following # option will override this X_ARF_TO = "notify@omega8.cc" # If you want to automatically send reports to the abuse contact where found, # you can enable the following option # # Note: You MUST set X_ARF_FROM to a valid email address for this option to # work. This is so that the abuse contact can reply to the report # # However, you should be aware that without manual checking you could be # reporting innocent IP addresses, including your own clients, yourself and # your own servers # # Additionally, just because a contact address is found, does not mean that # there is anyone on the end of it reading, processing or acting on such # reports and you could conceivably reported for sending spam # # We do not recommend enabling this option. Abuse reports should be checked and # verified before being forwarded to the abuse contact X_ARF_ABUSE = "0" ############################################################################### # SECTION:Temp to Perm/Netblock Settings ############################################################################### # Temporary to Permanent IP blocking. The following enables this feature to # permanently block IP addresses that have been temporarily blocked more than # LF_PERMBLOCK_COUNT times in the last LF_PERMBLOCK_INTERVAL seconds. Set # LF_PERMBLOCK to "1" to enable this feature # # Care needs to be taken when setting LF_PERMBLOCK_INTERVAL as it needs to be # at least LF_PERMBLOCK_COUNT multiplied by the longest temporary time setting # (TTL) for blocked IPs, to be effective # # Set LF_PERMBLOCK to "0" to disable this feature LF_PERMBLOCK = "1" LF_PERMBLOCK_INTERVAL = "86400" LF_PERMBLOCK_COUNT = "4" LF_PERMBLOCK_ALERT = "0" # Permanently block IPs by network class. The following enables this feature # to permanently block classes of IP address where individual IP addresses # within the same class LF_NETBLOCK_CLASS have already been blocked more than # LF_NETBLOCK_COUNT times in the last LF_NETBLOCK_INTERVAL seconds. Set # LF_NETBLOCK to "1" to enable this feature # # This can be an affective way of blocking DDOS attacks launched from within # the same network class # # Valid settings for LF_NETBLOCK_CLASS are "A", "B" and "C", care and # consideration is required when blocking network classes A or B # # Set LF_NETBLOCK to "0" to disable this feature LF_NETBLOCK = "1" LF_NETBLOCK_INTERVAL = "86400" LF_NETBLOCK_COUNT = "4" LF_NETBLOCK_CLASS = "C" LF_NETBLOCK_ALERT = "0" # Valid settings for LF_NETBLOCK_IPV6 are "/64", "/56", "/48", "/32" and "/24" # Great care should be taken with IPV6 netblock ranges due to the large number # of addresses involved # # To disable IPv6 netblocks set to "" LF_NETBLOCK_IPV6 = "" ############################################################################### # SECTION:Global Lists/DYNDNS/Blocklists ############################################################################### # Safe Chain Update. If enabled, all dynamic update chains (GALLOW*, GDENY*, # SPAMHAUS, DSHIELD, BOGON, CC_ALLOW, CC_DENY, ALLOWDYN*) will create a new # chain when updating, and insert it into the relevant LOCALINPUT/LOCALOUTPUT # chain, then flush and delete the old dynamic chain and rename the new chain. # # This prevents a small window of opportunity opening when an update occurs and # the dynamic chain is flushed for the new rules. # # This option should not be enabled on servers with long dynamic chains (e.g. # CC_DENY/CC_ALLOW lists) and low memory. It should also not be enabled on # Virtuozzo VPS servers with a restricted numiptent value. This is because each # chain will effectively be duplicated while the update occurs, doubling the # number of iptables rules SAFECHAINUPDATE = "0" # If you wish to allow access from dynamic DNS records (for example if your IP # address changes whenever you connect to the internet but you have a dedicated # dynamic DNS record from the likes of dyndns.org) then you can list the FQDN # records in csf.dyndns and then set the following to the number of seconds to # poll for a change in the IP address. If the IP address has changed iptables # will be updated. # # If the FQDN has multiple A records then all of the IP addresses will be # processed. If IPV6 is enabled, then all IPv6 AAAA IP address records will # also be allowed. # # A setting of 600 would check for IP updates every 10 minutes. Set the value # to 0 to disable the feature DYNDNS = "0" # To always ignore DYNDNS IP addresses in lfd blocking, set the following # option to 1 DYNDNS_IGNORE = "0" # The follow Global options allow you to specify a URL where csf can grab a # centralised copy of an IP allow or deny block list of your own. You need to # specify the full URL in the following options, i.e.: # http://www.somelocation.com/allow.txt # # The actual retrieval of these IP's is controlled by lfd, so you need to set # LF_GLOBAL to the interval (in seconds) when you want lfd to retrieve. lfd # will perform the retrieval when it runs and then again at the specified # interval. A sensible interval would probably be every 3600 seconds (1 hour). # A minimum value of 300 is enforced for LF_GLOBAL if enabled # # You do not have to specify both an allow and a deny file # # You can also configure a global ignore file for IP's that lfd should ignore LF_GLOBAL = "0" GLOBAL_ALLOW = "" GLOBAL_DENY = "" GLOBAL_IGNORE = "" # Provides the same functionality as DYNDNS but with a GLOBAL URL file. Set # this to the URL of the file containing DYNDNS entries GLOBAL_DYNDNS = "" # Set the following to the number of seconds to poll for a change in the IP # address resoved from GLOBAL_DYNDNS GLOBAL_DYNDNS_INTERVAL = "600" # To always ignore GLOBAL_DYNDNS IP addresses in lfd blocking, set the following # option to 1 GLOBAL_DYNDNS_IGNORE = "0" # Blocklists are controlled by modifying /etc/csf/csf.blocklists # # If you don't want BOGON rules applied to specific NICs, then list them in # a comma separated list (e.g "eth1,eth2") LF_BOGON_SKIP = "" # The following option can be used to select the method csf will use to # retrieve URL data and files # # This can be set to use: # # 1. Perl module HTTP::Tiny # 2. Perl module LWP::UserAgent # 3. CURL/WGET (set location at the bottom of csf.conf if installed) # # HTTP::Tiny is much faster than LWP::UserAgent and is included in the csf # distribution. LWP::UserAgent may have to be installed manually, but it can # better support https:// URL's which also needs the LWP::Protocol::https perl # module # # CURL/WGET uses the system binaries if installed but does not always provide # good feedback when it fails. The script will first look for CURL, if that # does not exist at the configured location it will then look for WGET # # Additionally, 1 or 2 are used and the retrieval fails, then if either CURL or # WGET are available, an additional attempt will be using CURL/WGET. This is # useful if the perl distribution has outdated modules that do not support # modern SSL/TLS implementations # # To install the LWP perl modules required: # # On rpm based systems: # # yum install perl-libwww-perl.noarch perl-LWP-Protocol-https.noarch # # On APT based systems: # # apt-get install libwww-perl liblwp-protocol-https-perl # # Via cpan: # # perl -MCPAN -eshell # cpan> install LWP LWP::Protocol::https # # We recommend setting this set to "2" or "3" as upgrades to csf will be # performed over SSL as well as other URLs used when retrieving external data # # "1" = HTTP::Tiny # "2" = LWP::UserAgent # "3" = CURL/WGET (set location at the bottom of csf.conf) URLGET = "1" # If you need csf/lfd to use a proxy, then you can set this option to the URL # of the proxy. The proxy provided will be used for both HTTP and HTTPS # connections URLPROXY = "" ############################################################################### # SECTION:Country Code Lists and Settings ############################################################################### # Country Code to CIDR allow/deny. In the following options you can allow or # deny whole country CIDR ranges. The CIDR blocks are obtained from a selected # source below. They also display Country Code Country and City for reported IP # addresses and lookups # # There are a number of sources for these databases, before utilising them you # need to visit each site and ensure you abide by their license provisions # where stated: # 1. MaxMind # # MaxMind GeoLite2 Country/City and ASN databases at: # https://dev.MaxMind.com/geoip/geoip2/geolite2/ # This feature relies entirely on that service being available # # Advantages: This is a one stop shop for all of the databases required for # these features. They provide a consistent dataset for blocking and reporting # purposes # # Disadvantages: MaxMind require a license key to download their databases. # This is free of charge, but requires the user to create an account on their # website to generate the required key: # # WARNING: As of 2019-12-29, MaxMind REQUIRES you to create an account on their # site and to generate a license key to use their databases. See: # https://www.maxmind.com/en/geolite2/signup # https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-geolite2-databases/ # # You MUST set the following to continue using the IP lookup features of csf, # otherwise an error will be generated and the features will not work. # Alternatively set CC_SRC below to a different provider # # MaxMind License Key: MM_LICENSE_KEY = "" # 2. DB-IP, ipdeny.com, iptoasn.com # # Advantages: The ipdeny.com databases form CC blocking are better optimised # and so are quicker to process and create fewer iptables entries. All of these # databases are free to download without requiring login or key # # Disadvantages: Multiple sources mean that any one of the three could # interrupt the provision of these features. It may also mean that there are # inconsistences between them # # https://db-ip.com/db/lite.php # http://ipdeny.com/ # https://iptoasn.com/ # http://download.geonames.org/export/dump/readme.txt # Set the following to your preferred source: # # "1" - MaxMind # "2" - db-ip, ipdeny, iptoasn # # The default is "2" on new installations of csf, or set to "1" to use the # MaxMind databases after obtaining a license key CC_SRC = "2" # In the following options, specify the the two-letter ISO Country Code(s). # The iptables rules are for incoming connections only # # Additionally, ASN numbers can also be added to the comma separated lists # below that also list Country Codes. The same WARNINGS for Country Codes apply # to the use of ASNs. More about Autonomous System Numbers (ASN): # http://www.iana.org/assignments/as-numbers/as-numbers.xhtml # ASNs must be listed as ASnnnn (where nnnn is the ASN number) # # You should consider using LF_IPSET when using any of the following options # # WARNING: These lists are never 100% accurate and some ISP's (e.g. AOL) use # non-geographic IP address designations for their clients # # WARNING: Some of the CIDR lists are huge and each one requires a rule within # the incoming iptables chain. This can result in significant performance # overheads and could render the server inaccessible in some circumstances. For # this reason (amongst others) we do not recommend using these options # # WARNING: Due to the resource constraints on VPS servers this feature should # not be used on such systems unless you choose very small CC zones # # WARNING: CC_ALLOW allows access through all ports in the firewall. For this # reason CC_ALLOW probably has very limited use and CC_ALLOW_FILTER is # preferred # # Each option is a comma separated list of CC's, e.g. "US,GB,DE" CC_DENY = "" CC_ALLOW = "" # An alternative to CC_ALLOW is to only allow access from the following # countries but still filter based on the port and packets rules. All other # connections are dropped CC_ALLOW_FILTER = "" # This option allows access from the following countries to specific ports # listed in CC_ALLOW_PORTS_TCP and CC_ALLOW_PORTS_UDP # # Note: The rules for this feature are inserted after the allow and deny # rules to still allow blocking of IP addresses # # Each option is a comma separated list of CC's, e.g. "US,GB,DE" CC_ALLOW_PORTS = "" # All listed ports should be removed from TCP_IN/UDP_IN to block access from # elsewhere. This option uses the same format as TCP_IN/UDP_IN # # An example would be to list port 21 here and remove it from TCP_IN/UDP_IN # then only countries listed in CC_ALLOW_PORTS can access FTP CC_ALLOW_PORTS_TCP = "" CC_ALLOW_PORTS_UDP = "" # This option denies access from the following countries to specific ports # listed in CC_DENY_PORTS_TCP and CC_DENY_PORTS_UDP # # Note: The rules for this feature are inserted after the allow and deny # rules to still allow allowing of IP addresses # # Each option is a comma separated list of CC's, e.g. "US,GB,DE" CC_DENY_PORTS = "" # This option uses the same format as TCP_IN/UDP_IN. The ports listed should # NOT be removed from TCP_IN/UDP_IN # # An example would be to list port 21 here then countries listed in # CC_DENY_PORTS cannot access FTP CC_DENY_PORTS_TCP = "" CC_DENY_PORTS_UDP = "" # This Country Code list will prevent lfd from blocking IP address hits for the # listed CC's # # CC_LOOKUPS must be enabled to use this option CC_IGNORE = "" # This Country Code list will only allow SMTP AUTH to be advertised to the # listed countries in EXIM. This is to help limit attempts at distributed # attacks against SMTP AUTH which are difficult to achive since port 25 needs # to be open to relay email # # The reason why this works is that if EXIM does not advertise SMTP AUTH on a # connection, then SMTP AUTH will not accept logins, defeating the attacks # without restricting mail relaying # # This option can generate a very large list of IP addresses that could easily # severely impact on SMTP (mail) performance, so care must be taken when # selecting countries and if performance issues ensue # # The option SMTPAUTH_RESTRICT must be enabled to use this option CC_ALLOW_SMTPAUTH = "" # These options can control which IP blocks are redirected to the MESSENGER # service, if it is enabled # # If Country Codes are listed in CC_MESSENGER_ALLOW, then only a blocked IP # that resolves to one of those Country Codes will be redirected to the # MESSENGER service # # If Country Codes are listed in CC_MESSENGER_DENY, then a blocked IP that # resolves to one of those Country Codes will NOT be redirected to the # MESSENGER service # CC_MESSENGER_ALLOW = "" CC_MESSENGER_DENY = "" # Set this option to a valid CIDR (i.e. 1 to 32) to ignore CIDR blocks smaller # than this value when implementing CC_DENY/CC_ALLOW/CC_ALLOW_FILTER. This can # help reduce the number of CC entries and may improve iptables throughput. # Obviously, this will deny/allow fewer IP addresses depending on how small you # configure the option # # For example, to ignore all CIDR (and single IP) entries small than a /16, set # this option to "16". Set to "" to block all CC IP addresses CC_DROP_CIDR = "" # Display Country Code and Country for reported IP addresses. This option can # be configured to use the databases enabled at the top of this section. An # additional option is also available if you cannot use those databases: # # "0" - disable # "1" - Reports: Country Code and Country # "2" - Reports: Country Code and Country and Region and City # "3" - Reports: Country Code and Country and Region and City and ASN # "4" - Reports: Country Code and Country and Region and City (db-ip.com) # # Note: "4" does not use the databases enabled at the top of this section # directly for lookups. Instead it uses a URL-based lookup from # https://db-ip.com and so avoids having to download and process the large # databases. Please visit the https://db-ip.com and read their limitations and # understand that this option will either cease to function or be removed by us # if that site is abused or overloaded. ONLY use this option if you have # difficulties using the databases enabled at the top of this section. This # option is ONLY for IP lookups, NOT when using the CC_* options above, which # will continue to use the databases enabled at the top of this section # CC_LOOKUPS = "1" # Display Country Code and Country for reported IPv6 addresses using the # databases enabled at the top of this section # # "0" - disable # "1" - enable and report the detail level as specified in CC_LOOKUPS # # This option must also be enabled to allow IPv6 support to CC_*, MESSENGER and # PORTFLOOD CC6_LOOKUPS = "0" # This option tells lfd how often to retrieve the databases for CC_ALLOW, # CC_ALLOW_FILTER, CC_DENY, CC_IGNORE and CC_LOOKUPS (in days) CC_INTERVAL = "7" ############################################################################### # SECTION:Login Failure Blocking and Alerts ############################################################################### # The following[*] triggers are application specific. If you set LF_TRIGGER to # "0" the value of each trigger is the number of failures against that # application that will trigger lfd to block the IP address # # If you set LF_TRIGGER to a value greater than "0" then the following[*] # application triggers are simply on or off ("0" or "1") and the value of # LF_TRIGGER is the total cumulative number of failures that will trigger lfd # to block the IP address # # Setting the application trigger to "0" disables it LF_TRIGGER = "0" # If LF_TRIGGER is > "0" then LF_TRIGGER_PERM can be set to "1" to permanently # block the IP address, or LF_TRIGGER_PERM can be set to a value greater than # "1" and the IP address will be blocked temporarily for that value in seconds. # For example: # LF_TRIGGER_PERM = "1" => the IP is blocked permanently # LF_TRIGGER_PERM = "3600" => the IP is blocked temporarily for 1 hour # # If LF_TRIGGER is "0", then the application LF_[application]_PERM value works # in the same way as above and LF_TRIGGER_PERM serves no function LF_TRIGGER_PERM = "3600" # To only block access to the failed application instead of a complete block # for an ip address, you can set the following to "1", but LF_TRIGGER must be # set to "0" with specific application[*] trigger levels also set appropriately # # The ports that are blocked can be configured by changing the PORTS_* options LF_SELECT = "0" # Send an email alert if an IP address is blocked by one of the [*] triggers LF_EMAIL_ALERT = "0" # Send an email alert if an IP address is only temporarily blocked by one of # the [*] triggers # # Note: LF_EMAIL_ALERT must still be enabled to get permanent block emails LF_TEMP_EMAIL_ALERT = "1" # [*]Enable login failure detection of sshd connections # # SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read # this file about RESTRICT_SYSLOG before enabling this option: LF_SSHD = "10" LF_SSHD_PERM = "3600" # [*]Enable login failure detection of ftp connections # # SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read # this file about RESTRICT_SYSLOG before enabling this option: LF_FTPD = "10" LF_FTPD_PERM = "3600" # [*]Enable login failure detection of SMTP AUTH connections LF_SMTPAUTH = "10" LF_SMTPAUTH_PERM = "3600" # [*]Enable syntax failure detection of Exim connections LF_EXIMSYNTAX = "10" LF_EXIMSYNTAX_PERM = "1" # [*]Enable login failure detection of pop3 connections # # SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read # this file about RESTRICT_SYSLOG before enabling this option: LF_POP3D = "10" LF_POP3D_PERM = "3600" # [*]Enable login failure detection of imap connections # # SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read # this file about RESTRICT_SYSLOG before enabling this option: LF_IMAPD = "10" LF_IMAPD_PERM = "3600" # [*]Enable login failure detection of Apache .htpasswd connections # Due to the often high logging rate in the Apache error log, you might want to # enable this option only if you know you are suffering from attacks against # password protected directories LF_HTACCESS = "0" LF_HTACCESS_PERM = "3600" # [*]Enable failure detection of repeated Apache mod_security rule triggers LF_MODSEC = "10" LF_MODSEC_PERM = "3600" # [*]Enable detection of repeated BIND denied requests # This option should be enabled with care as it will prevent blocked IPs from # resolving any domains on the server. You might want to set the trigger value # reasonably high to avoid this # Example: LF_BIND = "100" LF_BIND = "0" LF_BIND_PERM = "1" # [*]Enable detection of repeated suhosin ALERTs # Example: LF_SUHOSIN = "5" # # SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read # this file about RESTRICT_SYSLOG before enabling this option: LF_SUHOSIN = "0" LF_SUHOSIN_PERM = "1" # [*]Enable detection of repeated cxs ModSecurity mod_security rule triggers # This option will block IP addresses if cxs detects a hits from the # ModSecurity rule associated with it # # Note: This option takes precedence over LF_MODSEC and removes any hits # counted towards LF_MODSEC for the cxs rule # # This setting should probably set very low, perhaps to 1, if you want to # effectively block IP addresses for this trigger option LF_CXS = "0" LF_CXS_PERM = "1" # [*]Enable detection of repeated Apache mod_qos rule triggers LF_QOS = "0" LF_QOS_PERM = "1" # [*]Enable detection of repeated Apache symlink race condition triggers from # the Apache patch provided by: # http://www.mail-archive.com/dev@httpd.apache.org/msg55666.html # This patch has also been included by cPanel via the easyapache option: # "Symlink Race Condition Protection" LF_SYMLINK = "0" LF_SYMLINK_PERM = "1" # [*]Enable login failure detection of webmin connections # # SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read # this file about RESTRICT_SYSLOG before enabling this option: LF_WEBMIN = "0" LF_WEBMIN_PERM = "1" # Send an email alert if anyone logs in successfully using SSH # # SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read # this file about RESTRICT_SYSLOG before enabling this option: LF_SSH_EMAIL_ALERT = "0" # Send an email alert if anyone uses su to access another account. This will # send an email alert whether the attempt to use su was successful or not # # SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read # this file about RESTRICT_SYSLOG before enabling this option: LF_SU_EMAIL_ALERT = "1" # Send an email alert if anyone uses sudo to access another account. This will # send an email alert whether the attempt to use sudo was successful or not # # NOTE: This option could become onerous if sudo is used extensively for root # access by administrators or control panels. It is provided for those where # this is not the case # # SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read # this file about RESTRICT_SYSLOG before enabling this option: LF_SUDO_EMAIL_ALERT = "0" # Send an email alert if anyone accesses webmin # # SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read # this file about RESTRICT_SYSLOG before enabling this option: LF_WEBMIN_EMAIL_ALERT = "0" # Send an email alert if anyone logs in successfully to root on the console # # SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read # this file about RESTRICT_SYSLOG before enabling this option: LF_CONSOLE_EMAIL_ALERT = "1" # This option will keep track of the number of "File does not exist" errors in # HTACCESS_LOG. If the number of hits is more than LF_APACHE_404 in LF_INTERVAL # seconds then the IP address will be blocked # # Care should be used with this option as it could generate many # false-positives, especially Search Bots (use csf.rignore to ignore such bots) # so only use this option if you know you are under this type of attack # # A sensible setting for this would be quite high, perhaps 200 # # To disable set to "0" LF_APACHE_404 = "0" # If this option is set to 1 the blocks will be permanent # If this option is > 1, the blocks will be temporary for the specified number # of seconds LF_APACHE_404_PERM = "3600" # This option will keep track of the number of "client denied by server # configuration" errors in HTACCESS_LOG. If the number of hits is more than # LF_APACHE_403 in LF_INTERVAL seconds then the IP address will be blocked # # Care should be used with this option as it could generate many # false-positives, especially Search Bots (use csf.rignore to ignore such bots) # so only use this option if you know you are under this type of attack # # A sensible setting for this would be quite high, perhaps 200 # # To disable set to "0" LF_APACHE_403 = "0" # If this option is set to 1 the blocks will be permanent # If this option is > 1, the blocks will be temporary for the specified number # of seconds LF_APACHE_403_PERM = "3600" # This option will keep track of the number of 401 failures in HTACCESS_LOG. # If the number of hits is more than LF_APACHE_401 in LF_INTERVAL seconds then # the IP address will be blocked # # To disable set to "0" LF_APACHE_401 = "0" # This option is used to determine if the Apache error_log format contains the # client port after the client IP. In Apache prior to v2.4, this was not the # case. In Apache v2.4+ the error_log format can be configured using # ErrorLogFormat, making the port directive optional # # Unfortunately v2.4 ErrorLogFormat places the port number after a colon next # to the client IP by default. This makes determining client IPv6 addresses # difficult unless we know whether the port is being appended or not # # lfd will attempt to autodetect the correct value if this option is set to "0" # from the httpd binary found in common locations. If it fails to find a binary # it will be set to "2", unless specified here # # The value can be set here explicitly if the autodetection does not work: # 0 - autodetect # 1 - no port directive after client IP # 2 - port directive after client IP LF_APACHE_ERRPORT = "0" # If this option is set to 1 the blocks will be permanent # If this option is > 1, the blocks will be temporary for the specified number # of seconds LF_APACHE_401_PERM = "3600" # This option will send an alert if the ModSecurity IP persistent storage grows # excessively large: https://goo.gl/rGh5sF # # More information on cPanel servers here: https://goo.gl/vo6xTE # # LF_MODSECIPDB_FILE must be set to the correct location of the database file # # The check is performed at lfd startup and then once per hour, the template # used is modsecipdbalert.txt # # Set to "0" to disable this option, otherwise it is the threshold size of the # file to report in gigabytes, e.g. set to 5 for 5GB LF_MODSECIPDB_ALERT = "0" # This is the location of the persistent IP storage file on the server, e.g.: # /run/modsecurity/data/ip.pag # /var/cpanel/secdatadir/ip.pag # /var/cache/modsecurity/ip.pag # /usr/local/apache/conf/modsec/data/msa/ip.pag # /var/tmp/ip.pag # /tmp/ip.pag LF_MODSECIPDB_FILE = "/run/modsecurity/data/ip.pag" # System Exploit Checking. This option is designed to perform a series of tests # to send an alert in case a possible server compromise is detected # # To enable this feature set the following to the checking interval in seconds # (a value of 300 would seem sensible). # # To disable set to "0" LF_EXPLOIT = "300" # This comma separated list allows you to ignore tests LF_EXPLOIT performs # # For the SUPERUSER check, you can list usernames in csf.suignore to have them # ignored for that test # # Valid tests are: # SUPERUSER # # If you want to ignore a test add it to this as a comma separated list, e.g. # "SUPERUSER" LF_EXPLOIT_IGNORE = "" # Set the time interval to track login and other LF_ failures within (seconds), # i.e. LF_TRIGGER failures within the last LF_INTERVAL seconds LF_INTERVAL = "300" # This is how long the lfd process sleeps (in seconds) before processing the # log file entries and checking whether other events need to be triggered LF_PARSE = "5" # This is the interval that is used to flush reports of usernames, files and # pids so that persistent problems continue to be reported, in seconds. # A value of 3600 seems sensible LF_FLUSH = "3600" # Under some circumstances iptables can fail to include a rule instruction, # especially if more than one request is made concurrently. In this event, a # permanent block entry may exist in csf.deny, but not in iptables. # # This option instructs csf to deny an already blocked IP address the number # of times set. The downside, is that there will be multiple entries for an IP # address in csf.deny and possibly multiple rules for the same IP address in # iptables. This needs to be taken into consideration when unblocking such IP # addresses. # # Set to "0" to disable this feature. Do not set this too high for the reasons # detailed above (e.g. "5" should be more than enough) LF_REPEATBLOCK = "0" # By default csf will create both an inbound and outbound blocks from/to an IP # unless otherwise specified in csf.deny and GLOBAL_DENY. This is the most # effective way to block IP traffic. This option instructs csf to only block # inbound traffic from those IP's and so reduces the number of iptables rules, # but at the expense of less effectiveness. For this reason we recommend # leaving this option disabled # # Set to "0" to disable this feature - the default LF_BLOCKINONLY = "0" ############################################################################### # SECTION:CloudFlare ############################################################################### # This features provides interaction with the CloudFlare Firewall # # As CloudFlare is a reverse proxy, any attacking IP addresses (so far as # iptables is concerned) come from the CloudFlare IP's. To counter this, an # Apache module (mod_cloudflare) is available that obtains the true attackers # IP from a custom HTTP header record (similar functionality is available # for other HTTP daemons # # However, despite now knowing the true attacking IP address, iptables cannot # be used to block that IP as the traffic is still coming from the CloudFlare # servers # # CloudFlare have provided a Firewall feature within the user account where # rules can be added to block, challenge or whitelist IP addresses # # Using the CloudFlare API, this feature adds and removes attacking IPs from # that firewall and provides CLI (and via the UI) additional commands # # See /etc/csf/readme.txt for more information about this feature and the # restrictions for its use BEFORE enabling this feature CF_ENABLE = "0" # This can be set to either "block" or "challenge" (see CloudFlare docs) CF_BLOCK = "block" # This setting determines how long the temporary block will apply within csf # and CloudFlare, keeping them in sync # # Block duration in seconds - overrides perm block or time of individual blocks # in lfd for block triggers CF_TEMP = "3600" ############################################################################### # SECTION:Directory Watching & Integrity ############################################################################### # Enable Directory Watching. This enables lfd to check /tmp and /dev/shm # directories for suspicious files, i.e. script exploits. If a suspicious # file is found an email alert is sent. One alert per file per LF_FLUSH # interval is sent # # To enable this feature set the following to the checking interval in seconds. # To disable set to "0" LF_DIRWATCH = "300" # To remove any suspicious files found during directory watching, enable the # following. These files will be appended to a tarball in # /var/lib/csf/suspicious.tar LF_DIRWATCH_DISABLE = "0" # This option allows you to have lfd watch a particular file or directory for # changes and should they change and email alert using watchalert.txt is sent # # To enable this feature set the following to the checking interval in seconds # (a value of 60 would seem sensible) and add your entries to csf.dirwatch # # Set to disable set to "0" LF_DIRWATCH_FILE = "0" # System Integrity Checking. This enables lfd to compare md5sums of the # servers OS binary application files from the time when lfd starts. If the # md5sum of a monitored file changes an alert is sent. This option is intended # as an IDS (Intrusion Detection System) and is the last line of detection for # a possible root compromise. # # There will be constant false-positives as the servers OS is updated or # monitored application binaries are updated. However, unexpected changes # should be carefully inspected. # # Modified files will only be reported via email once. # # To enable this feature set the following to the checking interval in seconds # (a value of 3600 would seem sensible). This option may increase server I/O # load onto the server as it checks system binaries. # # To disable set to "0" LF_INTEGRITY = "3600" ############################################################################### # SECTION:Distributed Attacks ############################################################################### # Distributed Account Attack. This option will keep track of login failures # from distributed IP addresses to a specific application account. If the # number of failures matches the trigger value above, ALL of the IP addresses # involved in the attack will be blocked according to the temp/perm rules above # # Tracking applies to LF_SSHD, LF_FTPD, LF_SMTPAUTH, LF_POP3D, LF_IMAPD, # LF_HTACCESS # # SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read # this file about RESTRICT_SYSLOG before enabling this option: LF_DISTATTACK = "1" # Set the following to the minimum number of unique IP addresses that trigger # LF_DISTATTACK LF_DISTATTACK_UNIQ = "3" # Distributed FTP Logins. This option will keep track of successful FTP logins. # If the number of successful logins to an individual account is at least # LF_DISTFTP in LF_DIST_INTERVAL from at least LF_DISTFTP_UNIQ IP addresses, # then all of the IP addresses will be blocked # # This option can help mitigate the common FTP account compromise attacks that # use a distributed network of zombies to deface websites # # A sensible setting for this might be 5, depending on how many different # IP addresses you expect to an individual FTP account within LF_DIST_INTERVAL # # To disable set to "0" # # SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read # this file about RESTRICT_SYSLOG before enabling this option: LF_DISTFTP = "5" # Set the following to the minimum number of unique IP addresses that trigger # LF_DISTFTP. LF_DISTFTP_UNIQ must be <= LF_DISTFTP for this to work LF_DISTFTP_UNIQ = "5" # If this option is set to 1 the blocks will be permanent # If this option is > 1, the blocks will be temporary for the specified number # of seconds LF_DISTFTP_PERM = "900" # Send an email alert if LF_DISTFTP is triggered LF_DISTFTP_ALERT = "1" # Distributed SMTP Logins. This option will keep track of successful SMTP # logins. If the number of successful logins to an individual account is at # least LF_DISTSMTP in LF_DIST_INTERVAL from at least LF_DISTSMTP_UNIQ IP # addresses, then all of the IP addresses will be blocked. These options only # apply to the exim MTA # # This option can help mitigate the common SMTP account compromise attacks that # use a distributed network of zombies to send spam # # A sensible setting for this might be 5, depending on how many different # IP addresses you expect to an individual SMTP account within LF_DIST_INTERVAL # # To disable set to "0" LF_DISTSMTP = "0" # Set the following to the minimum number of unique IP addresses that trigger # LF_DISTSMTP. LF_DISTSMTP_UNIQ must be <= LF_DISTSMTP for this to work LF_DISTSMTP_UNIQ = "3" # If this option is set to 1 the blocks will be permanent # If this option is > 1, the blocks will be temporary for the specified number # of seconds LF_DISTSMTP_PERM = "1" # Send an email alert if LF_DISTSMTP is triggered LF_DISTSMTP_ALERT = "1" # This is the interval during which a distributed FTP or SMTP attack is # measured LF_DIST_INTERVAL = "300" # If LF_DISTFTP or LF_DISTSMTP is triggered, then if the following contains the # path to a script, it will run the script and pass the following as arguments: # # LF_DISTFTP/LF_DISTSMTP # account name # log file text # # The action script must have the execute bit and interpreter (shebang) set LF_DIST_ACTION = "" ############################################################################### # SECTION:Login Tracking ############################################################################### # Block POP3 logins if greater than LT_POP3D times per hour per account per IP # address (0=disabled) # # This is a temporary block for the rest of the hour, afterwhich the IP is # unblocked # # SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read # this file about RESTRICT_SYSLOG before enabling this option: LT_POP3D = "0" # Block IMAP logins if greater than LT_IMAPD times per hour per account per IP # address (0=disabled) - not recommended for IMAP logins due to the ethos # within which IMAP works. If you want to use this, setting it quite high is # probably a good idea # # This is a temporary block for the rest of the hour, afterwhich the IP is # unblocked # # SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read # this file about RESTRICT_SYSLOG before enabling this option: LT_IMAPD = "0" # Send an email alert if an account exceeds LT_POP3D/LT_IMAPD logins per hour # per IP LT_EMAIL_ALERT = "0" # If LF_PERMBLOCK is enabled but you do not want this to apply to # LT_POP3D/LT_IMAPD, then enable this option LT_SKIPPERMBLOCK = "0" ############################################################################### # SECTION:Connection Tracking ############################################################################### # Connection Tracking. This option enables tracking of all connections from IP # addresses to the server. If the total number of connections is greater than # this value then the offending IP address is blocked. This can be used to help # prevent some types of DOS attack. # # Care should be taken with this option. It's entirely possible that you will # see false-positives. Some protocols can be connection hungry, e.g. FTP, IMAPD # and HTTP so it could be quite easy to trigger, especially with a lot of # closed connections in TIME_WAIT. However, for a server that is prone to DOS # attacks this may be very useful. A reasonable setting for this option might # be around 300. # # To disable this feature, set this to 0 CT_LIMIT = "0" # Connection Tracking interval. Set this to the the number of seconds between # connection tracking scans CT_INTERVAL = "30" # Send an email alert if an IP address is blocked due to connection tracking CT_EMAIL_ALERT = "0" # If you want to make IP blocks permanent then set this to 1, otherwise blocks # will be temporary and will be cleared after CT_BLOCK_TIME seconds CT_PERMANENT = "0" # If you opt for temporary IP blocks for CT, then the following is the interval # in seconds that the IP will remained blocked for (e.g. 1800 = 30 mins) CT_BLOCK_TIME = "3600" # If you don't want to count the TIME_WAIT state against the connection count # then set the following to "1" CT_SKIP_TIME_WAIT = "0" # If you only want to count specific states (e.g. SYN_RECV) then add the states # to the following as a comma separated list. E.g. "SYN_RECV,TIME_WAIT" # # Leave this option empty to count all states against CT_LIMIT CT_STATES = "" # If you only want to count specific ports (e.g. 80,443) then add the ports # to the following as a comma separated list. E.g. "80,443" # # Leave this option empty to count all ports against CT_LIMIT CT_PORTS = "" # If the total number of connections from a class C subnet is greater than this # value then the offending subnet is blocked according to the other CT_* # settings # # This option can be used to help prevent some types of DOS attack where a # range of IP's between x.y.z.1-255 has connected to the server # # If you use a reverse proxy service such as Cloudflare you should not enable # this option, or should exclude the ports that you have proxied in CT_PORTS # # To disable this feature, set this to 0 CT_SUBNET_LIMIT = "0" ############################################################################### # SECTION:Process Tracking ############################################################################### # Process Tracking. This option enables tracking of user and nobody processes # and examines them for suspicious executables or open network ports. Its # purpose is to identify potential exploit processes that are running on the # server, even if they are obfuscated to appear as system services. If a # suspicious process is found an alert email is sent with relevant information. # It is then the responsibility of the recipient to investigate the process # further as the script takes no further action # # The following is the number of seconds a process has to be active before it # is inspected. If you set this time too low, then you will likely trigger # false-positives with CGI or PHP scripts. # Set the value to 0 to disable this feature PT_LIMIT = "0" # How frequently processes are checked in seconds PT_INTERVAL = "60" # If you want process tracking to highlight php or perl scripts that are run # through apache then disable the following, # i.e. set it to 0 # # While enabling this setting will reduce false-positives, having it set to 0 # does provide better checking for exploits running on the server PT_SKIP_HTTP = "0" # lfd will report processes, even if they're listed in csf.pignore, if they're # tagged as (deleted) by Linux. This information is provided in Linux under # /proc/PID/exe. A (deleted) process is one that is running a binary that has # the inode for the file removed from the file system directory. This usually # happens when the binary has been replaced due to an upgrade for it by the OS # vendor or another third party (e.g. cPanel). You need to investigate whether # this is indeed the case to be sure that the original binary has not been # replaced by a rootkit or is running an exploit. # # Note: If a deleted executable process is detected and reported then lfd will # not report children of the parent (or the parent itself if a child triggered # the report) if the parent is also a deleted executable process # # To stop lfd reporting such process you need to restart the daemon to which it # belongs and therefore run the process using the replacement binary (presuming # one exists). This will normally mean running the associated startup script in # /etc/init.d/ # # If you do want lfd to report deleted binary processes, set to 1 PT_DELETED = "0" # If a PT_DELETED event is triggered, then if the following contains the path to # a script, it will be run in a child process and passed the executable, pid, # account for the process, and parent pid # # The action script must have the execute bit and interpreter (shebang) set. An # example is provided in /usr/local/csf/bin/pt_deleted_action.pl # # WARNING: Make sure you read and understand the potential security # implications of such processes in PT_DELETED above before simply restarting # such processes with a script PT_DELETED_ACTION = "" # User Process Tracking. This option enables the tracking of the number of # process any given account is running at one time. If the number of processes # exceeds the value of the following setting an email alert is sent with # details of those processes. If you specify a user in csf.pignore it will be # ignored # # Set to 0 to disable this feature PT_USERPROC = "0" # This User Process Tracking option sends an alert if any user process exceeds # the virtual memory usage set (MB). To ignore specific processes or users use # csf.pignore # # Set to 0 to disable this feature PT_USERMEM = "0" # This User Process Tracking option sends an alert if any user process exceeds # the RSS memory usage set (MB) - RAM used, not virtual. To ignore specific # processes or users use csf.pignore # # Set to 0 to disable this feature PT_USERRSS = "0" # This User Process Tracking option sends an alert if any linux user process # exceeds the time usage set (seconds). To ignore specific processes or users # use csf.pignore # # Set to 0 to disable this feature PT_USERTIME = "0" # If this option is set then processes detected by PT_USERMEM, PT_USERTIME or # PT_USERPROC are killed # # Warning: We don't recommend enabling this option unless absolutely necessary # as it can cause unexpected problems when processes are suddenly terminated. # It can also lead to system processes being terminated which could cause # stability issues. It is much better to leave this option disabled and to # investigate each case as it is reported when the triggers above are breached # # Note: Processes that are running deleted excecutables (see PT_DELETED) will # not be killed by lfd PT_USERKILL = "0" # If you want to disable email alerts if PT_USERKILL is triggered, then set # this option to 0 PT_USERKILL_ALERT = "0" # If a PT_* event is triggered, then if the following contains the path to # a script, it will be run in a child process and passed the PID(s) of the # process(es) in a comma separated list. # # The action script must have the execute bit and interpreter (shebang) set PT_USER_ACTION = "" # Check the PT_LOAD_AVG minute Load Average (can be set to 1 5 or 15 and # defaults to 5 if set otherwise) on the server every PT_LOAD seconds. If the # load average is greater than or equal to PT_LOAD_LEVEL then an email alert is # sent. lfd then does not report subsequent high load until PT_LOAD_SKIP # seconds has passed to prevent email floods. # # Set PT_LOAD to "0" to disable this feature PT_LOAD = "0" PT_LOAD_AVG = "5" PT_LOAD_LEVEL = "10" PT_LOAD_SKIP = "3600" # This is the Apache Server Status URL used in the email alert. Requires the # Apache mod_status module to be installed and configured correctly PT_APACHESTATUS = "http://127.0.0.1/server-status" # If a PT_LOAD event is triggered, then if the following contains the path to # a script, it will be run in a child process. For example, the script could # contain commands to terminate and restart httpd, php, exim, etc incase of # looping processes. The action script must have the execute bit an # interpreter (shebang) set PT_LOAD_ACTION = "" # Fork Bomb Protection. This option checks the number of processes with the # same session id and if greater than the value set, the whole session tree is # terminated and an alert sent # # You can see an example of common session id processes on most Linux systems # using: "ps axf -O sid" # # On cPanel servers, PT_ALL_USERS should be enabled to use this option # effectively # # This option will check root owned processes. Session id 0 and 1 will always # be ignored as they represent kernel and init processes. csf.pignore will be # honoured, but bear in mind that a session tree can contain a variety of users # and executables # # Care needs to be taken to ensure that this option only detects runaway fork # bombs, so should be set higher than any session tree is likely to get (e.g. # httpd could have 100s of legitimate children on very busy systems). A # sensible starting point on most servers might be 250 PT_FORKBOMB = "250" # Terminate hung SSHD sessions. When under an SSHD login attack, SSHD processes # are often left hanging after their connecting IP addresses have been blocked # # This option will terminate the SSH processes created by the blocked IP. This # option is preferred over PT_SSHDHUNG PT_SSHDKILL = "0" # This option will terminate all processes with the cmdline of "sshd: unknown # [net]" or "sshd: unknown [priv]" if they have been running for more than 60 # seconds PT_SSHDHUNG = "0" ############################################################################### # SECTION:Port Scan Tracking ############################################################################### # Port Scan Tracking. This feature tracks port blocks logged by iptables to # syslog. If an IP address generates a port block that is logged more than # PS_LIMIT within PS_INTERVAL seconds, the IP address will be blocked. # # This feature could, for example, be useful for blocking hackers attempting # to access the standard SSH port if you have moved it to a port other than 22 # and have removed 22 from the TCP_IN list so that connection attempts to the # old port are being logged # # This feature blocks all iptables blocks from the iptables logs, including # repeated attempts to one port or SYN flood blocks, etc # # Note: This feature will only track iptables blocks from the log file set in # IPTABLES_LOG below and if you have DROP_LOGGING enabled. However, it will # cause redundant blocking with DROP_IP_LOGGING enabled # # Warning: It's possible that an elaborate DDOS (i.e. from multiple IP's) # could very quickly fill the iptables rule chains and cause a DOS in itself. # The DENY_IP_LIMIT should help to mitigate such problems with permanent blocks # and the DENY_TEMP_IP_LIMIT with temporary blocks # # Set PS_INTERVAL to "0" to disable this feature. A value of between 60 and 300 # would be sensible to enable this feature # # SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read # this file about RESTRICT_SYSLOG before enabling this option: PS_INTERVAL = "120" PS_LIMIT = "19" # You can specify the ports and/or port ranges that should be tracked by the # Port Scan Tracking feature. The following setting is a comma separated list # of those ports and uses the same format as TCP_IN. The setting of # 0:65535,ICMP,INVALID,OPEN,BRD covers all ports # # Special values are: # ICMP - include ICMP blocks (see ICMP_*) # INVALID - include INVALID blocks (see PACKET_FILTER) # OPEN - include TCP_IN and UDP_IN open port blocks - *[proto]_IN Blocked* # BRD - include UDP Broadcast IPs, otherwise they are ignored PS_PORTS = "0:65535,ICMP" # To specify how many different ports qualifies as a Port Scan you can increase # the following from the default value of 1. The risk in doing so will mean # that persistent attempts to attack a specific closed port will not be # detected and blocked PS_DIVERSITY = "1" # You can select whether IP blocks for Port Scan Tracking should be temporary # or permanent. Set PS_PERMANENT to "0" for temporary and "1" for permanent # blocking. If set to "0" PS_BLOCK_TIME is the amount of time in seconds to # temporarily block the IP address for PS_PERMANENT = "0" PS_BLOCK_TIME = "3600" # Set the following to "1" to enable Port Scan Tracking email alerts, set to # "0" to disable them PS_EMAIL_ALERT = "1" ############################################################################### # SECTION:User ID Tracking ############################################################################### # User ID Tracking. This feature tracks UID blocks logged by iptables to # syslog. If a UID generates a port block that is logged more than UID_LIMIT # times within UID_INTERVAL seconds, an alert will be sent # # Note: This feature will only track iptables blocks from the log file set in # IPTABLES_LOG and if DROP_OUT_LOGGING and DROP_UID_LOGGING are enabled. # # To ignore specific UIDs list them in csf.uidignore and then restart lfd # # Set UID_INTERVAL to "0" to disable this feature. A value of between 60 and 300 # would be sensible to enable this feature # # SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read # this file about RESTRICT_SYSLOG before enabling this option: UID_INTERVAL = "0" UID_LIMIT = "10" # You can specify the ports and/or port ranges that should be tracked by the # User ID Tracking feature. The following setting is a comma separated list # of those ports and uses the same format as TCP_OUT. The default setting of # 0:65535,ICMP covers all ports UID_PORTS = "0:65535,ICMP" ############################################################################### # SECTION:Account Tracking ############################################################################### # Account Tracking. The following options enable the tracking of modifications # to the accounts on a server. If any of the enabled options are triggered by # a modifications to an account, an alert email is sent. Only the modification # is reported. The cause of the modification will have to be investigated # manually # # You can set AT_ALERT to the following: # 0 = disable this feature # 1 = enable this feature for all accounts # 2 = enable this feature only for superuser accounts (UID = 0, e.g. root, etc) # 3 = enable this feature only for the root account AT_ALERT = "2" # This options is the interval between checks in seconds AT_INTERVAL = "60" # Send alert if a new account is created AT_NEW = "1" # Send alert if an existing account is deleted AT_OLD = "1" # Send alert if an account password has changed AT_PASSWD = "1" # Send alert if an account uid has changed AT_UID = "1" # Send alert if an account gid has changed AT_GID = "1" # Send alert if an account login directory has changed AT_DIR = "1" # Send alert if an account login shell has changed AT_SHELL = "1" ############################################################################### # SECTION:Integrated User Interface ############################################################################### # Integrated User Interface. This feature provides a HTML UI to csf and lfd, # without requiring a control panel or web server. The UI runs as a sub process # to the lfd daemon # # As it runs under the root account and successful login provides root access # to the server, great care should be taken when configuring and using this # feature. There are additional restrictions to enhance secure access to the UI # # See readme.txt for more information about using this feature BEFORE enabling # it for security and access reasons # # 1 to enable, 0 to disable UI = "0" # Set this to the port that want to bind this service to. You should configure # this port to be >1023 and different from any other port already being used # # Do NOT enable access to this port in TCP_IN, instead only allow trusted IP's # to the port using Advanced Allow Filters (see readme.txt) UI_PORT = "9898" # Optionally set the IP address to bind to. Normally this should be left blank # to bind to all IP addresses on the server. # # If the server is configured for IPv6 but the IP to bind to is IPv4, then the # IP address MUST use the IPv6 representation. For example 1.2.3.4 must use # ::ffff:1.2.3.4 # # Leave blank to bind to all IP addresses on the server UI_IP = "" # This should be a secure, hard to guess username # # This must be changed from the default UI_USER = "username" # This should be a secure, hard to guess password. That is, at least 8 # characters long with a mixture of upper and lowercase characters plus # numbers and non-alphanumeric characters # # This must be changed from the default UI_PASS = "password" # This is the login session timeout. If there is no activity for a logged in # session within this number of seconds, the session will timeout and a new # login will be required # # For security reasons, you should always keep this option low (i.e 60-300) UI_TIMEOUT = "300" # This is the maximum concurrent connections allowed to the server. The default # value should be sufficient UI_CHILDREN = "5" # The number of login retries allowed within a 24 hour period. A successful # login from the IP address will clear the failures # # For security reasons, you should always keep this option low (i.e 0-10) UI_RETRY = "5" # If enabled, this option will add the connecting IP address to the file # /etc/csf/ui/ui.ban after UI_RETRY login failures. The IP address will not be # able to login to the UI while it is listed in this file. The UI_BAN setting # does not refer to any of the csf/lfd allow or ignore files, e.g. csf.allow, # csf.ignore, etc. # # For security reasons, you should always enable this option UI_BAN = "1" # If enabled, only IPs (or CIDR's) listed in the file /etc/csf/ui/ui.allow will # be allowed to login to the UI. The UI_ALLOW setting does not refer to any of # the csf/lfd allow or ignore files, e.g. csf.allow, csf.ignore, etc. # # For security reasons, you should always enable this option and use ui.allow UI_ALLOW = "1" # If enabled, this option will trigger an iptables block through csf after # UI_RETRY login failures # # 0 = no block;1 = perm block;nn=temp block for nn secs UI_BLOCK = "1" # This controls what email alerts are sent with regards to logins to the UI. It # uses the uialert.txt template # # 4 = login success + login failure/ban/block + login attempts # 3 = login success + login failure/ban/block # 2 = login failure/ban/block # 1 = login ban/block # 0 = disabled UI_ALERT = "4" # This is the SSL cipher list that the Integrated UI will negotiate from UI_CIPHER = "ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP:!kEDH" # This is the SSL protocol version used. See IO::Socket::SSL if you wish to # change this and to understand the implications of changing it UI_SSL_VERSION = "SSLv23:!SSLv2" # If cxs is installed then enabling this option will provide a dropdown box to # switch between applications UI_CXS = "0" # There is a modified installation of ConfigServer Explorer (cse) provided with # the csf distribution. If this option is enabled it will provide a dropdown # box to switch between applications UI_CSE = "0" ############################################################################### # SECTION:Messenger service ############################################################################### # Messenger service. This feature allows the display of a message to a blocked # connecting IP address to inform the user that they are blocked in the # firewall. This can help when users get themselves blocked, e.g. due to # multiple login failures. The service is provided by two daemons running on # ports providing either an HTML or TEXT message # # This feature does not work on servers that do not have the iptables module # ipt_REDIRECT loaded. Typically, this will be with MONOLITHIC kernels. VPS # server admins should check with their VPS host provider that the iptables # module is included # # IPv6 will need the IO::Socket::INET6 perl module # # For further information on features and limitations refer to the csf # readme.txt # # Note: Run /etc/csf/csftest.pl to check whether this option will function on # this server # # 1 to enable, 0 to disable MESSENGER = "0" # Provide this service to temporary IP address blocks MESSENGER_TEMP = "1" # Provide this service to permanent IP address blocks MESSENGER_PERM = "1" # User account to run the service servers under. We recommend creating a # specific non-priv, non-shell account for this purpose # # Note: When using MESSENGERV2, this account must NOT be a valid control panel # account, it must be created manually as explained in the csf readme.txt MESSENGER_USER = "csf" # This option points to the file(s) containing the Apache VirtualHost SSL # definitions. This can be a file glob if there are multiple files to search. # Only Apache v2 SSL VirtualHost definitions are supported # # This is used by MESSENGERV1 and MESSENGERV2 only MESSENGER_HTTPS_CONF = "/etc/httpd/conf.d/ssl.conf" # The following options can be specified to provide a default fallback # certificate to be used if either SNI is not supported or a hosted domain does # not have an SSL certificate. If a fallback is not provided, one of the certs # obtained from MESSENGER_HTTPS_CONF will be used # # This is used by MESSENGERV1 and MESSENGERV2 only MESSENGER_HTTPS_KEY = "/etc/pki/tls/private/localhost.key" MESSENGER_HTTPS_CRT = "/etc/pki/tls/certs/localhost.crt" # Set this to the port that will receive the HTTPS HTML message. You should # configure this port to be >1023 and different from the TEXT and HTML port. Do # NOT enable access to this port in TCP_IN. This option requires the perl # module IO::Socket::SSL at a version level that supports SNI (1.83+). # Additionally the version of openssl on the server must also support SNI # # The option uses existing SSL certificates on the server for each domain to # maintain a secure connection without browser warnings. It uses SNI to choose # the correct certificate to use for each client connection # # Warning: On some servers the amount of memory used by the HTTPS MESSENGER # service can become significant depending on various factors associated with # the use of IO::Socket::SSL including the number of domains and certificates # served. This is normally only an issue if using MESSENGERV1 MESSENGER_HTTPS = "8887" # This comma separated list are the HTTPS HTML ports that will be redirected # for the blocked IP address. If you are using per application blocking # (LF_TRIGGER) then only the relevant block port will be redirected to the # messenger port # # Recommended setting "443" plus any end-user control panel SSL ports. So, for # cPanel: "443,2083,2096" MESSENGER_HTTPS_IN = "" # Set this to the port that will receive the HTML message. You should configure # this port to be >1023 and different from the TEXT port. Do NOT enable access # to this port in TCP_IN MESSENGER_HTML = "8888" # This comma separated list are the HTML ports that will be redirected for the # blocked IP address. If you are using per application blocking (LF_TRIGGER) # then only the relevant block port will be redirected to the messenger port MESSENGER_HTML_IN = "80,2082,2095" # Set this to the port that will receive the TEXT message. You should configure # this port to be >1023 and different from the HTML port. Do NOT enable access # to this port in TCP_IN MESSENGER_TEXT = "8889" # This comma separated list are the TEXT ports that will be redirected for the # blocked IP address. If you are using per application blocking (LF_TRIGGER) # then only the relevant block port will be redirected to the messenger port MESSENGER_TEXT_IN = "21" # These settings limit the rate at which connections can be made to the # messenger service servers. Its intention is to provide protection from # attacks or excessive connections to the servers. If the rate is exceeded then # iptables will revert for the duration to the normal blocking activity # # See the iptables man page for the correct --limit rate syntax MESSENGER_RATE = "100/s" MESSENGER_BURST = "150" # MESSENGERV1 only: #------------------------------------------------------------------------------ # This is the maximum concurrent connections allowed to each service server # # Note: This number should be increased to cater for the number of local images # served by this page, including one for favicon.ico. This is because each # image displayed counts as an additional connection MESSENGER_CHILDREN = "10" # This options ignores ServerAlias definitions that begin with "mail.". This # can help reduce memory usage on systems that do not require the use of # MESSENGER_HTTPS on those subdomains # # Set to 0 to include these ServerAlias definitions MESSENGER_HTTPS_SKIPMAIL = "1" # MESSENGERV2 only: #------------------------------------------------------------------------------ # MESSENGERV2. This option is available on cPanel servers running Apache v2.4+ # under EA4. # # This uses the Apache http daemon to provide the web server functionality for # the MESSENGER HTML and HTTPS services. It uses a fraction of the resources # that the lfd inbuilt service uses and overcomes the memory overhead of using # the MESSENGER HTTPS service # # For more information consult readme.txt before enabling this option #MESSENGERV2 = "0" # MESSENGERV3 only: #------------------------------------------------------------------------------ # MESSENGERV3. This option is available on any server running Apache v2.4+, # Litespeed or Openlitespeed # # This uses the web server http daemon to provide the web server functionality # for the MESSENGER HTML and HTTPS services. It uses a fraction of the # resources that the lfd inbuilt service uses and overcomes the memory overhead # of using the MESSENGER HTTPS service # # For more information consult readme.txt before enabling this option MESSENGERV3 = "0" # This is the file or directory where the additional web server configuration # file should be included MESSENGERV3LOCATION = "/etc/httpd/conf.d/" # This is the command to restart the web server MESSENGERV3RESTART = "service httpd restart" # This is the command to test the validity of the web server configuration. If # using Litespeed, set to "" MESSENGERV3TEST = "/usr/sbin/apachectl -t" # This must be set to the main httpd.conf file for either Apache or Litespeed MESSENGERV3HTTPS_CONF = "/etc/httpd/conf/httpd.conf" # This can be set to either: # "apache" - for servers running Apache v2.4+ or Litespeed using Apache # configuration # "litespeed" - for Litespeed or Openlitespeed MESSENGERV3WEBSERVER = "apache" # On creation, set the MESSENGER_USER public_html directory permissions to # Note: If you precreate this directory the following setting will be ignored MESSENGERV3PERMS = "711" # On creation, set the MESSENGER_USER public_html directory group user to # Note: If you precreate this directory the following setting will be ignored MESSENGERV3GROUP = "apache" # This is the web server configuration to allow PHP scripts to run. If left # empty, the MESSENGER service will try to configure this. If this does not # work, this should be set as an "Include /path/to/csf_php.conf" or similar # file which must contain appropriate web server configuration to allow PHP # scripts to run. This line will be included within each MESSENGER VirtualHost # container. This will replace the [MESSENGERV3PHPHANDLER] line from the csf # webserver template files MESSENGERV3PHPHANDLER = "" # RECAPTCHA: #------------------------------------------------------------------------------ # The RECAPTCHA options provide a way for end-users that have blocked # themselves in the firewall to unblock themselves. # # A valid Google ReCAPTCHA (v2) key set is required for this feature from: # https://www.google.com/recaptcha/intro/index.html # # When configuring a new reCAPTCHA API key set you must ensure that the option # for "Domain Name Validation" is unticked so that the same reCAPTCHA can be # used for all domains hosted on the server. lfd then checks that the hostname # of the request resolves to an IP on this server # # This feature requires the installation of the LWP::UserAgent perl module (see # option URLGET for more details) # # The template used for this feature is /etc/csf/messenger/index.recaptcha.html # # Note: An unblock will fail if the end-users IP is located in a netblock, # blocklist or CC_* deny entry RECAPTCHA_SITEKEY = "" RECAPTCHA_SECRET = "" # Send an email when an IP address successfully attempts to unblock themselves. # This does not necessarily mean the IP was unblocked, only that the # post-recaptcha unblock request was attempted # # Set to "0" to disable RECAPTCHA_ALERT = "1" # If the server uses NAT then resolving the hostname to hosted IPs will likely # not succeed. In that case, the external IP addresses must be listed as comma # separated list here RECAPTCHA_NAT = "" ############################################################################### # SECTION:lfd Clustering ############################################################################### # lfd Clustering. This allows the configuration of an lfd cluster environment # where a group of servers can share blocks and configuration option changes. # Included are CLI and UI options to send requests to the cluster. # # See the readme.txt file for more information and details on setup and # security risks. # # Set this to a comma separated list of cluster member IP addresses to send # requests to. Alternatively, it can be set to the full path of a file that # will read in one IP per line, e.g.: # "/etc/csf/cluster_sendto.txt" CLUSTER_SENDTO = "" # Set this to a comma separated list of cluster member IP addresses to receive # requests from. Alternatively, it can be set to the full path of a file that # will read in one IP per line, e.g.: # "/etc/csf/cluster_recvfrom.txt" CLUSTER_RECVFROM = "" # IP address of the master node in the cluster allowed to send CLUSTER_CONFIG # changes CLUSTER_MASTER = "" # If this is a NAT server, set this to the public IP address of this server CLUSTER_NAT = "" # If a cluster member should send requests on an IP other than the default IP, # set it here CLUSTER_LOCALADDR = "" # Cluster communication port (must be the same on all member servers). There # is no need to open this port in the firewall as csf will automatically add # in and out bound rules to allow communication between cluster members CLUSTER_PORT = "7777" # This is a secret key used to encrypt cluster communications using the # Blowfish algorithm. It should be between 8 and 56 characters long, # preferably > 20 random characters # 56 chars: 01234567890123456789012345678901234567890123456789012345 CLUSTER_KEY = "" # Automatically send lfd blocks to all members of CLUSTER_SENDTO. Those # servers must have this servers IP address listed in their CLUSTER_RECVFROM # # Set to 0 to disable this feature CLUSTER_BLOCK = "0" # This option allows the enabling and disabling of the Cluster configuration # changing options --cconfig, --cconfigr, --cfile, --ccfile sent from the # CLUSTER_MASTER server # # Set this option to 1 to allow Cluster configurations to be received CLUSTER_CONFIG = "0" # Maximum number of child processes to listen on. High blocking rates or large # clusters may need to increase this CLUSTER_CHILDREN = "10" ############################################################################### # SECTION:Port Knocking ############################################################################### # Port Knocking. This feature allows port knocking to be enabled on multiple # ports with a variable number of knocked ports and a timeout. There must be a # minimum of 3 ports to knock for an entry to be valid # # See the following for information regarding Port Knocking: # http://www.portknocking.org/ # # This feature does not work on servers that do not have the iptables module # ipt_recent loaded. Typically, this will be with MONOLITHIC kernels. VPS # server admins should check with their VPS host provider that the iptables # module is included # # For further information and syntax refer to the Port Knocking section of the # csf readme.txt # # Note: Run /etc/csf/csftest.pl to check whether this option will function on # this server # # openport;protocol;timeout;kport1;kport2;kport3[...;kportN],... # e.g.: 22;TCP;20;100;200;300;400 PORTKNOCKING = "" # Enable PORTKNOCKING logging by iptables PORTKNOCKING_LOG = "1" # Send an email alert if the PORTKNOCKING port is opened. PORTKNOCKING_LOG must # also be enabled to use this option # # SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read # this file about RESTRICT_SYSLOG before enabling this option: PORTKNOCKING_ALERT = "1" ############################################################################### # SECTION:Log Scanner ############################################################################### # Log Scanner. This feature will send out an email summary of the log lines of # each log listed in /etc/csf/csf.logfiles. All lines will be reported unless # they match a regular expression in /etc/csf/csf.logignore # # File globbing is supported for logs listed in /etc/csf/csf.logfiles. However, # be aware that the more files lfd has to track, the greater the performance # hit. Note: File globs are only evaluated when lfd is started # # Note: lfd builds the report continuously from lines logged after lfd has # started, so any lines logged when lfd is not running will not be reported # (e.g. during reboot). If lfd is restarted, then the report will include any # lines logged during the previous lfd logging period that weren't reported # # 1 to enable, 0 to disable LOGSCANNER = "0" # This is the interval each report will be sent based on the logalert.txt # template # # The interval can be set to: # "hourly" - sent on the hour # "daily" - sent at midnight (00:00) # "manual" - sent whenever "csf --logrun" is run. This allows for scheduling # via cron job LOGSCANNER_INTERVAL = "hourly" # Report Style # 1 = Separate chronological log lines per log file # 2 = Simply chronological log of all lines LOGSCANNER_STYLE = "1" # Send the report email even if no log lines reported # 1 to enable, 0 to disable LOGSCANNER_EMPTY = "1" # Maximum number of lines in the report before it is truncated. This is to # prevent log lines flooding resulting in an excessively large report. This # might need to be increased if you choose a daily report LOGSCANNER_LINES = "5000" ############################################################################### # SECTION:Statistics Settings ############################################################################### # Statistics # # Some of the Statistics output requires the gd graphics library and the # GD::Graph perl module with all dependent modules to be installed for the UI # for them to be displayed # # This option enabled statistical data gathering ST_ENABLE = "1" # This option determines how many iptables log lines to store for reports ST_IPTABLES = "100" # This option indicates whether rDNS and CC lookups are performed at the time # the log line is recorded (this is not performed when viewing the reports) # # Warning: If DROP_IP_LOGGING is enabled and there are frequent iptables hits, # then enabling this setting could cause serious performance problems ST_LOOKUP = "0" # This option will gather basic system statstics. Through the UI it displays # various graphs for disk, cpu, memory, network, etc usage over 4 intervals: # . Hourly (per minute) # . 24 hours (per minute) # . 7 days (per minute averaged over an hour) # . 30 days (per minute averaged over an hour) - user definable # The data is stored in /var/lib/csf/stats/system and the option requires the # perl GD::Graph module # # Note: Disk graphs do not show on Virtuozzo/OpenVZ servers as the kernel on # those systems do not store the required information in /proc/diskstats # On new installations or when enabling this option it will take time for these # graphs to be populated ST_SYSTEM = "0" # Set the maximum days to collect statistics for. The default is 30 days, the # more data that is collected the longer it will take for each of the graphs to # be generated ST_SYSTEM_MAXDAYS = "30" # If ST_SYSTEM is enabled, then these options can collect MySQL statistical # data. To use this option the server must have the perl modules DBI and # DBD::mysql installed. # # Set this option to "0" to disable MySQL data collection ST_MYSQL = "0" # The following options are for authentication for MySQL data collection. If # the password is left blank and the user set to "root" then the procedure will # look for authentication data in /root/.my.cnf. Otherwise, you will need to # provide a MySQL username and password to collect the data. Any MySQL user # account can be used ST_MYSQL_USER = "root" ST_MYSQL_PASS = "" ST_MYSQL_HOST = "localhost" # If ST_SYSTEM is enabled, then this option can collect Apache statistical data # The value for PT_APACHESTATUS must be correctly set ST_APACHE = "0" # The following options measure disk write performance using dd (location set # via the DD setting). It creates a 64MB file called /var/lib/dd_write_test and # the statistics will plot the MB/s response time of the disk. As this is an IO # intensive operation, it may not be prudent to run this test too often, so by # default it is only run every 5 minutes and the result duplicated for each # intervening minute for the statistics # # This is not necessrily a good measure of disk performance, primarily because # the measurements are for relatively small amounts of data over a small amount # of time. To properly test disk performance there are a variety of tools # available that should be run for extended periods of time to obtain an # accurate measurement. This metric is provided to give an idea of how the disk # is performing over time # # Note: There is a 15 second timeout performing the check # # Set to 0 to disable, 1 to enable ST_DISKW = "0" # The number of minutes that elapse between tests. Default is 5, minimum is 1. ST_DISKW_FREQ = "5" # This is the command line passed to dd. If you are familiar with dd, or wish # to move the output file (of) to a different disk, then you can alter this # command. Take great care when making any changes to this command as it is # very easy to overwrite a disk using dd if you make a mistake ST_DISKW_DD = "if=/dev/zero of=/etc/csf/dd_test bs=1MB count=64 conv=fdatasync" ############################################################################### # SECTION:Docker Settings ############################################################################### # This section provides the configuration of iptables rules to allow Docker # containers to communicate through the host. If the generated rules do not # work with your setup you will have to use a /etc/csf/csfpost.sh file and add # your own iptables configuration instead # # 1 to enable, 0 to disable DOCKER = "0" # The network device on the host DOCKER_DEVICE = "docker0" # Docker container IPv4 range DOCKER_NETWORK4 = "172.17.0.0/16" # Docker container IPv6 range. IPV6 must be enabled and the IPv6 nat table # available (see IPv6 section). Leave blank to disable DOCKER_NETWORK6 = "2001:db8:1::/64" ############################################################################### # SECTION:OS Specific Settings ############################################################################### # Binary locations IPTABLES = "/usr/sbin/iptables" IPTABLES_SAVE = "/usr/sbin/iptables-save" IPTABLES_RESTORE = "/usr/sbin/iptables-restore" IP6TABLES = "/usr/sbin/ip6tables" IP6TABLES_SAVE = "/usr/sbin/ip6tables-save" IP6TABLES_RESTORE = "/usr/sbin/ip6tables-restore" MODPROBE = "/sbin/modprobe" IFCONFIG = "/sbin/ifconfig" SENDMAIL = "/usr/sbin/sendmail" PS = "/bin/ps" VMSTAT = "/usr/bin/vmstat" NETSTAT = "/bin/netstat" LS = "/bin/ls" MD5SUM = "/usr/bin/md5sum" TAR = "/bin/tar" CHATTR = "/usr/bin/chattr" UNZIP = "/usr/bin/unzip" GUNZIP = "/bin/gunzip" DD = "/bin/dd" TAIL = "/usr/bin/tail" GREP = "/bin/grep" ZGREP = "/bin/zgrep" IPSET = "/usr/sbin/ipset" SYSTEMCTL = "/usr/bin/systemctl" HOST = "/usr/bin/host" IP = "/bin/ip" CURL = "/usr/bin/curl" WGET = "/usr/bin/wget" # Log file locations # # File globbing is allowed for the following logs. However, be aware that the # more files lfd has to track, the greater the performance hit # # Note: File globs are only evaluated when lfd is started # HTACCESS_LOG = "/var/log/nginx/error.log" MODSEC_LOG = "/var/log/nginx/error.log" SSHD_LOG = "/var/log/auth.log" SU_LOG = "/var/log/auth.log" SUDO_LOG = "/var/log/auth.log" FTPD_LOG = "/var/log/messages" SMTPAUTH_LOG = "/var/log/mail.log" POP3D_LOG = "/var/log/mail.log" IMAPD_LOG = "/var/log/mail.log" IPTABLES_LOG = "/var/log/iptables.log" SUHOSIN_LOG = "/var/log/messages" BIND_LOG = "/var/log/messages" SYSLOG_LOG = "/var/log/syslog" WEBMIN_LOG = "/var/log/auth.log" CUSTOM1_LOG = "/var/log/cron.log" # The following are comma separated lists used if LF_SELECT is enabled, # otherwise they are not used. They are derived from the application returned # from a regex match in /usr/local/csf/bin/regex.pm # # All ports default to tcp blocks. To specify udp or tcp use the format: # port;protocol,port;protocol,... For example, "53;udp,53;tcp" PORTS_pop3d = "110,995" PORTS_imapd = "143,993" PORTS_htpasswd = "80,443" PORTS_mod_security = "80,443" PORTS_mod_qos = "80,443" PORTS_symlink = "80,443" PORTS_suhosin = "80,443" PORTS_cxs = "80,443" PORTS_bind = "53" PORTS_ftpd = "20,21" PORTS_webmin = "10000" PORTS_smtpauth = "25,465,587" PORTS_eximsyntax = "25,465,587" # This list is replaced, if present, by "Port" definitions in # /etc/ssh/sshd_config PORTS_sshd = "22" # This configuration is for use with generic Linux servers, do not change the # following setting: GENERIC = "1" # For internal use only. You should not enable this option as it could cause # instability in csf and lfd DEBUG = "0" ############################################################################### ================================================ FILE: aegir/conf/var/galera.cnf ================================================ [mysqld] ### ### Galera configuration template ### /etc/mysql/conf.d/galera.cnf ### ### Mandatory for Galera # binlog_format=ROW #default_storage_engine=InnoDB innodb_autoinc_lock_mode=2 ### Recommended for Galera # innodb_flush_log_at_trx_commit=0 binlog_row_image=minimal performance_schema=OFF ### Basic Galera Settings # # wsrep_provider=/usr/lib/galera/libgalera_smm.so # wsrep_cluster_name="galera_cluster" # wsrep_cluster_address="gcomm://192.168.0.1,192.168.0.2,192.168.0.3,...?pc.wait_prim=no" # wsrep_sst_auth=wsrep:sCWL4tgEpyS5cLZITshxSTWRjhsUOeR6 # wsrep_provider_options='socket.checksum=1' ### Optional Galera Settings # # wsrep_node_address="192.168.0.1" # wsrep_node_name="galera_node1" # wsrep_slave_threads=8 ### Optional Memory Settings for Galera # # gcs.recv_q_hard_limit=4G # gcs.recv_q_soft_limit=2G # gcs.max_throttle=0.25T ### Optional MyISAM Support in Galera # # wsrep_replicate_myisam=1 ================================================ FILE: aegir/conf/var/get.htaccess.txt ================================================ # # Apache/PHP/Drupal settings: # # Protect files and directories from prying eyes. Order allow,deny # Don't show directory listings for URLs which map to a directory. Options -Indexes # Follow symbolic links in this directory. Options +FollowSymLinks # Make Drupal handle any 404 errors. ErrorDocument 404 /index.php # Set the default handler. DirectoryIndex index.php index.html index.htm # Override PHP settings that cannot be changed at runtime. See # sites/default/default.settings.php and drupal_environment_initialize() in # includes/bootstrap.inc for settings that can be changed at runtime. # PHP 5, Apache 1 and 2. php_flag magic_quotes_gpc off php_flag magic_quotes_sybase off php_flag register_globals off php_flag session.auto_start off php_value mbstring.http_input pass php_value mbstring.http_output pass php_flag mbstring.encoding_translation off # Requires mod_expires to be enabled. # Enable expirations. ExpiresActive On # Cache all files for 2 weeks after access (A). ExpiresDefault A1209600 # Do not allow PHP scripts to be cached unless they explicitly send cache # headers themselves. Otherwise all scripts would have to overwrite the # headers set by mod_expires if they want another caching behavior. This may # fail if an error occurs early in the bootstrap process, and it may cause # problems if a non-Drupal PHP file is installed in a subdirectory. ExpiresActive Off # Various rewrite rules. RewriteEngine on # Set "protossl" to "s" if we were accessed via https://. This is used later # if you enable "www." stripping or enforcement, in order to ensure that # you don't bounce between http and https. RewriteRule ^ - [E=protossl] RewriteCond %{HTTPS} on RewriteRule ^ - [E=protossl:s] # Make sure Authorization HTTP header is available to PHP # even when running as CGI or FastCGI. RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] # Block access to "hidden" directories whose names begin with a period. This # includes directories used by version control systems such as Subversion or # Git to store control files. Files whose names begin with a period, as well # as the control files used by CVS, are protected by the FilesMatch directive # above. # # NOTE: This only works when mod_rewrite is loaded. Without mod_rewrite, it is # not possible to block access to entire directories from .htaccess, because # is not allowed here. # # If you do not have mod_rewrite installed, you should remove these # directories from your webroot or otherwise protect them from being # downloaded. RewriteRule "(^|/)\." - [F] # If your site can be accessed both with and without the 'www.' prefix, you # can use one of the following settings to redirect users to your preferred # URL, either WITH or WITHOUT the 'www.' prefix. Choose ONLY one option: # # To redirect all users to access the site WITH the 'www.' prefix, # (http://example.com/... will be redirected to http://www.example.com/...) # uncomment the following: # RewriteCond %{HTTP_HOST} . # RewriteCond %{HTTP_HOST} !^www\. [NC] # RewriteRule ^ http%{ENV:protossl}://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301] # # To redirect all users to access the site WITHOUT the 'www.' prefix, # (http://www.example.com/... will be redirected to http://example.com/...) # uncomment the following: # RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC] # RewriteRule ^ http%{ENV:protossl}://%1%{REQUEST_URI} [L,R=301] # Modify the RewriteBase if you are using Drupal in a subdirectory or in a # VirtualDocumentRoot and the rewrite rules are not working properly. # For example if your site is at http://example.com/drupal uncomment and # modify the following line: # RewriteBase /drupal # # If your site is running in a VirtualDocumentRoot at http://example.com/, # uncomment the following line: # RewriteBase / # AIS: Adaptive Image Style RewriteBase / RewriteCond %{REQUEST_URI} ^(.+)/files/styles/adaptive/(.+)$ RewriteCond %{REQUEST_URI} !/modules/image/sample.png RewriteCond %{HTTP_COOKIE} ais=([a-z0-9_-]+) RewriteRule ^(.+)/files/styles/adaptive/(.+)$ $1/files/styles/%1/$2 [R=302,L] ### BOOST START ### AddDefaultCharset utf-8 ExpiresDefault A1 Header set Expires "Tue, 24 Jan 1984 08:00:00 GMT" Header set Cache-Control "no-store, no-cache, must-revalidate, post-check=0, pre-check=0" AddCharset utf-8 .html AddCharset utf-8 .xml AddCharset utf-8 .json AddCharset utf-8 .css AddCharset utf-8 .js AddEncoding gzip .gz ForceType text/html ForceType text/xml ForceType text/javascript ForceType text/css # Gzip Cookie Test RewriteRule boost-gzip-cookie-test\.html cache/perm/boost-gzip-cookie-test\.html\.gz [L,T=text/html] # GZIP - Cached css & js files RewriteCond %{HTTP_COOKIE} !(boost-gzip) RewriteCond %{HTTP:Accept-encoding} !gzip RewriteRule .* - [S=2] RewriteCond %{DOCUMENT_ROOT}/cache/perm/%{HTTP_HOST}%{REQUEST_URI}_\.css\.gz -s RewriteRule .* cache/perm/%{HTTP_HOST}%{REQUEST_URI}_\.css\.gz [L,QSA,T=text/css] RewriteCond %{DOCUMENT_ROOT}/cache/perm/%{HTTP_HOST}%{REQUEST_URI}_\.js\.gz -s RewriteRule .* cache/perm/%{HTTP_HOST}%{REQUEST_URI}_\.js\.gz [L,QSA,T=text/javascript] # NORMAL - Cached css & js files RewriteCond %{DOCUMENT_ROOT}/cache/perm/%{HTTP_HOST}%{REQUEST_URI}_\.css -s RewriteRule .* cache/perm/%{HTTP_HOST}%{REQUEST_URI}_\.css [L,QSA,T=text/css] RewriteCond %{DOCUMENT_ROOT}/cache/perm/%{HTTP_HOST}%{REQUEST_URI}_\.js -s RewriteRule .* cache/perm/%{HTTP_HOST}%{REQUEST_URI}_\.js [L,QSA,T=text/javascript] # Caching for anonymous users # Skip boost IF not get request OR uri has wrong dir OR cookie is set OR https request RewriteCond %{REQUEST_METHOD} !^(GET|HEAD)$ [OR] RewriteCond %{REQUEST_URI} (^/(admin|cache|misc|modules|sites|system|openid|themes|node/add))|(/(comment/reply|edit|user|user/(login|password|register))$) [OR] RewriteCond %{HTTP_COOKIE} DRUPAL_UID [OR] RewriteCond %{HTTPS} on RewriteRule .* - [S=7] # GZIP RewriteCond %{HTTP_COOKIE} !(boost-gzip) RewriteCond %{HTTP:Accept-encoding} !gzip RewriteRule .* - [S=3] RewriteCond %{DOCUMENT_ROOT}/cache/normal/%{HTTP_HOST}%{REQUEST_URI}_%{QUERY_STRING}\.html\.gz -s RewriteRule .* cache/normal/%{HTTP_HOST}%{REQUEST_URI}_%{QUERY_STRING}\.html\.gz [L,T=text/html] RewriteCond %{DOCUMENT_ROOT}/cache/normal/%{HTTP_HOST}%{REQUEST_URI}_%{QUERY_STRING}\.xml\.gz -s RewriteRule .* cache/normal/%{HTTP_HOST}%{REQUEST_URI}_%{QUERY_STRING}\.xml\.gz [L,T=text/xml] RewriteCond %{DOCUMENT_ROOT}/cache/normal/%{HTTP_HOST}%{REQUEST_URI}_%{QUERY_STRING}\.json\.gz -s RewriteRule .* cache/normal/%{HTTP_HOST}%{REQUEST_URI}_%{QUERY_STRING}\.json\.gz [L,T=text/javascript] # NORMAL RewriteCond %{DOCUMENT_ROOT}/cache/normal/%{HTTP_HOST}%{REQUEST_URI}_%{QUERY_STRING}\.html -s RewriteRule .* cache/normal/%{HTTP_HOST}%{REQUEST_URI}_%{QUERY_STRING}\.html [L,T=text/html] RewriteCond %{DOCUMENT_ROOT}/cache/normal/%{HTTP_HOST}%{REQUEST_URI}_%{QUERY_STRING}\.xml -s RewriteRule .* cache/normal/%{HTTP_HOST}%{REQUEST_URI}_%{QUERY_STRING}\.xml [L,T=text/xml] RewriteCond %{DOCUMENT_ROOT}/cache/normal/%{HTTP_HOST}%{REQUEST_URI}_%{QUERY_STRING}\.json -s RewriteRule .* cache/normal/%{HTTP_HOST}%{REQUEST_URI}_%{QUERY_STRING}\.json [L,T=text/javascript] ### BOOST END ### # $Id: boosted2.txt,v 1.1.2.24 2010/03/17 05:43:15 mikeytown2 Exp $ # Pass all requests not referring directly to files in the filesystem to # index.php. Clean URLs are handled in drupal_environment_initialize(). RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteCond %{REQUEST_URI} !=/favicon.ico RewriteRule ^ index.php [L] # Rules to correctly serve gzip compressed CSS and JS files. # Requires both mod_rewrite and mod_headers to be enabled. # Serve gzip compressed CSS files if they exist and the client accepts gzip. RewriteCond %{HTTP:Accept-encoding} gzip RewriteCond %{REQUEST_FILENAME}\.gz -s RewriteRule ^(.*)\.css $1\.css\.gz [QSA] # Serve gzip compressed JS files if they exist and the client accepts gzip. RewriteCond %{HTTP:Accept-encoding} gzip RewriteCond %{REQUEST_FILENAME}\.gz -s RewriteRule ^(.*)\.js $1\.js\.gz [QSA] # Serve correct content types, and prevent mod_deflate double gzip. RewriteRule \.css\.gz$ - [T=text/css,E=no-gzip:1] RewriteRule \.js\.gz$ - [T=text/javascript,E=no-gzip:1] # Serve correct encoding type. Header set Content-Encoding gzip # Force proxies to cache gzipped & non-gzipped css/js files separately. Header append Vary Accept-Encoding ================================================ FILE: aegir/conf/var/logrotate.d.rsyslog.conf ================================================ /var/log/syslog /var/log/mail.info /var/log/mail.warn /var/log/mail.err /var/log/mail.log /var/log/daemon.log /var/log/mysql-notices.log /var/log/kern.log /var/log/iptables.log /var/log/auth.log /var/log/user.log /var/log/lpr.log /var/log/cron.log /var/log/debug /var/log/messages { rotate 4 weekly missingok notifempty compress delaycompress sharedscripts postrotate /usr/lib/rsyslog/rsyslog-rotate endscript } ================================================ FILE: aegir/conf/var/my.cnf.txt ================================================ [client] port = 3306 socket = /run/mysqld/mysqld.sock default-character-set = utf8mb4 [mysqld] user = mysql pid-file = /run/mysqld/mysqld.pid socket = /run/mysqld/mysqld.sock port = 3306 basedir = /usr datadir = /var/lib/mysql tmpdir = /tmp #default_storage_engine = InnoDB #mysql_native_password = ON #mysqlx = OFF lc_messages_dir = /usr/share/mysql lc_messages = en_US character_set_server = utf8mb4 collation_server = utf8mb4_unicode_ci transaction-isolation = READ-COMMITTED transaction-read-only = OFF skip-external-locking skip-name-resolve secure_file_priv = NULL #performance_schema = OFF #performance_schema_instrument = 'wait/%=ON' #performance_schema_consumer_events_waits_current=OFF #performance_schema_consumer_events_waits_history=OFF #performance_schema_consumer_events_waits_history_long=OFF #symbolic-links = 0 connect_timeout = 60 join_buffer_size = 1M key_buffer_size = 1024M max_allowed_packet = 256M max_connect_errors = 191 max_connections = 292 max_user_connections = 191 myisam_sort_buffer_size = 256K read_buffer_size = 8M read_rnd_buffer_size = 4M sort_buffer_size = 256K bulk_insert_buffer_size = 256K table_open_cache = 2048 table_definition_cache = 512 thread_stack = 256K thread_cache_size = 128 wait_timeout = 3600 tmp_table_size = 64M max_heap_table_size = 128M low_priority_updates = 1 concurrent_insert = 2 #max_tmp_tables = 16384 server-id = 8 #myisam-recover-options = BACKUP #myisam_recover = BACKUP sync_binlog = 0 open_files_limit = 294912 innodb_autoinc_lock_mode= 2 group_concat_max_len = 10000 skip-log-bin #log_bin = ON #max_binlog_size = 256M #binlog_row_image = minimal #binlog_format = ROW #slow_query_log = 1 #long_query_time = 10 #slow_query_log_file = /var/log/mysql/sql-slow-query.log #log_queries_not_using_indexes # --- Logging in Percona 5.7 ----------------------------------------------- # log_syslog = ON # log_syslog_facility = daemon # log_syslog_include_pid = ON # --- Logging in Percona 8.x ----------------------------------------------- # log_error = /var/log/mysql/error.log # log_error_verbosity = 2 # log_error_services = log_filter_internal; log_sink_internal; log_sink_syseventlog # syseventlog.facility = daemon # syseventlog.include_pid = ON # * InnoDB # # InnoDB is enabled by default with a 10MB datafile in /var/lib/mysql/. # Read the manual for more InnoDB related options. There are many! sql_mode = NO_ENGINE_SUBSTITUTION # you can't just change log file size, requires special procedure #innodb_log_file_size = 50M #innodb_redo_log_capacity = 50M innodb_buffer_pool_instances = 8 innodb_page_cleaners = 8 innodb_lru_scan_depth = 1024 innodb_buffer_pool_size = 181M innodb_log_buffer_size = 256M innodb_file_per_table = 1 #innodb_use_native_aio = 1 innodb_open_files = 196608 innodb_io_capacity = 1000 innodb_flush_method = O_DIRECT innodb_flush_log_at_trx_commit = 2 innodb_thread_concurrency = 0 innodb_lock_wait_timeout = 300 innodb_buffer_pool_dump_at_shutdown = 1 innodb_buffer_pool_load_at_startup = 1 #innodb_buffer_pool_dump_pct = 100 #innodb_buffer_pool_dump_now = ON innodb_stats_on_metadata = OFF innodb_adaptive_hash_index = 0 innodb_default_row_format = dynamic innodb_doublewrite = 1 #innodb_checksum_algorithm=crc32 innodb_flush_log_at_timeout = 1 #innodb_force_recovery = 3 #innodb_temp_data_file_path = ibtmp1:12M:autoextend:max:900M [mysqld_safe] socket = /run/mysqld/mysqld.sock nice = 0 open_files_limit = 294912 syslog [mysqldump] quick max_allowed_packet = 256M quote-names [mysql] default-character-set = utf8mb4 no-auto-rehash [myisamchk] key_buffer = 1M sort_buffer_size = 256K read_buffer = 4M write_buffer = 4M [isamchk] key_buffer = 1M sort_buffer_size = 256K read_buffer = 4M write_buffer = 4M [mysqlhotcopy] interactive-timeout !includedir /etc/mysql/conf.d/ ================================================ FILE: aegir/conf/var/mysql ================================================ #!/bin/bash ### BEGIN INIT INFO # Provides: mysql # Required-Start: $network $remote_fs $syslog # Required-Stop: $network $remote_fs $syslog # Default-Start: 2 3 4 5 # Default-Stop: 0 1 6 # Short-Description: Start and stop Percona MySQL server # Description: Manage the Percona MySQL server daemon ### END INIT INFO # Path to Percona MySQL executable DAEMON=/usr/sbin/mysqld MYSQL_OPTS="" # PID file location PIDFILE=/run/mysqld/mysqld.pid # Configuration file location MYCNF=/etc/mysql/my.cnf # Logging LOGFILE=/var/log/mysql/mysql.log ERRORLOG=/var/log/mysql/error.log # Ensure the Percona MySQL directory exists [ -d /run/mysqld ] || mkdir -p /run/mysqld chown mysql:mysql /run/mysqld # Start Percona MySQL Server start_mysql() { echo "Starting MySQL" if [ -f $PIDFILE ]; then echo "Percona MySQL is already running." return 1 fi # Start MySQL $DAEMON --defaults-file=$MYCNF $MYSQL_OPTS > /dev/null 2>&1 & sleep 5 if [ -f $PIDFILE ]; then echo "Percona MySQL started successfully." else echo "Percona MySQL failed to start." return 1 fi } # Stop Percona MySQL Server stop_mysql() { echo "Stopping MySQL" if [ ! -f $PIDFILE ]; then echo "Percona MySQL is not running." return 1 fi kill `cat $PIDFILE` sleep 5 if [ -f $PIDFILE ]; then echo "Percona MySQL failed to stop." return 1 else echo "Percona MySQL stopped successfully." fi } # Restart Percona MySQL Server restart_mysql() { stop_mysql start_mysql } # Status of Percona MySQL Server status_mysql() { if [ -f $PIDFILE ]; then echo "Percona MySQL is running (PID: `cat $PIDFILE`)." else echo "Percona MySQL is not running." return 1 fi } case "$1" in start) start_mysql ;; stop) stop_mysql ;; restart) restart_mysql ;; status) status_mysql ;; *) echo "Usage: $0 {start|stop|restart|status}" exit 1 esac exit 0 ================================================ FILE: aegir/conf/var/mysql-notices.conf ================================================ # /etc/rsyslog.d/mysql-notices.conf if $programname == 'mysqld' and $msg contains 'InnoDB: Stopping purge' then /var/log/mysql-notices.log if $programname == 'mysqld' and $msg contains 'InnoDB: Resuming purge' then /var/log/mysql-notices.log # Don't log these specific notices in syslog or daemon.log if $programname == 'mysqld' and $msg contains 'InnoDB: Stopping purge' then stop if $programname == 'mysqld' and $msg contains 'InnoDB: Resuming purge' then stop ================================================ FILE: aegir/conf/var/named.conf.options ================================================ options { directory "/var/cache/bind"; // If there is a firewall between you and nameservers you want // to talk to, you may need to fix the firewall to allow multiple // ports to talk. See http://www.kb.cert.org/vuls/id/800113 // If your ISP provided one or more IP addresses for stable // nameservers, you probably want to use them as forwarders. // Uncomment the following block, and insert the addresses replacing // the all-0's placeholder. // forwarders { // 0.0.0.0; // }; auth-nxdomain no; # conform to RFC1035 listen-on-v6 { any; }; listen-on { 127.0.1.1; }; }; ================================================ FILE: aegir/conf/var/rsyslog.conf ================================================ # /etc/rsyslog.conf configuration file for rsyslog # # For more information install rsyslog-doc and see # /usr/share/doc/rsyslog-doc/html/configuration/index.html ################# #### MODULES #### ################# module(load="imuxsock") # provides support for local system logging module(load="imklog") # provides kernel logging support #module(load="immark") # provides --MARK-- message capability # provides UDP syslog reception #module(load="imudp") #input(type="imudp" port="514") # provides TCP syslog reception #module(load="imtcp") #input(type="imtcp" port="514") ########################### #### GLOBAL DIRECTIVES #### ########################### # # Use traditional timestamp format. # To enable high precision timestamps, comment out the following line. # $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat # # Set the default permissions for all log files. # $FileOwner root $FileGroup adm $FileCreateMode 0640 $DirCreateMode 0755 $Umask 0022 # # Where to place spool and state files # $WorkDirectory /var/spool/rsyslog # # Include all config files in /etc/rsyslog.d/ # $IncludeConfig /etc/rsyslog.d/*.conf ############### #### RULES #### ############### # # First some standard log files. Log by facility. # # Direct all cron messages to /var/log/cron.log if $programname == 'CRON' then /var/log/cron.log & stop # Log auth and authpriv messages to /var/log/auth.log auth,authpriv.* /var/log/auth.log *.*;kern.!info;\ cron.!info;\ mail.!info;\ auth,authpriv.none -/var/log/syslog daemon.* -/var/log/daemon.log kern.*;kern.!info -/var/log/kern.log lpr.* -/var/log/lpr.log mail.* -/var/log/mail.log user.* -/var/log/user.log kern.info -/var/log/iptables.log cron.info /var/log/cron.log # # Logging for the mail system. Split it up so that # it is easy to write scripts to parse these files. # mail.info -/var/log/mail.info mail.warn -/var/log/mail.warn mail.err /var/log/mail.err # # Some "catch-all" log files. # *.=debug;\ auth,authpriv.none;\ mail.none -/var/log/debug *.=info;*.=notice;*.=warn;\ kern.!info;\ auth,authpriv.none;\ cron,daemon.none;\ mail.none -/var/log/messages # # Emergencies are sent to everybody logged in. # *.emerg :omusrmsg:* ================================================ FILE: aegir/conf/var/sftp_config ================================================ GlobalDownload 0 GlobalUpload 0 Download 0 Upload 0 StayAtHome true VirtualChroot true LimitConnection 0 LimitConnectionByUser 5 LimitConnectionByIP 5 Home /home/$USER IdleTimeOut 15m ResolveIP false IgnoreHidden false HideNoAccess true DefaultRights 0664 0775 MinimumRights 0664 0775 Shell /usr/bin/lshell ================================================ FILE: aegir/conf/var/ssh_config ================================================ # This is the ssh client system-wide configuration file. See # ssh_config(5) for more information. This file provides defaults for # users, and the values can be changed in per-user configuration files # or on the command line. # Configuration data is parsed as follows: # 1. command line options # 2. user-specific file # 3. system-wide file # Any configuration value is only changed the first time it is set. # Thus, host-specific definitions should be at the beginning of the # configuration file, and defaults at the end. # Site-wide defaults for some commonly used options. For a comprehensive # list of available options, their meanings and defaults, please see the # ssh_config(5) man page. Include /etc/ssh/ssh_config.d/*.conf Host * # ForwardAgent no # ForwardX11 no # ForwardX11Trusted yes # PasswordAuthentication yes # HostbasedAuthentication no # GSSAPIAuthentication no # GSSAPIDelegateCredentials no # GSSAPIKeyExchange no # GSSAPITrustDNS no # BatchMode no # CheckHostIP yes # AddressFamily any # ConnectTimeout 0 # StrictHostKeyChecking ask # IdentityFile ~/.ssh/id_rsa # IdentityFile ~/.ssh/id_dsa # IdentityFile ~/.ssh/id_ecdsa # IdentityFile ~/.ssh/id_ed25519 # Port 22 # Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc # MACs hmac-md5,hmac-sha1,umac-64@openssh.com # EscapeChar ~ # Tunnel no # TunnelDevice any:any # PermitLocalCommand no # VisualHostKey no # ProxyCommand ssh -q -W %h:%p gateway.example.com # RekeyLimit 1G 1h # UserKnownHostsFile ~/.ssh/known_hosts.d/%k SendEnv LANG LC_* HashKnownHosts yes WarnWeakCrypto no ================================================ FILE: aegir/conf/var/sshd_config ================================================ # This is the sshd server system-wide configuration file. See # sshd_config(5) for more information. # This sshd was compiled with PATH=/usr/local/bin:/usr/bin:/bin:/usr/games # The strategy used for options in the default sshd_config shipped with # OpenSSH is to specify options with their default value where # possible, but leave them commented. Uncommented options override the # default value. Include /etc/ssh/sshd_config.d/*.conf Port 22 #AddressFamily any #ListenAddress 0.0.0.0 #ListenAddress :: #HostKey /etc/ssh/ssh_host_rsa_key #HostKey /etc/ssh/ssh_host_ecdsa_key #HostKey /etc/ssh/ssh_host_ed25519_key # Ciphers and keying #RekeyLimit default none # Logging #SyslogFacility AUTH #LogLevel INFO # Authentication: #LoginGraceTime 2m PermitRootLogin prohibit-password #StrictModes yes #MaxAuthTries 6 #MaxSessions 10 #PubkeyAuthentication yes # Expect .ssh/authorized_keys2 to be disregarded by default in future. #AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2 #AuthorizedPrincipalsFile none #AuthorizedKeysCommand none #AuthorizedKeysCommandUser nobody # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts #HostbasedAuthentication no # Change to yes if you don't trust ~/.ssh/known_hosts for # HostbasedAuthentication #IgnoreUserKnownHosts no # Don't read the user's ~/.rhosts and ~/.shosts files #IgnoreRhosts yes # To disable tunneled clear text passwords, change to no here! PermitEmptyPasswords no # Change to yes to enable challenge-response passwords (beware issues with # some PAM modules and threads) KbdInteractiveAuthentication no # Kerberos options #KerberosAuthentication no #KerberosOrLocalPasswd yes #KerberosTicketCleanup yes #KerberosGetAFSToken no # GSSAPI options #GSSAPIAuthentication no #GSSAPICleanupCredentials yes #GSSAPIStrictAcceptorCheck yes #GSSAPIKeyExchange no # Set this to 'yes' to enable PAM authentication, account processing, # and session processing. If this is enabled, PAM authentication will # be allowed through the KbdInteractiveAuthentication and # PasswordAuthentication. Depending on your PAM configuration, # PAM authentication via KbdInteractiveAuthentication may bypass # the setting of "PermitRootLogin prohibit-password". # If you just want the PAM account and session checks to run without # PAM authentication, then enable this but set PasswordAuthentication # and KbdInteractiveAuthentication to 'no'. #AllowAgentForwarding yes #AllowTcpForwarding yes #GatewayPorts no #X11Forwarding yes #X11DisplayOffset 10 #X11UseLocalhost yes #PermitTTY yes #PrintLastLog yes #PermitUserEnvironment no #Compression delayed #ClientAliveInterval 0 #ClientAliveCountMax 3 #PidFile /run/sshd.pid #MaxStartups 10:30:100 #PermitTunnel no #ChrootDirectory none #VersionAddendum none # no default banner path #Banner none # Allow client to pass locale environment variables AcceptEnv LANG LC_* # override default of no subsystems Subsystem sftp /usr/lib/openssh/sftp-server -u 0002 # Example of overriding settings on a per-user basis #Match User anoncvs # X11Forwarding no # AllowTcpForwarding no # PermitTTY no # ForceCommand cvs server IgnoreUserKnownHosts no PasswordAuthentication yes UseDNS no UsePAM no PrintMotd yes ClientAliveInterval 300 ClientAliveCountMax 10000 TCPKeepAlive yes MaxAuthTries 3 LoginGraceTime 30 MaxStartups 5:50:10 X11Forwarding no AllowTcpForwarding no AllowAgentForwarding no ================================================ FILE: aegir/conf/var/sysctl.conf ================================================ # ============================================================================= # sysctl.conf - Kernel parameter tuning for KVM/QEMU virtual machines # Target: Devuan Daedalus 5.x (Linux kernel 6.1 LTS / Debian Bookworm base) # Compatible with: Linux 4.9+ (all settings verified for kernel 6.1) # # Apply changes with: sysctl -p /etc/sysctl.conf # Verify a value with: sysctl # # Sections: # 1. IPv4 Security Hardening # 2. IPv6 Disablement # 3. TCP/IP Performance Tuning # 4. Network Buffer Sizes # 5. Virtual Memory # 6. Filesystem & Process Limits # 7. Kernel Security Hardening # ============================================================================= # ----------------------------------------------------------------------------- # 1. IPv4 Security Hardening # ----------------------------------------------------------------------------- # Ignore ICMP echo requests sent to broadcast addresses (smurf attack defence) net.ipv4.icmp_echo_ignore_broadcasts = 1 # Suppress bogus ICMP error responses that could be used for OS fingerprinting net.ipv4.icmp_ignore_bogus_error_responses = 1 # Enable SYN cookies to withstand SYN flood attacks without dropping connections net.ipv4.tcp_syncookies = 1 # Log martian packets (packets with impossible source addresses). # Useful for detecting spoofing attempts; generates some log noise on noisy # networks. Set to 0 if log verbosity is a concern. net.ipv4.conf.all.log_martians = 1 net.ipv4.conf.default.log_martians = 1 # Reject source-routed packets (attacker-controlled routing) net.ipv4.conf.all.accept_source_route = 0 net.ipv4.conf.default.accept_source_route = 0 # Strict Reverse Path Filtering: drop packets whose source address has no # return route through the interface they arrived on. Prevents IP spoofing. # Use rp_filter = 2 (loose mode) only if asymmetric routing is required. net.ipv4.conf.all.rp_filter = 1 net.ipv4.conf.default.rp_filter = 1 # Reject ICMP redirect messages (could be used to alter routing tables) net.ipv4.conf.all.accept_redirects = 0 net.ipv4.conf.default.accept_redirects = 0 # Reject "secure" redirects as well (redirects from listed gateways only) net.ipv4.conf.all.secure_redirects = 0 net.ipv4.conf.default.secure_redirects = 0 # Do not forward traffic between interfaces (this is not a router) net.ipv4.ip_forward = 0 # Do not send ICMP redirects (only relevant on routers) net.ipv4.conf.all.send_redirects = 0 net.ipv4.conf.default.send_redirects = 0 # Protect against TIME_WAIT assassination (RFC 1337). # Drops RST packets for sockets in TIME_WAIT state. net.ipv4.tcp_rfc1337 = 1 # ----------------------------------------------------------------------------- # 2. IPv6 Disablement # ----------------------------------------------------------------------------- # Remove this section entirely if IPv6 is needed. If keeping IPv6, replace # these with appropriate security settings instead of wholesale disablement. # Disable IPv6 on all interfaces including loopback net.ipv6.conf.all.disable_ipv6 = 1 net.ipv6.conf.default.disable_ipv6 = 1 net.ipv6.conf.lo.disable_ipv6 = 1 # The following are redundant when disable_ipv6 = 1 but are kept as a # defence-in-depth measure in case IPv6 is re-enabled without removing this file net.ipv6.conf.default.router_solicitations = 0 net.ipv6.conf.default.accept_ra_rtr_pref = 0 net.ipv6.conf.default.accept_ra_pinfo = 0 net.ipv6.conf.default.accept_ra_defrtr = 0 net.ipv6.conf.default.autoconf = 0 net.ipv6.conf.default.dad_transmits = 0 net.ipv6.conf.default.max_addresses = 1 # ----------------------------------------------------------------------------- # 3. TCP/IP Performance Tuning # ----------------------------------------------------------------------------- # Use BBR (Bottleneck Bandwidth and RTT) congestion control. # BBR significantly improves throughput in virtualised environments compared # to the default CUBIC algorithm. Requires the 'fq' packet scheduler below. # Available since kernel 4.9; present in Daedalus kernel 6.1. net.core.default_qdisc = fq net.ipv4.tcp_congestion_control = bbr # How long to wait before closing a socket in FIN_WAIT_2 (seconds). # Reducing from the 60s default frees ports faster under heavy connection churn. # Do not go below 15 on systems with load balancers or long-RTT clients. net.ipv4.tcp_fin_timeout = 20 # TCP keepalive: how long an idle connection is kept before probing begins. # 300s is a reasonable balance between detecting dead peers and keeping # long-lived idle connections (e.g. SSH, database pools) alive. net.ipv4.tcp_keepalive_time = 300 # Number of unacknowledged probes before the connection is declared dead net.ipv4.tcp_keepalive_probes = 5 # Interval between consecutive keepalive probes (seconds) net.ipv4.tcp_keepalive_intvl = 15 # Disable slow-start restart after an idle period. # Prevents throughput degradation for long-lived but bursty connections # (e.g. HTTP/2 keep-alive, gRPC). Recommended for most server workloads. net.ipv4.tcp_slow_start_after_idle = 0 # Allow TIME_WAIT sockets to be reused for new outbound connections. # Safe when tcp_timestamps is enabled (which it is below). net.ipv4.tcp_tw_reuse = 1 # Ephemeral port range for outbound connections. # Starting at 1024 (below 1024 requires CAP_NET_BIND_SERVICE anyway) gives # more ports. The previous value of 2000 wasted the 1024-1999 range. net.ipv4.ip_local_port_range = 1024 65535 # Maximum queue length for SYN requests awaiting completion of the 3-way # handshake. Increase for servers handling high connection rates. net.ipv4.tcp_max_syn_backlog = 4096 # Number of times a SYN-ACK is retransmitted for an incoming connection. # Reducing from the 5 default shortens the time a half-open connection # occupies resources before being abandoned. net.ipv4.tcp_synack_retries = 2 # Enable TCP timestamps (RFC 1323). Required for tcp_tw_reuse to be safe, # and improves RTT estimation accuracy. Disable only if you have strong # reasons (e.g. privacy concerns about timestamp-based OS fingerprinting). net.ipv4.tcp_timestamps = 1 # Enable window scaling (RFC 1323) to support receive windows > 65535 bytes. # Essential for performance over high-bandwidth or high-latency paths. net.ipv4.tcp_window_scaling = 1 # Enable TCP Fast Open for both outbound (1) and inbound (2) connections. # Value 3 = both. Reduces latency for repeated TCP connections by allowing # data in the SYN packet. Requires application support. net.ipv4.tcp_fastopen = 3 # Raise the conntrack table size if this VM runs iptables/nftables and # sees high connection volume. The default (~65k) is often too low. # Note: this parameter only takes effect if the nf_conntrack module is loaded. net.netfilter.nf_conntrack_max = 262144 # TCP SACK (Selective Acknowledgments) - leave enabled (default = 1). # SACK improves recovery from packet loss. The security argument for disabling # it (a 2019 kernel bug) has been patched in all current kernels. net.ipv4.tcp_sack = 1 # ----------------------------------------------------------------------------- # 4. Network Buffer Sizes # ----------------------------------------------------------------------------- # Per-socket TCP receive buffer: min, default, max (bytes) # 8 MB max gives headroom for high-BDP (bandwidth-delay product) paths # without wasting memory on idle sockets. net.ipv4.tcp_rmem = 4096 131072 8388608 # Per-socket TCP send buffer: min, default, max (bytes) net.ipv4.tcp_wmem = 4096 131072 8388608 # Global maximum socket receive/send buffer (bytes). # Must be >= the max values in tcp_rmem/tcp_wmem above. net.core.rmem_max = 8388608 net.core.wmem_max = 8388608 # Default socket receive/send buffer for non-TCP protocols (UDP etc.) net.core.rmem_default = 262144 net.core.wmem_default = 262144 # Maximum number of packets queued on the input side of a network interface # before the kernel starts dropping them. Increase for high-throughput NICs. net.core.netdev_max_backlog = 16384 # Maximum number of connections that can be queued for acceptance per socket. # nginx/Apache worker queues and similar services benefit from values >= 1024. net.core.somaxconn = 1024 # ----------------------------------------------------------------------------- # 5. Virtual Memory # ----------------------------------------------------------------------------- # Swappiness: how aggressively the kernel swaps anonymous memory to disk. # 0 = swap only to avoid OOM # 1 = swap as little as possible (original value; risky with limited RAM) # 10 = sensible minimum for VMs; avoids OOM kills while still preferring RAM # 60 = kernel default # For VMs with ample RAM and no swap, 1 is acceptable. For typical VMs, # 10 reduces the risk of unexpected OOM kills under memory pressure. vm.swappiness = 10 # vfs_cache_pressure controls how eagerly the kernel reclaims memory used for # dentries and inodes. Default is 100 (neutral). Values > 100 reclaim more # aggressively; values < 100 keep more cache. 50 favours retaining the VFS # cache, which benefits workloads touching many files (web servers, git, etc.) # The original value of 200 was excessively aggressive for most workloads. vm.vfs_cache_pressure = 50 # Minimum virtual address for mmap. Prevents null-pointer dereference exploits. # 4096 = one page. Some hardened profiles set this to 65536. vm.mmap_min_addr = 65536 # Memory overcommit policy: # 0 = heuristic (default): the kernel uses an estimate of available memory # 1 = always allow overcommit (suitable for scientific/HPC workloads) # 2 = strict: never commit more than (RAM * overcommit_ratio / 100) + swap # Mode 0 is appropriate for general-purpose VMs. # overcommit_ratio is only meaningful with mode 2; leaving it at the default # (50) avoids confusion. The original config set ratio=0 with mode=0 which # had no effect but implied strict behaviour. vm.overcommit_memory = 0 # vm.overcommit_ratio = 50 # Only relevant when overcommit_memory = 2 # ----------------------------------------------------------------------------- # 6. Filesystem & Process Limits # ----------------------------------------------------------------------------- # Maximum number of open file descriptors system-wide. # Raise if running databases, high-concurrency servers, or many containers. fs.file-max = 2097152 # Maximum number of concurrent asynchronous I/O operations system-wide. # Relevant for databases (PostgreSQL, MySQL) that use AIO heavily. fs.aio-max-nr = 1048576 # Maximum number of inotify watches per user. # 65536 covers most use cases. Raise to 524288 if running IDEs, webpack, # lsyncd, or other file-watching tools that exhaust the default. fs.inotify.max_user_watches = 65536 # Maximum number of inotify event queue entries per inotify instance. # The default (16384) is usually fine; raise if you see ENOSPC from inotify. fs.inotify.max_queued_events = 32768 # Protect against hardlink attacks (e.g. TOCTOU in /tmp). # Prevents users from creating hardlinks to files they do not own. fs.protected_hardlinks = 1 # Protect against symlink attacks in world-writable sticky directories. fs.protected_symlinks = 1 # Protect against opening FIFOs in world-writable sticky directories # by users other than the owner. Available since kernel 4.19. fs.protected_fifos = 1 # Prevent opening regular files not owned by the user in world-writable # sticky directories. Available since kernel 4.19. # 2 = also block writes; 1 = block opens by non-owners fs.protected_regular = 2 # Disable core dumps for setuid programs. Prevents sensitive memory from # being written to disk by privilege-dropped processes. fs.suid_dumpable = 0 # ----------------------------------------------------------------------------- # 7. Kernel Security Hardening # ----------------------------------------------------------------------------- # Full ASLR: randomise the base addresses of the stack, VDSO, and mmap regions. # 0 = off, 1 = partial, 2 = full. Always use 2 on production systems. kernel.randomize_va_space = 2 # Restrict access to the kernel message ring buffer (dmesg) to root only. # Prevents unprivileged users from gleaning kernel addresses or error details. kernel.dmesg_restrict = 1 # Hide kernel symbol addresses from unprivileged users. # 1 = hide from non-root, 2 = hide from all including root (CAP_SYSLOG bypasses). # kptr_restrict = 2 is the stricter option; use 1 if you need oops reports. kernel.kptr_restrict = 2 # Restrict ptrace to parent processes (or root). Prevents one unprivileged # process from attaching to and inspecting another. # 1 = restricted (recommended), 0 = permissive (default), 3 = disabled entirely # Note: this is a Debian/Ubuntu-specific sysctl; it may be a no-op on some kernels. kernel.yama.ptrace_scope = 1 # Suppress most kernel messages on the console. The four values are: # console_loglevel, default_message_loglevel, min_console_level, default_console_level # "4 1 1 7" shows KERN_WARNING and above on the console, which is appropriate # for production VMs to avoid log spam without silencing warnings. kernel.printk = 4 1 1 7 # Redirect core dumps to /dev/null rather than writing them to disk. # Prevents potentially sensitive process memory from being captured. # To re-enable temporarily: sysctl -w kernel.core_pattern=core kernel.core_pattern = |/bin/false # Maximum PID value. The default (32768) can be exhausted by systems running # many threads or containers. 4194304 is the maximum on 64-bit kernels. kernel.pid_max = 4194304 # Kernel module loading: # Uncomment the line below only on fully provisioned systems where you are # certain no additional modules will ever need to be loaded. It is # irreversible without a reboot. # kernel.modules_disabled = 1 # ============================================================================= # End of sysctl.conf # ============================================================================= ================================================ FILE: aegir/conf/version/barracuda-release.txt ================================================ BOA-5.9.1-dev ================================================ FILE: aegir/conf/version/barracuda-version.txt ================================================ BOA-5.9.1-dev ================================================ FILE: aegir/conf/version/octopus-release.txt ================================================ BOA-5.9.1-dev ================================================ FILE: aegir/conf/version/octopus-version.txt ================================================ BOA-5.9.1-dev ================================================ FILE: aegir/conf/version/release.txt ================================================ BOA-5.9.1-dev ================================================ FILE: aegir/conf/version/version.txt ================================================ BOA-5.9.1-dev ================================================ FILE: aegir/helpers/Gemfile.txt ================================================ source 'https://rubygems.org' group :development do # Sass, Compass and extensions. gem 'sass' # Sass. gem 'sass-globbing' # Import Sass files based on globbing pattern. gem 'compass' # Framework built on Sass. gem 'compass-validator' # So you can `compass validate`. gem 'compass-normalize' # Compass version of normalize.css. gem 'compass-rgbapng' # Turns rgba() into .png's for backwards compatibility. gem 'susy' # Susy grid framework. gem 'singularitygs' # Alternative to the Susy grid framework. gem 'toolkit' # Compass utility from the fabulous Snugug. gem 'breakpoint' # Manages CSS media queries. gem 'oily_png' # Faster Compass sprite generation. gem 'css_parser' # Helps `compass stats` output statistics. # Guard gem 'guard' # Guard event handler. gem 'guard-compass' # Compile on sass/scss change. gem 'guard-shell' # Run shell commands. gem 'guard-livereload' # Browser reload. gem 'yajl-ruby' # Faster JSON with LiveReload in the browser. # Dependency to prevent polling. Setup for multiple OS environments. # Optionally remove the lines not specific to your OS. # https://github.com/guard/guard#efficient-filesystem-handling gem 'rb-inotify', '~> 0.9', :require => false # Linux gem 'rb-fsevent', :require => false # Mac OSX gem 'rb-fchange', :require => false # Windows end ================================================ FILE: aegir/helpers/apt-list-debian.txt ================================================ ftp.at.debian.org ftp.au.debian.org ftp.ba.debian.org ftp.be.debian.org ftp.bg.debian.org ftp.br.debian.org ftp.ca.debian.org ftp.ch.debian.org ftp.cz.debian.org ftp.de.debian.org ftp.debian.org ftp.dk.debian.org ftp.ee.debian.org ftp.es.debian.org ftp.fi.debian.org ftp.fr.debian.org ftp.gr.debian.org ftp.hk.debian.org ftp.hu.debian.org ftp.ie.debian.org ftp.it.debian.org ftp.jp.debian.org ftp.lt.debian.org ftp.nl.debian.org ftp.nz.debian.org ftp.pl.debian.org ftp.pt.debian.org ftp.ro.debian.org ftp.ru.debian.org ftp.se.debian.org ftp.sk.debian.org ftp.th.debian.org ftp.tr.debian.org ftp.tw.debian.org ftp.ua.debian.org ftp.uk.debian.org ftp.us.debian.org ================================================ FILE: aegir/helpers/apt.conf.noi.dist ================================================ APT::Get::Assume-Yes "true"; APT::Get::Show-Upgraded "true"; APT::Get::Install-Recommends "false"; APT::Get::Install-Suggests "false"; APT::Quiet "true"; DPkg::Options {"--force-confnew";"--force-confmiss";}; DPkg::Pre-Install-Pkgs {"/usr/sbin/dpkg-preconfigure --apt";}; Dir::Etc::SourceList "/etc/apt/sources.list"; ================================================ FILE: aegir/helpers/apt.conf.noi.nrml ================================================ APT::Get::Assume-Yes "true"; APT::Get::Show-Upgraded "true"; APT::Get::Install-Recommends "false"; APT::Get::Install-Suggests "false"; APT::Quiet "true"; DPkg::Options {"--force-confdef";"--force-confmiss";"--force-confold"}; DPkg::Pre-Install-Pkgs {"/usr/sbin/dpkg-preconfigure --apt";}; Dir::Etc::SourceList "/etc/apt/sources.list"; ================================================ FILE: aegir/helpers/apt.conf.noninteractive ================================================ APT::Get::Assume-Yes "true"; APT::Get::Show-Upgraded "true"; APT::Get::Install-Recommends "false"; APT::Get::Install-Suggests "false"; APT::Quiet "true"; DPkg::Options {"--force-confdef";"--force-confmiss";"--force-confold"}; DPkg::Pre-Install-Pkgs {"/usr/sbin/dpkg-preconfigure --apt";}; Dir::Etc::SourceList "/etc/apt/sources.list"; ================================================ FILE: aegir/helpers/cf-simple-hook.sh ================================================ #!/usr/bin/env bash # Enable strict error handling for debugging only # set -euo pipefail function vault_upload { local DOMAIN="${1}" local KEYFILE="${2}" local CERTFILE="${3}" local FULLCHAINFILE="${4}" local CHAINFILE="${5}" local MAIN=$(<<<"${DOMAIN}" grep -oP '[^\.]+\.[^\.]+$') local HOST="${DOMAIN/.${MAIN}/}" if [[ "${HOST}" == "" ]]; then local STORE=secret/dehydrated/${MAIN}/${HOST} else local STORE=secret/dehydrated/${MAIN}/wildcard fi local TOKEN=$( curl -s -X POST \ -d "{\"role_id\":\"SNIP\",\"secret_id\":\"SNIP\"}" \ https://vault.example.com/v1/auth/approle/login | jq -r .auth.client_token ) curl -s -X POST \ -H "X-Vault-Token: ${TOKEN}" \ -d @<( jq -n \ --arg cert "$(< ${CERTFILE} )" \ --arg key "$(< ${KEYFILE} )" \ --arg chain "$(< ${CHAINFILE} )" \ --arg fullchain "$(< ${FULLCHAINFILE} )" \ --arg timestamp "${TIMESTAMP}" \ '{cert:$cert,key:$key,chain:$chain,fullchain:$fullchain}' ) \ https://vault.example.com/v1/${STORE} } function deploy_challenge { local DOMAIN="${1}" local TOKEN_FILENAME="${2}" local TOKEN_VALUE="${3}" lexicon cloudflare create ${DOMAIN} TXT \ --name="_acme-challenge.${DOMAIN}." \ --content="${TOKEN_VALUE}" \ --auth-username="devops@example.com" \ --auth-token="SNIP" sleep 10 : } function clean_challenge { local DOMAIN="${1}" local TOKEN_FILENAME="${2}" local TOKEN_VALUE="${3}" lexicon cloudflare delete ${DOMAIN} TXT \ --name="_acme-challenge.${DOMAIN}." \ --content="${TOKEN_VALUE}" \ --auth-username="devops@example.com" \ --auth-token="SNIP" : } function deploy_cert { local DOMAIN="${1}" local KEYFILE="${2}" local CERTFILE="${3}" local FULLCHAINFILE="${4}" local CHAINFILE="${5}" vault_upload "${@}" : } function unchanged_cert { local DOMAIN="${1}" local KEYFILE="${2}" local CERTFILE="${3}" local FULLCHAINFILE="${4}" local CHAINFILE="${5}" vault_upload "${@}" : } function invalid_challenge() { local DOMAIN="${1}" local RESPONSE="${2}" : } exit_hook() { : } startup_hook() { : } HANDLER="${1}" shift if [ -n "$(type -t ${HANDLER})" ] && [ "$(type -t ${HANDLER})" = function ]; then $HANDLER "${@}" fi ================================================ FILE: aegir/helpers/challenge-dns-email-hook.sh ================================================ #!/usr/bin/env bash function has_propagated { while [ "$#" -ge 2 ]; do local RECORD_NAME="${1}"; shift local TOKEN_VALUE="${1}"; shift if [ ${#AUTH_NS[@]} -eq 0 ]; then local RECORD_DOMAIN=$RECORD_NAME declare -a iAUTH_NS while [ -z "$iAUTH_NS" ]; do RECORD_DOMAIN=$(echo "${RECORD_DOMAIN}" | cut -d'.' -f 2-) iAUTH_NS=($(dig +short "${RECORD_DOMAIN}" IN CNAME)) if [ -n "$iAUTH_NS" ]; then unset iAUTH_NS && declare -a iAUTH_NS continue fi iAUTH_NS=($(dig +short "${RECORD_DOMAIN}" IN NS)) done else local iAUTH_NS=("${AUTH_NS[@]}") fi for NS in "${iAUTH_NS[@]}"; do dig +short @"${NS}" "${RECORD_NAME}" IN TXT | grep -q "\"${TOKEN_VALUE}\"" || return 1 done unset iAUTH_NS done return 0 } function ocsp_update { local DOMAIN="${1}" KEYFILE="${2}" CERTFILE="${3}" FULLCHAINFILE="${4}" CHAINFILE="${5}" TIMESTAMP="${6}" # Get oscp response and shove it into a file, used for OCSP stapling. # # You only need this for old versions of of nginx that can't do this itself, # or if your server is behind a proxy (eg nginx can't do OCSP via HTTP proxy). # # Parameters: # - DOMAIN # The primary domain name, i.e. the certificate common # name (CN). # - KEYFILE # The path of the file containing the private key. # - CERTFILE # The path of the file containing the signed certificate. # - FULLCHAINFILE # The path of the file containing the full certificate chain. # - CHAINFILE # The path of the file containing the intermediate certificate(s). # - TIMESTAMP # Timestamp when the specified certificate was created. if [ -n "${OCSP_RESPONSE_FILE}" ]; then if [ -z "${OCSP_HOST}" ]; then OCSP_HOST="${http_proxy}" # eg http://foo.bar:3128/ # strip protocol and path: OCSP_HOST="$(echo "$OCSP_HOST" | sed -E 's/(\w+:\/\/)((\w|\.)+:[0-9]+?)\/?.*/\2/')" # eg foo.bar:3128 fi if [ -n "$VERBOSE" ]; then echo "OCSP_HOST: $OCSP_HOST" echo "http_proxy: $http_proxy" echo "OCSP_RESPONSE_FILE: $OCSP_RESPONSE_FILE" echo "CHAINFILE: $CHAINFILE" echo "CERTFILE: $CERTFILE" echo "command: openssl ocsp -noverify -no_nonce -respout \"${OCSP_RESPONSE_FILE}\" -issuer \"${CHAINFILE}\" -cert \"${CERTFILE}\" -host \"${OCSP_HOST}\" -path \"\$(openssl x509 -noout -ocsp_uri -in \"${CERTFILE}\")\" -CApath \"/etc/ssl/certs\"" fi if [ -n "${OCSP_HOST}" ]; then openssl ocsp -noverify -no_nonce -respout "${OCSP_RESPONSE_FILE}" -issuer "${CHAINFILE}" -cert "${CERTFILE}" -host "${OCSP_HOST}" -path "$(openssl x509 -noout -ocsp_uri -in "${CERTFILE}")" -CApath "/etc/ssl/certs" else openssl ocsp -noverify -no_nonce -respout "${OCSP_RESPONSE_FILE}" -issuer "${CHAINFILE}" -cert "${CERTFILE}" -path "$(openssl x509 -noout -ocsp_uri -in "${CERTFILE}")" -CApath "/etc/ssl/certs" fi fi } function oscp_update { #oops :) ocsp_update "$@" } function deploy_challenge { local RECORDS=() RECIPIENT=${RECIPIENT:-$(id -u -n)} local FIRSTDOMAIN="${1}" local SUBJECT="Let's Encrypt certificate renewal" while (( "$#" >= 3 )); do local DOMAIN="${1}"; shift local TOKEN_FILENAME="${1}"; shift local TOKEN_VALUE="${1}"; shift # This hook is called once for every domain that needs to be # validated, including any alternative names you may have listed. # # Parameters: # - DOMAIN # The domain name (CN or subject alternative name) being # validated. # - TOKEN_FILENAME # The name of the file containing the token to be served for HTTP # validation. Should be served by your web server as # /.well-known/acme-challenge/${TOKEN_FILENAME}. # - TOKEN_VALUE # The token value that needs to be served for validation. For DNS # validation, this is what you want to put in the _acme-challenge # TXT record. For HTTP validation it is the value that is expected # be found in the $TOKEN_FILENAME file. RECORD_NAME="_acme-challenge.${DOMAIN}" RECORDS+=( ${RECORD_NAME} ) RECORDS+=( ${TOKEN_VALUE} ) done read -d '' MESSAGE <= 3 )); do local DOMAIN="${1}"; shift local TOKEN_FILENAME="${1}"; shift local TOKEN_VALUE="${1}"; shift # This hook is called after attempting to validate each domain, # whether or not validation was successful. Here you can delete # files or DNS records that are no longer needed. # # The parameters are the same as for deploy_challenge. RECORD_NAME="_acme-challenge.${DOMAIN}" RECORDS+=( ${RECORD_NAME} ) RECORDS+=( ${TOKEN_VALUE} ) done read -d '' MESSAGE <= 2 )); do MESSAGE="$(printf '%s\n %s. IN TXT %s\n' "$MESSAGE" "${RECORDS[0]}" "${RECORDS[1]}")" RECORDS=( "${RECORDS[@]:2}" ) done echo "$MESSAGE" | s-nail -s "$SUBJECT" "$RECIPIENT" } function deploy_cert { local DOMAIN="${1}" KEYFILE="${2}" CERTFILE="${3}" FULLCHAINFILE="${4}" CHAINFILE="${5}" TIMESTAMP="${6}" # This hook is called once for each certificate that has been # produced. Here you might, for instance, copy your new certificates # to service-specific locations and reload the service. # # Parameters: # - DOMAIN # The primary domain name, i.e. the certificate common # name (CN). # - KEYFILE # The path of the file containing the private key. # - CERTFILE # The path of the file containing the signed certificate. # - FULLCHAINFILE # The path of the file containing the full certificate chain. # - CHAINFILE # The path of the file containing the intermediate certificate(s). # - TIMESTAMP # Timestamp when the specified certificate was created. oscp_update "$@" } function unchanged_cert { local DOMAIN="${1}" KEYFILE="${2}" CERTFILE="${3}" FULLCHAINFILE="${4}" CHAINFILE="${5}" # This hook is called once for each certificate that is still # valid and therefore wasn't reissued. # # Parameters: # - DOMAIN # The primary domain name, i.e. the certificate common # name (CN). # - KEYFILE # The path of the file containing the private key. # - CERTFILE # The path of the file containing the signed certificate. # - FULLCHAINFILE # The path of the file containing the full certificate chain. # - CHAINFILE # The path of the file containing the intermediate certificate(s). oscp_update "$@" } HANDLER=$1; shift if [[ "${HANDLER}" =~ ^(deploy_challenge|clean_challenge|deploy_cert|unchanged_cert)$ ]]; then "$HANDLER" "$@" fi ================================================ FILE: aegir/helpers/dehydrated ================================================ #!/usr/bin/env bash # dehydrated by lukas2511 # Source: https://dehydrated.io # # This script is licensed under The MIT License (see LICENSE for more information). set -e set -u set -o pipefail [[ -n "${ZSH_VERSION:-}" ]] && set -o SH_WORD_SPLIT && set +o FUNCTION_ARGZERO && set -o NULL_GLOB && set -o noglob [[ -z "${ZSH_VERSION:-}" ]] && shopt -s nullglob && set -f umask 077 # paranoid umask, we're creating private keys # Close weird external file descriptors exec 3>&- exec 4>&- VERSION="0.7.3" # Find directory in which this script is stored by traversing all symbolic links SOURCE="${0}" while [ -h "$SOURCE" ]; do # resolve $SOURCE until the file is no longer a symlink DIR="$( cd -P "$( dirname "$SOURCE" )" && pwd )" SOURCE="$(readlink "$SOURCE")" [[ $SOURCE != /* ]] && SOURCE="$DIR/$SOURCE" # if $SOURCE was a relative symlink, we need to resolve it relative to the path where the symlink file was located done SCRIPTDIR="$( cd -P "$( dirname "$SOURCE" )" && pwd )" BASEDIR="${SCRIPTDIR}" ORIGARGS=("${@}") noglob_set() { if [[ -n "${ZSH_VERSION:-}" ]]; then set +o noglob else set +f fi } noglob_clear() { if [[ -n "${ZSH_VERSION:-}" ]]; then set -o noglob else set -f fi } # Generate json.sh path matching string json_path() { if [ ! "${1}" = "-p" ]; then printf '"%s"' "${1}" else printf '%s' "${2}" fi } # Get string value from json dictionary get_json_string_value() { local filter filter="$(printf 's/.*\[%s\][[:space:]]*"\([^"]*\)"/\\1/p' "$(json_path "${1:-}" "${2:-}")")" sed -n "${filter}" } # Get array values from json dictionary get_json_array_values() { grep -E '^\['"$(json_path "${1:-}" "${2:-}")"',[0-9]*\]' | sed -e 's/\[[^\]*\][[:space:]]*//g' -e 's/^"//' -e 's/"$//' } # Get sub-dictionary from json get_json_dict_value() { local filter filter="$(printf 's/.*\[%s\][[:space:]]*\(.*\)/\\1/p' "$(json_path "${1:-}" "${2:-}")")" sed -n "${filter}" | jsonsh } # Get integer value from json get_json_int_value() { local filter filter="$(printf 's/.*\[%s\][[:space:]]*\([^"]*\)/\\1/p' "$(json_path "${1:-}" "${2:-}")")" sed -n "${filter}" } # Get boolean value from json get_json_bool_value() { local filter filter="$(printf 's/.*\[%s\][[:space:]]*\([^"]*\)/\\1/p' "$(json_path "${1:-}" "${2:-}")")" sed -n "${filter}" } # JSON.sh JSON-parser # Modified from https://github.com/dominictarr/JSON.sh # Original Copyright (c) 2011 Dominic Tarr # Licensed under The MIT License jsonsh() { throw() { echo "$*" >&2 exit 1 } awk_egrep () { local pattern_string=$1 awk '{ while ($0) { start=match($0, pattern); token=substr($0, start, RLENGTH); print token; $0=substr($0, start+RLENGTH); } }' pattern="$pattern_string" } tokenize () { local GREP local ESCAPE local CHAR if echo "test string" | grep -Eao --color=never "test" >/dev/null 2>&1 then GREP='grep -Eao --color=never' else GREP='grep -Eao' fi # shellcheck disable=SC2196 if echo "test string" | grep -Eao "test" >/dev/null 2>&1 then ESCAPE='(\\[^u[:cntrl:]]|\\u[0-9a-fA-F]{4})' CHAR='[^[:cntrl:]"\\]' else GREP=awk_egrep ESCAPE='(\\\\[^u[:cntrl:]]|\\u[0-9a-fA-F]{4})' CHAR='[^[:cntrl:]"\\\\]' fi local STRING="\"$CHAR*($ESCAPE$CHAR*)*\"" local NUMBER='-?(0|[1-9][0-9]*)([.][0-9]*)?([eE][+-]?[0-9]*)?' local KEYWORD='null|false|true' local SPACE='[[:space:]]+' # Force zsh to expand $A into multiple words local is_wordsplit_disabled is_wordsplit_disabled="$(unsetopt 2>/dev/null | grep -c '^shwordsplit$' || true)" if [ "${is_wordsplit_disabled}" != "0" ]; then setopt shwordsplit; fi $GREP "$STRING|$NUMBER|$KEYWORD|$SPACE|." | grep -Ev "^$SPACE$" if [ "${is_wordsplit_disabled}" != "0" ]; then unsetopt shwordsplit; fi } parse_array () { local index=0 local ary='' read -r token case "$token" in ']') ;; *) while : do parse_value "$1" "$index" index=$((index+1)) ary="$ary""$value" read -r token case "$token" in ']') break ;; ',') ary="$ary," ;; *) throw "EXPECTED , or ] GOT ${token:-EOF}" ;; esac read -r token done ;; esac value=$(printf '[%s]' "$ary") || value= : } parse_object () { local key local obj='' read -r token case "$token" in '}') ;; *) while : do case "$token" in '"'*'"') key=$token ;; *) throw "EXPECTED string GOT ${token:-EOF}" ;; esac read -r token case "$token" in ':') ;; *) throw "EXPECTED : GOT ${token:-EOF}" ;; esac read -r token parse_value "$1" "$key" obj="$obj$key:$value" read -r token case "$token" in '}') break ;; ',') obj="$obj," ;; *) throw "EXPECTED , or } GOT ${token:-EOF}" ;; esac read -r token done ;; esac value=$(printf '{%s}' "$obj") || value= : } parse_value () { local jpath="${1:+$1,}${2:-}" case "$token" in '{') parse_object "$jpath" ;; '[') parse_array "$jpath" ;; # At this point, the only valid single-character tokens are digits. ''|[!0-9]) throw "EXPECTED value GOT ${token:-EOF}" ;; *) value="${token//\\\///}" # replace solidus ("\/") in json strings with normalized value: "/" ;; esac [ "$value" = '' ] && return [ -z "$jpath" ] && return # do not print head printf "[%s]\t%s\n" "$jpath" "$value" : } parse () { read -r token parse_value read -r token || true case "$token" in '') ;; *) throw "EXPECTED EOF GOT $token" ;; esac } tokenize | parse } # Convert IP addresses to their reverse dns variants. # Used for ALPN certs as validation for IPs uses this in SNI since IPs aren't allowed there. ip_to_ptr() { ip="$(cat)" if [[ "${ip}" =~ : ]]; then printf "%sip6.arpa" "$(printf "%s" "${ip}" | awk -F: 'BEGIN {OFS=""; }{addCount = 9 - NF; for(i=1; i<=NF;i++){if(length($i) == 0){ for(j=1;j<=addCount;j++){$i = ($i "0000");} } else { $i = substr(("0000" $i), length($i)+5-4);}}; print}' | rev | sed -e "s/./&./g")" else printf "%s.in-addr.arpa" "$(printf "%s" "${ip}" | awk -F. '{print $4"."$3"." $2"."$1}')" fi } # IPv6 conversion helpers ipv6_expand() { # expand double colons until 8 segments exist # replace remaining double colon with single colon # pad all segments to 4 characters with leading zeros _sed \ -e ':addsegs; /^([^:]*:){0,7}[^:]*$/{ s/::/:0000::/g; t addsegs; }' \ -e 's/::/:/' \ -e ':padsegs; s/(:|^)([^:]{0,3})(:|$)/\10\2\3/g; t padsegs;' } ipv6_shorten() { # remove leading zeros from all segments # find the longest matching run of zeros and replace with double colons (this could be prettier..) _sed \ -e ':unpadsegs;/(^|:)0/{s/(^|:)0([^:])/\1\2/g;t unpadsegs;}' \ -e '/(^|:)(0(:|$)){8}/{ s/(^|:)(0(:|$)){8}/::/; t end; }' \ -e '/(^|:)(0(:|$)){7}/{ s/(^|:)(0(:|$)){7}/::/; t end; }' \ -e '/(^|:)(0(:|$)){6}/{ s/(^|:)(0(:|$)){6}/::/; t end; }' \ -e '/(^|:)(0(:|$)){5}/{ s/(^|:)(0(:|$)){5}/::/; t end; }' \ -e '/(^|:)(0(:|$)){4}/{ s/(^|:)(0(:|$)){4}/::/; t end; }' \ -e '/(^|:)(0(:|$)){3}/{ s/(^|:)(0(:|$)){3}/::/; t end; }' \ -e '/(^|:)(0(:|$)){2}/{ s/(^|:)(0(:|$)){2}/::/; t end; }' \ -e ':end' } ipv6_normalize() { for domain in $(cat); do if [[ "${domain}" =~ : ]]; then printf "%s" "${domain}" | ipv6_expand | ipv6_shorten else printf "%s" "${domain}" fi printf " " done | sed -e 's/ $//' } # Create (identifiable) temporary files _mktemp() { mktemp "${TMPDIR:-/tmp}/dehydrated-XXXXXX" } # Check for script dependencies check_dependencies() { # look for required binaries for binary in grep mktemp diff sed awk curl cut head tail hexdump; do bin_path="$(command -v "${binary}" 2>/dev/null)" || _exiterr "This script requires ${binary}." [[ -x "${bin_path}" ]] || _exiterr "${binary} found in PATH but it's not executable" done # just execute some dummy and/or version commands to see if required tools are actually usable "${OPENSSL}" version > /dev/null 2>&1 || _exiterr "This script requires an openssl binary." _sed "" < /dev/null > /dev/null 2>&1 || _exiterr "This script requires sed with support for extended (modern) regular expressions." # curl returns with an error code in some ancient versions so we have to catch that set +e CURL_VERSION="$(curl -V 2>&1 | head -n1 | awk '{print $2}')" set -e } store_configvars() { __KEY_ALGO="${KEY_ALGO}" __OCSP_MUST_STAPLE="${OCSP_MUST_STAPLE}" __OCSP_FETCH="${OCSP_FETCH}" __OCSP_DAYS="${OCSP_DAYS}" __PRIVATE_KEY_RENEW="${PRIVATE_KEY_RENEW}" __PRIVATE_KEY_ROLLOVER="${PRIVATE_KEY_ROLLOVER}" __KEYSIZE="${KEYSIZE}" __CHALLENGETYPE="${CHALLENGETYPE}" __HOOK="${HOOK}" __PREFERRED_CHAIN="${PREFERRED_CHAIN}" __WELLKNOWN="${WELLKNOWN}" __HOOK_CHAIN="${HOOK_CHAIN}" __OPENSSL_CNF="${OPENSSL_CNF}" __RENEW_DAYS="${RENEW_DAYS}" __IP_VERSION="${IP_VERSION}" __ACME_PROFILE="${ACME_PROFILE}" __ORDER_TIMEOUT=${ORDER_TIMEOUT} __VALIDATION_TIMEOUT=${VALIDATION_TIMEOUT} __KEEP_GOING=${KEEP_GOING} } reset_configvars() { KEY_ALGO="${__KEY_ALGO}" OCSP_MUST_STAPLE="${__OCSP_MUST_STAPLE}" OCSP_FETCH="${__OCSP_FETCH}" OCSP_DAYS="${__OCSP_DAYS}" PRIVATE_KEY_RENEW="${__PRIVATE_KEY_RENEW}" PRIVATE_KEY_ROLLOVER="${__PRIVATE_KEY_ROLLOVER}" KEYSIZE="${__KEYSIZE}" CHALLENGETYPE="${__CHALLENGETYPE}" HOOK="${__HOOK}" PREFERRED_CHAIN="${__PREFERRED_CHAIN}" WELLKNOWN="${__WELLKNOWN}" HOOK_CHAIN="${__HOOK_CHAIN}" OPENSSL_CNF="${__OPENSSL_CNF}" RENEW_DAYS="${__RENEW_DAYS}" IP_VERSION="${__IP_VERSION}" ACME_PROFILE="${__ACME_PROFILE}" ORDER_TIMEOUT=${__ORDER_TIMEOUT} VALIDATION_TIMEOUT=${__VALIDATION_TIMEOUT} KEEP_GOING="${__KEEP_GOING}" } hookscript_bricker_hook() { # Hook scripts should ignore any hooks they don't know. # Calling a random hook to make this clear to the hook script authors... if [[ -n "${HOOK}" ]]; then "${HOOK}" "this_hookscript_is_broken__dehydrated_is_working_fine__please_ignore_unknown_hooks_in_your_script" || _exiterr "Please check your hook script, it should exit cleanly without doing anything on unknown/new hooks." fi } # verify configuration values verify_config() { [[ "${CHALLENGETYPE}" == "http-01" || "${CHALLENGETYPE}" == "dns-01" || "${CHALLENGETYPE}" == "dns-persist-01" || "${CHALLENGETYPE}" == "tls-alpn-01" ]] || _exiterr "Unknown challenge type ${CHALLENGETYPE}... cannot continue." if [[ "${COMMAND:-}" =~ sign_domains|sign_csr ]]; then if [[ "${CHALLENGETYPE}" = "dns-01" ]] && [[ -z "${HOOK}" ]]; then _exiterr "Challenge type dns-01 needs a hook script for deployment... cannot continue." fi if [[ "${CHALLENGETYPE}" = "http-01" ]] && [[ ! -d "${WELLKNOWN}" ]]; then _exiterr "WELLKNOWN directory doesn't exist, please create ${WELLKNOWN} and set appropriate permissions." fi fi [[ "${KEY_ALGO}" == "rsa" || "${KEY_ALGO}" == "prime256v1" || "${KEY_ALGO}" == "secp384r1" || "${KEY_ALGO}" == "secp521r1" ]] || _exiterr "Unknown public key algorithm ${KEY_ALGO}... cannot continue." if [[ -n "${IP_VERSION}" ]]; then [[ "${IP_VERSION}" = "4" || "${IP_VERSION}" = "6" ]] || _exiterr "Unknown IP version ${IP_VERSION}... cannot continue." fi [[ "${API}" == "auto" || "${API}" == "1" || "${API}" == "2" ]] || _exiterr "Unsupported API version defined in config: ${API}" [[ "${OCSP_DAYS}" =~ ^[0-9]+$ ]] || _exiterr "OCSP_DAYS must be a number" [[ "${ORDER_TIMEOUT}" =~ ^[0-9]+$ ]] || _exiterr "ORDER_TIMEOUT must be a number" [[ "${VALIDATION_TIMEOUT}" =~ ^[0-9]+$ ]] || _exiterr "VALIDATION_TIMEOUT must be a number" } # Setup default config values, search for and load configuration files load_config() { # Check for config in various locations if [[ -z "${CONFIG:-}" ]]; then for check_config in "/etc/dehydrated" "/usr/local/etc/dehydrated" "${PWD}" "${SCRIPTDIR}"; do if [[ -f "${check_config}/config" ]]; then BASEDIR="${check_config}" CONFIG="${check_config}/config" break fi done fi # Preset CA_ZEROSSL="https://acme.zerossl.com/v2/DV90" CA_LETSENCRYPT="https://acme-v02.api.letsencrypt.org/directory" CA_LETSENCRYPT_TEST="https://acme-staging-v02.api.letsencrypt.org/directory" CA_BUYPASS="https://api.buypass.com/acme/directory" CA_BUYPASS_TEST="https://api.test4.buypass.no/acme/directory" CA_GOOGLE="https://dv.acme-v02.api.pki.goog/directory" CA_GOOGLE_TEST="https://dv.acme-v02.test-api.pki.goog/directory" # Default values CA="letsencrypt" OLDCA= CERTDIR= ALPNCERTDIR= ACCOUNTDIR= ACCOUNT_KEYSIZE="4096" ACCOUNT_KEY_ALGO=rsa CHALLENGETYPE="http-01" CONFIG_D= CURL_OPTS= DOMAINS_D= DOMAINS_TXT= HOOK= PREFERRED_CHAIN= HOOK_CHAIN="no" RENEW_DAYS="69" KEYSIZE="4096" WELLKNOWN= PRIVATE_KEY_RENEW="yes" PRIVATE_KEY_ROLLOVER="no" KEY_ALGO=secp384r1 OPENSSL=openssl OPENSSL_CNF= CONTACT_EMAIL= LOCKFILE= OCSP_MUST_STAPLE="no" OCSP_FETCH="no" OCSP_DAYS=5 IP_VERSION= CHAINCACHE= AUTO_CLEANUP="no" AUTO_CLEANUP_DELETE="no" DEHYDRATED_USER= DEHYDRATED_GROUP= API=2 ACME_PROFILE="" ORDER_TIMEOUT=0 VALIDATION_TIMEOUT=0 KEEP_GOING="no" if [[ -z "${CONFIG:-}" ]]; then echo "#" >&2 echo "# BOA auto-config mode" >&2 echo "#" >&2 elif [[ -f "${CONFIG}" ]]; then echo "# INFO: Using main config file ${CONFIG}" BASEDIR="$(dirname "${CONFIG}")" # shellcheck disable=SC1090 . "${CONFIG}" else _exiterr "Specified config file doesn't exist." fi if [[ -n "${CONFIG_D}" ]]; then if [[ ! -d "${CONFIG_D}" ]]; then _exiterr "The path ${CONFIG_D} specified for CONFIG_D does not point to a directory." fi # Allow globbing noglob_set for check_config_d in "${CONFIG_D}"/*.sh; do if [[ -f "${check_config_d}" ]] && [[ -r "${check_config_d}" ]]; then echo "# INFO: Using additional config file ${check_config_d}" # shellcheck disable=SC1090 . "${check_config_d}" else _exiterr "Specified additional config ${check_config_d} is not readable or not a file at all." fi done # Disable globbing noglob_clear fi # Check for missing dependencies check_dependencies has_sudo() { command -v sudo > /dev/null 2>&1 || _exiterr "DEHYDRATED_USER set but sudo not available. Please install sudo." } # Check if we are running & are allowed to run as root if [[ -n "$DEHYDRATED_USER" ]]; then command -v getent > /dev/null 2>&1 || _exiterr "DEHYDRATED_USER set but getent not available. Please install getent." TARGET_UID="$(getent passwd "${DEHYDRATED_USER}" | cut -d':' -f3)" || _exiterr "DEHYDRATED_USER ${DEHYDRATED_USER} is invalid" if [[ -z "${DEHYDRATED_GROUP}" ]]; then if [[ "${EUID}" != "${TARGET_UID}" ]]; then echo "# INFO: Running $0 as ${DEHYDRATED_USER}" has_sudo && exec sudo -u "${DEHYDRATED_USER}" "${0}" "${ORIGARGS[@]}" fi else TARGET_GID="$(getent group "${DEHYDRATED_GROUP}" | cut -d':' -f3)" || _exiterr "DEHYDRATED_GROUP ${DEHYDRATED_GROUP} is invalid" if [[ -z "${EGID:-}" ]]; then command -v id > /dev/null 2>&1 || _exiterr "DEHYDRATED_GROUP set, don't know current gid and 'id' not available... Please provide 'id' binary." EGID="$(id -g)" fi if [[ "${EUID}" != "${TARGET_UID}" ]] || [[ "${EGID}" != "${TARGET_GID}" ]]; then echo "# INFO: Running $0 as ${DEHYDRATED_USER}/${DEHYDRATED_GROUP}" has_sudo && exec sudo -u "${DEHYDRATED_USER}" -g "${DEHYDRATED_GROUP}" "${0}" "${ORIGARGS[@]}" fi fi elif [[ -n "${DEHYDRATED_GROUP}" ]]; then _exiterr "DEHYDRATED_GROUP can only be used in combination with DEHYDRATED_USER." fi # Remove slash from end of BASEDIR. Mostly for cleaner outputs, doesn't change functionality. [[ "$BASEDIR" != "/" ]] && BASEDIR="${BASEDIR%%/}" # Check BASEDIR and set default variables [[ -d "${BASEDIR}" ]] || _exiterr "BASEDIR does not exist: ${BASEDIR}" # Check for ca cli parameter if [ -n "${PARAM_CA:-}" ]; then CA="${PARAM_CA}" fi # Preset CAs if [ "${CA}" = "letsencrypt" ]; then CA="${CA_LETSENCRYPT}" elif [ "${CA}" = "letsencrypt-test" ]; then CA="${CA_LETSENCRYPT_TEST}" elif [ "${CA}" = "zerossl" ]; then CA="${CA_ZEROSSL}" elif [ "${CA}" = "buypass" ]; then CA="${CA_BUYPASS}" elif [ "${CA}" = "buypass-test" ]; then CA="${CA_BUYPASS_TEST}" elif [ "${CA}" = "google" ]; then CA="${CA_GOOGLE}" elif [ "${CA}" = "google-test" ]; then CA="${CA_GOOGLE_TEST}" fi if [[ -z "${OLDCA}" ]] && [[ "${CA}" = "https://acme-v02.api.letsencrypt.org/directory" ]]; then OLDCA="https://acme-v01.api.letsencrypt.org/directory" fi # Create new account directory or symlink to account directory from old CA # dev note: keep in mind that because of the use of 'echo' instead of 'printf' or # similar there is a newline encoded in the directory name. not going to fix this # since it's a non-issue and trying to fix existing installations would be too much # trouble CAHASH="$(echo "${CA}" | urlbase64)" [[ -z "${ACCOUNTDIR}" ]] && ACCOUNTDIR="${BASEDIR}/accounts" if [[ ! -e "${ACCOUNTDIR}/${CAHASH}" ]]; then OLDCAHASH="$(echo "${OLDCA}" | urlbase64)" mkdir -p "${ACCOUNTDIR}" if [[ -n "${OLDCA}" ]] && [[ -e "${ACCOUNTDIR}/${OLDCAHASH}" ]]; then echo "! Reusing account from ${OLDCA}" ln -s "${OLDCAHASH}" "${ACCOUNTDIR}/${CAHASH}" else mkdir "${ACCOUNTDIR}/${CAHASH}" fi fi # shellcheck disable=SC1090 [[ -f "${ACCOUNTDIR}/${CAHASH}/config" ]] && . "${ACCOUNTDIR}/${CAHASH}/config" ACCOUNT_KEY="${ACCOUNTDIR}/${CAHASH}/account_key.pem" ACCOUNT_KEY_JSON="${ACCOUNTDIR}/${CAHASH}/registration_info.json" ACCOUNT_ID_JSON="${ACCOUNTDIR}/${CAHASH}/account_id.json" ACCOUNT_DEACTIVATED="${ACCOUNTDIR}/${CAHASH}/deactivated" if [[ -f "${ACCOUNT_DEACTIVATED}" ]]; then _exiterr "Account has been deactivated. Remove account and create a new one using --register." fi if [[ -f "${BASEDIR}/private_key.pem" ]] && [[ ! -f "${ACCOUNT_KEY}" ]]; then echo "! Moving private_key.pem to ${ACCOUNT_KEY}" mv "${BASEDIR}/private_key.pem" "${ACCOUNT_KEY}" fi if [[ -f "${BASEDIR}/private_key.json" ]] && [[ ! -f "${ACCOUNT_KEY_JSON}" ]]; then echo "! Moving private_key.json to ${ACCOUNT_KEY_JSON}" mv "${BASEDIR}/private_key.json" "${ACCOUNT_KEY_JSON}" fi [[ -z "${CERTDIR}" ]] && CERTDIR="${BASEDIR}/certs" [[ -z "${ALPNCERTDIR}" ]] && ALPNCERTDIR="${BASEDIR}/alpn-certs" [[ -z "${CHAINCACHE}" ]] && CHAINCACHE="${BASEDIR}/chains" [[ -z "${DOMAINS_TXT}" ]] && DOMAINS_TXT="${BASEDIR}/domains.txt" [[ -z "${WELLKNOWN}" ]] && WELLKNOWN="${BASEDIR}/.acme-challenges" [[ -z "${LOCKFILE}" ]] && LOCKFILE="${BASEDIR}/lock" [[ -z "${OPENSSL_CNF}" ]] && OPENSSL_CNF="$("${OPENSSL}" version -d | cut -d\" -f2)/openssl.cnf" [[ -n "${PARAM_LOCKFILE_SUFFIX:-}" ]] && LOCKFILE="${LOCKFILE}-${PARAM_LOCKFILE_SUFFIX}" [[ -n "${PARAM_NO_LOCK:-}" ]] && LOCKFILE="" [[ -n "${PARAM_HOOK:-}" ]] && HOOK="${PARAM_HOOK}" [[ -n "${PARAM_DOMAINS_TXT:-}" ]] && DOMAINS_TXT="${PARAM_DOMAINS_TXT}" [[ -n "${PARAM_PREFERRED_CHAIN:-}" ]] && PREFERRED_CHAIN="${PARAM_PREFERRED_CHAIN}" [[ -n "${PARAM_CERTDIR:-}" ]] && CERTDIR="${PARAM_CERTDIR}" [[ -n "${PARAM_ALPNCERTDIR:-}" ]] && ALPNCERTDIR="${PARAM_ALPNCERTDIR}" [[ -n "${PARAM_CHALLENGETYPE:-}" ]] && CHALLENGETYPE="${PARAM_CHALLENGETYPE}" [[ -n "${PARAM_KEY_ALGO:-}" ]] && KEY_ALGO="${PARAM_KEY_ALGO}" [[ -n "${PARAM_OCSP_MUST_STAPLE:-}" ]] && OCSP_MUST_STAPLE="${PARAM_OCSP_MUST_STAPLE}" [[ -n "${PARAM_IP_VERSION:-}" ]] && IP_VERSION="${PARAM_IP_VERSION}" [[ -n "${PARAM_ACME_PROFILE:-}" ]] && ACME_PROFILE="${PARAM_ACME_PROFILE}" [[ -n "${PARAM_ORDER_TIMEOUT:-}" ]] && ORDER_TIMEOUT="${PARAM_ORDER_TIMEOUT}" [[ -n "${PARAM_VALIDATION_TIMEOUT:-}" ]] && VALIDATION_TIMEOUT="${PARAM_VALIDATION_TIMEOUT}" [[ -n "${PARAM_KEEP_GOING:-}" ]] && KEEP_GOING="${PARAM_KEEP_GOING}" if [ "${PARAM_FORCE_VALIDATION:-no}" = "yes" ] && [ "${PARAM_FORCE:-no}" = "no" ]; then _exiterr "Argument --force-validation can only be used in combination with --force (-x)" fi if [ ! "${1:-}" = "noverify" ]; then verify_config fi store_configvars } # Initialize system init_system() { load_config # Lockfile handling (prevents concurrent access) if [[ -n "${LOCKFILE}" ]]; then LOCKDIR="$(dirname "${LOCKFILE}")" [[ -w "${LOCKDIR}" ]] || _exiterr "Directory ${LOCKDIR} for LOCKFILE ${LOCKFILE} is not writable, aborting." ( set -C; date > "${LOCKFILE}" ) 2>/dev/null || _exiterr "Lock file '${LOCKFILE}' present, aborting." remove_lock() { rm -f "${LOCKFILE}"; } trap 'remove_lock' EXIT fi # Get CA URLs CA_DIRECTORY="$(http_request get "${CA}" | jsonsh)" # Automatic discovery of API version if [[ "${API}" = "auto" ]]; then grep -q newOrder <<< "${CA_DIRECTORY}" && API=2 || API=1 fi # shellcheck disable=SC2015 if [[ "${API}" = "1" ]]; then CA_NEW_CERT="$(printf "%s" "${CA_DIRECTORY}" | get_json_string_value new-cert)" && CA_NEW_AUTHZ="$(printf "%s" "${CA_DIRECTORY}" | get_json_string_value new-authz)" && CA_NEW_REG="$(printf "%s" "${CA_DIRECTORY}" | get_json_string_value new-reg)" && CA_TERMS="$(printf "%s" "${CA_DIRECTORY}" | get_json_string_value terms-of-service)" && CA_REQUIRES_EAB="false" && CA_REVOKE_CERT="$(printf "%s" "${CA_DIRECTORY}" | get_json_string_value revoke-cert)" || _exiterr "Problem retrieving ACME/CA-URLs, check if your configured CA points to the directory entrypoint." # Since reg URI is missing from directory we will assume it is the same as CA_NEW_REG without the new part CA_REG=${CA_NEW_REG/new-reg/reg} if [[ -n "${ACME_PROFILE}" ]]; then _exiterr "ACME profiles are not supported in ACME v1." fi else CA_NEW_ORDER="$(printf "%s" "${CA_DIRECTORY}" | get_json_string_value newOrder)" && CA_NEW_NONCE="$(printf "%s" "${CA_DIRECTORY}" | get_json_string_value newNonce)" && CA_NEW_ACCOUNT="$(printf "%s" "${CA_DIRECTORY}" | get_json_string_value newAccount)" && CA_TERMS="$(printf "%s" "${CA_DIRECTORY}" | get_json_string_value -p '"meta","termsOfService"')" && CA_REQUIRES_EAB="$(printf "%s" "${CA_DIRECTORY}" | get_json_bool_value -p '"meta","externalAccountRequired"' || echo false)" && CA_REVOKE_CERT="$(printf "%s" "${CA_DIRECTORY}" | get_json_string_value revokeCert)" || _exiterr "Problem retrieving ACME/CA-URLs, check if your configured CA points to the directory entrypoint." # Checking ACME profile if [[ -n "${ACME_PROFILE}" ]]; then # Extract available profiles from CA directory declare -A available_profiles=() while IFS=$'\t' read -r path value; do if [[ "${value}" =~ ^\"([^\"]+)\"$ ]]; then value=${BASH_REMATCH[1]} fi if [[ "${path}" =~ ^\[\"([^\"]+)\"\]$ ]]; then available_profiles[${BASH_REMATCH[1]}]=$value fi done <<< "$(printf "%s" "${CA_DIRECTORY}" | get_json_dict_value -p '"meta","profiles"' 2>/dev/null)" if [[ ${#available_profiles[@]} -eq 0 ]]; then _exiterr "ACME profile not supported by this CA" fi # Check if the requested profile is available found_profile="no" for profile in "${!available_profiles[@]}"; do if [[ "${profile}" == "${ACME_PROFILE}" ]]; then found_profile="yes" break fi done if [[ "${found_profile}" == "no" ]]; then _exiterr "ACME profile '${ACME_PROFILE}' not found, available profiles:$(for key in "${!available_profiles[@]}"; do printf "\n %s: %s" "${key}" "${available_profiles[$key]}"; done)" fi fi fi # Export some environment variables to be used in hook script export WELLKNOWN BASEDIR CERTDIR ALPNCERTDIR CONFIG COMMAND # Checking for private key ... register_new_key="no" generated="false" if [[ -n "${PARAM_ACCOUNT_KEY:-}" ]]; then # a private key was specified from the command line so use it for this run echo "Using private key ${PARAM_ACCOUNT_KEY} instead of account key" ACCOUNT_KEY="${PARAM_ACCOUNT_KEY}" ACCOUNT_KEY_JSON="${PARAM_ACCOUNT_KEY}.json" ACCOUNT_ID_JSON="${PARAM_ACCOUNT_KEY}_id.json" [ "${COMMAND:-}" = "register" ] && register_new_key="yes" else # Check if private account key exists, if it doesn't exist yet generate a new one (rsa key) if [[ ! -e "${ACCOUNT_KEY}" ]]; then if [[ ! "${PARAM_ACCEPT_TERMS:-}" = "yes" ]]; then printf '\n' >&2 printf 'To use dehydrated with this certificate authority you have to agree to their terms of service which you can find here: %s\n\n' "${CA_TERMS}" >&2 printf 'To accept these terms of service run "%s --register --accept-terms".\n' "${0}" >&2 exit 1 fi echo "+ Generating account key..." generated="true" local tmp_account_key tmp_account_key="$(_mktemp)" if [[ ${API} -eq 1 && ! "${ACCOUNT_KEY_ALGO}" = "rsa" ]]; then _exiterr "ACME API version 1 does not support EC account keys" fi case "${ACCOUNT_KEY_ALGO}" in rsa) _openssl genrsa -out "${tmp_account_key}" "${ACCOUNT_KEYSIZE}";; prime256v1|secp384r1|secp521r1) _openssl ecparam -genkey -name "${ACCOUNT_KEY_ALGO}" -out "${tmp_account_key}" -noout;; esac cat "${tmp_account_key}" > "${ACCOUNT_KEY}" rm "${tmp_account_key}" register_new_key="yes" fi fi if ("${OPENSSL}" rsa -in "${ACCOUNT_KEY}" -check 2>/dev/null > /dev/null); then # Get public components from private key and calculate thumbprint pubExponent64="$(printf '%x' "$("${OPENSSL}" rsa -in "${ACCOUNT_KEY}" -noout -text | awk '/publicExponent/ {print $2}')" | hex2bin | urlbase64)" pubMod64="$("${OPENSSL}" rsa -in "${ACCOUNT_KEY}" -noout -modulus | cut -d'=' -f2 | hex2bin | urlbase64)" account_key_info="$(printf '{"e":"%s","kty":"RSA","n":"%s"}' "${pubExponent64}" "${pubMod64}")" account_key_sigalgo=RS256 elif ("${OPENSSL}" ec -in "${ACCOUNT_KEY}" -check 2>/dev/null > /dev/null); then curve="$("${OPENSSL}" ec -in "${ACCOUNT_KEY}" -noout -text 2>/dev/null | grep 'NIST CURVE' | cut -d':' -f2 | tr -d ' ')" pubkey="$("${OPENSSL}" ec -in "${ACCOUNT_KEY}" -noout -text 2>/dev/null | tr -d '\n ' | grep -Eo 'pub:.*ASN1' | _sed -e 's/^pub://' -e 's/ASN1$//' | tr -d ':')" if [ "${curve}" = "P-256" ]; then account_key_sigalgo="ES256" elif [ "${curve}" = "P-384" ]; then account_key_sigalgo="ES384" elif [ "${curve}" = "P-521" ]; then account_key_sigalgo="ES512" else _exiterr "Unknown account key curve: ${curve}" fi ec_x_offset=2 ec_x_len=$((${#pubkey}/2 - 1)) ec_x="${pubkey:$ec_x_offset:$ec_x_len}" ec_x64="$(printf "%s" "${ec_x}" | hex2bin | urlbase64)" ec_y_offset=$((ec_x_offset+ec_x_len)) ec_y_len=$((${#pubkey}-ec_y_offset)) ec_y="${pubkey:$ec_y_offset:$ec_y_len}" ec_y64="$(printf "%s" "${ec_y}" | hex2bin | urlbase64)" account_key_info="$(printf '{"crv":"%s","kty":"EC","x":"%s","y":"%s"}' "${curve}" "${ec_x64}" "${ec_y64}")" else _exiterr "Account key is not valid, cannot continue." fi thumbprint="$(printf '%s' "${account_key_info}" | "${OPENSSL}" dgst -sha256 -binary | urlbase64)" # If we generated a new private key in the step above we have to register it with the acme-server if [[ "${register_new_key}" = "yes" ]]; then echo "+ Registering account key with ACME server..." FAILED=false if [[ ${API} -eq 1 && -z "${CA_NEW_REG}" ]] || [[ ${API} -eq 2 && -z "${CA_NEW_ACCOUNT}" ]]; then echo "Certificate authority doesn't allow registrations." FAILED=true fi # ZeroSSL special sauce if [[ "${CA}" = "${CA_ZEROSSL}" ]]; then if [[ -z "${EAB_KID:-}" ]] || [[ -z "${EAB_HMAC_KEY:-}" ]]; then if [[ -z "${CONTACT_EMAIL}" ]]; then echo "ZeroSSL requires contact email to be set or EAB_KID/EAB_HMAC_KEY to be manually configured" FAILED=true else zeroapi="$(curl ${ip_version:-} -A "dehydrated/${VERSION} curl/${CURL_VERSION}" ${CURL_OPTS} -s "https://api.zerossl.com/acme/eab-credentials-email" -d "email=${CONTACT_EMAIL}" | jsonsh)" EAB_KID="$(printf "%s" "${zeroapi}" | get_json_string_value eab_kid)" EAB_HMAC_KEY="$(printf "%s" "${zeroapi}" | get_json_string_value eab_hmac_key)" if [[ -z "${EAB_KID:-}" ]] || [[ -z "${EAB_HMAC_KEY:-}" ]]; then echo "Unknown error retrieving ZeroSSL API credentials" echo "${zeroapi}" FAILED=true fi fi fi fi # Google special sauce if [[ "${CA}" = "${CA_GOOGLE}" ]]; then if [[ -z "${CONTACT_EMAIL}" ]] || [[ -z "${EAB_KID:-}" ]] || [[ -z "${EAB_HMAC_KEY:-}" ]]; then echo "Google requires contact email, EAB_KID and EAB_HMAC_KEY to be manually configured (see https://cloud.google.com/certificate-manager/docs/public-ca-tutorial)" FAILED=true fi fi # Check if external account is required if [[ "${FAILED}" = "false" ]]; then if [[ "${CA_REQUIRES_EAB}" = "true" ]]; then if [[ -z "${EAB_KID:-}" ]] || [[ -z "${EAB_HMAC_KEY:-}" ]]; then FAILED=true echo "This CA requires an external account but no EAB_KID/EAB_HMAC_KEY has been configured" fi fi fi # If an email for the contact has been provided then adding it to the registration request if [[ "${FAILED}" = "false" ]]; then if [[ ${API} -eq 1 ]]; then if [[ -n "${CONTACT_EMAIL}" ]]; then (signed_request "${CA_NEW_REG}" '{"resource": "new-reg", "contact":["mailto:'"${CONTACT_EMAIL}"'"], "agreement": "'"${CA_TERMS}"'"}' > "${ACCOUNT_KEY_JSON}") || FAILED=true else (signed_request "${CA_NEW_REG}" '{"resource": "new-reg", "agreement": "'"${CA_TERMS}"'"}' > "${ACCOUNT_KEY_JSON}") || FAILED=true fi else if [[ -n "${EAB_KID:-}" ]] && [[ -n "${EAB_HMAC_KEY:-}" ]]; then eab_url="${CA_NEW_ACCOUNT}" eab_protected64="$(printf '{"alg":"HS256","kid":"%s","url":"%s"}' "${EAB_KID}" "${eab_url}" | urlbase64)" eab_payload64="$(printf "%s" "${account_key_info}" | urlbase64)" eab_key="$(printf "%s" "${EAB_HMAC_KEY}" | deurlbase64 | bin2hex)" eab_signed64="$(printf '%s' "${eab_protected64}.${eab_payload64}" | "${OPENSSL}" dgst -binary -sha256 -mac HMAC -macopt "hexkey:${eab_key}" | urlbase64)" if [[ -n "${CONTACT_EMAIL}" ]]; then regjson='{"contact":["mailto:'"${CONTACT_EMAIL}"'"], "termsOfServiceAgreed": true, "externalAccountBinding": {"protected": "'"${eab_protected64}"'", "payload": "'"${eab_payload64}"'", "signature": "'"${eab_signed64}"'"}}' else regjson='{"termsOfServiceAgreed": true, "externalAccountBinding": {"protected": "'"${eab_protected64}"'", "payload": "'"${eab_payload64}"'", "signature": "'"${eab_signed64}"'"}}' fi else if [[ -n "${CONTACT_EMAIL}" ]]; then regjson='{"contact":["mailto:'"${CONTACT_EMAIL}"'"], "termsOfServiceAgreed": true}' else regjson='{"termsOfServiceAgreed": true}' fi fi (signed_request "${CA_NEW_ACCOUNT}" "${regjson}" > "${ACCOUNT_KEY_JSON}") || FAILED=true fi fi if [[ "${FAILED}" = "true" ]]; then echo >&2 echo >&2 echo "Error registering account key. See message above for more information." >&2 if [[ "${generated}" = "true" ]]; then rm "${ACCOUNT_KEY}" fi rm -f "${ACCOUNT_KEY_JSON}" exit 1 fi elif [[ "${COMMAND:-}" = "register" ]]; then echo "+ Account already registered!" exit 0 fi # Read account information or request from CA if missing if [[ -e "${ACCOUNT_KEY_JSON}" ]]; then if [[ ${API} -eq 1 ]]; then ACCOUNT_ID="$(jsonsh < "${ACCOUNT_KEY_JSON}" | get_json_int_value id)" ACCOUNT_URL="${CA_REG}/${ACCOUNT_ID}" else if [[ -e "${ACCOUNT_ID_JSON}" ]]; then ACCOUNT_URL="$(jsonsh < "${ACCOUNT_ID_JSON}" | get_json_string_value url)" fi # if account URL is not storred, fetch it from the CA if [[ -z "${ACCOUNT_URL:-}" ]]; then echo "+ Fetching account URL..." ACCOUNT_URL="$(signed_request "${CA_NEW_ACCOUNT}" '{"onlyReturnExisting": true}' 4>&1 | grep -i ^Location: | cut -d':' -f2- | tr -d ' \t\r\n')" if [[ -z "${ACCOUNT_URL}" ]]; then _exiterr "Unknown error on fetching account information" fi echo '{"url":"'"${ACCOUNT_URL}"'"}' > "${ACCOUNT_ID_JSON}" # store the URL for next time fi fi else echo "Fetching missing account information from CA..." if [[ ${API} -eq 1 ]]; then _exiterr "This is not implemented for ACMEv1! Consider switching to ACMEv2 :)" else ACCOUNT_URL="$(signed_request "${CA_NEW_ACCOUNT}" '{"onlyReturnExisting": true}' 4>&1 | grep -i ^Location: | cut -d':' -f2- | tr -d ' \t\r\n')" ACCOUNT_INFO="$(signed_request "${ACCOUNT_URL}" '{}')" fi echo "${ACCOUNT_INFO}" > "${ACCOUNT_KEY_JSON}" fi } # Different sed version for different os types... _sed() { if [[ "${OSTYPE}" = "Linux" || "${OSTYPE:0:5}" = "MINGW" ]]; then sed -r "${@}" else sed -E "${@}" fi } # Print error message and exit with error _exiterr() { if [ -n "${1:-}" ]; then echo "ERROR: ${1}" >&2 fi [[ "${skip_exit_hook:-no}" = "no" ]] && [[ -n "${HOOK:-}" ]] && ("${HOOK}" "exit_hook" "${1:-}" || echo 'exit_hook returned with non-zero exit code!' >&2) exit 1 } # Remove newlines and whitespace from json clean_json() { tr -d '\r\n' | _sed -e 's/ +/ /g' -e 's/\{ /{/g' -e 's/ \}/}/g' -e 's/\[ /[/g' -e 's/ \]/]/g' } # Encode data as url-safe formatted base64 urlbase64() { # urlbase64: base64 encoded string with '+' replaced with '-' and '/' replaced with '_' "${OPENSSL}" base64 -e | tr -d '\n\r' | _sed -e 's:=*$::g' -e 'y:+/:-_:' } # Decode data from url-safe formatted base64 deurlbase64() { data="$(cat | tr -d ' \n\r')" modlen=$((${#data} % 4)) padding="" if [[ "${modlen}" = "2" ]]; then padding="=="; elif [[ "${modlen}" = "3" ]]; then padding="="; fi printf "%s%s" "${data}" "${padding}" | tr -d '\n\r' | _sed -e 'y:-_:+/:' | "${OPENSSL}" base64 -d -A } # Convert hex string to binary data hex2bin() { # Remove spaces, add leading zero, escape as hex string and parse with printf # shellcheck disable=SC2059 printf "%b" "$(cat | _sed -e 's/[[:space:]]//g' -e 's/^(.(.{2})*)$/0\1/' -e 's/(.{2})/\\x\1/g')" } # Convert binary data to hex string bin2hex() { hexdump -v -e '/1 "%02x"' } # OpenSSL writes to stderr/stdout even when there are no errors. So just # display the output if the exit code was != 0 to simplify debugging. _openssl() { set +e out="$("${OPENSSL}" "${@}" 2>&1)" res=$? set -e if [[ ${res} -ne 0 ]]; then echo " + ERROR: failed to run $* (Exitcode: ${res})" >&2 echo >&2 echo "Details:" >&2 echo "${out}" >&2 echo >&2 exit "${res}" fi } # Send http(s) request with specified method http_request() { tempcont="$(_mktemp)" tempheaders="$(_mktemp)" if [[ -n "${IP_VERSION:-}" ]]; then ip_version="-${IP_VERSION}" fi set +e # shellcheck disable=SC2086 if [[ "${1}" = "head" ]]; then statuscode="$(curl ${ip_version:-} -A "dehydrated/${VERSION} curl/${CURL_VERSION}" ${CURL_OPTS} -s -w "%{http_code}" -o "${tempcont}" -H 'Cache-Control: no-cache' "${2}" -I)" curlret="${?}" touch "${tempheaders}" elif [[ "${1}" = "get" ]]; then statuscode="$(curl ${ip_version:-} -A "dehydrated/${VERSION} curl/${CURL_VERSION}" ${CURL_OPTS} -L -s -w "%{http_code}" -o "${tempcont}" -D "${tempheaders}" -H 'Cache-Control: no-cache' "${2}")" curlret="${?}" elif [[ "${1}" = "post" ]]; then statuscode="$(curl ${ip_version:-} -A "dehydrated/${VERSION} curl/${CURL_VERSION}" ${CURL_OPTS} -s -w "%{http_code}" -o "${tempcont}" "${2}" -D "${tempheaders}" -H 'Cache-Control: no-cache' -H 'Content-Type: application/jose+json' -d "${3}")" curlret="${?}" else set -e _exiterr "Unknown request method: ${1}" fi set -e if [[ ! "${curlret}" = "0" ]]; then _exiterr "Problem connecting to server (${1} for ${2}; curl returned with ${curlret})" fi if [[ ! "${statuscode:0:1}" = "2" ]]; then # check for existing registration warning if [[ "${API}" = "1" ]] && [[ -n "${CA_NEW_REG:-}" ]] && [[ "${2}" = "${CA_NEW_REG:-}" ]] && [[ "${statuscode}" = "409" ]] && grep -q "Registration key is already in use" "${tempcont}"; then # do nothing : # check for already-revoked warning elif [[ -n "${CA_REVOKE_CERT:-}" ]] && [[ "${2}" = "${CA_REVOKE_CERT:-}" ]] && [[ "${statuscode}" = "409" ]]; then grep -q "Certificate already revoked" "${tempcont}" && return else if grep -q "urn:ietf:params:acme:error:badNonce" "${tempcont}"; then printf "badnonce %s" "$(grep -Eoi "^replay-nonce:.*$" "${tempheaders}" | sed 's/ //' | cut -d: -f2)" return 0 fi echo " + ERROR: An error occurred while sending ${1}-request to ${2} (Status ${statuscode})" >&2 echo >&2 echo "Details:" >&2 cat "${tempheaders}" >&2 cat "${tempcont}" >&2 echo >&2 echo >&2 # An exclusive hook for the {1}-request error might be useful (e.g., for sending an e-mail to admins) if [[ -n "${HOOK}" ]]; then errtxt="$(cat "${tempcont}")" errheaders="$(cat "${tempheaders}")" "${HOOK}" "request_failure" "${statuscode}" "${errtxt}" "${1}" "${errheaders}" || _exiterr 'request_failure hook returned with non-zero exit code' fi rm -f "${tempcont}" rm -f "${tempheaders}" # remove temporary domains.txt file if used [[ "${COMMAND:-}" = "sign_domains" && -n "${PARAM_DOMAIN:-}" && -n "${DOMAINS_TXT:-}" ]] && rm "${DOMAINS_TXT}" _exiterr fi fi if { true >&4; } 2>/dev/null; then cat "${tempheaders}" >&4 fi cat "${tempcont}" rm -f "${tempcont}" rm -f "${tempheaders}" } # Send signed request signed_request() { # Encode payload as urlbase64 payload64="$(printf '%s' "${2}" | urlbase64)" if [ -n "${3:-}" ]; then nonce="$(printf "%s" "${3}" | tr -d ' \t\n\r')" else # Retrieve nonce from acme-server if [[ ${API} -eq 1 ]]; then nonce="$(http_request head "${CA}" | grep -i ^Replay-Nonce: | cut -d':' -f2- | tr -d ' \t\n\r')" else nonce="$(http_request head "${CA_NEW_NONCE}" | grep -i ^Replay-Nonce: | cut -d':' -f2- | tr -d ' \t\n\r')" fi fi if [[ ${API} -eq 1 ]]; then # Build another header which also contains the previously received nonce and encode it as urlbase64 protected='{"alg": "RS256", "jwk": {"e": "'"${pubExponent64}"'", "kty": "RSA", "n": "'"${pubMod64}"'"}, "nonce": "'"${nonce}"'"}' protected64="$(printf '%s' "${protected}" | urlbase64)" else # Build another header which also contains the previously received nonce and url and encode it as urlbase64 if [[ -n "${ACCOUNT_URL:-}" ]]; then protected='{"alg": "'"${account_key_sigalgo}"'", "kid": "'"${ACCOUNT_URL}"'", "url": "'"${1}"'", "nonce": "'"${nonce}"'"}' else protected='{"alg": "'"${account_key_sigalgo}"'", "jwk": '"${account_key_info}"', "url": "'"${1}"'", "nonce": "'"${nonce}"'"}' fi protected64="$(printf '%s' "${protected}" | urlbase64)" fi # Sign header with nonce and our payload with our private key and encode signature as urlbase64 if [[ "${account_key_sigalgo}" = "RS256" ]]; then signed64="$(printf '%s' "${protected64}.${payload64}" | "${OPENSSL}" dgst -sha256 -sign "${ACCOUNT_KEY}" | urlbase64)" else dgstparams="$(printf '%s' "${protected64}.${payload64}" | "${OPENSSL}" dgst -sha${account_key_sigalgo:2} -sign "${ACCOUNT_KEY}" | "${OPENSSL}" asn1parse -inform DER)" dgst_parm_1="$(echo "$dgstparams" | head -n 2 | tail -n 1 | cut -d':' -f4)" dgst_parm_2="$(echo "$dgstparams" | head -n 3 | tail -n 1 | cut -d':' -f4)" # zero-padding (doesn't seem to be necessary, but other clients are doing this as well... case "${account_key_sigalgo}" in "ES256") siglen=64;; "ES384") siglen=96;; "ES512") siglen=132;; esac while [[ ${#dgst_parm_1} -lt $siglen ]]; do dgst_parm_1="0${dgst_parm_1}"; done while [[ ${#dgst_parm_2} -lt $siglen ]]; do dgst_parm_2="0${dgst_parm_2}"; done signed64="$(printf "%s%s" "${dgst_parm_1}" "${dgst_parm_2}" | hex2bin | urlbase64)" fi if [[ ${API} -eq 1 ]]; then # Build header with just our public key and algorithm information header='{"alg": "RS256", "jwk": {"e": "'"${pubExponent64}"'", "kty": "RSA", "n": "'"${pubMod64}"'"}}' # Send header + extended header + payload + signature to the acme-server data='{"header": '"${header}"', "protected": "'"${protected64}"'", "payload": "'"${payload64}"'", "signature": "'"${signed64}"'"}' else # Send extended header + payload + signature to the acme-server data='{"protected": "'"${protected64}"'", "payload": "'"${payload64}"'", "signature": "'"${signed64}"'"}' fi output="$(http_request post "${1}" "${data}")" if grep -qE "^badnonce " <<< "${output}"; then echo " ! Request failed (badNonce), retrying request..." >&2 signed_request "${1:-}" "${2:-}" "$(printf "%s" "${output}" | cut -d' ' -f2)" else printf "%s" "${output}" fi } # Extracts all subject names from a CSR # Outputs either the CN, or the SANs, one per line extract_altnames() { csrfile="${1}" # path to CSR file if ! "${OPENSSL}" req -in "${csrfile}" -verify -noout >/dev/null; then _exiterr "Certificate signing request isn't valid" fi reqtext="$("${OPENSSL}" req -in "${csrfile}" -noout -text)" if <<<"${reqtext}" grep -q '^[[:space:]]*X509v3 Subject Alternative Name:[[:space:]]*$'; then # SANs used, extract these altnames="$( <<<"${reqtext}" awk '/X509v3 Subject Alternative Name:/{print;getline;print;}' | tail -n1 )" # split to one per line: # shellcheck disable=SC1003 altnames="$( <<<"${altnames}" _sed -e 's/^[[:space:]]*//; s/, /\'$'\n''/g' )" # we can only get DNS/IP: ones signed if grep -qEv '^(DNS|IP( Address)*|othername):' <<<"${altnames}"; then _exiterr "Certificate signing request contains non-DNS/IP Subject Alternative Names" fi # strip away the DNS/IP: prefix altnames="$( <<<"${altnames}" _sed -e 's/^(DNS:|IP( Address)*:|othername:)//' )" printf "%s" "${altnames}" | tr '\n' ' ' else # No SANs, extract CN altnames="$( <<<"${reqtext}" grep '^[[:space:]]*Subject:' | _sed -e 's/.*[ /]CN ?= ?([^ /,]*).*/\1/' )" printf "%s" "${altnames}" fi } # Get last issuer CN in certificate chain get_last_cn() { <<<"${1}" _sed 'H;/-----BEGIN CERTIFICATE-----/h;$!d;x' | "${OPENSSL}" x509 -noout -issuer | head -n1 | _sed -e 's/.*[ /]CN ?= ?([^/,]*).*/\1/' } # Create certificate for domain(s) and outputs it FD 3 sign_csr() { csrfile="${1}" # path to CSR file if { true >&3; } 2>/dev/null; then : # fd 3 looks OK else _exiterr "sign_csr: FD 3 not open" fi shift 1 || true export altnames="${*}" if [[ ${API} -eq 1 ]]; then if [[ -z "${CA_NEW_AUTHZ}" ]] || [[ -z "${CA_NEW_CERT}" ]]; then _exiterr "Certificate authority doesn't allow certificate signing" fi elif [[ ${API} -eq 2 ]] && [[ -z "${CA_NEW_ORDER}" ]]; then _exiterr "Certificate authority doesn't allow certificate signing" fi if [[ -n "${ZSH_VERSION:-}" ]]; then local -A challenge_names challenge_uris challenge_tokens authorizations keyauths deploy_args else local -a challenge_names challenge_uris challenge_tokens authorizations keyauths deploy_args fi # Initial step: Find which authorizations we're dealing with if [[ ${API} -eq 2 ]]; then # Request new order and store authorization URIs local challenge_identifiers="" for altname in ${altnames}; do if [[ "${altname}" =~ ^ip: ]]; then ip="${altname:3}" if [[ "${ip}" =~ : ]]; then ip="$(ipv6_normalize <<< "${ip}")" fi challenge_identifiers+="$(printf '{"type": "ip", "value": "%s"}, ' "${ip}")" else challenge_identifiers+="$(printf '{"type": "dns", "value": "%s"}, ' "${altname}")" fi done challenge_identifiers="[${challenge_identifiers%, }]" echo " + Requesting new certificate order from CA..." local order_payload='{"identifiers": '"${challenge_identifiers}" if [[ -n "${ACME_PROFILE}" ]]; then order_payload="${order_payload}"',"profile":"'"${ACME_PROFILE}"'"' fi order_payload="${order_payload}"'}' order_location="$(signed_request "${CA_NEW_ORDER}" "${order_payload}" 4>&1 | grep -i ^Location: | cut -d':' -f2- | tr -d ' \t\r\n')" result="$(signed_request "${order_location}" "" | jsonsh)" order_authorizations="$(echo "${result}" | get_json_array_values authorizations)" finalize="$(echo "${result}" | get_json_string_value finalize)" local idx=0 for uri in ${order_authorizations}; do authorizations[${idx}]="${uri}" idx=$((idx+1)) done echo " + Received ${idx} authorizations URLs from the CA" else # Copy $altnames to $authorizations (just doing this to reduce duplicate code later on) local idx=0 for altname in ${altnames}; do authorizations[${idx}]="${altname}" idx=$((idx+1)) done fi # Check if authorizations are valid and gather challenge information for pending authorizations local idx=0 for authorization in ${authorizations[*]}; do if [[ "${API}" -eq 2 ]]; then # Receive authorization ($authorization is authz uri) response="$(signed_request "$(echo "${authorization}" | _sed -e 's/\"(.*)".*/\1/')" "" | jsonsh)" identifier="$(echo "${response}" | get_json_string_value -p '"identifier","value"')" identifier_type="$(echo "${response}" | get_json_string_value -p '"identifier","type"')" echo " + Handling authorization for ${identifier}" else # Request new authorization ($authorization is altname) identifier="${authorization}" echo " + Requesting authorization for ${identifier}..." response="$(signed_request "${CA_NEW_AUTHZ}" '{"resource": "new-authz", "identifier": {"type": "dns", "value": "'"${identifier}"'"}}' | jsonsh)" fi # Check if authorization has already been validated if [ "$(echo "${response}" | get_json_string_value status)" = "valid" ]; then if [ "${PARAM_FORCE_VALIDATION:-no}" = "yes" ]; then echo " + A valid authorization has been found but will be ignored" else echo " + Found valid authorization for ${identifier}" continue fi fi # Find challenge in authorization challengeindex="$(echo "${response}" | grep -E '^\["challenges",[0-9]+,"type"\][[:space:]]+"'"${CHALLENGETYPE}"'"' | cut -d',' -f2 || true)" if [ -z "${challengeindex}" ]; then allowed_validations="$(echo "${response}" | grep -E '^\["challenges",[0-9]+,"type"\]' | sed -e 's/\[[^\]*\][[:space:]]*//g' -e 's/^"//' -e 's/"$//' | tr '\n' ' ')" _exiterr "Validating this certificate is not possible using ${CHALLENGETYPE}. Possible validation methods are: ${allowed_validations}. Please check with your CA for more information about supported validation methods." fi challenge="$(echo "${response}" | get_json_dict_value -p '"challenges",'"${challengeindex}")" # Gather challenge information if [ "${identifier_type:-}" = "ip" ] && [ "${CHALLENGETYPE}" = "tls-alpn-01" ]; then challenge_names[${idx}]="$(echo "${identifier}" | ip_to_ptr)" else challenge_names[${idx}]="${identifier}" fi challenge_tokens[${idx}]="$(echo "${challenge}" | get_json_string_value token)" if [[ ${API} -eq 2 ]]; then challenge_uris[${idx}]="$(echo "${challenge}" | get_json_string_value url)" else if [[ "$(echo "${challenge}" | get_json_string_value type)" = "urn:acme:error:unauthorized" ]]; then _exiterr "Challenge unauthorized: $(echo "${challenge}" | get_json_string_value detail)" fi challenge_uris[${idx}]="$(echo "${challenge}" | get_json_dict_value validationRecord | get_json_string_value uri)" fi # Prepare challenge tokens and deployment parameters keyauth="${challenge_tokens[${idx}]}.${thumbprint}" case "${CHALLENGETYPE}" in "http-01") # Store challenge response in well-known location and make world-readable (so that a webserver can access it) printf '%s' "${keyauth}" > "${WELLKNOWN}/${challenge_tokens[${idx}]}" chmod a+r "${WELLKNOWN}/${challenge_tokens[${idx}]}" keyauth_hook="${keyauth}" ;; "dns-01") # Generate DNS entry content for dns-01 validation keyauth_hook="$(printf '%s' "${keyauth}" | "${OPENSSL}" dgst -sha256 -binary | urlbase64)" ;; "dns-persist-01") # Pre-existing persistent DNS record is expected; no deploy/cleanup by dehydrated. keyauth_hook="" ;; "tls-alpn-01") keyauth_hook="$(printf '%s' "${keyauth}" | "${OPENSSL}" dgst -sha256 -c -hex | awk '{print $NF}')" generate_alpn_certificate "${identifier}" "${identifier_type}" "${keyauth_hook}" ;; esac keyauths[${idx}]="${keyauth}" if [ "${identifier_type:-}" = "ip" ] && [ "${CHALLENGETYPE}" = "tls-alpn-01" ]; then deploy_args[${idx}]="$(echo "${identifier}" | ip_to_ptr) ${challenge_tokens[${idx}]} ${keyauth_hook}" else deploy_args[${idx}]="${identifier} ${challenge_tokens[${idx}]} ${keyauth_hook}" fi idx=$((idx+1)) done local num_pending_challenges=${idx} echo " + ${num_pending_challenges} pending challenge(s)" # Deploy challenge tokens if [[ ${num_pending_challenges} -ne 0 ]]; then if [[ "${CHALLENGETYPE}" != "dns-persist-01" ]]; then echo " + Deploying challenge tokens..." if [[ -n "${HOOK}" ]] && [[ "${HOOK_CHAIN}" = "yes" ]]; then # shellcheck disable=SC2068 "${HOOK}" "deploy_challenge" ${deploy_args[@]} || _exiterr 'deploy_challenge hook returned with non-zero exit code' elif [[ -n "${HOOK}" ]]; then # Run hook script to deploy the challenge token local idx=0 while [ ${idx} -lt ${num_pending_challenges} ]; do # shellcheck disable=SC2086 "${HOOK}" "deploy_challenge" ${deploy_args[${idx}]} || _exiterr 'deploy_challenge hook returned with non-zero exit code' idx=$((idx+1)) done fi fi fi # Validate pending challenges local idx=0 while [ ${idx} -lt ${num_pending_challenges} ]; do echo " + Responding to challenge for ${challenge_names[${idx}]} authorization..." # Ask the acme-server to verify our challenge and wait until it is no longer pending if [[ ${API} -eq 1 ]]; then result="$(signed_request "${challenge_uris[${idx}]}" '{"resource": "challenge", "keyAuthorization": "'"${keyauths[${idx}]}"'"}' | jsonsh)" else result="$(signed_request "${challenge_uris[${idx}]}" '{}' | jsonsh)" fi reqstatus="$(echo "${result}" | get_json_string_value status)" local waited=0 while [[ "${reqstatus}" = "pending" ]] || [[ "${reqstatus}" = "processing" ]]; do if [ ${VALIDATION_TIMEOUT} -gt 0 ] && [ ${waited} -gt ${VALIDATION_TIMEOUT} ]; then _exiterr "Timed out waiting for processing of domain validation (still ${reqstatus})" fi echo " + Validation is ${reqstatus}..." sleep 1 waited=$((waited+1)) if [[ "${API}" -eq 2 ]]; then result="$(signed_request "${challenge_uris[${idx}]}" "" | jsonsh)" else result="$(http_request get "${challenge_uris[${idx}]}" | jsonsh)" fi reqstatus="$(echo "${result}" | get_json_string_value status)" done [[ "${CHALLENGETYPE}" = "http-01" ]] && rm -f "${WELLKNOWN}/${challenge_tokens[${idx}]}" [[ "${CHALLENGETYPE}" = "tls-alpn-01" ]] && rm -f "${ALPNCERTDIR}/${challenge_names[${idx}]}.crt.pem" "${ALPNCERTDIR}/${challenge_names[${idx}]}.key.pem" if [[ "${reqstatus}" = "valid" ]]; then echo " + Challenge is valid!" else [[ -n "${HOOK}" ]] && ("${HOOK}" "invalid_challenge" "${altname}" "${result}" || _exiterr 'invalid_challenge hook returned with non-zero exit code') break fi idx=$((idx+1)) done if [[ ${num_pending_challenges} -ne 0 ]]; then if [[ "${CHALLENGETYPE}" != "dns-persist-01" ]]; then echo " + Cleaning challenge tokens..." # Clean challenge tokens using chained hook # shellcheck disable=SC2068 [[ -n "${HOOK}" ]] && [[ "${HOOK_CHAIN}" = "yes" ]] && ("${HOOK}" "clean_challenge" ${deploy_args[@]} || _exiterr 'clean_challenge hook returned with non-zero exit code') # Clean remaining challenge tokens if validation has failed local idx=0 while [ ${idx} -lt ${num_pending_challenges} ]; do # Delete challenge file [[ "${CHALLENGETYPE}" = "http-01" ]] && rm -f "${WELLKNOWN}/${challenge_tokens[${idx}]}" # Delete alpn verification certificates [[ "${CHALLENGETYPE}" = "tls-alpn-01" ]] && rm -f "${ALPNCERTDIR}/${challenge_names[${idx}]}.crt.pem" "${ALPNCERTDIR}/${challenge_names[${idx}]}.key.pem" # Clean challenge token using non-chained hook # shellcheck disable=SC2086 [[ -n "${HOOK}" ]] && [[ "${HOOK_CHAIN}" != "yes" ]] && ("${HOOK}" "clean_challenge" ${deploy_args[${idx}]} || _exiterr 'clean_challenge hook returned with non-zero exit code') idx=$((idx+1)) done fi if [[ "${reqstatus}" != "valid" ]]; then echo " + Challenge validation has failed :(" _exiterr "Challenge is invalid! (returned: ${reqstatus}) (result: ${result})" fi fi # Finally request certificate from the acme-server and store it in cert-${timestamp}.pem and link from cert.pem echo " + Requesting certificate..." csr64="$("${OPENSSL}" req -in "${csrfile}" -config "${OPENSSL_CNF}" -outform DER | urlbase64)" if [[ ${API} -eq 1 ]]; then crt64="$(signed_request "${CA_NEW_CERT}" '{"resource": "new-cert", "csr": "'"${csr64}"'"}' | "${OPENSSL}" base64 -e)" crt="$( printf -- '-----BEGIN CERTIFICATE-----\n%s\n-----END CERTIFICATE-----\n' "${crt64}" )" else result="$(signed_request "${finalize}" '{"csr": "'"${csr64}"'"}' | jsonsh)" waited=0 while :; do orderstatus="$(echo "${result}" | get_json_string_value status)" case "${orderstatus}" in "processing" | "pending") if [ ${ORDER_TIMEOUT} -gt 0 ] && [ ${waited} -gt ${ORDER_TIMEOUT} ]; then _exiterr "Timed out waiting for processing of order (still ${orderstatus})" fi echo " + Order is ${orderstatus}..." sleep 2; waited=$((waited+2)) ;; "valid") break; ;; *) _exiterr "Order has invalid/unknown status: ${orderstatus}" ;; esac result="$(signed_request "${order_location}" "" | jsonsh)" done resheaders="$(_mktemp)" certificate="$(echo "${result}" | get_json_string_value certificate)" crt="$(signed_request "${certificate}" "" 4>"${resheaders}")" if [ -n "${PREFERRED_CHAIN:-}" ]; then foundaltchain=0 altcn="$(get_last_cn "${crt}")" altoptions="${altcn}" if [ "${altcn}" = "${PREFERRED_CHAIN}" ]; then foundaltchain=1 fi if [ "${foundaltchain}" = "0" ] && (grep -Ei '^link:' "${resheaders}" | grep -q -Ei 'rel="alternate"'); then while read -r altcrturl; do if [ "${foundaltchain}" = "0" ]; then altcrt="$(signed_request "${altcrturl}" "")" altcn="$(get_last_cn "${altcrt}")" altoptions="${altoptions}, ${altcn}" if [ "${altcn}" = "${PREFERRED_CHAIN}" ]; then foundaltchain=1 crt="${altcrt}" fi fi done <<< "$(grep -Ei '^link:' "${resheaders}" | grep -Ei 'rel="alternate"' | cut -d'<' -f2 | cut -d'>' -f1)" fi if [ "${foundaltchain}" = "0" ]; then _exiterr "Alternative chain with CN = ${PREFERRED_CHAIN} not found, available options: ${altoptions}" fi echo " + Using preferred chain with CN = ${altcn}" fi rm -f "${resheaders}" fi # Try to load the certificate to detect corruption echo " + Checking certificate..." _openssl x509 -text <<<"${crt}" echo "${crt}" >&3 unset challenge_token echo " + Done!" } # grep issuer cert uri from certificate get_issuer_cert_uri() { certificate="${1}" "${OPENSSL}" x509 -in "${certificate}" -noout -text | (grep 'CA Issuers - URI:' | cut -d':' -f2-) || true } get_issuer_hash() { certificate="${1}" "${OPENSSL}" x509 -in "${certificate}" -noout -issuer_hash } get_ocsp_url() { certificate="${1}" "${OPENSSL}" x509 -in "${certificate}" -noout -ocsp_uri } # walk certificate chain, retrieving all intermediate certificates walk_chain() { local certificate certificate="${1}" local issuer_cert_uri issuer_cert_uri="${2:-}" if [[ -z "${issuer_cert_uri}" ]]; then issuer_cert_uri="$(get_issuer_cert_uri "${certificate}")"; fi if [[ -n "${issuer_cert_uri}" ]]; then # create temporary files local tmpcert local tmpcert_raw tmpcert_raw="$(_mktemp)" tmpcert="$(_mktemp)" # download certificate http_request get "${issuer_cert_uri}" > "${tmpcert_raw}" # PEM if grep -q "BEGIN CERTIFICATE" "${tmpcert_raw}"; then mv "${tmpcert_raw}" "${tmpcert}" # DER elif "${OPENSSL}" x509 -in "${tmpcert_raw}" -inform DER -out "${tmpcert}" -outform PEM 2> /dev/null > /dev/null; then : # PKCS7 elif "${OPENSSL}" pkcs7 -in "${tmpcert_raw}" -inform DER -out "${tmpcert}" -outform PEM -print_certs 2> /dev/null > /dev/null; then : # Unknown certificate type else _exiterr "Unknown certificate type in chain" fi local next_issuer_cert_uri next_issuer_cert_uri="$(get_issuer_cert_uri "${tmpcert}")" if [[ -n "${next_issuer_cert_uri}" ]]; then printf "\n%s\n" "${issuer_cert_uri}" cat "${tmpcert}" walk_chain "${tmpcert}" "${next_issuer_cert_uri}" fi rm -f "${tmpcert}" "${tmpcert_raw}" fi } # Generate ALPN verification certificate generate_alpn_certificate() { local altname="${1}" local identifier_type="${2}" local acmevalidation="${3}" local alpncertdir="${ALPNCERTDIR}" if [[ ! -e "${alpncertdir}" ]]; then echo " + Creating new directory ${alpncertdir} ..." mkdir -p "${alpncertdir}" || _exiterr "Unable to create directory ${alpncertdir}" fi echo " + Generating ALPN certificate and key for ${1}..." tmp_openssl_cnf="$(_mktemp)" cat "${OPENSSL_CNF}" > "${tmp_openssl_cnf}" if [[ "${identifier_type}" = "ip" ]]; then printf "\n[SAN]\nsubjectAltName=IP:%s\n" "${altname}" >> "${tmp_openssl_cnf}" else printf "\n[SAN]\nsubjectAltName=DNS:%s\n" "${altname}" >> "${tmp_openssl_cnf}" fi printf "1.3.6.1.5.5.7.1.31=critical,DER:04:20:%s\n" "${acmevalidation}" >> "${tmp_openssl_cnf}" SUBJ="/CN=${altname}/" [[ "${OSTYPE:0:5}" = "MINGW" ]] && SUBJ="/${SUBJ}" if [[ "${identifier_type}" = "ip" ]]; then altname="$(echo "${altname}" | ip_to_ptr)" fi _openssl req -x509 -new -sha256 -nodes -newkey rsa:2048 -keyout "${alpncertdir}/${altname}.key.pem" -out "${alpncertdir}/${altname}.crt.pem" -subj "${SUBJ}" -extensions SAN -config "${tmp_openssl_cnf}" chmod g+r "${alpncertdir}/${altname}.key.pem" "${alpncertdir}/${altname}.crt.pem" rm -f "${tmp_openssl_cnf}" } # Create certificate for domain(s) sign_domain() { local certdir="${1}" shift timestamp="${1}" shift domain="${1}" altnames="${*}" export altnames echo " + Signing domains..." if [[ ${API} -eq 1 ]]; then if [[ -z "${CA_NEW_AUTHZ}" ]] || [[ -z "${CA_NEW_CERT}" ]]; then _exiterr "Certificate authority doesn't allow certificate signing" fi elif [[ ${API} -eq 2 ]] && [[ -z "${CA_NEW_ORDER}" ]]; then _exiterr "Certificate authority doesn't allow certificate signing" fi local privkey="privkey.pem" if [[ ! -e "${certdir}/cert-${timestamp}.csr" ]]; then # generate a new private key if we need or want one if [[ ! -r "${certdir}/privkey.pem" ]] || [[ "${PRIVATE_KEY_RENEW}" = "yes" ]]; then echo " + Generating private key..." privkey="privkey-${timestamp}.pem" local tmp_privkey tmp_privkey="$(_mktemp)" case "${KEY_ALGO}" in rsa) _openssl genrsa -out "${tmp_privkey}" "${KEYSIZE}";; prime256v1|secp384r1) _openssl ecparam -genkey -name "${KEY_ALGO}" -out "${tmp_privkey}" -noout;; esac cat "${tmp_privkey}" > "${certdir}/privkey-${timestamp}.pem" rm "${tmp_privkey}" fi # move rolloverkey into position (if any) if [[ -r "${certdir}/privkey.pem" && -r "${certdir}/privkey.roll.pem" && "${PRIVATE_KEY_RENEW}" = "yes" && "${PRIVATE_KEY_ROLLOVER}" = "yes" ]]; then echo " + Moving Rolloverkey into position.... " mv "${certdir}/privkey.roll.pem" "${certdir}/privkey-tmp.pem" mv "${certdir}/privkey-${timestamp}.pem" "${certdir}/privkey.roll.pem" mv "${certdir}/privkey-tmp.pem" "${certdir}/privkey-${timestamp}.pem" fi # generate a new private rollover key if we need or want one if [[ ! -r "${certdir}/privkey.roll.pem" && "${PRIVATE_KEY_ROLLOVER}" = "yes" && "${PRIVATE_KEY_RENEW}" = "yes" ]]; then echo " + Generating private rollover key..." case "${KEY_ALGO}" in rsa) _openssl genrsa -out "${certdir}/privkey.roll.pem" "${KEYSIZE}";; prime256v1|secp384r1) _openssl ecparam -genkey -name "${KEY_ALGO}" -out "${certdir}/privkey.roll.pem" -noout;; esac fi # delete rolloverkeys if disabled if [[ -r "${certdir}/privkey.roll.pem" && ! "${PRIVATE_KEY_ROLLOVER}" = "yes" ]]; then echo " + Removing Rolloverkey (feature disabled)..." rm -f "${certdir}/privkey.roll.pem" fi # Generate signing request config and the actual signing request echo " + Generating signing request..." SAN="" for altname in ${altnames}; do if [[ "${altname}" =~ ^ip: ]]; then SAN="${SAN}IP:${altname:3}, " else SAN="${SAN}DNS:${altname}, " fi done if [[ "${domain}" =~ ^ip: ]]; then SUBJ="/" else SUBJ="/CN=${domain}/" fi SAN="${SAN%%, }" local tmp_openssl_cnf tmp_openssl_cnf="$(_mktemp)" cat "${OPENSSL_CNF}" > "${tmp_openssl_cnf}" printf "\n[SAN]\nsubjectAltName=%s" "${SAN}" >> "${tmp_openssl_cnf}" if [ "${OCSP_MUST_STAPLE}" = "yes" ]; then printf "\n1.3.6.1.5.5.7.1.24=DER:30:03:02:01:05" >> "${tmp_openssl_cnf}" fi if [[ "${OSTYPE:0:5}" = "MINGW" ]]; then # The subject starts with a /, so MSYS will assume it's a path and convert # it unless we escape it with another one: SUBJ="/${SUBJ}" fi "${OPENSSL}" req -new -sha256 -key "${certdir}/${privkey}" -out "${certdir}/cert-${timestamp}.csr" -subj "${SUBJ}" -reqexts SAN -config "${tmp_openssl_cnf}" rm -f "${tmp_openssl_cnf}" fi crt_path="${certdir}/cert-${timestamp}.pem" # shellcheck disable=SC2086 sign_csr "${certdir}/cert-${timestamp}.csr" ${altnames} 3>"${crt_path}" # Create fullchain.pem echo " + Creating fullchain.pem..." if [[ ${API} -eq 1 ]]; then cat "${crt_path}" > "${certdir}/fullchain-${timestamp}.pem" local issuer_hash issuer_hash="$(get_issuer_hash "${crt_path}")" if [ -e "${CHAINCACHE}/${issuer_hash}.chain" ]; then echo " + Using cached chain!" cat "${CHAINCACHE}/${issuer_hash}.chain" > "${certdir}/chain-${timestamp}.pem" else echo " + Walking chain..." local issuer_cert_uri issuer_cert_uri="$(get_issuer_cert_uri "${crt_path}" || echo "unknown")" (walk_chain "${crt_path}" > "${certdir}/chain-${timestamp}.pem") || _exiterr "Walking chain has failed, your certificate has been created and can be found at ${crt_path}, the corresponding private key at ${privkey}. If you want you can manually continue on creating and linking all necessary files. If this error occurs again you should manually generate the certificate chain and place it under ${CHAINCACHE}/${issuer_hash}.chain (see ${issuer_cert_uri})" cat "${certdir}/chain-${timestamp}.pem" > "${CHAINCACHE}/${issuer_hash}.chain" fi cat "${certdir}/chain-${timestamp}.pem" >> "${certdir}/fullchain-${timestamp}.pem" else tmpcert="$(_mktemp)" tmpchain="$(_mktemp)" awk '{print >out}; /----END CERTIFICATE-----/{out=tmpchain}' out="${tmpcert}" tmpchain="${tmpchain}" "${certdir}/cert-${timestamp}.pem" mv "${certdir}/cert-${timestamp}.pem" "${certdir}/fullchain-${timestamp}.pem" cat "${tmpcert}" > "${certdir}/cert-${timestamp}.pem" cat "${tmpchain}" > "${certdir}/chain-${timestamp}.pem" rm "${tmpcert}" "${tmpchain}" fi # Wait for hook script to sync the files before creating the symlinks [[ -n "${HOOK}" ]] && ("${HOOK}" "sync_cert" "${certdir}/privkey-${timestamp}.pem" "${certdir}/cert-${timestamp}.pem" "${certdir}/fullchain-${timestamp}.pem" "${certdir}/chain-${timestamp}.pem" "${certdir}/cert-${timestamp}.csr" || _exiterr 'sync_cert hook returned with non-zero exit code') # Update symlinks [[ "${privkey}" = "privkey.pem" ]] || ln -sf "privkey-${timestamp}.pem" "${certdir}/privkey.pem" ln -sf "chain-${timestamp}.pem" "${certdir}/chain.pem" ln -sf "fullchain-${timestamp}.pem" "${certdir}/fullchain.pem" ln -sf "cert-${timestamp}.csr" "${certdir}/cert.csr" ln -sf "cert-${timestamp}.pem" "${certdir}/cert.pem" # Wait for hook script to clean the challenge and to deploy cert if used [[ -n "${HOOK}" ]] && ("${HOOK}" "deploy_cert" "${domain}" "${certdir}/privkey.pem" "${certdir}/cert.pem" "${certdir}/fullchain.pem" "${certdir}/chain.pem" "${timestamp}" || _exiterr 'deploy_cert hook returned with non-zero exit code') unset challenge_token echo " + Done!" } # Update OCSP stapling file update_ocsp_stapling() { local certdir="${1}" local update_ocsp="${2}" local cert="${3}" local chain="${4}" local ocsp_url="$(get_ocsp_url "${cert}")" if [[ -z "${ocsp_url}" ]]; then echo " ! ERROR: OCSP stapling requested but no OCSP url found in certificate." >&2 echo " ! Keep in mind that some CAs ended support for OCSP: https://letsencrypt.org/2024/12/05/ending-ocsp/" >&2 return 1 fi if [[ ! -e "${certdir}/ocsp.der" ]]; then update_ocsp="yes" elif ! ("${OPENSSL}" ocsp -no_nonce -issuer "${chain}" -verify_other "${chain}" -cert "${cert}" -respin "${certdir}/ocsp.der" -status_age $((OCSP_DAYS*24*3600)) 2>&1 | grep -q "${cert}: good"); then update_ocsp="yes" fi if [[ "${update_ocsp}" = "yes" ]]; then echo " + Updating OCSP stapling file" ocsp_timestamp="$(date +%s)" if grep -qE "^(openssl (0|(1\.0))\.)|(libressl (1|2|3)\.)" <<< "$(${OPENSSL} version | awk '{print tolower($0)}')"; then ocsp_log="$("${OPENSSL}" ocsp -no_nonce -issuer "${chain}" -verify_other "${chain}" -cert "${cert}" -respout "${certdir}/ocsp-${ocsp_timestamp}.der" -url "${ocsp_url}" -header "HOST" "$(echo "${ocsp_url}" | _sed -e 's/^http(s?):\/\///' -e 's/\/.*$//g')" 2>&1)" || _exiterr "Fetching of OCSP information failed. Please note that some CAs (e.g. LetsEncrypt) do no longer support OCSP. Error message: ${ocsp_log}" else ocsp_log="$("${OPENSSL}" ocsp -no_nonce -issuer "${chain}" -verify_other "${chain}" -cert "${cert}" -respout "${certdir}/ocsp-${ocsp_timestamp}.der" -url "${ocsp_url}" 2>&1)" || _exiterr "Fetching of OCSP information failed. Please note that some CAs (e.g. LetsEncrypt) do no longer support OCSP. Error message: ${ocsp_log}" fi ln -sf "ocsp-${ocsp_timestamp}.der" "${certdir}/ocsp.der" [[ -n "${HOOK}" ]] && (altnames="${domain} ${morenames}" "${HOOK}" "deploy_ocsp" "${domain}" "${certdir}/ocsp.der" "${ocsp_timestamp}" || _exiterr 'deploy_ocsp hook returned with non-zero exit code') else echo " + OCSP stapling file is still valid (skipping update)" fi } # Usage: --version (-v) # Description: Print version information command_version() { load_config noverify echo "Dehydrated by Lukas Schauer" echo "https://dehydrated.io" echo "" echo "Dehydrated version: ${VERSION}" revision="$(cd "${SCRIPTDIR}"; git rev-parse HEAD 2>/dev/null || echo "unknown")" echo "GIT-Revision: ${revision}" echo "" # shellcheck disable=SC1091 if [[ "${OSTYPE}" =~ (BSD|Darwin) ]]; then echo "OS: $(uname -sr)" elif [[ -e /etc/os-release ]]; then ( . /etc/os-release && echo "OS: $PRETTY_NAME" ) elif [[ -e /usr/lib/os-release ]]; then ( . /usr/lib/os-release && echo "OS: $PRETTY_NAME" ) else echo "OS: $(grep -v '^$' /etc/issue | head -n1 | _sed 's/\\(r|n|l) .*//g')" fi echo "Used software:" [[ -n "${BASH_VERSION:-}" ]] && echo " bash: ${BASH_VERSION}" [[ -n "${ZSH_VERSION:-}" ]] && echo " zsh: ${ZSH_VERSION}" echo " curl: ${CURL_VERSION}" if [[ "${OSTYPE}" =~ (BSD|Darwin) ]]; then echo " awk, sed, mktemp, grep, diff: BSD base system versions" else echo " awk: $(awk -W version 2>&1 | head -n1)" echo " sed: $(sed --version 2>&1 | head -n1)" echo " mktemp: $(mktemp --version 2>&1 | head -n1)" echo " grep: $(grep --version 2>&1 | head -n1)" echo " diff: $(diff --version 2>&1 | head -n1)" fi echo " openssl: $("${OPENSSL}" version 2>&1)" exit 0 } # Usage: --display-terms # Description: Display current terms of service command_terms() { init_system echo "The current terms of service: $CA_TERMS" echo "+ Done!" exit 0 } # Usage: --register # Description: Register account key command_register() { init_system echo "+ Done!" exit 0 } # Usage: --account # Description: Update account contact information command_account() { init_system FAILED=false NEW_ACCOUNT_KEY_JSON="$(_mktemp)" # Check if we have the registration url if [[ -z "${ACCOUNT_URL}" ]]; then _exiterr "Error retrieving registration url." fi echo "+ Updating registration url: ${ACCOUNT_URL} contact information..." if [[ ${API} -eq 1 ]]; then # If an email for the contact has been provided then adding it to the registered account if [[ -n "${CONTACT_EMAIL}" ]]; then (signed_request "${ACCOUNT_URL}" '{"resource": "reg", "contact":["mailto:'"${CONTACT_EMAIL}"'"]}' > "${NEW_ACCOUNT_KEY_JSON}") || FAILED=true else (signed_request "${ACCOUNT_URL}" '{"resource": "reg", "contact":[]}' > "${NEW_ACCOUNT_KEY_JSON}") || FAILED=true fi else # If an email for the contact has been provided then adding it to the registered account if [[ -n "${CONTACT_EMAIL}" ]]; then (signed_request "${ACCOUNT_URL}" '{"contact":["mailto:'"${CONTACT_EMAIL}"'"]}' > "${NEW_ACCOUNT_KEY_JSON}") || FAILED=true else (signed_request "${ACCOUNT_URL}" '{"contact":[]}' > "${NEW_ACCOUNT_KEY_JSON}") || FAILED=true fi fi if [[ "${FAILED}" = "true" ]]; then rm "${NEW_ACCOUNT_KEY_JSON}" _exiterr "Error updating account information. See message above for more information." fi if diff -q "${NEW_ACCOUNT_KEY_JSON}" "${ACCOUNT_KEY_JSON}" > /dev/null; then echo "+ Account information was the same after the update" rm "${NEW_ACCOUNT_KEY_JSON}" else ACCOUNT_KEY_JSON_BACKUP="${ACCOUNT_KEY_JSON%.*}-$(date +%s).json" echo "+ Backup ${ACCOUNT_KEY_JSON} as ${ACCOUNT_KEY_JSON_BACKUP}" cp -p "${ACCOUNT_KEY_JSON}" "${ACCOUNT_KEY_JSON_BACKUP}" echo "+ Populate ${ACCOUNT_KEY_JSON}" mv "${NEW_ACCOUNT_KEY_JSON}" "${ACCOUNT_KEY_JSON}" fi echo "+ Done!" exit 0 } # Parse contents of domains.txt and domains.txt.d parse_domains_txt() { # Allow globbing temporarily noglob_set local inputs=("${DOMAINS_TXT}" "${DOMAINS_TXT}.d"/*.txt) noglob_clear cat "${inputs[@]}" | tr -d '\r' | awk '{print tolower($0)}' | _sed -e 's/^[[:space:]]*//g' -e 's/[[:space:]]*$//g' -e 's/[[:space:]]+/ /g' -e 's/([^ ])>/\1 >/g' -e 's/> />/g' | (grep -vE '^(#|$)' || true) } # normalize SAN lists # normalize IPv6 adresses, and sort alphabetically normalize_san_list() { cat | awk '{print tolower($0)}' | _sed 's/ $//' | _sed 's/^ //' | ipv6_normalize | tr ' ' '\n' | sort -u | tr '\n' ' ' | _sed 's/ $//' } # Usage: --cron (-c) # Description: Sign/renew non-existent/changed/expiring certificates. command_sign_domains() { init_system hookscript_bricker_hook # Call startup hook [[ -n "${HOOK}" ]] && ("${HOOK}" "startup_hook" || _exiterr 'startup_hook hook returned with non-zero exit code') if [ ! -d "${CHAINCACHE}" ]; then echo " + Creating chain cache directory ${CHAINCACHE}" mkdir "${CHAINCACHE}" fi if [[ -n "${PARAM_DOMAIN:-}" ]]; then DOMAINS_TXT="$(_mktemp)" if [[ -n "${PARAM_ALIAS:-}" ]]; then printf "%s > %s" "${PARAM_DOMAIN}" "${PARAM_ALIAS}" > "${DOMAINS_TXT}" else printf "%s" "${PARAM_DOMAIN}" > "${DOMAINS_TXT}" fi elif [[ -e "${DOMAINS_TXT}" ]]; then if [[ ! -r "${DOMAINS_TXT}" ]]; then _exiterr "domains.txt found but not readable" fi else _exiterr "domains.txt not found and --domain not given" fi # Generate certificates for all domains found in domains.txt. Check if existing certificate are about to expire ORIGIFS="${IFS}" IFS=$'\n' for line in $(parse_domains_txt); do reset_configvars IFS="${ORIGIFS}" alias="$(grep -Eo '>[^ ]+' <<< "${line}" || true)" line="$(_sed -e 's/>[^ ]+[ ]*//g' <<< "${line}")" aliascount="$(grep -Eo '>' <<< "${alias}" | awk 'END {print NR}' || true )" [ "${aliascount}" -gt 1 ] && _exiterr "Only one alias per line is allowed in domains.txt!" domain="$(printf '%s\n' "${line}" | cut -d' ' -f1)" morenames="$(printf '%s\n' "${line}" | cut -s -d' ' -f2-)" [ "${aliascount}" -lt 1 ] && alias="${domain}" || alias="${alias#>}" export alias if [[ -z "${morenames}" ]];then echo "Processing ${domain}" else echo "Processing ${domain} with alternative names: ${morenames}" fi if [ "${alias:0:2}" = "*." ]; then _exiterr "Please define a valid alias for your ${domain} wildcard-certificate. See domains.txt-documentation for more details." fi local certdir="${CERTDIR}/${alias}" cert="${certdir}/cert.pem" chain="${certdir}/chain.pem" force_renew="${PARAM_FORCE:-no}" timestamp="$(date +%s)" # If there is no existing certificate directory => make it if [[ ! -e "${certdir}" ]]; then echo " + Creating new directory ${certdir} ..." mkdir -p "${certdir}" || _exiterr "Unable to create directory ${certdir}" fi # read cert config # for now this loads the certificate specific config in a subshell and parses a diff of set variables. # we could just source the config file but i decided to go this way to protect people from accidentally overriding # variables used internally by this script itself. if [[ -n "${DOMAINS_D}" ]]; then certconfig="${DOMAINS_D}/${alias}" else certconfig="${certdir}/config" fi if [ -f "${certconfig}" ]; then echo " + Using certificate specific config file!" ORIGIFS="${IFS}" IFS=$'\n' for cfgline in $( beforevars="$(_mktemp)" aftervars="$(_mktemp)" set > "${beforevars}" # shellcheck disable=SC1090 . "${certconfig}" set > "${aftervars}" diff -u "${beforevars}" "${aftervars}" | grep -E '^\+[^+]' rm "${beforevars}" rm "${aftervars}" ); do config_var="$(echo "${cfgline:1}" | cut -d'=' -f1)" config_value="$(echo "${cfgline:1}" | cut -d'=' -f2- | tr -d "'")" # All settings that are allowed here should also be stored and # restored in store_configvars() and reset_configvars() case "${config_var}" in KEY_ALGO|OCSP_MUST_STAPLE|OCSP_FETCH|OCSP_DAYS|PRIVATE_KEY_RENEW|PRIVATE_KEY_ROLLOVER|KEYSIZE|CHALLENGETYPE|HOOK|PREFERRED_CHAIN|WELLKNOWN|HOOK_CHAIN|OPENSSL_CNF|RENEW_DAYS|ACME_PROFILE|ORDER_TIMEOUT|VALIDATION_TIMEOUT|KEEP_GOING) echo " + ${config_var} = ${config_value}" declare -- "${config_var}=${config_value}" ;; _) ;; *) echo " ! Setting ${config_var} on a per-certificate base is not (yet) supported" >&2 esac done IFS="${ORIGIFS}" fi verify_config hookscript_bricker_hook export WELLKNOWN CHALLENGETYPE KEY_ALGO PRIVATE_KEY_ROLLOVER skip="no" # Allow for external CSR generation local csrfile="" if [[ -n "${HOOK}" ]]; then csr="$("${HOOK}" "generate_csr" "${domain}" "${certdir}" "${domain} ${morenames}")" || _exiterr 'generate_csr hook returned with non-zero exit code' if grep -qE "\-----BEGIN (NEW )?CERTIFICATE REQUEST-----" <<< "${csr}"; then csrfile="$(_mktemp)" cat > "${csrfile}" <<< "${csr}" altnames="$(extract_altnames "${csrfile}")" domain="$(cut -d' ' -f1 <<< "${altnames}")" morenames="$(cut -s -d' ' -f2- <<< "${altnames}")" echo " + Using CSR from hook script (real names: ${altnames})" else csrfile="" fi fi # Check domain names of existing certificate if [[ -e "${cert}" && "${force_renew}" = "no" ]]; then printf " + Checking domain name(s) of existing cert..." certnames="$("${OPENSSL}" x509 -in "${cert}" -text -noout | grep -E '(DNS|IP( Address)*):' | _sed 's/(DNS|IP( Address)*)://g' | tr -d ' ' | tr ',' ' ' | normalize_san_list )" givennames="$(echo "${domain}" "${morenames}" | _sed 's/ip://g' | normalize_san_list )" if [[ "${certnames}" = "${givennames}" ]]; then echo " unchanged." else echo " changed!" echo " + Domain name(s) are not matching!" echo " + Names in old certificate: ${certnames}" echo " + Configured names: ${givennames}" echo " + Forcing renew." force_renew="yes" fi fi # Check expire date of existing certificate if [[ -e "${cert}" ]]; then echo " + Checking expire date of existing cert..." valid="$("${OPENSSL}" x509 -enddate -noout -in "${cert}" | cut -d= -f2- )" printf " + Valid till %s " "${valid}" if ("${OPENSSL}" x509 -checkend $((RENEW_DAYS * 86400)) -in "${cert}" 2>&1 | grep -q "will not expire"); then printf "(Longer than %d days). " "${RENEW_DAYS}" if [[ "${force_renew}" = "yes" ]]; then echo "Ignoring because renew was forced!" else # Certificate-Names unchanged and cert is still valid echo "Skipping renew!" [[ -n "${HOOK}" ]] && ("${HOOK}" "unchanged_cert" "${domain}" "${certdir}/privkey.pem" "${certdir}/cert.pem" "${certdir}/fullchain.pem" "${certdir}/chain.pem" || _exiterr 'unchanged_cert hook returned with non-zero exit code') skip="yes" fi else echo "(Less than ${RENEW_DAYS} days). Renewing!" fi fi local update_ocsp update_ocsp="no" # Sign certificate for this domain if [[ ! "${skip}" = "yes" ]]; then update_ocsp="yes" if [[ -n "${csrfile}" ]]; then cat "${csrfile}" > "${certdir}/cert-${timestamp}.csr" rm "${csrfile}" fi # shellcheck disable=SC2086 if [[ "${KEEP_GOING:-}" = "yes" ]]; then skip_exit_hook=yes sign_domain "${certdir}" "${timestamp}" "${domain}" ${morenames} & wait $! || exit_with_errorcode=1 skip_exit_hook=no else sign_domain "${certdir}" "${timestamp}" "${domain}" ${morenames} fi fi if [[ "${OCSP_FETCH}" = "yes" ]]; then if [[ "${KEEP_GOING:-}" = "yes" ]]; then skip_exit_hook=yes update_ocsp_stapling "${certdir}" "${update_ocsp}" "${cert}" "${chain}" & wait $! || exit_with_errorcode=1 skip_exit_hook=no else update_ocsp_stapling "${certdir}" "${update_ocsp}" "${cert}" "${chain}" fi fi done reset_configvars # remove temporary domains.txt file if used [[ -n "${PARAM_DOMAIN:-}" ]] && rm -f "${DOMAINS_TXT}" [[ -n "${HOOK}" ]] && ("${HOOK}" "exit_hook" || echo 'exit_hook returned with non-zero exit code!' >&2) if [[ "${AUTO_CLEANUP}" == "yes" ]]; then echo " + Running automatic cleanup" PARAM_CLEANUPDELETE="${AUTO_CLEANUP_DELETE:-no}" command_cleanup noinit | _sed 's/^/ + /g' fi exit "${exit_with_errorcode}" } # Usage: --signcsr (-s) path/to/csr.pem # Description: Sign a given CSR, output CRT on stdout (advanced usage) command_sign_csr() { init_system # redirect stdout to stderr # leave stdout over at fd 3 to output the cert exec 3>&1 1>&2 # load csr local csrfile="${1}" if [ ! -r "${csrfile}" ]; then _exiterr "Could not read certificate signing request ${csrfile}" fi # extract names altnames="$(extract_altnames "${csrfile}")" # gen cert certfile="$(_mktemp)" # shellcheck disable=SC2086 sign_csr "${csrfile}" ${altnames} 3> "${certfile}" # print cert echo "# CERT #" >&3 cat "${certfile}" >&3 echo >&3 # print chain if [ -n "${PARAM_FULL_CHAIN:-}" ]; then # get and convert ca cert chainfile="$(_mktemp)" tmpchain="$(_mktemp)" http_request get "$("${OPENSSL}" x509 -in "${certfile}" -noout -text | grep 'CA Issuers - URI:' | cut -d':' -f2-)" > "${tmpchain}" if grep -q "BEGIN CERTIFICATE" "${tmpchain}"; then mv "${tmpchain}" "${chainfile}" else "${OPENSSL}" x509 -in "${tmpchain}" -inform DER -out "${chainfile}" -outform PEM rm "${tmpchain}" fi echo "# CHAIN #" >&3 cat "${chainfile}" >&3 rm "${chainfile}" fi # cleanup rm "${certfile}" exit 0 } # Usage: --revoke (-r) path/to/cert.pem # Description: Revoke specified certificate command_revoke() { init_system [[ -n "${CA_REVOKE_CERT}" ]] || _exiterr "Certificate authority doesn't allow certificate revocation." cert="${1}" if [[ -L "${cert}" ]]; then # follow symlink and use real certificate name (so we move the real file and not the symlink at the end) local link_target link_target="$(readlink -n "${cert}")" if [[ "${link_target}" =~ ^/ ]]; then cert="${link_target}" else cert="$(dirname "${cert}")/${link_target}" fi fi [[ -f "${cert}" ]] || _exiterr "Could not find certificate ${cert}" echo "Revoking ${cert}" cert64="$("${OPENSSL}" x509 -in "${cert}" -inform PEM -outform DER | urlbase64)" if [[ ${API} -eq 1 ]]; then response="$(signed_request "${CA_REVOKE_CERT}" '{"resource": "revoke-cert", "certificate": "'"${cert64}"'"}' | clean_json)" else response="$(signed_request "${CA_REVOKE_CERT}" '{"certificate": "'"${cert64}"'"}' | clean_json)" fi # if there is a problem with our revoke request _request (via signed_request) will report this and "exit 1" out # so if we are here, it is safe to assume the request was successful echo " + Done." echo " + Renaming certificate to ${cert}-revoked" mv -f "${cert}" "${cert}-revoked" } # Usage: --deactivate # Description: Deactivate account command_deactivate() { init_system echo "Deactivating account ${ACCOUNT_URL}" if [[ ${API} -eq 1 ]]; then echo "Deactivation for ACMEv1 is not implemented" else response="$(signed_request "${ACCOUNT_URL}" '{"status": "deactivated"}' | clean_json)" deactstatus=$(echo "$response" | jsonsh | get_json_string_value "status") if [[ "${deactstatus}" = "deactivated" ]]; then touch "${ACCOUNT_DEACTIVATED}" else _exiterr "Account deactivation failed!" fi fi echo " + Done." } # Usage: --cleanup (-gc) # Description: Move unused certificate files to archive directory command_cleanup() { if [ ! "${1:-}" = "noinit" ]; then load_config fi if [[ ! "${PARAM_CLEANUPDELETE:-}" = "yes" ]]; then # Create global archive directory if not existent if [[ ! -e "${BASEDIR}/archive" ]]; then mkdir "${BASEDIR}/archive" fi fi # Allow globbing noglob_set # Loop over all certificate directories for certdir in "${CERTDIR}/"*; do # Skip if entry is not a folder [[ -d "${certdir}" ]] || continue # Get certificate name certname="$(basename "${certdir}")" # Create certificates archive directory if not existent if [[ ! "${PARAM_CLEANUPDELETE:-}" = "yes" ]]; then archivedir="${BASEDIR}/archive/${certname}" if [[ ! -e "${archivedir}" ]]; then mkdir "${archivedir}" fi fi # Loop over file-types (certificates, keys, signing-requests, ...) for filetype in cert.csr cert.pem chain.pem fullchain.pem privkey.pem ocsp.der; do # Delete all if symlink is broken if [[ -r "${certdir}/${filetype}" ]]; then # Look up current file in use current="$(basename "$(readlink "${certdir}/${filetype}")")" else if [[ -h "${certdir}/${filetype}" ]]; then echo "Removing broken symlink: ${certdir}/${filetype}" rm -f "${certdir}/${filetype}" fi current="" fi # Split filetype into name and extension filebase="$(echo "${filetype}" | cut -d. -f1)" fileext="$(echo "${filetype}" | cut -d. -f2)" # Loop over all files of this type for file in "${certdir}/${filebase}-"*".${fileext}" "${certdir}/${filebase}-"*".${fileext}-revoked"; do # Check if current file is in use, if unused move to archive directory filename="$(basename "${file}")" if [[ ! "${filename}" = "${current}" ]] && [[ -f "${certdir}/${filename}" ]]; then if [[ "${PARAM_CLEANUPDELETE:-}" = "yes" ]]; then echo "Deleting unused file: ${certname}/${filename}" rm "${certdir}/${filename}" else echo "Moving unused file to archive directory: ${certname}/${filename}" mv "${certdir}/${filename}" "${archivedir}/${filename}" fi fi done done done exit "${exit_with_errorcode}" } # Usage: --cleanup-delete (-gcd) # Description: Deletes (!) unused certificate files command_cleanupdelete() { command_cleanup } # Usage: --help (-h) # Description: Show help text command_help() { printf "Usage: %s [-h] [command [argument]] [parameter [argument]] [parameter [argument]] ...\n\n" "${0}" printf "Default command: help\n\n" echo "Commands:" grep -e '^[[:space:]]*# Usage:' -e '^[[:space:]]*# Description:' -e '^command_.*()[[:space:]]*{' "${0}" | while read -r usage; read -r description; read -r command; do if [[ ! "${usage}" =~ Usage ]] || [[ ! "${description}" =~ Description ]] || [[ ! "${command}" =~ ^command_ ]]; then _exiterr "Error generating help text." fi printf " %-32s %s\n" "${usage##"# Usage: "}" "${description##"# Description: "}" done printf -- "\nParameters:\n" grep -E -e '^[[:space:]]*# PARAM_Usage:' -e '^[[:space:]]*# PARAM_Description:' "${0}" | while read -r usage; read -r description; do if [[ ! "${usage}" =~ Usage ]] || [[ ! "${description}" =~ Description ]]; then _exiterr "Error generating help text." fi printf " %-32s %s\n" "${usage##"# PARAM_Usage: "}" "${description##"# PARAM_Description: "}" done } # Usage: --env (-e) # Description: Output configuration variables for use in other scripts command_env() { echo "# dehydrated configuration" load_config typeset -p CA CERTDIR ALPNCERTDIR CHALLENGETYPE DOMAINS_D DOMAINS_TXT HOOK HOOK_CHAIN RENEW_DAYS ACCOUNT_KEY ACCOUNT_KEY_JSON ACCOUNT_ID_JSON KEYSIZE WELLKNOWN PRIVATE_KEY_RENEW OPENSSL_CNF CONTACT_EMAIL LOCKFILE } # Main method (parses script arguments and calls command_* methods) main() { exit_with_errorcode=0 skip_exit_hook=no COMMAND="" set_command() { [[ -z "${COMMAND}" ]] || _exiterr "Only one command can be executed at a time. See help (-h) for more information." COMMAND="${1}" } check_parameters() { if [[ -z "${1:-}" ]]; then echo "The specified command requires additional parameters. See help:" >&2 echo >&2 command_help >&2 exit 1 elif [[ "${1:0:1}" = "-" ]]; then _exiterr "Invalid argument: ${1}" fi } [[ -z "${*}" ]] && eval set -- "--help" while (( ${#} )); do case "${1}" in --help|-h) command_help exit 0 ;; --env|-e) set_command env ;; --cron|-c) set_command sign_domains ;; --register) set_command register ;; --account) set_command account ;; # PARAM_Usage: --accept-terms # PARAM_Description: Accept CAs terms of service --accept-terms) PARAM_ACCEPT_TERMS="yes" ;; --display-terms) set_command terms ;; --signcsr|-s) shift 1 set_command sign_csr check_parameters "${1:-}" PARAM_CSR="${1}" ;; --revoke|-r) shift 1 set_command revoke check_parameters "${1:-}" PARAM_REVOKECERT="${1}" ;; --deactivate) set_command deactivate ;; --version|-v) set_command version ;; --cleanup|-gc) set_command cleanup ;; --cleanup-delete|-gcd) set_command cleanupdelete PARAM_CLEANUPDELETE="yes" ;; # PARAM_Usage: --full-chain (-fc) # PARAM_Description: Print full chain when using --signcsr --full-chain|-fc) PARAM_FULL_CHAIN="1" ;; # PARAM_Usage: --ipv4 (-4) # PARAM_Description: Resolve names to IPv4 addresses only --ipv4|-4) PARAM_IP_VERSION="4" ;; # PARAM_Usage: --ipv6 (-6) # PARAM_Description: Resolve names to IPv6 addresses only --ipv6|-6) PARAM_IP_VERSION="6" ;; # PARAM_Usage: --domain (-d) domain.tld # PARAM_Description: Use specified domain name(s) instead of domains.txt entry (one certificate!) --domain|-d) shift 1 check_parameters "${1:-}" if [[ -z "${PARAM_DOMAIN:-}" ]]; then PARAM_DOMAIN="${1}" else PARAM_DOMAIN="${PARAM_DOMAIN} ${1}" fi ;; # PARAM_Usage: --ca url/preset # PARAM_Description: Use specified CA URL or preset --ca) shift 1 check_parameters "${1:-}" [[ -n "${PARAM_CA:-}" ]] && _exiterr "CA can only be specified once!" PARAM_CA="${1}" ;; # PARAM_Usage: --alias certalias # PARAM_Description: Use specified name for certificate directory (and per-certificate config) instead of the primary domain (only used if --domain is specified) --alias) shift 1 check_parameters "${1:-}" [[ -n "${PARAM_ALIAS:-}" ]] && _exiterr "Alias can only be specified once!" PARAM_ALIAS="${1}" ;; # PARAM_Usage: --keep-going (-g) # PARAM_Description: Keep going after encountering an error while creating/renewing multiple certificates in cron mode --keep-going|-g) PARAM_KEEP_GOING="yes" ;; # PARAM_Usage: --force (-x) # PARAM_Description: Force certificate renewal even if it is not due to expire within RENEW_DAYS --force|-x) PARAM_FORCE="yes" ;; # PARAM_Usage: --force-validation # PARAM_Description: Force revalidation of domain names (used in combination with --force) --force-validation) PARAM_FORCE_VALIDATION="yes" ;; # PARAM_Usage: --no-lock (-n) # PARAM_Description: Don't use lockfile (potentially dangerous!) --no-lock|-n) PARAM_NO_LOCK="yes" ;; # PARAM_Usage: --lock-suffix example.com # PARAM_Description: Suffix lockfile name with a string (useful for with -d) --lock-suffix) shift 1 check_parameters "${1:-}" PARAM_LOCKFILE_SUFFIX="${1}" ;; # PARAM_Usage: --ocsp # PARAM_Description: Sets option in CSR indicating OCSP stapling to be mandatory --ocsp) PARAM_OCSP_MUST_STAPLE="yes" ;; # PARAM_Usage: --privkey (-p) path/to/key.pem # PARAM_Description: Use specified private key instead of account key (useful for revocation) --privkey|-p) shift 1 check_parameters "${1:-}" PARAM_ACCOUNT_KEY="${1}" ;; # PARAM_Usage: --domains-txt path/to/domains.txt # PARAM_Description: Use specified domains.txt instead of default/configured one --domains-txt) shift 1 check_parameters "${1:-}" PARAM_DOMAINS_TXT="${1}" ;; # PARAM_Usage: --config (-f) path/to/config # PARAM_Description: Use specified config file --config|-f) shift 1 check_parameters "${1:-}" CONFIG="${1}" ;; # PARAM_Usage: --hook (-k) path/to/hook.sh # PARAM_Description: Use specified script for hooks --hook|-k) shift 1 check_parameters "${1:-}" PARAM_HOOK="${1}" ;; # PARAM_Usage: --preferred-chain issuer-cn # PARAM_Description: Use alternative certificate chain identified by issuer CN --preferred-chain) shift 1 check_parameters "${1:-}" PARAM_PREFERRED_CHAIN="${1}" ;; # PARAM_Usage: --out (-o) certs/directory # PARAM_Description: Output certificates into the specified directory --out|-o) shift 1 check_parameters "${1:-}" PARAM_CERTDIR="${1}" ;; # PARAM_Usage: --alpn alpn-certs/directory # PARAM_Description: Output alpn verification certificates into the specified directory --alpn) shift 1 check_parameters "${1:-}" PARAM_ALPNCERTDIR="${1}" ;; # PARAM_Usage: --challenge (-t) http-01|dns-01|dns-persist-01|tls-alpn-01 # PARAM_Description: Which challenge should be used? Currently http-01, dns-01, dns-persist-01 and tls-alpn-01 are supported --challenge|-t) shift 1 check_parameters "${1:-}" PARAM_CHALLENGETYPE="${1}" ;; # PARAM_Usage: --algo (-a) rsa|prime256v1|secp384r1 # PARAM_Description: Which public key algorithm should be used? Supported: rsa, prime256v1 and secp384r1 --algo|-a) shift 1 check_parameters "${1:-}" PARAM_KEY_ALGO="${1}" ;; # PARAM_Usage: --acme-profile profile_name # PARAM_Description: Use specified ACME profile --acme-profile) shift 1 check_parameters "${1:-}" PARAM_ACME_PROFILE="${1}" ;; # PARAM_Usage: --order-timeout seconds # PARAM_Description: Amount of seconds to wait for processing of order until erroring out --order-timeout) shift 1 check_parameters "${1:-}" PARAM_ORDER_TIMEOUT=${1} ;; # PARAM_Usage: --validation-timeout seconds # PARAM_Description: Amount of seconds to wait for processing of domain validations until erroring out --validation-timeout) shift 1 check_parameters "${1:-}" PARAM_VALIDATION_TIMEOUT=${1} ;; *) echo "Unknown parameter detected: ${1}" >&2 echo >&2 command_help >&2 exit 1 ;; esac shift 1 done case "${COMMAND}" in env) command_env;; sign_domains) command_sign_domains;; register) command_register;; account) command_account;; sign_csr) command_sign_csr "${PARAM_CSR}";; revoke) command_revoke "${PARAM_REVOKECERT}";; deactivate) command_deactivate;; cleanup) command_cleanup;; terms) command_terms;; cleanupdelete) command_cleanupdelete;; version) command_version;; *) command_help; exit 1;; esac exit "${exit_with_errorcode}" } # Determine OS type OSTYPE="$(uname)" if [[ ! "${DEHYDRATED_NOOP:-}" = "NOOP" ]]; then # Run script main "${@:-}" fi # vi: expandtab sw=2 ts=2 ================================================ FILE: aegir/helpers/dump_cdorked_config.c ================================================ // This program dumps the content of a shared memory block // used by Linux/Cdorked.A into a file named httpd_cdorked_config.bin // when the machine is infected. // // Some of the data is encrypted. If your server is infected and you // would like to help, please send the httpd_cdorked_config.bin // and your httpd executable to our lab for analysis. Thanks! // // Build with gcc -o dump_cdorked_config dump_cdorked_config.c // // Marc-Etienne M.Léveillé // #include #include #define CDORKED_SHM_SIZE (6118512) #define CDORKED_OUTFILE "httpd_cdorked_config.bin" int main (int argc, char *argv[]) { int maxkey, id, shmid, infected = 0; struct shm_info shm_info; struct shmid_ds shmds; void * cdorked_data; FILE * outfile; maxkey = shmctl(0, SHM_INFO, (void *) &shm_info); for(id = 0; id <= maxkey; id++) { shmid = shmctl(id, SHM_STAT, &shmds); if (shmid < 0) continue; if(shmds.shm_segsz == CDORKED_SHM_SIZE) { // We have a matching Cdorked memory segment infected++; printf("A shared memory matching Cdorked signature was found.\n"); printf("You should check your HTTP server's executable file integrity.\n"); cdorked_data = shmat(shmid, NULL, 0666); if(cdorked_data != NULL) { outfile = fopen(CDORKED_OUTFILE, "wb"); if(outfile == NULL) { printf("Could not open file %s for writing.", CDORKED_OUTFILE); } else { fwrite(cdorked_data, CDORKED_SHM_SIZE, 1, outfile); fclose(outfile); printf("The Cdorked configuration was dumped in the %s file.\n\n", CDORKED_OUTFILE); } } } } if(infected == 0) { printf("No shared memory matching Cdorked signature was found.\n"); printf("To further verify your server, run \"ipcs -m -p\" and look"); printf(" for a memory segments created by your http server.\n"); } else { printf("If you would like to help us in our research on Cdorked, "); printf("please send the httpd_cdorked_config.bin and your httpd executable file "); printf("to our lab for analysis at leveille@eset.com. Thanks!\n"); } return infected; } ================================================ FILE: aegir/helpers/fix-fstab-to-uuid.sh ================================================ #!/bin/bash # Enable strict error handling for debugging only # set -euo pipefail echo "Backing up /etc/fstab to /etc/fstab.bak" cp -p /etc/fstab /etc/fstab.bak echo "Processing Linode volume mounts..." # Loop through current fstab entries related to Linode Volumes grep '/dev/disk/by-id/scsi-0Linode_Volume_' /etc/fstab.bak | while read -r line; do # Extract device and mount point device=$(echo "$line" | awk '{print $1}') mountpoint=$(echo "$line" | awk '{print $2}') # Resolve the real device path (like /dev/sdb, /dev/sdc) realdev=$(readlink -f "$device") # Get the UUID of the real device uuid=$(blkid -s UUID -o value "$realdev") if [ -n "$uuid" ]; then echo "Updating $mountpoint to UUID=$uuid" # Escape slashes for sed replacement escaped_device=$(echo "$device" | sed 's|/|\\/|g') sed -i "s|$escaped_device|UUID=$uuid|" /etc/fstab else echo "Warning: UUID not found for $device ($realdev)" fi done echo "Checking with diff.." diff -urp /etc/fstab.bak /etc/fstab echo "Done. New /etc/fstab is ready." echo "Please verify with: cat /etc/fstab" echo "If everything looks good, you can safely reboot." ================================================ FILE: aegir/helpers/hosting_cron.sql ================================================ CREATE TABLE IF NOT EXISTS `hosting_cron` ( `nid` int(10) unsigned NOT NULL DEFAULT '0', `cron_interval` int(10) unsigned NOT NULL DEFAULT '0', PRIMARY KEY (`nid`) ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4; ================================================ FILE: aegir/helpers/le-hook.sh ================================================ #!/usr/bin/env bash # https://github.com/lukas2511/dehydrated/blob/master/docs/examples/hook.sh # Enable strict error handling for debugging only # set -euo pipefail deploy_challenge() { local DOMAIN="${1}" TOKEN_FILENAME="${2}" TOKEN_VALUE="${3}" echo "" echo "Add the following to the zone definition of ${1}:" echo "_acme-challenge.${1}. IN TXT \"${3}\"" echo "" echo -n "Press enter to continue..." read tmp echo "" } clean_challenge() { local DOMAIN="${1}" TOKEN_FILENAME="${2}" TOKEN_VALUE="${3}" echo "" echo "Now you can remove the following from the zone definition of ${1}:" echo "_acme-challenge.${1}. IN TXT \"${3}\"" echo "" echo -n "Press enter to continue..." read tmp echo "" } deploy_cert() { local DOMAIN="${1}" KEYFILE="${2}" CERTFILE="${3}" FULLCHAINFILE="${4}" CHAINFILE="${5}" TIMESTAMP="${6}" echo "" echo "deploy_cert()" echo "" } unchanged_cert() { local DOMAIN="${1}" KEYFILE="${2}" CERTFILE="${3}" FULLCHAINFILE="${4}" CHAINFILE="${5}" echo "" echo "unchanged_cert()" echo "" } invalid_challenge() { local DOMAIN="${1}" RESPONSE="${2}" echo "" echo "invalid_challenge()" echo "${1}" echo "${2}" echo "" } request_failure() { local STATUSCODE="${1}" REASON="${2}" REQTYPE="${3}" echo "" echo "request_failure()" echo "${1}" echo "${2}" echo "${3}" echo "" } exit_hook() { echo "" echo "done" echo "" } HANDLER="$1"; shift if [[ "${HANDLER}" =~ ^(deploy_challenge|clean_challenge|deploy_cert|unchanged_cert|invalid_challenge|request_failure|exit_hook)$ ]]; then "$HANDLER" "$@" fi ================================================ FILE: aegir/helpers/make_client.php.txt ================================================ uid = 1; $node->type = 'client'; $node->email = $_SERVER['argv'][3]; $node->title = 'Octopus' . $number; $node->language = LANGUAGE_NONE; $node->status = 1; node_object_prepare($node); $node = node_submit($node); node_save($node); $this_client_id = $node->nid; variable_set('hosting_default_client', $node->nid); ?> ================================================ FILE: aegir/helpers/make_client_3.php.txt ================================================ uid = 1; $node->type = 'client'; $node->email = $_SERVER['argv'][4]; $node->title = 'Octopus' . $number; $node->status = 1; node_save($node); $this_client_id = $node->nid; variable_set('hosting_default_client', $node->nid); ?> ================================================ FILE: aegir/helpers/make_home.php.txt ================================================ type = 'book'; variable_set('comment_book', '0'); $node->title = 'Welcome to the World of Ægir'; $node->language = LANGUAGE_NONE; $path = 'welcome'; $node->path = array('alias' => $path); node_object_prepare($node); $node->uid = 1; $body_text = '

Do you manage more than a few Drupal sites, and feel a great sense of panic every time a security release is announced? Or maybe you only have a few sites, and would like to spend less time on the tedious (and likely manual) tasks associated with running these Drupal sites over their entire lifetime?

Solve your problems with multiple Drupal sites by running in Ægir! It\'s even easier than tweeting! Simply enter your domain or subdomain, pointed to your Ægir instance, choose an installation profile and platform, click Save, then - wait a few minutes and you\'re ready to go!

Now, from one web site, you can manage every other web site you\'ve created - clone it, batch-migrate to newer platforms, reset your main password - anything you want, and it\'s still the same 2-click easy task - as simple as posting a new tweet!



Already 900+ other hosts powering thousands of Drupal sites are running on our high-performance, Free/Libre Open Source Ægir BOA Software. BOA is an acronym of high performance Barracuda, Octopus and Ægir LEMP server stack. Barracuda installs and monitors all essential system services, while Octopus is an Ægir installer, with many popular Drupal Distributions ready to use, including: Drupal CMS, Commerce, DXPR Marketing, EzContent, farmOS, LocalGov, OpenCulturas, OpenFed, OpenLucius, Opigno LMS, Sector, Social, Thunder, Ubercart, and Varbase.



Ægir is built by a community of system administrators and developers who share Drupal deployment tools, strategies and best practices. Ægir makes it easy to install, upgrade, and backup an entire network of Drupal sites. Ægir is fully extensible, since it\'s built on Drupal and Drush.

'; $node->status = 1; $node->body[$node->language][0]['value'] = $body_text; $node->body[$node->language][0]['summary'] = text_summary('Welcome to the World of Ægir','filtered_html'); $node->body[$node->language][0]['format'] = 'full_html'; $node = node_submit($node); node_save($node); variable_set('site_frontpage', 'node/' . $node->nid); ?> ================================================ FILE: aegir/helpers/make_platform.php.txt ================================================ type = 'platform'; $node->title = $_SERVER['argv'][3]; $node->language = LANGUAGE_NONE; node_object_prepare($node); $node->uid = 1; $node->publish_path = $_SERVER['argv'][5]; $node->web_server = variable_get('hosting_default_web_server', 2); $node->status = 1; $node = node_submit($node); node_save($node); $platform_id = $node->nid; variable_set('hosting_own_platform', $node->nid); // Create the platform profile node $node = new stdClass(); $node->type = 'package'; $node->title = $_SERVER['argv'][3]; $node->language = LANGUAGE_NONE; node_object_prepare($node); $node->uid = 1; $node->package_type = 'profile'; $node->short_name = $_SERVER['argv'][4]; $node->status = 1; $node = node_submit($node); node_save($node); ?> ================================================ FILE: aegir/helpers/make_platform_3.php.txt ================================================ uid = 1; $node->type = 'platform'; $node->title = $_SERVER['argv'][4]; $node->publish_path = $_SERVER['argv'][6]; $node->web_server = variable_get('hosting_default_web_server', 2); $node->status = 1; node_save($node); $platform_id = $node->nid; variable_set('hosting_own_platform', $node->nid); // Create the platform profile node $node = new stdClass(); $node->uid = 1; $node->title = $_SERVER['argv'][4]; $node->type = 'package'; $node->package_type = 'profile'; $node->short_name = $_SERVER['argv'][5]; $node->status = 1; node_save($node); ?> ================================================ FILE: aegir/helpers/mysql_root_pass_reset.sh ================================================ service cron stop ### Check /root/.my.cnf server:~# cat /root/.my.cnf [client] user=root password=FOOO server:~# ### If /root/.my.pass.txt does not exist or does not match /root/.my.cnf server:~# echo FOOO > /root/.my.pass.txt ### If /etc/mysql_pre exists and /etc/mysql does not server:~# mv -f /etc/mysql_pre /etc/mysql ### Wait 60 sec. ### Run: service mysql stop ps axf | grep mysql ### For Percona 8.0 and 8.4 /usr/sbin/mysqld \ --defaults-file=/etc/mysql/my.cnf \ --user=mysql \ --skip-grant-tables \ --skip-networking \ --log-error-verbosity=3 \ --daemonize=OFF ### For Percona 5.7 /usr/sbin/mysqld \ --defaults-file=/etc/mysql/my.cnf \ --user=mysql \ --skip-grant-tables \ --skip-networking \ --log-warnings=2 server:~# mysql FLUSH PRIVILEGES; ALTER USER 'root'@'127.0.0.1' IDENTIFIED WITH mysql_native_password BY 'FOOO'; ALTER USER 'root'@'::1' IDENTIFIED WITH mysql_native_password BY 'FOOO'; ALTER USER 'root'@'localhost' IDENTIFIED WITH mysql_native_password BY 'FOOO'; FLUSH PRIVILEGES; mysql> exit server:~# service mysql restart server:~# mysql mysql> exit server:~# service cron start ================================================ FILE: aegir/helpers/mysqltuner5 ================================================ #!/usr/bin/env perl # mysqltuner.pl - Version 2.5.2 # High Performance MySQL Tuning Script # Copyright (C) 2015-2023 Jean-Marie Renouard - jmrenouard@gmail.com # Copyright (C) 2006-2023 Major Hayden - major@mhtx.net # For the latest updates, please visit http://mysqltuner.pl/ # Git repository available at https://github.com/major/MySQLTuner-perl # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . # # This project would not be possible without help from: # Matthew Montgomery Paul Kehrer Dave Burgess # Jonathan Hinds Mike Jackson Nils Breunese # Shawn Ashlee Luuk Vosslamber Ville Skytta # Trent Hornibrook Jason Gill Mark Imbriaco # Greg Eden Aubin Galinotti Giovanni Bechis # Bill Bradford Ryan Novosielski Michael Scheidell # Blair Christensen Hans du Plooy Victor Trac # Everett Barnes Tom Krouper Gary Barrueto # Simon Greenaway Adam Stein Isart Montane # Baptiste M. Cole Turner Major Hayden # Joe Ashcraft Jean-Marie Renouard Christian Loos # Julien Francoz Daniel Black Long Radix # # Inspired by Matthew Montgomery's tuning-primer.sh script: # http://www.day32.com/MySQL/ # package main; use 5.005; use strict; use warnings; use diagnostics; use File::Spec; use Getopt::Long; use Pod::Usage; use File::Basename; use Cwd 'abs_path'; #use Data::Dumper; #$Data::Dumper::Pair = " : "; # for which() #use Env; # Set up a few variables for use in the script my $tunerversion = "2.5.2"; my ( @adjvars, @generalrec ); # Set defaults my %opt = ( "silent" => 0, "nobad" => 0, "nogood" => 0, "noinfo" => 0, "debug" => 0, "nocolor" => ( !-t STDOUT ), "color" => ( -t STDOUT ), "forcemem" => 0, "forceswap" => 0, "host" => 0, "socket" => 0, "port" => 0, "user" => 0, "pass" => 0, "password" => 0, "ssl-ca" => 0, "skipsize" => 0, "checkversion" => 0, "updateversion" => 0, "buffers" => 0, "passwordfile" => 0, "bannedports" => '', "maxportallowed" => 0, "outputfile" => 0, "noprocess" => 0, "dbstat" => 0, "nodbstat" => 0, "server-log" => '', "tbstat" => 0, "notbstat" => 0, "colstat" => 0, "nocolstat" => 0, "idxstat" => 0, "noidxstat" => 0, "nomyisamstat" => 0, "nostructstat" => 0, "sysstat" => 0, "nosysstat" => 0, "pfstat" => 0, "nopfstat" => 0, "skippassword" => 0, "noask" => 0, "template" => 0, "json" => 0, "prettyjson" => 0, "reportfile" => 0, "verbose" => 0, "defaults-file" => '', "defaults-extra-file" => '', "protocol" => '', "dumpdir" => '', "feature" => '', "dbgpattern" => '', "defaultarch" => 64 ); # Gather the options from the command line GetOptions( \%opt, 'nobad', 'nogood', 'noinfo', 'debug', 'nocolor', 'forcemem=i', 'forceswap=i', 'host=s', 'socket=s', 'port=i', 'user=s', 'pass=s', 'skipsize', 'checkversion', 'mysqladmin=s', 'mysqlcmd=s', 'help', 'buffers', 'skippassword', 'passwordfile=s', 'outputfile=s', 'silent', 'noask', 'json', 'prettyjson', 'template=s', 'reportfile=s', 'cvefile=s', 'bannedports=s', 'updateversion', 'maxportallowed=s', 'verbose', 'password=s', 'passenv=s', 'userenv=s', 'defaults-file=s', 'ssl-ca=s', 'color', 'noprocess', 'dbstat', 'nodbstat', 'tbstat', 'notbstat', 'colstat', 'nocolstat', 'sysstat', 'nosysstat', 'pfstat', 'nopfstat', 'idxstat', 'noidxstat', 'structstat', 'nostructstat', 'myisamstat', 'nomyisamstat', 'server-log=s', 'protocol=s', 'defaults-extra-file=s', 'dumpdir=s', 'feature=s', 'dbgpattern=s', 'defaultarch=i' ) or pod2usage( -exitval => 1, -verbose => 99, -sections => [ "NAME", "IMPORTANT USAGE GUIDELINES", "CONNECTION AND AUTHENTICATION", "PERFORMANCE AND REPORTING OPTIONS", "OUTPUT OPTIONS" ] ); if ( defined $opt{'help'} && $opt{'help'} == 1 ) { pod2usage( -exitval => 0, -verbose => 99, -sections => [ "NAME", "IMPORTANT USAGE GUIDELINES", "CONNECTION AND AUTHENTICATION", "PERFORMANCE AND REPORTING OPTIONS", "OUTPUT OPTIONS" ] ); } my $devnull = File::Spec->devnull(); my $basic_password_files = ( $opt{passwordfile} eq "0" ) ? abs_path( dirname(__FILE__) ) . "/basic_passwords.txt" : abs_path( $opt{passwordfile} ); # Username from envvar if ( exists $opt{userenv} && exists $ENV{ $opt{userenv} } ) { $opt{user} = $ENV{ $opt{userenv} }; } # Related to password option if ( exists $opt{passenv} && exists $ENV{ $opt{passenv} } ) { $opt{pass} = $ENV{ $opt{passenv} }; } $opt{pass} = $opt{password} if ( $opt{pass} eq 0 and $opt{password} ne 0 ); if ( $opt{dumpdir} ne '' ) { $opt{dumpdir} = abs_path( $opt{dumpdir} ); if ( !-d $opt{dumpdir} ) { mkdir $opt{dumpdir} or die "Cannot create directory $opt{dumpdir}: $!"; } } # for RPM distributions $basic_password_files = "/usr/share/mysqltuner/basic_passwords.txt" unless -f "$basic_password_files"; $opt{dbgpattern} = '.*' if ( $opt{dbgpattern} eq '' ); # check if we need to enable verbose mode if ( $opt{feature} ne '' ) { $opt{verbose} = 1; } if ( $opt{verbose} ) { $opt{checkversion} = 1; # Check for updates to MySQLTuner $opt{dbstat} = 1; # Print database information $opt{tbstat} = 1; # Print database information $opt{idxstat} = 1; # Print index information $opt{sysstat} = 1; # Print index information $opt{buffers} = 1; # Print global and per-thread buffer values $opt{pfstat} = 1; # Print performance schema info. $opt{structstat} = 1; # Print table structure information $opt{myisamstat} = 1; # Print MyISAM table information $opt{cvefile} = 'vulnerabilities.csv'; #CVE File for vulnerability checks } $opt{nocolor} = 1 if defined( $opt{outputfile} ); $opt{tbstat} = 0 if ( $opt{notbstat} == 1 ); # Don't print table information $opt{colstat} = 0 if ( $opt{nocolstat} == 1 ); # Don't print column information $opt{dbstat} = 0 if ( $opt{nodbstat} == 1 ); # Don't print database information $opt{noprocess} = 0 if ( $opt{noprocess} == 1 ); # Don't print process information $opt{sysstat} = 0 if ( $opt{nosysstat} == 1 ); # Don't print sysstat information $opt{pfstat} = 0 if ( $opt{nopfstat} == 1 ); # Don't print performance schema information $opt{idxstat} = 0 if ( $opt{noidxstat} == 1 ); # Don't print index information $opt{structstat} = 0 if ( not defined( $opt{structstat} ) or $opt{nostructstat} == 1 ) ; # Don't print table struct information $opt{myisamstat} = 1 if ( not defined( $opt{myisamstat} ) ); $opt{myisamstat} = 0 if ( $opt{nomyisamstat} == 1 ); # Don't print MyISAM table information # for RPM distributions $opt{cvefile} = "/usr/share/mysqltuner/vulnerabilities.csv" unless ( defined $opt{cvefile} and -f "$opt{cvefile}" ); $opt{cvefile} = '' unless -f "$opt{cvefile}"; $opt{cvefile} = './vulnerabilities.csv' if -f './vulnerabilities.csv'; $opt{'bannedports'} = '' unless defined( $opt{'bannedports'} ); my @banned_ports = split ',', $opt{'bannedports'}; # my $outputfile = undef; $outputfile = abs_path( $opt{outputfile} ) unless $opt{outputfile} eq "0"; my $fh = undef; open( $fh, '>', $outputfile ) or die("Fail opening $outputfile") if defined($outputfile); $opt{nocolor} = 1 if defined($outputfile); $opt{nocolor} = 1 unless ( -t STDOUT ); $opt{nocolor} = 0 if ( $opt{color} == 1 ); # Setting up the colors for the print styles my $me = `whoami`; $me =~ s/\n//g; my $good = ( $opt{nocolor} == 0 ) ? "[\e[0;32mOK\e[0m]" : "[OK]"; my $bad = ( $opt{nocolor} == 0 ) ? "[\e[0;31m!!\e[0m]" : "[!!]"; my $info = ( $opt{nocolor} == 0 ) ? "[\e[0;34m--\e[0m]" : "[--]"; my $deb = ( $opt{nocolor} == 0 ) ? "[\e[0;31mDG\e[0m]" : "[DG]"; my $cmd = ( $opt{nocolor} == 0 ) ? "\e[1;32m[CMD]($me)" : "[CMD]($me)"; my $end = ( $opt{nocolor} == 0 ) ? "\e[0m" : ""; # Maximum lines of log output to read from end my $maxlines = 30000; # Checks for supported or EOL'ed MySQL versions my ( $mysqlvermajor, $mysqlverminor, $mysqlvermicro ); # Database my @dblist; # Super structure containing all information my %result; $result{'MySQLTuner'}{'version'} = $tunerversion; $result{'MySQLTuner'}{'datetime'} = `date '+%d-%m-%Y %H:%M:%S'`; $result{'MySQLTuner'}{'options'} = \%opt; # Functions that handle the print styles sub prettyprint { print $_[0] . "\n" unless ( $opt{'silent'} or $opt{'json'} ); print $fh $_[0] . "\n" if defined($fh); } sub goodprint { prettyprint $good. " " . $_[0] unless ( $opt{nogood} == 1 ); } sub infoprint { prettyprint $info. " " . $_[0] unless ( $opt{noinfo} == 1 ); } sub badprint { prettyprint $bad. " " . $_[0] unless ( $opt{nobad} == 1 ); } sub debugprint { prettyprint $deb. " " . $_[0] unless ( $opt{debug} == 0 ); } sub redwrap { return ( $opt{nocolor} == 0 ) ? "\e[0;31m" . $_[0] . "\e[0m" : $_[0]; } sub greenwrap { return ( $opt{nocolor} == 0 ) ? "\e[0;32m" . $_[0] . "\e[0m" : $_[0]; } sub cmdprint { prettyprint $cmd. " " . $_[0] . $end; } sub infoprintml { for my $ln (@_) { $ln =~ s/\n//g; infoprint "\t$ln"; } } sub infoprintcmd { cmdprint "@_"; infoprintml grep { $_ ne '' and $_ !~ /^\s*$/ } `@_ 2>&1`; } sub subheaderprint { my $tln = 100; my $sln = 8; my $ln = length("@_") + 2; prettyprint " "; prettyprint "-" x $sln . " @_ " . "-" x ( $tln - $ln - $sln ); } sub infoprinthcmd { subheaderprint "$_[0]"; infoprintcmd "$_[1]"; } sub is_remote() { my $host = $opt{'host'}; return 0 if ( $host eq '' ); return 0 if ( $host eq 'localhost' ); return 0 if ( $host eq '127.0.0.1' ); return 1; } sub is_int { return 0 unless defined $_[0]; my $str = $_[0]; #trim whitespace both sides $str =~ s/^\s+|\s+$//g; #Alternatively, to match any float-like numeric, use: # m/^([+-]?)(?=\d|\.\d)\d*(\.\d*)?([Ee]([+-]?\d+))?$/ #flatten to string and match dash or plus and one or more digits if ( $str =~ /^(\-|\+)?\d+?$/ ) { return 1; } return 0; } # Calculates the number of physical cores considering HyperThreading sub cpu_cores { if ( $^O eq 'linux' ) { my $cntCPU = `awk -F: '/^core id/ && !P[\$2] { CORES++; P[\$2]=1 }; /^physical id/ && !N[\$2] { CPUs++; N[\$2]=1 }; END { print CPUs*CORES }' /proc/cpuinfo`; chomp $cntCPU; return ( $cntCPU == 0 ? `nproc` : $cntCPU ); } if ( $^O eq 'freebsd' ) { my $cntCPU = `sysctl -n kern.smp.cores`; chomp $cntCPU; return $cntCPU + 0; } return 0; } # Calculates the parameter passed in bytes, then rounds it to one decimal place sub hr_bytes { my $num = shift; return "0B" unless defined($num); return "0B" if $num eq "NULL"; return "0B" if $num eq ""; if ( $num >= ( 1024**3 ) ) { # GB return sprintf( "%.1f", ( $num / ( 1024**3 ) ) ) . "G"; } elsif ( $num >= ( 1024**2 ) ) { # MB return sprintf( "%.1f", ( $num / ( 1024**2 ) ) ) . "M"; } elsif ( $num >= 1024 ) { # KB return sprintf( "%.1f", ( $num / 1024 ) ) . "K"; } else { return $num . "B"; } } sub hr_raw { my $num = shift; return "0" unless defined($num); return "0" if $num eq "NULL"; if ( $num =~ /^(\d+)G$/ ) { return $1 * 1024 * 1024 * 1024; } if ( $num =~ /^(\d+)M$/ ) { return $1 * 1024 * 1024; } if ( $num =~ /^(\d+)K$/ ) { return $1 * 1024; } if ( $num =~ /^(\d+)$/ ) { return $1; } return $num; } # Calculates the parameter passed in bytes, then rounds it to the nearest integer sub hr_bytes_rnd { my $num = shift; return "0B" unless defined($num); return "0B" if $num eq "NULL"; if ( $num >= ( 1024**3 ) ) { # GB return int( ( $num / ( 1024**3 ) ) ) . "G"; } elsif ( $num >= ( 1024**2 ) ) { # MB return int( ( $num / ( 1024**2 ) ) ) . "M"; } elsif ( $num >= 1024 ) { # KB return int( ( $num / 1024 ) ) . "K"; } else { return $num . "B"; } } # Calculates the parameter passed to the nearest power of 1000, then rounds it to the nearest integer sub hr_num { my $num = shift; if ( $num >= ( 1000**3 ) ) { # Billions return int( ( $num / ( 1000**3 ) ) ) . "B"; } elsif ( $num >= ( 1000**2 ) ) { # Millions return int( ( $num / ( 1000**2 ) ) ) . "M"; } elsif ( $num >= 1000 ) { # Thousands return int( ( $num / 1000 ) ) . "K"; } else { return $num; } } # Calculate Percentage sub percentage { my $value = shift; my $total = shift; $total = 0 unless defined $total; $total = 0 if $total eq "NULL"; return 100, 00 if $total == 0; return sprintf( "%.2f", ( $value * 100 / $total ) ); } # Calculates uptime to display in a human-readable form sub pretty_uptime { my $uptime = shift; my $seconds = $uptime % 60; my $minutes = int( ( $uptime % 3600 ) / 60 ); my $hours = int( ( $uptime % 86400 ) / (3600) ); my $days = int( $uptime / (86400) ); my $uptimestring; if ( $days > 0 ) { $uptimestring = "${days}d ${hours}h ${minutes}m ${seconds}s"; } elsif ( $hours > 0 ) { $uptimestring = "${hours}h ${minutes}m ${seconds}s"; } elsif ( $minutes > 0 ) { $uptimestring = "${minutes}m ${seconds}s"; } else { $uptimestring = "${seconds}s"; } return $uptimestring; } # Retrieves the memory installed on this machine my ( $physical_memory, $swap_memory, $duflags, $xargsflags ); sub memerror { badprint "Unable to determine total memory/swap; use '--forcemem' and '--forceswap'"; exit 1; } sub os_setup { my $os = `uname`; $duflags = ( $os =~ /Linux/ ) ? '-b' : ''; $xargsflags = ( $os =~ /Darwin|SunOS/ ) ? '' : '-r'; if ( $opt{'forcemem'} > 0 ) { $physical_memory = $opt{'forcemem'} * 1048576; infoprint "Assuming $opt{'forcemem'} MB of physical memory"; if ( $opt{'forceswap'} > 0 ) { $swap_memory = $opt{'forceswap'} * 1048576; infoprint "Assuming $opt{'forceswap'} MB of swap space"; } else { $swap_memory = 0; badprint "Assuming 0 MB of swap space (use --forceswap to specify)"; } } else { if ( $os =~ /Linux|CYGWIN/ ) { $physical_memory = `grep -i memtotal: /proc/meminfo | awk '{print \$2}'` or memerror; $physical_memory *= 1024; $swap_memory = `grep -i swaptotal: /proc/meminfo | awk '{print \$2}'` or memerror; $swap_memory *= 1024; } elsif ( $os =~ /Darwin/ ) { $physical_memory = `sysctl -n hw.memsize` or memerror; $swap_memory = `sysctl -n vm.swapusage | awk '{print \$3}' | sed 's/\..*\$//'` or memerror; } elsif ( $os =~ /NetBSD|OpenBSD|FreeBSD/ ) { $physical_memory = `sysctl -n hw.physmem` or memerror; if ( $physical_memory < 0 ) { $physical_memory = `sysctl -n hw.physmem64` or memerror; } $swap_memory = `swapctl -l | grep '^/' | awk '{ s+= \$2 } END { print s }'` or memerror; } elsif ( $os =~ /BSD/ ) { $physical_memory = `sysctl -n hw.realmem` or memerror; $swap_memory = `swapinfo | grep '^/' | awk '{ s+= \$2 } END { print s }'`; } elsif ( $os =~ /SunOS/ ) { $physical_memory = `/usr/sbin/prtconf | grep Memory | cut -f 3 -d ' '` or memerror; chomp($physical_memory); $physical_memory = $physical_memory * 1024 * 1024; } elsif ( $os =~ /AIX/ ) { $physical_memory = `lsattr -El sys0 | grep realmem | awk '{print \$2}'` or memerror; chomp($physical_memory); $physical_memory = $physical_memory * 1024; $swap_memory = `lsps -as | awk -F"(MB| +)" '/MB /{print \$2}'` or memerror; chomp($swap_memory); $swap_memory = $swap_memory * 1024 * 1024; } elsif ( $os =~ /windows/i ) { $physical_memory = `wmic ComputerSystem get TotalPhysicalMemory | perl -ne "chomp; print if /[0-9]+/;"` or memerror; $swap_memory = `wmic OS get FreeVirtualMemory | perl -ne "chomp; print if /[0-9]+/;"` or memerror; } } debugprint "Physical Memory: $physical_memory"; debugprint "Swap Memory: $swap_memory"; chomp($physical_memory); chomp($swap_memory); chomp($os); $result{'OS'}{'OS Type'} = $os; $result{'OS'}{'Physical Memory'}{'bytes'} = $physical_memory; $result{'OS'}{'Physical Memory'}{'pretty'} = hr_bytes($physical_memory); $result{'OS'}{'Swap Memory'}{'bytes'} = $swap_memory; $result{'OS'}{'Swap Memory'}{'pretty'} = hr_bytes($swap_memory); $result{'OS'}{'Other Processes'}{'bytes'} = get_other_process_memory(); $result{'OS'}{'Other Processes'}{'pretty'} = hr_bytes( get_other_process_memory() ); } sub get_http_cli { my $httpcli = which( "curl", $ENV{'PATH'} ); chomp($httpcli); if ($httpcli) { return $httpcli; } $httpcli = which( "wget", $ENV{'PATH'} ); chomp($httpcli); if ($httpcli) { return $httpcli; } return ""; } # Checks for updates to MySQLTuner sub validate_tuner_version { if ( $opt{'checkversion'} eq 0 ) { print "\n" unless ( $opt{'silent'} or $opt{'json'} ); infoprint "Skipped version check for MySQLTuner script"; return; } my $update; my $url = "https://raw.githubusercontent.com/major/MySQLTuner-perl/master/mysqltuner.pl"; my $httpcli = get_http_cli(); if ( $httpcli =~ /curl$/ ) { debugprint "$httpcli is available."; debugprint "$httpcli -m 3 -silent '$url' 2>/dev/null | grep 'my \$tunerversion'| cut -d\\\" -f2"; $update = `$httpcli -m 3 -silent '$url' 2>/dev/null | grep 'my \$tunerversion'| cut -d\\\" -f2`; chomp($update); debugprint "VERSION: $update"; compare_tuner_version($update); return; } if ( $httpcli =~ /wget$/ ) { debugprint "$httpcli is available."; debugprint "$httpcli -e timestamping=off -t 1 -T 3 -O - '$url' 2>$devnull| grep 'my \$tunerversion'| cut -d\\\" -f2"; $update = `$httpcli -e timestamping=off -t 1 -T 3 -O - '$url' 2>$devnull| grep 'my \$tunerversion'| cut -d\\\" -f2`; chomp($update); compare_tuner_version($update); return; } debugprint "curl and wget are not available."; infoprint "Unable to check for the latest MySQLTuner version"; infoprint "Using --pass and --password option is insecure during MySQLTuner execution (password disclosure)" if ( defined( $opt{'pass'} ) ); } # Checks for updates to MySQLTuner sub update_tuner_version { if ( $opt{'updateversion'} eq 0 ) { badprint "Skipped version update for MySQLTuner script"; print "\n" unless ( $opt{'silent'} or $opt{'json'} ); return; } my $update; my $fullpath = ""; my $url = "https://raw.githubusercontent.com/major/MySQLTuner-perl/master/"; my @scripts = ( "mysqltuner.pl", "basic_passwords.txt", "vulnerabilities.csv" ); my $totalScripts = scalar(@scripts); my $receivedScripts = 0; my $httpcli = get_http_cli(); foreach my $script (@scripts) { if ( $httpcli =~ /curl$/ ) { debugprint "$httpcli is available."; $fullpath = dirname(__FILE__) . "/" . $script; debugprint "FullPath: $fullpath"; debugprint "$httpcli --connect-timeout 3 '$url$script' 2>$devnull > $fullpath"; $update = `$httpcli --connect-timeout 3 '$url$script' 2>$devnull > $fullpath`; chomp($update); debugprint "$script updated: $update"; if ( -s $script eq 0 ) { badprint "Couldn't update $script"; } else { ++$receivedScripts; debugprint "$script updated: $update"; } } elsif ( $httpcli =~ /wget$/ ) { debugprint "$httpcli is available."; debugprint "$httpcli -qe timestamping=off -t 1 -T 3 -O $script '$url$script'"; $update = `$httpcli -qe timestamping=off -t 1 -T 3 -O $script '$url$script'`; chomp($update); if ( -s $script eq 0 ) { badprint "Couldn't update $script"; } else { ++$receivedScripts; debugprint "$script updated: $update"; } } else { debugprint "curl and wget are not available."; infoprint "Unable to check for the latest MySQLTuner version"; } } if ( $receivedScripts eq $totalScripts ) { goodprint "Successfully updated MySQLTuner script"; } else { badprint "Couldn't update MySQLTuner script"; } infoprint "Stopping program: MySQLTuner script must be updated first."; exit 0; } sub compare_tuner_version { my $remoteversion = shift; debugprint "Remote data: $remoteversion"; #exit 0; if ( $remoteversion ne $tunerversion ) { badprint "There is a new version of MySQLTuner available ($remoteversion)"; update_tuner_version(); return; } goodprint "You have the latest version of MySQLTuner ($tunerversion)"; return; } # Checks to see if a MySQL login is possible my ( $mysqllogin, $doremote, $remotestring, $mysqlcmd, $mysqladmincmd ); my $osname = $^O; if ( $osname eq 'MSWin32' ) { eval { require Win32; } or last; $osname = Win32::GetOSName(); infoprint "* Windows OS ($osname) is not fully supported.\n"; #exit 1; } sub mysql_setup { $doremote = 0; $remotestring = ''; if ( $opt{mysqladmin} ) { $mysqladmincmd = $opt{mysqladmin}; } else { $mysqladmincmd = which( "mysqladmin", $ENV{'PATH'} ); if ( !-e $mysqladmincmd ) { $mysqladmincmd = which( "mariadb-admin", $ENV{'PATH'} ); } } chomp($mysqladmincmd); if ( !-e $mysqladmincmd && $opt{mysqladmin} ) { badprint "Unable to find the mysqladmin command you specified: " . $mysqladmincmd . ""; exit 1; } elsif ( !-e $mysqladmincmd ) { badprint "Couldn't find mysqladmin/mariadb-admin in your \$PATH. Is MySQL installed?"; #exit 1; } if ( $opt{mysqlcmd} ) { $mysqlcmd = $opt{mysqlcmd}; } else { $mysqlcmd = which( "mysql", $ENV{'PATH'} ); if ( !-e $mysqlcmd ) { $mysqlcmd = which( "mariadb", $ENV{'PATH'} ); } } chomp($mysqlcmd); if ( !-e $mysqlcmd && $opt{mysqlcmd} ) { badprint "Unable to find the mysql command you specified: " . $mysqlcmd . ""; exit 1; } elsif ( !-e $mysqlcmd ) { badprint "Couldn't find mysql/mariadb in your \$PATH. Is MySQL installed?"; exit 1; } $mysqlcmd =~ s/\n$//g; my $mysqlclidefaults = `$mysqlcmd --print-defaults`; debugprint "MySQL Client: $mysqlclidefaults"; if ( $mysqlclidefaults =~ /auto-vertical-output/ ) { badprint "Avoid auto-vertical-output in configuration file(s) for MySQL like"; exit 1; } debugprint "MySQL Client: $mysqlcmd"; # Are we being asked to connect via a socket? if ( $opt{socket} ne 0 ) { if ( $opt{port} ne 0 ) { $remotestring = " -S $opt{socket} -P $opt{port}"; } else { $remotestring = " -S $opt{socket}"; } } if ( $opt{protocol} ne '' ) { $remotestring = " --protocol=$opt{protocol}"; } # Are we being asked to connect to a remote server? if ( $opt{host} ne 0 ) { chomp( $opt{host} ); $opt{port} = ( $opt{port} eq 0 ) ? 3306 : $opt{port}; # If we're doing a remote connection, but forcemem wasn't specified, we need to exit if ( $opt{'forcemem'} eq 0 && is_remote eq 1 ) { badprint "The --forcemem option is required for remote connections"; badprint "Assuming RAM memory is 1Gb for simplify remote connection usage"; $opt{'forcemem'} = 1024; #exit 1; } if ( $opt{'forceswap'} eq 0 && is_remote eq 1 ) { badprint "The --forceswap option is required for remote connections"; badprint "Assuming Swap size is 1Gb for simplify remote connection usage"; $opt{'forceswap'} = 1024; #exit 1; } infoprint "Performing tests on $opt{host}:$opt{port}"; $remotestring = " -h $opt{host} -P $opt{port}"; $doremote = is_remote(); } else { $opt{host} = '127.0.0.1'; } if ( $opt{'ssl-ca'} ne 0 ) { if ( -e -r -f $opt{'ssl-ca'} ) { $remotestring .= " --ssl-ca=$opt{'ssl-ca'}"; infoprint "Will connect using ssl public key passed on the command line"; return 1; } else { badprint "Attempted to use passed ssl public key, but it was not found or could not be read"; exit 1; } } # Did we already get a username with or without password on the command line? if ( $opt{user} ne 0 ) { $mysqllogin = "-u $opt{user} " . ( ( $opt{pass} ne 0 ) ? "-p'$opt{pass}' " : " " ) . $remotestring; my $loginstatus = `$mysqlcmd -Nrs -e 'select "mysqld is alive";' $mysqllogin 2>&1`; if ( $loginstatus =~ /mysqld is alive/ ) { goodprint "Logged in using credentials passed on the command line"; return 1; } else { badprint "Attempted to use login credentials, but they were invalid"; exit 1; } } my $svcprop = which( "svcprop", $ENV{'PATH'} ); if ( substr( $svcprop, 0, 1 ) =~ "/" ) { # We are on solaris ( my $mysql_login = `svcprop -p quickbackup/username svc:/network/mysql-quickbackup:default` ) =~ s/\s+$//; ( my $mysql_pass = `svcprop -p quickbackup/password svc:/network/mysql-quickbackup:default` ) =~ s/\s+$//; if ( substr( $mysql_login, 0, 7 ) ne "svcprop" ) { # mysql-quickbackup is installed $mysqllogin = "-u $mysql_login -p$mysql_pass"; my $loginstatus = `mysqladmin $mysqllogin ping 2>&1`; if ( $loginstatus =~ /mysqld is alive/ ) { goodprint "Logged in using credentials from mysql-quickbackup."; return 1; } else { badprint "Attempted to use login credentials from mysql-quickbackup, but they failed."; exit 1; } } } elsif ( -r "/etc/psa/.psa.shadow" and $doremote == 0 ) { # It's a Plesk box, use the available credentials $mysqllogin = "-u admin -p`cat /etc/psa/.psa.shadow`"; my $loginstatus = `$mysqladmincmd ping $mysqllogin 2>&1`; unless ( $loginstatus =~ /mysqld is alive/ ) { # Plesk 10+ $mysqllogin = "-u admin -p`/usr/local/psa/bin/admin --show-password`"; $loginstatus = `$mysqladmincmd ping $mysqllogin 2>&1`; unless ( $loginstatus =~ /mysqld is alive/ ) { badprint "Attempted to use login credentials from Plesk and Plesk 10+, but they failed."; exit 1; } } } elsif ( -r "/usr/local/directadmin/conf/mysql.conf" and $doremote == 0 ) { # It's a DirectAdmin box, use the available credentials my $mysqluser = `cat /usr/local/directadmin/conf/mysql.conf | egrep '^user=.*'`; my $mysqlpass = `cat /usr/local/directadmin/conf/mysql.conf | egrep '^passwd=.*'`; $mysqluser =~ s/user=//; $mysqluser =~ s/[\r\n]//; $mysqlpass =~ s/passwd=//; $mysqlpass =~ s/[\r\n]//; $mysqllogin = "-u $mysqluser -p$mysqlpass"; my $loginstatus = `mysqladmin ping $mysqllogin 2>&1`; unless ( $loginstatus =~ /mysqld is alive/ ) { badprint "Attempted to use login credentials from DirectAdmin, but they failed."; exit 1; } } elsif ( -r "/etc/mysql/debian.cnf" and $doremote == 0 and $opt{'defaults-file'} eq '' ) { # We have a Debian maintenance account, use it $mysqllogin = "--defaults-file=/etc/mysql/debian.cnf"; my $loginstatus = `$mysqladmincmd $mysqllogin ping 2>&1`; if ( $loginstatus =~ /mysqld is alive/ ) { goodprint "Logged in using credentials from Debian maintenance account."; return 1; } else { badprint "Attempted to use login credentials from Debian maintenance account, but they failed."; exit 1; } } elsif ( $opt{'defaults-file'} ne '' and -r "$opt{'defaults-file'}" ) { # defaults-file debugprint "defaults file detected: $opt{'defaults-file'}"; my $mysqlclidefaults = `$mysqlcmd --print-defaults`; debugprint "MySQL Client Default File: $opt{'defaults-file'}"; $mysqllogin = "--defaults-file=" . $opt{'defaults-file'}; my $loginstatus = `$mysqladmincmd $mysqllogin ping 2>&1`; if ( $loginstatus =~ /mysqld is alive/ ) { goodprint "Logged in using credentials from defaults file account."; return 1; } } elsif ( $opt{'defaults-extra-file'} ne '' and -r "$opt{'defaults-extra-file'}" ) { # defaults-extra-file debugprint "defaults extra file detected: $opt{'defaults-extra-file'}"; my $mysqlclidefaults = `$mysqlcmd --print-defaults`; debugprint "MySQL Client Extra Default File: $opt{'defaults-extra-file'}"; $mysqllogin = "--defaults-extra-file=" . $opt{'defaults-extra-file'}; my $loginstatus = `$mysqladmincmd $mysqllogin ping 2>&1`; if ( $loginstatus =~ /mysqld is alive/ ) { goodprint "Logged in using credentials from extra defaults file account."; return 1; } } else { # It's not Plesk or Debian, we should try a login debugprint "$mysqladmincmd $remotestring ping 2>&1"; #my $loginstatus = ""; debugprint "Using mysqlcmd: $mysqlcmd"; #if (defined($mysqladmincmd)) { # infoprint "Using mysqladmin to check login"; # $loginstatus=`$mysqladmincmd $remotestring ping 2>&1`; #} else { infoprint "Using mysql to check login"; my $loginstatus = `$mysqlcmd $remotestring -Nrs -e 'select "mysqld is alive"' --connect-timeout=3 2>&1`; #} if ( $loginstatus =~ /mysqld is alive/ ) { # Login went just fine $mysqllogin = " $remotestring "; # Did this go well because of a .my.cnf file or is there no password set? my $userpath = `printenv HOME`; if ( length($userpath) > 0 ) { chomp($userpath); } unless ( -e "${userpath}/.my.cnf" or -e "${userpath}/.mylogin.cnf" ) { badprint "SECURITY RISK: Successfully authenticated without password"; } return 1; } else { if ( $opt{'noask'} == 1 ) { badprint "Attempted to use login credentials, but they were invalid"; exit 1; } my ( $name, $password ); # If --user is defined no need to ask for username if ( $opt{user} ne 0 ) { $name = $opt{user}; } else { print STDERR "Please enter your MySQL administrative login: "; $name = ; } # If --pass is defined no need to ask for password if ( $opt{pass} ne 0 ) { $password = $opt{pass}; } else { print STDERR "Please enter your MySQL administrative password: "; system("stty -echo >$devnull 2>&1"); $password = ; system("stty echo >$devnull 2>&1"); } chomp($password); chomp($name); $mysqllogin = "-u $name"; if ( length($password) > 0 ) { $mysqllogin .= " -p'$password'"; } $mysqllogin .= $remotestring; my $loginstatus = `$mysqladmincmd ping $mysqllogin 2>&1`; if ( $loginstatus =~ /mysqld is alive/ ) { #print STDERR ""; if ( !length($password) ) { # Did this go well because of a .my.cnf file or is there no password set? my $userpath = `printenv HOME`; chomp($userpath); unless ( -e "$userpath/.my.cnf" ) { print STDERR ""; badprint "SECURITY RISK: Successfully authenticated without password"; } } return 1; } else { #print STDERR ""; badprint "Attempted to use login credentials, but they were invalid."; exit 1; } exit 1; } } } # MySQL Request Array sub select_array { my $req = shift; debugprint "PERFORM: $req "; my @result = `$mysqlcmd $mysqllogin -Bse "\\w$req" 2>>/dev/null`; if ( $? != 0 ) { badprint "Failed to execute: $req"; badprint "FAIL Execute SQL / return code: $?"; debugprint "CMD : $mysqlcmd"; debugprint "OPTIONS: $mysqllogin"; debugprint `$mysqlcmd $mysqllogin -Bse "$req" 2>&1`; #exit $?; } debugprint "select_array: return code : $?"; chomp(@result); return @result; } # MySQL Request Array sub select_array_with_headers { my $req = shift; debugprint "PERFORM: $req "; my @result = `$mysqlcmd $mysqllogin -Bre "\\w$req" 2>>/dev/null`; if ( $? != 0 ) { badprint "Failed to execute: $req"; badprint "FAIL Execute SQL / return code: $?"; debugprint "CMD : $mysqlcmd"; debugprint "OPTIONS: $mysqllogin"; debugprint `$mysqlcmd $mysqllogin -Bse "$req" 2>&1`; #exit $?; } debugprint "select_array_with_headers: return code : $?"; chomp(@result); return @result; } # MySQL Request Array sub select_csv_file { my $tfile = shift; my $req = shift; debugprint "PERFORM: $req CSV into $tfile"; #return; my @result = select_array_with_headers($req); open( my $fh, '>', $tfile ) or die "Could not open file '$tfile' $!"; for my $l (@result) { $l =~ s/\t/","/g; $l =~ s/^/"/; $l =~ s/$/"\n/; print $fh $l; print $l if $opt{debug}; } close $fh; infoprint "CSV file $tfile created"; } sub human_size { my ( $size, $n ) = ( shift, 0 ); ++$n and $size /= 1024 until $size < 1024; return sprintf "%.2f %s", $size, (qw[ bytes KB MB GB TB ])[$n]; } # MySQL Request one sub select_one { my $req = shift; debugprint "PERFORM: $req "; my $result = `$mysqlcmd $mysqllogin -Bse "\\w$req" 2>>/dev/null`; if ( $? != 0 ) { badprint "Failed to execute: $req"; badprint "FAIL Execute SQL / return code: $?"; debugprint "CMD : $mysqlcmd"; debugprint "OPTIONS: $mysqllogin"; debugprint `$mysqlcmd $mysqllogin -Bse "$req" 2>&1`; #exit $?; } debugprint "select_array: return code : $?"; chomp($result); return $result; } # MySQL Request one sub select_one_g { my $pattern = shift; my $req = shift; debugprint "PERFORM: $req "; my @result = `$mysqlcmd $mysqllogin -re "\\w$req\\G" 2>>/dev/null`; if ( $? != 0 ) { badprint "Failed to execute: $req"; badprint "FAIL Execute SQL / return code: $?"; debugprint "CMD : $mysqlcmd"; debugprint "OPTIONS: $mysqllogin"; debugprint `$mysqlcmd $mysqllogin -Bse "$req" 2>&1`; #exit $?; } debugprint "select_array: return code : $?"; chomp(@result); return ( grep { /$pattern/ } @result )[0]; } sub select_str_g { my $pattern = shift; my $req = shift; my $str = select_one_g $pattern, $req; return () unless defined $str; my @val = split /:/, $str; shift @val; return trim(@val); } sub select_user_dbs { return select_array( "SELECT DISTINCT TABLE_SCHEMA FROM information_schema.TABLES WHERE TABLE_SCHEMA NOT IN ('mysql', 'information_schema', 'performance_schema', 'percona', 'sys')" ); } sub select_tables_db { my $schema = shift; return select_array( "SELECT DISTINCT TABLE_NAME FROM information_schema.TABLES WHERE TABLE_SCHEMA='$schema'" ); } sub select_indexes_db { my $schema = shift; return select_array( "SELECT DISTINCT INDEX_NAME FROM information_schema.STATISTICS WHERE TABLE_SCHEMA='$schema'" ); } sub select_views_db { my $schema = shift; return select_array( "SELECT DISTINCT TABLE_NAME FROM information_schema.VIEWS WHERE TABLE_SCHEMA='$schema'" ); } sub select_triggers_db { my $schema = shift; return select_array( "SELECT DISTINCT TRIGGER_NAME FROM information_schema.TRIGGERS WHERE TRIGGER_SCHEMA='$schema'" ); } sub select_routines_db { my $schema = shift; return select_array( "SELECT DISTINCT ROUTINE_NAME FROM information_schema.ROUTINES WHERE ROUTINE_SCHEMA='$schema'" ); } sub select_table_indexes_db { my $schema = shift; my $tbname = shift; return select_array( "SELECT INDEX_NAME FROM information_schema.STATISTICS WHERE TABLE_SCHEMA='$schema' AND TABLE_NAME='$tbname'" ); } sub select_table_columns_db { my $schema = shift; my $table = shift; return select_array( "SELECT COLUMN_NAME FROM information_schema.COLUMNS WHERE TABLE_SCHEMA='$schema' AND TABLE_NAME='$table'" ); } sub get_tuning_info { my @infoconn = select_array "\\s"; my ( $tkey, $tval ); @infoconn = grep { !/Threads:/ and !/Connection id:/ and !/pager:/ and !/Using/ } @infoconn; foreach my $line (@infoconn) { if ( $line =~ /\s*(.*):\s*(.*)/ ) { debugprint "$1 => $2"; $tkey = $1; $tval = $2; chomp($tkey); chomp($tval); $result{'MySQL Client'}{$tkey} = $tval; } } $result{'MySQL Client'}{'Client Path'} = $mysqlcmd; $result{'MySQL Client'}{'Admin Path'} = $mysqladmincmd; $result{'MySQL Client'}{'Authentication Info'} = $mysqllogin; } # Populates all of the variable and status hashes my ( %mystat, %myvar, $dummyselect, %myrepl, %myslaves ); sub arr2hash { my $href = shift; my $harr = shift; my $sep = shift; my $key = ''; my $val = ''; $sep = '\s' unless defined($sep); foreach my $line (@$harr) { next if ( $line =~ m/^\*\*\*\*\*\*\*/ ); $line =~ /([a-zA-Z_]*)\s*$sep\s*(.*)/; $key = $1; $val = $2; $$href{$key} = $val; debugprint " * $key = $val" if $key =~ /$opt{dbgpattern}/i; } } sub get_all_vars { # We need to initiate at least one query so that our data is useable $dummyselect = select_one "SELECT VERSION()"; if ( not defined($dummyselect) or $dummyselect eq "" ) { badprint "You probably do not have enough privileges to run MySQLTuner ..."; exit(256); } $dummyselect =~ s/(.*?)\-.*/$1/; debugprint "VERSION: " . $dummyselect . ""; $result{'MySQL Client'}{'Version'} = $dummyselect; my @mysqlvarlist = select_array("SHOW VARIABLES"); push( @mysqlvarlist, select_array("SHOW GLOBAL VARIABLES") ); arr2hash( \%myvar, \@mysqlvarlist ); $result{'Variables'} = \%myvar; my @mysqlstatlist = select_array("SHOW STATUS"); push( @mysqlstatlist, select_array("SHOW GLOBAL STATUS") ); arr2hash( \%mystat, \@mysqlstatlist ); $result{'Status'} = \%mystat; unless ( defined( $myvar{'innodb_support_xa'} ) ) { $myvar{'innodb_support_xa'} = 'ON'; } $mystat{'Uptime'} = 1 unless defined( $mystat{'Uptime'} ) and $mystat{'Uptime'} > 0; $myvar{'have_galera'} = "NO"; if ( defined( $myvar{'wsrep_provider_options'} ) && $myvar{'wsrep_provider_options'} ne "" && $myvar{'wsrep_on'} ne "OFF" ) { $myvar{'have_galera'} = "YES"; debugprint "Galera options: " . $myvar{'wsrep_provider_options'}; } # Workaround for MySQL bug #59393 wrt. ignore-builtin-innodb if ( ( $myvar{'ignore_builtin_innodb'} || "" ) eq "ON" ) { $myvar{'have_innodb'} = "NO"; } # Support GTID MODE FOR MARIADB # Issue MariaDB GTID mode #513 $myvar{'gtid_mode'} = 'ON' if ( defined( $myvar{'gtid_current_pos'} ) and $myvar{'gtid_current_pos'} ne '' ); # Whether the server uses a thread pool to handle client connections # MariaDB: thread_handling = pool-of-threads # MySQL: thread_handling = loaded-dynamically $myvar{'have_threadpool'} = "NO"; if ( defined( $myvar{'thread_handling'} ) and ( $myvar{'thread_handling'} eq 'pool-of-threads' || $myvar{'thread_handling'} eq 'loaded-dynamically' ) ) { $myvar{'have_threadpool'} = "YES"; } # have_* for engines is deprecated and will be removed in MySQL 5.6; # check SHOW ENGINES and set corresponding old style variables. # Also works around MySQL bug #59393 wrt. skip-innodb my @mysqlenginelist = select_array "SHOW ENGINES"; foreach my $line (@mysqlenginelist) { if ( $line =~ /^([a-zA-Z_]+)\s+(\S+)/ ) { my $engine = lc($1); if ( $engine eq "federated" || $engine eq "blackhole" ) { $engine .= "_engine"; } elsif ( $engine eq "berkeleydb" ) { $engine = "bdb"; } my $val = ( $2 eq "DEFAULT" ) ? "YES" : $2; $myvar{"have_$engine"} = $val; $result{'Storage Engines'}{$engine} = $2; } } #debugprint Dumper(@mysqlenginelist); my @mysqlslave; if ( mysql_version_eq(8) or mysql_version_ge( 10, 5 ) ) { @mysqlslave = select_array("SHOW REPLICA STATUS\\G"); } else { @mysqlslave = select_array("SHOW SLAVE STATUS\\G"); } arr2hash( \%myrepl, \@mysqlslave, ':' ); $result{'Replication'}{'Status'} = \%myrepl; my @mysqlslaves; if ( mysql_version_eq(8) or mysql_version_ge( 10, 5 ) ) { @mysqlslaves = select_array "SHOW SLAVE STATUS"; } else { @mysqlslaves = select_array("SHOW SLAVE HOSTS\\G"); } my @lineitems = (); foreach my $line (@mysqlslaves) { debugprint "L: $line "; @lineitems = split /\s+/, $line; $myslaves{ $lineitems[0] } = $line; $result{'Replication'}{'Slaves'}{ $lineitems[0] } = $lineitems[4]; } } sub remove_cr { return map { my $line = $_; $line =~ s/\n$//g; $line =~ s/^\s+$//g; $line; } @_; } sub remove_empty { grep { $_ ne '' } @_; } sub grep_file_contents { my $file = shift; my $patt; } sub get_file_contents { my $file = shift; open( my $fh, "<", $file ) or die "Can't open $file for read: $!"; my @lines = <$fh>; close $fh or die "Cannot close $file: $!"; @lines = remove_cr @lines; return @lines; } sub get_basic_passwords { return get_file_contents(shift); } sub get_log_file_real_path { my $file = shift; my $hostname = shift; my $datadir = shift; if ( -f "$file" ) { return $file; } elsif ( -f "$hostname.log" ) { return "$hostname.log"; } elsif ( -f "$hostname.err" ) { return "$hostname.err"; } elsif ( -f "$datadir$hostname.err" ) { return "$datadir$hostname.err"; } elsif ( -f "$datadir$hostname.log" ) { return "$datadir$hostname.log"; } elsif ( -f "$datadir" . "mysql_error.log" ) { return "$datadir" . "mysql_error.log"; } elsif ( -f "/var/log/mysql.log" ) { return "/var/log/mysql.log"; } elsif ( -f "/var/log/mysqld.log" ) { return "/var/log/mysqld.log"; } elsif ( -f "/var/log/mysql/$hostname.err" ) { return "/var/log/mysql/$hostname.err"; } elsif ( -f "/var/log/mysql/$hostname.log" ) { return "/var/log/mysql/$hostname.log"; } elsif ( -f "/var/log/mysql/" . "mysql_error.log" ) { return "/var/log/mysql/" . "mysql_error.log"; } else { return $file; } } sub log_file_recommendations { if ( is_remote eq 1 ) { infoprint "Skipping error log files checks on remote host"; return; } my $fh; $myvar{'log_error'} = $opt{'server-log'} || get_log_file_real_path( $myvar{'log_error'}, $myvar{'hostname'}, $myvar{'datadir'} ); subheaderprint "Log file Recommendations"; if ( "$myvar{'log_error'}" eq "stderr" ) { badprint "log_error is set to $myvar{'log_error'}, but this script can't read stderr"; return; } elsif ( $myvar{'log_error'} =~ /^(docker|podman|kubectl):(.*)/ ) { open( $fh, '-|', "$1 logs --tail=$maxlines '$2'" ) // die "Can't start $1 $!"; goodprint "Log from cloud` $myvar{'log_error'} exists"; } elsif ( $myvar{'log_error'} =~ /^systemd:(.*)/ ) { open( $fh, '-|', "journalctl -n $maxlines -b -u '$1'" ) // die "Can't start journalctl $!"; goodprint "Log journal` $myvar{'log_error'} exists"; } elsif ( -f "$myvar{'log_error'}" ) { goodprint "Log file $myvar{'log_error'} exists"; my $size = ( stat $myvar{'log_error'} )[7]; infoprint "Log file: " . $myvar{'log_error'} . " (" . hr_bytes_rnd($size) . ")"; if ( $size > 0 ) { goodprint "Log file $myvar{'log_error'} is not empty"; if ( $size < 32 * 1024 * 1024 ) { goodprint "Log file $myvar{'log_error'} is smaller than 32 MB"; } else { badprint "Log file $myvar{'log_error'} is bigger than 32 MB"; push @generalrec, $myvar{'log_error'} . " is > 32MB, you should analyze why or implement a rotation log strategy such as logrotate!"; } } else { infoprint "Log file $myvar{'log_error'} is empty. Assuming log-rotation. Use --server-log={file} for explicit file"; return; } if ( !open( $fh, '<', $myvar{'log_error'} ) ) { badprint "Log file $myvar{'log_error'} isn't readable."; return; } goodprint "Log file $myvar{'log_error'} is readable."; if ( $maxlines * 80 < $size ) { seek( $fh, -$maxlines * 80, 2 ); <$fh>; # discard line fragment } } else { badprint "Log file $myvar{'log_error'} doesn't exist"; return; } my $numLi = 0; my $nbWarnLog = 0; my $nbErrLog = 0; my @lastShutdowns; my @lastStarts; while ( my $logLi = <$fh> ) { chomp $logLi; $numLi++; debugprint "$numLi: $logLi" if $logLi =~ /warning|error/i and $logLi !~ /Logging to/; $nbErrLog++ if $logLi =~ /error/i and $logLi !~ /(Logging to|\[Warning\].*ERROR_FOR_DIVISION_BY_ZERO)/; $nbWarnLog++ if $logLi =~ /warning/i; push @lastShutdowns, $logLi if $logLi =~ /Shutdown complete/ and $logLi !~ /Innodb/i; push @lastStarts, $logLi if $logLi =~ /ready for connections/; } close $fh; if ( $nbWarnLog > 0 ) { badprint "$myvar{'log_error'} contains $nbWarnLog warning(s)."; push @generalrec, "Check warning line(s) in $myvar{'log_error'} file"; } else { goodprint "$myvar{'log_error'} doesn't contain any warning."; } if ( $nbErrLog > 0 ) { badprint "$myvar{'log_error'} contains $nbErrLog error(s)."; push @generalrec, "Check error line(s) in $myvar{'log_error'} file"; } else { goodprint "$myvar{'log_error'} doesn't contain any error."; } infoprint scalar @lastStarts . " start(s) detected in $myvar{'log_error'}"; my $nStart = 0; my $nEnd = 10; if ( scalar @lastStarts < $nEnd ) { $nEnd = scalar @lastStarts; } for my $startd ( reverse @lastStarts[ -$nEnd .. -1 ] ) { $nStart++; infoprint "$nStart) $startd"; } infoprint scalar @lastShutdowns . " shutdown(s) detected in $myvar{'log_error'}"; $nStart = 0; $nEnd = 10; if ( scalar @lastShutdowns < $nEnd ) { $nEnd = scalar @lastShutdowns; } for my $shutd ( reverse @lastShutdowns[ -$nEnd .. -1 ] ) { $nStart++; infoprint "$nStart) $shutd"; } #exit 0; } sub cve_recommendations { subheaderprint "CVE Security Recommendations"; unless ( defined( $opt{cvefile} ) && -f "$opt{cvefile}" ) { infoprint "Skipped due to --cvefile option undefined"; return; } #$mysqlvermajor=10; #$mysqlverminor=1; #$mysqlvermicro=17; #prettyprint "Look for related CVE for $myvar{'version'} or lower in $opt{cvefile}"; my $cvefound = 0; open( my $fh, "<", $opt{cvefile} ) or die "Can't open $opt{cvefile} for read: $!"; while ( my $cveline = <$fh> ) { my @cve = split( ';', $cveline ); debugprint "Comparing $mysqlvermajor\.$mysqlverminor\.$mysqlvermicro with $cve[1]\.$cve[2]\.$cve[3] : " . ( mysql_version_le( $cve[1], $cve[2], $cve[3] ) ? '<=' : '>' ); # Avoid not major/minor version corresponding CVEs next unless ( int( $cve[1] ) == $mysqlvermajor && int( $cve[2] ) == $mysqlverminor ); if ( int( $cve[3] ) >= $mysqlvermicro ) { badprint "$cve[4](<= $cve[1]\.$cve[2]\.$cve[3]) : $cve[6]"; $result{'CVE'}{'List'}{$cvefound} = "$cve[4](<= $cve[1]\.$cve[2]\.$cve[3]) : $cve[6]"; $cvefound++; } } close $fh or die "Cannot close $opt{cvefile}: $!"; $result{'CVE'}{'nb'} = $cvefound; my $cve_warning_notes = ""; if ( $cvefound == 0 ) { goodprint "NO SECURITY CVE FOUND FOR YOUR VERSION"; return; } if ( $mysqlvermajor eq 5 and $mysqlverminor eq 5 ) { infoprint "False positive CVE(s) for MySQL and MariaDB 5.5.x can be found."; infoprint "Check carefully each CVE for those particular versions"; } badprint $cvefound . " CVE(s) found for your MySQL release."; push( @generalrec, $cvefound . " CVE(s) found for your MySQL release. Consider upgrading your version !" ); } sub get_opened_ports { my @opened_ports = `netstat -ltn`; @opened_ports = map { my $v = $_; $v =~ s/.*:(\d+)\s.*$/$1/; $v =~ s/\D//g; $v; } @opened_ports; @opened_ports = sort { $a <=> $b } grep { !/^$/ } @opened_ports; #debugprint Dumper \@opened_ports; $result{'Network'}{'TCP Opened'} = \@opened_ports; return @opened_ports; } sub is_open_port { my $port = shift; if ( grep { /^$port$/ } get_opened_ports ) { return 1; } return 0; } sub get_process_memory { my $pid = shift; my @mem = `ps -p $pid -o rss`; return 0 if scalar @mem != 2; return $mem[1] * 1024; } sub get_other_process_memory { return 0 if ( $opt{tbstat} == 0 ); my @procs = `ps eaxo pid,command`; @procs = map { my $v = $_; $v =~ s/.*PID.*//; $v =~ s/.*mysqld.*//; $v =~ s/.*\[.*\].*//; $v =~ s/^\s+$//g; $v =~ s/.*PID.*CMD.*//; $v =~ s/.*systemd.*//; $v =~ s/\s*?(\d+)\s*.*/$1/g; $v; } @procs; @procs = remove_cr @procs; @procs = remove_empty @procs; my $totalMemOther = 0; map { $totalMemOther += get_process_memory($_); } @procs; return $totalMemOther; } sub get_os_release { if ( -f "/etc/lsb-release" ) { my @info_release = get_file_contents "/etc/lsb-release"; my $os_release = $info_release[3]; $os_release =~ s/.*="//; $os_release =~ s/"$//; return $os_release; } if ( -f "/etc/system-release" ) { my @info_release = get_file_contents "/etc/system-release"; return $info_release[0]; } if ( -f "/etc/os-release" ) { my @info_release = get_file_contents "/etc/os-release"; my $os_release = $info_release[0]; $os_release =~ s/.*="//; $os_release =~ s/"$//; return $os_release; } if ( -f "/etc/issue" ) { my @info_release = get_file_contents "/etc/issue"; my $os_release = $info_release[0]; $os_release =~ s/\s+\\n.*//; return $os_release; } return "Unknown OS release"; } sub get_fs_info { my @sinfo = `df -P | grep '%'`; my @iinfo = `df -Pi| grep '%'`; shift @sinfo; shift @iinfo; foreach my $info (@sinfo) { #exit(0); if ( $info =~ /.*?(\d+)\s+(\d+)\s+(\d+)\s+(\d+)%\s+(.*)$/ ) { next if $5 =~ m{(run|dev|sys|proc|snap|init)}; if ( $4 > 85 ) { badprint "mount point $5 is using $4 % total space (" . human_size( $2 * 1024 ) . " / " . human_size( $1 * 1024 ) . ")"; push( @generalrec, "Add some space to $4 mountpoint." ); } else { infoprint "mount point $5 is using $4 % total space (" . human_size( $2 * 1024 ) . " / " . human_size( $1 * 1024 ) . ")"; } $result{'Filesystem'}{'Space Pct'}{$5} = $4; $result{'Filesystem'}{'Used Space'}{$5} = $2; $result{'Filesystem'}{'Free Space'}{$5} = $3; $result{'Filesystem'}{'Total Space'}{$5} = $1; } } @iinfo = map { my $v = $_; $v =~ s/.*\s(\d+)%\s+(.*)/$1\t$2/g; $v; } @iinfo; foreach my $info (@iinfo) { next if $info =~ m{(\d+)\t/(run|dev|sys|proc|snap)($|/)}; if ( $info =~ /(\d+)\t(.*)/ ) { if ( $1 > 85 ) { badprint "mount point $2 is using $1 % of max allowed inodes"; push( @generalrec, "Cleanup files from $2 mountpoint or reformat your filesystem." ); } else { infoprint "mount point $2 is using $1 % of max allowed inodes"; } $result{'Filesystem'}{'Inode Pct'}{$2} = $1; } } } sub merge_hash { my $h1 = shift; my $h2 = shift; my %result = {}; foreach my $substanceref ( $h1, $h2 ) { while ( my ( $k, $v ) = each %$substanceref ) { next if ( exists $result{$k} ); $result{$k} = $v; } } return \%result; } sub is_virtual_machine { if ( $^O eq 'linux' ) { my $isVm = `grep -Ec '^flags.*\ hypervisor\ ' /proc/cpuinfo`; return ( $isVm == 0 ? 0 : 1 ); } if ( $^O eq 'freebsd' ) { my $isVm = `sysctl -n kern.vm_guest`; chomp $isVm; print "FARK DEBUG isVm=[$isVm]"; return ( $isVm eq 'none' ? 0 : 1 ); } return 0; } sub infocmd { my $cmd = "@_"; debugprint "CMD: $cmd"; my @result = `$cmd`; @result = remove_cr @result; for my $l (@result) { infoprint "$l"; } } sub infocmd_tab { my $cmd = "@_"; debugprint "CMD: $cmd"; my @result = `$cmd`; @result = remove_cr @result; for my $l (@result) { infoprint "\t$l"; } } sub infocmd_one { my $cmd = "@_"; my @result = `$cmd 2>&1`; @result = remove_cr @result; return join ', ', @result; } sub get_kernel_info { my @params = ( 'fs.aio-max-nr', 'fs.aio-nr', 'fs.nr_open', 'fs.file-max', 'sunrpc.tcp_fin_timeout', 'sunrpc.tcp_max_slot_table_entries', 'sunrpc.tcp_slot_table_entries', 'vm.swappiness' ); infoprint "Information about kernel tuning:"; foreach my $param (@params) { infocmd_tab("sysctl $param 2>/dev/null"); $result{'OS'}{'Config'}{$param} = `sysctl -n $param 2>/dev/null`; } if ( `sysctl -n vm.swappiness` > 10 ) { badprint "Swappiness is > 10, please consider having a value lower than 10"; push @generalrec, "setup swappiness lower or equal to 10"; push @adjvars, 'vm.swappiness <= 10 (echo 10 > /proc/sys/vm/swappiness) or vm.swappiness=10 in /etc/sysctl.conf'; } else { infoprint "Swappiness is < 10."; } # only if /proc/sys/sunrpc exists my $tcp_slot_entries = `sysctl -n sunrpc.tcp_slot_table_entries 2>/dev/null`; if ( -f "/proc/sys/sunrpc" and ( $tcp_slot_entries eq '' or $tcp_slot_entries < 100 ) ) { badprint "Initial TCP slot entries is < 1M, please consider having a value greater than 100"; push @generalrec, "setup Initial TCP slot entries greater than 100"; push @adjvars, 'sunrpc.tcp_slot_table_entries > 100 (echo 128 > /proc/sys/sunrpc/tcp_slot_table_entries) or sunrpc.tcp_slot_table_entries=128 in /etc/sysctl.conf'; } else { infoprint "TCP slot entries is > 100."; } if ( -f "/proc/sys/fs/aio-max-nr" ) { if ( `sysctl -n fs.aio-max-nr` < 1000000 ) { badprint "Max running total of the number of max. events is < 1M, please consider having a value greater than 1M"; push @generalrec, "setup Max running number events greater than 1M"; push @adjvars, 'fs.aio-max-nr > 1M (echo 1048576 > /proc/sys/fs/aio-max-nr) or fs.aio-max-nr=1048576 in /etc/sysctl.conf'; } else { infoprint "Max Number of AIO events is > 1M."; } } if ( -f "/proc/sys/fs/nr_open" ) { if ( `sysctl -n fs.nr_open` < 1000000 ) { badprint "Max running total of the number of file open request is < 1M, please consider having a value greater than 1M"; push @generalrec, "setup running number of open request greater than 1M"; push @adjvars, 'fs.aio-nr > 1M (echo 1048576 > /proc/sys/fs/nr_open) or fs.nr_open=1048576 in /etc/sysctl.conf'; } else { infoprint "Max Number of open file requests is > 1M."; } } } sub get_system_info { $result{'OS'}{'Release'} = get_os_release(); infoprint get_os_release; if (is_virtual_machine) { infoprint "Machine type : Virtual machine"; $result{'OS'}{'Virtual Machine'} = 'YES'; } else { infoprint "Machine type : Physical machine"; $result{'OS'}{'Virtual Machine'} = 'NO'; } $result{'Network'}{'Connected'} = 'NO'; `ping -c 1 ipecho.net &>/dev/null`; my $isConnected = $?; if ( $? == 0 ) { infoprint "Internet : Connected"; $result{'Network'}{'Connected'} = 'YES'; } else { badprint "Internet : Disconnected"; } $result{'OS'}{'NbCore'} = cpu_cores; infoprint "Number of Core CPU : " . cpu_cores; $result{'OS'}{'Type'} = `uname -o`; infoprint "Operating System Type : " . infocmd_one "uname -o"; $result{'OS'}{'Kernel'} = `uname -r`; infoprint "Kernel Release : " . infocmd_one "uname -r"; $result{'OS'}{'Hostname'} = `hostname`; $result{'Network'}{'Internal Ip'} = `hostname -I`; infoprint "Hostname : " . infocmd_one "hostname"; infoprint "Network Cards : "; infocmd_tab "ifconfig| grep -A1 mtu"; infoprint "Internal IP : " . infocmd_one "hostname -I"; $result{'Network'}{'Internal Ip'} = `ifconfig| grep -A1 mtu`; my $httpcli = get_http_cli(); infoprint "HTTP client found: $httpcli" if defined $httpcli; my $ext_ip = ""; if ( $httpcli =~ /curl$/ ) { $ext_ip = infocmd_one "$httpcli -m 3 ipecho.net/plain"; } elsif ( $httpcli =~ /wget$/ ) { $ext_ip = infocmd_one "$httpcli -t 1 -T 3 -q -O - ipecho.net/plain"; } infoprint "External IP : " . $ext_ip; $result{'Network'}{'External Ip'} = $ext_ip; badprint "External IP : Can't check, no Internet connectivity" unless defined($httpcli); infoprint "Name Servers : " . infocmd_one "grep 'nameserver' /etc/resolv.conf \| awk '{print \$2}'"; infoprint "Logged In users : "; infocmd_tab "who"; $result{'OS'}{'Logged users'} = `who`; infoprint "Ram Usages in MB : "; infocmd_tab "free -m | grep -v +"; $result{'OS'}{'Free Memory RAM'} = `free -m | grep -v +`; infoprint "Load Average : "; infocmd_tab "top -n 1 -b | grep 'load average:'"; $result{'OS'}{'Load Average'} = `top -n 1 -b | grep 'load average:'`; infoprint "System Uptime : "; infocmd_tab "uptime"; $result{'OS'}{'Uptime'} = `uptime`; } sub system_recommendations { if ( is_remote eq 1 ) { infoprint "Skipping system checks on remote host"; return; } return if ( $opt{sysstat} == 0 ); subheaderprint "System Linux Recommendations"; my $os = `uname`; unless ( $os =~ /Linux/i ) { infoprint "Skipped due to non Linux server"; return; } prettyprint "Look for related Linux system recommendations"; #prettyprint '-'x78; get_system_info(); my $nb_cpus = cpu_cores; if ( $nb_cpus > 1 ) { goodprint "There is at least one CPU dedicated to database server."; } else { badprint "There is only one CPU, consider dedicated one CPU for your database server"; push @generalrec, "Consider increasing number of CPU for your database server"; } if ( $physical_memory >= 1.5 * 1024 ) { goodprint "There is at least 1 Gb of RAM dedicated to Linux server."; } else { badprint "There is less than 1,5 Gb of RAM, consider dedicated 1 Gb for your Linux server"; push @generalrec, "Consider increasing 1,5 / 2 Gb of RAM for your Linux server"; } my $omem = get_other_process_memory; infoprint "User process except mysqld used " . hr_bytes_rnd($omem) . " RAM."; if ( ( 0.15 * $physical_memory ) < $omem ) { badprint "Other user process except mysqld used more than 15% of total physical memory " . percentage( $omem, $physical_memory ) . "% (" . hr_bytes_rnd($omem) . " / " . hr_bytes_rnd($physical_memory) . ")"; push( @generalrec, "Consider stopping or dedicate server for additional process other than mysqld." ); push( @adjvars, "DON'T APPLY SETTINGS BECAUSE THERE ARE TOO MANY PROCESSES RUNNING ON THIS SERVER. OOM KILL CAN OCCUR!" ); } else { infoprint "Other user process except mysqld used less than 15% of total physical memory " . percentage( $omem, $physical_memory ) . "% (" . hr_bytes_rnd($omem) . " / " . hr_bytes_rnd($physical_memory) . ")"; } if ( $opt{'maxportallowed'} > 0 ) { my @opened_ports = get_opened_ports; infoprint "There is " . scalar @opened_ports . " listening port(s) on this server."; if ( scalar(@opened_ports) > $opt{'maxportallowed'} ) { badprint "There are too many listening ports: " . scalar(@opened_ports) . " opened > " . $opt{'maxportallowed'} . "allowed."; push( @generalrec, "Consider dedicating a server for your database installation with fewer services running on it!" ); } else { goodprint "There are less than " . $opt{'maxportallowed'} . " opened ports on this server."; } } foreach my $banport (@banned_ports) { if ( is_open_port($banport) ) { badprint "Banned port: $banport is opened.."; push( @generalrec, "Port $banport is opened. Consider stopping the program over this port." ); } else { goodprint "$banport is not opened."; } } subheaderprint "Filesystem Linux Recommendations"; get_fs_info; subheaderprint "Kernel Information Recommendations"; get_kernel_info; } sub security_recommendations { subheaderprint "Security Recommendations"; if ( mysql_version_eq(8) ) { infoprint "Skipped due to unsupported feature for MySQL 8.0+"; return; } #exit 0; if ( $opt{skippassword} eq 1 ) { infoprint "Skipped due to --skippassword option"; return; } my $PASS_COLUMN_NAME = 'password'; # New table schema available since mysql-5.7 and mariadb-10.2 # But need to be checked if ( $myvar{'version'} =~ /5\.7|10\.[2-5]\..*MariaDB*/ ) { my $password_column_exists = `$mysqlcmd $mysqllogin -Bse "SELECT 1 FROM information_schema.columns WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user' AND COLUMN_NAME = 'password'" 2>>/dev/null`; my $authstring_column_exists = `$mysqlcmd $mysqllogin -Bse "SELECT 1 FROM information_schema.columns WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user' AND COLUMN_NAME = 'authentication_string'" 2>>/dev/null`; if ( $password_column_exists && $authstring_column_exists ) { $PASS_COLUMN_NAME = "IF(plugin='mysql_native_password', authentication_string, password)"; } elsif ($authstring_column_exists) { $PASS_COLUMN_NAME = 'authentication_string'; } elsif ( !$password_column_exists ) { infoprint "Skipped due to none of known auth columns exists"; return; } } debugprint "Password column = $PASS_COLUMN_NAME"; # IS THERE A ROLE COLUMN my $is_role_column = select_one "select count(*) from information_schema.columns where TABLE_NAME='user' AND TABLE_SCHEMA='mysql' and COLUMN_NAME='IS_ROLE'"; my $extra_user_condition = ""; $extra_user_condition = "IS_ROLE = 'N' AND" if $is_role_column > 0; my @mysqlstatlist; if ( $is_role_column > 0 ) { @mysqlstatlist = select_array "SELECT CONCAT(QUOTE(user), '\@', QUOTE(host)) FROM mysql.user WHERE IS_ROLE='Y'"; foreach my $line ( sort @mysqlstatlist ) { chomp($line); infoprint "User $line is User Role"; } } else { debugprint "No Role user detected"; goodprint "No Role user detected"; } # Looking for Anonymous users @mysqlstatlist = select_array "SELECT CONCAT(QUOTE(user), '\@', QUOTE(host)) FROM mysql.user WHERE $extra_user_condition (TRIM(USER) = '' OR USER IS NULL)"; #debugprint Dumper \@mysqlstatlist; #exit 0; if (@mysqlstatlist) { push( @generalrec, "Remove Anonymous User accounts: there are " . scalar(@mysqlstatlist) . " anonymous accounts." ); foreach my $line ( sort @mysqlstatlist ) { chomp($line); badprint "User " . $line . " is an anonymous account. Remove with DROP USER " . $line . ";"; } } else { goodprint "There are no anonymous accounts for any database users"; } if ( mysql_version_le( 5, 1 ) ) { badprint "No more password checks for MySQL version <=5.1"; badprint "MySQL version <=5.1 is deprecated and end of support."; return; } # Looking for Empty Password if ( mysql_version_ge( 10, 4 ) ) { @mysqlstatlist = select_array q{SELECT CONCAT(QUOTE(user), '@', QUOTE(host)) FROM mysql.global_priv WHERE ( user != '' AND JSON_CONTAINS(Priv, '"mysql_native_password"', '$.plugin') AND JSON_CONTAINS(Priv, '""', '$.authentication_string') AND NOT JSON_CONTAINS(Priv, 'true', '$.account_locked') )}; } else { @mysqlstatlist = select_array "SELECT CONCAT(QUOTE(user), '\@', QUOTE(host)) FROM mysql.user WHERE ($PASS_COLUMN_NAME = '' OR $PASS_COLUMN_NAME IS NULL) AND user != '' /*!50501 AND plugin NOT IN ('auth_socket', 'unix_socket', 'win_socket', 'auth_pam_compat') */ /*!80000 AND account_locked = 'N' AND password_expired = 'N' */"; } if (@mysqlstatlist) { foreach my $line ( sort @mysqlstatlist ) { chomp($line); badprint "User '" . $line . "' has no password set."; push( @generalrec, "Set up a Secure Password for $line user: SET PASSWORD FOR $line = PASSWORD('secure_password');" ); } } else { goodprint "All database users have passwords assigned"; } if ( mysql_version_ge( 5, 7 ) ) { my $valPlugin = select_one( "select count(*) from information_schema.plugins where PLUGIN_NAME='validate_password' AND PLUGIN_STATUS='ACTIVE'" ); if ( $valPlugin >= 1 ) { infoprint "Bug #80860 MySQL 5.7: Avoid testing password when validate_password is activated"; return; } } # Looking for User with user/ uppercase /capitalise user as password @mysqlstatlist = select_array "SELECT CONCAT(QUOTE(user), '\@', QUOTE(host)) FROM mysql.user WHERE user != '' AND (CAST($PASS_COLUMN_NAME as Binary) = PASSWORD(user) OR CAST($PASS_COLUMN_NAME as Binary) = PASSWORD(UPPER(user)) OR CAST($PASS_COLUMN_NAME as Binary) = PASSWORD(CONCAT(UPPER(LEFT(User, 1)), SUBSTRING(User, 2, LENGTH(User)))))"; if (@mysqlstatlist) { foreach my $line ( sort @mysqlstatlist ) { chomp($line); badprint "User " . $line . " has user name as password."; push( @generalrec, "Set up a Secure Password for $line user: SET PASSWORD FOR $line = PASSWORD('secure_password');" ); } } @mysqlstatlist = select_array "SELECT CONCAT(QUOTE(user), '\@', host) FROM mysql.user WHERE HOST='%'"; if (@mysqlstatlist) { foreach my $line ( sort @mysqlstatlist ) { chomp($line); my $luser = ( split /@/, $line )[0]; badprint "User " . $line . " does not specify hostname restrictions."; push( @generalrec, "Restrict Host for $luser\@'%' to $luser\@LimitedIPRangeOrLocalhost" ); push( @generalrec, "RENAME USER $luser\@'%' TO " . $luser . "\@LimitedIPRangeOrLocalhost;" ); } } unless ( -f $basic_password_files ) { badprint "There is no basic password file list!"; return; } my @passwords = get_basic_passwords $basic_password_files; infoprint "There are " . scalar(@passwords) . " basic passwords in the list."; my $nbins = 0; my $passreq; if (@passwords) { my $nbInterPass = 0; foreach my $pass (@passwords) { $nbInterPass++; $pass =~ s/\s//g; $pass =~ s/\'/\\\'/g; chomp($pass); # Looking for User with user/ uppercase /capitalise weak password @mysqlstatlist = select_array "SELECT CONCAT(user, '\@', host) FROM mysql.user WHERE $PASS_COLUMN_NAME = PASSWORD('" . $pass . "') OR $PASS_COLUMN_NAME = PASSWORD(UPPER('" . $pass . "')) OR $PASS_COLUMN_NAME = PASSWORD(CONCAT(UPPER(LEFT('" . $pass . "', 1)), SUBSTRING('" . $pass . "', 2, LENGTH('" . $pass . "'))))"; debugprint "There are " . scalar(@mysqlstatlist) . " items."; if (@mysqlstatlist) { foreach my $line (@mysqlstatlist) { chomp($line); badprint "User '" . $line . "' is using weak password: $pass in a lower, upper or capitalize derivative version."; push( @generalrec, "Set up a Secure Password for $line user: SET PASSWORD FOR '" . ( split /@/, $line )[0] . "'\@'" . ( split /@/, $line )[1] . "' = PASSWORD('secure_password');" ); $nbins++; } } debugprint "$nbInterPass / " . scalar(@passwords) if ( $nbInterPass % 1000 == 0 ); } } if ( $nbins > 0 ) { push( @generalrec, $nbins . " user(s) used basic or weak password from basic dictionary." ); } } sub get_replication_status { subheaderprint "Replication Metrics"; infoprint "Galera Synchronous replication: " . $myvar{'have_galera'}; if ( scalar( keys %myslaves ) == 0 ) { infoprint "No replication slave(s) for this server."; } else { infoprint "This server is acting as master for " . scalar( keys %myslaves ) . " server(s)."; } infoprint "Binlog format: " . $myvar{'binlog_format'}; infoprint "XA support enabled: " . $myvar{'innodb_support_xa'}; infoprint "Semi synchronous replication Master: " . ( ( defined( $myvar{'rpl_semi_sync_master_enabled'} ) or defined( $myvar{'rpl_semi_sync_source_enabled'} ) ) ? ( $myvar{'rpl_semi_sync_master_enabled'} // $myvar{'rpl_semi_sync_source_enabled'} ) : 'Not Activated' ); infoprint "Semi synchronous replication Slave: " . ( ( defined( $myvar{'rpl_semi_sync_slave_enabled'} ) or defined( $myvar{'rpl_semi_sync_replica_enabled'} ) ) ? ( $myvar{'rpl_semi_sync_slave_enabled'} // $myvar{'rpl_semi_sync_replica_enabled'} ) : 'Not Activated' ); if ( scalar( keys %myrepl ) == 0 and scalar( keys %myslaves ) == 0 ) { infoprint "This is a standalone server"; return; } if ( scalar( keys %myrepl ) == 0 ) { infoprint "No replication setup for this server or replication not started."; return; } $result{'Replication'}{'status'} = \%myrepl; my ($io_running) = $myrepl{'Slave_IO_Running'} // $myrepl{'Replica_IO_Running'}; debugprint "IO RUNNING: $io_running "; my ($sql_running) = $myrepl{'Slave_SQL_Running'} // $myrepl{'Replica_SQL_Running'}; debugprint "SQL RUNNING: $sql_running "; my ($seconds_behind_master) = $myrepl{'Seconds_Behind_Master'} // $myrepl{'Seconds_Behind_Source'}; $seconds_behind_master = 1000000 unless defined($seconds_behind_master); debugprint "SECONDS : $seconds_behind_master "; if ( defined($io_running) and ( $io_running !~ /yes/i or $sql_running !~ /yes/i ) ) { badprint "This replication slave is not running but seems to be configured."; } if ( defined($io_running) && $io_running =~ /yes/i && $sql_running =~ /yes/i ) { if ( $myvar{'read_only'} eq 'OFF' ) { badprint "This replication slave is running with the read_only option disabled."; } else { goodprint "This replication slave is running with the read_only option enabled."; } if ( $seconds_behind_master > 0 ) { badprint "This replication slave is lagging and slave has $seconds_behind_master second(s) behind master host."; } else { goodprint "This replication slave is up to date with master."; } } } # https://endoflife.software/applications/databases/mysql # https://endoflife.date/mariadb sub validate_mysql_version { ( $mysqlvermajor, $mysqlverminor, $mysqlvermicro ) = $myvar{'version'} =~ /^(\d+)(?:\.(\d+)|)(?:\.(\d+)|)/; $mysqlverminor ||= 0; $mysqlvermicro ||= 0; prettyprint " "; if ( mysql_version_eq(8) or mysql_version_eq( 5, 7 ) or mysql_version_eq( 10, 3 ) or mysql_version_eq( 10, 4 ) or mysql_version_eq( 10, 5 ) or mysql_version_eq( 10, 6 ) or mysql_version_eq( 10, 7 ) or mysql_version_eq( 10, 8 ) or mysql_version_eq( 10, 9 ) or mysql_version_eq( 10, 10 ) or mysql_version_eq( 10, 11 ) ) { goodprint "Currently running supported MySQL version " . $myvar{'version'} . ""; return; } else { badprint "Your MySQL version " . $myvar{'version'} . " is EOL software. Upgrade soon!"; push( @generalrec, "You are using an unsupported version for production environments" ); push( @generalrec, "Upgrade as soon as possible to a supported version !" ); } } # Checks if MySQL version is equal to (major, minor, micro) sub mysql_version_eq { my ( $maj, $min, $mic ) = @_; my ( $mysqlvermajor, $mysqlverminor, $mysqlvermicro ) = $myvar{'version'} =~ /^(\d+)(?:\.(\d+)|)(?:\.(\d+)|)/; return int($mysqlvermajor) == int($maj) if ( !defined($min) && !defined($mic) ); return int($mysqlvermajor) == int($maj) && int($mysqlverminor) == int($min) if ( !defined($mic) ); return ( int($mysqlvermajor) == int($maj) && int($mysqlverminor) == int($min) && int($mysqlvermicro) == int($mic) ); } # Checks if MySQL version is greater than equal to (major, minor, micro) sub mysql_version_ge { my ( $maj, $min, $mic ) = @_; $min ||= 0; $mic ||= 0; my ( $mysqlvermajor, $mysqlverminor, $mysqlvermicro ) = $myvar{'version'} =~ /^(\d+)(?:\.(\d+)|)(?:\.(\d+)|)/; return int($mysqlvermajor) > int($maj) || ( int($mysqlvermajor) == int($maj) && int($mysqlverminor) > int($min) ) || ( int($mysqlvermajor) == int($maj) && int($mysqlverminor) == int($min) && int($mysqlvermicro) >= int($mic) ); } # Checks if MySQL version is lower than equal to (major, minor, micro) sub mysql_version_le { my ( $maj, $min, $mic ) = @_; $min ||= 0; $mic ||= 0; my ( $mysqlvermajor, $mysqlverminor, $mysqlvermicro ) = $myvar{'version'} =~ /^(\d+)(?:\.(\d+)|)(?:\.(\d+)|)/; return int($mysqlvermajor) < int($maj) || ( int($mysqlvermajor) == int($maj) && int($mysqlverminor) < int($min) ) || ( int($mysqlvermajor) == int($maj) && int($mysqlverminor) == int($min) && int($mysqlvermicro) <= int($mic) ); } # Checks for 32-bit boxes with more than 2GB of RAM my ($arch); sub check_architecture { if ( is_remote eq 1 ) { infoprint "Skipping architecture check on remote host"; infoprint "Using default $opt{defaultarch} bits as target architecture"; $arch = $opt{defaultarch}; return; } if ( `uname` =~ /SunOS/ && `isainfo -b` =~ /64/ ) { $arch = 64; goodprint "Operating on 64-bit architecture"; } elsif ( `uname` !~ /SunOS/ && `uname -m` =~ /(64|s390x)/ ) { $arch = 64; goodprint "Operating on 64-bit architecture"; } elsif ( `uname` =~ /AIX/ && `bootinfo -K` =~ /64/ ) { $arch = 64; goodprint "Operating on 64-bit architecture"; } elsif ( `uname` =~ /NetBSD|OpenBSD/ && `sysctl -b hw.machine` =~ /64/ ) { $arch = 64; goodprint "Operating on 64-bit architecture"; } elsif ( `uname` =~ /FreeBSD/ && `sysctl -b hw.machine_arch` =~ /64/ ) { $arch = 64; goodprint "Operating on 64-bit architecture"; } elsif ( `uname` =~ /Darwin/ && `uname -m` =~ /Power Macintosh/ ) { # Darwin box.local 9.8.0 Darwin Kernel Version 9.8.0: Wed Jul 15 16:57:01 PDT 2009; root:xnu1228.15.4~1/RELEASE_PPC Power Macintosh $arch = 64; goodprint "Operating on 64-bit architecture"; } elsif ( `uname` =~ /Darwin/ && `uname -m` =~ /x86_64/ ) { # Darwin gibas.local 12.5.2 Darwin Kernel Version 12.3.0: Sun Jan 6 22:37:10 PST 2013; root:xnu-2050.22.13~1/RELEASE_X86_64 x86_64 $arch = 64; goodprint "Operating on 64-bit architecture"; } else { $arch = 32; if ( $physical_memory > 2147483648 ) { badprint "Switch to 64-bit OS - MySQL cannot currently use all of your RAM"; } else { goodprint "Operating on 32-bit architecture with less than 2GB RAM"; } } $result{'OS'}{'Architecture'} = "$arch bits"; } # Start up a ton of storage engine counts/statistics my ( %enginestats, %enginecount, $fragtables ); sub check_storage_engines { subheaderprint "Storage Engine Statistics"; if ( $opt{skipsize} eq 1 ) { infoprint "Skipped due to --skipsize option"; return; } my $engines; if ( mysql_version_ge( 5, 5 ) ) { my @engineresults = select_array "SELECT ENGINE,SUPPORT FROM information_schema.ENGINES ORDER BY ENGINE ASC"; foreach my $line (@engineresults) { my ( $engine, $engineenabled ); ( $engine, $engineenabled ) = $line =~ /([a-zA-Z_]*)\s+([a-zA-Z]+)/; $result{'Engine'}{$engine}{'Enabled'} = $engineenabled; $engines .= ( $engineenabled eq "YES" || $engineenabled eq "DEFAULT" ) ? greenwrap "+" . $engine . " " : redwrap "-" . $engine . " "; } } elsif ( mysql_version_ge( 5, 1, 5 ) ) { my @engineresults = select_array "SELECT ENGINE, SUPPORT FROM information_schema.ENGINES WHERE ENGINE NOT IN ('MyISAM', 'MERGE', 'MEMORY') ORDER BY ENGINE"; foreach my $line (@engineresults) { my ( $engine, $engineenabled ); ( $engine, $engineenabled ) = $line =~ /([a-zA-Z_]*)\s+([a-zA-Z]+)/; $result{'Engine'}{$engine}{'Enabled'} = $engineenabled; $engines .= ( $engineenabled eq "YES" || $engineenabled eq "DEFAULT" ) ? greenwrap "+" . $engine . " " : redwrap "-" . $engine . " "; } } else { $engines .= ( defined $myvar{'have_archive'} && $myvar{'have_archive'} eq "YES" ) ? greenwrap "+Archive " : redwrap "-Archive "; $engines .= ( defined $myvar{'have_bdb'} && $myvar{'have_bdb'} eq "YES" ) ? greenwrap "+BDB " : redwrap "-BDB "; $engines .= ( defined $myvar{'have_federated_engine'} && $myvar{'have_federated_engine'} eq "YES" ) ? greenwrap "+Federated " : redwrap "-Federated "; $engines .= ( defined $myvar{'have_innodb'} && $myvar{'have_innodb'} eq "YES" ) ? greenwrap "+InnoDB " : redwrap "-InnoDB "; $engines .= ( defined $myvar{'have_isam'} && $myvar{'have_isam'} eq "YES" ) ? greenwrap "+ISAM " : redwrap "-ISAM "; $engines .= ( defined $myvar{'have_ndbcluster'} && $myvar{'have_ndbcluster'} eq "YES" ) ? greenwrap "+NDBCluster " : redwrap "-NDBCluster "; } my @dblist = grep { $_ ne 'lost+found' } select_array "SHOW DATABASES"; $result{'Databases'}{'List'} = [@dblist]; infoprint "Status: $engines"; if ( mysql_version_ge( 5, 1, 5 ) ) { # MySQL 5+ servers can have table sizes calculated quickly from information schema my @templist = select_array "SELECT ENGINE, SUM(DATA_LENGTH+INDEX_LENGTH), COUNT(ENGINE), SUM(DATA_LENGTH), SUM(INDEX_LENGTH) FROM information_schema.TABLES WHERE TABLE_SCHEMA NOT IN ('information_schema', 'performance_schema', 'mysql') AND ENGINE IS NOT NULL GROUP BY ENGINE ORDER BY ENGINE ASC;"; my ( $engine, $size, $count, $dsize, $isize ); foreach my $line (@templist) { ( $engine, $size, $count, $dsize, $isize ) = $line =~ /([a-zA-Z_]+)\s+(\d+)\s+(\d+)\s+(\d+)\s+(\d+)/; debugprint "Engine Found: $engine"; next unless ( defined($engine) or trim($engine) eq '' ); $size = 0 unless ( defined($size) or trim($engine) eq '' ); $isize = 0 unless ( defined($isize) or trim($engine) eq '' ); $dsize = 0 unless ( defined($dsize) or trim($engine) eq '' ); $count = 0 unless ( defined($count) or trim($engine) eq '' ); $enginestats{$engine} = $size; $enginecount{$engine} = $count; $result{'Engine'}{$engine}{'Table Number'} = $count; $result{'Engine'}{$engine}{'Total Size'} = $size; $result{'Engine'}{$engine}{'Data Size'} = $dsize; $result{'Engine'}{$engine}{'Index Size'} = $isize; } #print Dumper( \%enginestats ) if $opt{debug}; my $not_innodb = ''; if ( not defined $result{'Variables'}{'innodb_file_per_table'} ) { $not_innodb = "AND NOT ENGINE='InnoDB'"; } elsif ( $result{'Variables'}{'innodb_file_per_table'} eq 'OFF' ) { $not_innodb = "AND NOT ENGINE='InnoDB'"; } $result{'Tables'}{'Fragmented tables'} = [ select_array "SELECT TABLE_SCHEMA, TABLE_NAME, ENGINE, CAST(DATA_FREE AS SIGNED) FROM information_schema.TABLES WHERE TABLE_SCHEMA NOT IN ('information_schema', 'performance_schema', 'mysql') AND DATA_LENGTH/1024/1024>100 AND cast(DATA_FREE as signed)*100/(DATA_LENGTH+INDEX_LENGTH+cast(DATA_FREE as signed)) > 10 AND NOT ENGINE='MEMORY' $not_innodb" ]; $fragtables = scalar @{ $result{'Tables'}{'Fragmented tables'} }; } else { # MySQL < 5 servers take a lot of work to get table sizes my @tblist; # Now we build a database list, and loop through it to get storage engine stats for tables foreach my $db (@dblist) { chomp($db); if ( $db eq "information_schema" or $db eq "performance_schema" or $db eq "mysql" or $db eq "lost+found" ) { next; } my @ixs = ( 1, 6, 9 ); if ( !mysql_version_ge( 4, 1 ) ) { # MySQL 3.23/4.0 keeps Data_Length in the 5th (0-based) column @ixs = ( 1, 5, 8 ); } push( @tblist, map { [ (split)[@ixs] ] } select_array "SHOW TABLE STATUS FROM \\\`$db\\\`" ); } # Parse through the table list to generate storage engine counts/statistics $fragtables = 0; foreach my $tbl (@tblist) { #debugprint "Data dump " . Dumper(@$tbl) if $opt{debug}; my ( $engine, $size, $datafree ) = @$tbl; next if $engine eq 'NULL' or not defined($engine); $size = 0 if $size eq 'NULL' or not defined($size); $datafree = 0 if $datafree eq 'NULL' or not defined($datafree); if ( defined $enginestats{$engine} ) { $enginestats{$engine} += $size; $enginecount{$engine} += 1; } else { $enginestats{$engine} = $size; $enginecount{$engine} = 1; } if ( $datafree > 0 ) { $fragtables++; } } } while ( my ( $engine, $size ) = each(%enginestats) ) { infoprint "Data in $engine tables: " . hr_bytes($size) . " (Tables: " . $enginecount{$engine} . ")" . ""; } # If the storage engine isn't being used, recommend it to be disabled if ( !defined $enginestats{'InnoDB'} && defined $myvar{'have_innodb'} && $myvar{'have_innodb'} eq "YES" ) { badprint "InnoDB is enabled, but isn't being used"; push( @generalrec, "Add skip-innodb to MySQL configuration to disable InnoDB" ); } if ( !defined $enginestats{'BerkeleyDB'} && defined $myvar{'have_bdb'} && $myvar{'have_bdb'} eq "YES" ) { badprint "BDB is enabled, but isn't being used"; push( @generalrec, "Add skip-bdb to MySQL configuration to disable BDB" ); } if ( !defined $enginestats{'ISAM'} && defined $myvar{'have_isam'} && $myvar{'have_isam'} eq "YES" ) { badprint "MyISAM is enabled, but isn't being used"; push( @generalrec, "Add skip-isam to MySQL configuration to disable MyISAM (MySQL > 4.1.0)" ); } # Fragmented tables if ( $fragtables > 0 ) { badprint "Total fragmented tables: $fragtables"; push @generalrec, 'Run ALTER TABLE ... FORCE or OPTIMIZE TABLE to defragment tables for better performance'; my $total_free = 0; foreach my $table_line ( @{ $result{'Tables'}{'Fragmented tables'} } ) { my ( $table_schema, $table_name, $engine, $data_free ) = split /\t/msx, $table_line; $data_free = $data_free / 1024 / 1024; $total_free += $data_free; my $generalrec; if ( $engine eq 'InnoDB' ) { $generalrec = " ALTER TABLE `$table_schema`.`$table_name` FORCE;"; } else { $generalrec = " OPTIMIZE TABLE `$table_schema`.`$table_name`;"; } $generalrec .= " -- can free $data_free MiB"; push @generalrec, $generalrec; } push @generalrec, "Total freed space after defragmentation: $total_free MiB"; } else { goodprint "Total fragmented tables: $fragtables"; } # Auto increments my %tblist; # Find the maximum integer my $maxint = select_one "SELECT ~0"; $result{'MaxInt'} = $maxint; # Now we use a database list, and loop through it to get storage engine stats for tables foreach my $db (@dblist) { chomp($db); if ( !$tblist{$db} ) { $tblist{$db} = (); } if ( $db eq "information_schema" ) { next; } my @ia = ( 0, 10 ); if ( !mysql_version_ge( 4, 1 ) ) { # MySQL 3.23/4.0 keeps Data_Length in the 5th (0-based) column @ia = ( 0, 9 ); } push( @{ $tblist{$db} }, map { [ (split)[@ia] ] } select_array "SHOW TABLE STATUS FROM \\\`$db\\\`" ); } my @dbnames = keys %tblist; foreach my $db (@dbnames) { foreach my $tbl ( @{ $tblist{$db} } ) { my ( $name, $autoincrement ) = @$tbl; if ( $autoincrement =~ /^\d+?$/ ) { my $percent = percentage( $autoincrement, $maxint ); $result{'PctAutoIncrement'}{"$db.$name"} = $percent; if ( $percent >= 75 ) { badprint "Table '$db.$name' has an autoincrement value near max capacity ($percent%)"; } } } } } my %mycalc; sub dump_into_file { my $file = shift; my $content = shift; if ( -d "$opt{dumpdir}" ) { $file = "$opt{dumpdir}/$file"; open( FILE, ">$file" ) or die "Can't open $file: $!"; print FILE $content; close FILE; infoprint "Data saved to $file"; } } sub calculations { if ( $mystat{'Questions'} < 1 ) { badprint "Your server has not answered any queries: cannot continue..."; exit 2; } # Per-thread memory $mycalc{'per_thread_buffers'} = 0; $mycalc{'per_thread_buffers'} += $myvar{'read_buffer_size'} if is_int( $myvar{'read_buffer_size'} ); $mycalc{'per_thread_buffers'} += $myvar{'read_rnd_buffer_size'} if is_int( $myvar{'read_rnd_buffer_size'} ); $mycalc{'per_thread_buffers'} += $myvar{'sort_buffer_size'} if is_int( $myvar{'sort_buffer_size'} ); $mycalc{'per_thread_buffers'} += $myvar{'thread_stack'} if is_int( $myvar{'thread_stack'} ); $mycalc{'per_thread_buffers'} += $myvar{'join_buffer_size'} if is_int( $myvar{'join_buffer_size'} ); $mycalc{'per_thread_buffers'} += $myvar{'binlog_cache_size'} if is_int( $myvar{'binlog_cache_size'} ); debugprint "per_thread_buffers: $mycalc{'per_thread_buffers'} (" . human_size( $mycalc{'per_thread_buffers'} ) . " )"; # Error max_allowed_packet is not included in thread buffers size #$mycalc{'per_thread_buffers'} += $myvar{'max_allowed_packet'} if is_int($myvar{'max_allowed_packet'}); # Total per-thread memory $mycalc{'total_per_thread_buffers'} = $mycalc{'per_thread_buffers'} * $myvar{'max_connections'}; # Max total per-thread memory reached $mycalc{'max_total_per_thread_buffers'} = $mycalc{'per_thread_buffers'} * $mystat{'Max_used_connections'}; # Server-wide memory $mycalc{'max_tmp_table_size'} = ( $myvar{'tmp_table_size'} > $myvar{'max_heap_table_size'} ) ? $myvar{'max_heap_table_size'} : $myvar{'tmp_table_size'}; $mycalc{'server_buffers'} = $myvar{'key_buffer_size'} + $mycalc{'max_tmp_table_size'}; $mycalc{'server_buffers'} += ( defined $myvar{'innodb_buffer_pool_size'} ) ? $myvar{'innodb_buffer_pool_size'} : 0; $mycalc{'server_buffers'} += ( defined $myvar{'innodb_additional_mem_pool_size'} ) ? $myvar{'innodb_additional_mem_pool_size'} : 0; $mycalc{'server_buffers'} += ( defined $myvar{'innodb_log_buffer_size'} ) ? $myvar{'innodb_log_buffer_size'} : 0; $mycalc{'server_buffers'} += ( defined $myvar{'query_cache_size'} ) ? $myvar{'query_cache_size'} : 0; $mycalc{'server_buffers'} += ( defined $myvar{'aria_pagecache_buffer_size'} ) ? $myvar{'aria_pagecache_buffer_size'} : 0; # Global memory # Max used memory is memory used by MySQL based on Max_used_connections # This is the max memory used theoretically calculated with the max concurrent connection number reached by mysql $mycalc{'max_used_memory'} = $mycalc{'server_buffers'} + $mycalc{"max_total_per_thread_buffers"} + get_pf_memory(); # + get_gcache_memory(); $mycalc{'pct_max_used_memory'} = percentage( $mycalc{'max_used_memory'}, $physical_memory ); # Total possible memory is memory needed by MySQL based on max_connections # This is the max memory MySQL can theoretically used if all connections allowed has opened by mysql $mycalc{'max_peak_memory'} = $mycalc{'server_buffers'} + $mycalc{'total_per_thread_buffers'} + get_pf_memory(); # + get_gcache_memory(); $mycalc{'pct_max_physical_memory'} = percentage( $mycalc{'max_peak_memory'}, $physical_memory ); debugprint "Max Used Memory: " . hr_bytes( $mycalc{'max_used_memory'} ) . ""; debugprint "Max Used Percentage RAM: " . $mycalc{'pct_max_used_memory'} . "%"; debugprint "Max Peak Memory: " . hr_bytes( $mycalc{'max_peak_memory'} ) . ""; debugprint "Max Peak Percentage RAM: " . $mycalc{'pct_max_physical_memory'} . "%"; # Slow queries $mycalc{'pct_slow_queries'} = int( ( $mystat{'Slow_queries'} / $mystat{'Questions'} ) * 100 ); # Connections $mycalc{'pct_connections_used'} = int( ( $mystat{'Max_used_connections'} / $myvar{'max_connections'} ) * 100 ); $mycalc{'pct_connections_used'} = ( $mycalc{'pct_connections_used'} > 100 ) ? 100 : $mycalc{'pct_connections_used'}; # Aborted Connections $mycalc{'pct_connections_aborted'} = percentage( $mystat{'Aborted_connects'}, $mystat{'Connections'} ); debugprint "Aborted_connects: " . $mystat{'Aborted_connects'} . ""; debugprint "Connections: " . $mystat{'Connections'} . ""; debugprint "pct_connections_aborted: " . $mycalc{'pct_connections_aborted'} . ""; # Key buffers if ( mysql_version_ge( 4, 1 ) && $myvar{'key_buffer_size'} > 0 ) { $mycalc{'pct_key_buffer_used'} = sprintf( "%.1f", ( 1 - ( ( $mystat{'Key_blocks_unused'} * $myvar{'key_cache_block_size'} ) / $myvar{'key_buffer_size'} ) ) * 100 ); } else { $mycalc{'pct_key_buffer_used'} = 0; } if ( $mystat{'Key_read_requests'} > 0 ) { $mycalc{'pct_keys_from_mem'} = sprintf( "%.1f", ( 100 - ( ( $mystat{'Key_reads'} / $mystat{'Key_read_requests'} ) * 100 ) ) ); } else { $mycalc{'pct_keys_from_mem'} = 0; } if ( defined $mystat{'Aria_pagecache_read_requests'} && $mystat{'Aria_pagecache_read_requests'} > 0 ) { $mycalc{'pct_aria_keys_from_mem'} = sprintf( "%.1f", ( 100 - ( ( $mystat{'Aria_pagecache_reads'} / $mystat{'Aria_pagecache_read_requests'} ) * 100 ) ) ); } else { $mycalc{'pct_aria_keys_from_mem'} = 0; } if ( $mystat{'Key_write_requests'} > 0 ) { $mycalc{'pct_wkeys_from_mem'} = sprintf( "%.1f", ( ( $mystat{'Key_writes'} / $mystat{'Key_write_requests'} ) * 100 ) ); } else { $mycalc{'pct_wkeys_from_mem'} = 0; } if ( $doremote eq 0 and !mysql_version_ge(5) ) { my $size = 0; $size += (split)[0] for `find "$myvar{'datadir'}" -name "*.MYI" -print0 2>&1 | xargs $xargsflags -0 du -L $duflags 2>&1`; $mycalc{'total_myisam_indexes'} = $size; $size = 0 + (split)[0] for `find "$myvar{'datadir'}" -name "*.MAI" -print0 2>&1 | xargs $xargsflags -0 du -L $duflags 2>&1`; $mycalc{'total_aria_indexes'} = $size; } elsif ( mysql_version_ge(5) ) { $mycalc{'total_myisam_indexes'} = select_one "SELECT IFNULL(SUM(INDEX_LENGTH), 0) FROM information_schema.TABLES WHERE TABLE_SCHEMA NOT IN ('information_schema') AND ENGINE = 'MyISAM';"; $mycalc{'total_aria_indexes'} = select_one "SELECT IFNULL(SUM(INDEX_LENGTH), 0) FROM information_schema.TABLES WHERE TABLE_SCHEMA NOT IN ('information_schema') AND ENGINE = 'Aria';"; } if ( defined $mycalc{'total_myisam_indexes'} ) { chomp( $mycalc{'total_myisam_indexes'} ); } if ( defined $mycalc{'total_aria_indexes'} ) { chomp( $mycalc{'total_aria_indexes'} ); } # Query cache if ( mysql_version_ge(8) and mysql_version_le(10) ) { $mycalc{'query_cache_efficiency'} = 0; } elsif ( mysql_version_ge(4) ) { $mycalc{'query_cache_efficiency'} = sprintf( "%.1f", ( $mystat{'Qcache_hits'} / ( $mystat{'Com_select'} + $mystat{'Qcache_hits'} ) ) * 100 ); if ( $myvar{'query_cache_size'} ) { $mycalc{'pct_query_cache_used'} = sprintf( "%.1f", 100 - ( $mystat{'Qcache_free_memory'} / $myvar{'query_cache_size'} ) * 100 ); } if ( $mystat{'Qcache_lowmem_prunes'} == 0 ) { $mycalc{'query_cache_prunes_per_day'} = 0; } else { $mycalc{'query_cache_prunes_per_day'} = int( $mystat{'Qcache_lowmem_prunes'} / ( $mystat{'Uptime'} / 86400 ) ); } } # Sorting $mycalc{'total_sorts'} = $mystat{'Sort_scan'} + $mystat{'Sort_range'}; if ( $mycalc{'total_sorts'} > 0 ) { $mycalc{'pct_temp_sort_table'} = int( ( $mystat{'Sort_merge_passes'} / $mycalc{'total_sorts'} ) * 100 ); } # Joins $mycalc{'joins_without_indexes'} = $mystat{'Select_range_check'} + $mystat{'Select_full_join'}; $mycalc{'joins_without_indexes_per_day'} = int( $mycalc{'joins_without_indexes'} / ( $mystat{'Uptime'} / 86400 ) ); # Temporary tables if ( $mystat{'Created_tmp_tables'} > 0 ) { if ( $mystat{'Created_tmp_disk_tables'} > 0 ) { $mycalc{'pct_temp_disk'} = int( ( $mystat{'Created_tmp_disk_tables'} / $mystat{'Created_tmp_tables'} ) * 100 ); } else { $mycalc{'pct_temp_disk'} = 0; } } # Table cache if ( $mystat{'Opened_tables'} > 0 ) { if ( not defined( $mystat{'Table_open_cache_hits'} ) ) { $mycalc{'table_cache_hit_rate'} = int( $mystat{'Open_tables'} * 100 / $mystat{'Opened_tables'} ); } else { $mycalc{'table_cache_hit_rate'} = int( $mystat{'Table_open_cache_hits'} * 100 / ( $mystat{'Table_open_cache_hits'} + $mystat{'Table_open_cache_misses'} ) ); } } else { $mycalc{'table_cache_hit_rate'} = 100; } # Open files if ( $myvar{'open_files_limit'} > 0 ) { $mycalc{'pct_files_open'} = int( $mystat{'Open_files'} * 100 / $myvar{'open_files_limit'} ); } # Table locks if ( $mystat{'Table_locks_immediate'} > 0 ) { if ( $mystat{'Table_locks_waited'} == 0 ) { $mycalc{'pct_table_locks_immediate'} = 100; } else { $mycalc{'pct_table_locks_immediate'} = int( $mystat{'Table_locks_immediate'} * 100 / ( $mystat{'Table_locks_waited'} + $mystat{'Table_locks_immediate'} ) ); } } # Thread cache $mycalc{'thread_cache_hit_rate'} = int( 100 - ( ( $mystat{'Threads_created'} / $mystat{'Connections'} ) * 100 ) ); # Other if ( $mystat{'Connections'} > 0 ) { $mycalc{'pct_aborted_connections'} = int( ( $mystat{'Aborted_connects'} / $mystat{'Connections'} ) * 100 ); } if ( $mystat{'Questions'} > 0 ) { $mycalc{'total_reads'} = $mystat{'Com_select'}; $mycalc{'total_writes'} = $mystat{'Com_delete'} + $mystat{'Com_insert'} + $mystat{'Com_update'} + $mystat{'Com_replace'}; if ( $mycalc{'total_reads'} == 0 ) { $mycalc{'pct_reads'} = 0; $mycalc{'pct_writes'} = 100; } else { $mycalc{'pct_reads'} = int( ( $mycalc{'total_reads'} / ( $mycalc{'total_reads'} + $mycalc{'total_writes'} ) ) * 100 ); $mycalc{'pct_writes'} = 100 - $mycalc{'pct_reads'}; } } # InnoDB $myvar{'innodb_log_files_in_group'} = 1 unless defined( $myvar{'innodb_log_files_in_group'} ); $myvar{'innodb_log_files_in_group'} = 1 if $myvar{'innodb_log_files_in_group'} == 0; $myvar{"innodb_buffer_pool_instances"} = 1 unless defined( $myvar{'innodb_buffer_pool_instances'} ); if ( $myvar{'have_innodb'} eq "YES" ) { $mycalc{'innodb_log_size_pct'} = ( $myvar{'innodb_log_file_size'} * $myvar{'innodb_log_files_in_group'} * 100 / $myvar{'innodb_buffer_pool_size'} ); } if ( !defined $myvar{'innodb_buffer_pool_size'} ) { $mycalc{'innodb_log_size_pct'} = 0; $myvar{'innodb_buffer_pool_size'} = 0; } # InnoDB Buffer pool read cache efficiency ( $mystat{'Innodb_buffer_pool_read_requests'}, $mystat{'Innodb_buffer_pool_reads'} ) = ( 1, 1 ) unless defined $mystat{'Innodb_buffer_pool_reads'}; $mycalc{'pct_read_efficiency'} = percentage( $mystat{'Innodb_buffer_pool_read_requests'}, ( $mystat{'Innodb_buffer_pool_read_requests'} + $mystat{'Innodb_buffer_pool_reads'} ) ) if defined $mystat{'Innodb_buffer_pool_read_requests'}; debugprint "pct_read_efficiency: " . $mycalc{'pct_read_efficiency'} . ""; debugprint "Innodb_buffer_pool_reads: " . $mystat{'Innodb_buffer_pool_reads'} . ""; debugprint "Innodb_buffer_pool_read_requests: " . $mystat{'Innodb_buffer_pool_read_requests'} . ""; # InnoDB log write cache efficiency ( $mystat{'Innodb_log_write_requests'}, $mystat{'Innodb_log_writes'} ) = ( 1, 1 ) unless defined $mystat{'Innodb_log_writes'}; $mycalc{'pct_write_efficiency'} = percentage( ( $mystat{'Innodb_log_write_requests'} - $mystat{'Innodb_log_writes'} ), $mystat{'Innodb_log_write_requests'} ) if defined $mystat{'Innodb_log_write_requests'}; debugprint "pct_write_efficiency: " . $mycalc{'pct_write_efficiency'} . ""; debugprint "Innodb_log_writes: " . $mystat{'Innodb_log_writes'} . ""; debugprint "Innodb_log_write_requests: " . $mystat{'Innodb_log_write_requests'} . ""; $mycalc{'pct_innodb_buffer_used'} = percentage( ( $mystat{'Innodb_buffer_pool_pages_total'} - $mystat{'Innodb_buffer_pool_pages_free'} ), $mystat{'Innodb_buffer_pool_pages_total'} ) if defined $mystat{'Innodb_buffer_pool_pages_total'}; $mycalc{'innodb_buffer_alloc_pct'} = select_one( "select round( 100* sum(allocated)/( select VARIABLE_VALUE " . "FROM performance_schema.global_variables " . "WHERE VARIABLE_NAME='innodb_buffer_pool_size' ) ,2)" . 'FROM sys.x\$innodb_buffer_stats_by_table;' ); # Binlog Cache if ( $myvar{'log_bin'} ne 'OFF' ) { $mycalc{'pct_binlog_cache'} = percentage( $mystat{'Binlog_cache_use'} - $mystat{'Binlog_cache_disk_use'}, $mystat{'Binlog_cache_use'} ); } } sub mysql_stats { subheaderprint "Performance Metrics"; # Show uptime, queries per second, connections, traffic stats my $qps; if ( $mystat{'Uptime'} > 0 ) { $qps = sprintf( "%.3f", $mystat{'Questions'} / $mystat{'Uptime'} ); } push( @generalrec, "MySQL was started within the last 24 hours: recommendations may be inaccurate" ) if ( $mystat{'Uptime'} < 86400 ); infoprint "Up for: " . pretty_uptime( $mystat{'Uptime'} ) . " (" . hr_num( $mystat{'Questions'} ) . " q [" . hr_num($qps) . " qps], " . hr_num( $mystat{'Connections'} ) . " conn," . " TX: " . hr_bytes_rnd( $mystat{'Bytes_sent'} ) . ", RX: " . hr_bytes_rnd( $mystat{'Bytes_received'} ) . ")"; infoprint "Reads / Writes: " . $mycalc{'pct_reads'} . "% / " . $mycalc{'pct_writes'} . "%"; # Binlog Cache if ( $myvar{'log_bin'} eq 'OFF' ) { infoprint "Binary logging is disabled"; } else { infoprint "Binary logging is enabled (GTID MODE: " . ( defined( $myvar{'gtid_mode'} ) ? $myvar{'gtid_mode'} : "OFF" ) . ")"; } # Memory usage infoprint "Physical Memory : " . hr_bytes($physical_memory); infoprint "Max MySQL memory : " . hr_bytes( $mycalc{'max_peak_memory'} ); infoprint "Other process memory: " . hr_bytes( get_other_process_memory() ); infoprint "Total buffers: " . hr_bytes( $mycalc{'server_buffers'} ) . " global + " . hr_bytes( $mycalc{'per_thread_buffers'} ) . " per thread ($myvar{'max_connections'} max threads)"; infoprint "Performance_schema Max memory usage: " . hr_bytes_rnd( get_pf_memory() ); $result{'Performance_schema'}{'memory'} = get_pf_memory(); $result{'Performance_schema'}{'pretty_memory'} = hr_bytes_rnd( get_pf_memory() ); infoprint "Galera GCache Max memory usage: " . hr_bytes_rnd( get_gcache_memory() ); $result{'Galera'}{'GCache'}{'memory'} = get_gcache_memory(); $result{'Galera'}{'GCache'}{'pretty_memory'} = hr_bytes_rnd( get_gcache_memory() ); if ( $opt{buffers} ne 0 ) { infoprint "Global Buffers"; infoprint " +-- Key Buffer: " . hr_bytes( $myvar{'key_buffer_size'} ) . ""; infoprint " +-- Max Tmp Table: " . hr_bytes( $mycalc{'max_tmp_table_size'} ) . ""; if ( defined $myvar{'query_cache_type'} ) { infoprint "Query Cache Buffers"; infoprint " +-- Query Cache: " . $myvar{'query_cache_type'} . " - " . ( $myvar{'query_cache_type'} eq 0 | $myvar{'query_cache_type'} eq 'OFF' ? "DISABLED" : ( $myvar{'query_cache_type'} eq 1 ? "ALL REQUESTS" : "ON DEMAND" ) ) . ""; infoprint " +-- Query Cache Size: " . hr_bytes( $myvar{'query_cache_size'} ) . ""; } infoprint "Per Thread Buffers"; infoprint " +-- Read Buffer: " . hr_bytes( $myvar{'read_buffer_size'} ) . ""; infoprint " +-- Read RND Buffer: " . hr_bytes( $myvar{'read_rnd_buffer_size'} ) . ""; infoprint " +-- Sort Buffer: " . hr_bytes( $myvar{'sort_buffer_size'} ) . ""; infoprint " +-- Thread stack: " . hr_bytes( $myvar{'thread_stack'} ) . ""; infoprint " +-- Join Buffer: " . hr_bytes( $myvar{'join_buffer_size'} ) . ""; if ( $myvar{'log_bin'} ne 'OFF' ) { infoprint "Binlog Cache Buffers"; infoprint " +-- Binlog Cache: " . hr_bytes( $myvar{'binlog_cache_size'} ) . ""; } } if ( $arch && $arch == 32 && $mycalc{'max_used_memory'} > 2 * 1024 * 1024 * 1024 ) { badprint "Allocating > 2GB RAM on 32-bit systems can cause system instability"; badprint "Maximum reached memory usage: " . hr_bytes( $mycalc{'max_used_memory'} ) . " ($mycalc{'pct_max_used_memory'}% of installed RAM)"; } elsif ( $mycalc{'pct_max_used_memory'} > 85 ) { badprint "Maximum reached memory usage: " . hr_bytes( $mycalc{'max_used_memory'} ) . " ($mycalc{'pct_max_used_memory'}% of installed RAM)"; } else { goodprint "Maximum reached memory usage: " . hr_bytes( $mycalc{'max_used_memory'} ) . " ($mycalc{'pct_max_used_memory'}% of installed RAM)"; } if ( $mycalc{'pct_max_physical_memory'} > 85 ) { badprint "Maximum possible memory usage: " . hr_bytes( $mycalc{'max_peak_memory'} ) . " ($mycalc{'pct_max_physical_memory'}% of installed RAM)"; push( @generalrec, "Reduce your overall MySQL memory footprint for system stability" ); } else { goodprint "Maximum possible memory usage: " . hr_bytes( $mycalc{'max_peak_memory'} ) . " ($mycalc{'pct_max_physical_memory'}% of installed RAM)"; } if ( $physical_memory < ( $mycalc{'max_peak_memory'} + get_other_process_memory() ) ) { badprint "Overall possible memory usage with other process exceeded memory"; push( @generalrec, "Dedicate this server to your database for highest performance." ); } else { goodprint "Overall possible memory usage with other process is compatible with memory available"; } # Slow queries if ( $mycalc{'pct_slow_queries'} > 5 ) { badprint "Slow queries: $mycalc{'pct_slow_queries'}% (" . hr_num( $mystat{'Slow_queries'} ) . "/" . hr_num( $mystat{'Questions'} ) . ")"; } else { goodprint "Slow queries: $mycalc{'pct_slow_queries'}% (" . hr_num( $mystat{'Slow_queries'} ) . "/" . hr_num( $mystat{'Questions'} ) . ")"; } if ( $myvar{'long_query_time'} > 10 ) { push( @adjvars, "long_query_time (<= 10)" ); } if ( defined( $myvar{'log_slow_queries'} ) ) { if ( $myvar{'log_slow_queries'} eq "OFF" ) { push( @generalrec, "Enable the slow query log to troubleshoot bad queries" ); } } # Connections if ( $mycalc{'pct_connections_used'} > 85 ) { badprint "Highest connection usage: $mycalc{'pct_connections_used'}% ($mystat{'Max_used_connections'}/$myvar{'max_connections'})"; push( @adjvars, "max_connections (> " . $myvar{'max_connections'} . ")" ); push( @adjvars, "wait_timeout (< " . $myvar{'wait_timeout'} . ")", "interactive_timeout (< " . $myvar{'interactive_timeout'} . ")" ); push( @generalrec, "Reduce or eliminate persistent connections to reduce connection usage" ); } else { goodprint "Highest usage of available connections: $mycalc{'pct_connections_used'}% ($mystat{'Max_used_connections'}/$myvar{'max_connections'})"; } # Aborted Connections if ( $mycalc{'pct_connections_aborted'} > 3 ) { badprint "Aborted connections: $mycalc{'pct_connections_aborted'}% ($mystat{'Aborted_connects'}/$mystat{'Connections'})"; push( @generalrec, "Reduce or eliminate unclosed connections and network issues" ); } else { goodprint "Aborted connections: $mycalc{'pct_connections_aborted'}% ($mystat{'Aborted_connects'}/$mystat{'Connections'})"; } # name resolution debugprint "skip name resolve: $result{'Variables'}{'skip_name_resolve'}" if ( defined( $result{'Variables'}{'skip_name_resolve'} ) ); if ( defined( $result{'Variables'}{'skip_networking'} ) && $result{'Variables'}{'skip_networking'} eq 'ON' ) { infoprint "Skipped name resolution test due to skip_networking=ON in system variables."; } elsif ( not defined( $result{'Variables'}{'skip_name_resolve'} ) ) { infoprint "Skipped name resolution test due to missing skip_name_resolve in system variables."; } #Cpanel and Skip name resolve elsif ( -r "/usr/local/cpanel/cpanel" ) { if ( $result{'Variables'}{'skip_name_resolve'} ne 'OFF' ) { infoprint "CPanel and Flex system skip-name-resolve should be on"; } if ( $result{'Variables'}{'skip_name_resolve'} eq 'OFF' ) { badprint "CPanel and Flex system skip-name-resolve should be on"; push( @generalrec, "name resolution is enabled due to cPanel doesn't support this disabled." ); push( @adjvars, "skip-name-resolve=0" ); } } elsif ( $result{'Variables'}{'skip_name_resolve'} ne 'ON' and $result{'Variables'}{'skip_name_resolve'} ne '1' ) { badprint "Name resolution is active: a reverse name resolution is made for each new connection which can reduce performance"; push( @generalrec, "Configure your accounts with ip or subnets only, then update your configuration with skip-name-resolve=ON" ); push( @adjvars, "skip-name-resolve=ON" ); } # Query cache if ( !mysql_version_ge(4) ) { # MySQL versions < 4.01 don't support query caching push( @generalrec, "Upgrade MySQL to version 4+ to utilize query caching" ); } elsif ( mysql_version_eq(8) ) { infoprint "Query cache has been removed since MySQL 8.0"; #return; } elsif ($myvar{'query_cache_size'} < 1 or $myvar{'query_cache_type'} eq "OFF" ) { goodprint "Query cache is disabled by default due to mutex contention on multiprocessor machines."; } elsif ( $mystat{'Com_select'} == 0 ) { badprint "Query cache cannot be analyzed: no SELECT statements executed"; } else { if ( $mycalc{'query_cache_efficiency'} < 20 ) { badprint "Query cache efficiency: $mycalc{'query_cache_efficiency'}% (" . hr_num( $mystat{'Qcache_hits'} ) . " cached / " . hr_num( $mystat{'Qcache_hits'} + $mystat{'Com_select'} ) . " selects)"; push( @adjvars, "query_cache_limit (> " . hr_bytes_rnd( $myvar{'query_cache_limit'} ) . ", or use smaller result sets)" ); badprint "Query cache may be disabled by default due to mutex contention."; push( @adjvars, "query_cache_size (=0)" ); push( @adjvars, "query_cache_type (=0)" ); } else { goodprint "Query cache efficiency: $mycalc{'query_cache_efficiency'}% (" . hr_num( $mystat{'Qcache_hits'} ) . " cached / " . hr_num( $mystat{'Qcache_hits'} + $mystat{'Com_select'} ) . " selects)"; if ( $mycalc{'query_cache_prunes_per_day'} > 98 ) { badprint "Query cache prunes per day: $mycalc{'query_cache_prunes_per_day'}"; if ( $myvar{'query_cache_size'} >= 128 * 1024 * 1024 ) { push( @generalrec, "Increasing the query_cache size over 128M may reduce performance" ); push( @adjvars, "query_cache_size (> " . hr_bytes_rnd( $myvar{'query_cache_size'} ) . ") [see warning above]" ); } else { push( @adjvars, "query_cache_size (> " . hr_bytes_rnd( $myvar{'query_cache_size'} ) . ")" ); } } else { goodprint "Query cache prunes per day: $mycalc{'query_cache_prunes_per_day'}"; } } } # Sorting if ( $mycalc{'total_sorts'} == 0 ) { goodprint "No Sort requiring temporary tables"; } elsif ( $mycalc{'pct_temp_sort_table'} > 10 ) { badprint "Sorts requiring temporary tables: $mycalc{'pct_temp_sort_table'}% (" . hr_num( $mystat{'Sort_merge_passes'} ) . " temp sorts / " . hr_num( $mycalc{'total_sorts'} ) . " sorts)"; push( @adjvars, "sort_buffer_size (> " . hr_bytes_rnd( $myvar{'sort_buffer_size'} ) . ")" ); push( @adjvars, "read_rnd_buffer_size (> " . hr_bytes_rnd( $myvar{'read_rnd_buffer_size'} ) . ")" ); } else { goodprint "Sorts requiring temporary tables: $mycalc{'pct_temp_sort_table'}% (" . hr_num( $mystat{'Sort_merge_passes'} ) . " temp sorts / " . hr_num( $mycalc{'total_sorts'} ) . " sorts)"; } # Joins if ( $mycalc{'joins_without_indexes_per_day'} > 250 ) { badprint "Joins performed without indexes: $mycalc{'joins_without_indexes'}"; push( @adjvars, "join_buffer_size (> " . hr_bytes( $myvar{'join_buffer_size'} ) . ", or always use indexes with JOINs)" ); push( @generalrec, "We will suggest raising the 'join_buffer_size' until JOINs not using indexes are found. See https://dev.mysql.com/doc/refman/8.0/en/server-system-variables.html#sysvar_join_buffer_size" ); } else { goodprint "No joins without indexes"; # No joins have run without indexes } # Temporary tables if ( $mystat{'Created_tmp_tables'} > 0 ) { if ( $mycalc{'pct_temp_disk'} > 25 && $mycalc{'max_tmp_table_size'} < 256 * 1024 * 1024 ) { badprint "Temporary tables created on disk: $mycalc{'pct_temp_disk'}% (" . hr_num( $mystat{'Created_tmp_disk_tables'} ) . " on disk / " . hr_num( $mystat{'Created_tmp_tables'} ) . " total)"; push( @adjvars, "tmp_table_size (> " . hr_bytes_rnd( $myvar{'tmp_table_size'} ) . ")" ); push( @adjvars, "max_heap_table_size (> " . hr_bytes_rnd( $myvar{'max_heap_table_size'} ) . ")" ); push( @generalrec, "When making adjustments, make tmp_table_size/max_heap_table_size equal" ); push( @generalrec, "Reduce your SELECT DISTINCT queries which have no LIMIT clause" ); } elsif ($mycalc{'pct_temp_disk'} > 25 && $mycalc{'max_tmp_table_size'} >= 256 * 1024 * 1024 ) { badprint "Temporary tables created on disk: $mycalc{'pct_temp_disk'}% (" . hr_num( $mystat{'Created_tmp_disk_tables'} ) . " on disk / " . hr_num( $mystat{'Created_tmp_tables'} ) . " total)"; push( @generalrec, "Temporary table size is already large: reduce result set size" ); push( @generalrec, "Reduce your SELECT DISTINCT queries without LIMIT clauses" ); } else { goodprint "Temporary tables created on disk: $mycalc{'pct_temp_disk'}% (" . hr_num( $mystat{'Created_tmp_disk_tables'} ) . " on disk / " . hr_num( $mystat{'Created_tmp_tables'} ) . " total)"; } } else { goodprint "No tmp tables created on disk"; } # Thread cache if ( defined( $myvar{'have_threadpool'} ) and $myvar{'have_threadpool'} eq 'YES' ) { # https://www.percona.com/doc/percona-server/5.7/performance/threadpool.html#status-variables # When thread pool is enabled, the value of the thread_cache_size variable # is ignored. The Threads_cached status variable contains 0 in this case. infoprint "Thread cache not used with thread pool enabled"; } else { if ( $myvar{'thread_cache_size'} eq 0 ) { badprint "Thread cache is disabled"; push( @generalrec, "Set thread_cache_size to 4 as a starting value" ); push( @adjvars, "thread_cache_size (start at 4)" ); } else { if ( $mycalc{'thread_cache_hit_rate'} <= 50 ) { badprint "Thread cache hit rate: $mycalc{'thread_cache_hit_rate'}% (" . hr_num( $mystat{'Threads_created'} ) . " created / " . hr_num( $mystat{'Connections'} ) . " connections)"; push( @adjvars, "thread_cache_size (> $myvar{'thread_cache_size'})" ); } else { goodprint "Thread cache hit rate: $mycalc{'thread_cache_hit_rate'}% (" . hr_num( $mystat{'Threads_created'} ) . " created / " . hr_num( $mystat{'Connections'} ) . " connections)"; } } } # Table cache my $table_cache_var = ""; if ( $mystat{'Open_tables'} > 0 ) { if ( $mycalc{'table_cache_hit_rate'} < 20 ) { unless ( defined( $mystat{'Table_open_cache_hits'} ) ) { badprint "Table cache hit rate: $mycalc{'table_cache_hit_rate'}% (" . hr_num( $mystat{'Open_tables'} ) . " hits / " . hr_num( $mystat{'Opened_tables'} ) . " requests)"; } else { badprint "Table cache hit rate: $mycalc{'table_cache_hit_rate'}% (" . hr_num( $mystat{'Table_open_cache_hits'} ) . " hits / " . hr_num( $mystat{'Table_open_cache_hits'} + $mystat{'Table_open_cache_misses'} ) . " requests)"; } if ( mysql_version_ge( 5, 1 ) ) { $table_cache_var = "table_open_cache"; } else { $table_cache_var = "table_cache"; } push( @adjvars, $table_cache_var . " (> " . $myvar{$table_cache_var} . ")" ); push( @generalrec, "Increase " . $table_cache_var . " gradually to avoid file descriptor limits" ); push( @generalrec, "Read this before increasing " . $table_cache_var . " over 64: https://bit.ly/2Fulv7r" ); push( @generalrec, "Read this before increasing for MariaDB" . " https://mariadb.com/kb/en/library/optimizing-table_open_cache/" ); push( @generalrec, "This is MyISAM only table_cache scalability problem, InnoDB not affected." ); push( @generalrec, "For more details see: https://bugs.mysql.com/bug.php?id=49177" ); push( @generalrec, "This bug already fixed in MySQL 5.7.9 and newer MySQL versions." ); push( @generalrec, "Beware that open_files_limit (" . $myvar{'open_files_limit'} . ") variable " ); push( @generalrec, "should be greater than $table_cache_var (" . $myvar{$table_cache_var} . ")" ); } else { unless ( defined( $mystat{'Table_open_cache_hits'} ) ) { goodprint "Table cache hit rate: $mycalc{'table_cache_hit_rate'}% (" . hr_num( $mystat{'Open_tables'} ) . " hits / " . hr_num( $mystat{'Opened_tables'} ) . " requests)"; } else { goodprint "Table cache hit rate: $mycalc{'table_cache_hit_rate'}% (" . hr_num( $mystat{'Table_open_cache_hits'} ) . " hits / " . hr_num( $mystat{'Table_open_cache_hits'} + $mystat{'Table_open_cache_misses'} ) . " requests)"; } } } # Table definition cache my $nbtables = select_one('SELECT COUNT(*) FROM information_schema.tables'); $mycalc{'total_tables'} = $nbtables; if ( defined $myvar{'table_definition_cache'} ) { if ( $myvar{'table_definition_cache'} == -1 ) { infoprint( "table_definition_cache (" . $myvar{'table_definition_cache'} . ") is in autosizing mode" ); } elsif ( $myvar{'table_definition_cache'} < $nbtables ) { badprint "table_definition_cache (" . $myvar{'table_definition_cache'} . ") is less than number of tables ($nbtables) "; push( @adjvars, "table_definition_cache (" . $myvar{'table_definition_cache'} . ") > " . $nbtables . " or -1 (autosizing if supported)" ); } else { goodprint "table_definition_cache (" . $myvar{'table_definition_cache'} . ") is greater than number of tables ($nbtables)"; } } else { infoprint "No table_definition_cache variable found."; } # Open files if ( defined $mycalc{'pct_files_open'} ) { if ( $mycalc{'pct_files_open'} > 85 ) { badprint "Open file limit used: $mycalc{'pct_files_open'}% (" . hr_num( $mystat{'Open_files'} ) . "/" . hr_num( $myvar{'open_files_limit'} ) . ")"; push( @adjvars, "open_files_limit (> " . $myvar{'open_files_limit'} . ")" ); } else { goodprint "Open file limit used: $mycalc{'pct_files_open'}% (" . hr_num( $mystat{'Open_files'} ) . "/" . hr_num( $myvar{'open_files_limit'} ) . ")"; } } # Table locks if ( defined $mycalc{'pct_table_locks_immediate'} ) { if ( $mycalc{'pct_table_locks_immediate'} < 95 ) { badprint "Table locks acquired immediately: $mycalc{'pct_table_locks_immediate'}%"; push( @generalrec, "Optimize queries and/or use InnoDB to reduce lock wait" ); } else { goodprint "Table locks acquired immediately: $mycalc{'pct_table_locks_immediate'}% (" . hr_num( $mystat{'Table_locks_immediate'} ) . " immediate / " . hr_num( $mystat{'Table_locks_waited'} + $mystat{'Table_locks_immediate'} ) . " locks)"; } } # Binlog cache if ( defined $mycalc{'pct_binlog_cache'} ) { if ( $mycalc{'pct_binlog_cache'} < 90 && $mystat{'Binlog_cache_use'} > 0 ) { badprint "Binlog cache memory access: " . $mycalc{'pct_binlog_cache'} . "% (" . ( $mystat{'Binlog_cache_use'} - $mystat{'Binlog_cache_disk_use'} ) . " Memory / " . $mystat{'Binlog_cache_use'} . " Total)"; push( @generalrec, "Increase binlog_cache_size (current value: " . $myvar{'binlog_cache_size'} . ")" ); push( @adjvars, "binlog_cache_size (" . hr_bytes( $myvar{'binlog_cache_size'} + 16 * 1024 * 1024 ) . ")" ); } else { goodprint "Binlog cache memory access: " . $mycalc{'pct_binlog_cache'} . "% (" . ( $mystat{'Binlog_cache_use'} - $mystat{'Binlog_cache_disk_use'} ) . " Memory / " . $mystat{'Binlog_cache_use'} . " Total)"; debugprint "Not enough data to validate binlog cache size\n" if $mystat{'Binlog_cache_use'} < 10; } } # Performance options if ( !mysql_version_ge( 5, 1 ) ) { push( @generalrec, "Upgrade to MySQL 5.5+ to use asynchronous write" ); } elsif ( $myvar{'concurrent_insert'} eq "OFF" ) { push( @generalrec, "Enable concurrent_insert by setting it to 'ON'" ); } elsif ( $myvar{'concurrent_insert'} eq 0 ) { push( @generalrec, "Enable concurrent_insert by setting it to 1" ); } } # Recommendations for MyISAM sub mysql_myisam { return 0 unless ( $opt{'myisamstat'} > 0 ); subheaderprint "MyISAM Metrics"; my $nb_myisam_tables = select_one( "SELECT COUNT(*) FROM information_schema.TABLES WHERE ENGINE='MyISAM' and TABLE_SCHEMA NOT IN ('mysql','information_schema','performance_schema')" ); push( @generalrec, "MyISAM engine is deprecated, consider migrating to InnoDB" ) if $nb_myisam_tables > 0; if ( $nb_myisam_tables > 0 ) { badprint "Consider migrating $nb_myisam_tables following tables to InnoDB:"; my $sql_mig = ""; for my $myisam_table ( select_array( "SELECT CONCAT(TABLE_SCHEMA, '.', TABLE_NAME) FROM information_schema.TABLES WHERE ENGINE='MyISAM' and TABLE_SCHEMA NOT IN ('mysql','information_schema','performance_schema')" ) ) { $sql_mig = "${sql_mig}-- InnoDB migration for $myisam_table\nALTER TABLE $myisam_table ENGINE=InnoDB;\n\n"; infoprint "* InnoDB migration request for $myisam_table Table: ALTER TABLE $myisam_table ENGINE=InnoDB;"; } dump_into_file( "migrate_myisam_to_innodb.sql", $sql_mig ); } infoprint("General MyIsam metrics:"); infoprint " +-- Total MyISAM Tables : $nb_myisam_tables"; infoprint " +-- Total MyISAM indexes : " . hr_bytes( $mycalc{'total_myisam_indexes'} ) if defined( $mycalc{'total_myisam_indexes'} ); infoprint " +-- KB Size :" . hr_bytes( $myvar{'key_buffer_size'} ); infoprint " +-- KB Used Size :" . hr_bytes( $myvar{'key_buffer_size'} - $mystat{'Key_blocks_unused'} * $myvar{'key_cache_block_size'} ); infoprint " +-- KB used :" . $mycalc{'pct_key_buffer_used'} . "%"; infoprint " +-- Read KB hit rate: $mycalc{'pct_keys_from_mem'}% (" . hr_num( $mystat{'Key_read_requests'} ) . " cached / " . hr_num( $mystat{'Key_reads'} ) . " reads)"; infoprint " +-- Write KB hit rate: $mycalc{'pct_wkeys_from_mem'}% (" . hr_num( $mystat{'Key_write_requests'} ) . " cached / " . hr_num( $mystat{'Key_writes'} ) . " writes)"; if ( $nb_myisam_tables == 0 ) { infoprint "No MyISAM table(s) detected ...."; return; } if ( mysql_version_ge(8) and mysql_version_le(10) ) { infoprint "MyISAM Metrics are disabled since MySQL 8.0."; if ( $myvar{'key_buffer_size'} > 0 ) { push( @adjvars, "key_buffer_size=0" ); push( @generalrec, "Buffer Key MyISAM set to 0, no MyISAM table detected" ); } return; } if ( !defined( $mycalc{'total_myisam_indexes'} ) ) { badprint "Unable to calculate MyISAM index size on MySQL server < 5.0.0"; push( @generalrec, "Unable to calculate MyISAM index size on MySQL server < 5.0.0" ); return; } if ( $mycalc{'pct_key_buffer_used'} == 0 ) { # No queries have run that would use keys infoprint "Key buffer used: $mycalc{'pct_key_buffer_used'}% (" . hr_bytes( $myvar{'key_buffer_size'} - $mystat{'Key_blocks_unused'} * $myvar{'key_cache_block_size'} ) . " used / " . hr_bytes( $myvar{'key_buffer_size'} ) . " cache)"; infoprint "No SQL statement based on MyISAM table(s) detected ...."; return; } # Key buffer usage if ( $mycalc{'pct_key_buffer_used'} < 90 ) { badprint "Key buffer used: $mycalc{'pct_key_buffer_used'}% (" . hr_bytes( $myvar{'key_buffer_size'} - $mystat{'Key_blocks_unused'} * $myvar{'key_cache_block_size'} ) . " used / " . hr_bytes( $myvar{'key_buffer_size'} ) . " cache)"; push( @adjvars, "key_buffer_size (\~ " . hr_num( $myvar{'key_buffer_size'} * $mycalc{'pct_key_buffer_used'} / 100 ) . ")" ); } else { goodprint "Key buffer used: $mycalc{'pct_key_buffer_used'}% (" . hr_bytes( $myvar{'key_buffer_size'} - $mystat{'Key_blocks_unused'} * $myvar{'key_cache_block_size'} ) . " used / " . hr_bytes( $myvar{'key_buffer_size'} ) . " cache)"; } # Key buffer size / total MyISAM indexes if ( $myvar{'key_buffer_size'} < $mycalc{'total_myisam_indexes'} && $mycalc{'pct_keys_from_mem'} < 95 ) { badprint "Key buffer size / total MyISAM indexes: " . hr_bytes( $myvar{'key_buffer_size'} ) . "/" . hr_bytes( $mycalc{'total_myisam_indexes'} ) . ""; push( @adjvars, "key_buffer_size (> " . hr_bytes( $mycalc{'total_myisam_indexes'} ) . ")" ); } else { goodprint "Key buffer size / total MyISAM indexes: " . hr_bytes( $myvar{'key_buffer_size'} ) . "/" . hr_bytes( $mycalc{'total_myisam_indexes'} ) . ""; } if ( $mystat{'Key_read_requests'} > 0 ) { if ( $mycalc{'pct_keys_from_mem'} < 95 ) { badprint "Read Key buffer hit rate: $mycalc{'pct_keys_from_mem'}% (" . hr_num( $mystat{'Key_read_requests'} ) . " cached / " . hr_num( $mystat{'Key_reads'} ) . " reads)"; } else { goodprint "Read Key buffer hit rate: $mycalc{'pct_keys_from_mem'}% (" . hr_num( $mystat{'Key_read_requests'} ) . " cached / " . hr_num( $mystat{'Key_reads'} ) . " reads)"; } } # No queries have run that would use keys debugprint "Key buffer size / total MyISAM indexes: " . hr_bytes( $myvar{'key_buffer_size'} ) . "/" . hr_bytes( $mycalc{'total_myisam_indexes'} ) . ""; if ( $mystat{'Key_write_requests'} > 0 ) { if ( $mycalc{'pct_wkeys_from_mem'} < 95 ) { badprint "Write Key buffer hit rate: $mycalc{'pct_wkeys_from_mem'}% (" . hr_num( $mystat{'Key_write_requests'} ) . " cached / " . hr_num( $mystat{'Key_writes'} ) . " writes)"; } else { goodprint "Write Key buffer hit rate: $mycalc{'pct_wkeys_from_mem'}% (" . hr_num( $mystat{'Key_write_requests'} ) . " cached / " . hr_num( $mystat{'Key_writes'} ) . " writes)"; } } else { # No queries have run that would use keys debugprint "Write Key buffer hit rate: $mycalc{'pct_wkeys_from_mem'}% (" . hr_num( $mystat{'Key_write_requests'} ) . " cached / " . hr_num( $mystat{'Key_writes'} ) . " writes)"; } } # Recommendations for ThreadPool sub mariadb_threadpool { subheaderprint "ThreadPool Metrics"; # MariaDB unless ( defined $myvar{'have_threadpool'} && $myvar{'have_threadpool'} eq "YES" ) { infoprint "ThreadPool stat is disabled."; return; } infoprint "ThreadPool stat is enabled."; infoprint "Thread Pool Size: " . $myvar{'thread_pool_size'} . " thread(s)."; if ( $myvar{'version'} =~ /percona/i or $myvar{'version_comment'} =~ /percona/i ) { my $np = cpu_cores; if ( $myvar{'thread_pool_size'} >= $np and $myvar{'thread_pool_size'} < ( $np * 1.5 ) ) { goodprint "thread_pool_size for Percona between 1 and 1.5 times number of CPUs (" . $np . " and " . ( $np * 1.5 ) . ")"; } else { badprint "thread_pool_size for Percona between 1 and 1.5 times number of CPUs (" . $np . " and " . ( $np * 1.5 ) . ")"; push( @adjvars, "thread_pool_size between " . $np . " and " . ( $np * 1.5 ) . " for InnoDB usage" ); } return; } if ( $myvar{'version'} =~ /mariadb/i ) { infoprint "Using default value is good enough for your version (" . $myvar{'version'} . ")"; return; } if ( $myvar{'have_innodb'} eq 'YES' ) { if ( $myvar{'thread_pool_size'} < 16 or $myvar{'thread_pool_size'} > 36 ) { badprint "thread_pool_size between 16 and 36 when using InnoDB storage engine."; push( @generalrec, "Thread pool size for InnoDB usage (" . $myvar{'thread_pool_size'} . ")" ); push( @adjvars, "thread_pool_size between 16 and 36 for InnoDB usage" ); } else { goodprint "thread_pool_size between 16 and 36 when using InnoDB storage engine."; } return; } if ( $myvar{'have_isam'} eq 'YES' ) { if ( $myvar{'thread_pool_size'} < 4 or $myvar{'thread_pool_size'} > 8 ) { badprint "thread_pool_size between 4 and 8 when using MyISAM storage engine."; push( @generalrec, "Thread pool size for MyISAM usage (" . $myvar{'thread_pool_size'} . ")" ); push( @adjvars, "thread_pool_size between 4 and 8 for MyISAM usage" ); } else { goodprint "thread_pool_size between 4 and 8 when using MyISAM storage engine."; } } } sub get_pf_memory { # Performance Schema return 0 unless defined $myvar{'performance_schema'}; return 0 if $myvar{'performance_schema'} eq 'OFF'; my @infoPFSMemory = grep { /\tperformance_schema[.]memory\t/msx } select_array("SHOW ENGINE PERFORMANCE_SCHEMA STATUS"); @infoPFSMemory == 1 || return 0; $infoPFSMemory[0] =~ s/.*\s+(\d+)$/$1/g; return $infoPFSMemory[0]; } # Recommendations for Performance Schema sub mysql_pfs { subheaderprint "Performance schema"; # Performance Schema debugprint "Performance schema is " . $myvar{'performance_schema'}; $myvar{'performance_schema'} = 'OFF' unless defined( $myvar{'performance_schema'} ); if ( $myvar{'performance_schema'} eq 'OFF' ) { badprint "Performance_schema should be activated."; push( @adjvars, "performance_schema=ON" ); push( @generalrec, "Performance schema should be activated for better diagnostics" ); } if ( $myvar{'performance_schema'} eq 'ON' ) { infoprint "Performance_schema is activated."; debugprint "Performance schema is " . $myvar{'performance_schema'}; infoprint "Memory used by Performance_schema: " . hr_bytes( get_pf_memory() ); } unless ( grep /^sys$/, select_array("SHOW DATABASES") ) { infoprint "Sys schema is not installed."; push( @generalrec, mysql_version_ge( 10, 0 ) ? "Consider installing Sys schema from https://github.com/FromDual/mariadb-sys for MariaDB" : "Consider installing Sys schema from https://github.com/mysql/mysql-sys for MySQL" ) unless ( mysql_version_le( 5, 6 ) ); return; } infoprint "Sys schema is installed."; return if ( $opt{pfstat} == 0 or $myvar{'performance_schema'} ne 'ON' ); infoprint "Sys schema Version: " . select_one("select sys_version from sys.version"); # Store all sys schema in dumpdir if defined if ( defined $opt{dumpdir} and -d "$opt{dumpdir}" ) { for my $sys_view ( select_array('use sys;show tables;') ) { infoprint "Dumping $sys_view into $opt{dumpdir}"; my $sys_view_table = $sys_view; $sys_view_table =~ s/\$/\\\$/g; select_csv_file( "$opt{dumpdir}/sys_$sys_view.csv", 'select * from sys.\`' . $sys_view_table . '\`' ); } return; #exit 0 if ( $opt{stop} == 1 ); } # Top user per connection subheaderprint "Performance schema: Top 5 user per connection"; my $nbL = 1; for my $lQuery ( select_array( 'select user, total_connections from sys.user_summary order by total_connections desc LIMIT 5' ) ) { infoprint " +-- $nbL: $lQuery conn(s)"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top user per statement subheaderprint "Performance schema: Top 5 user per statement"; $nbL = 1; for my $lQuery ( select_array( 'select user, statements from sys.user_summary order by statements desc LIMIT 5' ) ) { infoprint " +-- $nbL: $lQuery stmt(s)"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top user per statement latency subheaderprint "Performance schema: Top 5 user per statement latency"; $nbL = 1; for my $lQuery ( select_array( 'select user, statement_avg_latency from sys.x\\$user_summary order by statement_avg_latency desc LIMIT 5' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top user per lock latency subheaderprint "Performance schema: Top 5 user per lock latency"; $nbL = 1; for my $lQuery ( select_array( 'select user, lock_latency from sys.x\\$user_summary_by_statement_latency order by lock_latency desc LIMIT 5' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top user per full scans subheaderprint "Performance schema: Top 5 user per nb full scans"; $nbL = 1; for my $lQuery ( select_array( 'select user, full_scans from sys.x\\$user_summary_by_statement_latency order by full_scans desc LIMIT 5' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top user per row_sent subheaderprint "Performance schema: Top 5 user per rows sent"; $nbL = 1; for my $lQuery ( select_array( 'select user, rows_sent from sys.x\\$user_summary_by_statement_latency order by rows_sent desc LIMIT 5' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top user per row modified subheaderprint "Performance schema: Top 5 user per rows modified"; $nbL = 1; for my $lQuery ( select_array( 'select user, rows_affected from sys.x\\$user_summary_by_statement_latency order by rows_affected desc LIMIT 5' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top user per io subheaderprint "Performance schema: Top 5 user per IO"; $nbL = 1; for my $lQuery ( select_array( 'select user, file_ios from sys.x\\$user_summary order by file_ios desc LIMIT 5' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top user per io latency subheaderprint "Performance schema: Top 5 user per IO latency"; $nbL = 1; for my $lQuery ( select_array( 'select user, file_io_latency from sys.x\\$user_summary order by file_io_latency desc LIMIT 5' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top host per connection subheaderprint "Performance schema: Top 5 host per connection"; $nbL = 1; for my $lQuery ( select_array( 'select host, total_connections from sys.x\\$host_summary order by total_connections desc LIMIT 5' ) ) { infoprint " +-- $nbL: $lQuery conn(s)"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top host per statement subheaderprint "Performance schema: Top 5 host per statement"; $nbL = 1; for my $lQuery ( select_array( 'select host, statements from sys.x\\$host_summary order by statements desc LIMIT 5' ) ) { infoprint " +-- $nbL: $lQuery stmt(s)"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top host per statement latency subheaderprint "Performance schema: Top 5 host per statement latency"; $nbL = 1; for my $lQuery ( select_array( 'select host, statement_avg_latency from sys.x\\$host_summary order by statement_avg_latency desc LIMIT 5' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top host per lock latency subheaderprint "Performance schema: Top 5 host per lock latency"; $nbL = 1; for my $lQuery ( select_array( 'select host, lock_latency from sys.x\\$host_summary_by_statement_latency order by lock_latency desc LIMIT 5' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top host per full scans subheaderprint "Performance schema: Top 5 host per nb full scans"; $nbL = 1; for my $lQuery ( select_array( 'select host, full_scans from sys.x\\$host_summary_by_statement_latency order by full_scans desc LIMIT 5' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top host per rows sent subheaderprint "Performance schema: Top 5 host per rows sent"; $nbL = 1; for my $lQuery ( select_array( 'select host, rows_sent from sys.x\\$host_summary_by_statement_latency order by rows_sent desc LIMIT 5' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top host per rows modified subheaderprint "Performance schema: Top 5 host per rows modified"; $nbL = 1; for my $lQuery ( select_array( 'select host, rows_affected from sys.x\\$host_summary_by_statement_latency order by rows_affected desc LIMIT 5' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top host per io subheaderprint "Performance schema: Top 5 host per io"; $nbL = 1; for my $lQuery ( select_array( 'select host, file_ios from sys.x\\$host_summary order by file_ios desc LIMIT 5' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top 5 host per io latency subheaderprint "Performance schema: Top 5 host per io latency"; $nbL = 1; for my $lQuery ( select_array( 'select host, file_io_latency from sys.x\\$host_summary order by file_io_latency desc LIMIT 5' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top IO type order by total io subheaderprint "Performance schema: Top IO type order by total io"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select substring(event_name,14), SUM(total)AS total from sys.x\\$host_summary_by_file_io_type GROUP BY substring(event_name,14) ORDER BY total DESC;' ) ) { infoprint " +-- $nbL: $lQuery i/o"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top IO type order by total latency subheaderprint "Performance schema: Top IO type order by total latency"; $nbL = 1; for my $lQuery ( select_array( 'select substring(event_name,14), ROUND(SUM(total_latency),1) AS total_latency from sys.x\\$host_summary_by_file_io_type GROUP BY substring(event_name,14) ORDER BY total_latency DESC;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top IO type order by max latency subheaderprint "Performance schema: Top IO type order by max latency"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select substring(event_name,14), MAX(max_latency) as max_latency from sys.x\\$host_summary_by_file_io_type GROUP BY substring(event_name,14) ORDER BY max_latency DESC;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top Stages order by total io subheaderprint "Performance schema: Top Stages order by total io"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select substring(event_name,7), SUM(total)AS total from sys.x\\$host_summary_by_stages GROUP BY substring(event_name,7) ORDER BY total DESC;' ) ) { infoprint " +-- $nbL: $lQuery i/o"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top Stages order by total latency subheaderprint "Performance schema: Top Stages order by total latency"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select substring(event_name,7), ROUND(SUM(total_latency),1) AS total_latency from sys.x\\$host_summary_by_stages GROUP BY substring(event_name,7) ORDER BY total_latency DESC;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top Stages order by avg latency subheaderprint "Performance schema: Top Stages order by avg latency"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select substring(event_name,7), MAX(avg_latency) as avg_latency from sys.x\\$host_summary_by_stages GROUP BY substring(event_name,7) ORDER BY avg_latency DESC;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top host per table scans subheaderprint "Performance schema: Top 5 host per table scans"; $nbL = 1; for my $lQuery ( select_array( 'select host, table_scans from sys.x\\$host_summary order by table_scans desc LIMIT 5' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # InnoDB Buffer Pool by schema subheaderprint "Performance schema: InnoDB Buffer Pool by schema"; $nbL = 1; for my $lQuery ( select_array( 'select object_schema, allocated, data, pages from sys.x\\$innodb_buffer_stats_by_schema ORDER BY pages DESC' ) ) { infoprint " +-- $nbL: $lQuery page(s)"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # InnoDB Buffer Pool by table subheaderprint "Performance schema: 40 InnoDB Buffer Pool by table"; $nbL = 1; for my $lQuery ( select_array( 'select object_schema, object_name, allocated,data, pages from sys.x\\$innodb_buffer_stats_by_table ORDER BY pages DESC LIMIT 40' ) ) { infoprint " +-- $nbL: $lQuery page(s)"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Process per allocated memory subheaderprint "Performance schema: Process per time"; $nbL = 1; for my $lQuery ( select_array( 'select user, Command AS PROC, time from sys.x\\$processlist ORDER BY time DESC;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # InnoDB Lock Waits subheaderprint "Performance schema: InnoDB Lock Waits"; $nbL = 1; for my $lQuery ( select_array( 'select wait_age_secs, locked_table, locked_type, waiting_query from sys.x\\$innodb_lock_waits order by wait_age_secs DESC;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Threads IO Latency subheaderprint "Performance schema: Thread IO Latency"; $nbL = 1; for my $lQuery ( select_array( 'select user, total_latency, max_latency from sys.x\\$io_by_thread_by_latency order by total_latency DESC;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # High Cost SQL statements subheaderprint "Performance schema: Top 15 Most latency statements"; $nbL = 1; for my $lQuery ( select_array( 'select LEFT(query, 120), avg_latency from sys.x\\$statement_analysis order by avg_latency desc LIMIT 15' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top 5% slower queries subheaderprint "Performance schema: Top 15 slower queries"; $nbL = 1; for my $lQuery ( select_array( 'select LEFT(query, 120), exec_count from sys.x\\$statements_with_runtimes_in_95th_percentile order by exec_count desc LIMIT 15' ) ) { infoprint " +-- $nbL: $lQuery s"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top 10 nb statement type subheaderprint "Performance schema: Top 15 nb statement type"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select statement, sum(total) as total from sys.x\\$host_summary_by_statement_type group by statement order by total desc LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top statement by total latency subheaderprint "Performance schema: Top 15 statement by total latency"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select statement, sum(total_latency) as total from sys.x\\$host_summary_by_statement_type group by statement order by total desc LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top statement by lock latency subheaderprint "Performance schema: Top 15 statement by lock latency"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select statement, sum(lock_latency) as total from sys.x\\$host_summary_by_statement_type group by statement order by total desc LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top statement by full scans subheaderprint "Performance schema: Top 15 statement by full scans"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select statement, sum(full_scans) as total from sys.x\\$host_summary_by_statement_type group by statement order by total desc LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top statement by rows sent subheaderprint "Performance schema: Top 15 statement by rows sent"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select statement, sum(rows_sent) as total from sys.x\\$host_summary_by_statement_type group by statement order by total desc LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top statement by rows modified subheaderprint "Performance schema: Top 15 statement by rows modified"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select statement, sum(rows_affected) as total from sys.x\\$host_summary_by_statement_type group by statement order by total desc LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Use temporary tables subheaderprint "Performance schema: 15 sample queries using temp table"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select left(query, 120) from sys.x\\$statements_with_temp_tables LIMIT 15' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Unused Indexes subheaderprint "Performance schema: Unused indexes"; $nbL = 1; for my $lQuery ( select_array( "select \* from sys.schema_unused_indexes where object_schema not in ('performance_schema')" ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Full table scans subheaderprint "Performance schema: Tables with full table scans"; $nbL = 1; for my $lQuery ( select_array( 'select * from sys.x\\$schema_tables_with_full_table_scans order by rows_full_scanned DESC' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Latest file IO by latency subheaderprint "Performance schema: Latest File IO by latency"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select thread, file, latency, operation from sys.x\\$latest_file_io ORDER BY latency LIMIT 10;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # FILE by IO read bytes subheaderprint "Performance schema: File by IO read bytes"; $nbL = 1; for my $lQuery ( select_array( 'select file, total_read from sys.x\\$io_global_by_file_by_bytes order by total_read DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # FILE by IO written bytes subheaderprint "Performance schema: File by IO written bytes"; $nbL = 1; for my $lQuery ( select_array( 'select file, total_written from sys.x\\$io_global_by_file_by_bytes order by total_written DESC LIMIT 15' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # file per IO total latency subheaderprint "Performance schema: File per IO total latency"; $nbL = 1; for my $lQuery ( select_array( 'select file, total_latency from sys.x\\$io_global_by_file_by_latency ORDER BY total_latency DESC LIMIT 20;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # file per IO read latency subheaderprint "Performance schema: file per IO read latency"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select file, read_latency from sys.x\\$io_global_by_file_by_latency ORDER BY read_latency DESC LIMIT 20;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # file per IO write latency subheaderprint "Performance schema: file per IO write latency"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select file, write_latency from sys.x\\$io_global_by_file_by_latency ORDER BY write_latency DESC LIMIT 20;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Event Wait by read bytes subheaderprint "Performance schema: Event Wait by read bytes"; $nbL = 1; for my $lQuery ( select_array( 'select event_name, total_read from sys.x\\$io_global_by_wait_by_bytes order by total_read DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Event Wait by write bytes subheaderprint "Performance schema: Event Wait written bytes"; $nbL = 1; for my $lQuery ( select_array( 'select event_name, total_written from sys.x\\$io_global_by_wait_by_bytes order by total_written DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # event per wait total latency subheaderprint "Performance schema: event per wait total latency"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select event_name, total_latency from sys.x\\$io_global_by_wait_by_latency ORDER BY total_latency DESC LIMIT 20;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # event per wait read latency subheaderprint "Performance schema: event per wait read latency"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select event_name, read_latency from sys.x\\$io_global_by_wait_by_latency ORDER BY read_latency DESC LIMIT 20;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # event per wait write latency subheaderprint "Performance schema: event per wait write latency"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select event_name, write_latency from sys.x\\$io_global_by_wait_by_latency ORDER BY write_latency DESC LIMIT 20;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); #schema_index_statistics # TOP 15 most read index subheaderprint "Performance schema: Top 15 most read indexes"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select table_schema, table_name,index_name, rows_selected from sys.x\\$schema_index_statistics ORDER BY ROWs_selected DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # TOP 15 most used index subheaderprint "Performance schema: Top 15 most modified indexes"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select table_schema, table_name,index_name, rows_inserted+rows_updated+rows_deleted AS changes from sys.x\\$schema_index_statistics ORDER BY rows_inserted+rows_updated+rows_deleted DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # TOP 15 high read latency index subheaderprint "Performance schema: Top 15 high read latency index"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select table_schema, table_name,index_name, select_latency from sys.x\\$schema_index_statistics ORDER BY select_latency DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # TOP 15 high insert latency index subheaderprint "Performance schema: Top 15 most modified indexes"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select table_schema, table_name,index_name, insert_latency from sys.x\\$schema_index_statistics ORDER BY insert_latency DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # TOP 15 high update latency index subheaderprint "Performance schema: Top 15 high update latency index"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select table_schema, table_name,index_name, update_latency from sys.x\\$schema_index_statistics ORDER BY update_latency DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # TOP 15 high delete latency index subheaderprint "Performance schema: Top 15 high delete latency index"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select table_schema, table_name,index_name, delete_latency from sys.x\\$schema_index_statistics ORDER BY delete_latency DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # TOP 15 most read tables subheaderprint "Performance schema: Top 15 most read tables"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select table_schema, table_name, rows_fetched from sys.x\\$schema_table_statistics ORDER BY ROWs_fetched DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # TOP 15 most used tables subheaderprint "Performance schema: Top 15 most modified tables"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select table_schema, table_name, rows_inserted+rows_updated+rows_deleted AS changes from sys.x\\$schema_table_statistics ORDER BY rows_inserted+rows_updated+rows_deleted DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # TOP 15 high read latency tables subheaderprint "Performance schema: Top 15 high read latency tables"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select table_schema, table_name, fetch_latency from sys.x\\$schema_table_statistics ORDER BY fetch_latency DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # TOP 15 high insert latency tables subheaderprint "Performance schema: Top 15 high insert latency tables"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select table_schema, table_name, insert_latency from sys.x\\$schema_table_statistics ORDER BY insert_latency DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # TOP 15 high update latency tables subheaderprint "Performance schema: Top 15 high update latency tables"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select table_schema, table_name, update_latency from sys.x\\$schema_table_statistics ORDER BY update_latency DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # TOP 15 high delete latency tables subheaderprint "Performance schema: Top 15 high delete latency tables"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select table_schema, table_name, delete_latency from sys.x\\$schema_table_statistics ORDER BY delete_latency DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Redundant indexes subheaderprint "Performance schema: Redundant indexes"; $nbL = 1; for my $lQuery ( select_array('use sys;select * from schema_redundant_indexes;') ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Table not using InnoDB buffer"; $nbL = 1; for my $lQuery ( select_array( ' Select table_schema, table_name from sys.x\\$schema_table_statistics_with_buffer where innodb_buffer_allocated IS NULL;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 15 Tables using InnoDB buffer"; $nbL = 1; for my $lQuery ( select_array( 'select table_schema,table_name,innodb_buffer_allocated from sys.x\\$schema_table_statistics_with_buffer where innodb_buffer_allocated IS NOT NULL ORDER BY innodb_buffer_allocated DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 15 Tables with InnoDB buffer free"; $nbL = 1; for my $lQuery ( select_array( 'select table_schema,table_name,innodb_buffer_free from sys.x\\$schema_table_statistics_with_buffer where innodb_buffer_allocated IS NOT NULL ORDER BY innodb_buffer_free DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 15 Most executed queries"; $nbL = 1; for my $lQuery ( select_array( 'select db, LEFT(query, 120), exec_count from sys.x\\$statement_analysis order by exec_count DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Latest SQL queries in errors or warnings"; $nbL = 1; for my $lQuery ( select_array( 'select LEFT(query, 120), last_seen from sys.x\\$statements_with_errors_or_warnings ORDER BY last_seen LIMIT 40;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 20 queries with full table scans"; $nbL = 1; for my $lQuery ( select_array( 'select db, LEFT(query, 120), exec_count from sys.x\\$statements_with_full_table_scans order BY exec_count DESC LIMIT 20;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Last 50 queries with full table scans"; $nbL = 1; for my $lQuery ( select_array( 'select db, LEFT(query, 120), last_seen from sys.x\\$statements_with_full_table_scans order BY last_seen DESC LIMIT 50;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 15 reader queries (95% percentile)"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select db, LEFT(query, 120), rows_sent from sys.x\\$statements_with_runtimes_in_95th_percentile ORDER BY ROWs_sent DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 15 most row look queries (95% percentile)"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select db, LEFT(query, 120), rows_examined AS search from sys.x\\$statements_with_runtimes_in_95th_percentile ORDER BY rows_examined DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 15 total latency queries (95% percentile)"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select db, LEFT(query, 120), total_latency AS search from sys.x\\$statements_with_runtimes_in_95th_percentile ORDER BY total_latency DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 15 max latency queries (95% percentile)"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select db, LEFT(query, 120), max_latency AS search from sys.x\\$statements_with_runtimes_in_95th_percentile ORDER BY max_latency DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 15 average latency queries (95% percentile)"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select db, LEFT(query, 120), avg_latency AS search from sys.x\\$statements_with_runtimes_in_95th_percentile ORDER BY avg_latency DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 20 queries with sort"; $nbL = 1; for my $lQuery ( select_array( 'select db, LEFT(query, 120), exec_count from sys.x\\$statements_with_sorting order BY exec_count DESC LIMIT 20;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Last 50 queries with sort"; $nbL = 1; for my $lQuery ( select_array( 'select db, LEFT(query, 120), last_seen from sys.x\\$statements_with_sorting order BY last_seen DESC LIMIT 50;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 15 row sorting queries with sort"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select db, LEFT(query, 120), rows_sorted from sys.x\\$statements_with_sorting ORDER BY ROWs_sorted DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 15 total latency queries with sort"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select db, LEFT(query, 120), total_latency AS search from sys.x\\$statements_with_sorting ORDER BY total_latency DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 15 merge queries with sort"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select db, LEFT(query, 120), sort_merge_passes AS search from sys.x\\$statements_with_sorting ORDER BY sort_merge_passes DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 15 average sort merges queries with sort"; $nbL = 1; for my $lQuery ( select_array( 'select db, LEFT(query, 120), avg_sort_merges AS search from sys.x\\$statements_with_sorting ORDER BY avg_sort_merges DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 15 scans queries with sort"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select db, LEFT(query, 120), sorts_using_scans AS search from sys.x\\$statements_with_sorting ORDER BY sorts_using_scans DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 15 range queries with sort"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select db, LEFT(query, 120), sort_using_range AS search from sys.x\\$statements_with_sorting ORDER BY sort_using_range DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); ################################################################################## #statements_with_temp_tables #mysql> desc statements_with_temp_tables; #+--------------------------+---------------------+------+-----+---------------------+-------+ #| Field | Type | Null | Key | Default | Extra | #+--------------------------+---------------------+------+-----+---------------------+-------+ #| query | longtext | YES | | NULL | | #| db | varchar(64) | YES | | NULL | | #| exec_count | bigint(20) unsigned | NO | | NULL | | #| total_latency | text | YES | | NULL | | #| memory_tmp_tables | bigint(20) unsigned | NO | | NULL | | #| disk_tmp_tables | bigint(20) unsigned | NO | | NULL | | #| avg_tmp_tables_per_query | decimal(21,0) | NO | | 0 | | #| tmp_tables_to_disk_pct | decimal(24,0) | NO | | 0 | | #| first_seen | timestamp | NO | | 0000-00-00 00:00:00 | | #| last_seen | timestamp | NO | | 0000-00-00 00:00:00 | | #| digest | varchar(32) | YES | | NULL | | #+--------------------------+---------------------+------+-----+---------------------+-------+ #11 rows in set (0,01 sec)# # subheaderprint "Performance schema: Top 20 queries with temp table"; $nbL = 1; for my $lQuery ( select_array( 'select db, LEFT(query, 120), exec_count from sys.x\\$statements_with_temp_tables order BY exec_count DESC LIMIT 20;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Last 50 queries with temp table"; $nbL = 1; for my $lQuery ( select_array( 'select db, LEFT(query, 120), last_seen from sys.x\\$statements_with_temp_tables order BY last_seen DESC LIMIT 50;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 15 total latency queries with temp table"; $nbL = 1; for my $lQuery ( select_array( 'select db, LEFT(query, 120), total_latency AS search from sys.x\\$statements_with_temp_tables ORDER BY total_latency DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 15 queries with temp table to disk"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select db, LEFT(query, 120), disk_tmp_tables from sys.x\\$statements_with_temp_tables ORDER BY disk_tmp_tables DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); ################################################################################## #wait_classes_global_by_latency #mysql> select * from wait_classes_global_by_latency; #-----------------+-------+---------------+-------------+-------------+-------------+ # event_class | total | total_latency | min_latency | avg_latency | max_latency | #-----------------+-------+---------------+-------------+-------------+-------------+ # wait/io/file | 15381 | 1.23 s | 0 ps | 80.12 us | 230.64 ms | # wait/io/table | 59 | 7.57 ms | 5.45 us | 128.24 us | 3.95 ms | # wait/lock/table | 69 | 3.22 ms | 658.84 ns | 46.64 us | 1.10 ms | #-----------------+-------+---------------+-------------+-------------+-------------+ # rows in set (0,00 sec) subheaderprint "Performance schema: Top 15 class events by number"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select event_class, total from sys.x\\$wait_classes_global_by_latency ORDER BY total DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 30 events by number"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select events, total from sys.x\\$waits_global_by_latency ORDER BY total DESC LIMIT 30;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 15 class events by total latency"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select event_class, total_latency from sys.x\\$wait_classes_global_by_latency ORDER BY total_latency DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 30 events by total latency"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select events, total_latency from sys.x\\$waits_global_by_latency ORDER BY total_latency DESC LIMIT 30;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 15 class events by max latency"; $nbL = 1; for my $lQuery ( select_array( 'select event_class, max_latency from sys.x\\$wait_classes_global_by_latency ORDER BY max_latency DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 30 events by max latency"; $nbL = 1; for my $lQuery ( select_array( 'select events, max_latency from sys.x\\$waits_global_by_latency ORDER BY max_latency DESC LIMIT 30;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); } # Recommendations for Aria Engine sub mariadb_aria { subheaderprint "Aria Metrics"; # Aria if ( !defined $myvar{'have_aria'} ) { infoprint "Aria Storage Engine not available."; return; } if ( $myvar{'have_aria'} ne "YES" ) { infoprint "Aria Storage Engine is disabled."; return; } infoprint "Aria Storage Engine is enabled."; # Aria pagecache if ( !defined( $mycalc{'total_aria_indexes'} ) ) { push( @generalrec, "Unable to calculate Aria index size on MySQL server" ); } else { if ( $myvar{'aria_pagecache_buffer_size'} < $mycalc{'total_aria_indexes'} && $mycalc{'pct_aria_keys_from_mem'} < 95 ) { badprint "Aria pagecache size / total Aria indexes: " . hr_bytes( $myvar{'aria_pagecache_buffer_size'} ) . "/" . hr_bytes( $mycalc{'total_aria_indexes'} ) . ""; push( @adjvars, "aria_pagecache_buffer_size (> " . hr_bytes( $mycalc{'total_aria_indexes'} ) . ")" ); } else { goodprint "Aria pagecache size / total Aria indexes: " . hr_bytes( $myvar{'aria_pagecache_buffer_size'} ) . "/" . hr_bytes( $mycalc{'total_aria_indexes'} ) . ""; } if ( $mystat{'Aria_pagecache_read_requests'} > 0 ) { if ( $mycalc{'pct_aria_keys_from_mem'} < 95 ) { badprint "Aria pagecache hit rate: $mycalc{'pct_aria_keys_from_mem'}% (" . hr_num( $mystat{'Aria_pagecache_read_requests'} ) . " cached / " . hr_num( $mystat{'Aria_pagecache_reads'} ) . " reads)"; } else { goodprint "Aria pagecache hit rate: $mycalc{'pct_aria_keys_from_mem'}% (" . hr_num( $mystat{'Aria_pagecache_read_requests'} ) . " cached / " . hr_num( $mystat{'Aria_pagecache_reads'} ) . " reads)"; } } else { # No queries have run that would use keys } } } # Recommendations for TokuDB sub mariadb_tokudb { subheaderprint "TokuDB Metrics"; # AriaDB unless ( defined $myvar{'have_tokudb'} && $myvar{'have_tokudb'} eq "YES" ) { infoprint "TokuDB is disabled."; return; } infoprint "TokuDB is enabled."; # Not implemented } # Recommendations for XtraDB sub mariadb_xtradb { subheaderprint "XtraDB Metrics"; # XtraDB unless ( defined $myvar{'have_xtradb'} && $myvar{'have_xtradb'} eq "YES" ) { infoprint "XtraDB is disabled."; return; } infoprint "XtraDB is enabled."; infoprint "Note that MariaDB 10.2 makes use of InnoDB, not XtraDB." # Not implemented } # Recommendations for RocksDB sub mariadb_rockdb { subheaderprint "RocksDB Metrics"; # RocksDB unless ( defined $myvar{'have_rocksdb'} && $myvar{'have_rocksdb'} eq "YES" ) { infoprint "RocksDB is disabled."; return; } infoprint "RocksDB is enabled."; # Not implemented } # Recommendations for Spider sub mariadb_spider { subheaderprint "Spider Metrics"; # Spider unless ( defined $myvar{'have_spider'} && $myvar{'have_spider'} eq "YES" ) { infoprint "Spider is disabled."; return; } infoprint "Spider is enabled."; # Not implemented } # Recommendations for Connect sub mariadb_connect { subheaderprint "Connect Metrics"; # Connect unless ( defined $myvar{'have_connect'} && $myvar{'have_connect'} eq "YES" ) { infoprint "Connect is disabled."; return; } infoprint "Connect is enabled."; # Not implemented } # Perl trim function to remove whitespace from the start and end of the string sub trim { my $string = shift; return "" unless defined($string); $string =~ s/^\s+//; $string =~ s/\s+$//; return $string; } sub get_wsrep_options { return () unless defined $myvar{'wsrep_provider_options'}; my @galera_options = split /;/, $myvar{'wsrep_provider_options'}; my $wsrep_slave_threads = $myvar{'wsrep_slave_threads'}; push @galera_options, ' wsrep_slave_threads = ' . $wsrep_slave_threads; @galera_options = remove_cr @galera_options; @galera_options = remove_empty @galera_options; #debugprint Dumper( \@galera_options ) if $opt{debug}; return @galera_options; } sub get_gcache_memory { my $gCacheMem = hr_raw( get_wsrep_option('gcache.size') ); return 0 unless defined $gCacheMem and $gCacheMem ne ''; return $gCacheMem; } sub get_wsrep_option { my $key = shift; return '' unless defined $myvar{'wsrep_provider_options'}; my @galera_options = get_wsrep_options; return '' unless scalar(@galera_options) > 0; my @memValues = grep /\s*$key =/, @galera_options; my $memValue = $memValues[0]; return 0 unless defined $memValue; $memValue =~ s/.*=\s*(.+)$/$1/g; return $memValue; } # REcommendations for Tables sub mysql_table_structures { return 0 unless ( $opt{structstat} > 0 ); subheaderprint "Table structures analysis"; my @primaryKeysNbTables = select_array( "Select CONCAT(c.table_schema, ',' , c.table_name) from information_schema.columns c join information_schema.tables t using (TABLE_SCHEMA, TABLE_NAME) where c.table_schema not in ('sys', 'mysql', 'information_schema', 'performance_schema') and t.table_type = 'BASE TABLE' group by c.table_schema,c.table_name having sum(if(c.column_key in ('PRI', 'UNI'), 1, 0)) = 0" ); my $tmpContent = 'Schema,Table'; if ( scalar(@primaryKeysNbTables) > 0 ) { badprint "Following table(s) don't have primary key:"; foreach my $badtable (@primaryKeysNbTables) { badprint "\t$badtable"; push @{ $result{'Tables without PK'} }, $badtable; $tmpContent .= "\n$badtable"; } push @generalrec, "Ensure that all table(s) get an explicit primary keys for performance, maintenance and also for replication"; } else { goodprint "All tables get a primary key"; } dump_into_file( "tables_without_primary_keys.csv", $tmpContent ); my @nonInnoDBTables = select_array( "select CONCAT(table_schema, ',', table_name, ',', ENGINE) FROM information_schema.tables t WHERE ENGINE <> 'InnoDB' and t.table_type = 'BASE TABLE' and table_schema not in ('sys', 'mysql', 'performance_schema', 'information_schema')" ); $tmpContent = 'Schema,Table,Engine'; if ( scalar(@nonInnoDBTables) > 0 ) { badprint "Following table(s) are not InnoDB table:"; push @generalrec, "Ensure that all table(s) are InnoDB tables for performance and also for replication"; foreach my $badtable (@nonInnoDBTables) { if ( $badtable =~ /Memory/i ) { badprint "Table $badtable is a MEMORY table. It's suggested to use only InnoDB tables in production"; } else { badprint "\t$badtable"; } $tmpContent .= "\n$badtable"; } } else { goodprint "All tables are InnoDB tables"; } dump_into_file( "tables_non_innodb.csv", $tmpContent ); my @nonutf8columns = select_array( "SELECT CONCAT(table_schema, ',', table_name, ',', column_name, ',', CHARacter_set_name, ',', COLLATION_name, ',', data_type, ',', CHARACTER_MAXIMUM_LENGTH) from information_schema.columns WHERE table_schema not in ('sys', 'mysql', 'performance_schema', 'information_schema') and (CHARacter_set_name NOT LIKE 'utf8%' or COLLATION_name NOT LIKE 'utf8%');" ); $tmpContent = 'Schema,Table,Column, Charset, Collation, Data Type, Max Length'; if ( scalar(@nonutf8columns) > 0 ) { badprint "Following character columns(s) are not utf8 compliant:"; push @generalrec, "Ensure that all text colums(s) are UTF-8 compliant for encoding support and performance"; foreach my $badtable (@nonutf8columns) { badprint "\t$badtable"; $tmpContent .= "\n$badtable"; } } else { goodprint "All columns are UTF-8 compliant"; } dump_into_file( "columns_non_utf8.csv", $tmpContent ); my @utf8columns = select_array( "SELECT CONCAT(table_schema, ',', table_name, ',', column_name, ',', CHARacter_set_name, ',', COLLATION_name, ',', data_type, ',', CHARACTER_MAXIMUM_LENGTH) from information_schema.columns WHERE table_schema not in ('sys', 'mysql', 'performance_schema', 'information_schema') and (CHARacter_set_name LIKE 'utf8%' or COLLATION_name LIKE 'utf8%');" ); $tmpContent = 'Schema,Table,Column, Charset, Collation, Data Type, Max Length'; foreach my $badtable (@utf8columns) { $tmpContent .= "\n$badtable"; } dump_into_file( "columns_utf8.csv", $tmpContent ); my @ftcolumns = select_array( "SELECT CONCAT(table_schema, ',', table_name, ',', column_name, ',', data_type) from information_schema.columns WHERE table_schema not in ('sys', 'mysql', 'performance_schema', 'information_schema') AND data_type='FULLTEXT';" ); $tmpContent = 'Schema,Table,Column, Data Type'; foreach my $ctable (@ftcolumns) { $tmpContent .= "\n$ctable"; } dump_into_file( "fulltext_columns.csv", $tmpContent ); } # Recommendations for Galera sub mariadb_galera { subheaderprint "Galera Metrics"; # Galera Cluster unless ( defined $myvar{'have_galera'} && $myvar{'have_galera'} eq "YES" ) { infoprint "Galera is disabled."; return; } infoprint "Galera is enabled."; debugprint "Galera variables:"; foreach my $gvar ( keys %myvar ) { next unless $gvar =~ /^wsrep.*/; next if $gvar eq 'wsrep_provider_options'; debugprint "\t" . trim($gvar) . " = " . $myvar{$gvar}; $result{'Galera'}{'variables'}{$gvar} = $myvar{$gvar}; } if ( not defined( $myvar{'wsrep_on'} ) or $myvar{'wsrep_on'} ne "ON" ) { infoprint "Galera is disabled."; return; } debugprint "Galera wsrep provider Options:"; my @galera_options = get_wsrep_options; $result{'Galera'}{'wsrep options'} = get_wsrep_options(); foreach my $gparam (@galera_options) { debugprint "\t" . trim($gparam); } debugprint "Galera status:"; foreach my $gstatus ( keys %mystat ) { next unless $gstatus =~ /^wsrep.*/; debugprint "\t" . trim($gstatus) . " = " . $mystat{$gstatus}; $result{'Galera'}{'status'}{$gstatus} = $myvar{$gstatus}; } infoprint "GCache is using " . hr_bytes_rnd( get_wsrep_option('gcache.mem_size') ); infoprint "CPU cores detected : " . (cpu_cores); infoprint "wsrep_slave_threads: " . get_wsrep_option('wsrep_slave_threads'); if ( get_wsrep_option('wsrep_slave_threads') > ( (cpu_cores) * 4 ) or get_wsrep_option('wsrep_slave_threads') < ( (cpu_cores) * 2 ) ) { badprint "wsrep_slave_threads is not equal to 2, 3 or 4 times the number of CPU(s)"; push @adjvars, "wsrep_slave_threads = " . ( (cpu_cores) * 4 ); } else { goodprint "wsrep_slave_threads is equal to 2, 3 or 4 times the number of CPU(s)"; } if ( get_wsrep_option('wsrep_slave_threads') > 1 ) { infoprint "wsrep parallel slave can cause frequent inconsistency crash."; push @adjvars, "Set wsrep_slave_threads to 1 in case of HA_ERR_FOUND_DUPP_KEY crash on slave"; # check options for parallel slave if ( get_wsrep_option('wsrep_slave_FK_checks') eq "OFF" ) { badprint "wsrep_slave_FK_checks is off with parallel slave"; push @adjvars, "wsrep_slave_FK_checks should be ON when using parallel slave"; } # wsrep_slave_UK_checks seems useless in MySQL source code if ( $myvar{'innodb_autoinc_lock_mode'} != 2 ) { badprint "innodb_autoinc_lock_mode is incorrect with parallel slave"; push @adjvars, "innodb_autoinc_lock_mode should be 2 when using parallel slave"; } } if ( get_wsrep_option('gcs.fc_limit') != $myvar{'wsrep_slave_threads'} * 5 ) { badprint "gcs.fc_limit should be equal to 5 * wsrep_slave_threads (=" . ( $myvar{'wsrep_slave_threads'} * 5 ) . ")"; push @adjvars, "gcs.fc_limit= wsrep_slave_threads * 5 (=" . ( $myvar{'wsrep_slave_threads'} * 5 ) . ")"; } else { goodprint "gcs.fc_limit is equal to 5 * wsrep_slave_threads ( =" . get_wsrep_option('gcs.fc_limit') . ")"; } if ( get_wsrep_option('gcs.fc_factor') != 0.8 ) { badprint "gcs.fc_factor should be equal to 0.8 (=" . get_wsrep_option('gcs.fc_factor') . ")"; push @adjvars, "gcs.fc_factor=0.8"; } else { goodprint "gcs.fc_factor is equal to 0.8"; } if ( get_wsrep_option('wsrep_flow_control_paused') > 0.02 ) { badprint "Fraction of time node pause flow control > 0.02"; } else { goodprint "Flow control fraction seems to be OK (wsrep_flow_control_paused <= 0.02)"; } if ( $myvar{'binlog_format'} ne 'ROW' ) { badprint "Binlog format should be in ROW mode."; push @adjvars, "binlog_format = ROW"; } else { goodprint "Binlog format is in ROW mode."; } if ( $myvar{'innodb_flush_log_at_trx_commit'} != 0 ) { badprint "InnoDB flush log at each commit should be disabled."; push @adjvars, "innodb_flush_log_at_trx_commit = 0"; } else { goodprint "InnoDB flush log at each commit is disabled for Galera."; } infoprint "Read consistency mode :" . $myvar{'wsrep_causal_reads'}; if ( defined( $myvar{'wsrep_cluster_name'} ) and $myvar{'wsrep_on'} eq "ON" ) { goodprint "Galera WsREP is enabled."; if ( defined( $myvar{'wsrep_cluster_address'} ) and trim("$myvar{'wsrep_cluster_address'}") ne "" ) { goodprint "Galera Cluster address is defined: " . $myvar{'wsrep_cluster_address'}; my @NodesTmp = split /,/, $myvar{'wsrep_cluster_address'}; my $nbNodes = @NodesTmp; infoprint "There are $nbNodes nodes in wsrep_cluster_address"; my $nbNodesSize = trim( $mystat{'wsrep_cluster_size'} ); if ( $nbNodesSize == 3 or $nbNodesSize == 5 ) { goodprint "There are $nbNodesSize nodes in wsrep_cluster_size."; } else { badprint "There are $nbNodesSize nodes in wsrep_cluster_size. Prefer 3 or 5 nodes architecture."; push @generalrec, "Prefer 3 or 5 nodes architecture."; } # wsrep_cluster_address doesn't include garbd nodes if ( $nbNodes > $nbNodesSize ) { badprint "All cluster nodes are not detected. wsrep_cluster_size less than node count in wsrep_cluster_address"; } else { goodprint "All cluster nodes detected."; } } else { badprint "Galera Cluster address is undefined"; push @adjvars, "set up wsrep_cluster_address variable for Galera replication"; } if ( defined( $myvar{'wsrep_cluster_name'} ) and trim( $myvar{'wsrep_cluster_name'} ) ne "" ) { goodprint "Galera Cluster name is defined: " . $myvar{'wsrep_cluster_name'}; } else { badprint "Galera Cluster name is undefined"; push @adjvars, "set up wsrep_cluster_name variable for Galera replication"; } if ( defined( $myvar{'wsrep_node_name'} ) and trim( $myvar{'wsrep_node_name'} ) ne "" ) { goodprint "Galera Node name is defined: " . $myvar{'wsrep_node_name'}; } else { badprint "Galera node name is undefined"; push @adjvars, "set up wsrep_node_name variable for Galera replication"; } if ( trim( $myvar{'wsrep_notify_cmd'} ) ne "" ) { goodprint "Galera Notify command is defined."; } else { badprint "Galera Notify command is not defined."; push( @adjvars, "set up parameter wsrep_notify_cmd to be notified" ); } if ( trim( $myvar{'wsrep_sst_method'} ) !~ "^xtrabackup.*" and trim( $myvar{'wsrep_sst_method'} ) !~ "^mariabackup" ) { badprint "Galera SST method is not xtrabackup based."; push( @adjvars, "set up parameter wsrep_sst_method to xtrabackup based parameter" ); } else { goodprint "SST Method is based on xtrabackup."; } if ( ( defined( $myvar{'wsrep_OSU_method'} ) && trim( $myvar{'wsrep_OSU_method'} ) eq "TOI" ) || ( defined( $myvar{'wsrep_osu_method'} ) && trim( $myvar{'wsrep_osu_method'} ) eq "TOI" ) ) { goodprint "TOI is default mode for upgrade."; } else { badprint "Schema upgrade are not replicated automatically"; push( @adjvars, "set up parameter wsrep_OSU_method to TOI" ); } infoprint "Max WsRep message : " . hr_bytes( $myvar{'wsrep_max_ws_size'} ); } else { badprint "Galera WsREP is disabled"; } if ( defined( $mystat{'wsrep_connected'} ) and $mystat{'wsrep_connected'} eq "ON" ) { goodprint "Node is connected"; } else { badprint "Node is disconnected"; } if ( defined( $mystat{'wsrep_ready'} ) and $mystat{'wsrep_ready'} eq "ON" ) { goodprint "Node is ready"; } else { badprint "Node is not ready"; } infoprint "Cluster status :" . $mystat{'wsrep_cluster_status'}; if ( defined( $mystat{'wsrep_cluster_status'} ) and $mystat{'wsrep_cluster_status'} eq "Primary" ) { goodprint "Galera cluster is consistent and ready for operations"; } else { badprint "Cluster is not consistent and ready"; } if ( $mystat{'wsrep_local_state_uuid'} eq $mystat{'wsrep_cluster_state_uuid'} ) { goodprint "Node and whole cluster at the same level: " . $mystat{'wsrep_cluster_state_uuid'}; } else { badprint "Node and whole cluster not the same level"; infoprint "Node state uuid: " . $mystat{'wsrep_local_state_uuid'}; infoprint "Cluster state uuid: " . $mystat{'wsrep_cluster_state_uuid'}; } if ( $mystat{'wsrep_local_state_comment'} eq 'Synced' ) { goodprint "Node is synced with whole cluster."; } else { badprint "Node is not synced"; infoprint "Node State : " . $mystat{'wsrep_local_state_comment'}; } if ( $mystat{'wsrep_local_cert_failures'} == 0 ) { goodprint "There is no certification failures detected."; } else { badprint "There is " . $mystat{'wsrep_local_cert_failures'} . " certification failure(s)detected."; } for my $key ( keys %mystat ) { if ( $key =~ /wsrep_|galera/i ) { debugprint "WSREP: $key = $mystat{$key}"; } } #debugprint Dumper get_wsrep_options() if $opt{debug}; } # Recommendations for InnoDB sub mysql_innodb { subheaderprint "InnoDB Metrics"; # InnoDB unless ( defined $myvar{'have_innodb'} && $myvar{'have_innodb'} eq "YES" ) { infoprint "InnoDB is disabled."; if ( mysql_version_ge( 5, 5 ) ) { my $defengine = 'InnoDB'; $defengine = $myvar{'default_storage_engine'} if defined( $myvar{'default_storage_engine'} ); badprint "InnoDB Storage engine is disabled. $defengine is the default storage engine" if $defengine eq 'InnoDB'; infoprint "InnoDB Storage engine is disabled. $defengine is the default storage engine" if $defengine ne 'InnoDB'; } return; } infoprint "InnoDB is enabled."; if ( !defined $enginestats{'InnoDB'} ) { if ( $opt{skipsize} eq 1 ) { infoprint "Skipped due to --skipsize option"; return; } badprint "No tables are Innodb"; $enginestats{'InnoDB'} = 0; } if ( $opt{buffers} ne 0 ) { infoprint "InnoDB Buffers"; if ( defined $myvar{'innodb_buffer_pool_size'} ) { infoprint " +-- InnoDB Buffer Pool: " . hr_bytes( $myvar{'innodb_buffer_pool_size'} ) . ""; } if ( defined $myvar{'innodb_buffer_pool_instances'} ) { infoprint " +-- InnoDB Buffer Pool Instances: " . $myvar{'innodb_buffer_pool_instances'} . ""; } if ( defined $myvar{'innodb_buffer_pool_chunk_size'} ) { infoprint " +-- InnoDB Buffer Pool Chunk Size: " . hr_bytes( $myvar{'innodb_buffer_pool_chunk_size'} ) . ""; } if ( defined $myvar{'innodb_additional_mem_pool_size'} ) { infoprint " +-- InnoDB Additional Mem Pool: " . hr_bytes( $myvar{'innodb_additional_mem_pool_size'} ) . ""; } if ( defined $myvar{'innodb_redo_log_capacity'} ) { infoprint " +-- InnoDB Redo Log Capacity: " . hr_bytes( $myvar{'innodb_redo_log_capacity'} ); } else { if ( defined $myvar{'innodb_log_file_size'} ) { infoprint " +-- InnoDB Log File Size: " . hr_bytes( $myvar{'innodb_log_file_size'} ); } if ( defined $myvar{'innodb_log_files_in_group'} ) { infoprint " +-- InnoDB Log File In Group: " . $myvar{'innodb_log_files_in_group'}; infoprint " +-- InnoDB Total Log File Size: " . hr_bytes( $myvar{'innodb_log_files_in_group'} * $myvar{'innodb_log_file_size'} ) . "(" . $mycalc{'innodb_log_size_pct'} . " % of buffer pool)"; } else { infoprint " +-- InnoDB Total Log File Size: " . hr_bytes( $myvar{'innodb_log_file_size'} ) . "(" . $mycalc{'innodb_log_size_pct'} . " % of buffer pool)"; } } if ( defined $myvar{'innodb_log_buffer_size'} ) { infoprint " +-- InnoDB Log Buffer: " . hr_bytes( $myvar{'innodb_log_buffer_size'} ); } if ( defined $mystat{'Innodb_buffer_pool_pages_free'} ) { infoprint " +-- InnoDB Buffer Free: " . hr_bytes( $mystat{'Innodb_buffer_pool_pages_free'} ) . ""; } if ( defined $mystat{'Innodb_buffer_pool_pages_total'} ) { infoprint " +-- InnoDB Buffer Used: " . hr_bytes( $mystat{'Innodb_buffer_pool_pages_total'} ) . ""; } } if ( defined $myvar{'innodb_thread_concurrency'} ) { infoprint "InnoDB Thread Concurrency: " . $myvar{'innodb_thread_concurrency'}; } # InnoDB Buffer Pool Size if ( $myvar{'innodb_file_per_table'} eq "ON" ) { goodprint "InnoDB File per table is activated"; } else { badprint "InnoDB File per table is not activated"; push( @adjvars, "innodb_file_per_table=ON" ); } # InnoDB Buffer Pool Size if ( $arch == 32 && $myvar{'innodb_buffer_pool_size'} > 4294967295 ) { badprint "InnoDB Buffer Pool size limit reached for 32 bits architecture: (" . hr_bytes(4294967295) . " )"; push( @adjvars, "limit innodb_buffer_pool_size under " . hr_bytes(4294967295) . " for 32 bits architecture" ); } if ( $arch == 32 && $myvar{'innodb_buffer_pool_size'} < 4294967295 ) { goodprint "InnoDB Buffer Pool size ( " . hr_bytes( $myvar{'innodb_buffer_pool_size'} ) . " ) under limit for 32 bits architecture: (" . hr_bytes(4294967295) . ")"; } if ( $arch == 64 && $myvar{'innodb_buffer_pool_size'} > 18446744073709551615 ) { badprint "InnoDB Buffer Pool size limit(" . hr_bytes(18446744073709551615) . ") reached for 64 bits architecture"; push( @adjvars, "limit innodb_buffer_pool_size under " . hr_bytes(18446744073709551615) . " for 64 bits architecture" ); } if ( $arch == 64 && $myvar{'innodb_buffer_pool_size'} < 18446744073709551615 ) { goodprint "InnoDB Buffer Pool size ( " . hr_bytes( $myvar{'innodb_buffer_pool_size'} ) . " ) under limit for 64 bits architecture: (" . hr_bytes(18446744073709551615) . " )"; } if ( $myvar{'innodb_buffer_pool_size'} > $enginestats{'InnoDB'} ) { goodprint "InnoDB buffer pool / data size: " . hr_bytes( $myvar{'innodb_buffer_pool_size'} ) . " / " . hr_bytes( $enginestats{'InnoDB'} ) . ""; } else { badprint "InnoDB buffer pool / data size: " . hr_bytes( $myvar{'innodb_buffer_pool_size'} ) . " / " . hr_bytes( $enginestats{'InnoDB'} ) . ""; push( @adjvars, "innodb_buffer_pool_size (>= " . hr_bytes( $enginestats{'InnoDB'} ) . ") if possible." ); } # select round( 100* sum(allocated)/( select VARIABLE_VALUE # FROM performance_schema.global_variables # where VARIABLE_NAME='innodb_buffer_pool_size' ) # ,2) as "PCT ALLOC/BUFFER POOL" #from sys.x$innodb_buffer_stats_by_table; if ( $mycalc{innodb_buffer_alloc_pct} < 80 ) { badprint "Ratio Buffer Pool allocated / Buffer Pool Size: " . $mycalc{'innodb_buffer_alloc_pct'} . '%'; } else { goodprint "Ratio Buffer Pool allocated / Buffer Pool Size: " . $mycalc{'innodb_buffer_alloc_pct'} . '%'; } if ( $mycalc{'innodb_log_size_pct'} < 20 or $mycalc{'innodb_log_size_pct'} > 30 ) { if ( defined $myvar{'innodb_redo_log_capacity'} ) { badprint "Ratio InnoDB redo log capacity / InnoDB Buffer pool size (" . $mycalc{'innodb_log_size_pct'} . "%): " . hr_bytes( $myvar{'innodb_redo_log_capacity'} ) . " / " . hr_bytes( $myvar{'innodb_buffer_pool_size'} ) . " should be equal to 25%"; push( @adjvars, "innodb_redo_log_capacity should be (=" . hr_bytes_rnd( $myvar{'innodb_buffer_pool_size'} / 4 ) . ") if possible, so InnoDB Redo log Capacity equals 25% of buffer pool size." ); push( @generalrec, "Be careful, increasing innodb_redo_log_capacity means higher crash recovery mean time" ); } else { badprint "Ratio InnoDB log file size / InnoDB Buffer pool size (" . $mycalc{'innodb_log_size_pct'} . "%): " . hr_bytes( $myvar{'innodb_log_file_size'} ) . " * " . $myvar{'innodb_log_files_in_group'} . " / " . hr_bytes( $myvar{'innodb_buffer_pool_size'} ) . " should be equal to 25%"; push( @adjvars, "innodb_log_file_size should be (=" . hr_bytes_rnd( $myvar{'innodb_buffer_pool_size'} / $myvar{'innodb_log_files_in_group'} / 4 ) . ") if possible, so InnoDB total log file size equals 25% of buffer pool size." ); push( @generalrec, "Be careful, increasing innodb_log_file_size / innodb_log_files_in_group means higher crash recovery mean time" ); } if ( mysql_version_le( 5, 6, 2 ) ) { push( @generalrec, "For MySQL 5.6.2 and lower, total innodb_log_file_size should have a ceiling of (4096MB / log files in group) - 1MB." ); } } else { if ( defined $myvar{'innodb_redo_log_capacity'} ) { goodprint "Ratio InnoDB Redo Log Capacity / InnoDB Buffer pool size: " . hr_bytes( $myvar{'innodb_redo_log_capacity'} ) . "/" . hr_bytes( $myvar{'innodb_buffer_pool_size'} ) . " should be equal to 25%"; } else { push( @generalrec, "Before changing innodb_log_file_size and/or innodb_log_files_in_group read this: https://bit.ly/2TcGgtU" ); goodprint "Ratio InnoDB log file size / InnoDB Buffer pool size: " . hr_bytes( $myvar{'innodb_log_file_size'} ) . " * " . $myvar{'innodb_log_files_in_group'} . "/" . hr_bytes( $myvar{'innodb_buffer_pool_size'} ) . " should be equal to 25%"; } } # InnoDB Buffer Pool Instances (MySQL 5.6.6+) if ( not mysql_version_ge( 10, 4 ) and defined( $myvar{'innodb_buffer_pool_instances'} ) ) { # Bad Value if > 64 if ( $myvar{'innodb_buffer_pool_instances'} > 64 ) { badprint "InnoDB buffer pool instances: " . $myvar{'innodb_buffer_pool_instances'} . ""; push( @adjvars, "innodb_buffer_pool_instances (<= 64)" ); } # InnoDB Buffer Pool Size > 1Go if ( $myvar{'innodb_buffer_pool_size'} > 1024 * 1024 * 1024 ) { # InnoDB Buffer Pool Size / 1Go = InnoDB Buffer Pool Instances limited to 64 max. # InnoDB Buffer Pool Size > 64Go my $max_innodb_buffer_pool_instances = int( $myvar{'innodb_buffer_pool_size'} / ( 1024 * 1024 * 1024 ) ); $max_innodb_buffer_pool_instances = 64 if ( $max_innodb_buffer_pool_instances > 64 ); if ( $myvar{'innodb_buffer_pool_instances'} != $max_innodb_buffer_pool_instances ) { badprint "InnoDB buffer pool instances: " . $myvar{'innodb_buffer_pool_instances'} . ""; push( @adjvars, "innodb_buffer_pool_instances(=" . $max_innodb_buffer_pool_instances . ")" ); } else { goodprint "InnoDB buffer pool instances: " . $myvar{'innodb_buffer_pool_instances'} . ""; } # InnoDB Buffer Pool Size < 1Go } else { if ( $myvar{'innodb_buffer_pool_instances'} != 1 ) { badprint "InnoDB buffer pool <= 1G and Innodb_buffer_pool_instances(!=1)."; push( @adjvars, "innodb_buffer_pool_instances (=1)" ); } else { goodprint "InnoDB buffer pool instances: " . $myvar{'innodb_buffer_pool_instances'} . ""; } } } # InnoDB Used Buffer Pool Size vs CHUNK size if ( !defined( $myvar{'innodb_buffer_pool_chunk_size'} ) ) { infoprint "InnoDB Buffer Pool Chunk Size not used or defined in your version"; } else { infoprint "Number of InnoDB Buffer Pool Chunk: " . int( $myvar{'innodb_buffer_pool_size'} ) / int( $myvar{'innodb_buffer_pool_chunk_size'} ) . " for " . $myvar{'innodb_buffer_pool_instances'} . " Buffer Pool Instance(s)"; if ( int( $myvar{'innodb_buffer_pool_size'} ) % ( int( $myvar{'innodb_buffer_pool_chunk_size'} ) * int( $myvar{'innodb_buffer_pool_instances'} ) ) eq 0 ) { goodprint "Innodb_buffer_pool_size aligned with Innodb_buffer_pool_chunk_size & Innodb_buffer_pool_instances"; } else { badprint "Innodb_buffer_pool_size aligned with Innodb_buffer_pool_chunk_size & Innodb_buffer_pool_instances"; #push( @adjvars, "Adjust innodb_buffer_pool_instances, innodb_buffer_pool_chunk_size with innodb_buffer_pool_size" ); push( @adjvars, "innodb_buffer_pool_size must always be equal to or a multiple of innodb_buffer_pool_chunk_size * innodb_buffer_pool_instances" ); } } # InnoDB Read efficiency if ( defined $mycalc{'pct_read_efficiency'} && $mycalc{'pct_read_efficiency'} < 90 ) { badprint "InnoDB Read buffer efficiency: " . $mycalc{'pct_read_efficiency'} . "% (" . $mystat{'Innodb_buffer_pool_read_requests'} . " hits / " . ( $mystat{'Innodb_buffer_pool_reads'} + $mystat{'Innodb_buffer_pool_read_requests'} ) . " total)"; } else { goodprint "InnoDB Read buffer efficiency: " . $mycalc{'pct_read_efficiency'} . "% (" . $mystat{'Innodb_buffer_pool_read_requests'} . " hits / " . ( $mystat{'Innodb_buffer_pool_reads'} + $mystat{'Innodb_buffer_pool_read_requests'} ) . " total)"; } # InnoDB Write efficiency if ( defined $mycalc{'pct_write_efficiency'} && $mycalc{'pct_write_efficiency'} < 90 ) { badprint "InnoDB Write Log efficiency: " . abs( $mycalc{'pct_write_efficiency'} ) . "% (" . abs( $mystat{'Innodb_log_write_requests'} - $mystat{'Innodb_log_writes'} ) . " hits / " . $mystat{'Innodb_log_write_requests'} . " total)"; push( @adjvars, "innodb_log_buffer_size (> " . hr_bytes_rnd( $myvar{'innodb_log_buffer_size'} ) . ")" ); } else { goodprint "InnoDB Write Log efficiency: " . $mycalc{'pct_write_efficiency'} . "% (" . ( $mystat{'Innodb_log_write_requests'} - $mystat{'Innodb_log_writes'} ) . " hits / " . $mystat{'Innodb_log_write_requests'} . " total)"; } # InnoDB Log Waits $mystat{'Innodb_log_waits_computed'} = 0; if ( defined( $mystat{'Innodb_log_waits'} ) and defined( $mystat{'Innodb_log_writes'} ) and $mystat{'Innodb_log_writes'} > 0.000001 ) { $mystat{'Innodb_log_waits_computed'} = $mystat{'Innodb_log_waits'} / $mystat{'Innodb_log_writes'}; } else { undef $mystat{'Innodb_log_waits_computed'}; } if ( defined $mystat{'Innodb_log_waits_computed'} && $mystat{'Innodb_log_waits_computed'} > 0.000001 ) { badprint "InnoDB log waits: " . percentage( $mystat{'Innodb_log_waits'}, $mystat{'Innodb_log_writes'} ) . "% (" . $mystat{'Innodb_log_waits'} . " waits / " . $mystat{'Innodb_log_writes'} . " writes)"; push( @adjvars, "innodb_log_buffer_size (> " . hr_bytes_rnd( $myvar{'innodb_log_buffer_size'} ) . ")" ); } else { goodprint "InnoDB log waits: " . percentage( $mystat{'Innodb_log_waits'}, $mystat{'Innodb_log_writes'} ) . "% (" . $mystat{'Innodb_log_waits'} . " waits / " . $mystat{'Innodb_log_writes'} . " writes)"; } $result{'Calculations'} = {%mycalc}; } sub check_metadata_perf { subheaderprint "Analysis Performance Metrics"; if ( defined $myvar{'innodb_stats_on_metadata'} ) { infoprint "innodb_stats_on_metadata: " . $myvar{'innodb_stats_on_metadata'}; if ( $myvar{'innodb_stats_on_metadata'} eq 'ON' ) { badprint "Stat are updated during querying INFORMATION_SCHEMA."; push @adjvars, "SET innodb_stats_on_metadata = OFF"; #Disabling innodb_stats_on_metadata select_one("SET GLOBAL innodb_stats_on_metadata = OFF;"); return 1; } } goodprint "No stat updates during querying INFORMATION_SCHEMA."; return 0; } # Recommendations for Database metrics sub mysql_databases { return if ( $opt{dbstat} == 0 ); subheaderprint "Database Metrics"; unless ( mysql_version_ge( 5, 5 ) ) { infoprint "Database metrics from information schema are missing in this version. Skipping..."; return; } @dblist = select_array( "SELECT SCHEMA_NAME FROM information_schema.SCHEMATA WHERE SCHEMA_NAME NOT IN ( 'mysql', 'performance_schema', 'information_schema', 'sys' );" ); infoprint "There is " . scalar(@dblist) . " Database(s)."; my @totaldbinfo = split /\s/, select_one( "SELECT SUM(TABLE_ROWS), SUM(DATA_LENGTH), SUM(INDEX_LENGTH), SUM(DATA_LENGTH+INDEX_LENGTH), COUNT(TABLE_NAME), COUNT(DISTINCT(TABLE_COLLATION)), COUNT(DISTINCT(ENGINE)) FROM information_schema.TABLES WHERE TABLE_SCHEMA NOT IN ('mysql', 'performance_schema', 'information_schema', 'sys');" ); infoprint "All User Databases:"; infoprint " +-- TABLE : " . select_one( "SELECT count(*) from information_schema.TABLES WHERE TABLE_TYPE ='BASE TABLE' AND TABLE_SCHEMA NOT IN ('mysql', 'performance_schema', 'information_schema', 'sys')" ) . ""; infoprint " +-- VIEW : " . select_one( "SELECT count(*) from information_schema.TABLES WHERE TABLE_TYPE ='VIEW' AND TABLE_SCHEMA NOT IN ('mysql', 'performance_schema', 'information_schema', 'sys')" ) . ""; infoprint " +-- INDEX : " . select_one( "SELECT count(distinct(concat(TABLE_NAME, TABLE_SCHEMA, INDEX_NAME))) from information_schema.STATISTICS WHERE TABLE_SCHEMA NOT IN ('mysql', 'performance_schema', 'information_schema', 'sys')" ) . ""; infoprint " +-- CHARS : " . ( $totaldbinfo[5] eq 'NULL' ? 0 : $totaldbinfo[5] ) . " (" . ( join ", ", select_array( "select distinct(CHARACTER_SET_NAME) from information_schema.columns WHERE CHARACTER_SET_NAME IS NOT NULL AND TABLE_SCHEMA NOT IN ('mysql', 'performance_schema', 'information_schema', 'sys');" ) ) . ")"; infoprint " +-- COLLA : " . ( $totaldbinfo[5] eq 'NULL' ? 0 : $totaldbinfo[5] ) . " (" . ( join ", ", select_array( "SELECT DISTINCT(TABLE_COLLATION) FROM information_schema.TABLES WHERE TABLE_COLLATION IS NOT NULL AND TABLE_SCHEMA NOT IN ('mysql', 'performance_schema', 'information_schema', 'sys');" ) ) . ")"; infoprint " +-- ROWS : " . ( $totaldbinfo[0] eq 'NULL' ? 0 : $totaldbinfo[0] ) . ""; infoprint " +-- DATA : " . hr_bytes( $totaldbinfo[1] ) . "(" . percentage( $totaldbinfo[1], $totaldbinfo[3] ) . "%)"; infoprint " +-- INDEX : " . hr_bytes( $totaldbinfo[2] ) . "(" . percentage( $totaldbinfo[2], $totaldbinfo[3] ) . "%)"; infoprint " +-- SIZE : " . hr_bytes( $totaldbinfo[3] ) . ""; infoprint " +-- ENGINE: " . ( $totaldbinfo[6] eq 'NULL' ? 0 : $totaldbinfo[6] ) . " (" . ( join ", ", select_array( "SELECT DISTINCT(ENGINE) FROM information_schema.TABLES WHERE ENGINE IS NOT NULL AND TABLE_SCHEMA NOT IN ('mysql', 'performance_schema', 'information_schema', 'sys');" ) ) . ")"; $result{'Databases'}{'All databases'}{'Rows'} = ( $totaldbinfo[0] eq 'NULL' ? 0 : $totaldbinfo[0] ); $result{'Databases'}{'All databases'}{'Data Size'} = $totaldbinfo[1]; $result{'Databases'}{'All databases'}{'Data Pct'} = percentage( $totaldbinfo[1], $totaldbinfo[3] ) . "%"; $result{'Databases'}{'All databases'}{'Index Size'} = $totaldbinfo[2]; $result{'Databases'}{'All databases'}{'Index Pct'} = percentage( $totaldbinfo[2], $totaldbinfo[3] ) . "%"; $result{'Databases'}{'All databases'}{'Total Size'} = $totaldbinfo[3]; print "\n" unless ( $opt{'silent'} or $opt{'json'} ); my $nbViews = 0; my $nbTables = 0; foreach (@dblist) { my @dbinfo = split /\s/, select_one( "SELECT TABLE_SCHEMA, SUM(TABLE_ROWS), SUM(DATA_LENGTH), SUM(INDEX_LENGTH), SUM(DATA_LENGTH+INDEX_LENGTH), COUNT(DISTINCT ENGINE), COUNT(TABLE_NAME), COUNT(DISTINCT(TABLE_COLLATION)), COUNT(DISTINCT(ENGINE)) FROM information_schema.TABLES WHERE TABLE_SCHEMA='$_' GROUP BY TABLE_SCHEMA ORDER BY TABLE_SCHEMA" ); next unless defined $dbinfo[0]; infoprint "Database: " . $dbinfo[0] . ""; $nbTables = select_one( "SELECT count(*) from information_schema.TABLES WHERE TABLE_TYPE ='BASE TABLE' AND TABLE_SCHEMA='$_'" ); infoprint " +-- TABLE : $nbTables"; infoprint " +-- VIEW : " . select_one( "SELECT count(*) from information_schema.TABLES WHERE TABLE_TYPE ='VIEW' AND TABLE_SCHEMA='$_'" ) . ""; infoprint " +-- INDEX : " . select_one( "SELECT count(distinct(concat(TABLE_NAME, TABLE_SCHEMA, INDEX_NAME))) from information_schema.STATISTICS WHERE TABLE_SCHEMA='$_'" ) . ""; infoprint " +-- CHARS : " . ( $totaldbinfo[5] eq 'NULL' ? 0 : $totaldbinfo[5] ) . " (" . ( join ", ", select_array( "select distinct(CHARACTER_SET_NAME) from information_schema.columns WHERE CHARACTER_SET_NAME IS NOT NULL AND TABLE_SCHEMA='$_';" ) ) . ")"; infoprint " +-- COLLA : " . ( $dbinfo[7] eq 'NULL' ? 0 : $dbinfo[7] ) . " (" . ( join ", ", select_array( "SELECT DISTINCT(TABLE_COLLATION) FROM information_schema.TABLES WHERE TABLE_SCHEMA='$_' AND TABLE_COLLATION IS NOT NULL;" ) ) . ")"; infoprint " +-- ROWS : " . ( !defined( $dbinfo[1] ) or $dbinfo[1] eq 'NULL' ? 0 : $dbinfo[1] ) . ""; infoprint " +-- DATA : " . hr_bytes( $dbinfo[2] ) . "(" . percentage( $dbinfo[2], $dbinfo[4] ) . "%)"; infoprint " +-- INDEX : " . hr_bytes( $dbinfo[3] ) . "(" . percentage( $dbinfo[3], $dbinfo[4] ) . "%)"; infoprint " +-- TOTAL : " . hr_bytes( $dbinfo[4] ) . ""; infoprint " +-- ENGINE: " . ( $dbinfo[8] eq 'NULL' ? 0 : $dbinfo[8] ) . " (" . ( join ", ", select_array( "SELECT DISTINCT(ENGINE) FROM information_schema.TABLES WHERE TABLE_SCHEMA='$_' AND ENGINE IS NOT NULL" ) ) . ")"; foreach my $eng ( select_array( "SELECT DISTINCT(ENGINE) FROM information_schema.TABLES WHERE TABLE_SCHEMA='$_' AND ENGINE IS NOT NULL" ) ) { infoprint " +-- ENGINE $eng : " . select_one( "SELECT COUNT(*) FROM information_schema.TABLES WHERE TABLE_SCHEMA='$dbinfo[0]' AND ENGINE='$eng'" ) . " TABLE(s)"; } if ( $nbTables == 0 ) { badprint " No table in $dbinfo[0] database"; next; } badprint "Index size is larger than data size for $dbinfo[0] \n" if ( $dbinfo[2] ne 'NULL' ) and ( $dbinfo[3] ne 'NULL' ) and ( $dbinfo[2] < $dbinfo[3] ); if ( $dbinfo[5] > 1 and $nbTables > 0 ) { badprint "There are " . $dbinfo[5] . " storage engines. Be careful. \n"; push @generalrec, "Select one storage engine (InnoDB is a good choice) for all tables in $dbinfo[0] database ($dbinfo[5] engines detected)"; } $result{'Databases'}{ $dbinfo[0] }{'Rows'} = $dbinfo[1]; $result{'Databases'}{ $dbinfo[0] }{'Tables'} = $dbinfo[6]; $result{'Databases'}{ $dbinfo[0] }{'Collations'} = $dbinfo[7]; $result{'Databases'}{ $dbinfo[0] }{'Data Size'} = $dbinfo[2]; $result{'Databases'}{ $dbinfo[0] }{'Data Pct'} = percentage( $dbinfo[2], $dbinfo[4] ) . "%"; $result{'Databases'}{ $dbinfo[0] }{'Index Size'} = $dbinfo[3]; $result{'Databases'}{ $dbinfo[0] }{'Index Pct'} = percentage( $dbinfo[3], $dbinfo[4] ) . "%"; $result{'Databases'}{ $dbinfo[0] }{'Total Size'} = $dbinfo[4]; if ( $dbinfo[7] > 1 ) { badprint $dbinfo[7] . " different collations for database " . $dbinfo[0]; push( @generalrec, "Check all table collations are identical for all tables in " . $dbinfo[0] . " database." ); } else { goodprint $dbinfo[7] . " collation for " . $dbinfo[0] . " database."; } if ( $dbinfo[8] > 1 ) { badprint $dbinfo[8] . " different engines for database " . $dbinfo[0]; push( @generalrec, "Check all table engines are identical for all tables in " . $dbinfo[0] . " database." ); } else { goodprint $dbinfo[8] . " engine for " . $dbinfo[0] . " database."; } my @distinct_column_charset = select_array( "select DISTINCT(CHARACTER_SET_NAME) from information_schema.COLUMNS where CHARACTER_SET_NAME IS NOT NULL AND TABLE_SCHEMA ='$_' AND CHARACTER_SET_NAME IS NOT NULL" ); infoprint "Charsets for $dbinfo[0] database table column: " . join( ', ', @distinct_column_charset ); if ( scalar(@distinct_column_charset) > 1 ) { badprint $dbinfo[0] . " table column(s) has several charsets defined for all text like column(s)."; push( @generalrec, "Limit charset for column to one charset if possible for " . $dbinfo[0] . " database." ); } else { goodprint $dbinfo[0] . " table column(s) has same charset defined for all text like column(s)."; } my @distinct_column_collation = select_array( "select DISTINCT(COLLATION_NAME) from information_schema.COLUMNS where COLLATION_NAME IS NOT NULL AND TABLE_SCHEMA ='$_' AND COLLATION_NAME IS NOT NULL" ); infoprint "Collations for $dbinfo[0] database table column: " . join( ', ', @distinct_column_collation ); if ( scalar(@distinct_column_collation) > 1 ) { badprint $dbinfo[0] . " table column(s) has several collations defined for all text like column(s)."; push( @generalrec, "Limit collations for column to one collation if possible for " . $dbinfo[0] . " database." ); } else { goodprint $dbinfo[0] . " table column(s) has same collation defined for all text like column(s)."; } } } # Recommendations for database columns sub mysql_tables { return if ( $opt{tbstat} == 0 ); subheaderprint "Table Column Metrics"; unless ( mysql_version_ge( 5, 5 ) ) { infoprint "Table column metrics from information schema are missing in this version. Skipping..."; return; } if ( mysql_version_ge(8) and not mysql_version_eq(10) ) { infoprint "MySQL and Percona version 8.0 and greater have removed PROCEDURE ANALYSE feature"; $opt{colstat} = 0; infoprint "Disabling colstat parameter"; } infoprint("Dumpdir: $opt{dumpdir}"); # Store all information schema in dumpdir if defined if ( defined $opt{dumpdir} and -d "$opt{dumpdir}" ) { for my $info_s_table ( select_array('use information_schema;show tables;') ) { infoprint "Dumping $info_s_table into $opt{dumpdir}"; select_csv_file( "$opt{dumpdir}/ifs_${info_s_table}.csv", "select * from information_schema.$info_s_table" ); } #exit 0 if ( $opt{stop} == 1 ); } foreach ( select_user_dbs() ) { my $dbname = $_; next unless defined $_; infoprint "Database: " . $_ . ""; my @dbtable = select_array( "SELECT TABLE_NAME FROM information_schema.TABLES WHERE TABLE_SCHEMA='$dbname' AND TABLE_TYPE='BASE TABLE' ORDER BY TABLE_NAME" ); foreach (@dbtable) { my $tbname = $_; infoprint " +-- TABLE: $tbname"; infoprint " +-- TYPE: " . select_one( "SELECT ENGINE FROM information_schema.tables where TABLE_schema='$dbname' AND TABLE_NAME='$tbname'" ); my $selIdxReq = <<"ENDSQL"; SELECT index_name AS idxname, GROUP_CONCAT(column_name ORDER BY seq_in_index) AS cols, INDEX_TYPE as type FROM information_schema.statistics WHERE INDEX_SCHEMA='$dbname' AND TABLE_NAME='$tbname' GROUP BY idxname, type ENDSQL my @tbidx = select_array($selIdxReq); my $found = 0; foreach my $idx (@tbidx) { my @info = split /\s/, $idx; next if $info[0] eq 'NULL'; infoprint " +-- Index $info[0] - Cols: $info[1] - Type: $info[2]"; $found++; } if ( $found == 0 ) { badprint("Table $dbname.$tbname has no index defined"); push @generalrec, "Add at least a primary key on table $dbname.$tbname"; } my @tbcol = select_array( "SELECT COLUMN_NAME FROM information_schema.COLUMNS WHERE TABLE_SCHEMA='$dbname' AND TABLE_NAME='$tbname'" ); foreach (@tbcol) { my $ctype = select_one( "SELECT COLUMN_TYPE FROM information_schema.COLUMNS WHERE TABLE_SCHEMA='$dbname' AND TABLE_NAME='$tbname' AND COLUMN_NAME='$_' " ); my $isnull = select_one( "SELECT IS_NULLABLE FROM information_schema.COLUMNS WHERE TABLE_SCHEMA='$dbname' AND TABLE_NAME='$tbname' AND COLUMN_NAME='$_' " ); my $current_type = uc($ctype) . ( $isnull eq 'NO' ? " NOT NULL" : " NULL" ); my $optimal_type = ''; infoprint " +-- Column $tbname.$_: $current_type"; if ( $opt{colstat} == 1 ) { $optimal_type = select_str_g( "Optimal_fieldtype", "SELECT \\`$_\\` FROM \\`$dbname\\`.\\`$tbname\\` PROCEDURE ANALYSE(100000)" ) unless ( mysql_version_ge(8) and not mysql_version_eq(10) ); } if ( $optimal_type eq '' ) { #infoprint " +-- Current Fieldtype: $current_type"; #infoprint " Optimal Fieldtype: Not available"; } elsif ( $current_type ne $optimal_type and $current_type !~ /.*DATETIME.*/ and $current_type !~ /.*TIMESTAMP.*/ ) { infoprint " +-- Current Fieldtype: $current_type"; if ( $optimal_type =~ /.*ENUM\(.*/ ) { $optimal_type = "ENUM( ... )"; } infoprint " +-- Optimal Fieldtype: $optimal_type "; if ( $optimal_type !~ /.*ENUM\(.*/ ) { badprint "Consider changing type for column $_ in table $dbname.$tbname"; push( @generalrec, "ALTER TABLE \`$dbname\`.\`$tbname\` MODIFY \`$_\` $optimal_type;" ); } } else { goodprint "$dbname.$tbname ($_) type: $current_type"; } } } } } # Recommendations for Indexes metrics sub mysql_indexes { return if ( $opt{idxstat} == 0 ); subheaderprint "Indexes Metrics"; unless ( mysql_version_ge( 5, 5 ) ) { infoprint "Index metrics from information schema are missing in this version. Skipping..."; return; } # unless ( mysql_version_ge( 5, 6 ) ) { # infoprint #"Skip Index metrics from information schema due to erroneous information provided in this version"; # return; # } my $selIdxReq = <<'ENDSQL'; SELECT CONCAT(t.TABLE_SCHEMA, '.', t.TABLE_NAME) AS 'table', CONCAT(s.INDEX_NAME, '(', s.COLUMN_NAME, ')') AS 'index' , s.SEQ_IN_INDEX AS 'seq' , s2.max_columns AS 'maxcol' , s.CARDINALITY AS 'card' , t.TABLE_ROWS AS 'est_rows' , INDEX_TYPE as type , ROUND(((s.CARDINALITY / IFNULL(t.TABLE_ROWS, 0.01)) * 100), 2) AS 'sel' FROM INFORMATION_SCHEMA.STATISTICS s INNER JOIN INFORMATION_SCHEMA.TABLES t ON s.TABLE_SCHEMA = t.TABLE_SCHEMA AND s.TABLE_NAME = t.TABLE_NAME INNER JOIN ( SELECT TABLE_SCHEMA , TABLE_NAME , INDEX_NAME , MAX(SEQ_IN_INDEX) AS max_columns FROM INFORMATION_SCHEMA.STATISTICS WHERE TABLE_SCHEMA NOT IN ('mysql', 'information_schema', 'performance_schema') AND INDEX_TYPE <> 'FULLTEXT' GROUP BY TABLE_SCHEMA, TABLE_NAME, INDEX_NAME ) AS s2 ON s.TABLE_SCHEMA = s2.TABLE_SCHEMA AND s.TABLE_NAME = s2.TABLE_NAME AND s.INDEX_NAME = s2.INDEX_NAME WHERE t.TABLE_SCHEMA NOT IN ('mysql', 'information_schema', 'performance_schema') AND t.TABLE_ROWS > 10 AND s.CARDINALITY IS NOT NULL AND (s.CARDINALITY / IFNULL(t.TABLE_ROWS, 0.01)) < 8.00 ORDER BY sel LIMIT 10; ENDSQL my @idxinfo = select_array($selIdxReq); infoprint "Worst selectivity indexes:"; foreach (@idxinfo) { debugprint "$_"; my @info = split /\s/; infoprint "Index: " . $info[1] . ""; infoprint " +-- COLUMN : " . $info[0] . ""; infoprint " +-- NB SEQS : " . $info[2] . " sequence(s)"; infoprint " +-- NB COLS : " . $info[3] . " column(s)"; infoprint " +-- CARDINALITY : " . $info[4] . " distinct values"; infoprint " +-- NB ROWS : " . $info[5] . " rows"; infoprint " +-- TYPE : " . $info[6]; infoprint " +-- SELECTIVITY : " . $info[7] . "%"; $result{'Indexes'}{ $info[1] }{'Column'} = $info[0]; $result{'Indexes'}{ $info[1] }{'Sequence number'} = $info[2]; $result{'Indexes'}{ $info[1] }{'Number of column'} = $info[3]; $result{'Indexes'}{ $info[1] }{'Cardinality'} = $info[4]; $result{'Indexes'}{ $info[1] }{'Row number'} = $info[5]; $result{'Indexes'}{ $info[1] }{'Index Type'} = $info[6]; $result{'Indexes'}{ $info[1] }{'Selectivity'} = $info[7]; if ( $info[7] < 25 ) { badprint "$info[1] has a low selectivity"; } } infoprint "Indexes per database:"; foreach my $dbname ( select_user_dbs() ) { infoprint "Database: " . $dbname . ""; $selIdxReq = <<"ENDSQL"; SELECT concat(table_name, '.', index_name) AS idxname, GROUP_CONCAT(column_name ORDER BY seq_in_index) AS cols, SUM(CARDINALITY) as card, INDEX_TYPE as type FROM information_schema.statistics WHERE INDEX_SCHEMA='$dbname' AND index_name IS NOT NULL GROUP BY table_name, idxname, type ENDSQL my $found = 0; foreach my $idxinfo ( select_array($selIdxReq) ) { my @info = split /\s/, $idxinfo; next if $info[0] eq 'NULL'; infoprint " +-- INDEX : " . $info[0]; infoprint " +-- COLUMNS : " . $info[1]; infoprint " +-- CARDINALITY: " . $info[2]; infoprint " +-- TYPE : " . $info[4] if defined $info[4]; infoprint " +-- COMMENT : " . $info[5] if defined $info[5]; $found++; } my $nbTables = select_one( "SELECT count(*) from information_schema.TABLES WHERE TABLE_TYPE ='BASE TABLE' AND TABLE_SCHEMA='$dbname'" ); badprint "No index found for $dbname database" if $found == 0 and $nbTables > 1; push @generalrec, "Add indexes on tables from $dbname database" if $found == 0 and $nbTables > 1; } return unless ( defined( $myvar{'performance_schema'} ) and $myvar{'performance_schema'} eq 'ON' ); $selIdxReq = <<'ENDSQL'; SELECT CONCAT(object_schema, '.', object_name) AS 'table', index_name FROM performance_schema.table_io_waits_summary_by_index_usage WHERE index_name IS NOT NULL AND count_star = 0 AND index_name <> 'PRIMARY' AND object_schema NOT IN ('mysql', 'performance_schema', 'information_schema') ORDER BY count_star, object_schema, object_name; ENDSQL @idxinfo = select_array($selIdxReq); infoprint "Unused indexes:"; push( @generalrec, "Remove unused indexes." ) if ( scalar(@idxinfo) > 0 ); foreach (@idxinfo) { debugprint "$_"; my @info = split /\s/; badprint "Index: $info[1] on $info[0] is not used."; push @{ $result{'Indexes'}{'Unused Indexes'} }, $info[0] . "." . $info[1]; } } sub mysql_views { subheaderprint "Views Metrics"; unless ( mysql_version_ge( 5, 5 ) ) { infoprint "Views metrics from information schema are missing in this version. Skipping..."; return; } } sub mysql_routines { subheaderprint "Routines Metrics"; unless ( mysql_version_ge( 5, 5 ) ) { infoprint "Routines metrics from information schema are missing in this version. Skipping..."; return; } } sub mysql_triggers { subheaderprint "Triggers Metrics"; unless ( mysql_version_ge( 5, 5 ) ) { infoprint "Trigger metrics from information schema are missing in this version. Skipping..."; return; } } # Take the two recommendation arrays and display them at the end of the output sub make_recommendations { $result{'Recommendations'} = \@generalrec; $result{'AdjustVariables'} = \@adjvars; subheaderprint "Recommendations"; if ( @generalrec > 0 ) { prettyprint "General recommendations:"; foreach (@generalrec) { prettyprint " " . $_ . ""; } } if ( @adjvars > 0 ) { prettyprint "Variables to adjust:"; if ( $mycalc{'pct_max_physical_memory'} > 90 ) { prettyprint " *** MySQL's maximum memory usage is dangerously high ***\n" . " *** Add RAM before increasing MySQL buffer variables ***"; } foreach (@adjvars) { prettyprint " " . $_ . ""; } } if ( @generalrec == 0 && @adjvars == 0 ) { prettyprint "No additional performance recommendations are available."; } } sub close_outputfile { close($fh) if defined($fh); } sub headerprint { prettyprint " >> MySQLTuner $tunerversion\n" . "\t * Jean-Marie Renouard \n" . "\t * Major Hayden \n" . " >> Bug reports, feature requests, and downloads at http://mysqltuner.pl/\n" . " >> Run with '--help' for additional options and output filtering"; } sub string2file { my $filename = shift; my $content = shift; open my $fh, q(>), $filename or die "Unable to open $filename in write mode. Please check permissions for this file or directory"; print $fh $content if defined($content); close $fh; debugprint $content if ( $opt{'debug'} ); } sub file2array { my $filename = shift; debugprint "* reading $filename" if ( $opt{'debug'} ); my $fh; open( $fh, q(<), "$filename" ) or die "Couldn't open $filename for reading: $!\n"; my @lines = <$fh>; close($fh); return @lines; } sub file2string { return join( '', file2array(@_) ); } my $templateModel; if ( $opt{'template'} ne 0 ) { $templateModel = file2string( $opt{'template'} ); } else { # DEFAULT REPORT TEMPLATE $templateModel = <<'END_TEMPLATE'; MySQLTuner Report

Result output

{$data}
END_TEMPLATE } sub dump_result { #debugprint Dumper( \%result ) if ( $opt{'debug'} ); debugprint "HTML REPORT: $opt{'reportfile'}"; if ( $opt{'reportfile'} ne 0 ) { eval { require Text::Template }; eval { require JSON }; if ($@) { badprint "Text::Template Module is needed."; die "Text::Template Module is needed."; } my $json = JSON->new->allow_nonref; my $json_text = $json->pretty->encode( \%result ); my %vars = ( 'data' => \%result, 'debug' => $json_text, ); my $template; { no warnings 'once'; $template = Text::Template->new( TYPE => 'STRING', PREPEND => q{;}, SOURCE => $templateModel, DELIMITERS => [ '[%', '%]' ] ) or die "Couldn't construct template: $Text::Template::ERROR"; } open my $fh, q(>), $opt{'reportfile'} or die "Unable to open $opt{'reportfile'} in write mode. please check permissions for this file or directory"; $template->fill_in( HASH => \%vars, OUTPUT => $fh ); close $fh; } if ( $opt{'json'} ne 0 ) { eval { require JSON }; if ($@) { print "$bad JSON Module is needed.\n"; return 1; } my $json = JSON->new->allow_nonref; print $json->utf8(1)->pretty( ( $opt{'prettyjson'} ? 1 : 0 ) ) ->encode( \%result ); if ( $opt{'outputfile'} ne 0 ) { unlink $opt{'outputfile'} if ( -e $opt{'outputfile'} ); open my $fh, q(>), $opt{'outputfile'} or die "Unable to open $opt{'outputfile'} in write mode. please check permissions for this file or directory"; print $fh $json->utf8(1)->pretty( ( $opt{'prettyjson'} ? 1 : 0 ) ) ->encode( \%result ); close $fh; } } } sub which { my $prog_name = shift; my $path_string = shift; my @path_array = split /:/, $ENV{'PATH'}; for my $path (@path_array) { return "$path/$prog_name" if ( -x "$path/$prog_name" ); } return 0; } # --------------------------------------------------------------------------- # BEGIN 'MAIN' # --------------------------------------------------------------------------- headerprint; # Header Print validate_tuner_version; # Check latest version mysql_setup; # Gotta login first debugprint "MySQL FINAL Client : $mysqlcmd $mysqllogin"; debugprint "MySQL Admin FINAL Client : $mysqladmincmd $mysqllogin"; #exit(0); os_setup; # Set up some OS variables get_all_vars; # Toss variables/status into hashes get_tuning_info; # Get information about the tuning connection calculations; # Calculate everything we need check_architecture; # Suggest 64-bit upgrade check_storage_engines; # Show enabled storage engines if ( $opt{'feature'} ne '' ) { subheaderprint "See FEATURES.md for more information"; no strict 'refs'; for my $feature ( split /,/, $opt{'feature'} ) { subheaderprint "Running feature: $opt{'feature'}"; $feature->(); } make_recommendations; exit(0); } validate_mysql_version; # Check current MySQL version system_recommendations; # Avoid too many services on the same host log_file_recommendations; # check log file content check_metadata_perf; # Show parameter impacting performance during analysis mysql_databases; # Show information about databases mysql_tables; # Show information about table column mysql_table_structures; # Show information about table structures mysql_indexes; # Show information about indexes mysql_views; # Show information about views mysql_triggers; # Show information about triggers mysql_routines; # Show information about routines security_recommendations; # Display some security recommendations cve_recommendations; # Display related CVE mysql_stats; # Print the server stats mysql_pfs; # Print Performance schema info mariadb_threadpool; # Print MariaDB ThreadPool stats mysql_myisam; # Print MyISAM stats mysql_innodb; # Print InnoDB stats mariadb_aria; # Print MariaDB Aria stats mariadb_tokudb; # Print MariaDB Tokudb stats mariadb_xtradb; # Print MariaDB XtraDB stats #mariadb_rockdb; # Print MariaDB RockDB stats #mariadb_spider; # Print MariaDB Spider stats #mariadb_connect; # Print MariaDB Connect stats mariadb_galera; # Print MariaDB Galera Cluster stats get_replication_status; # Print replication info make_recommendations; # Make recommendations based on stats dump_result; # Dump result if debug is on close_outputfile; # Close reportfile if needed # --------------------------------------------------------------------------- # END 'MAIN' # --------------------------------------------------------------------------- 1; __END__ =pod =encoding UTF-8 =head1 NAME MySQLTuner 2.5.2 - MySQL High Performance Tuning Script =head1 IMPORTANT USAGE GUIDELINES To run the script with the default options, run the script without arguments Allow MySQL server to run for at least 24-48 hours before trusting suggestions Some routines may require root level privileges (script will provide warnings) You must provide the remote server's total memory when connecting to other servers =head1 CONNECTION AND AUTHENTICATION --host Connect to a remote host to perform tests (default: localhost) --socket Use a different socket for a local connection --port Port to use for connection (default: 3306) --protocol tcp Force TCP connection instead of socket --user Username to use for authentication --userenv Name of env variable which contains username to use for authentication --pass Password to use for authentication --passenv Name of env variable which contains password to use for authentication --ssl-ca Path to public key --mysqladmin Path to a custom mysqladmin executable --mysqlcmd Path to a custom mysql executable --defaults-file Path to a custom .my.cnf --defaults-extra-file Path to an extra custom config file --server-log Path to explicit log file (error_log) =head1 PERFORMANCE AND REPORTING OPTIONS --skipsize Don't enumerate tables and their types/sizes (default: on) (Recommended for servers with many tables) --json Print result as JSON string --prettyjson Print result as JSON formatted string --skippassword Don't perform checks on user passwords (default: off) --checkversion Check for updates to MySQLTuner (default: don't check) --updateversion Check for updates to MySQLTuner and update when newer version is available (default: don't check) --forcemem Amount of RAM installed in megabytes --forceswap Amount of swap memory configured in megabytes --passwordfile Path to a password file list (one password by line) --cvefile CVE File for vulnerability checks --outputfile Path to a output txt file --reportfile Path to a report txt file --template Path to a template file --dumpdir Path to a directory where to dump information files --feature Run a specific feature (see FEATURES section) =head1 OUTPUT OPTIONS --silent Don't output anything on screen --verbose Print out all options (default: no verbose, dbstat, idxstat, sysstat, tbstat, pfstat) --color Print output in color --nocolor Don't print output in color --nogood Remove OK responses --nobad Remove negative/suggestion responses --noinfo Remove informational responses --debug Print debug information --noprocess Consider no other process is running --dbstat Print database information --nodbstat Don't print database information --tbstat Print table information --notbstat Don't print table information --colstat Print column information --nocolstat Don't print column information --idxstat Print index information --noidxstat Don't print index information --nomyisamstat Don't print MyIsam information --sysstat Print system information --nosysstat Don't print system information --nostructstat Don't print table structures information --pfstat Print Performance schema --nopfstat Don't print Performance schema --bannedports Ports banned separated by comma (,) --server-log Define specific error_log to analyze --maxportallowed Number of open ports allowable on this host --buffers Print global and per-thread buffer values =head1 PERLDOC You can find documentation for this module with the perldoc command. perldoc mysqltuner =head2 INTERNALS L Internal documentation =head1 AUTHORS Major Hayden - major@mhtx.net Jean-Marie Renouard - jmrenouard@gmail.com =head1 CONTRIBUTORS =over 4 =item * Matthew Montgomery =item * Paul Kehrer =item * Dave Burgess =item * Jonathan Hinds =item * Mike Jackson =item * Nils Breunese =item * Shawn Ashlee =item * Luuk Vosslamber =item * Ville Skytta =item * Trent Hornibrook =item * Jason Gill =item * Mark Imbriaco =item * Greg Eden =item * Aubin Galinotti =item * Giovanni Bechis =item * Bill Bradford =item * Ryan Novosielski =item * Michael Scheidell =item * Blair Christensen =item * Hans du Plooy =item * Victor Trac =item * Everett Barnes =item * Tom Krouper =item * Gary Barrueto =item * Simon Greenaway =item * Adam Stein =item * Isart Montane =item * Baptiste M. =item * Cole Turner =item * Major Hayden =item * Joe Ashcraft =item * Jean-Marie Renouard =item * Stephan GroBberndt =item * Christian Loos =item * Long Radix =back =head1 SUPPORT Bug reports, feature requests, and downloads at http://mysqltuner.pl/ Bug tracker can be found at https://github.com/major/MySQLTuner-perl/issues Maintained by Jean-Marie Renouard (jmrenouard\@gmail.com) - Licensed under GPL =head1 SOURCE CODE L git clone https://github.com/major/MySQLTuner-perl.git =head1 COPYRIGHT AND LICENSE Copyright (C) 2006-2023 Major Hayden - major@mhtx.net # Copyright (C) 2015-2023 Jean-Marie Renouard - jmrenouard@gmail.com For the latest updates, please visit http://mysqltuner.pl/ Git repository available at https://github.com/major/MySQLTuner-perl This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . =cut # Local variables: # indent-tabs-mode: t # cperl-indent-level: 8 # perl-indent-level: 8 # End: ================================================ FILE: aegir/helpers/mysqltuner8 ================================================ #!/usr/bin/env perl # mysqltuner.pl - Version 2.6.0 # High Performance MySQL Tuning Script # Copyright (C) 2015-2023 Jean-Marie Renouard - jmrenouard@gmail.com # Copyright (C) 2006-2023 Major Hayden - major@mhtx.net # For the latest updates, please visit http://mysqltuner.pl/ # Git repository available at https://github.com/major/MySQLTuner-perl # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . # # This project would not be possible without help from: # Matthew Montgomery Paul Kehrer Dave Burgess # Jonathan Hinds Mike Jackson Nils Breunese # Shawn Ashlee Luuk Vosslamber Ville Skytta # Trent Hornibrook Jason Gill Mark Imbriaco # Greg Eden Aubin Galinotti Giovanni Bechis # Bill Bradford Ryan Novosielski Michael Scheidell # Blair Christensen Hans du Plooy Victor Trac # Everett Barnes Tom Krouper Gary Barrueto # Simon Greenaway Adam Stein Isart Montane # Baptiste M. Cole Turner Major Hayden # Joe Ashcraft Jean-Marie Renouard Christian Loos # Julien Francoz Daniel Black Long Radix # # Inspired by Matthew Montgomery's tuning-primer.sh script: # http://www.day32.com/MySQL/ # package main; use 5.005; use strict; use warnings; use diagnostics; use File::Spec; use Getopt::Long; use Pod::Usage; use File::Basename; use Cwd 'abs_path'; #use Data::Dumper; #$Data::Dumper::Pair = " : "; # for which() #use Env; # Set up a few variables for use in the script my $tunerversion = "2.6.0"; my ( @adjvars, @generalrec ); # Set defaults my %opt = ( "silent" => 0, "nobad" => 0, "nogood" => 0, "noinfo" => 0, "debug" => 0, "nocolor" => ( !-t STDOUT ), "color" => ( -t STDOUT ), "forcemem" => 0, "forceswap" => 0, "host" => 0, "socket" => 0, "port" => 0, "user" => 0, "pass" => 0, "password" => 0, "ssl-ca" => 0, "skipsize" => 0, "checkversion" => 0, "updateversion" => 0, "buffers" => 0, "passwordfile" => 0, "bannedports" => '', "maxportallowed" => 0, "outputfile" => 0, "noprocess" => 0, "dbstat" => 0, "nodbstat" => 0, "server-log" => '', "tbstat" => 0, "notbstat" => 0, "colstat" => 0, "nocolstat" => 0, "idxstat" => 0, "noidxstat" => 0, "nomyisamstat" => 0, "nostructstat" => 0, "sysstat" => 0, "nosysstat" => 0, "pfstat" => 0, "nopfstat" => 0, "skippassword" => 0, "noask" => 0, "template" => 0, "json" => 0, "prettyjson" => 0, "reportfile" => 0, "verbose" => 0, "experimental" => 0, "nondedicated" => 0, "defaults-file" => '', "defaults-extra-file" => '', "protocol" => '', "dumpdir" => '', "feature" => '', "dbgpattern" => '', "defaultarch" => 64 ); # Gather the options from the command line GetOptions( \%opt, 'nobad', 'nogood', 'noinfo', 'debug', 'nocolor', 'forcemem=i', 'forceswap=i', 'host=s', 'socket=s', 'port=i', 'user=s', 'pass=s', 'skipsize', 'checkversion', 'mysqladmin=s', 'mysqlcmd=s', 'help', 'buffers', 'skippassword', 'passwordfile=s', 'outputfile=s', 'silent', 'noask', 'json', 'prettyjson', 'template=s', 'reportfile=s', 'cvefile=s', 'bannedports=s', 'updateversion', 'maxportallowed=s', 'verbose', 'password=s', 'passenv=s', 'userenv=s', 'defaults-file=s', 'ssl-ca=s', 'color', 'noprocess', 'dbstat', 'nodbstat', 'tbstat', 'notbstat', 'colstat', 'nocolstat', 'sysstat', 'nosysstat', 'pfstat', 'nopfstat', 'idxstat', 'noidxstat', 'structstat', 'nostructstat', 'myisamstat', 'nomyisamstat', 'server-log=s', 'protocol=s', 'defaults-extra-file=s', 'dumpdir=s', 'feature=s', 'dbgpattern=s', 'defaultarch=i', 'experimental', 'nondedicated' ) or pod2usage( -exitval => 1, -verbose => 99, -sections => [ "NAME", "IMPORTANT USAGE GUIDELINES", "CONNECTION AND AUTHENTICATION", "PERFORMANCE AND REPORTING OPTIONS", "OUTPUT OPTIONS" ] ); if ( defined $opt{'help'} && $opt{'help'} == 1 ) { pod2usage( -exitval => 0, -verbose => 99, -sections => [ "NAME", "IMPORTANT USAGE GUIDELINES", "CONNECTION AND AUTHENTICATION", "PERFORMANCE AND REPORTING OPTIONS", "OUTPUT OPTIONS" ] ); } my $devnull = File::Spec->devnull(); my $basic_password_files = ( $opt{passwordfile} eq "0" ) ? abs_path( dirname(__FILE__) ) . "/basic_passwords.txt" : abs_path( $opt{passwordfile} ); # Username from envvar if ( exists $opt{userenv} && exists $ENV{ $opt{userenv} } ) { $opt{user} = $ENV{ $opt{userenv} }; } # Related to password option if ( exists $opt{passenv} && exists $ENV{ $opt{passenv} } ) { $opt{pass} = $ENV{ $opt{passenv} }; } $opt{pass} = $opt{password} if ( $opt{pass} eq 0 and $opt{password} ne 0 ); if ( $opt{dumpdir} ne '' ) { $opt{dumpdir} = abs_path( $opt{dumpdir} ); if ( !-d $opt{dumpdir} ) { mkdir $opt{dumpdir} or die "Cannot create directory $opt{dumpdir}: $!"; } } # for RPM distributions $basic_password_files = "/usr/share/mysqltuner/basic_passwords.txt" unless -f "$basic_password_files"; $opt{dbgpattern} = '.*' if ( $opt{dbgpattern} eq '' ); # Activate debug variables #if ( $opt{debug} ne '' ) { $opt{debug} = 2; } # Activate experimental calculations and analysis #if ( $opt{experimental} ne '' ) { $opt{experimental} = 1; } # check if we need to enable verbose mode if ( $opt{feature} ne '' ) { $opt{verbose} = 1; } if ( $opt{verbose} ) { $opt{checkversion} = 0; # Check for updates to MySQLTuner $opt{dbstat} = 1; # Print database information $opt{tbstat} = 1; # Print database information $opt{idxstat} = 1; # Print index information $opt{sysstat} = 1; # Print index information $opt{buffers} = 1; # Print global and per-thread buffer values $opt{pfstat} = 1; # Print performance schema info. $opt{structstat} = 1; # Print table structure information $opt{myisamstat} = 1; # Print MyISAM table information $opt{cvefile} = 'vulnerabilities.csv'; #CVE File for vulnerability checks } $opt{nocolor} = 1 if defined( $opt{outputfile} ); $opt{tbstat} = 0 if ( $opt{notbstat} == 1 ); # Don't print table information $opt{colstat} = 0 if ( $opt{nocolstat} == 1 ); # Don't print column information $opt{dbstat} = 0 if ( $opt{nodbstat} == 1 ); # Don't print database information $opt{noprocess} = 0 if ( $opt{noprocess} == 1 ); # Don't print process information $opt{sysstat} = 0 if ( $opt{nosysstat} == 1 ); # Don't print sysstat information $opt{pfstat} = 0 if ( $opt{nopfstat} == 1 ); # Don't print performance schema information $opt{idxstat} = 0 if ( $opt{noidxstat} == 1 ); # Don't print index information $opt{structstat} = 0 if ( not defined( $opt{structstat} ) or $opt{nostructstat} == 1 ) ; # Don't print table struct information $opt{myisamstat} = 1 if ( not defined( $opt{myisamstat} ) ); $opt{myisamstat} = 0 if ( $opt{nomyisamstat} == 1 ); # Don't print MyISAM table information # for RPM distributions $opt{cvefile} = "/usr/share/mysqltuner/vulnerabilities.csv" unless ( defined $opt{cvefile} and -f "$opt{cvefile}" ); $opt{cvefile} = '' unless -f "$opt{cvefile}"; $opt{cvefile} = './vulnerabilities.csv' if -f './vulnerabilities.csv'; $opt{'bannedports'} = '' unless defined( $opt{'bannedports'} ); my @banned_ports = split ',', $opt{'bannedports'}; # my $outputfile = undef; $outputfile = abs_path( $opt{outputfile} ) unless $opt{outputfile} eq "0"; my $fh = undef; open( $fh, '>', $outputfile ) or die("Fail opening $outputfile") if defined($outputfile); $opt{nocolor} = 1 if defined($outputfile); $opt{nocolor} = 1 unless ( -t STDOUT ); $opt{nocolor} = 0 if ( $opt{color} == 1 ); # Setting up the colors for the print styles my $me = `whoami`; $me =~ s/\n//g; my $good = ( $opt{nocolor} == 0 ) ? "[\e[0;32mOK\e[0m]" : "[OK]"; my $bad = ( $opt{nocolor} == 0 ) ? "[\e[0;31m!!\e[0m]" : "[!!]"; my $info = ( $opt{nocolor} == 0 ) ? "[\e[0;34m--\e[0m]" : "[--]"; my $deb = ( $opt{nocolor} == 0 ) ? "[\e[0;31mDG\e[0m]" : "[DG]"; my $cmd = ( $opt{nocolor} == 0 ) ? "\e[1;32m[CMD]($me)" : "[CMD]($me)"; my $end = ( $opt{nocolor} == 0 ) ? "\e[0m" : ""; # Maximum lines of log output to read from end my $maxlines = 30000; # Checks for supported or EOL'ed MySQL versions my ( $mysqlvermajor, $mysqlverminor, $mysqlvermicro ); # Database my @dblist; # Super structure containing all information my %result; $result{'MySQLTuner'}{'version'} = $tunerversion; $result{'MySQLTuner'}{'datetime'} = `date '+%d-%m-%Y %H:%M:%S'`; $result{'MySQLTuner'}{'options'} = \%opt; # Functions that handle the print styles sub prettyprint { print $_[0] . "\n" unless ( $opt{'silent'} or $opt{'json'} ); print $fh $_[0] . "\n" if defined($fh); } sub goodprint { prettyprint $good. " " . $_[0] unless ( $opt{nogood} == 1 ); } sub infoprint { prettyprint $info. " " . $_[0] unless ( $opt{noinfo} == 1 ); } sub badprint { prettyprint $bad. " " . $_[0] unless ( $opt{nobad} == 1 ); } sub debugprint { prettyprint $deb. " " . $_[0] unless ( $opt{debug} == 0 ); } sub redwrap { return ( $opt{nocolor} == 0 ) ? "\e[0;31m" . $_[0] . "\e[0m" : $_[0]; } sub greenwrap { return ( $opt{nocolor} == 0 ) ? "\e[0;32m" . $_[0] . "\e[0m" : $_[0]; } sub cmdprint { prettyprint $cmd. " " . $_[0] . $end; } sub infoprintml { for my $ln (@_) { $ln =~ s/\n//g; infoprint "\t$ln"; } } sub infoprintcmd { cmdprint "@_"; infoprintml grep { $_ ne '' and $_ !~ /^\s*$/ } `@_ 2>&1`; } sub subheaderprint { my $tln = 100; my $sln = 8; my $ln = length("@_") + 2; prettyprint " "; prettyprint "-" x $sln . " @_ " . "-" x ( $tln - $ln - $sln ); } sub infoprinthcmd { subheaderprint "$_[0]"; infoprintcmd "$_[1]"; } sub is_remote() { my $host = $opt{'host'}; return 0 if ( $host eq '' ); return 0 if ( $host eq 'localhost' ); return 0 if ( $host eq '127.0.0.1' ); return 1; } sub is_int { return 0 unless defined $_[0]; my $str = $_[0]; #trim whitespace both sides $str =~ s/^\s+|\s+$//g; #Alternatively, to match any float-like numeric, use: # m/^([+-]?)(?=\d|\.\d)\d*(\.\d*)?([Ee]([+-]?\d+))?$/ #flatten to string and match dash or plus and one or more digits if ( $str =~ /^(\-|\+)?\d+?$/ ) { return 1; } return 0; } # Calculates the number of physical cores considering HyperThreading sub cpu_cores { if ( $^O eq 'linux' ) { my $cntCPU = `awk -F: '/^core id/ && !P[\$2] { CORES++; P[\$2]=1 }; /^physical id/ && !N[\$2] { CPUs++; N[\$2]=1 }; END { print CPUs*CORES }' /proc/cpuinfo`; chomp $cntCPU; return ( $cntCPU == 0 ? `nproc` : $cntCPU ); } if ( $^O eq 'freebsd' ) { my $cntCPU = `sysctl -n kern.smp.cores`; chomp $cntCPU; return $cntCPU + 0; } return 0; } # Calculates the parameter passed in bytes, then rounds it to one decimal place sub hr_bytes { my $num = shift; return "0B" unless defined($num); return "0B" if $num eq "NULL"; return "0B" if $num eq ""; if ( $num >= ( 1024**3 ) ) { # GB return sprintf( "%.1f", ( $num / ( 1024**3 ) ) ) . "G"; } elsif ( $num >= ( 1024**2 ) ) { # MB return sprintf( "%.1f", ( $num / ( 1024**2 ) ) ) . "M"; } elsif ( $num >= 1024 ) { # KB return sprintf( "%.1f", ( $num / 1024 ) ) . "K"; } else { return $num . "B"; } } sub hr_raw { my $num = shift; return "0" unless defined($num); return "0" if $num eq "NULL"; if ( $num =~ /^(\d+)G$/ ) { return $1 * 1024 * 1024 * 1024; } if ( $num =~ /^(\d+)M$/ ) { return $1 * 1024 * 1024; } if ( $num =~ /^(\d+)K$/ ) { return $1 * 1024; } if ( $num =~ /^(\d+)$/ ) { return $1; } return $num; } # Calculates the parameter passed in bytes, then rounds it to the nearest integer sub hr_bytes_rnd { my $num = shift; return "0B" unless defined($num); return "0B" if $num eq "NULL"; if ( $num >= ( 1024**3 ) ) { # GB return int( ( $num / ( 1024**3 ) ) ) . "G"; } elsif ( $num >= ( 1024**2 ) ) { # MB return int( ( $num / ( 1024**2 ) ) ) . "M"; } elsif ( $num >= 1024 ) { # KB return int( ( $num / 1024 ) ) . "K"; } else { return $num . "B"; } } # Calculates the parameter passed to the nearest power of 1000, then rounds it to the nearest integer sub hr_num { my $num = shift; if ( $num >= ( 1000**3 ) ) { # Billions return int( ( $num / ( 1000**3 ) ) ) . "B"; } elsif ( $num >= ( 1000**2 ) ) { # Millions return int( ( $num / ( 1000**2 ) ) ) . "M"; } elsif ( $num >= 1000 ) { # Thousands return int( ( $num / 1000 ) ) . "K"; } else { return $num; } } # Calculate Percentage sub percentage { my $value = shift; my $total = shift; $total = 0 unless defined $total; $total = 0 if $total eq "NULL"; return 100, 00 if $total == 0; return sprintf( "%.2f", ( $value * 100 / $total ) ); } # Calculates uptime to display in a human-readable form sub pretty_uptime { my $uptime = shift; my $seconds = $uptime % 60; my $minutes = int( ( $uptime % 3600 ) / 60 ); my $hours = int( ( $uptime % 86400 ) / (3600) ); my $days = int( $uptime / (86400) ); my $uptimestring; if ( $days > 0 ) { $uptimestring = "${days}d ${hours}h ${minutes}m ${seconds}s"; } elsif ( $hours > 0 ) { $uptimestring = "${hours}h ${minutes}m ${seconds}s"; } elsif ( $minutes > 0 ) { $uptimestring = "${minutes}m ${seconds}s"; } else { $uptimestring = "${seconds}s"; } return $uptimestring; } # Retrieves the memory installed on this machine my ( $physical_memory, $swap_memory, $duflags, $xargsflags ); sub memerror { badprint "Unable to determine total memory/swap; use '--forcemem' and '--forceswap'"; exit 1; } sub os_setup { my $os = `uname`; $duflags = ( $os =~ /Linux/ ) ? '-b' : ''; $xargsflags = ( $os =~ /Darwin|SunOS/ ) ? '' : '-r'; if ( $opt{'forcemem'} > 0 ) { $physical_memory = $opt{'forcemem'} * 1048576; infoprint "Assuming $opt{'forcemem'} MB of physical memory"; if ( $opt{'forceswap'} > 0 ) { $swap_memory = $opt{'forceswap'} * 1048576; infoprint "Assuming $opt{'forceswap'} MB of swap space"; } else { $swap_memory = 0; badprint "Assuming 0 MB of swap space (use --forceswap to specify)"; } } else { if ( $os =~ /Linux|CYGWIN/ ) { $physical_memory = `grep -i memtotal: /proc/meminfo | awk '{print \$2}'` or memerror; $physical_memory *= 1024; $swap_memory = `grep -i swaptotal: /proc/meminfo | awk '{print \$2}'` or memerror; $swap_memory *= 1024; } elsif ( $os =~ /Darwin/ ) { $physical_memory = `sysctl -n hw.memsize` or memerror; $swap_memory = `sysctl -n vm.swapusage | awk '{print \$3}' | sed 's/\..*\$//'` or memerror; } elsif ( $os =~ /NetBSD|OpenBSD|FreeBSD/ ) { $physical_memory = `sysctl -n hw.physmem` or memerror; if ( $physical_memory < 0 ) { $physical_memory = `sysctl -n hw.physmem64` or memerror; } $swap_memory = `swapctl -l | grep '^/' | awk '{ s+= \$2 } END { print s }'` or memerror; } elsif ( $os =~ /BSD/ ) { $physical_memory = `sysctl -n hw.realmem` or memerror; $swap_memory = `swapinfo | grep '^/' | awk '{ s+= \$2 } END { print s }'`; } elsif ( $os =~ /SunOS/ ) { $physical_memory = `/usr/sbin/prtconf | grep Memory | cut -f 3 -d ' '` or memerror; chomp($physical_memory); $physical_memory = $physical_memory * 1024 * 1024; } elsif ( $os =~ /AIX/ ) { $physical_memory = `lsattr -El sys0 | grep realmem | awk '{print \$2}'` or memerror; chomp($physical_memory); $physical_memory = $physical_memory * 1024; $swap_memory = `lsps -as | awk -F"(MB| +)" '/MB /{print \$2}'` or memerror; chomp($swap_memory); $swap_memory = $swap_memory * 1024 * 1024; } elsif ( $os =~ /windows/i ) { $physical_memory = `wmic ComputerSystem get TotalPhysicalMemory | perl -ne "chomp; print if /[0-9]+/;"` or memerror; $swap_memory = `wmic OS get FreeVirtualMemory | perl -ne "chomp; print if /[0-9]+/;"` or memerror; } } debugprint "Physical Memory: $physical_memory"; debugprint "Swap Memory: $swap_memory"; chomp($physical_memory); chomp($swap_memory); chomp($os); $physical_memory = $opt{forcemem} if ( defined( $opt{forcemem} ) and $opt{forcemem} gt 0 ); $result{'OS'}{'OS Type'} = $os; $result{'OS'}{'Physical Memory'}{'bytes'} = $physical_memory; $result{'OS'}{'Physical Memory'}{'pretty'} = hr_bytes($physical_memory); $result{'OS'}{'Swap Memory'}{'bytes'} = $swap_memory; $result{'OS'}{'Swap Memory'}{'pretty'} = hr_bytes($swap_memory); $result{'OS'}{'Other Processes'}{'bytes'} = get_other_process_memory(); $result{'OS'}{'Other Processes'}{'pretty'} = hr_bytes( get_other_process_memory() ); } sub get_http_cli { my $httpcli = which( "curl", $ENV{'PATH'} ); chomp($httpcli); if ($httpcli) { return $httpcli; } $httpcli = which( "wget", $ENV{'PATH'} ); chomp($httpcli); if ($httpcli) { return $httpcli; } return ""; } # Checks for updates to MySQLTuner sub validate_tuner_version { if ( $opt{'checkversion'} eq 0 ) { print "\n" unless ( $opt{'silent'} or $opt{'json'} ); infoprint "Skipped version check for MySQLTuner script"; return; } my $update; my $url = "https://raw.githubusercontent.com/major/MySQLTuner-perl/master/mysqltuner.pl"; my $httpcli = get_http_cli(); if ( $httpcli =~ /curl$/ ) { debugprint "$httpcli is available."; debugprint "$httpcli -m 3 -silent '$url' 2>/dev/null | grep 'my \$tunerversion'| cut -d\\\" -f2"; $update = `$httpcli -m 3 -silent '$url' 2>/dev/null | grep 'my \$tunerversion'| cut -d\\\" -f2`; chomp($update); debugprint "VERSION: $update"; compare_tuner_version($update); return; } if ( $httpcli =~ /wget$/ ) { debugprint "$httpcli is available."; debugprint "$httpcli -e timestamping=off -t 1 -T 3 -O - '$url' 2>$devnull| grep 'my \$tunerversion'| cut -d\\\" -f2"; $update = `$httpcli -e timestamping=off -t 1 -T 3 -O - '$url' 2>$devnull| grep 'my \$tunerversion'| cut -d\\\" -f2`; chomp($update); compare_tuner_version($update); return; } debugprint "curl and wget are not available."; infoprint "Unable to check for the latest MySQLTuner version"; infoprint "Using --pass and --password option is insecure during MySQLTuner execution (password disclosure)" if ( defined( $opt{'pass'} ) ); } # Checks for updates to MySQLTuner sub update_tuner_version { if ( $opt{'updateversion'} eq 0 ) { badprint "Skipped version update for MySQLTuner script"; print "\n" unless ( $opt{'silent'} or $opt{'json'} ); return; } my $update; my $fullpath = ""; my $url = "https://raw.githubusercontent.com/major/MySQLTuner-perl/master/"; my @scripts = ( "mysqltuner.pl", "basic_passwords.txt", "vulnerabilities.csv" ); my $totalScripts = scalar(@scripts); my $receivedScripts = 0; my $httpcli = get_http_cli(); foreach my $script (@scripts) { if ( $httpcli =~ /curl$/ ) { debugprint "$httpcli is available."; $fullpath = dirname(__FILE__) . "/" . $script; debugprint "FullPath: $fullpath"; debugprint "$httpcli --connect-timeout 3 '$url$script' 2>$devnull > $fullpath"; $update = `$httpcli --connect-timeout 3 '$url$script' 2>$devnull > $fullpath`; chomp($update); debugprint "$script updated: $update"; if ( -s $script eq 0 ) { badprint "Couldn't update $script"; } else { ++$receivedScripts; debugprint "$script updated: $update"; } } elsif ( $httpcli =~ /wget$/ ) { debugprint "$httpcli is available."; debugprint "$httpcli -qe timestamping=off -t 1 -T 3 -O $script '$url$script'"; $update = `$httpcli -qe timestamping=off -t 1 -T 3 -O $script '$url$script'`; chomp($update); if ( -s $script eq 0 ) { badprint "Couldn't update $script"; } else { ++$receivedScripts; debugprint "$script updated: $update"; } } else { debugprint "curl and wget are not available."; infoprint "Unable to check for the latest MySQLTuner version"; } } if ( $receivedScripts eq $totalScripts ) { goodprint "Successfully updated MySQLTuner script"; } else { badprint "Couldn't update MySQLTuner script"; } infoprint "Stopping program: MySQLTuner script must be updated first."; exit 0; } sub compare_tuner_version { my $remoteversion = shift; debugprint "Remote data: $remoteversion"; #exit 0; if ( $remoteversion ne $tunerversion ) { badprint "There is a new version of MySQLTuner available ($remoteversion)"; update_tuner_version(); return; } goodprint "You have the latest version of MySQLTuner ($tunerversion)"; return; } # Checks to see if a MySQL login is possible my ( $mysqllogin, $doremote, $remotestring, $mysqlcmd, $mysqladmincmd ); my $osname = $^O; if ( $osname eq 'MSWin32' ) { eval { require Win32; } or last; $osname = Win32::GetOSName(); infoprint "* Windows OS ($osname) is not fully supported.\n"; #exit 1; } sub mysql_setup { $doremote = 0; $remotestring = ''; if ( $opt{mysqladmin} ) { $mysqladmincmd = $opt{mysqladmin}; } else { $mysqladmincmd = which( "mariadb-admin", $ENV{'PATH'} ); if ( !-e $mysqladmincmd ) { $mysqladmincmd = which( "mysqladmin", $ENV{'PATH'} ); } } chomp($mysqladmincmd); if ( !-e $mysqladmincmd && $opt{mysqladmin} ) { badprint "Unable to find the mysqladmin command you specified: " . $mysqladmincmd . ""; exit 1; } elsif ( !-e $mysqladmincmd ) { badprint "Couldn't find mysqladmin/mariadb-admin in your \$PATH. Is MySQL installed?"; #exit 1; } if ( $opt{mysqlcmd} ) { $mysqlcmd = $opt{mysqlcmd}; } else { $mysqlcmd = which( "mariadb", $ENV{'PATH'} ); if ( !-e $mysqlcmd ) { $mysqlcmd = which( "mysql", $ENV{'PATH'} ); } } chomp($mysqlcmd); if ( !-e $mysqlcmd && $opt{mysqlcmd} ) { badprint "Unable to find the mysql command you specified: " . $mysqlcmd . ""; exit 1; } elsif ( !-e $mysqlcmd ) { badprint "Couldn't find mysql/mariadb in your \$PATH. Is MySQL installed?"; exit 1; } $mysqlcmd =~ s/\n$//g; my $mysqlclidefaults = `$mysqlcmd --print-defaults`; debugprint "MySQL Client: $mysqlclidefaults"; if ( $mysqlclidefaults =~ /auto-vertical-output/ ) { badprint "Avoid auto-vertical-output in configuration file(s) for MySQL like"; exit 1; } debugprint "MySQL Client: $mysqlcmd"; # Are we being asked to connect via a socket? if ( $opt{socket} ne 0 ) { if ( $opt{port} ne 0 ) { $remotestring = " -S $opt{socket} -P $opt{port}"; } else { $remotestring = " -S $opt{socket}"; } } if ( $opt{protocol} ne '' ) { $remotestring = " --protocol=$opt{protocol}"; } # Are we being asked to connect to a remote server? if ( $opt{host} ne 0 ) { chomp( $opt{host} ); $opt{port} = ( $opt{port} eq 0 ) ? 3306 : $opt{port}; # If we're doing a remote connection, but forcemem wasn't specified, we need to exit if ( $opt{'forcemem'} eq 0 && is_remote eq 1 ) { badprint "The --forcemem option is required for remote connections"; badprint "Assuming RAM memory is 1Gb for simplify remote connection usage"; $opt{'forcemem'} = 1024; #exit 1; } if ( $opt{'forceswap'} eq 0 && is_remote eq 1 ) { badprint "The --forceswap option is required for remote connections"; badprint "Assuming Swap size is 1Gb for simplify remote connection usage"; $opt{'forceswap'} = 1024; #exit 1; } infoprint "Performing tests on $opt{host}:$opt{port}"; $remotestring = " -h $opt{host} -P $opt{port}"; $doremote = is_remote(); } else { $opt{host} = '127.0.0.1'; } if ( $opt{'ssl-ca'} ne 0 ) { if ( -e -r -f $opt{'ssl-ca'} ) { $remotestring .= " --ssl-ca=$opt{'ssl-ca'}"; infoprint "Will connect using ssl public key passed on the command line"; return 1; } else { badprint "Attempted to use passed ssl public key, but it was not found or could not be read"; exit 1; } } # Did we already get a username with or without password on the command line? if ( $opt{user} ne 0 ) { $mysqllogin = "-u $opt{user} " . ( ( $opt{pass} ne 0 ) ? "-p'$opt{pass}' " : " " ) . $remotestring; my $loginstatus = `$mysqlcmd -Nrs -e 'select "mysqld is alive";' $mysqllogin 2>&1`; if ( $loginstatus =~ /mysqld is alive/ ) { goodprint "Logged in using credentials passed on the command line"; return 1; } else { badprint "Attempted to use login credentials, but they were invalid"; exit 1; } } my $svcprop = which( "svcprop", $ENV{'PATH'} ); if ( substr( $svcprop, 0, 1 ) =~ "/" ) { # We are on solaris ( my $mysql_login = `svcprop -p quickbackup/username svc:/network/mysql-quickbackup:default` ) =~ s/\s+$//; ( my $mysql_pass = `svcprop -p quickbackup/password svc:/network/mysql-quickbackup:default` ) =~ s/\s+$//; if ( substr( $mysql_login, 0, 7 ) ne "svcprop" ) { # mysql-quickbackup is installed $mysqllogin = "-u $mysql_login -p$mysql_pass"; my $loginstatus = `mysqladmin $mysqllogin ping 2>&1`; if ( $loginstatus =~ /mysqld is alive/ ) { goodprint "Logged in using credentials from mysql-quickbackup."; return 1; } else { badprint "Attempted to use login credentials from mysql-quickbackup, but they failed."; exit 1; } } } elsif ( -r "/etc/psa/.psa.shadow" and $doremote == 0 ) { # It's a Plesk box, use the available credentials $mysqllogin = "-u admin -p`cat /etc/psa/.psa.shadow`"; my $loginstatus = `$mysqladmincmd ping $mysqllogin 2>&1`; unless ( $loginstatus =~ /mysqld is alive/ ) { # Plesk 10+ $mysqllogin = "-u admin -p`/usr/local/psa/bin/admin --show-password`"; $loginstatus = `$mysqladmincmd ping $mysqllogin 2>&1`; unless ( $loginstatus =~ /mysqld is alive/ ) { badprint "Attempted to use login credentials from Plesk and Plesk 10+, but they failed."; exit 1; } } } elsif ( -r "/usr/local/directadmin/conf/mysql.conf" and $doremote == 0 ) { # It's a DirectAdmin box, use the available credentials my $mysqluser = `cat /usr/local/directadmin/conf/mysql.conf | egrep '^user=.*'`; my $mysqlpass = `cat /usr/local/directadmin/conf/mysql.conf | egrep '^passwd=.*'`; $mysqluser =~ s/user=//; $mysqluser =~ s/[\r\n]//; $mysqlpass =~ s/passwd=//; $mysqlpass =~ s/[\r\n]//; $mysqllogin = "-u $mysqluser -p$mysqlpass"; my $loginstatus = `mysqladmin ping $mysqllogin 2>&1`; unless ( $loginstatus =~ /mysqld is alive/ ) { badprint "Attempted to use login credentials from DirectAdmin, but they failed."; exit 1; } } elsif ( -r "/etc/mysql/debian.cnf" and $doremote == 0 and $opt{'defaults-file'} eq '' ) { # We have a Debian maintenance account, use it $mysqllogin = "--defaults-file=/etc/mysql/debian.cnf"; my $loginstatus = `$mysqladmincmd $mysqllogin ping 2>&1`; if ( $loginstatus =~ /mysqld is alive/ ) { goodprint "Logged in using credentials from Debian maintenance account."; return 1; } else { badprint "Attempted to use login credentials from Debian maintenance account, but they failed."; exit 1; } } elsif ( $opt{'defaults-file'} ne '' and -r "$opt{'defaults-file'}" ) { # defaults-file debugprint "defaults file detected: $opt{'defaults-file'}"; my $mysqlclidefaults = `$mysqlcmd --print-defaults`; debugprint "MySQL Client Default File: $opt{'defaults-file'}"; $mysqllogin = "--defaults-file=" . $opt{'defaults-file'}; my $loginstatus = `$mysqladmincmd $mysqllogin ping 2>&1`; if ( $loginstatus =~ /mysqld is alive/ ) { goodprint "Logged in using credentials from defaults file account."; return 1; } } elsif ( $opt{'defaults-extra-file'} ne '' and -r "$opt{'defaults-extra-file'}" ) { # defaults-extra-file debugprint "defaults extra file detected: $opt{'defaults-extra-file'}"; my $mysqlclidefaults = `$mysqlcmd --print-defaults`; debugprint "MySQL Client Extra Default File: $opt{'defaults-extra-file'}"; $mysqllogin = "--defaults-extra-file=" . $opt{'defaults-extra-file'}; my $loginstatus = `$mysqladmincmd $mysqllogin ping 2>&1`; if ( $loginstatus =~ /mysqld is alive/ ) { goodprint "Logged in using credentials from extra defaults file account."; return 1; } } else { # It's not Plesk or Debian, we should try a login debugprint "$mysqladmincmd $remotestring ping 2>&1"; #my $loginstatus = ""; debugprint "Using mysqlcmd: $mysqlcmd"; #if (defined($mysqladmincmd)) { # infoprint "Using mysqladmin to check login"; # $loginstatus=`$mysqladmincmd $remotestring ping 2>&1`; #} else { infoprint "Using mysql to check login"; my $loginstatus = `$mysqlcmd $remotestring -Nrs -e 'select "mysqld is alive"' --connect-timeout=3 2>&1`; #} if ( $loginstatus =~ /mysqld is alive/ ) { # Login went just fine $mysqllogin = " $remotestring "; # Did this go well because of a .my.cnf file or is there no password set? my $userpath = `printenv HOME`; if ( length($userpath) > 0 ) { chomp($userpath); } unless ( -e "${userpath}/.my.cnf" or -e "${userpath}/.mylogin.cnf" ) { badprint "SECURITY RISK: Successfully authenticated without password"; } return 1; } else { if ( $opt{'noask'} == 1 ) { badprint "Attempted to use login credentials, but they were invalid"; exit 1; } my ( $name, $password ); # If --user is defined no need to ask for username if ( $opt{user} ne 0 ) { $name = $opt{user}; } else { print STDERR "Please enter your MySQL administrative login: "; $name = ; } # If --pass is defined no need to ask for password if ( $opt{pass} ne 0 ) { $password = $opt{pass}; } else { print STDERR "Please enter your MySQL administrative password: "; system("stty -echo >$devnull 2>&1"); $password = ; system("stty echo >$devnull 2>&1"); } chomp($password); chomp($name); $mysqllogin = "-u $name"; if ( length($password) > 0 ) { $mysqllogin .= " -p'$password'"; } $mysqllogin .= $remotestring; my $loginstatus = `$mysqladmincmd ping $mysqllogin 2>&1`; if ( $loginstatus =~ /mysqld is alive/ ) { #print STDERR ""; if ( !length($password) ) { # Did this go well because of a .my.cnf file or is there no password set? my $userpath = `printenv HOME`; chomp($userpath); unless ( -e "$userpath/.my.cnf" ) { print STDERR ""; badprint "SECURITY RISK: Successfully authenticated without password"; } } return 1; } else { #print STDERR ""; badprint "Attempted to use login credentials, but they were invalid."; exit 1; } exit 1; } } } # MySQL Request Array sub select_array { my $req = shift; debugprint "PERFORM: $req "; my @result = `$mysqlcmd $mysqllogin -Bse "\\w$req" 2>>/dev/null`; if ( $? != 0 ) { badprint "Failed to execute: $req"; badprint "FAIL Execute SQL / return code: $?"; debugprint "CMD : $mysqlcmd"; debugprint "OPTIONS: $mysqllogin"; debugprint `$mysqlcmd $mysqllogin -Bse "$req" 2>&1`; #exit $?; } debugprint "select_array: return code : $?"; chomp(@result); return @result; } # MySQL Request Array sub select_array_with_headers { my $req = shift; debugprint "PERFORM: $req "; my @result = `$mysqlcmd $mysqllogin -Bre "\\w$req" 2>>/dev/null`; if ( $? != 0 ) { badprint "Failed to execute: $req"; badprint "FAIL Execute SQL / return code: $?"; debugprint "CMD : $mysqlcmd"; debugprint "OPTIONS: $mysqllogin"; debugprint `$mysqlcmd $mysqllogin -Bse "$req" 2>&1`; #exit $?; } debugprint "select_array_with_headers: return code : $?"; chomp(@result); return @result; } # MySQL Request Array sub select_csv_file { my $tfile = shift; my $req = shift; debugprint "PERFORM: $req CSV into $tfile"; #return; my @result = select_array_with_headers($req); open( my $fh, '>', $tfile ) or die "Could not open file '$tfile' $!"; for my $l (@result) { $l =~ s/\t/","/g; $l =~ s/^/"/; $l =~ s/$/"\n/; print $fh $l; print $l if $opt{debug}; } close $fh; infoprint "CSV file $tfile created"; } sub human_size { my ( $size, $n ) = ( shift, 0 ); ++$n and $size /= 1024 until $size < 1024; return sprintf "%.2f %s", $size, (qw[ bytes KB MB GB TB ])[$n]; } # MySQL Request one sub select_one { my $req = shift; debugprint "PERFORM: $req "; my $result = `$mysqlcmd $mysqllogin -Bse "\\w$req" 2>>/dev/null`; if ( $? != 0 ) { badprint "Failed to execute: $req"; badprint "FAIL Execute SQL / return code: $?"; debugprint "CMD : $mysqlcmd"; debugprint "OPTIONS: $mysqllogin"; debugprint `$mysqlcmd $mysqllogin -Bse "$req" 2>&1`; #exit $?; } debugprint "select_array: return code : $?"; chomp($result); return $result; } # MySQL Request one sub select_one_g { my $pattern = shift; my $req = shift; debugprint "PERFORM: $req "; my @result = `$mysqlcmd $mysqllogin -re "\\w$req\\G" 2>>/dev/null`; if ( $? != 0 ) { badprint "Failed to execute: $req"; badprint "FAIL Execute SQL / return code: $?"; debugprint "CMD : $mysqlcmd"; debugprint "OPTIONS: $mysqllogin"; debugprint `$mysqlcmd $mysqllogin -Bse "$req" 2>&1`; #exit $?; } debugprint "select_array: return code : $?"; chomp(@result); return ( grep { /$pattern/ } @result )[0]; } sub select_str_g { my $pattern = shift; my $req = shift; my $str = select_one_g $pattern, $req; return () unless defined $str; my @val = split /:/, $str; shift @val; return trim(@val); } sub select_user_dbs { return select_array( "SELECT DISTINCT TABLE_SCHEMA FROM information_schema.TABLES WHERE TABLE_SCHEMA NOT IN ('mysql', 'information_schema', 'performance_schema', 'percona', 'sys')" ); } sub select_tables_db { my $schema = shift; return select_array( "SELECT DISTINCT TABLE_NAME FROM information_schema.TABLES WHERE TABLE_SCHEMA='$schema'" ); } sub select_indexes_db { my $schema = shift; return select_array( "SELECT DISTINCT INDEX_NAME FROM information_schema.STATISTICS WHERE TABLE_SCHEMA='$schema'" ); } sub select_views_db { my $schema = shift; return select_array( "SELECT DISTINCT TABLE_NAME FROM information_schema.VIEWS WHERE TABLE_SCHEMA='$schema'" ); } sub select_triggers_db { my $schema = shift; return select_array( "SELECT DISTINCT TRIGGER_NAME FROM information_schema.TRIGGERS WHERE TRIGGER_SCHEMA='$schema'" ); } sub select_routines_db { my $schema = shift; return select_array( "SELECT DISTINCT ROUTINE_NAME FROM information_schema.ROUTINES WHERE ROUTINE_SCHEMA='$schema'" ); } sub select_table_indexes_db { my $schema = shift; my $tbname = shift; return select_array( "SELECT INDEX_NAME FROM information_schema.STATISTICS WHERE TABLE_SCHEMA='$schema' AND TABLE_NAME='$tbname'" ); } sub select_table_columns_db { my $schema = shift; my $table = shift; return select_array( "SELECT COLUMN_NAME FROM information_schema.COLUMNS WHERE TABLE_SCHEMA='$schema' AND TABLE_NAME='$table'" ); } sub get_tuning_info { my @infoconn = select_array "\\s"; my ( $tkey, $tval ); @infoconn = grep { !/Threads:/ and !/Connection id:/ and !/pager:/ and !/Using/ } @infoconn; foreach my $line (@infoconn) { if ( $line =~ /\s*(.*):\s*(.*)/ ) { debugprint "$1 => $2"; $tkey = $1; $tval = $2; chomp($tkey); chomp($tval); $result{'MySQL Client'}{$tkey} = $tval; } } $result{'MySQL Client'}{'Client Path'} = $mysqlcmd; $result{'MySQL Client'}{'Admin Path'} = $mysqladmincmd; $result{'MySQL Client'}{'Authentication Info'} = $mysqllogin; } # Populates all of the variable and status hashes my ( %mystat, %myvar, $dummyselect, %myrepl, %myslaves ); sub arr2hash { my $href = shift; my $harr = shift; my $sep = shift; my $key = ''; my $val = ''; $sep = '\s' unless defined($sep); foreach my $line (@$harr) { next if ( $line =~ m/^\*\*\*\*\*\*\*/ ); $line =~ /([a-zA-Z_]*)\s*$sep\s*(.*)/; $key = $1; $val = $2; $$href{$key} = $val; debugprint " * $key = $val" if $key =~ /$opt{dbgpattern}/i; } } sub get_all_vars { # We need to initiate at least one query so that our data is useable $dummyselect = select_one "SELECT VERSION()"; if ( not defined($dummyselect) or $dummyselect eq "" ) { badprint "You probably do not have enough privileges to run MySQLTuner ..."; exit(256); } $dummyselect =~ s/(.*?)\-.*/$1/; debugprint "VERSION: " . $dummyselect . ""; $result{'MySQL Client'}{'Version'} = $dummyselect; my @mysqlvarlist = select_array("SHOW VARIABLES"); push( @mysqlvarlist, select_array("SHOW GLOBAL VARIABLES") ); arr2hash( \%myvar, \@mysqlvarlist ); $result{'Variables'} = \%myvar; my @mysqlstatlist = select_array("SHOW STATUS"); push( @mysqlstatlist, select_array("SHOW GLOBAL STATUS") ); arr2hash( \%mystat, \@mysqlstatlist ); $result{'Status'} = \%mystat; unless ( defined( $myvar{'innodb_support_xa'} ) ) { $myvar{'innodb_support_xa'} = 'ON'; } $mystat{'Uptime'} = 1 unless defined( $mystat{'Uptime'} ) and $mystat{'Uptime'} > 0; $myvar{'have_galera'} = "NO"; if ( defined( $myvar{'wsrep_provider_options'} ) && $myvar{'wsrep_provider_options'} ne "" && $myvar{'wsrep_on'} ne "OFF" ) { $myvar{'have_galera'} = "YES"; debugprint "Galera options: " . $myvar{'wsrep_provider_options'}; } # Workaround for MySQL bug #59393 wrt. ignore-builtin-innodb if ( ( $myvar{'ignore_builtin_innodb'} || "" ) eq "ON" ) { $myvar{'have_innodb'} = "NO"; } # Support GTID MODE FOR MARIADB # Issue MariaDB GTID mode #513 $myvar{'gtid_mode'} = 'ON' if ( defined( $myvar{'gtid_current_pos'} ) and $myvar{'gtid_current_pos'} ne '' ); # Whether the server uses a thread pool to handle client connections # MariaDB: thread_handling = pool-of-threads # MySQL: thread_handling = loaded-dynamically $myvar{'have_threadpool'} = "NO"; if ( defined( $myvar{'thread_handling'} ) and ( $myvar{'thread_handling'} eq 'pool-of-threads' || $myvar{'thread_handling'} eq 'loaded-dynamically' ) ) { $myvar{'have_threadpool'} = "YES"; } # have_* for engines is deprecated and will be removed in MySQL 5.6; # check SHOW ENGINES and set corresponding old style variables. # Also works around MySQL bug #59393 wrt. skip-innodb my @mysqlenginelist = select_array "SHOW ENGINES"; foreach my $line (@mysqlenginelist) { if ( $line =~ /^([a-zA-Z_]+)\s+(\S+)/ ) { my $engine = lc($1); if ( $engine eq "federated" || $engine eq "blackhole" ) { $engine .= "_engine"; } elsif ( $engine eq "berkeleydb" ) { $engine = "bdb"; } my $val = ( $2 eq "DEFAULT" ) ? "YES" : $2; $myvar{"have_$engine"} = $val; $result{'Storage Engines'}{$engine} = $2; } } #debugprint Dumper(@mysqlenginelist); my @mysqlslave; if ( mysql_version_eq(8) or mysql_version_ge( 10, 5 ) ) { @mysqlslave = select_array("SHOW REPLICA STATUS\\G"); } else { @mysqlslave = select_array("SHOW SLAVE STATUS\\G"); } arr2hash( \%myrepl, \@mysqlslave, ':' ); $result{'Replication'}{'Status'} = \%myrepl; my @mysqlslaves; if ( mysql_version_eq(8) or mysql_version_ge( 10, 5 ) ) { @mysqlslaves = select_array "SHOW SLAVE STATUS"; } else { @mysqlslaves = select_array("SHOW SLAVE HOSTS\\G"); } my @lineitems = (); foreach my $line (@mysqlslaves) { debugprint "L: $line "; @lineitems = split /\s+/, $line; $myslaves{ $lineitems[0] } = $line; $result{'Replication'}{'Slaves'}{ $lineitems[0] } = $lineitems[4]; } } sub remove_cr { return map { my $line = $_; $line =~ s/\n$//g; $line =~ s/^\s+$//g; $line; } @_; } sub remove_empty { grep { $_ ne '' } @_; } sub grep_file_contents { my $file = shift; my $patt; } sub get_file_contents { my $file = shift; open( my $fh, "<", $file ) or die "Can't open $file for read: $!"; my @lines = <$fh>; close $fh or die "Cannot close $file: $!"; @lines = remove_cr @lines; return @lines; } sub get_basic_passwords { return get_file_contents(shift); } sub get_log_file_real_path { my $file = shift; my $hostname = shift; my $datadir = shift; if ( -f "$file" ) { return $file; } elsif ( -f "$hostname.log" ) { return "$hostname.log"; } elsif ( -f "$hostname.err" ) { return "$hostname.err"; } elsif ( -f "$datadir$hostname.err" ) { return "$datadir$hostname.err"; } elsif ( -f "$datadir$hostname.log" ) { return "$datadir$hostname.log"; } elsif ( -f "$datadir" . "mysql_error.log" ) { return "$datadir" . "mysql_error.log"; } elsif ( -f "/var/log/mysql.log" ) { return "/var/log/mysql.log"; } elsif ( -f "/var/log/mysqld.log" ) { return "/var/log/mysqld.log"; } elsif ( -f "/var/log/mysql/$hostname.err" ) { return "/var/log/mysql/$hostname.err"; } elsif ( -f "/var/log/mysql/$hostname.log" ) { return "/var/log/mysql/$hostname.log"; } elsif ( -f "/var/log/mysql/" . "mysql_error.log" ) { return "/var/log/mysql/" . "mysql_error.log"; } else { return $file; } } sub log_file_recommendations { if ( is_remote eq 1 ) { infoprint "Skipping error log files checks on remote host"; return; } my $fh; $myvar{'log_error'} = $opt{'server-log'} || get_log_file_real_path( $myvar{'log_error'}, $myvar{'hostname'}, $myvar{'datadir'} ); subheaderprint "Log file Recommendations"; if ( "$myvar{'log_error'}" eq "stderr" ) { badprint "log_error is set to $myvar{'log_error'}, but this script can't read stderr"; return; } elsif ( $myvar{'log_error'} =~ /^(docker|podman|kubectl):(.*)/ ) { open( $fh, '-|', "$1 logs --tail=$maxlines '$2'" ) // die "Can't start $1 $!"; goodprint "Log from cloud` $myvar{'log_error'} exists"; } elsif ( $myvar{'log_error'} =~ /^systemd:(.*)/ ) { open( $fh, '-|', "journalctl -n $maxlines -b -u '$1'" ) // die "Can't start journalctl $!"; goodprint "Log journal` $myvar{'log_error'} exists"; } elsif ( -f "$myvar{'log_error'}" ) { goodprint "Log file $myvar{'log_error'} exists"; my $size = ( stat $myvar{'log_error'} )[7]; infoprint "Log file: " . $myvar{'log_error'} . " (" . hr_bytes_rnd($size) . ")"; if ( $size > 0 ) { goodprint "Log file $myvar{'log_error'} is not empty"; if ( $size < 32 * 1024 * 1024 ) { goodprint "Log file $myvar{'log_error'} is smaller than 32 MB"; } else { badprint "Log file $myvar{'log_error'} is bigger than 32 MB"; push @generalrec, $myvar{'log_error'} . " is > 32MB, you should analyze why or implement a rotation log strategy such as logrotate!"; } } else { infoprint "Log file $myvar{'log_error'} is empty. Assuming log-rotation. Use --server-log={file} for explicit file"; return; } if ( !open( $fh, '<', $myvar{'log_error'} ) ) { badprint "Log file $myvar{'log_error'} isn't readable."; return; } goodprint "Log file $myvar{'log_error'} is readable."; if ( $maxlines * 80 < $size ) { seek( $fh, -$maxlines * 80, 2 ); <$fh>; # discard line fragment } } else { badprint "Log file $myvar{'log_error'} doesn't exist"; return; } my $numLi = 0; my $nbWarnLog = 0; my $nbErrLog = 0; my @lastShutdowns; my @lastStarts; while ( my $logLi = <$fh> ) { chomp $logLi; $numLi++; debugprint "$numLi: $logLi" if $logLi =~ /warning|error/i and $logLi !~ /Logging to/; $nbErrLog++ if $logLi =~ /error/i and $logLi !~ /(Logging to|\[Warning\].*ERROR_FOR_DIVISION_BY_ZERO)/; $nbWarnLog++ if $logLi =~ /warning/i; push @lastShutdowns, $logLi if $logLi =~ /Shutdown complete/ and $logLi !~ /Innodb/i; push @lastStarts, $logLi if $logLi =~ /ready for connections/; } close $fh; if ( $nbWarnLog > 0 ) { badprint "$myvar{'log_error'} contains $nbWarnLog warning(s)."; push @generalrec, "Check warning line(s) in $myvar{'log_error'} file"; } else { goodprint "$myvar{'log_error'} doesn't contain any warning."; } if ( $nbErrLog > 0 ) { badprint "$myvar{'log_error'} contains $nbErrLog error(s)."; push @generalrec, "Check error line(s) in $myvar{'log_error'} file"; } else { goodprint "$myvar{'log_error'} doesn't contain any error."; } infoprint scalar @lastStarts . " start(s) detected in $myvar{'log_error'}"; my $nStart = 0; my $nEnd = 10; if ( scalar @lastStarts < $nEnd ) { $nEnd = scalar @lastStarts; } for my $startd ( reverse @lastStarts[ -$nEnd .. -1 ] ) { $nStart++; infoprint "$nStart) $startd"; } infoprint scalar @lastShutdowns . " shutdown(s) detected in $myvar{'log_error'}"; $nStart = 0; $nEnd = 10; if ( scalar @lastShutdowns < $nEnd ) { $nEnd = scalar @lastShutdowns; } for my $shutd ( reverse @lastShutdowns[ -$nEnd .. -1 ] ) { $nStart++; infoprint "$nStart) $shutd"; } #exit 0; } sub cve_recommendations { subheaderprint "CVE Security Recommendations"; unless ( defined( $opt{cvefile} ) && -f "$opt{cvefile}" ) { infoprint "Skipped due to --cvefile option undefined"; return; } #$mysqlvermajor=10; #$mysqlverminor=1; #$mysqlvermicro=17; #prettyprint "Look for related CVE for $myvar{'version'} or lower in $opt{cvefile}"; my $cvefound = 0; open( my $fh, "<", $opt{cvefile} ) or die "Can't open $opt{cvefile} for read: $!"; while ( my $cveline = <$fh> ) { my @cve = split( ';', $cveline ); debugprint "Comparing $mysqlvermajor\.$mysqlverminor\.$mysqlvermicro with $cve[1]\.$cve[2]\.$cve[3] : " . ( mysql_version_le( $cve[1], $cve[2], $cve[3] ) ? '<=' : '>' ); # Avoid not major/minor version corresponding CVEs next unless ( int( $cve[1] ) == $mysqlvermajor && int( $cve[2] ) == $mysqlverminor ); if ( int( $cve[3] ) >= $mysqlvermicro ) { badprint "$cve[4](<= $cve[1]\.$cve[2]\.$cve[3]) : $cve[6]"; $result{'CVE'}{'List'}{$cvefound} = "$cve[4](<= $cve[1]\.$cve[2]\.$cve[3]) : $cve[6]"; $cvefound++; } } close $fh or die "Cannot close $opt{cvefile}: $!"; $result{'CVE'}{'nb'} = $cvefound; my $cve_warning_notes = ""; if ( $cvefound == 0 ) { goodprint "NO SECURITY CVE FOUND FOR YOUR VERSION"; return; } if ( $mysqlvermajor eq 5 and $mysqlverminor eq 5 ) { infoprint "False positive CVE(s) for MySQL and MariaDB 5.5.x can be found."; infoprint "Check carefully each CVE for those particular versions"; } badprint $cvefound . " CVE(s) found for your MySQL release."; push( @generalrec, $cvefound . " CVE(s) found for your MySQL release. Consider upgrading your version !" ); } sub get_opened_ports { my @opened_ports = `netstat -ltn`; @opened_ports = map { my $v = $_; $v =~ s/.*:(\d+)\s.*$/$1/; $v =~ s/\D//g; $v; } @opened_ports; @opened_ports = sort { $a <=> $b } grep { !/^$/ } @opened_ports; #debugprint Dumper \@opened_ports; $result{'Network'}{'TCP Opened'} = \@opened_ports; return @opened_ports; } sub is_open_port { my $port = shift; if ( grep { /^$port$/ } get_opened_ports ) { return 1; } return 0; } sub get_process_memory { my $pid = shift; my @mem = `ps -p $pid -o rss`; return 0 if scalar @mem != 2; return $mem[1] * 1024; } sub get_other_process_memory { return 0 if ( $opt{tbstat} == 0 ); my @procs = `ps eaxo pid,command`; @procs = map { my $v = $_; $v =~ s/.*PID.*//; $v =~ s/.*mysqld.*//; $v =~ s/.*\[.*\].*//; $v =~ s/^\s+$//g; $v =~ s/.*PID.*CMD.*//; $v =~ s/.*systemd.*//; $v =~ s/\s*?(\d+)\s*.*/$1/g; $v; } @procs; @procs = remove_cr @procs; @procs = remove_empty @procs; my $totalMemOther = 0; map { $totalMemOther += get_process_memory($_); } @procs; return $totalMemOther; } sub get_os_release { if ( -f "/etc/lsb-release" ) { my @info_release = get_file_contents "/etc/lsb-release"; my $os_release = $info_release[3]; $os_release =~ s/.*="//; $os_release =~ s/"$//; return $os_release; } if ( -f "/etc/system-release" ) { my @info_release = get_file_contents "/etc/system-release"; return $info_release[0]; } if ( -f "/etc/os-release" ) { my @info_release = get_file_contents "/etc/os-release"; my $os_release = $info_release[0]; $os_release =~ s/.*="//; $os_release =~ s/"$//; return $os_release; } if ( -f "/etc/issue" ) { my @info_release = get_file_contents "/etc/issue"; my $os_release = $info_release[0]; $os_release =~ s/\s+\\n.*//; return $os_release; } return "Unknown OS release"; } sub get_fs_info { my @sinfo = `df -P | grep '%'`; my @iinfo = `df -Pi| grep '%'`; shift @sinfo; shift @iinfo; foreach my $info (@sinfo) { #exit(0); if ( $info =~ /.*?(\d+)\s+(\d+)\s+(\d+)\s+(\d+)%\s+(.*)$/ ) { next if $5 =~ m{(run|dev|sys|proc|snap|init)}; if ( $4 > 85 ) { badprint "mount point $5 is using $4 % total space (" . human_size( $2 * 1024 ) . " / " . human_size( $1 * 1024 ) . ")"; push( @generalrec, "Add some space to $4 mountpoint." ); } else { infoprint "mount point $5 is using $4 % total space (" . human_size( $2 * 1024 ) . " / " . human_size( $1 * 1024 ) . ")"; } $result{'Filesystem'}{'Space Pct'}{$5} = $4; $result{'Filesystem'}{'Used Space'}{$5} = $2; $result{'Filesystem'}{'Free Space'}{$5} = $3; $result{'Filesystem'}{'Total Space'}{$5} = $1; } } @iinfo = map { my $v = $_; $v =~ s/.*\s(\d+)%\s+(.*)/$1\t$2/g; $v; } @iinfo; foreach my $info (@iinfo) { next if $info =~ m{(\d+)\t/(run|dev|sys|proc|snap)($|/)}; if ( $info =~ /(\d+)\t(.*)/ ) { if ( $1 > 85 ) { badprint "mount point $2 is using $1 % of max allowed inodes"; push( @generalrec, "Cleanup files from $2 mountpoint or reformat your filesystem." ); } else { infoprint "mount point $2 is using $1 % of max allowed inodes"; } $result{'Filesystem'}{'Inode Pct'}{$2} = $1; } } } sub merge_hash { my $h1 = shift; my $h2 = shift; my %result = {}; foreach my $substanceref ( $h1, $h2 ) { while ( my ( $k, $v ) = each %$substanceref ) { next if ( exists $result{$k} ); $result{$k} = $v; } } return \%result; } sub is_virtual_machine { if ( $^O eq 'linux' ) { my $isVm = `grep -Ec '^flags.*\ hypervisor\ ' /proc/cpuinfo`; return ( $isVm == 0 ? 0 : 1 ); } if ( $^O eq 'freebsd' ) { my $isVm = `sysctl -n kern.vm_guest`; chomp $isVm; print "FARK DEBUG isVm=[$isVm]"; return ( $isVm eq 'none' ? 0 : 1 ); } return 0; } sub infocmd { my $cmd = "@_"; debugprint "CMD: $cmd"; my @result = `$cmd`; @result = remove_cr @result; for my $l (@result) { infoprint "$l"; } } sub infocmd_tab { my $cmd = "@_"; debugprint "CMD: $cmd"; my @result = `$cmd`; @result = remove_cr @result; for my $l (@result) { infoprint "\t$l"; } } sub infocmd_one { my $cmd = "@_"; my @result = `$cmd 2>&1`; @result = remove_cr @result; return join ', ', @result; } sub get_kernel_info { my @params = ( 'fs.aio-max-nr', 'fs.aio-nr', 'fs.nr_open', 'fs.file-max', 'sunrpc.tcp_fin_timeout', 'sunrpc.tcp_max_slot_table_entries', 'sunrpc.tcp_slot_table_entries', 'vm.swappiness' ); infoprint "Information about kernel tuning:"; foreach my $param (@params) { infocmd_tab("sysctl $param 2>/dev/null"); $result{'OS'}{'Config'}{$param} = `sysctl -n $param 2>/dev/null`; } if ( `sysctl -n vm.swappiness` > 10 ) { badprint "Swappiness is > 10, please consider having a value lower than 10"; push @generalrec, "setup swappiness lower or equal to 10"; push @adjvars, 'vm.swappiness <= 10 (echo 10 > /proc/sys/vm/swappiness) or vm.swappiness=10 in /etc/sysctl.conf'; } else { infoprint "Swappiness is < 10."; } # only if /proc/sys/sunrpc exists my $tcp_slot_entries = `sysctl -n sunrpc.tcp_slot_table_entries 2>/dev/null`; if ( -f "/proc/sys/sunrpc" and ( $tcp_slot_entries eq '' or $tcp_slot_entries < 100 ) ) { badprint "Initial TCP slot entries is < 1M, please consider having a value greater than 100"; push @generalrec, "setup Initial TCP slot entries greater than 100"; push @adjvars, 'sunrpc.tcp_slot_table_entries > 100 (echo 128 > /proc/sys/sunrpc/tcp_slot_table_entries) or sunrpc.tcp_slot_table_entries=128 in /etc/sysctl.conf'; } else { infoprint "TCP slot entries is > 100."; } if ( -f "/proc/sys/fs/aio-max-nr" ) { if ( `sysctl -n fs.aio-max-nr` < 1000000 ) { badprint "Max running total of the number of max. events is < 1M, please consider having a value greater than 1M"; push @generalrec, "setup Max running number events greater than 1M"; push @adjvars, 'fs.aio-max-nr > 1M (echo 1048576 > /proc/sys/fs/aio-max-nr) or fs.aio-max-nr=1048576 in /etc/sysctl.conf'; } else { infoprint "Max Number of AIO events is > 1M."; } } if ( -f "/proc/sys/fs/nr_open" ) { if ( `sysctl -n fs.nr_open` < 1000000 ) { badprint "Max running total of the number of file open request is < 1M, please consider having a value greater than 1M"; push @generalrec, "setup running number of open request greater than 1M"; push @adjvars, 'fs.aio-nr > 1M (echo 1048576 > /proc/sys/fs/nr_open) or fs.nr_open=1048576 in /etc/sysctl.conf'; } else { infoprint "Max Number of open file requests is > 1M."; } } } sub get_system_info { $result{'OS'}{'Release'} = get_os_release(); infoprint get_os_release; if (is_virtual_machine) { infoprint "Machine type : Virtual machine"; $result{'OS'}{'Virtual Machine'} = 'YES'; } else { infoprint "Machine type : Physical machine"; $result{'OS'}{'Virtual Machine'} = 'NO'; } $result{'Network'}{'Connected'} = 'NO'; `ping -c 1 ipecho.net &>/dev/null`; my $isConnected = $?; if ( $? == 0 ) { infoprint "Internet : Connected"; $result{'Network'}{'Connected'} = 'YES'; } else { badprint "Internet : Disconnected"; } $result{'OS'}{'NbCore'} = cpu_cores; infoprint "Number of Core CPU : " . cpu_cores; $result{'OS'}{'Type'} = `uname -o`; infoprint "Operating System Type : " . infocmd_one "uname -o"; $result{'OS'}{'Kernel'} = `uname -r`; infoprint "Kernel Release : " . infocmd_one "uname -r"; $result{'OS'}{'Hostname'} = `hostname`; $result{'Network'}{'Internal Ip'} = `hostname -I`; infoprint "Hostname : " . infocmd_one "hostname"; infoprint "Network Cards : "; infocmd_tab "ifconfig| grep -A1 mtu"; infoprint "Internal IP : " . infocmd_one "hostname -I"; $result{'Network'}{'Internal Ip'} = `ifconfig| grep -A1 mtu`; my $httpcli = get_http_cli(); infoprint "HTTP client found: $httpcli" if defined $httpcli; my $ext_ip = ""; if ( $httpcli =~ /curl$/ ) { $ext_ip = infocmd_one "$httpcli -m 3 ipecho.net/plain"; } elsif ( $httpcli =~ /wget$/ ) { $ext_ip = infocmd_one "$httpcli -t 1 -T 3 -q -O - ipecho.net/plain"; } infoprint "External IP : " . $ext_ip; $result{'Network'}{'External Ip'} = $ext_ip; badprint "External IP : Can't check, no Internet connectivity" unless defined($httpcli); infoprint "Name Servers : " . infocmd_one "grep 'nameserver' /etc/resolv.conf \| awk '{print \$2}'"; infoprint "Logged In users : "; infocmd_tab "who"; $result{'OS'}{'Logged users'} = `who`; infoprint "Ram Usages in MB : "; infocmd_tab "free -m | grep -v +"; $result{'OS'}{'Free Memory RAM'} = `free -m | grep -v +`; infoprint "Load Average : "; infocmd_tab "top -n 1 -b | grep 'load average:'"; $result{'OS'}{'Load Average'} = `top -n 1 -b | grep 'load average:'`; infoprint "System Uptime : "; infocmd_tab "uptime"; $result{'OS'}{'Uptime'} = `uptime`; } sub system_recommendations { if ( is_remote eq 1 ) { infoprint "Skipping system checks on remote host"; return; } return if ( $opt{sysstat} == 0 ); subheaderprint "System Linux Recommendations"; my $os = `uname`; unless ( $os =~ /Linux/i ) { infoprint "Skipped due to non Linux server"; return; } prettyprint "Look for related Linux system recommendations"; #prettyprint '-'x78; get_system_info(); my $nb_cpus = cpu_cores; if ( $nb_cpus > 1 ) { goodprint "There is at least one CPU dedicated to database server."; } else { badprint "There is only one CPU, consider dedicated one CPU for your database server"; push @generalrec, "Consider increasing number of CPU for your database server"; } if ( $physical_memory >= 1.5 * 1024 ) { goodprint "There is at least 1 Gb of RAM dedicated to Linux server."; } else { badprint "There is less than 1,5 Gb of RAM, consider dedicated 1 Gb for your Linux server"; push @generalrec, "Consider increasing 1,5 / 2 Gb of RAM for your Linux server"; } my $omem = get_other_process_memory; infoprint "User process except mysqld used " . hr_bytes_rnd($omem) . " RAM."; if ( ( 0.15 * $physical_memory ) < $omem ) { if ( $opt{nondedicated} ) { infoprint "No warning with --nondedicated option"; infoprint "Other user process except mysqld used more than 15% of total physical memory " . percentage( $omem, $physical_memory ) . "% (" . hr_bytes_rnd($omem) . " / " . hr_bytes_rnd($physical_memory) . ")"; } else { badprint "Other user process except mysqld used more than 15% of total physical memory " . percentage( $omem, $physical_memory ) . "% (" . hr_bytes_rnd($omem) . " / " . hr_bytes_rnd($physical_memory) . ")"; push( @generalrec, "Consider stopping or dedicate server for additional process other than mysqld." ); push( @adjvars, "DON'T APPLY SETTINGS BECAUSE THERE ARE TOO MANY PROCESSES RUNNING ON THIS SERVER. OOM KILL CAN OCCUR!" ); } } else { infoprint "Other user process except mysqld used less than 15% of total physical memory " . percentage( $omem, $physical_memory ) . "% (" . hr_bytes_rnd($omem) . " / " . hr_bytes_rnd($physical_memory) . ")"; } if ( $opt{'maxportallowed'} > 0 ) { my @opened_ports = get_opened_ports; infoprint "There is " . scalar @opened_ports . " listening port(s) on this server."; if ( scalar(@opened_ports) > $opt{'maxportallowed'} ) { badprint "There are too many listening ports: " . scalar(@opened_ports) . " opened > " . $opt{'maxportallowed'} . "allowed."; push( @generalrec, "Consider dedicating a server for your database installation with fewer services running on it!" ); } else { goodprint "There are less than " . $opt{'maxportallowed'} . " opened ports on this server."; } } foreach my $banport (@banned_ports) { if ( is_open_port($banport) ) { badprint "Banned port: $banport is opened.."; push( @generalrec, "Port $banport is opened. Consider stopping the program over this port." ); } else { goodprint "$banport is not opened."; } } subheaderprint "Filesystem Linux Recommendations"; get_fs_info; subheaderprint "Kernel Information Recommendations"; get_kernel_info; } sub security_recommendations { subheaderprint "Security Recommendations"; if ( mysql_version_eq(8) ) { infoprint "Skipped due to unsupported feature for MySQL 8.0+"; return; } #exit 0; if ( $opt{skippassword} eq 1 ) { infoprint "Skipped due to --skippassword option"; return; } my $PASS_COLUMN_NAME = 'password'; # New table schema available since mysql-5.7 and mariadb-10.2 # But need to be checked if ( $myvar{'version'} =~ /5\.7|10\.[2-5]\..*MariaDB*/ ) { my $password_column_exists = `$mysqlcmd $mysqllogin -Bse "SELECT 1 FROM information_schema.columns WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user' AND COLUMN_NAME = 'password'" 2>>/dev/null`; my $authstring_column_exists = `$mysqlcmd $mysqllogin -Bse "SELECT 1 FROM information_schema.columns WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user' AND COLUMN_NAME = 'authentication_string'" 2>>/dev/null`; if ( $password_column_exists && $authstring_column_exists ) { $PASS_COLUMN_NAME = "IF(plugin='mysql_native_password', authentication_string, password)"; } elsif ($authstring_column_exists) { $PASS_COLUMN_NAME = 'authentication_string'; } elsif ( !$password_column_exists ) { infoprint "Skipped due to none of known auth columns exists"; return; } } debugprint "Password column = $PASS_COLUMN_NAME"; # IS THERE A ROLE COLUMN my $is_role_column = select_one "select count(*) from information_schema.columns where TABLE_NAME='user' AND TABLE_SCHEMA='mysql' and COLUMN_NAME='IS_ROLE'"; my $extra_user_condition = ""; $extra_user_condition = "IS_ROLE = 'N' AND" if $is_role_column > 0; my @mysqlstatlist; if ( $is_role_column > 0 ) { @mysqlstatlist = select_array "SELECT CONCAT(QUOTE(user), '\@', QUOTE(host)) FROM mysql.user WHERE IS_ROLE='Y'"; foreach my $line ( sort @mysqlstatlist ) { chomp($line); infoprint "User $line is User Role"; } } else { debugprint "No Role user detected"; goodprint "No Role user detected"; } # Looking for Anonymous users @mysqlstatlist = select_array "SELECT CONCAT(QUOTE(user), '\@', QUOTE(host)) FROM mysql.user WHERE $extra_user_condition (TRIM(USER) = '' OR USER IS NULL)"; #debugprint Dumper \@mysqlstatlist; #exit 0; if (@mysqlstatlist) { push( @generalrec, "Remove Anonymous User accounts: there are " . scalar(@mysqlstatlist) . " anonymous accounts." ); foreach my $line ( sort @mysqlstatlist ) { chomp($line); badprint "User " . $line . " is an anonymous account. Remove with DROP USER " . $line . ";"; } } else { goodprint "There are no anonymous accounts for any database users"; } if ( mysql_version_le( 5, 1 ) ) { badprint "No more password checks for MySQL version <=5.1"; badprint "MySQL version <=5.1 is deprecated and end of support."; return; } # Looking for Empty Password if ( mysql_version_ge( 10, 4 ) ) { @mysqlstatlist = select_array q{SELECT CONCAT(QUOTE(user), '@', QUOTE(host)) FROM mysql.global_priv WHERE ( user != '' AND JSON_CONTAINS(Priv, '"mysql_native_password"', '$.plugin') AND JSON_CONTAINS(Priv, '""', '$.authentication_string') AND NOT JSON_CONTAINS(Priv, 'true', '$.account_locked') )}; } else { @mysqlstatlist = select_array "SELECT CONCAT(QUOTE(user), '\@', QUOTE(host)) FROM mysql.user WHERE ($PASS_COLUMN_NAME = '' OR $PASS_COLUMN_NAME IS NULL) AND user != '' /*!50501 AND plugin NOT IN ('auth_socket', 'unix_socket', 'win_socket', 'auth_pam_compat') */ /*!80000 AND account_locked = 'N' AND password_expired = 'N' */"; } if (@mysqlstatlist) { foreach my $line ( sort @mysqlstatlist ) { chomp($line); badprint "User '" . $line . "' has no password set."; push( @generalrec, "Set up a Secure Password for $line user: SET PASSWORD FOR $line = PASSWORD('secure_password');" ); } } else { goodprint "All database users have passwords assigned"; } if ( mysql_version_ge( 5, 7 ) ) { my $valPlugin = select_one( "select count(*) from information_schema.plugins where PLUGIN_NAME='validate_password' AND PLUGIN_STATUS='ACTIVE'" ); if ( $valPlugin >= 1 ) { infoprint "Bug #80860 MySQL 5.7: Avoid testing password when validate_password is activated"; return; } } # Looking for User with user/ uppercase /capitalise user as password @mysqlstatlist = select_array "SELECT CONCAT(QUOTE(user), '\@', QUOTE(host)) FROM mysql.user WHERE user != '' AND (CAST($PASS_COLUMN_NAME as Binary) = PASSWORD(user) OR CAST($PASS_COLUMN_NAME as Binary) = PASSWORD(UPPER(user)) OR CAST($PASS_COLUMN_NAME as Binary) = PASSWORD(CONCAT(UPPER(LEFT(User, 1)), SUBSTRING(User, 2, LENGTH(User)))))"; if (@mysqlstatlist) { foreach my $line ( sort @mysqlstatlist ) { chomp($line); badprint "User " . $line . " has user name as password."; push( @generalrec, "Set up a Secure Password for $line user: SET PASSWORD FOR $line = PASSWORD('secure_password');" ); } } @mysqlstatlist = select_array "SELECT CONCAT(QUOTE(user), '\@', host) FROM mysql.user WHERE HOST='%'"; if (@mysqlstatlist) { foreach my $line ( sort @mysqlstatlist ) { chomp($line); my $luser = ( split /@/, $line )[0]; badprint "User " . $line . " does not specify hostname restrictions."; push( @generalrec, "Restrict Host for $luser\@'%' to $luser\@LimitedIPRangeOrLocalhost" ); push( @generalrec, "RENAME USER $luser\@'%' TO " . $luser . "\@LimitedIPRangeOrLocalhost;" ); } } unless ( -f $basic_password_files ) { badprint "There is no basic password file list!"; return; } my @passwords = get_basic_passwords $basic_password_files; infoprint "There are " . scalar(@passwords) . " basic passwords in the list."; my $nbins = 0; my $passreq; if (@passwords) { my $nbInterPass = 0; foreach my $pass (@passwords) { $nbInterPass++; $pass =~ s/\s//g; $pass =~ s/\'/\\\'/g; chomp($pass); # Looking for User with user/ uppercase /capitalise weak password @mysqlstatlist = select_array "SELECT CONCAT(user, '\@', host) FROM mysql.user WHERE $PASS_COLUMN_NAME = PASSWORD('" . $pass . "') OR $PASS_COLUMN_NAME = PASSWORD(UPPER('" . $pass . "')) OR $PASS_COLUMN_NAME = PASSWORD(CONCAT(UPPER(LEFT('" . $pass . "', 1)), SUBSTRING('" . $pass . "', 2, LENGTH('" . $pass . "'))))"; debugprint "There are " . scalar(@mysqlstatlist) . " items."; if (@mysqlstatlist) { foreach my $line (@mysqlstatlist) { chomp($line); badprint "User '" . $line . "' is using weak password: $pass in a lower, upper or capitalize derivative version."; push( @generalrec, "Set up a Secure Password for $line user: SET PASSWORD FOR '" . ( split /@/, $line )[0] . "'\@'" . ( split /@/, $line )[1] . "' = PASSWORD('secure_password');" ); $nbins++; } } debugprint "$nbInterPass / " . scalar(@passwords) if ( $nbInterPass % 1000 == 0 ); } } if ( $nbins > 0 ) { push( @generalrec, $nbins . " user(s) used basic or weak password from basic dictionary." ); } } sub get_replication_status { subheaderprint "Replication Metrics"; infoprint "Galera Synchronous replication: " . $myvar{'have_galera'}; if ( scalar( keys %myslaves ) == 0 ) { infoprint "No replication slave(s) for this server."; } else { infoprint "This server is acting as master for " . scalar( keys %myslaves ) . " server(s)."; } infoprint "Binlog format: " . $myvar{'binlog_format'}; infoprint "XA support enabled: " . $myvar{'innodb_support_xa'}; infoprint "Semi synchronous replication Master: " . ( ( defined( $myvar{'rpl_semi_sync_master_enabled'} ) or defined( $myvar{'rpl_semi_sync_source_enabled'} ) ) ? ( $myvar{'rpl_semi_sync_master_enabled'} // $myvar{'rpl_semi_sync_source_enabled'} ) : 'Not Activated' ); infoprint "Semi synchronous replication Slave: " . ( ( defined( $myvar{'rpl_semi_sync_slave_enabled'} ) or defined( $myvar{'rpl_semi_sync_replica_enabled'} ) ) ? ( $myvar{'rpl_semi_sync_slave_enabled'} // $myvar{'rpl_semi_sync_replica_enabled'} ) : 'Not Activated' ); if ( scalar( keys %myrepl ) == 0 and scalar( keys %myslaves ) == 0 ) { infoprint "This is a standalone server"; return; } if ( scalar( keys %myrepl ) == 0 ) { infoprint "No replication setup for this server or replication not started."; return; } $result{'Replication'}{'status'} = \%myrepl; my ($io_running) = $myrepl{'Slave_IO_Running'} // $myrepl{'Replica_IO_Running'}; debugprint "IO RUNNING: $io_running "; my ($sql_running) = $myrepl{'Slave_SQL_Running'} // $myrepl{'Replica_SQL_Running'}; debugprint "SQL RUNNING: $sql_running "; my ($seconds_behind_master) = $myrepl{'Seconds_Behind_Master'} // $myrepl{'Seconds_Behind_Source'}; $seconds_behind_master = 1000000 unless defined($seconds_behind_master); debugprint "SECONDS : $seconds_behind_master "; if ( defined($io_running) and ( $io_running !~ /yes/i or $sql_running !~ /yes/i ) ) { badprint "This replication slave is not running but seems to be configured."; } if ( defined($io_running) && $io_running =~ /yes/i && $sql_running =~ /yes/i ) { if ( $myvar{'read_only'} eq 'OFF' ) { badprint "This replication slave is running with the read_only option disabled."; } else { goodprint "This replication slave is running with the read_only option enabled."; } if ( $seconds_behind_master > 0 ) { badprint "This replication slave is lagging and slave has $seconds_behind_master second(s) behind master host."; } else { goodprint "This replication slave is up to date with master."; } } } # https://endoflife.software/applications/databases/mysql # https://endoflife.date/mariadb sub validate_mysql_version { ( $mysqlvermajor, $mysqlverminor, $mysqlvermicro ) = $myvar{'version'} =~ /^(\d+)(?:\.(\d+)|)(?:\.(\d+)|)/; $mysqlverminor ||= 0; $mysqlvermicro ||= 0; prettyprint " "; if ( mysql_version_eq(9) or mysql_version_eq(8, 4) or mysql_version_eq(8, 0) or mysql_version_eq( 10, 5 ) or mysql_version_eq( 10, 6 ) or mysql_version_eq( 10, 11 ) or mysql_version_eq( 11, 4 ) ) { goodprint "Currently running supported MySQL version " . $myvar{'version'} . ""; return; } else { badprint "Your MySQL version " . $myvar{'version'} . " is EOL software. Upgrade soon!"; push( @generalrec, "You are using an unsupported version for production environments" ); push( @generalrec, "Upgrade as soon as possible to a supported version !" ); } } # Checks if MySQL version is equal to (major, minor, micro) sub mysql_version_eq { my ( $maj, $min, $mic ) = @_; my ( $mysqlvermajor, $mysqlverminor, $mysqlvermicro ) = $myvar{'version'} =~ /^(\d+)(?:\.(\d+)|)(?:\.(\d+)|)/; return int($mysqlvermajor) == int($maj) if ( !defined($min) && !defined($mic) ); return int($mysqlvermajor) == int($maj) && int($mysqlverminor) == int($min) if ( !defined($mic) ); return ( int($mysqlvermajor) == int($maj) && int($mysqlverminor) == int($min) && int($mysqlvermicro) == int($mic) ); } # Checks if MySQL version is greater than equal to (major, minor, micro) sub mysql_version_ge { my ( $maj, $min, $mic ) = @_; $min ||= 0; $mic ||= 0; my ( $mysqlvermajor, $mysqlverminor, $mysqlvermicro ) = $myvar{'version'} =~ /^(\d+)(?:\.(\d+)|)(?:\.(\d+)|)/; return int($mysqlvermajor) > int($maj) || ( int($mysqlvermajor) == int($maj) && int($mysqlverminor) > int($min) ) || ( int($mysqlvermajor) == int($maj) && int($mysqlverminor) == int($min) && int($mysqlvermicro) >= int($mic) ); } # Checks if MySQL version is lower than equal to (major, minor, micro) sub mysql_version_le { my ( $maj, $min, $mic ) = @_; $min ||= 0; $mic ||= 0; my ( $mysqlvermajor, $mysqlverminor, $mysqlvermicro ) = $myvar{'version'} =~ /^(\d+)(?:\.(\d+)|)(?:\.(\d+)|)/; return int($mysqlvermajor) < int($maj) || ( int($mysqlvermajor) == int($maj) && int($mysqlverminor) < int($min) ) || ( int($mysqlvermajor) == int($maj) && int($mysqlverminor) == int($min) && int($mysqlvermicro) <= int($mic) ); } # Checks for 32-bit boxes with more than 2GB of RAM my ($arch); sub check_architecture { if ( is_remote eq 1 ) { infoprint "Skipping architecture check on remote host"; infoprint "Using default $opt{defaultarch} bits as target architecture"; $arch = $opt{defaultarch}; return; } if ( `uname` =~ /SunOS/ && `isainfo -b` =~ /64/ ) { $arch = 64; goodprint "Operating on 64-bit architecture"; } elsif ( `uname` !~ /SunOS/ && `uname -m` =~ /(64|s390x)/ ) { $arch = 64; goodprint "Operating on 64-bit architecture"; } elsif ( `uname` =~ /AIX/ && `bootinfo -K` =~ /64/ ) { $arch = 64; goodprint "Operating on 64-bit architecture"; } elsif ( `uname` =~ /NetBSD|OpenBSD/ && `sysctl -b hw.machine` =~ /64/ ) { $arch = 64; goodprint "Operating on 64-bit architecture"; } elsif ( `uname` =~ /FreeBSD/ && `sysctl -b hw.machine_arch` =~ /64/ ) { $arch = 64; goodprint "Operating on 64-bit architecture"; } elsif ( `uname` =~ /Darwin/ && `uname -m` =~ /Power Macintosh/ ) { # Darwin box.local 9.8.0 Darwin Kernel Version 9.8.0: Wed Jul 15 16:57:01 PDT 2009; root:xnu1228.15.4~1/RELEASE_PPC Power Macintosh $arch = 64; goodprint "Operating on 64-bit architecture"; } elsif ( `uname` =~ /Darwin/ && `uname -m` =~ /x86_64/ ) { # Darwin gibas.local 12.6.0 Darwin Kernel Version 12.3.0: Sun Jan 6 22:37:10 PST 2013; root:xnu-2050.22.13~1/RELEASE_X86_64 x86_64 $arch = 64; goodprint "Operating on 64-bit architecture"; } else { $arch = 32; if ( $physical_memory > 2147483648 ) { badprint "Switch to 64-bit OS - MySQL cannot currently use all of your RAM"; } else { goodprint "Operating on 32-bit architecture with less than 2GB RAM"; } } $result{'OS'}{'Architecture'} = "$arch bits"; } # Start up a ton of storage engine counts/statistics my ( %enginestats, %enginecount, $fragtables ); sub check_storage_engines { subheaderprint "Storage Engine Statistics"; if ( $opt{skipsize} eq 1 ) { infoprint "Skipped due to --skipsize option"; return; } my $engines; if ( mysql_version_ge( 5, 5 ) ) { my @engineresults = select_array "SELECT ENGINE,SUPPORT FROM information_schema.ENGINES ORDER BY ENGINE ASC"; foreach my $line (@engineresults) { my ( $engine, $engineenabled ); ( $engine, $engineenabled ) = $line =~ /([a-zA-Z_]*)\s+([a-zA-Z]+)/; $result{'Engine'}{$engine}{'Enabled'} = $engineenabled; $engines .= ( $engineenabled eq "YES" || $engineenabled eq "DEFAULT" ) ? greenwrap "+" . $engine . " " : redwrap "-" . $engine . " "; } } elsif ( mysql_version_ge( 5, 1, 5 ) ) { my @engineresults = select_array "SELECT ENGINE, SUPPORT FROM information_schema.ENGINES WHERE ENGINE NOT IN ('MyISAM', 'MERGE', 'MEMORY') ORDER BY ENGINE"; foreach my $line (@engineresults) { my ( $engine, $engineenabled ); ( $engine, $engineenabled ) = $line =~ /([a-zA-Z_]*)\s+([a-zA-Z]+)/; $result{'Engine'}{$engine}{'Enabled'} = $engineenabled; $engines .= ( $engineenabled eq "YES" || $engineenabled eq "DEFAULT" ) ? greenwrap "+" . $engine . " " : redwrap "-" . $engine . " "; } } else { $engines .= ( defined $myvar{'have_archive'} && $myvar{'have_archive'} eq "YES" ) ? greenwrap "+Archive " : redwrap "-Archive "; $engines .= ( defined $myvar{'have_bdb'} && $myvar{'have_bdb'} eq "YES" ) ? greenwrap "+BDB " : redwrap "-BDB "; $engines .= ( defined $myvar{'have_federated_engine'} && $myvar{'have_federated_engine'} eq "YES" ) ? greenwrap "+Federated " : redwrap "-Federated "; $engines .= ( defined $myvar{'have_innodb'} && $myvar{'have_innodb'} eq "YES" ) ? greenwrap "+InnoDB " : redwrap "-InnoDB "; $engines .= ( defined $myvar{'have_isam'} && $myvar{'have_isam'} eq "YES" ) ? greenwrap "+ISAM " : redwrap "-ISAM "; $engines .= ( defined $myvar{'have_ndbcluster'} && $myvar{'have_ndbcluster'} eq "YES" ) ? greenwrap "+NDBCluster " : redwrap "-NDBCluster "; } my @dblist = grep { $_ ne 'lost+found' } select_array "SHOW DATABASES"; $result{'Databases'}{'List'} = [@dblist]; infoprint "Status: $engines"; if ( mysql_version_ge( 5, 1, 5 ) ) { # MySQL 5+ servers can have table sizes calculated quickly from information schema my @templist = select_array "SELECT ENGINE, SUM(DATA_LENGTH+INDEX_LENGTH), COUNT(ENGINE), SUM(DATA_LENGTH), SUM(INDEX_LENGTH) FROM information_schema.TABLES WHERE TABLE_SCHEMA NOT IN ('information_schema', 'performance_schema', 'mysql') AND ENGINE IS NOT NULL GROUP BY ENGINE ORDER BY ENGINE ASC;"; my ( $engine, $size, $count, $dsize, $isize ); foreach my $line (@templist) { ( $engine, $size, $count, $dsize, $isize ) = $line =~ /([a-zA-Z_]+)\s+(\d+)\s+(\d+)\s+(\d+)\s+(\d+)/; debugprint "Engine Found: $engine"; next unless ( defined($engine) or trim($engine) eq '' ); $size = 0 unless ( defined($size) or trim($engine) eq '' ); $isize = 0 unless ( defined($isize) or trim($engine) eq '' ); $dsize = 0 unless ( defined($dsize) or trim($engine) eq '' ); $count = 0 unless ( defined($count) or trim($engine) eq '' ); $enginestats{$engine} = $size; $enginecount{$engine} = $count; $result{'Engine'}{$engine}{'Table Number'} = $count; $result{'Engine'}{$engine}{'Total Size'} = $size; $result{'Engine'}{$engine}{'Data Size'} = $dsize; $result{'Engine'}{$engine}{'Index Size'} = $isize; } #print Dumper( \%enginestats ) if $opt{debug}; my $not_innodb = ''; if ( not defined $result{'Variables'}{'innodb_file_per_table'} ) { $not_innodb = "AND NOT ENGINE='InnoDB'"; } elsif ( $result{'Variables'}{'innodb_file_per_table'} eq 'OFF' ) { $not_innodb = "AND NOT ENGINE='InnoDB'"; } $result{'Tables'}{'Fragmented tables'} = [ select_array "SELECT TABLE_SCHEMA, TABLE_NAME, ENGINE, CAST(DATA_FREE AS SIGNED) FROM information_schema.TABLES WHERE TABLE_SCHEMA NOT IN ('information_schema', 'performance_schema', 'mysql') AND DATA_LENGTH/1024/1024>100 AND cast(DATA_FREE as signed)*100/(DATA_LENGTH+INDEX_LENGTH+cast(DATA_FREE as signed)) > 10 AND NOT ENGINE='MEMORY' $not_innodb" ]; $fragtables = scalar @{ $result{'Tables'}{'Fragmented tables'} }; } else { # MySQL < 5 servers take a lot of work to get table sizes my @tblist; # Now we build a database list, and loop through it to get storage engine stats for tables foreach my $db (@dblist) { chomp($db); if ( $db eq "information_schema" or $db eq "performance_schema" or $db eq "mysql" or $db eq "lost+found" ) { next; } my @ixs = ( 1, 6, 9 ); if ( !mysql_version_ge( 4, 1 ) ) { # MySQL 3.23/4.0 keeps Data_Length in the 5th (0-based) column @ixs = ( 1, 5, 8 ); } push( @tblist, map { [ (split)[@ixs] ] } select_array "SHOW TABLE STATUS FROM \\\`$db\\\`" ); } # Parse through the table list to generate storage engine counts/statistics $fragtables = 0; foreach my $tbl (@tblist) { #debugprint "Data dump " . Dumper(@$tbl) if $opt{debug}; my ( $engine, $size, $datafree ) = @$tbl; next if $engine eq 'NULL' or not defined($engine); $size = 0 if $size eq 'NULL' or not defined($size); $datafree = 0 if $datafree eq 'NULL' or not defined($datafree); if ( defined $enginestats{$engine} ) { $enginestats{$engine} += $size; $enginecount{$engine} += 1; } else { $enginestats{$engine} = $size; $enginecount{$engine} = 1; } if ( $datafree > 0 ) { $fragtables++; } } } while ( my ( $engine, $size ) = each(%enginestats) ) { infoprint "Data in $engine tables: " . hr_bytes($size) . " (Tables: " . $enginecount{$engine} . ")" . ""; } # If the storage engine isn't being used, recommend it to be disabled if ( !defined $enginestats{'InnoDB'} && defined $myvar{'have_innodb'} && $myvar{'have_innodb'} eq "YES" ) { badprint "InnoDB is enabled, but isn't being used"; push( @generalrec, "Add skip-innodb to MySQL configuration to disable InnoDB" ); } if ( !defined $enginestats{'BerkeleyDB'} && defined $myvar{'have_bdb'} && $myvar{'have_bdb'} eq "YES" ) { badprint "BDB is enabled, but isn't being used"; push( @generalrec, "Add skip-bdb to MySQL configuration to disable BDB" ); } if ( !defined $enginestats{'ISAM'} && defined $myvar{'have_isam'} && $myvar{'have_isam'} eq "YES" ) { badprint "MyISAM is enabled, but isn't being used"; push( @generalrec, "Add skip-isam to MySQL configuration to disable MyISAM (MySQL > 4.1.0)" ); } # Fragmented tables if ( $fragtables > 0 ) { badprint "Total fragmented tables: $fragtables"; push @generalrec, 'Run ALTER TABLE ... FORCE or OPTIMIZE TABLE to defragment tables for better performance'; my $total_free = 0; foreach my $table_line ( @{ $result{'Tables'}{'Fragmented tables'} } ) { my ( $table_schema, $table_name, $engine, $data_free ) = split /\t/msx, $table_line; $data_free = $data_free / 1024 / 1024; $total_free += $data_free; my $generalrec; if ( $engine eq 'InnoDB' ) { $generalrec = " ALTER TABLE `$table_schema`.`$table_name` FORCE;"; } else { $generalrec = " OPTIMIZE TABLE `$table_schema`.`$table_name`;"; } $generalrec .= " -- can free $data_free MiB"; push @generalrec, $generalrec; } push @generalrec, "Total freed space after defragmentation: $total_free MiB"; } else { goodprint "Total fragmented tables: $fragtables"; } # Auto increments my %tblist; # Find the maximum integer my $maxint = select_one "SELECT ~0"; $result{'MaxInt'} = $maxint; # Now we use a database list, and loop through it to get storage engine stats for tables foreach my $db (@dblist) { chomp($db); if ( !$tblist{$db} ) { $tblist{$db} = (); } if ( $db eq "information_schema" ) { next; } my @ia = ( 0, 10 ); if ( !mysql_version_ge( 4, 1 ) ) { # MySQL 3.23/4.0 keeps Data_Length in the 5th (0-based) column @ia = ( 0, 9 ); } push( @{ $tblist{$db} }, map { [ (split)[@ia] ] } select_array "SHOW TABLE STATUS FROM \\\`$db\\\`" ); } my @dbnames = keys %tblist; foreach my $db (@dbnames) { foreach my $tbl ( @{ $tblist{$db} } ) { my ( $name, $autoincrement ) = @$tbl; if ( $autoincrement =~ /^\d+?$/ ) { my $percent = percentage( $autoincrement, $maxint ); $result{'PctAutoIncrement'}{"$db.$name"} = $percent; if ( $percent >= 75 ) { badprint "Table '$db.$name' has an autoincrement value near max capacity ($percent%)"; } } } } } my %mycalc; sub dump_into_file { my $file = shift; my $content = shift; if ( -d "$opt{dumpdir}" ) { $file = "$opt{dumpdir}/$file"; open( FILE, ">$file" ) or die "Can't open $file: $!"; print FILE $content; close FILE; infoprint "Data saved to $file"; } } sub calculations { if ( $mystat{'Questions'} < 1 ) { badprint "Your server has not answered any queries: cannot continue..."; exit 2; } # Per-thread memory $mycalc{'per_thread_buffers'} = 0; $mycalc{'per_thread_buffers'} += $myvar{'read_buffer_size'} if is_int( $myvar{'read_buffer_size'} ); $mycalc{'per_thread_buffers'} += $myvar{'read_rnd_buffer_size'} if is_int( $myvar{'read_rnd_buffer_size'} ); $mycalc{'per_thread_buffers'} += $myvar{'sort_buffer_size'} if is_int( $myvar{'sort_buffer_size'} ); $mycalc{'per_thread_buffers'} += $myvar{'thread_stack'} if is_int( $myvar{'thread_stack'} ); $mycalc{'per_thread_buffers'} += $myvar{'join_buffer_size'} if is_int( $myvar{'join_buffer_size'} ); $mycalc{'per_thread_buffers'} += $myvar{'binlog_cache_size'} if is_int( $myvar{'binlog_cache_size'} ); debugprint "per_thread_buffers: $mycalc{'per_thread_buffers'} (" . human_size( $mycalc{'per_thread_buffers'} ) . " )"; # Error max_allowed_packet is not included in thread buffers size #$mycalc{'per_thread_buffers'} += $myvar{'max_allowed_packet'} if is_int($myvar{'max_allowed_packet'}); # Total per-thread memory $mycalc{'total_per_thread_buffers'} = $mycalc{'per_thread_buffers'} * $myvar{'max_connections'}; # Max total per-thread memory reached $mycalc{'max_total_per_thread_buffers'} = $mycalc{'per_thread_buffers'} * $mystat{'Max_used_connections'}; # Server-wide memory $mycalc{'max_tmp_table_size'} = ( $myvar{'tmp_table_size'} > $myvar{'max_heap_table_size'} ) ? $myvar{'max_heap_table_size'} : $myvar{'tmp_table_size'}; $mycalc{'server_buffers'} = $myvar{'key_buffer_size'} + $mycalc{'max_tmp_table_size'}; $mycalc{'server_buffers'} += ( defined $myvar{'innodb_buffer_pool_size'} ) ? $myvar{'innodb_buffer_pool_size'} : 0; $mycalc{'server_buffers'} += ( defined $myvar{'innodb_additional_mem_pool_size'} ) ? $myvar{'innodb_additional_mem_pool_size'} : 0; $mycalc{'server_buffers'} += ( defined $myvar{'innodb_log_buffer_size'} ) ? $myvar{'innodb_log_buffer_size'} : 0; $mycalc{'server_buffers'} += ( defined $myvar{'query_cache_size'} ) ? $myvar{'query_cache_size'} : 0; $mycalc{'server_buffers'} += ( defined $myvar{'aria_pagecache_buffer_size'} ) ? $myvar{'aria_pagecache_buffer_size'} : 0; # Global memory # Max used memory is memory used by MySQL based on Max_used_connections # This is the max memory used theoretically calculated with the max concurrent connection number reached by mysql $mycalc{'max_used_memory'} = $mycalc{'server_buffers'} + $mycalc{"max_total_per_thread_buffers"} + get_pf_memory(); # + get_gcache_memory(); $mycalc{'pct_max_used_memory'} = percentage( $mycalc{'max_used_memory'}, $physical_memory ); # Total possible memory is memory needed by MySQL based on max_connections # This is the max memory MySQL can theoretically used if all connections allowed has opened by mysql $mycalc{'max_peak_memory'} = $mycalc{'server_buffers'} + $mycalc{'total_per_thread_buffers'} + get_pf_memory(); # + get_gcache_memory(); $mycalc{'pct_max_physical_memory'} = percentage( $mycalc{'max_peak_memory'}, $physical_memory ); debugprint "Max Used Memory: " . hr_bytes( $mycalc{'max_used_memory'} ) . ""; debugprint "Max Used Percentage RAM: " . $mycalc{'pct_max_used_memory'} . "%"; debugprint "Max Peak Memory: " . hr_bytes( $mycalc{'max_peak_memory'} ) . ""; debugprint "Max Peak Percentage RAM: " . $mycalc{'pct_max_physical_memory'} . "%"; # Slow queries $mycalc{'pct_slow_queries'} = int( ( $mystat{'Slow_queries'} / $mystat{'Questions'} ) * 100 ); # Connections $mycalc{'pct_connections_used'} = int( ( $mystat{'Max_used_connections'} / $myvar{'max_connections'} ) * 100 ); $mycalc{'pct_connections_used'} = ( $mycalc{'pct_connections_used'} > 100 ) ? 100 : $mycalc{'pct_connections_used'}; # Aborted Connections $mycalc{'pct_connections_aborted'} = percentage( $mystat{'Aborted_connects'}, $mystat{'Connections'} ); debugprint "Aborted_connects: " . $mystat{'Aborted_connects'} . ""; debugprint "Connections: " . $mystat{'Connections'} . ""; debugprint "pct_connections_aborted: " . $mycalc{'pct_connections_aborted'} . ""; # Key buffers if ( mysql_version_ge( 4, 1 ) && $myvar{'key_buffer_size'} > 0 ) { $mycalc{'pct_key_buffer_used'} = sprintf( "%.1f", ( 1 - ( ( $mystat{'Key_blocks_unused'} * $myvar{'key_cache_block_size'} ) / $myvar{'key_buffer_size'} ) ) * 100 ); } else { $mycalc{'pct_key_buffer_used'} = 0; } if ( $mystat{'Key_read_requests'} > 0 ) { $mycalc{'pct_keys_from_mem'} = sprintf( "%.1f", ( 100 - ( ( $mystat{'Key_reads'} / $mystat{'Key_read_requests'} ) * 100 ) ) ); } else { $mycalc{'pct_keys_from_mem'} = 0; } if ( defined $mystat{'Aria_pagecache_read_requests'} && $mystat{'Aria_pagecache_read_requests'} > 0 ) { $mycalc{'pct_aria_keys_from_mem'} = sprintf( "%.1f", ( 100 - ( ( $mystat{'Aria_pagecache_reads'} / $mystat{'Aria_pagecache_read_requests'} ) * 100 ) ) ); } else { $mycalc{'pct_aria_keys_from_mem'} = 0; } if ( $mystat{'Key_write_requests'} > 0 ) { $mycalc{'pct_wkeys_from_mem'} = sprintf( "%.1f", ( ( $mystat{'Key_writes'} / $mystat{'Key_write_requests'} ) * 100 ) ); } else { $mycalc{'pct_wkeys_from_mem'} = 0; } if ( $doremote eq 0 and !mysql_version_ge(5) ) { my $size = 0; $size += (split)[0] for `find "$myvar{'datadir'}" -name "*.MYI" -print0 2>&1 | xargs $xargsflags -0 du -L $duflags 2>&1`; $mycalc{'total_myisam_indexes'} = $size; $size = 0 + (split)[0] for `find "$myvar{'datadir'}" -name "*.MAI" -print0 2>&1 | xargs $xargsflags -0 du -L $duflags 2>&1`; $mycalc{'total_aria_indexes'} = $size; } elsif ( mysql_version_ge(5) ) { $mycalc{'total_myisam_indexes'} = select_one "SELECT IFNULL(SUM(INDEX_LENGTH), 0) FROM information_schema.TABLES WHERE TABLE_SCHEMA NOT IN ('information_schema') AND ENGINE = 'MyISAM';"; $mycalc{'total_aria_indexes'} = select_one "SELECT IFNULL(SUM(INDEX_LENGTH), 0) FROM information_schema.TABLES WHERE TABLE_SCHEMA NOT IN ('information_schema') AND ENGINE = 'Aria';"; } if ( defined $mycalc{'total_myisam_indexes'} ) { chomp( $mycalc{'total_myisam_indexes'} ); } if ( defined $mycalc{'total_aria_indexes'} ) { chomp( $mycalc{'total_aria_indexes'} ); } # Query cache if ( mysql_version_ge(8) and mysql_version_le(10) ) { $mycalc{'query_cache_efficiency'} = 0; } elsif ( mysql_version_ge(4) ) { $mycalc{'query_cache_efficiency'} = sprintf( "%.1f", ( $mystat{'Qcache_hits'} / ( $mystat{'Com_select'} + $mystat{'Qcache_hits'} ) ) * 100 ); if ( $myvar{'query_cache_size'} ) { $mycalc{'pct_query_cache_used'} = sprintf( "%.1f", 100 - ( $mystat{'Qcache_free_memory'} / $myvar{'query_cache_size'} ) * 100 ); } if ( $mystat{'Qcache_lowmem_prunes'} == 0 ) { $mycalc{'query_cache_prunes_per_day'} = 0; } else { $mycalc{'query_cache_prunes_per_day'} = int( $mystat{'Qcache_lowmem_prunes'} / ( $mystat{'Uptime'} / 86400 ) ); } } # Sorting $mycalc{'total_sorts'} = $mystat{'Sort_scan'} + $mystat{'Sort_range'}; if ( $mycalc{'total_sorts'} > 0 ) { $mycalc{'pct_temp_sort_table'} = int( ( $mystat{'Sort_merge_passes'} / $mycalc{'total_sorts'} ) * 100 ); } # Joins $mycalc{'joins_without_indexes'} = $mystat{'Select_range_check'} + $mystat{'Select_full_join'}; $mycalc{'joins_without_indexes_per_day'} = int( $mycalc{'joins_without_indexes'} / ( $mystat{'Uptime'} / 86400 ) ); # Temporary tables if ( $mystat{'Created_tmp_tables'} > 0 ) { if ( $mystat{'Created_tmp_disk_tables'} > 0 ) { $mycalc{'pct_temp_disk'} = int( ( $mystat{'Created_tmp_disk_tables'} / $mystat{'Created_tmp_tables'} ) * 100 ); } else { $mycalc{'pct_temp_disk'} = 0; } } # Table cache if ( $mystat{'Opened_tables'} > 0 ) { if ( not defined( $mystat{'Table_open_cache_hits'} ) ) { $mycalc{'table_cache_hit_rate'} = int( $mystat{'Open_tables'} * 100 / $mystat{'Opened_tables'} ); } else { $mycalc{'table_cache_hit_rate'} = int( $mystat{'Table_open_cache_hits'} * 100 / ( $mystat{'Table_open_cache_hits'} + $mystat{'Table_open_cache_misses'} ) ); } } else { $mycalc{'table_cache_hit_rate'} = 100; } # Open files if ( $myvar{'open_files_limit'} > 0 ) { $mycalc{'pct_files_open'} = int( $mystat{'Open_files'} * 100 / $myvar{'open_files_limit'} ); } # Table locks if ( $mystat{'Table_locks_immediate'} > 0 ) { if ( $mystat{'Table_locks_waited'} == 0 ) { $mycalc{'pct_table_locks_immediate'} = 100; } else { $mycalc{'pct_table_locks_immediate'} = int( $mystat{'Table_locks_immediate'} * 100 / ( $mystat{'Table_locks_waited'} + $mystat{'Table_locks_immediate'} ) ); } } # Thread cache $mycalc{'thread_cache_hit_rate'} = int( 100 - ( ( $mystat{'Threads_created'} / $mystat{'Connections'} ) * 100 ) ); # Other if ( $mystat{'Connections'} > 0 ) { $mycalc{'pct_aborted_connections'} = int( ( $mystat{'Aborted_connects'} / $mystat{'Connections'} ) * 100 ); } if ( $mystat{'Questions'} > 0 ) { $mycalc{'total_reads'} = $mystat{'Com_select'}; $mycalc{'total_writes'} = $mystat{'Com_delete'} + $mystat{'Com_insert'} + $mystat{'Com_update'} + $mystat{'Com_replace'}; if ( $mycalc{'total_reads'} == 0 ) { $mycalc{'pct_reads'} = 0; $mycalc{'pct_writes'} = 100; } else { $mycalc{'pct_reads'} = int( ( $mycalc{'total_reads'} / ( $mycalc{'total_reads'} + $mycalc{'total_writes'} ) ) * 100 ); $mycalc{'pct_writes'} = 100 - $mycalc{'pct_reads'}; } } # InnoDB $myvar{'innodb_log_files_in_group'} = 1 unless defined( $myvar{'innodb_log_files_in_group'} ); $myvar{'innodb_log_files_in_group'} = 1 if $myvar{'innodb_log_files_in_group'} == 0; $myvar{"innodb_buffer_pool_instances"} = 1 unless defined( $myvar{'innodb_buffer_pool_instances'} ); if ( $myvar{'have_innodb'} eq "YES" ) { $mycalc{'innodb_log_size_pct'} = ( $myvar{'innodb_log_file_size'} * $myvar{'innodb_log_files_in_group'} * 100 / $myvar{'innodb_buffer_pool_size'} ); } if ( !defined $myvar{'innodb_buffer_pool_size'} ) { $mycalc{'innodb_log_size_pct'} = 0; $myvar{'innodb_buffer_pool_size'} = 0; } # InnoDB Buffer pool read cache efficiency ( $mystat{'Innodb_buffer_pool_read_requests'}, $mystat{'Innodb_buffer_pool_reads'} ) = ( 1, 1 ) unless defined $mystat{'Innodb_buffer_pool_reads'}; $mycalc{'pct_read_efficiency'} = percentage( $mystat{'Innodb_buffer_pool_read_requests'}, ( $mystat{'Innodb_buffer_pool_read_requests'} + $mystat{'Innodb_buffer_pool_reads'} ) ) if defined $mystat{'Innodb_buffer_pool_read_requests'}; debugprint "pct_read_efficiency: " . $mycalc{'pct_read_efficiency'} . ""; debugprint "Innodb_buffer_pool_reads: " . $mystat{'Innodb_buffer_pool_reads'} . ""; debugprint "Innodb_buffer_pool_read_requests: " . $mystat{'Innodb_buffer_pool_read_requests'} . ""; # InnoDB log write cache efficiency ( $mystat{'Innodb_log_write_requests'}, $mystat{'Innodb_log_writes'} ) = ( 1, 1 ) unless defined $mystat{'Innodb_log_writes'}; $mycalc{'pct_write_efficiency'} = percentage( ( $mystat{'Innodb_log_write_requests'} - $mystat{'Innodb_log_writes'} ), $mystat{'Innodb_log_write_requests'} ) if defined $mystat{'Innodb_log_write_requests'}; debugprint "pct_write_efficiency: " . $mycalc{'pct_write_efficiency'} . ""; debugprint "Innodb_log_writes: " . $mystat{'Innodb_log_writes'} . ""; debugprint "Innodb_log_write_requests: " . $mystat{'Innodb_log_write_requests'} . ""; $mycalc{'pct_innodb_buffer_used'} = percentage( ( $mystat{'Innodb_buffer_pool_pages_total'} - $mystat{'Innodb_buffer_pool_pages_free'} ), $mystat{'Innodb_buffer_pool_pages_total'} ) if defined $mystat{'Innodb_buffer_pool_pages_total'}; my $lreq = "select ROUND( 100* sum(allocated)/ " . $myvar{'innodb_buffer_pool_size'} . ',1) FROM sys.x\$innodb_buffer_stats_by_table;'; debugprint("lreq: $lreq"); $mycalc{'innodb_buffer_alloc_pct'} = select_one($lreq) if ( $opt{experimental} ); # Binlog Cache if ( $myvar{'log_bin'} ne 'OFF' ) { $mycalc{'pct_binlog_cache'} = percentage( $mystat{'Binlog_cache_use'} - $mystat{'Binlog_cache_disk_use'}, $mystat{'Binlog_cache_use'} ); } } sub mysql_stats { subheaderprint "Performance Metrics"; # Show uptime, queries per second, connections, traffic stats my $qps; if ( $mystat{'Uptime'} > 0 ) { $qps = sprintf( "%.3f", $mystat{'Questions'} / $mystat{'Uptime'} ); } push( @generalrec, "MySQL was started within the last 24 hours: recommendations may be inaccurate" ) if ( $mystat{'Uptime'} < 86400 ); infoprint "Up for: " . pretty_uptime( $mystat{'Uptime'} ) . " (" . hr_num( $mystat{'Questions'} ) . " q [" . hr_num($qps) . " qps], " . hr_num( $mystat{'Connections'} ) . " conn," . " TX: " . hr_bytes_rnd( $mystat{'Bytes_sent'} ) . ", RX: " . hr_bytes_rnd( $mystat{'Bytes_received'} ) . ")"; infoprint "Reads / Writes: " . $mycalc{'pct_reads'} . "% / " . $mycalc{'pct_writes'} . "%"; # Binlog Cache if ( $myvar{'log_bin'} eq 'OFF' ) { infoprint "Binary logging is disabled"; } else { infoprint "Binary logging is enabled (GTID MODE: " . ( defined( $myvar{'gtid_mode'} ) ? $myvar{'gtid_mode'} : "OFF" ) . ")"; } # Memory usage infoprint "Physical Memory : " . hr_bytes($physical_memory); infoprint "Max MySQL memory : " . hr_bytes( $mycalc{'max_peak_memory'} ); infoprint "Other process memory: " . hr_bytes( get_other_process_memory() ); infoprint "Total buffers: " . hr_bytes( $mycalc{'server_buffers'} ) . " global + " . hr_bytes( $mycalc{'per_thread_buffers'} ) . " per thread ($myvar{'max_connections'} max threads)"; infoprint "Performance_schema Max memory usage: " . hr_bytes_rnd( get_pf_memory() ); $result{'Performance_schema'}{'memory'} = get_pf_memory(); $result{'Performance_schema'}{'pretty_memory'} = hr_bytes_rnd( get_pf_memory() ); infoprint "Galera GCache Max memory usage: " . hr_bytes_rnd( get_gcache_memory() ); $result{'Galera'}{'GCache'}{'memory'} = get_gcache_memory(); $result{'Galera'}{'GCache'}{'pretty_memory'} = hr_bytes_rnd( get_gcache_memory() ); if ( $opt{buffers} ne 0 ) { infoprint "Global Buffers"; infoprint " +-- Key Buffer: " . hr_bytes( $myvar{'key_buffer_size'} ) . ""; infoprint " +-- Max Tmp Table: " . hr_bytes( $mycalc{'max_tmp_table_size'} ) . ""; if ( defined $myvar{'query_cache_type'} ) { infoprint "Query Cache Buffers"; infoprint " +-- Query Cache: " . $myvar{'query_cache_type'} . " - " . ( $myvar{'query_cache_type'} eq 0 | $myvar{'query_cache_type'} eq 'OFF' ? "DISABLED" : ( $myvar{'query_cache_type'} eq 1 ? "ALL REQUESTS" : "ON DEMAND" ) ) . ""; infoprint " +-- Query Cache Size: " . hr_bytes( $myvar{'query_cache_size'} ) . ""; } infoprint "Per Thread Buffers"; infoprint " +-- Read Buffer: " . hr_bytes( $myvar{'read_buffer_size'} ) . ""; infoprint " +-- Read RND Buffer: " . hr_bytes( $myvar{'read_rnd_buffer_size'} ) . ""; infoprint " +-- Sort Buffer: " . hr_bytes( $myvar{'sort_buffer_size'} ) . ""; infoprint " +-- Thread stack: " . hr_bytes( $myvar{'thread_stack'} ) . ""; infoprint " +-- Join Buffer: " . hr_bytes( $myvar{'join_buffer_size'} ) . ""; if ( $myvar{'log_bin'} ne 'OFF' ) { infoprint "Binlog Cache Buffers"; infoprint " +-- Binlog Cache: " . hr_bytes( $myvar{'binlog_cache_size'} ) . ""; } } if ( $arch && $arch == 32 && $mycalc{'max_used_memory'} > 2 * 1024 * 1024 * 1024 ) { badprint "Allocating > 2GB RAM on 32-bit systems can cause system instability"; badprint "Maximum reached memory usage: " . hr_bytes( $mycalc{'max_used_memory'} ) . " ($mycalc{'pct_max_used_memory'}% of installed RAM)"; } elsif ( $mycalc{'pct_max_used_memory'} > 85 ) { badprint "Maximum reached memory usage: " . hr_bytes( $mycalc{'max_used_memory'} ) . " ($mycalc{'pct_max_used_memory'}% of installed RAM)"; } else { goodprint "Maximum reached memory usage: " . hr_bytes( $mycalc{'max_used_memory'} ) . " ($mycalc{'pct_max_used_memory'}% of installed RAM)"; } if ( $mycalc{'pct_max_physical_memory'} > 85 ) { badprint "Maximum possible memory usage: " . hr_bytes( $mycalc{'max_peak_memory'} ) . " ($mycalc{'pct_max_physical_memory'}% of installed RAM)"; push( @generalrec, "Reduce your overall MySQL memory footprint for system stability" ); } else { goodprint "Maximum possible memory usage: " . hr_bytes( $mycalc{'max_peak_memory'} ) . " ($mycalc{'pct_max_physical_memory'}% of installed RAM)"; } if ( $physical_memory < ( $mycalc{'max_peak_memory'} + get_other_process_memory() ) ) { if ( $opt{nondedicated} ) { infoprint "No warning with --nondedicated option"; infoprint "Overall possible memory usage with other process exceeded memory"; } else { badprint "Overall possible memory usage with other process exceeded memory"; push( @generalrec, "Dedicate this server to your database for highest performance." ); } } else { goodprint "Overall possible memory usage with other process is compatible with memory available"; } # Slow queries if ( $mycalc{'pct_slow_queries'} > 5 ) { badprint "Slow queries: $mycalc{'pct_slow_queries'}% (" . hr_num( $mystat{'Slow_queries'} ) . "/" . hr_num( $mystat{'Questions'} ) . ")"; } else { goodprint "Slow queries: $mycalc{'pct_slow_queries'}% (" . hr_num( $mystat{'Slow_queries'} ) . "/" . hr_num( $mystat{'Questions'} ) . ")"; } if ( $myvar{'long_query_time'} > 10 ) { push( @adjvars, "long_query_time (<= 10)" ); } if ( defined( $myvar{'log_slow_queries'} ) ) { if ( $myvar{'log_slow_queries'} eq "OFF" ) { push( @generalrec, "Enable the slow query log to troubleshoot bad queries" ); } } # Connections if ( $mycalc{'pct_connections_used'} > 85 ) { badprint "Highest connection usage: $mycalc{'pct_connections_used'}% ($mystat{'Max_used_connections'}/$myvar{'max_connections'})"; push( @adjvars, "max_connections (> " . $myvar{'max_connections'} . ")" ); push( @adjvars, "wait_timeout (< " . $myvar{'wait_timeout'} . ")", "interactive_timeout (< " . $myvar{'interactive_timeout'} . ")" ); push( @generalrec, "Reduce or eliminate persistent connections to reduce connection usage" ); } else { goodprint "Highest usage of available connections: $mycalc{'pct_connections_used'}% ($mystat{'Max_used_connections'}/$myvar{'max_connections'})"; } # Aborted Connections if ( $mycalc{'pct_connections_aborted'} > 3 ) { badprint "Aborted connections: $mycalc{'pct_connections_aborted'}% ($mystat{'Aborted_connects'}/$mystat{'Connections'})"; push( @generalrec, "Reduce or eliminate unclosed connections and network issues" ); } else { goodprint "Aborted connections: $mycalc{'pct_connections_aborted'}% ($mystat{'Aborted_connects'}/$mystat{'Connections'})"; } # name resolution debugprint "skip name resolve: $result{'Variables'}{'skip_name_resolve'}" if ( defined( $result{'Variables'}{'skip_name_resolve'} ) ); if ( defined( $result{'Variables'}{'skip_networking'} ) && $result{'Variables'}{'skip_networking'} eq 'ON' ) { infoprint "Skipped name resolution test due to skip_networking=ON in system variables."; } elsif ( not defined( $result{'Variables'}{'skip_name_resolve'} ) ) { infoprint "Skipped name resolution test due to missing skip_name_resolve in system variables."; } #Cpanel and Skip name resolve elsif ( -r "/usr/local/cpanel/cpanel" ) { if ( $result{'Variables'}{'skip_name_resolve'} ne 'OFF' ) { infoprint "CPanel and Flex system skip-name-resolve should be on"; } if ( $result{'Variables'}{'skip_name_resolve'} eq 'OFF' ) { badprint "CPanel and Flex system skip-name-resolve should be on"; push( @generalrec, "name resolution is enabled due to cPanel doesn't support this disabled." ); push( @adjvars, "skip-name-resolve=0" ); } } elsif ( $result{'Variables'}{'skip_name_resolve'} ne 'ON' and $result{'Variables'}{'skip_name_resolve'} ne '1' ) { badprint "Name resolution is active: a reverse name resolution is made for each new connection which can reduce performance"; push( @generalrec, "Configure your accounts with ip or subnets only, then update your configuration with skip-name-resolve=ON" ); push( @adjvars, "skip-name-resolve=ON" ); } # Query cache if ( !mysql_version_ge(4) ) { # MySQL versions < 4.01 don't support query caching push( @generalrec, "Upgrade MySQL to version 4+ to utilize query caching" ); } elsif ( mysql_version_eq(8) ) { infoprint "Query cache has been removed since MySQL 8.0"; #return; } elsif ($myvar{'query_cache_size'} < 1 or $myvar{'query_cache_type'} eq "OFF" ) { goodprint "Query cache is disabled by default due to mutex contention on multiprocessor machines."; } elsif ( $mystat{'Com_select'} == 0 ) { badprint "Query cache cannot be analyzed: no SELECT statements executed"; } else { if ( $mycalc{'query_cache_efficiency'} < 20 ) { badprint "Query cache efficiency: $mycalc{'query_cache_efficiency'}% (" . hr_num( $mystat{'Qcache_hits'} ) . " cached / " . hr_num( $mystat{'Qcache_hits'} + $mystat{'Com_select'} ) . " selects)"; push( @adjvars, "query_cache_limit (> " . hr_bytes_rnd( $myvar{'query_cache_limit'} ) . ", or use smaller result sets)" ); badprint "Query cache may be disabled by default due to mutex contention."; push( @adjvars, "query_cache_size (=0)" ); push( @adjvars, "query_cache_type (=0)" ); } else { goodprint "Query cache efficiency: $mycalc{'query_cache_efficiency'}% (" . hr_num( $mystat{'Qcache_hits'} ) . " cached / " . hr_num( $mystat{'Qcache_hits'} + $mystat{'Com_select'} ) . " selects)"; if ( $mycalc{'query_cache_prunes_per_day'} > 98 ) { badprint "Query cache prunes per day: $mycalc{'query_cache_prunes_per_day'}"; if ( $myvar{'query_cache_size'} >= 128 * 1024 * 1024 ) { push( @generalrec, "Increasing the query_cache size over 128M may reduce performance" ); push( @adjvars, "query_cache_size (> " . hr_bytes_rnd( $myvar{'query_cache_size'} ) . ") [see warning above]" ); } else { push( @adjvars, "query_cache_size (> " . hr_bytes_rnd( $myvar{'query_cache_size'} ) . ")" ); } } else { goodprint "Query cache prunes per day: $mycalc{'query_cache_prunes_per_day'}"; } } } # Sorting if ( $mycalc{'total_sorts'} == 0 ) { goodprint "No Sort requiring temporary tables"; } elsif ( $mycalc{'pct_temp_sort_table'} > 10 ) { badprint "Sorts requiring temporary tables: $mycalc{'pct_temp_sort_table'}% (" . hr_num( $mystat{'Sort_merge_passes'} ) . " temp sorts / " . hr_num( $mycalc{'total_sorts'} ) . " sorts)"; push( @adjvars, "sort_buffer_size (> " . hr_bytes_rnd( $myvar{'sort_buffer_size'} ) . ")" ); push( @adjvars, "read_rnd_buffer_size (> " . hr_bytes_rnd( $myvar{'read_rnd_buffer_size'} ) . ")" ); } else { goodprint "Sorts requiring temporary tables: $mycalc{'pct_temp_sort_table'}% (" . hr_num( $mystat{'Sort_merge_passes'} ) . " temp sorts / " . hr_num( $mycalc{'total_sorts'} ) . " sorts)"; } # Joins if ( $mycalc{'joins_without_indexes_per_day'} > 250 ) { badprint "Joins performed without indexes: $mycalc{'joins_without_indexes'}"; push( @adjvars, "join_buffer_size (> " . hr_bytes( $myvar{'join_buffer_size'} ) . ", or always use indexes with JOINs)" ); push( @generalrec, "We will suggest raising the 'join_buffer_size' until JOINs not using indexes are found. See https://dev.mysql.com/doc/refman/8.0/en/server-system-variables.html#sysvar_join_buffer_size" ); } else { goodprint "No joins without indexes"; # No joins have run without indexes } # Temporary tables if ( $mystat{'Created_tmp_tables'} > 0 ) { if ( $mycalc{'pct_temp_disk'} > 25 && $mycalc{'max_tmp_table_size'} < 256 * 1024 * 1024 ) { badprint "Temporary tables created on disk: $mycalc{'pct_temp_disk'}% (" . hr_num( $mystat{'Created_tmp_disk_tables'} ) . " on disk / " . hr_num( $mystat{'Created_tmp_tables'} ) . " total)"; push( @adjvars, "tmp_table_size (> " . hr_bytes_rnd( $myvar{'tmp_table_size'} ) . ")" ); push( @adjvars, "max_heap_table_size (> " . hr_bytes_rnd( $myvar{'max_heap_table_size'} ) . ")" ); push( @generalrec, "When making adjustments, make tmp_table_size/max_heap_table_size equal" ); push( @generalrec, "Reduce your SELECT DISTINCT queries which have no LIMIT clause" ); } elsif ($mycalc{'pct_temp_disk'} > 25 && $mycalc{'max_tmp_table_size'} >= 256 * 1024 * 1024 ) { badprint "Temporary tables created on disk: $mycalc{'pct_temp_disk'}% (" . hr_num( $mystat{'Created_tmp_disk_tables'} ) . " on disk / " . hr_num( $mystat{'Created_tmp_tables'} ) . " total)"; push( @generalrec, "Temporary table size is already large: reduce result set size" ); push( @generalrec, "Reduce your SELECT DISTINCT queries without LIMIT clauses" ); } else { goodprint "Temporary tables created on disk: $mycalc{'pct_temp_disk'}% (" . hr_num( $mystat{'Created_tmp_disk_tables'} ) . " on disk / " . hr_num( $mystat{'Created_tmp_tables'} ) . " total)"; } } else { goodprint "No tmp tables created on disk"; } # Thread cache if ( defined( $myvar{'have_threadpool'} ) and $myvar{'have_threadpool'} eq 'YES' ) { # https://www.percona.com/doc/percona-server/5.7/performance/threadpool.html#status-variables # When thread pool is enabled, the value of the thread_cache_size variable # is ignored. The Threads_cached status variable contains 0 in this case. infoprint "Thread cache not used with thread pool enabled"; } else { if ( $myvar{'thread_cache_size'} eq 0 ) { badprint "Thread cache is disabled"; push( @generalrec, "Set thread_cache_size to 4 as a starting value" ); push( @adjvars, "thread_cache_size (start at 4)" ); } else { if ( $mycalc{'thread_cache_hit_rate'} <= 50 ) { badprint "Thread cache hit rate: $mycalc{'thread_cache_hit_rate'}% (" . hr_num( $mystat{'Threads_created'} ) . " created / " . hr_num( $mystat{'Connections'} ) . " connections)"; push( @adjvars, "thread_cache_size (> $myvar{'thread_cache_size'})" ); } else { goodprint "Thread cache hit rate: $mycalc{'thread_cache_hit_rate'}% (" . hr_num( $mystat{'Threads_created'} ) . " created / " . hr_num( $mystat{'Connections'} ) . " connections)"; } } } # Table cache my $table_cache_var = ""; if ( $mystat{'Open_tables'} > 0 ) { if ( $mycalc{'table_cache_hit_rate'} < 20 ) { unless ( defined( $mystat{'Table_open_cache_hits'} ) ) { badprint "Table cache hit rate: $mycalc{'table_cache_hit_rate'}% (" . hr_num( $mystat{'Open_tables'} ) . " hits / " . hr_num( $mystat{'Opened_tables'} ) . " requests)"; } else { badprint "Table cache hit rate: $mycalc{'table_cache_hit_rate'}% (" . hr_num( $mystat{'Table_open_cache_hits'} ) . " hits / " . hr_num( $mystat{'Table_open_cache_hits'} + $mystat{'Table_open_cache_misses'} ) . " requests)"; } if ( mysql_version_ge( 5, 1 ) ) { $table_cache_var = "table_open_cache"; } else { $table_cache_var = "table_cache"; } push( @adjvars, $table_cache_var . " (> " . $myvar{$table_cache_var} . ")" ); push( @generalrec, "Increase " . $table_cache_var . " gradually to avoid file descriptor limits" ); push( @generalrec, "Read this before increasing " . $table_cache_var . " over 64: https://bit.ly/2Fulv7r" ); push( @generalrec, "Read this before increasing for MariaDB" . " https://mariadb.com/kb/en/library/optimizing-table_open_cache/" ); push( @generalrec, "This is MyISAM only table_cache scalability problem, InnoDB not affected." ); push( @generalrec, "For more details see: https://bugs.mysql.com/bug.php?id=49177" ); push( @generalrec, "This bug already fixed in MySQL 5.7.9 and newer MySQL versions." ); push( @generalrec, "Beware that open_files_limit (" . $myvar{'open_files_limit'} . ") variable " ); push( @generalrec, "should be greater than $table_cache_var (" . $myvar{$table_cache_var} . ")" ); } else { unless ( defined( $mystat{'Table_open_cache_hits'} ) ) { goodprint "Table cache hit rate: $mycalc{'table_cache_hit_rate'}% (" . hr_num( $mystat{'Open_tables'} ) . " hits / " . hr_num( $mystat{'Opened_tables'} ) . " requests)"; } else { goodprint "Table cache hit rate: $mycalc{'table_cache_hit_rate'}% (" . hr_num( $mystat{'Table_open_cache_hits'} ) . " hits / " . hr_num( $mystat{'Table_open_cache_hits'} + $mystat{'Table_open_cache_misses'} ) . " requests)"; } } } # Table definition cache my $nbtables = select_one('SELECT COUNT(*) FROM information_schema.tables'); $mycalc{'total_tables'} = $nbtables; if ( defined $myvar{'table_definition_cache'} ) { if ( $myvar{'table_definition_cache'} == -1 ) { infoprint( "table_definition_cache (" . $myvar{'table_definition_cache'} . ") is in autosizing mode" ); } elsif ( $myvar{'table_definition_cache'} < $nbtables ) { badprint "table_definition_cache (" . $myvar{'table_definition_cache'} . ") is less than number of tables ($nbtables) "; push( @adjvars, "table_definition_cache (" . $myvar{'table_definition_cache'} . ") > " . $nbtables . " or -1 (autosizing if supported)" ); } else { goodprint "table_definition_cache (" . $myvar{'table_definition_cache'} . ") is greater than number of tables ($nbtables)"; } } else { infoprint "No table_definition_cache variable found."; } # Open files if ( defined $mycalc{'pct_files_open'} ) { if ( $mycalc{'pct_files_open'} > 85 ) { badprint "Open file limit used: $mycalc{'pct_files_open'}% (" . hr_num( $mystat{'Open_files'} ) . "/" . hr_num( $myvar{'open_files_limit'} ) . ")"; push( @adjvars, "open_files_limit (> " . $myvar{'open_files_limit'} . ")" ); } else { goodprint "Open file limit used: $mycalc{'pct_files_open'}% (" . hr_num( $mystat{'Open_files'} ) . "/" . hr_num( $myvar{'open_files_limit'} ) . ")"; } } # Table locks if ( defined $mycalc{'pct_table_locks_immediate'} ) { if ( $mycalc{'pct_table_locks_immediate'} < 95 ) { badprint "Table locks acquired immediately: $mycalc{'pct_table_locks_immediate'}%"; push( @generalrec, "Optimize queries and/or use InnoDB to reduce lock wait" ); } else { goodprint "Table locks acquired immediately: $mycalc{'pct_table_locks_immediate'}% (" . hr_num( $mystat{'Table_locks_immediate'} ) . " immediate / " . hr_num( $mystat{'Table_locks_waited'} + $mystat{'Table_locks_immediate'} ) . " locks)"; } } # Binlog cache if ( defined $mycalc{'pct_binlog_cache'} ) { if ( $mycalc{'pct_binlog_cache'} < 90 && $mystat{'Binlog_cache_use'} > 0 ) { badprint "Binlog cache memory access: " . $mycalc{'pct_binlog_cache'} . "% (" . ( $mystat{'Binlog_cache_use'} - $mystat{'Binlog_cache_disk_use'} ) . " Memory / " . $mystat{'Binlog_cache_use'} . " Total)"; push( @generalrec, "Increase binlog_cache_size (current value: " . $myvar{'binlog_cache_size'} . ")" ); push( @adjvars, "binlog_cache_size (" . hr_bytes( $myvar{'binlog_cache_size'} + 16 * 1024 * 1024 ) . ")" ); } else { goodprint "Binlog cache memory access: " . $mycalc{'pct_binlog_cache'} . "% (" . ( $mystat{'Binlog_cache_use'} - $mystat{'Binlog_cache_disk_use'} ) . " Memory / " . $mystat{'Binlog_cache_use'} . " Total)"; debugprint "Not enough data to validate binlog cache size\n" if $mystat{'Binlog_cache_use'} < 10; } } # Performance options if ( !mysql_version_ge( 5, 1 ) ) { push( @generalrec, "Upgrade to MySQL 5.5+ to use asynchronous write" ); } elsif ( $myvar{'concurrent_insert'} eq "OFF" ) { push( @generalrec, "Enable concurrent_insert by setting it to 'ON'" ); } elsif ( $myvar{'concurrent_insert'} eq 0 ) { push( @generalrec, "Enable concurrent_insert by setting it to 1" ); } } # Recommendations for MyISAM sub mysql_myisam { return 0 unless ( $opt{'myisamstat'} > 0 ); subheaderprint "MyISAM Metrics"; my $nb_myisam_tables = select_one( "SELECT COUNT(*) FROM information_schema.TABLES WHERE ENGINE='MyISAM' and TABLE_SCHEMA NOT IN ('mysql','information_schema','performance_schema')" ); push( @generalrec, "MyISAM engine is deprecated, consider migrating to InnoDB" ) if $nb_myisam_tables > 0; if ( $nb_myisam_tables > 0 ) { badprint "Consider migrating $nb_myisam_tables following tables to InnoDB:"; my $sql_mig = ""; for my $myisam_table ( select_array( "SELECT CONCAT(TABLE_SCHEMA, '.', TABLE_NAME) FROM information_schema.TABLES WHERE ENGINE='MyISAM' and TABLE_SCHEMA NOT IN ('mysql','information_schema','performance_schema')" ) ) { $sql_mig = "${sql_mig}-- InnoDB migration for $myisam_table\nALTER TABLE $myisam_table ENGINE=InnoDB;\n\n"; infoprint "* InnoDB migration request for $myisam_table Table: ALTER TABLE $myisam_table ENGINE=InnoDB;"; } dump_into_file( "migrate_myisam_to_innodb.sql", $sql_mig ); } infoprint("General MyIsam metrics:"); infoprint " +-- Total MyISAM Tables : $nb_myisam_tables"; infoprint " +-- Total MyISAM indexes : " . hr_bytes( $mycalc{'total_myisam_indexes'} ) if defined( $mycalc{'total_myisam_indexes'} ); infoprint " +-- KB Size :" . hr_bytes( $myvar{'key_buffer_size'} ); infoprint " +-- KB Used Size :" . hr_bytes( $myvar{'key_buffer_size'} - $mystat{'Key_blocks_unused'} * $myvar{'key_cache_block_size'} ); infoprint " +-- KB used :" . $mycalc{'pct_key_buffer_used'} . "%"; infoprint " +-- Read KB hit rate: $mycalc{'pct_keys_from_mem'}% (" . hr_num( $mystat{'Key_read_requests'} ) . " cached / " . hr_num( $mystat{'Key_reads'} ) . " reads)"; infoprint " +-- Write KB hit rate: $mycalc{'pct_wkeys_from_mem'}% (" . hr_num( $mystat{'Key_write_requests'} ) . " cached / " . hr_num( $mystat{'Key_writes'} ) . " writes)"; if ( $nb_myisam_tables == 0 ) { infoprint "No MyISAM table(s) detected ...."; return; } if ( mysql_version_ge(8) and mysql_version_le(10) ) { infoprint "MyISAM Metrics are disabled since MySQL 8.0."; if ( $myvar{'key_buffer_size'} > 0 ) { push( @adjvars, "key_buffer_size=0" ); push( @generalrec, "Buffer Key MyISAM set to 0, no MyISAM table detected" ); } return; } if ( !defined( $mycalc{'total_myisam_indexes'} ) ) { badprint "Unable to calculate MyISAM index size on MySQL server < 5.0.0"; push( @generalrec, "Unable to calculate MyISAM index size on MySQL server < 5.0.0" ); return; } if ( $mycalc{'pct_key_buffer_used'} == 0 ) { # No queries have run that would use keys infoprint "Key buffer used: $mycalc{'pct_key_buffer_used'}% (" . hr_bytes( $myvar{'key_buffer_size'} - $mystat{'Key_blocks_unused'} * $myvar{'key_cache_block_size'} ) . " used / " . hr_bytes( $myvar{'key_buffer_size'} ) . " cache)"; infoprint "No SQL statement based on MyISAM table(s) detected ...."; return; } # Key buffer usage if ( $mycalc{'pct_key_buffer_used'} < 90 ) { badprint "Key buffer used: $mycalc{'pct_key_buffer_used'}% (" . hr_bytes( $myvar{'key_buffer_size'} - $mystat{'Key_blocks_unused'} * $myvar{'key_cache_block_size'} ) . " used / " . hr_bytes( $myvar{'key_buffer_size'} ) . " cache)"; push( @adjvars, "key_buffer_size (\~ " . hr_num( $myvar{'key_buffer_size'} * $mycalc{'pct_key_buffer_used'} / 100 ) . ")" ); } else { goodprint "Key buffer used: $mycalc{'pct_key_buffer_used'}% (" . hr_bytes( $myvar{'key_buffer_size'} - $mystat{'Key_blocks_unused'} * $myvar{'key_cache_block_size'} ) . " used / " . hr_bytes( $myvar{'key_buffer_size'} ) . " cache)"; } # Key buffer size / total MyISAM indexes if ( $myvar{'key_buffer_size'} < $mycalc{'total_myisam_indexes'} && $mycalc{'pct_keys_from_mem'} < 95 ) { badprint "Key buffer size / total MyISAM indexes: " . hr_bytes( $myvar{'key_buffer_size'} ) . "/" . hr_bytes( $mycalc{'total_myisam_indexes'} ) . ""; push( @adjvars, "key_buffer_size (> " . hr_bytes( $mycalc{'total_myisam_indexes'} ) . ")" ); } else { goodprint "Key buffer size / total MyISAM indexes: " . hr_bytes( $myvar{'key_buffer_size'} ) . "/" . hr_bytes( $mycalc{'total_myisam_indexes'} ) . ""; } if ( $mystat{'Key_read_requests'} > 0 ) { if ( $mycalc{'pct_keys_from_mem'} < 95 ) { badprint "Read Key buffer hit rate: $mycalc{'pct_keys_from_mem'}% (" . hr_num( $mystat{'Key_read_requests'} ) . " cached / " . hr_num( $mystat{'Key_reads'} ) . " reads)"; } else { goodprint "Read Key buffer hit rate: $mycalc{'pct_keys_from_mem'}% (" . hr_num( $mystat{'Key_read_requests'} ) . " cached / " . hr_num( $mystat{'Key_reads'} ) . " reads)"; } } # No queries have run that would use keys debugprint "Key buffer size / total MyISAM indexes: " . hr_bytes( $myvar{'key_buffer_size'} ) . "/" . hr_bytes( $mycalc{'total_myisam_indexes'} ) . ""; if ( $mystat{'Key_write_requests'} > 0 ) { if ( $mycalc{'pct_wkeys_from_mem'} < 95 ) { badprint "Write Key buffer hit rate: $mycalc{'pct_wkeys_from_mem'}% (" . hr_num( $mystat{'Key_write_requests'} ) . " cached / " . hr_num( $mystat{'Key_writes'} ) . " writes)"; } else { goodprint "Write Key buffer hit rate: $mycalc{'pct_wkeys_from_mem'}% (" . hr_num( $mystat{'Key_write_requests'} ) . " cached / " . hr_num( $mystat{'Key_writes'} ) . " writes)"; } } else { # No queries have run that would use keys debugprint "Write Key buffer hit rate: $mycalc{'pct_wkeys_from_mem'}% (" . hr_num( $mystat{'Key_write_requests'} ) . " cached / " . hr_num( $mystat{'Key_writes'} ) . " writes)"; } } # Recommendations for ThreadPool sub mariadb_threadpool { subheaderprint "ThreadPool Metrics"; # MariaDB unless ( defined $myvar{'have_threadpool'} && $myvar{'have_threadpool'} eq "YES" ) { infoprint "ThreadPool stat is disabled."; return; } infoprint "ThreadPool stat is enabled."; infoprint "Thread Pool Size: " . $myvar{'thread_pool_size'} . " thread(s)."; if ( $myvar{'version'} =~ /percona/i or $myvar{'version_comment'} =~ /percona/i ) { my $np = cpu_cores; if ( $myvar{'thread_pool_size'} >= $np and $myvar{'thread_pool_size'} < ( $np * 1.5 ) ) { goodprint "thread_pool_size for Percona between 1 and 1.5 times number of CPUs (" . $np . " and " . ( $np * 1.5 ) . ")"; } else { badprint "thread_pool_size for Percona between 1 and 1.5 times number of CPUs (" . $np . " and " . ( $np * 1.5 ) . ")"; push( @adjvars, "thread_pool_size between " . $np . " and " . ( $np * 1.5 ) . " for InnoDB usage" ); } return; } if ( $myvar{'version'} =~ /mariadb/i ) { infoprint "Using default value is good enough for your version (" . $myvar{'version'} . ")"; return; } if ( $myvar{'have_innodb'} eq 'YES' ) { if ( $myvar{'thread_pool_size'} < 16 or $myvar{'thread_pool_size'} > 36 ) { badprint "thread_pool_size between 16 and 36 when using InnoDB storage engine."; push( @generalrec, "Thread pool size for InnoDB usage (" . $myvar{'thread_pool_size'} . ")" ); push( @adjvars, "thread_pool_size between 16 and 36 for InnoDB usage" ); } else { goodprint "thread_pool_size between 16 and 36 when using InnoDB storage engine."; } return; } if ( $myvar{'have_isam'} eq 'YES' ) { if ( $myvar{'thread_pool_size'} < 4 or $myvar{'thread_pool_size'} > 8 ) { badprint "thread_pool_size between 4 and 8 when using MyISAM storage engine."; push( @generalrec, "Thread pool size for MyISAM usage (" . $myvar{'thread_pool_size'} . ")" ); push( @adjvars, "thread_pool_size between 4 and 8 for MyISAM usage" ); } else { goodprint "thread_pool_size between 4 and 8 when using MyISAM storage engine."; } } } sub get_pf_memory { # Performance Schema return 0 unless defined $myvar{'performance_schema'}; return 0 if $myvar{'performance_schema'} eq 'OFF'; my @infoPFSMemory = grep { /\tperformance_schema[.]memory\t/msx } select_array("SHOW ENGINE PERFORMANCE_SCHEMA STATUS"); @infoPFSMemory == 1 || return 0; $infoPFSMemory[0] =~ s/.*\s+(\d+)$/$1/g; return $infoPFSMemory[0]; } # Recommendations for Performance Schema sub mysql_pfs { subheaderprint "Performance schema"; # Performance Schema debugprint "Performance schema is " . $myvar{'performance_schema'}; $myvar{'performance_schema'} = 'OFF' unless defined( $myvar{'performance_schema'} ); if ( $myvar{'performance_schema'} eq 'OFF' ) { badprint "Performance_schema should be activated."; push( @adjvars, "performance_schema=ON" ); push( @generalrec, "Performance schema should be activated for better diagnostics" ); } if ( $myvar{'performance_schema'} eq 'ON' ) { infoprint "Performance_schema is activated."; debugprint "Performance schema is " . $myvar{'performance_schema'}; infoprint "Memory used by Performance_schema: " . hr_bytes( get_pf_memory() ); } unless ( grep /^sys$/, select_array("SHOW DATABASES") ) { infoprint "Sys schema is not installed."; push( @generalrec, mysql_version_ge( 10, 0 ) ? "Consider installing Sys schema from https://github.com/FromDual/mariadb-sys for MariaDB" : "Consider installing Sys schema from https://github.com/mysql/mysql-sys for MySQL" ) unless ( mysql_version_le( 5, 6 ) ); return; } infoprint "Sys schema is installed."; return if ( $opt{pfstat} == 0 or $myvar{'performance_schema'} ne 'ON' ); infoprint "Sys schema Version: " . select_one("select sys_version from sys.version"); # Store all sys schema in dumpdir if defined if ( defined $opt{dumpdir} and -d "$opt{dumpdir}" ) { for my $sys_view ( select_array('use sys;show tables;') ) { infoprint "Dumping $sys_view into $opt{dumpdir}"; my $sys_view_table = $sys_view; $sys_view_table =~ s/\$/\\\$/g; select_csv_file( "$opt{dumpdir}/sys_$sys_view.csv", 'select * from sys.\`' . $sys_view_table . '\`' ); } return; #exit 0 if ( $opt{stop} == 1 ); } # Top user per connection subheaderprint "Performance schema: Top 5 user per connection"; my $nbL = 1; for my $lQuery ( select_array( 'select user, total_connections from sys.user_summary order by total_connections desc LIMIT 5' ) ) { infoprint " +-- $nbL: $lQuery conn(s)"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top user per statement subheaderprint "Performance schema: Top 5 user per statement"; $nbL = 1; for my $lQuery ( select_array( 'select user, statements from sys.user_summary order by statements desc LIMIT 5' ) ) { infoprint " +-- $nbL: $lQuery stmt(s)"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top user per statement latency subheaderprint "Performance schema: Top 5 user per statement latency"; $nbL = 1; for my $lQuery ( select_array( 'select user, statement_avg_latency from sys.x\\$user_summary order by statement_avg_latency desc LIMIT 5' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top user per lock latency subheaderprint "Performance schema: Top 5 user per lock latency"; $nbL = 1; for my $lQuery ( select_array( 'select user, lock_latency from sys.x\\$user_summary_by_statement_latency order by lock_latency desc LIMIT 5' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top user per full scans subheaderprint "Performance schema: Top 5 user per nb full scans"; $nbL = 1; for my $lQuery ( select_array( 'select user, full_scans from sys.x\\$user_summary_by_statement_latency order by full_scans desc LIMIT 5' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top user per row_sent subheaderprint "Performance schema: Top 5 user per rows sent"; $nbL = 1; for my $lQuery ( select_array( 'select user, rows_sent from sys.x\\$user_summary_by_statement_latency order by rows_sent desc LIMIT 5' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top user per row modified subheaderprint "Performance schema: Top 5 user per rows modified"; $nbL = 1; for my $lQuery ( select_array( 'select user, rows_affected from sys.x\\$user_summary_by_statement_latency order by rows_affected desc LIMIT 5' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top user per io subheaderprint "Performance schema: Top 5 user per IO"; $nbL = 1; for my $lQuery ( select_array( 'select user, file_ios from sys.x\\$user_summary order by file_ios desc LIMIT 5' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top user per io latency subheaderprint "Performance schema: Top 5 user per IO latency"; $nbL = 1; for my $lQuery ( select_array( 'select user, file_io_latency from sys.x\\$user_summary order by file_io_latency desc LIMIT 5' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top host per connection subheaderprint "Performance schema: Top 5 host per connection"; $nbL = 1; for my $lQuery ( select_array( 'select host, total_connections from sys.x\\$host_summary order by total_connections desc LIMIT 5' ) ) { infoprint " +-- $nbL: $lQuery conn(s)"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top host per statement subheaderprint "Performance schema: Top 5 host per statement"; $nbL = 1; for my $lQuery ( select_array( 'select host, statements from sys.x\\$host_summary order by statements desc LIMIT 5' ) ) { infoprint " +-- $nbL: $lQuery stmt(s)"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top host per statement latency subheaderprint "Performance schema: Top 5 host per statement latency"; $nbL = 1; for my $lQuery ( select_array( 'select host, statement_avg_latency from sys.x\\$host_summary order by statement_avg_latency desc LIMIT 5' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top host per lock latency subheaderprint "Performance schema: Top 5 host per lock latency"; $nbL = 1; for my $lQuery ( select_array( 'select host, lock_latency from sys.x\\$host_summary_by_statement_latency order by lock_latency desc LIMIT 5' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top host per full scans subheaderprint "Performance schema: Top 5 host per nb full scans"; $nbL = 1; for my $lQuery ( select_array( 'select host, full_scans from sys.x\\$host_summary_by_statement_latency order by full_scans desc LIMIT 5' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top host per rows sent subheaderprint "Performance schema: Top 5 host per rows sent"; $nbL = 1; for my $lQuery ( select_array( 'select host, rows_sent from sys.x\\$host_summary_by_statement_latency order by rows_sent desc LIMIT 5' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top host per rows modified subheaderprint "Performance schema: Top 5 host per rows modified"; $nbL = 1; for my $lQuery ( select_array( 'select host, rows_affected from sys.x\\$host_summary_by_statement_latency order by rows_affected desc LIMIT 5' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top host per io subheaderprint "Performance schema: Top 5 host per io"; $nbL = 1; for my $lQuery ( select_array( 'select host, file_ios from sys.x\\$host_summary order by file_ios desc LIMIT 5' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top 5 host per io latency subheaderprint "Performance schema: Top 5 host per io latency"; $nbL = 1; for my $lQuery ( select_array( 'select host, file_io_latency from sys.x\\$host_summary order by file_io_latency desc LIMIT 5' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top IO type order by total io subheaderprint "Performance schema: Top IO type order by total io"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select substring(event_name,14), SUM(total)AS total from sys.x\\$host_summary_by_file_io_type GROUP BY substring(event_name,14) ORDER BY total DESC;' ) ) { infoprint " +-- $nbL: $lQuery i/o"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top IO type order by total latency subheaderprint "Performance schema: Top IO type order by total latency"; $nbL = 1; for my $lQuery ( select_array( 'select substring(event_name,14), ROUND(SUM(total_latency),1) AS total_latency from sys.x\\$host_summary_by_file_io_type GROUP BY substring(event_name,14) ORDER BY total_latency DESC;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top IO type order by max latency subheaderprint "Performance schema: Top IO type order by max latency"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select substring(event_name,14), MAX(max_latency) as max_latency from sys.x\\$host_summary_by_file_io_type GROUP BY substring(event_name,14) ORDER BY max_latency DESC;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top Stages order by total io subheaderprint "Performance schema: Top Stages order by total io"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select substring(event_name,7), SUM(total)AS total from sys.x\\$host_summary_by_stages GROUP BY substring(event_name,7) ORDER BY total DESC;' ) ) { infoprint " +-- $nbL: $lQuery i/o"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top Stages order by total latency subheaderprint "Performance schema: Top Stages order by total latency"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select substring(event_name,7), ROUND(SUM(total_latency),1) AS total_latency from sys.x\\$host_summary_by_stages GROUP BY substring(event_name,7) ORDER BY total_latency DESC;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top Stages order by avg latency subheaderprint "Performance schema: Top Stages order by avg latency"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select substring(event_name,7), MAX(avg_latency) as avg_latency from sys.x\\$host_summary_by_stages GROUP BY substring(event_name,7) ORDER BY avg_latency DESC;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top host per table scans subheaderprint "Performance schema: Top 5 host per table scans"; $nbL = 1; for my $lQuery ( select_array( 'select host, table_scans from sys.x\\$host_summary order by table_scans desc LIMIT 5' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # InnoDB Buffer Pool by schema subheaderprint "Performance schema: InnoDB Buffer Pool by schema"; $nbL = 1; for my $lQuery ( select_array( 'select object_schema, allocated, data, pages from sys.x\\$innodb_buffer_stats_by_schema ORDER BY pages DESC' ) ) { infoprint " +-- $nbL: $lQuery page(s)"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # InnoDB Buffer Pool by table subheaderprint "Performance schema: 40 InnoDB Buffer Pool by table"; $nbL = 1; for my $lQuery ( select_array( 'select object_schema, object_name, allocated,data, pages from sys.x\\$innodb_buffer_stats_by_table ORDER BY pages DESC LIMIT 40' ) ) { infoprint " +-- $nbL: $lQuery page(s)"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Process per allocated memory subheaderprint "Performance schema: Process per time"; $nbL = 1; for my $lQuery ( select_array( 'select user, Command AS PROC, time from sys.x\\$processlist ORDER BY time DESC;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # InnoDB Lock Waits subheaderprint "Performance schema: InnoDB Lock Waits"; $nbL = 1; for my $lQuery ( select_array( 'select wait_age_secs, locked_table, locked_type, waiting_query from sys.x\\$innodb_lock_waits order by wait_age_secs DESC;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Threads IO Latency subheaderprint "Performance schema: Thread IO Latency"; $nbL = 1; for my $lQuery ( select_array( 'select user, total_latency, max_latency from sys.x\\$io_by_thread_by_latency order by total_latency DESC;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # High Cost SQL statements subheaderprint "Performance schema: Top 15 Most latency statements"; $nbL = 1; for my $lQuery ( select_array( 'select LEFT(query, 120), avg_latency from sys.x\\$statement_analysis order by avg_latency desc LIMIT 15' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top 5% slower queries subheaderprint "Performance schema: Top 15 slower queries"; $nbL = 1; for my $lQuery ( select_array( 'select LEFT(query, 120), exec_count from sys.x\\$statements_with_runtimes_in_95th_percentile order by exec_count desc LIMIT 15' ) ) { infoprint " +-- $nbL: $lQuery s"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top 10 nb statement type subheaderprint "Performance schema: Top 15 nb statement type"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select statement, sum(total) as total from sys.x\\$host_summary_by_statement_type group by statement order by total desc LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top statement by total latency subheaderprint "Performance schema: Top 15 statement by total latency"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select statement, sum(total_latency) as total from sys.x\\$host_summary_by_statement_type group by statement order by total desc LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top statement by lock latency subheaderprint "Performance schema: Top 15 statement by lock latency"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select statement, sum(lock_latency) as total from sys.x\\$host_summary_by_statement_type group by statement order by total desc LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top statement by full scans subheaderprint "Performance schema: Top 15 statement by full scans"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select statement, sum(full_scans) as total from sys.x\\$host_summary_by_statement_type group by statement order by total desc LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top statement by rows sent subheaderprint "Performance schema: Top 15 statement by rows sent"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select statement, sum(rows_sent) as total from sys.x\\$host_summary_by_statement_type group by statement order by total desc LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Top statement by rows modified subheaderprint "Performance schema: Top 15 statement by rows modified"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select statement, sum(rows_affected) as total from sys.x\\$host_summary_by_statement_type group by statement order by total desc LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Use temporary tables subheaderprint "Performance schema: 15 sample queries using temp table"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select left(query, 120) from sys.x\\$statements_with_temp_tables LIMIT 15' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Unused Indexes subheaderprint "Performance schema: Unused indexes"; $nbL = 1; for my $lQuery ( select_array( "select \* from sys.schema_unused_indexes where object_schema not in ('performance_schema')" ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Full table scans subheaderprint "Performance schema: Tables with full table scans"; $nbL = 1; for my $lQuery ( select_array( 'select * from sys.x\\$schema_tables_with_full_table_scans order by rows_full_scanned DESC' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Latest file IO by latency subheaderprint "Performance schema: Latest File IO by latency"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select thread, file, latency, operation from sys.x\\$latest_file_io ORDER BY latency LIMIT 10;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # FILE by IO read bytes subheaderprint "Performance schema: File by IO read bytes"; $nbL = 1; for my $lQuery ( select_array( 'select file, total_read from sys.x\\$io_global_by_file_by_bytes order by total_read DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # FILE by IO written bytes subheaderprint "Performance schema: File by IO written bytes"; $nbL = 1; for my $lQuery ( select_array( 'select file, total_written from sys.x\\$io_global_by_file_by_bytes order by total_written DESC LIMIT 15' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # file per IO total latency subheaderprint "Performance schema: File per IO total latency"; $nbL = 1; for my $lQuery ( select_array( 'select file, total_latency from sys.x\\$io_global_by_file_by_latency ORDER BY total_latency DESC LIMIT 20;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # file per IO read latency subheaderprint "Performance schema: file per IO read latency"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select file, read_latency from sys.x\\$io_global_by_file_by_latency ORDER BY read_latency DESC LIMIT 20;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # file per IO write latency subheaderprint "Performance schema: file per IO write latency"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select file, write_latency from sys.x\\$io_global_by_file_by_latency ORDER BY write_latency DESC LIMIT 20;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Event Wait by read bytes subheaderprint "Performance schema: Event Wait by read bytes"; $nbL = 1; for my $lQuery ( select_array( 'select event_name, total_read from sys.x\\$io_global_by_wait_by_bytes order by total_read DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Event Wait by write bytes subheaderprint "Performance schema: Event Wait written bytes"; $nbL = 1; for my $lQuery ( select_array( 'select event_name, total_written from sys.x\\$io_global_by_wait_by_bytes order by total_written DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # event per wait total latency subheaderprint "Performance schema: event per wait total latency"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select event_name, total_latency from sys.x\\$io_global_by_wait_by_latency ORDER BY total_latency DESC LIMIT 20;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # event per wait read latency subheaderprint "Performance schema: event per wait read latency"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select event_name, read_latency from sys.x\\$io_global_by_wait_by_latency ORDER BY read_latency DESC LIMIT 20;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # event per wait write latency subheaderprint "Performance schema: event per wait write latency"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select event_name, write_latency from sys.x\\$io_global_by_wait_by_latency ORDER BY write_latency DESC LIMIT 20;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); #schema_index_statistics # TOP 15 most read index subheaderprint "Performance schema: Top 15 most read indexes"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select table_schema, table_name,index_name, rows_selected from sys.x\\$schema_index_statistics ORDER BY ROWs_selected DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # TOP 15 most used index subheaderprint "Performance schema: Top 15 most modified indexes"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select table_schema, table_name,index_name, rows_inserted+rows_updated+rows_deleted AS changes from sys.x\\$schema_index_statistics ORDER BY rows_inserted+rows_updated+rows_deleted DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # TOP 15 high read latency index subheaderprint "Performance schema: Top 15 high read latency index"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select table_schema, table_name,index_name, select_latency from sys.x\\$schema_index_statistics ORDER BY select_latency DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # TOP 15 high insert latency index subheaderprint "Performance schema: Top 15 most modified indexes"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select table_schema, table_name,index_name, insert_latency from sys.x\\$schema_index_statistics ORDER BY insert_latency DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # TOP 15 high update latency index subheaderprint "Performance schema: Top 15 high update latency index"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select table_schema, table_name,index_name, update_latency from sys.x\\$schema_index_statistics ORDER BY update_latency DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # TOP 15 high delete latency index subheaderprint "Performance schema: Top 15 high delete latency index"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select table_schema, table_name,index_name, delete_latency from sys.x\\$schema_index_statistics ORDER BY delete_latency DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # TOP 15 most read tables subheaderprint "Performance schema: Top 15 most read tables"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select table_schema, table_name, rows_fetched from sys.x\\$schema_table_statistics ORDER BY ROWs_fetched DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # TOP 15 most used tables subheaderprint "Performance schema: Top 15 most modified tables"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select table_schema, table_name, rows_inserted+rows_updated+rows_deleted AS changes from sys.x\\$schema_table_statistics ORDER BY rows_inserted+rows_updated+rows_deleted DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # TOP 15 high read latency tables subheaderprint "Performance schema: Top 15 high read latency tables"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select table_schema, table_name, fetch_latency from sys.x\\$schema_table_statistics ORDER BY fetch_latency DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # TOP 15 high insert latency tables subheaderprint "Performance schema: Top 15 high insert latency tables"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select table_schema, table_name, insert_latency from sys.x\\$schema_table_statistics ORDER BY insert_latency DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # TOP 15 high update latency tables subheaderprint "Performance schema: Top 15 high update latency tables"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select table_schema, table_name, update_latency from sys.x\\$schema_table_statistics ORDER BY update_latency DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # TOP 15 high delete latency tables subheaderprint "Performance schema: Top 15 high delete latency tables"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select table_schema, table_name, delete_latency from sys.x\\$schema_table_statistics ORDER BY delete_latency DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); # Redundant indexes subheaderprint "Performance schema: Redundant indexes"; $nbL = 1; for my $lQuery ( select_array('use sys;select * from schema_redundant_indexes;') ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Table not using InnoDB buffer"; $nbL = 1; for my $lQuery ( select_array( ' Select table_schema, table_name from sys.x\\$schema_table_statistics_with_buffer where innodb_buffer_allocated IS NULL;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 15 Tables using InnoDB buffer"; $nbL = 1; for my $lQuery ( select_array( 'select table_schema,table_name,innodb_buffer_allocated from sys.x\\$schema_table_statistics_with_buffer where innodb_buffer_allocated IS NOT NULL ORDER BY innodb_buffer_allocated DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 15 Tables with InnoDB buffer free"; $nbL = 1; for my $lQuery ( select_array( 'select table_schema,table_name,innodb_buffer_free from sys.x\\$schema_table_statistics_with_buffer where innodb_buffer_allocated IS NOT NULL ORDER BY innodb_buffer_free DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 15 Most executed queries"; $nbL = 1; for my $lQuery ( select_array( 'select db, LEFT(query, 120), exec_count from sys.x\\$statement_analysis order by exec_count DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Latest SQL queries in errors or warnings"; $nbL = 1; for my $lQuery ( select_array( 'select LEFT(query, 120), last_seen from sys.x\\$statements_with_errors_or_warnings ORDER BY last_seen LIMIT 40;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 20 queries with full table scans"; $nbL = 1; for my $lQuery ( select_array( 'select db, LEFT(query, 120), exec_count from sys.x\\$statements_with_full_table_scans order BY exec_count DESC LIMIT 20;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Last 50 queries with full table scans"; $nbL = 1; for my $lQuery ( select_array( 'select db, LEFT(query, 120), last_seen from sys.x\\$statements_with_full_table_scans order BY last_seen DESC LIMIT 50;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 15 reader queries (95% percentile)"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select db, LEFT(query, 120), rows_sent from sys.x\\$statements_with_runtimes_in_95th_percentile ORDER BY ROWs_sent DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 15 most row look queries (95% percentile)"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select db, LEFT(query, 120), rows_examined AS search from sys.x\\$statements_with_runtimes_in_95th_percentile ORDER BY rows_examined DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 15 total latency queries (95% percentile)"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select db, LEFT(query, 120), total_latency AS search from sys.x\\$statements_with_runtimes_in_95th_percentile ORDER BY total_latency DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 15 max latency queries (95% percentile)"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select db, LEFT(query, 120), max_latency AS search from sys.x\\$statements_with_runtimes_in_95th_percentile ORDER BY max_latency DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 15 average latency queries (95% percentile)"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select db, LEFT(query, 120), avg_latency AS search from sys.x\\$statements_with_runtimes_in_95th_percentile ORDER BY avg_latency DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 20 queries with sort"; $nbL = 1; for my $lQuery ( select_array( 'select db, LEFT(query, 120), exec_count from sys.x\\$statements_with_sorting order BY exec_count DESC LIMIT 20;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Last 50 queries with sort"; $nbL = 1; for my $lQuery ( select_array( 'select db, LEFT(query, 120), last_seen from sys.x\\$statements_with_sorting order BY last_seen DESC LIMIT 50;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 15 row sorting queries with sort"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select db, LEFT(query, 120), rows_sorted from sys.x\\$statements_with_sorting ORDER BY ROWs_sorted DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 15 total latency queries with sort"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select db, LEFT(query, 120), total_latency AS search from sys.x\\$statements_with_sorting ORDER BY total_latency DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 15 merge queries with sort"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select db, LEFT(query, 120), sort_merge_passes AS search from sys.x\\$statements_with_sorting ORDER BY sort_merge_passes DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 15 average sort merges queries with sort"; $nbL = 1; for my $lQuery ( select_array( 'select db, LEFT(query, 120), avg_sort_merges AS search from sys.x\\$statements_with_sorting ORDER BY avg_sort_merges DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 15 scans queries with sort"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select db, LEFT(query, 120), sorts_using_scans AS search from sys.x\\$statements_with_sorting ORDER BY sorts_using_scans DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 15 range queries with sort"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select db, LEFT(query, 120), sort_using_range AS search from sys.x\\$statements_with_sorting ORDER BY sort_using_range DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); ################################################################################## #statements_with_temp_tables #mysql> desc statements_with_temp_tables; #+--------------------------+---------------------+------+-----+---------------------+-------+ #| Field | Type | Null | Key | Default | Extra | #+--------------------------+---------------------+------+-----+---------------------+-------+ #| query | longtext | YES | | NULL | | #| db | varchar(64) | YES | | NULL | | #| exec_count | bigint(20) unsigned | NO | | NULL | | #| total_latency | text | YES | | NULL | | #| memory_tmp_tables | bigint(20) unsigned | NO | | NULL | | #| disk_tmp_tables | bigint(20) unsigned | NO | | NULL | | #| avg_tmp_tables_per_query | decimal(21,0) | NO | | 0 | | #| tmp_tables_to_disk_pct | decimal(24,0) | NO | | 0 | | #| first_seen | timestamp | NO | | 0000-00-00 00:00:00 | | #| last_seen | timestamp | NO | | 0000-00-00 00:00:00 | | #| digest | varchar(32) | YES | | NULL | | #+--------------------------+---------------------+------+-----+---------------------+-------+ #11 rows in set (0,01 sec)# # subheaderprint "Performance schema: Top 20 queries with temp table"; $nbL = 1; for my $lQuery ( select_array( 'select db, LEFT(query, 120), exec_count from sys.x\\$statements_with_temp_tables order BY exec_count DESC LIMIT 20;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Last 50 queries with temp table"; $nbL = 1; for my $lQuery ( select_array( 'select db, LEFT(query, 120), last_seen from sys.x\\$statements_with_temp_tables order BY last_seen DESC LIMIT 50;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 15 total latency queries with temp table"; $nbL = 1; for my $lQuery ( select_array( 'select db, LEFT(query, 120), total_latency AS search from sys.x\\$statements_with_temp_tables ORDER BY total_latency DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 15 queries with temp table to disk"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select db, LEFT(query, 120), disk_tmp_tables from sys.x\\$statements_with_temp_tables ORDER BY disk_tmp_tables DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); ################################################################################## #wait_classes_global_by_latency #mysql> select * from wait_classes_global_by_latency; #-----------------+-------+---------------+-------------+-------------+-------------+ # event_class | total | total_latency | min_latency | avg_latency | max_latency | #-----------------+-------+---------------+-------------+-------------+-------------+ # wait/io/file | 15381 | 1.23 s | 0 ps | 80.12 us | 230.64 ms | # wait/io/table | 59 | 7.57 ms | 5.45 us | 128.24 us | 3.95 ms | # wait/lock/table | 69 | 3.22 ms | 658.84 ns | 46.64 us | 1.10 ms | #-----------------+-------+---------------+-------------+-------------+-------------+ # rows in set (0,00 sec) subheaderprint "Performance schema: Top 15 class events by number"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select event_class, total from sys.x\\$wait_classes_global_by_latency ORDER BY total DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 30 events by number"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select events, total from sys.x\\$waits_global_by_latency ORDER BY total DESC LIMIT 30;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 15 class events by total latency"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select event_class, total_latency from sys.x\\$wait_classes_global_by_latency ORDER BY total_latency DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 30 events by total latency"; $nbL = 1; for my $lQuery ( select_array( 'use sys;select events, total_latency from sys.x\\$waits_global_by_latency ORDER BY total_latency DESC LIMIT 30;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 15 class events by max latency"; $nbL = 1; for my $lQuery ( select_array( 'select event_class, max_latency from sys.x\\$wait_classes_global_by_latency ORDER BY max_latency DESC LIMIT 15;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); subheaderprint "Performance schema: Top 30 events by max latency"; $nbL = 1; for my $lQuery ( select_array( 'select events, max_latency from sys.x\\$waits_global_by_latency ORDER BY max_latency DESC LIMIT 30;' ) ) { infoprint " +-- $nbL: $lQuery"; $nbL++; } infoprint "No information found or indicators deactivated." if ( $nbL == 1 ); } # Recommendations for Aria Engine sub mariadb_aria { subheaderprint "Aria Metrics"; # Aria if ( !defined $myvar{'have_aria'} ) { infoprint "Aria Storage Engine not available."; return; } if ( $myvar{'have_aria'} ne "YES" ) { infoprint "Aria Storage Engine is disabled."; return; } infoprint "Aria Storage Engine is enabled."; # Aria pagecache if ( !defined( $mycalc{'total_aria_indexes'} ) ) { push( @generalrec, "Unable to calculate Aria index size on MySQL server" ); } else { if ( $myvar{'aria_pagecache_buffer_size'} < $mycalc{'total_aria_indexes'} && $mycalc{'pct_aria_keys_from_mem'} < 95 ) { badprint "Aria pagecache size / total Aria indexes: " . hr_bytes( $myvar{'aria_pagecache_buffer_size'} ) . "/" . hr_bytes( $mycalc{'total_aria_indexes'} ) . ""; push( @adjvars, "aria_pagecache_buffer_size (> " . hr_bytes( $mycalc{'total_aria_indexes'} ) . ")" ); } else { goodprint "Aria pagecache size / total Aria indexes: " . hr_bytes( $myvar{'aria_pagecache_buffer_size'} ) . "/" . hr_bytes( $mycalc{'total_aria_indexes'} ) . ""; } if ( $mystat{'Aria_pagecache_read_requests'} > 0 ) { if ( $mycalc{'pct_aria_keys_from_mem'} < 95 ) { badprint "Aria pagecache hit rate: $mycalc{'pct_aria_keys_from_mem'}% (" . hr_num( $mystat{'Aria_pagecache_read_requests'} ) . " cached / " . hr_num( $mystat{'Aria_pagecache_reads'} ) . " reads)"; } else { goodprint "Aria pagecache hit rate: $mycalc{'pct_aria_keys_from_mem'}% (" . hr_num( $mystat{'Aria_pagecache_read_requests'} ) . " cached / " . hr_num( $mystat{'Aria_pagecache_reads'} ) . " reads)"; } } else { # No queries have run that would use keys } } } # Recommendations for TokuDB sub mariadb_tokudb { subheaderprint "TokuDB Metrics"; # AriaDB unless ( defined $myvar{'have_tokudb'} && $myvar{'have_tokudb'} eq "YES" ) { infoprint "TokuDB is disabled."; return; } infoprint "TokuDB is enabled."; # Not implemented } # Recommendations for XtraDB sub mariadb_xtradb { subheaderprint "XtraDB Metrics"; # XtraDB unless ( defined $myvar{'have_xtradb'} && $myvar{'have_xtradb'} eq "YES" ) { infoprint "XtraDB is disabled."; return; } infoprint "XtraDB is enabled."; infoprint "Note that MariaDB 10.2 makes use of InnoDB, not XtraDB." # Not implemented } # Recommendations for RocksDB sub mariadb_rockdb { subheaderprint "RocksDB Metrics"; # RocksDB unless ( defined $myvar{'have_rocksdb'} && $myvar{'have_rocksdb'} eq "YES" ) { infoprint "RocksDB is disabled."; return; } infoprint "RocksDB is enabled."; # Not implemented } # Recommendations for Spider sub mariadb_spider { subheaderprint "Spider Metrics"; # Spider unless ( defined $myvar{'have_spider'} && $myvar{'have_spider'} eq "YES" ) { infoprint "Spider is disabled."; return; } infoprint "Spider is enabled."; # Not implemented } # Recommendations for Connect sub mariadb_connect { subheaderprint "Connect Metrics"; # Connect unless ( defined $myvar{'have_connect'} && $myvar{'have_connect'} eq "YES" ) { infoprint "Connect is disabled."; return; } infoprint "Connect is enabled."; # Not implemented } # Perl trim function to remove whitespace from the start and end of the string sub trim { my $string = shift; return "" unless defined($string); $string =~ s/^\s+//; $string =~ s/\s+$//; return $string; } sub get_wsrep_options { return () unless defined $myvar{'wsrep_provider_options'}; my @galera_options = split /;/, $myvar{'wsrep_provider_options'}; my $wsrep_slave_threads = $myvar{'wsrep_slave_threads'}; push @galera_options, ' wsrep_slave_threads = ' . $wsrep_slave_threads; @galera_options = remove_cr @galera_options; @galera_options = remove_empty @galera_options; #debugprint Dumper( \@galera_options ) if $opt{debug}; return @galera_options; } sub get_gcache_memory { my $gCacheMem = hr_raw( get_wsrep_option('gcache.size') ); return 0 unless defined $gCacheMem and $gCacheMem ne ''; return $gCacheMem; } sub get_wsrep_option { my $key = shift; return '' unless defined $myvar{'wsrep_provider_options'}; my @galera_options = get_wsrep_options; return '' unless scalar(@galera_options) > 0; my @memValues = grep /\s*$key =/, @galera_options; my $memValue = $memValues[0]; return 0 unless defined $memValue; $memValue =~ s/.*=\s*(.+)$/$1/g; return $memValue; } # REcommendations for Tables sub mysql_table_structures { return 0 unless ( $opt{structstat} > 0 ); subheaderprint "Table structures analysis"; my @primaryKeysNbTables = select_array( "Select CONCAT(c.table_schema, ',' , c.table_name) from information_schema.columns c join information_schema.tables t using (TABLE_SCHEMA, TABLE_NAME) where c.table_schema not in ('sys', 'mysql', 'information_schema', 'performance_schema') and t.table_type = 'BASE TABLE' group by c.table_schema,c.table_name having sum(if(c.column_key in ('PRI', 'UNI'), 1, 0)) = 0" ); my $tmpContent = 'Schema,Table'; if ( scalar(@primaryKeysNbTables) > 0 ) { badprint "Following table(s) don't have primary key:"; foreach my $badtable (@primaryKeysNbTables) { badprint "\t$badtable"; push @{ $result{'Tables without PK'} }, $badtable; $tmpContent .= "\n$badtable"; } push @generalrec, "Ensure that all table(s) get an explicit primary keys for performance, maintenance and also for replication"; } else { goodprint "All tables get a primary key"; } dump_into_file( "tables_without_primary_keys.csv", $tmpContent ); my @nonInnoDBTables = select_array( "select CONCAT(table_schema, ',', table_name, ',', ENGINE) FROM information_schema.tables t WHERE ENGINE <> 'InnoDB' and t.table_type = 'BASE TABLE' and table_schema not in ('sys', 'mysql', 'performance_schema', 'information_schema')" ); $tmpContent = 'Schema,Table,Engine'; if ( scalar(@nonInnoDBTables) > 0 ) { badprint "Following table(s) are not InnoDB table:"; push @generalrec, "Ensure that all table(s) are InnoDB tables for performance and also for replication"; foreach my $badtable (@nonInnoDBTables) { if ( $badtable =~ /Memory/i ) { badprint "Table $badtable is a MEMORY table. It's suggested to use only InnoDB tables in production"; } else { badprint "\t$badtable"; } $tmpContent .= "\n$badtable"; } } else { goodprint "All tables are InnoDB tables"; } dump_into_file( "tables_non_innodb.csv", $tmpContent ); my @nonutf8columns = select_array( "SELECT CONCAT(table_schema, ',', table_name, ',', column_name, ',', CHARacter_set_name, ',', COLLATION_name, ',', data_type, ',', CHARACTER_MAXIMUM_LENGTH) from information_schema.columns WHERE table_schema not in ('sys', 'mysql', 'performance_schema', 'information_schema') and (CHARacter_set_name NOT LIKE 'utf8%' or COLLATION_name NOT LIKE 'utf8%');" ); $tmpContent = 'Schema,Table,Column, Charset, Collation, Data Type, Max Length'; if ( scalar(@nonutf8columns) > 0 ) { badprint "Following character columns(s) are not utf8 compliant:"; push @generalrec, "Ensure that all text colums(s) are UTF-8 compliant for encoding support and performance"; foreach my $badtable (@nonutf8columns) { badprint "\t$badtable"; $tmpContent .= "\n$badtable"; } } else { goodprint "All columns are UTF-8 compliant"; } dump_into_file( "columns_non_utf8.csv", $tmpContent ); my @utf8columns = select_array( "SELECT CONCAT(table_schema, ',', table_name, ',', column_name, ',', CHARacter_set_name, ',', COLLATION_name, ',', data_type, ',', CHARACTER_MAXIMUM_LENGTH) from information_schema.columns WHERE table_schema not in ('sys', 'mysql', 'performance_schema', 'information_schema') and (CHARacter_set_name LIKE 'utf8%' or COLLATION_name LIKE 'utf8%');" ); $tmpContent = 'Schema,Table,Column, Charset, Collation, Data Type, Max Length'; foreach my $badtable (@utf8columns) { $tmpContent .= "\n$badtable"; } dump_into_file( "columns_utf8.csv", $tmpContent ); my @ftcolumns = select_array( "SELECT CONCAT(table_schema, ',', table_name, ',', column_name, ',', data_type) from information_schema.columns WHERE table_schema not in ('sys', 'mysql', 'performance_schema', 'information_schema') AND data_type='FULLTEXT';" ); $tmpContent = 'Schema,Table,Column, Data Type'; foreach my $ctable (@ftcolumns) { $tmpContent .= "\n$ctable"; } dump_into_file( "fulltext_columns.csv", $tmpContent ); } # Recommendations for Galera sub mariadb_galera { subheaderprint "Galera Metrics"; # Galera Cluster unless ( defined $myvar{'have_galera'} && $myvar{'have_galera'} eq "YES" ) { infoprint "Galera is disabled."; return; } infoprint "Galera is enabled."; debugprint "Galera variables:"; foreach my $gvar ( keys %myvar ) { next unless $gvar =~ /^wsrep.*/; next if $gvar eq 'wsrep_provider_options'; debugprint "\t" . trim($gvar) . " = " . $myvar{$gvar}; $result{'Galera'}{'variables'}{$gvar} = $myvar{$gvar}; } if ( not defined( $myvar{'wsrep_on'} ) or $myvar{'wsrep_on'} ne "ON" ) { infoprint "Galera is disabled."; return; } debugprint "Galera wsrep provider Options:"; my @galera_options = get_wsrep_options; $result{'Galera'}{'wsrep options'} = get_wsrep_options(); foreach my $gparam (@galera_options) { debugprint "\t" . trim($gparam); } debugprint "Galera status:"; foreach my $gstatus ( keys %mystat ) { next unless $gstatus =~ /^wsrep.*/; debugprint "\t" . trim($gstatus) . " = " . $mystat{$gstatus}; $result{'Galera'}{'status'}{$gstatus} = $myvar{$gstatus}; } infoprint "GCache is using " . hr_bytes_rnd( get_wsrep_option('gcache.mem_size') ); infoprint "CPU cores detected : " . (cpu_cores); infoprint "wsrep_slave_threads: " . get_wsrep_option('wsrep_slave_threads'); if ( get_wsrep_option('wsrep_slave_threads') > ( (cpu_cores) * 4 ) or get_wsrep_option('wsrep_slave_threads') < ( (cpu_cores) * 2 ) ) { badprint "wsrep_slave_threads is not equal to 2, 3 or 4 times the number of CPU(s)"; push @adjvars, "wsrep_slave_threads = " . ( (cpu_cores) * 4 ); } else { goodprint "wsrep_slave_threads is equal to 2, 3 or 4 times the number of CPU(s)"; } if ( get_wsrep_option('wsrep_slave_threads') > 1 ) { infoprint "wsrep parallel slave can cause frequent inconsistency crash."; push @adjvars, "Set wsrep_slave_threads to 1 in case of HA_ERR_FOUND_DUPP_KEY crash on slave"; # check options for parallel slave if ( get_wsrep_option('wsrep_slave_FK_checks') eq "OFF" ) { badprint "wsrep_slave_FK_checks is off with parallel slave"; push @adjvars, "wsrep_slave_FK_checks should be ON when using parallel slave"; } # wsrep_slave_UK_checks seems useless in MySQL source code if ( $myvar{'innodb_autoinc_lock_mode'} != 2 ) { badprint "innodb_autoinc_lock_mode is incorrect with parallel slave"; push @adjvars, "innodb_autoinc_lock_mode should be 2 when using parallel slave"; } } if ( get_wsrep_option('gcs.fc_limit') != $myvar{'wsrep_slave_threads'} * 5 ) { badprint "gcs.fc_limit should be equal to 5 * wsrep_slave_threads (=" . ( $myvar{'wsrep_slave_threads'} * 5 ) . ")"; push @adjvars, "gcs.fc_limit= wsrep_slave_threads * 5 (=" . ( $myvar{'wsrep_slave_threads'} * 5 ) . ")"; } else { goodprint "gcs.fc_limit is equal to 5 * wsrep_slave_threads ( =" . get_wsrep_option('gcs.fc_limit') . ")"; } if ( get_wsrep_option('gcs.fc_factor') != 0.8 ) { badprint "gcs.fc_factor should be equal to 0.8 (=" . get_wsrep_option('gcs.fc_factor') . ")"; push @adjvars, "gcs.fc_factor=0.8"; } else { goodprint "gcs.fc_factor is equal to 0.8"; } if ( get_wsrep_option('wsrep_flow_control_paused') > 0.02 ) { badprint "Fraction of time node pause flow control > 0.02"; } else { goodprint "Flow control fraction seems to be OK (wsrep_flow_control_paused <= 0.02)"; } if ( $myvar{'binlog_format'} ne 'ROW' ) { badprint "Binlog format should be in ROW mode."; push @adjvars, "binlog_format = ROW"; } else { goodprint "Binlog format is in ROW mode."; } if ( $myvar{'innodb_flush_log_at_trx_commit'} != 0 ) { badprint "InnoDB flush log at each commit should be disabled."; push @adjvars, "innodb_flush_log_at_trx_commit = 0"; } else { goodprint "InnoDB flush log at each commit is disabled for Galera."; } infoprint "Read consistency mode :" . $myvar{'wsrep_causal_reads'}; if ( defined( $myvar{'wsrep_cluster_name'} ) and $myvar{'wsrep_on'} eq "ON" ) { goodprint "Galera WsREP is enabled."; if ( defined( $myvar{'wsrep_cluster_address'} ) and trim("$myvar{'wsrep_cluster_address'}") ne "" ) { goodprint "Galera Cluster address is defined: " . $myvar{'wsrep_cluster_address'}; my @NodesTmp = split /,/, $myvar{'wsrep_cluster_address'}; my $nbNodes = @NodesTmp; infoprint "There are $nbNodes nodes in wsrep_cluster_address"; my $nbNodesSize = trim( $mystat{'wsrep_cluster_size'} ); if ( $nbNodesSize == 3 or $nbNodesSize == 5 ) { goodprint "There are $nbNodesSize nodes in wsrep_cluster_size."; } else { badprint "There are $nbNodesSize nodes in wsrep_cluster_size. Prefer 3 or 5 nodes architecture."; push @generalrec, "Prefer 3 or 5 nodes architecture."; } # wsrep_cluster_address doesn't include garbd nodes if ( $nbNodes > $nbNodesSize ) { badprint "All cluster nodes are not detected. wsrep_cluster_size less than node count in wsrep_cluster_address"; } else { goodprint "All cluster nodes detected."; } } else { badprint "Galera Cluster address is undefined"; push @adjvars, "set up wsrep_cluster_address variable for Galera replication"; } if ( defined( $myvar{'wsrep_cluster_name'} ) and trim( $myvar{'wsrep_cluster_name'} ) ne "" ) { goodprint "Galera Cluster name is defined: " . $myvar{'wsrep_cluster_name'}; } else { badprint "Galera Cluster name is undefined"; push @adjvars, "set up wsrep_cluster_name variable for Galera replication"; } if ( defined( $myvar{'wsrep_node_name'} ) and trim( $myvar{'wsrep_node_name'} ) ne "" ) { goodprint "Galera Node name is defined: " . $myvar{'wsrep_node_name'}; } else { badprint "Galera node name is undefined"; push @adjvars, "set up wsrep_node_name variable for Galera replication"; } if ( trim( $myvar{'wsrep_notify_cmd'} ) ne "" ) { goodprint "Galera Notify command is defined."; } else { badprint "Galera Notify command is not defined."; push( @adjvars, "set up parameter wsrep_notify_cmd to be notified" ); } if ( trim( $myvar{'wsrep_sst_method'} ) !~ "^xtrabackup.*" and trim( $myvar{'wsrep_sst_method'} ) !~ "^mariabackup" ) { badprint "Galera SST method is not xtrabackup based."; push( @adjvars, "set up parameter wsrep_sst_method to xtrabackup based parameter" ); } else { goodprint "SST Method is based on xtrabackup."; } if ( ( defined( $myvar{'wsrep_OSU_method'} ) && trim( $myvar{'wsrep_OSU_method'} ) eq "TOI" ) || ( defined( $myvar{'wsrep_osu_method'} ) && trim( $myvar{'wsrep_osu_method'} ) eq "TOI" ) ) { goodprint "TOI is default mode for upgrade."; } else { badprint "Schema upgrade are not replicated automatically"; push( @adjvars, "set up parameter wsrep_OSU_method to TOI" ); } infoprint "Max WsRep message : " . hr_bytes( $myvar{'wsrep_max_ws_size'} ); } else { badprint "Galera WsREP is disabled"; } if ( defined( $mystat{'wsrep_connected'} ) and $mystat{'wsrep_connected'} eq "ON" ) { goodprint "Node is connected"; } else { badprint "Node is disconnected"; } if ( defined( $mystat{'wsrep_ready'} ) and $mystat{'wsrep_ready'} eq "ON" ) { goodprint "Node is ready"; } else { badprint "Node is not ready"; } infoprint "Cluster status :" . $mystat{'wsrep_cluster_status'}; if ( defined( $mystat{'wsrep_cluster_status'} ) and $mystat{'wsrep_cluster_status'} eq "Primary" ) { goodprint "Galera cluster is consistent and ready for operations"; } else { badprint "Cluster is not consistent and ready"; } if ( $mystat{'wsrep_local_state_uuid'} eq $mystat{'wsrep_cluster_state_uuid'} ) { goodprint "Node and whole cluster at the same level: " . $mystat{'wsrep_cluster_state_uuid'}; } else { badprint "Node and whole cluster not the same level"; infoprint "Node state uuid: " . $mystat{'wsrep_local_state_uuid'}; infoprint "Cluster state uuid: " . $mystat{'wsrep_cluster_state_uuid'}; } if ( $mystat{'wsrep_local_state_comment'} eq 'Synced' ) { goodprint "Node is synced with whole cluster."; } else { badprint "Node is not synced"; infoprint "Node State : " . $mystat{'wsrep_local_state_comment'}; } if ( $mystat{'wsrep_local_cert_failures'} == 0 ) { goodprint "There is no certification failures detected."; } else { badprint "There is " . $mystat{'wsrep_local_cert_failures'} . " certification failure(s)detected."; } for my $key ( keys %mystat ) { if ( $key =~ /wsrep_|galera/i ) { debugprint "WSREP: $key = $mystat{$key}"; } } #debugprint Dumper get_wsrep_options() if $opt{debug}; } # Recommendations for InnoDB sub mysql_innodb { subheaderprint "InnoDB Metrics"; # InnoDB unless ( defined $myvar{'have_innodb'} && $myvar{'have_innodb'} eq "YES" ) { infoprint "InnoDB is disabled."; if ( mysql_version_ge( 5, 5 ) ) { my $defengine = 'InnoDB'; $defengine = $myvar{'default_storage_engine'} if defined( $myvar{'default_storage_engine'} ); badprint "InnoDB Storage engine is disabled. $defengine is the default storage engine" if $defengine eq 'InnoDB'; infoprint "InnoDB Storage engine is disabled. $defengine is the default storage engine" if $defengine ne 'InnoDB'; } return; } infoprint "InnoDB is enabled."; if ( !defined $enginestats{'InnoDB'} ) { if ( $opt{skipsize} eq 1 ) { infoprint "Skipped due to --skipsize option"; return; } badprint "No tables are Innodb"; $enginestats{'InnoDB'} = 0; } if ( $opt{buffers} ne 0 ) { infoprint "InnoDB Buffers"; if ( defined $myvar{'innodb_buffer_pool_size'} ) { infoprint " +-- InnoDB Buffer Pool: " . hr_bytes( $myvar{'innodb_buffer_pool_size'} ) . ""; } if ( defined $myvar{'innodb_buffer_pool_instances'} ) { infoprint " +-- InnoDB Buffer Pool Instances: " . $myvar{'innodb_buffer_pool_instances'} . ""; } if ( defined $myvar{'innodb_buffer_pool_chunk_size'} ) { infoprint " +-- InnoDB Buffer Pool Chunk Size: " . hr_bytes( $myvar{'innodb_buffer_pool_chunk_size'} ) . ""; } if ( defined $myvar{'innodb_additional_mem_pool_size'} ) { infoprint " +-- InnoDB Additional Mem Pool: " . hr_bytes( $myvar{'innodb_additional_mem_pool_size'} ) . ""; } if ( defined $myvar{'innodb_redo_log_capacity'} ) { infoprint " +-- InnoDB Redo Log Capacity: " . hr_bytes( $myvar{'innodb_redo_log_capacity'} ); } else { if ( defined $myvar{'innodb_log_file_size'} ) { infoprint " +-- InnoDB Log File Size: " . hr_bytes( $myvar{'innodb_log_file_size'} ); } if ( defined $myvar{'innodb_log_files_in_group'} ) { infoprint " +-- InnoDB Log File In Group: " . $myvar{'innodb_log_files_in_group'}; infoprint " +-- InnoDB Total Log File Size: " . hr_bytes( $myvar{'innodb_log_files_in_group'} * $myvar{'innodb_log_file_size'} ) . "(" . $mycalc{'innodb_log_size_pct'} . " % of buffer pool)"; } else { infoprint " +-- InnoDB Total Log File Size: " . hr_bytes( $myvar{'innodb_log_file_size'} ) . "(" . $mycalc{'innodb_log_size_pct'} . " % of buffer pool)"; } } if ( defined $myvar{'innodb_log_buffer_size'} ) { infoprint " +-- InnoDB Log Buffer: " . hr_bytes( $myvar{'innodb_log_buffer_size'} ); } if ( defined $mystat{'Innodb_buffer_pool_pages_free'} ) { infoprint " +-- InnoDB Buffer Free: " . hr_bytes( $mystat{'Innodb_buffer_pool_pages_free'} ) . ""; } if ( defined $mystat{'Innodb_buffer_pool_pages_total'} ) { infoprint " +-- InnoDB Buffer Used: " . hr_bytes( $mystat{'Innodb_buffer_pool_pages_total'} ) . ""; } } if ( defined $myvar{'innodb_thread_concurrency'} ) { infoprint "InnoDB Thread Concurrency: " . $myvar{'innodb_thread_concurrency'}; } # InnoDB Buffer Pool Size if ( $myvar{'innodb_file_per_table'} eq "ON" ) { goodprint "InnoDB File per table is activated"; } else { badprint "InnoDB File per table is not activated"; push( @adjvars, "innodb_file_per_table=ON" ); } # InnoDB Buffer Pool Size if ( $arch == 32 && $myvar{'innodb_buffer_pool_size'} > 4294967295 ) { badprint "InnoDB Buffer Pool size limit reached for 32 bits architecture: (" . hr_bytes(4294967295) . " )"; push( @adjvars, "limit innodb_buffer_pool_size under " . hr_bytes(4294967295) . " for 32 bits architecture" ); } if ( $arch == 32 && $myvar{'innodb_buffer_pool_size'} < 4294967295 ) { goodprint "InnoDB Buffer Pool size ( " . hr_bytes( $myvar{'innodb_buffer_pool_size'} ) . " ) under limit for 32 bits architecture: (" . hr_bytes(4294967295) . ")"; } if ( $arch == 64 && $myvar{'innodb_buffer_pool_size'} > 18446744073709551615 ) { badprint "InnoDB Buffer Pool size limit(" . hr_bytes(18446744073709551615) . ") reached for 64 bits architecture"; push( @adjvars, "limit innodb_buffer_pool_size under " . hr_bytes(18446744073709551615) . " for 64 bits architecture" ); } if ( $arch == 64 && $myvar{'innodb_buffer_pool_size'} < 18446744073709551615 ) { goodprint "InnoDB Buffer Pool size ( " . hr_bytes( $myvar{'innodb_buffer_pool_size'} ) . " ) under limit for 64 bits architecture: (" . hr_bytes(18446744073709551615) . " )"; } if ( $myvar{'innodb_buffer_pool_size'} > $enginestats{'InnoDB'} ) { goodprint "InnoDB buffer pool / data size: " . hr_bytes( $myvar{'innodb_buffer_pool_size'} ) . " / " . hr_bytes( $enginestats{'InnoDB'} ) . ""; } else { badprint "InnoDB buffer pool / data size: " . hr_bytes( $myvar{'innodb_buffer_pool_size'} ) . " / " . hr_bytes( $enginestats{'InnoDB'} ) . ""; push( @adjvars, "innodb_buffer_pool_size (>= " . hr_bytes( $enginestats{'InnoDB'} ) . ") if possible." ); } # select round( 100* sum(allocated)/( select VARIABLE_VALUE # FROM information_schema.global_variables # where VARIABLE_NAME='innodb_buffer_pool_size' ) # ,2) as "PCT ALLOC/BUFFER POOL" #from sys.x$innodb_buffer_stats_by_table; if ( $opt{experimental} ) { debugprint( 'innodb_buffer_alloc_pct: "' . $mycalc{innodb_buffer_alloc_pct} . '"' ); if ( defined $mycalc{innodb_buffer_alloc_pct} and $mycalc{innodb_buffer_alloc_pct} ne '' ) { if ( $mycalc{innodb_buffer_alloc_pct} < 80 ) { badprint "Ratio Buffer Pool allocated / Buffer Pool Size: " . $mycalc{'innodb_buffer_alloc_pct'} . '%'; } else { goodprint "Ratio Buffer Pool allocated / Buffer Pool Size: " . $mycalc{'innodb_buffer_alloc_pct'} . '%'; } } } if ( $mycalc{'innodb_log_size_pct'} < 20 or $mycalc{'innodb_log_size_pct'} > 30 ) { if ( defined $myvar{'innodb_redo_log_capacity'} ) { badprint "Ratio InnoDB redo log capacity / InnoDB Buffer pool size (" . $mycalc{'innodb_log_size_pct'} . "%): " . hr_bytes( $myvar{'innodb_redo_log_capacity'} ) . " / " . hr_bytes( $myvar{'innodb_buffer_pool_size'} ) . " should be equal to 25%"; push( @adjvars, "innodb_redo_log_capacity should be (=" . hr_bytes_rnd( $myvar{'innodb_buffer_pool_size'} / 4 ) . ") if possible, so InnoDB Redo log Capacity equals 25% of buffer pool size." ); push( @generalrec, "Be careful, increasing innodb_redo_log_capacity means higher crash recovery mean time" ); } else { badprint "Ratio InnoDB log file size / InnoDB Buffer pool size (" . $mycalc{'innodb_log_size_pct'} . "%): " . hr_bytes( $myvar{'innodb_log_file_size'} ) . " * " . $myvar{'innodb_log_files_in_group'} . " / " . hr_bytes( $myvar{'innodb_buffer_pool_size'} ) . " should be equal to 25%"; push( @adjvars, "innodb_log_file_size should be (=" . hr_bytes_rnd( $myvar{'innodb_buffer_pool_size'} / $myvar{'innodb_log_files_in_group'} / 4 ) . ") if possible, so InnoDB total log file size equals 25% of buffer pool size." ); push( @generalrec, "Be careful, increasing innodb_log_file_size / innodb_log_files_in_group means higher crash recovery mean time" ); } if ( mysql_version_le( 5, 6, 2 ) ) { push( @generalrec, "For MySQL 5.6.2 and lower, total innodb_log_file_size should have a ceiling of (4096MB / log files in group) - 1MB." ); } } else { if ( defined $myvar{'innodb_redo_log_capacity'} ) { goodprint "Ratio InnoDB Redo Log Capacity / InnoDB Buffer pool size: " . hr_bytes( $myvar{'innodb_redo_log_capacity'} ) . "/" . hr_bytes( $myvar{'innodb_buffer_pool_size'} ) . " should be equal to 25%"; } else { push( @generalrec, "Before changing innodb_log_file_size and/or innodb_log_files_in_group read this: https://bit.ly/2TcGgtU" ); goodprint "Ratio InnoDB log file size / InnoDB Buffer pool size: " . hr_bytes( $myvar{'innodb_log_file_size'} ) . " * " . $myvar{'innodb_log_files_in_group'} . "/" . hr_bytes( $myvar{'innodb_buffer_pool_size'} ) . " should be equal to 25%"; } } # InnoDB Buffer Pool Instances (MySQL 5.6.6+) if ( not mysql_version_ge( 10, 4 ) and defined( $myvar{'innodb_buffer_pool_instances'} ) ) { # Bad Value if > 64 if ( $myvar{'innodb_buffer_pool_instances'} > 64 ) { badprint "InnoDB buffer pool instances: " . $myvar{'innodb_buffer_pool_instances'} . ""; push( @adjvars, "innodb_buffer_pool_instances (<= 64)" ); } # InnoDB Buffer Pool Size > 1Go if ( $myvar{'innodb_buffer_pool_size'} > 1024 * 1024 * 1024 ) { # InnoDB Buffer Pool Size / 1Go = InnoDB Buffer Pool Instances limited to 64 max. # InnoDB Buffer Pool Size > 64Go my $max_innodb_buffer_pool_instances = int( $myvar{'innodb_buffer_pool_size'} / ( 1024 * 1024 * 1024 ) ); $max_innodb_buffer_pool_instances = 64 if ( $max_innodb_buffer_pool_instances > 64 ); if ( $myvar{'innodb_buffer_pool_instances'} != $max_innodb_buffer_pool_instances ) { badprint "InnoDB buffer pool instances: " . $myvar{'innodb_buffer_pool_instances'} . ""; push( @adjvars, "innodb_buffer_pool_instances(=" . $max_innodb_buffer_pool_instances . ")" ); } else { goodprint "InnoDB buffer pool instances: " . $myvar{'innodb_buffer_pool_instances'} . ""; } # InnoDB Buffer Pool Size < 1Go } else { if ( $myvar{'innodb_buffer_pool_instances'} != 1 ) { badprint "InnoDB buffer pool <= 1G and Innodb_buffer_pool_instances(!=1)."; push( @adjvars, "innodb_buffer_pool_instances (=1)" ); } else { goodprint "InnoDB buffer pool instances: " . $myvar{'innodb_buffer_pool_instances'} . ""; } } } # InnoDB Used Buffer Pool Size vs CHUNK size if ( !defined( $myvar{'innodb_buffer_pool_chunk_size'} ) ) { infoprint "InnoDB Buffer Pool Chunk Size not used or defined in your version"; } else { infoprint "Number of InnoDB Buffer Pool Chunk: " . int( $myvar{'innodb_buffer_pool_size'} ) / int( $myvar{'innodb_buffer_pool_chunk_size'} ) . " for " . $myvar{'innodb_buffer_pool_instances'} . " Buffer Pool Instance(s)"; if ( int( $myvar{'innodb_buffer_pool_size'} ) % ( int( $myvar{'innodb_buffer_pool_chunk_size'} ) * int( $myvar{'innodb_buffer_pool_instances'} ) ) eq 0 ) { goodprint "Innodb_buffer_pool_size aligned with Innodb_buffer_pool_chunk_size & Innodb_buffer_pool_instances"; } else { badprint "Innodb_buffer_pool_size aligned with Innodb_buffer_pool_chunk_size & Innodb_buffer_pool_instances"; #push( @adjvars, "Adjust innodb_buffer_pool_instances, innodb_buffer_pool_chunk_size with innodb_buffer_pool_size" ); push( @adjvars, "innodb_buffer_pool_size must always be equal to or a multiple of innodb_buffer_pool_chunk_size * innodb_buffer_pool_instances" ); } } # InnoDB Read efficiency if ( defined $mycalc{'pct_read_efficiency'} && $mycalc{'pct_read_efficiency'} < 90 ) { badprint "InnoDB Read buffer efficiency: " . $mycalc{'pct_read_efficiency'} . "% (" . $mystat{'Innodb_buffer_pool_read_requests'} . " hits / " . ( $mystat{'Innodb_buffer_pool_reads'} + $mystat{'Innodb_buffer_pool_read_requests'} ) . " total)"; } else { goodprint "InnoDB Read buffer efficiency: " . $mycalc{'pct_read_efficiency'} . "% (" . $mystat{'Innodb_buffer_pool_read_requests'} . " hits / " . ( $mystat{'Innodb_buffer_pool_reads'} + $mystat{'Innodb_buffer_pool_read_requests'} ) . " total)"; } # InnoDB Write efficiency if ( defined $mycalc{'pct_write_efficiency'} && $mycalc{'pct_write_efficiency'} < 90 ) { badprint "InnoDB Write Log efficiency: " . abs( $mycalc{'pct_write_efficiency'} ) . "% (" . abs( $mystat{'Innodb_log_write_requests'} - $mystat{'Innodb_log_writes'} ) . " hits / " . $mystat{'Innodb_log_write_requests'} . " total)"; push( @adjvars, "innodb_log_buffer_size (> " . hr_bytes_rnd( $myvar{'innodb_log_buffer_size'} ) . ")" ); } else { goodprint "InnoDB Write Log efficiency: " . $mycalc{'pct_write_efficiency'} . "% (" . ( $mystat{'Innodb_log_write_requests'} - $mystat{'Innodb_log_writes'} ) . " hits / " . $mystat{'Innodb_log_write_requests'} . " total)"; } # InnoDB Log Waits $mystat{'Innodb_log_waits_computed'} = 0; if ( defined( $mystat{'Innodb_log_waits'} ) and defined( $mystat{'Innodb_log_writes'} ) and $mystat{'Innodb_log_writes'} > 0.000001 ) { $mystat{'Innodb_log_waits_computed'} = $mystat{'Innodb_log_waits'} / $mystat{'Innodb_log_writes'}; } else { undef $mystat{'Innodb_log_waits_computed'}; } if ( defined $mystat{'Innodb_log_waits_computed'} && $mystat{'Innodb_log_waits_computed'} > 0.000001 ) { badprint "InnoDB log waits: " . percentage( $mystat{'Innodb_log_waits'}, $mystat{'Innodb_log_writes'} ) . "% (" . $mystat{'Innodb_log_waits'} . " waits / " . $mystat{'Innodb_log_writes'} . " writes)"; push( @adjvars, "innodb_log_buffer_size (> " . hr_bytes_rnd( $myvar{'innodb_log_buffer_size'} ) . ")" ); } else { goodprint "InnoDB log waits: " . percentage( $mystat{'Innodb_log_waits'}, $mystat{'Innodb_log_writes'} ) . "% (" . $mystat{'Innodb_log_waits'} . " waits / " . $mystat{'Innodb_log_writes'} . " writes)"; } $result{'Calculations'} = {%mycalc}; } sub check_metadata_perf { subheaderprint "Analysis Performance Metrics"; if ( defined $myvar{'innodb_stats_on_metadata'} ) { infoprint "innodb_stats_on_metadata: " . $myvar{'innodb_stats_on_metadata'}; if ( $myvar{'innodb_stats_on_metadata'} eq 'ON' ) { badprint "Stat are updated during querying INFORMATION_SCHEMA."; push @adjvars, "SET innodb_stats_on_metadata = OFF"; #Disabling innodb_stats_on_metadata select_one("SET GLOBAL innodb_stats_on_metadata = OFF;"); return 1; } } goodprint "No stat updates during querying INFORMATION_SCHEMA."; return 0; } # Recommendations for Database metrics sub mysql_databases { return if ( $opt{dbstat} == 0 ); subheaderprint "Database Metrics"; unless ( mysql_version_ge( 5, 5 ) ) { infoprint "Database metrics from information schema are missing in this version. Skipping..."; return; } @dblist = select_array( "SELECT SCHEMA_NAME FROM information_schema.SCHEMATA WHERE SCHEMA_NAME NOT IN ( 'mysql', 'performance_schema', 'information_schema', 'sys' );" ); infoprint "There is " . scalar(@dblist) . " Database(s)."; my @totaldbinfo = split /\s/, select_one( "SELECT SUM(TABLE_ROWS), SUM(DATA_LENGTH), SUM(INDEX_LENGTH), SUM(DATA_LENGTH+INDEX_LENGTH), COUNT(TABLE_NAME), COUNT(DISTINCT(TABLE_COLLATION)), COUNT(DISTINCT(ENGINE)) FROM information_schema.TABLES WHERE TABLE_SCHEMA NOT IN ('mysql', 'performance_schema', 'information_schema', 'sys');" ); infoprint "All User Databases:"; infoprint " +-- TABLE : " . select_one( "SELECT count(*) from information_schema.TABLES WHERE TABLE_TYPE ='BASE TABLE' AND TABLE_SCHEMA NOT IN ('mysql', 'performance_schema', 'information_schema', 'sys')" ) . ""; infoprint " +-- VIEW : " . select_one( "SELECT count(*) from information_schema.TABLES WHERE TABLE_TYPE ='VIEW' AND TABLE_SCHEMA NOT IN ('mysql', 'performance_schema', 'information_schema', 'sys')" ) . ""; infoprint " +-- INDEX : " . select_one( "SELECT count(distinct(concat(TABLE_NAME, TABLE_SCHEMA, INDEX_NAME))) from information_schema.STATISTICS WHERE TABLE_SCHEMA NOT IN ('mysql', 'performance_schema', 'information_schema', 'sys')" ) . ""; infoprint " +-- CHARS : " . ( $totaldbinfo[5] eq 'NULL' ? 0 : $totaldbinfo[5] ) . " (" . ( join ", ", select_array( "select distinct(CHARACTER_SET_NAME) from information_schema.columns WHERE CHARACTER_SET_NAME IS NOT NULL AND TABLE_SCHEMA NOT IN ('mysql', 'performance_schema', 'information_schema', 'sys');" ) ) . ")"; infoprint " +-- COLLA : " . ( $totaldbinfo[5] eq 'NULL' ? 0 : $totaldbinfo[5] ) . " (" . ( join ", ", select_array( "SELECT DISTINCT(TABLE_COLLATION) FROM information_schema.TABLES WHERE TABLE_COLLATION IS NOT NULL AND TABLE_SCHEMA NOT IN ('mysql', 'performance_schema', 'information_schema', 'sys');" ) ) . ")"; infoprint " +-- ROWS : " . ( $totaldbinfo[0] eq 'NULL' ? 0 : $totaldbinfo[0] ) . ""; infoprint " +-- DATA : " . hr_bytes( $totaldbinfo[1] ) . "(" . percentage( $totaldbinfo[1], $totaldbinfo[3] ) . "%)"; infoprint " +-- INDEX : " . hr_bytes( $totaldbinfo[2] ) . "(" . percentage( $totaldbinfo[2], $totaldbinfo[3] ) . "%)"; infoprint " +-- SIZE : " . hr_bytes( $totaldbinfo[3] ) . ""; infoprint " +-- ENGINE: " . ( $totaldbinfo[6] eq 'NULL' ? 0 : $totaldbinfo[6] ) . " (" . ( join ", ", select_array( "SELECT DISTINCT(ENGINE) FROM information_schema.TABLES WHERE ENGINE IS NOT NULL AND TABLE_SCHEMA NOT IN ('mysql', 'performance_schema', 'information_schema', 'sys');" ) ) . ")"; $result{'Databases'}{'All databases'}{'Rows'} = ( $totaldbinfo[0] eq 'NULL' ? 0 : $totaldbinfo[0] ); $result{'Databases'}{'All databases'}{'Data Size'} = $totaldbinfo[1]; $result{'Databases'}{'All databases'}{'Data Pct'} = percentage( $totaldbinfo[1], $totaldbinfo[3] ) . "%"; $result{'Databases'}{'All databases'}{'Index Size'} = $totaldbinfo[2]; $result{'Databases'}{'All databases'}{'Index Pct'} = percentage( $totaldbinfo[2], $totaldbinfo[3] ) . "%"; $result{'Databases'}{'All databases'}{'Total Size'} = $totaldbinfo[3]; print "\n" unless ( $opt{'silent'} or $opt{'json'} ); my $nbViews = 0; my $nbTables = 0; foreach (@dblist) { my @dbinfo = split /\s/, select_one( "SELECT TABLE_SCHEMA, SUM(TABLE_ROWS), SUM(DATA_LENGTH), SUM(INDEX_LENGTH), SUM(DATA_LENGTH+INDEX_LENGTH), COUNT(DISTINCT ENGINE), COUNT(TABLE_NAME), COUNT(DISTINCT(TABLE_COLLATION)), COUNT(DISTINCT(ENGINE)) FROM information_schema.TABLES WHERE TABLE_SCHEMA='$_' GROUP BY TABLE_SCHEMA ORDER BY TABLE_SCHEMA" ); next unless defined $dbinfo[0]; infoprint "Database: " . $dbinfo[0] . ""; $nbTables = select_one( "SELECT count(*) from information_schema.TABLES WHERE TABLE_TYPE ='BASE TABLE' AND TABLE_SCHEMA='$_'" ); infoprint " +-- TABLE : $nbTables"; infoprint " +-- VIEW : " . select_one( "SELECT count(*) from information_schema.TABLES WHERE TABLE_TYPE ='VIEW' AND TABLE_SCHEMA='$_'" ) . ""; infoprint " +-- INDEX : " . select_one( "SELECT count(distinct(concat(TABLE_NAME, TABLE_SCHEMA, INDEX_NAME))) from information_schema.STATISTICS WHERE TABLE_SCHEMA='$_'" ) . ""; infoprint " +-- CHARS : " . ( $totaldbinfo[5] eq 'NULL' ? 0 : $totaldbinfo[5] ) . " (" . ( join ", ", select_array( "select distinct(CHARACTER_SET_NAME) from information_schema.columns WHERE CHARACTER_SET_NAME IS NOT NULL AND TABLE_SCHEMA='$_';" ) ) . ")"; infoprint " +-- COLLA : " . ( $dbinfo[7] eq 'NULL' ? 0 : $dbinfo[7] ) . " (" . ( join ", ", select_array( "SELECT DISTINCT(TABLE_COLLATION) FROM information_schema.TABLES WHERE TABLE_SCHEMA='$_' AND TABLE_COLLATION IS NOT NULL;" ) ) . ")"; infoprint " +-- ROWS : " . ( !defined( $dbinfo[1] ) or $dbinfo[1] eq 'NULL' ? 0 : $dbinfo[1] ) . ""; infoprint " +-- DATA : " . hr_bytes( $dbinfo[2] ) . "(" . percentage( $dbinfo[2], $dbinfo[4] ) . "%)"; infoprint " +-- INDEX : " . hr_bytes( $dbinfo[3] ) . "(" . percentage( $dbinfo[3], $dbinfo[4] ) . "%)"; infoprint " +-- TOTAL : " . hr_bytes( $dbinfo[4] ) . ""; infoprint " +-- ENGINE: " . ( $dbinfo[8] eq 'NULL' ? 0 : $dbinfo[8] ) . " (" . ( join ", ", select_array( "SELECT DISTINCT(ENGINE) FROM information_schema.TABLES WHERE TABLE_SCHEMA='$_' AND ENGINE IS NOT NULL" ) ) . ")"; foreach my $eng ( select_array( "SELECT DISTINCT(ENGINE) FROM information_schema.TABLES WHERE TABLE_SCHEMA='$_' AND ENGINE IS NOT NULL" ) ) { infoprint " +-- ENGINE $eng : " . select_one( "SELECT COUNT(*) FROM information_schema.TABLES WHERE TABLE_SCHEMA='$dbinfo[0]' AND ENGINE='$eng'" ) . " TABLE(s)"; } if ( $nbTables == 0 ) { badprint " No table in $dbinfo[0] database"; next; } badprint "Index size is larger than data size for $dbinfo[0] \n" if ( $dbinfo[2] ne 'NULL' ) and ( $dbinfo[3] ne 'NULL' ) and ( $dbinfo[2] < $dbinfo[3] ); if ( $dbinfo[5] > 1 and $nbTables > 0 ) { badprint "There are " . $dbinfo[5] . " storage engines. Be careful. \n"; push @generalrec, "Select one storage engine (InnoDB is a good choice) for all tables in $dbinfo[0] database ($dbinfo[5] engines detected)"; } $result{'Databases'}{ $dbinfo[0] }{'Rows'} = $dbinfo[1]; $result{'Databases'}{ $dbinfo[0] }{'Tables'} = $dbinfo[6]; $result{'Databases'}{ $dbinfo[0] }{'Collations'} = $dbinfo[7]; $result{'Databases'}{ $dbinfo[0] }{'Data Size'} = $dbinfo[2]; $result{'Databases'}{ $dbinfo[0] }{'Data Pct'} = percentage( $dbinfo[2], $dbinfo[4] ) . "%"; $result{'Databases'}{ $dbinfo[0] }{'Index Size'} = $dbinfo[3]; $result{'Databases'}{ $dbinfo[0] }{'Index Pct'} = percentage( $dbinfo[3], $dbinfo[4] ) . "%"; $result{'Databases'}{ $dbinfo[0] }{'Total Size'} = $dbinfo[4]; if ( $dbinfo[7] > 1 ) { badprint $dbinfo[7] . " different collations for database " . $dbinfo[0]; push( @generalrec, "Check all table collations are identical for all tables in " . $dbinfo[0] . " database." ); } else { goodprint $dbinfo[7] . " collation for " . $dbinfo[0] . " database."; } if ( $dbinfo[8] > 1 ) { badprint $dbinfo[8] . " different engines for database " . $dbinfo[0]; push( @generalrec, "Check all table engines are identical for all tables in " . $dbinfo[0] . " database." ); } else { goodprint $dbinfo[8] . " engine for " . $dbinfo[0] . " database."; } my @distinct_column_charset = select_array( "select DISTINCT(CHARACTER_SET_NAME) from information_schema.COLUMNS where CHARACTER_SET_NAME IS NOT NULL AND TABLE_SCHEMA ='$_' AND CHARACTER_SET_NAME IS NOT NULL" ); infoprint "Charsets for $dbinfo[0] database table column: " . join( ', ', @distinct_column_charset ); if ( scalar(@distinct_column_charset) > 1 ) { badprint $dbinfo[0] . " table column(s) has several charsets defined for all text like column(s)."; push( @generalrec, "Limit charset for column to one charset if possible for " . $dbinfo[0] . " database." ); } else { goodprint $dbinfo[0] . " table column(s) has same charset defined for all text like column(s)."; } my @distinct_column_collation = select_array( "select DISTINCT(COLLATION_NAME) from information_schema.COLUMNS where COLLATION_NAME IS NOT NULL AND TABLE_SCHEMA ='$_' AND COLLATION_NAME IS NOT NULL" ); infoprint "Collations for $dbinfo[0] database table column: " . join( ', ', @distinct_column_collation ); if ( scalar(@distinct_column_collation) > 1 ) { badprint $dbinfo[0] . " table column(s) has several collations defined for all text like column(s)."; push( @generalrec, "Limit collations for column to one collation if possible for " . $dbinfo[0] . " database." ); } else { goodprint $dbinfo[0] . " table column(s) has same collation defined for all text like column(s)."; } } } # Recommendations for database columns sub mysql_tables { return if ( $opt{tbstat} == 0 ); subheaderprint "Table Column Metrics"; unless ( mysql_version_ge( 5, 5 ) ) { infoprint "Table column metrics from information schema are missing in this version. Skipping..."; return; } if ( mysql_version_ge(8) and not mysql_version_eq(10) ) { infoprint "MySQL and Percona version 8.0 and greater have removed PROCEDURE ANALYSE feature"; $opt{colstat} = 0; infoprint "Disabling colstat parameter"; } infoprint("Dumpdir: $opt{dumpdir}"); # Store all information schema in dumpdir if defined if ( defined $opt{dumpdir} and -d "$opt{dumpdir}" ) { for my $info_s_table ( select_array('use information_schema;show tables;') ) { infoprint "Dumping $info_s_table into $opt{dumpdir}"; select_csv_file( "$opt{dumpdir}/ifs_${info_s_table}.csv", "select * from information_schema.$info_s_table" ); } #exit 0 if ( $opt{stop} == 1 ); } foreach ( select_user_dbs() ) { my $dbname = $_; next unless defined $_; infoprint "Database: " . $_ . ""; my @dbtable = select_array( "SELECT TABLE_NAME FROM information_schema.TABLES WHERE TABLE_SCHEMA='$dbname' AND TABLE_TYPE='BASE TABLE' ORDER BY TABLE_NAME" ); foreach (@dbtable) { my $tbname = $_; infoprint " +-- TABLE: $tbname"; infoprint " +-- TYPE: " . select_one( "SELECT ENGINE FROM information_schema.tables where TABLE_schema='$dbname' AND TABLE_NAME='$tbname'" ); my $selIdxReq = <<"ENDSQL"; SELECT index_name AS idxname, GROUP_CONCAT(column_name ORDER BY seq_in_index) AS cols, INDEX_TYPE as type FROM information_schema.statistics WHERE INDEX_SCHEMA='$dbname' AND TABLE_NAME='$tbname' GROUP BY idxname, type ENDSQL my @tbidx = select_array($selIdxReq); my $found = 0; foreach my $idx (@tbidx) { my @info = split /\s/, $idx; next if $info[0] eq 'NULL'; infoprint " +-- Index $info[0] - Cols: $info[1] - Type: $info[2]"; $found++; } if ( $found == 0 ) { badprint("Table $dbname.$tbname has no index defined"); push @generalrec, "Add at least a primary key on table $dbname.$tbname"; } my @tbcol = select_array( "SELECT COLUMN_NAME FROM information_schema.COLUMNS WHERE TABLE_SCHEMA='$dbname' AND TABLE_NAME='$tbname'" ); foreach (@tbcol) { my $ctype = select_one( "SELECT COLUMN_TYPE FROM information_schema.COLUMNS WHERE TABLE_SCHEMA='$dbname' AND TABLE_NAME='$tbname' AND COLUMN_NAME='$_' " ); my $isnull = select_one( "SELECT IS_NULLABLE FROM information_schema.COLUMNS WHERE TABLE_SCHEMA='$dbname' AND TABLE_NAME='$tbname' AND COLUMN_NAME='$_' " ); my $current_type = uc($ctype) . ( $isnull eq 'NO' ? " NOT NULL" : " NULL" ); my $optimal_type = ''; infoprint " +-- Column $tbname.$_: $current_type"; if ( $opt{colstat} == 1 ) { $optimal_type = select_str_g( "Optimal_fieldtype", "SELECT \\`$_\\` FROM \\`$dbname\\`.\\`$tbname\\` PROCEDURE ANALYSE(100000)" ) unless ( mysql_version_ge(8) and not mysql_version_eq(10) ); } if ( $optimal_type eq '' ) { #infoprint " +-- Current Fieldtype: $current_type"; #infoprint " Optimal Fieldtype: Not available"; } elsif ( $current_type ne $optimal_type and $current_type !~ /.*DATETIME.*/ and $current_type !~ /.*TIMESTAMP.*/ ) { infoprint " +-- Current Fieldtype: $current_type"; if ( $optimal_type =~ /.*ENUM\(.*/ ) { $optimal_type = "ENUM( ... )"; } infoprint " +-- Optimal Fieldtype: $optimal_type "; if ( $optimal_type !~ /.*ENUM\(.*/ ) { badprint "Consider changing type for column $_ in table $dbname.$tbname"; push( @generalrec, "ALTER TABLE \`$dbname\`.\`$tbname\` MODIFY \`$_\` $optimal_type;" ); } } else { goodprint "$dbname.$tbname ($_) type: $current_type"; } } } } } # Recommendations for Indexes metrics sub mysql_indexes { return if ( $opt{idxstat} == 0 ); subheaderprint "Indexes Metrics"; unless ( mysql_version_ge( 5, 5 ) ) { infoprint "Index metrics from information schema are missing in this version. Skipping..."; return; } # unless ( mysql_version_ge( 5, 6 ) ) { # infoprint #"Skip Index metrics from information schema due to erroneous information provided in this version"; # return; # } my $selIdxReq = <<'ENDSQL'; SELECT CONCAT(t.TABLE_SCHEMA, '.', t.TABLE_NAME) AS 'table', CONCAT(s.INDEX_NAME, '(', s.COLUMN_NAME, ')') AS 'index' , s.SEQ_IN_INDEX AS 'seq' , s2.max_columns AS 'maxcol' , s.CARDINALITY AS 'card' , t.TABLE_ROWS AS 'est_rows' , INDEX_TYPE as type , ROUND(((s.CARDINALITY / IFNULL(t.TABLE_ROWS, 0.01)) * 100), 2) AS 'sel' FROM INFORMATION_SCHEMA.STATISTICS s INNER JOIN INFORMATION_SCHEMA.TABLES t ON s.TABLE_SCHEMA = t.TABLE_SCHEMA AND s.TABLE_NAME = t.TABLE_NAME INNER JOIN ( SELECT TABLE_SCHEMA , TABLE_NAME , INDEX_NAME , MAX(SEQ_IN_INDEX) AS max_columns FROM INFORMATION_SCHEMA.STATISTICS WHERE TABLE_SCHEMA NOT IN ('mysql', 'information_schema', 'performance_schema') AND INDEX_TYPE <> 'FULLTEXT' GROUP BY TABLE_SCHEMA, TABLE_NAME, INDEX_NAME ) AS s2 ON s.TABLE_SCHEMA = s2.TABLE_SCHEMA AND s.TABLE_NAME = s2.TABLE_NAME AND s.INDEX_NAME = s2.INDEX_NAME WHERE t.TABLE_SCHEMA NOT IN ('mysql', 'information_schema', 'performance_schema') AND t.TABLE_ROWS > 10 AND s.CARDINALITY IS NOT NULL AND (s.CARDINALITY / IFNULL(t.TABLE_ROWS, 0.01)) < 8.00 ORDER BY sel LIMIT 10; ENDSQL my @idxinfo = select_array($selIdxReq); infoprint "Worst selectivity indexes:"; foreach (@idxinfo) { debugprint "$_"; my @info = split /\s/; infoprint "Index: " . $info[1] . ""; infoprint " +-- COLUMN : " . $info[0] . ""; infoprint " +-- NB SEQS : " . $info[2] . " sequence(s)"; infoprint " +-- NB COLS : " . $info[3] . " column(s)"; infoprint " +-- CARDINALITY : " . $info[4] . " distinct values"; infoprint " +-- NB ROWS : " . $info[5] . " rows"; infoprint " +-- TYPE : " . $info[6]; infoprint " +-- SELECTIVITY : " . $info[7] . "%"; $result{'Indexes'}{ $info[1] }{'Column'} = $info[0]; $result{'Indexes'}{ $info[1] }{'Sequence number'} = $info[2]; $result{'Indexes'}{ $info[1] }{'Number of column'} = $info[3]; $result{'Indexes'}{ $info[1] }{'Cardinality'} = $info[4]; $result{'Indexes'}{ $info[1] }{'Row number'} = $info[5]; $result{'Indexes'}{ $info[1] }{'Index Type'} = $info[6]; $result{'Indexes'}{ $info[1] }{'Selectivity'} = $info[7]; if ( $info[7] < 25 ) { badprint "$info[1] has a low selectivity"; } } infoprint "Indexes per database:"; foreach my $dbname ( select_user_dbs() ) { infoprint "Database: " . $dbname . ""; $selIdxReq = <<"ENDSQL"; SELECT concat(table_name, '.', index_name) AS idxname, GROUP_CONCAT(column_name ORDER BY seq_in_index) AS cols, SUM(CARDINALITY) as card, INDEX_TYPE as type FROM information_schema.statistics WHERE INDEX_SCHEMA='$dbname' AND index_name IS NOT NULL GROUP BY table_name, idxname, type ENDSQL my $found = 0; foreach my $idxinfo ( select_array($selIdxReq) ) { my @info = split /\s/, $idxinfo; next if $info[0] eq 'NULL'; infoprint " +-- INDEX : " . $info[0]; infoprint " +-- COLUMNS : " . $info[1]; infoprint " +-- CARDINALITY: " . $info[2]; infoprint " +-- TYPE : " . $info[4] if defined $info[4]; infoprint " +-- COMMENT : " . $info[5] if defined $info[5]; $found++; } my $nbTables = select_one( "SELECT count(*) from information_schema.TABLES WHERE TABLE_TYPE ='BASE TABLE' AND TABLE_SCHEMA='$dbname'" ); badprint "No index found for $dbname database" if $found == 0 and $nbTables > 1; push @generalrec, "Add indexes on tables from $dbname database" if $found == 0 and $nbTables > 1; } return unless ( defined( $myvar{'performance_schema'} ) and $myvar{'performance_schema'} eq 'ON' ); $selIdxReq = <<'ENDSQL'; SELECT CONCAT(object_schema, '.', object_name) AS 'table', index_name FROM performance_schema.table_io_waits_summary_by_index_usage WHERE index_name IS NOT NULL AND count_star = 0 AND index_name <> 'PRIMARY' AND object_schema NOT IN ('mysql', 'performance_schema', 'information_schema') ORDER BY count_star, object_schema, object_name; ENDSQL @idxinfo = select_array($selIdxReq); infoprint "Unused indexes:"; push( @generalrec, "Remove unused indexes." ) if ( scalar(@idxinfo) > 0 ); foreach (@idxinfo) { debugprint "$_"; my @info = split /\s/; badprint "Index: $info[1] on $info[0] is not used."; push @{ $result{'Indexes'}{'Unused Indexes'} }, $info[0] . "." . $info[1]; } } sub mysql_views { subheaderprint "Views Metrics"; unless ( mysql_version_ge( 5, 5 ) ) { infoprint "Views metrics from information schema are missing in this version. Skipping..."; return; } } sub mysql_routines { subheaderprint "Routines Metrics"; unless ( mysql_version_ge( 5, 5 ) ) { infoprint "Routines metrics from information schema are missing in this version. Skipping..."; return; } } sub mysql_triggers { subheaderprint "Triggers Metrics"; unless ( mysql_version_ge( 5, 5 ) ) { infoprint "Trigger metrics from information schema are missing in this version. Skipping..."; return; } } # Take the two recommendation arrays and display them at the end of the output sub make_recommendations { $result{'Recommendations'} = \@generalrec; $result{'AdjustVariables'} = \@adjvars; subheaderprint "Recommendations"; if ( @generalrec > 0 ) { prettyprint "General recommendations:"; foreach (@generalrec) { prettyprint " " . $_ . ""; } } if ( @adjvars > 0 ) { prettyprint "Variables to adjust:"; if ( $mycalc{'pct_max_physical_memory'} > 90 ) { prettyprint " *** MySQL's maximum memory usage is dangerously high ***\n" . " *** Add RAM before increasing MySQL buffer variables ***"; } foreach (@adjvars) { prettyprint " " . $_ . ""; } } if ( @generalrec == 0 && @adjvars == 0 ) { prettyprint "No additional performance recommendations are available."; } } sub close_outputfile { close($fh) if defined($fh); } sub headerprint { prettyprint " >> MySQLTuner $tunerversion\n" . "\t * Jean-Marie Renouard \n" . "\t * Major Hayden \n" . " >> Bug reports, feature requests, and downloads at http://mysqltuner.pl/\n" . " >> Run with '--help' for additional options and output filtering"; debugprint( "Debug: " . $opt{debug} ); debugprint( "Experimental: " . $opt{experimental} ); } sub string2file { my $filename = shift; my $content = shift; open my $fh, q(>), $filename or die "Unable to open $filename in write mode. Please check permissions for this file or directory"; print $fh $content if defined($content); close $fh; debugprint $content; } sub file2array { my $filename = shift; debugprint "* reading $filename"; my $fh; open( $fh, q(<), "$filename" ) or die "Couldn't open $filename for reading: $!\n"; my @lines = <$fh>; close($fh); return @lines; } sub file2string { return join( '', file2array(@_) ); } my $templateModel; if ( $opt{'template'} ne 0 ) { $templateModel = file2string( $opt{'template'} ); } else { # DEFAULT REPORT TEMPLATE $templateModel = <<'END_TEMPLATE'; MySQLTuner Report

Result output

{$data}
END_TEMPLATE } sub dump_result { #debugprint Dumper( \%result ) if ( $opt{'debug'} ); debugprint "HTML REPORT: $opt{'reportfile'}"; if ( $opt{'reportfile'} ne 0 ) { eval { require Text::Template }; eval { require JSON }; if ($@) { badprint "Text::Template Module is needed."; die "Text::Template Module is needed."; } my $json = JSON->new->allow_nonref; my $json_text = $json->pretty->encode( \%result ); my %vars = ( 'data' => \%result, 'debug' => $json_text, ); my $template; { no warnings 'once'; $template = Text::Template->new( TYPE => 'STRING', PREPEND => q{;}, SOURCE => $templateModel, DELIMITERS => [ '[%', '%]' ] ) or die "Couldn't construct template: $Text::Template::ERROR"; } open my $fh, q(>), $opt{'reportfile'} or die "Unable to open $opt{'reportfile'} in write mode. please check permissions for this file or directory"; $template->fill_in( HASH => \%vars, OUTPUT => $fh ); close $fh; } if ( $opt{'json'} ne 0 ) { eval { require JSON }; if ($@) { print "$bad JSON Module is needed.\n"; return 1; } my $json = JSON->new->allow_nonref; print $json->utf8(1)->pretty( ( $opt{'prettyjson'} ? 1 : 0 ) ) ->encode( \%result ); if ( $opt{'outputfile'} ne 0 ) { unlink $opt{'outputfile'} if ( -e $opt{'outputfile'} ); open my $fh, q(>), $opt{'outputfile'} or die "Unable to open $opt{'outputfile'} in write mode. please check permissions for this file or directory"; print $fh $json->utf8(1)->pretty( ( $opt{'prettyjson'} ? 1 : 0 ) ) ->encode( \%result ); close $fh; } } } sub which { my $prog_name = shift; my $path_string = shift; my @path_array = split /:/, $ENV{'PATH'}; for my $path (@path_array) { return "$path/$prog_name" if ( -x "$path/$prog_name" ); } return 0; } # --------------------------------------------------------------------------- # BEGIN 'MAIN' # --------------------------------------------------------------------------- headerprint; # Header Print validate_tuner_version; # Check latest version mysql_setup; # Gotta login first debugprint "MySQL FINAL Client : $mysqlcmd $mysqllogin"; debugprint "MySQL Admin FINAL Client : $mysqladmincmd $mysqllogin"; #exit(0); os_setup; # Set up some OS variables get_all_vars; # Toss variables/status into hashes get_tuning_info; # Get information about the tuning connection calculations; # Calculate everything we need check_architecture; # Suggest 64-bit upgrade check_storage_engines; # Show enabled storage engines if ( $opt{'feature'} ne '' ) { subheaderprint "See FEATURES.md for more information"; no strict 'refs'; for my $feature ( split /,/, $opt{'feature'} ) { subheaderprint "Running feature: $opt{'feature'}"; $feature->(); } make_recommendations; exit(0); } validate_mysql_version; # Check current MySQL version system_recommendations; # Avoid too many services on the same host log_file_recommendations; # check log file content check_metadata_perf; # Show parameter impacting performance during analysis mysql_databases; # Show information about databases mysql_tables; # Show information about table column mysql_table_structures; # Show information about table structures mysql_indexes; # Show information about indexes mysql_views; # Show information about views mysql_triggers; # Show information about triggers mysql_routines; # Show information about routines security_recommendations; # Display some security recommendations cve_recommendations; # Display related CVE mysql_stats; # Print the server stats mysql_pfs; # Print Performance schema info mariadb_threadpool; # Print MariaDB ThreadPool stats mysql_myisam; # Print MyISAM stats mysql_innodb; # Print InnoDB stats mariadb_aria; # Print MariaDB Aria stats mariadb_tokudb; # Print MariaDB Tokudb stats mariadb_xtradb; # Print MariaDB XtraDB stats #mariadb_rockdb; # Print MariaDB RockDB stats #mariadb_spider; # Print MariaDB Spider stats #mariadb_connect; # Print MariaDB Connect stats mariadb_galera; # Print MariaDB Galera Cluster stats get_replication_status; # Print replication info make_recommendations; # Make recommendations based on stats dump_result; # Dump result if debug is on close_outputfile; # Close reportfile if needed # --------------------------------------------------------------------------- # END 'MAIN' # --------------------------------------------------------------------------- 1; __END__ =pod =encoding UTF-8 =head1 NAME MySQLTuner 2.6.0 - MySQL High Performance Tuning Script =head1 IMPORTANT USAGE GUIDELINES To run the script with the default options, run the script without arguments Allow MySQL server to run for at least 24-48 hours before trusting suggestions Some routines may require root level privileges (script will provide warnings) You must provide the remote server's total memory when connecting to other servers =head1 CONNECTION AND AUTHENTICATION --host Connect to a remote host to perform tests (default: localhost) --socket Use a different socket for a local connection --port Port to use for connection (default: 3306) --protocol tcp Force TCP connection instead of socket --user Username to use for authentication --userenv Name of env variable which contains username to use for authentication --pass Password to use for authentication --passenv Name of env variable which contains password to use for authentication --ssl-ca Path to public key --mysqladmin Path to a custom mysqladmin executable --mysqlcmd Path to a custom mysql executable --defaults-file Path to a custom .my.cnf --defaults-extra-file Path to an extra custom config file --server-log Path to explicit log file (error_log) =head1 PERFORMANCE AND REPORTING OPTIONS --skipsize Don't enumerate tables and their types/sizes (default: on) (Recommended for servers with many tables) --json Print result as JSON string --prettyjson Print result as JSON formatted string --skippassword Don't perform checks on user passwords (default: off) --checkversion Check for updates to MySQLTuner (default: don't check) --updateversion Check for updates to MySQLTuner and update when newer version is available (default: don't check) --forcemem Amount of RAM installed in megabytes --forceswap Amount of swap memory configured in megabytes --passwordfile Path to a password file list (one password by line) --cvefile CVE File for vulnerability checks --outputfile Path to a output txt file --reportfile Path to a report txt file --template Path to a template file --dumpdir Path to a directory where to dump information files --feature Run a specific feature (see FEATURES section) --dumpdir information_schema tables and sys views are dumped in CSV in this path =head1 OUTPUT OPTIONS --silent Don't output anything on screen --verbose Print out all options (default: no verbose, dbstat, idxstat, sysstat, tbstat, pfstat) --color Print output in color --nocolor Don't print output in color --nogood Remove OK responses --nobad Remove negative/suggestion responses --noinfo Remove informational responses --debug Print debug information --experimental Print experimental analysis (may fail) --nondedicated Consider server is not dedicated to Db server usage only --noprocess Consider no other process is running --dbstat Print database information --nodbstat Don't print database information --tbstat Print table information --notbstat Don't print table information --colstat Print column information --nocolstat Don't print column information --idxstat Print index information --noidxstat Don't print index information --nomyisamstat Don't print MyIsam information --sysstat Print system information --nosysstat Don't print system information --nostructstat Don't print table structures information --pfstat Print Performance schema --nopfstat Don't print Performance schema --bannedports Ports banned separated by comma (,) --server-log Define specific error_log to analyze --maxportallowed Number of open ports allowable on this host --buffers Print global and per-thread buffer values =head1 PERLDOC You can find documentation for this module with the perldoc command. perldoc mysqltuner =head2 INTERNALS L Internal documentation =head1 AUTHORS Major Hayden - major@mhtx.net Jean-Marie Renouard - jmrenouard@gmail.com =head1 CONTRIBUTORS =over 4 =item * Matthew Montgomery =item * Paul Kehrer =item * Dave Burgess =item * Jonathan Hinds =item * Mike Jackson =item * Nils Breunese =item * Shawn Ashlee =item * Luuk Vosslamber =item * Ville Skytta =item * Trent Hornibrook =item * Jason Gill =item * Mark Imbriaco =item * Greg Eden =item * Aubin Galinotti =item * Giovanni Bechis =item * Bill Bradford =item * Ryan Novosielski =item * Michael Scheidell =item * Blair Christensen =item * Hans du Plooy =item * Victor Trac =item * Everett Barnes =item * Tom Krouper =item * Gary Barrueto =item * Simon Greenaway =item * Adam Stein =item * Isart Montane =item * Baptiste M. =item * Cole Turner =item * Major Hayden =item * Joe Ashcraft =item * Jean-Marie Renouard =item * Stephan GroBberndt =item * Christian Loos =item * Long Radix =back =head1 SUPPORT Bug reports, feature requests, and downloads at http://mysqltuner.pl/ Bug tracker can be found at https://github.com/major/MySQLTuner-perl/issues Maintained by Jean-Marie Renouard (jmrenouard\@gmail.com) - Licensed under GPL =head1 SOURCE CODE L git clone https://github.com/major/MySQLTuner-perl.git =head1 COPYRIGHT AND LICENSE Copyright (C) 2006-2023 Major Hayden - major@mhtx.net # Copyright (C) 2015-2023 Jean-Marie Renouard - jmrenouard@gmail.com For the latest updates, please visit http://mysqltuner.pl/ Git repository available at https://github.com/major/MySQLTuner-perl This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . =cut # Local variables: # indent-tabs-mode: t # cperl-indent-level: 8 # perl-indent-level: 8 # End: ================================================ FILE: aegir/helpers/rtoc.php.txt ================================================ 1 || php_sapi_name()=='cli' || empty($_SERVER['REMOTE_ADDR']) ) { die; } // weak block against indirect access $time=time(); define('CACHEPREFIX',function_exists('opcache_reset')?'opcache_':(function_exists('accelerator_reset')?'accelerator_':'')); if ( !empty($_GET['RESET']) ) { if ( function_exists(CACHEPREFIX.'reset') ) { call_user_func(CACHEPREFIX.'reset'); } header( 'Location: '.str_replace('?'.$_SERVER['QUERY_STRING'],'',$_SERVER['REQUEST_URI']) ); exit; } if ( !empty($_GET['RECHECK']) ) { if ( function_exists(CACHEPREFIX.'invalidate') ) { $recheck=trim($_GET['RECHECK']); $files=call_user_func(CACHEPREFIX.'get_status'); if (!empty($files['scripts'])) { foreach ($files['scripts'] as $file=>$value) { if ( $recheck==='1' || strpos($file,$recheck)===0 ) call_user_func(CACHEPREFIX.'invalidate',$file); } } header( 'Location: '.str_replace('?'.$_SERVER['QUERY_STRING'],'',$_SERVER['REQUEST_URI']) ); } else { echo 'Sorry, this feature requires Zend Opcache newer than April 8th 2013'; } exit; } ?> OCP - Opcache Control Panel

Opcache Control Panel

Details Files Reset Recheck Refresh
Opcache not detected?'; die; } if ( !empty($_GET['FILES']) ) { echo '

files cached

'; files_display(); echo '
'; exit; } if ( !(isset($_REQUEST['GRAPHS']) && !$_REQUEST['GRAPHS']) && CACHEPREFIX=='opcache_') { graphs_display(); if ( !empty($_REQUEST['GRAPHS']) ) { exit; } } ob_start(); phpinfo(8); $phpinfo = ob_get_contents(); ob_end_clean(); // some info is only available via phpinfo? sadly buffering capture has to be used if ( !preg_match( '/module\_Zend.(Optimizer\+|OPcache).+?(\]*\>.+?\<\/table\>).+?(\]*\>.+?\<\/table\>)/is', $phpinfo, $opcache) ) { } // todo if ( function_exists(CACHEPREFIX.'get_configuration') ) { echo '

general

'; $configuration=call_user_func(CACHEPREFIX.'get_configuration'); } $host=function_exists('gethostname')?@gethostname():@php_uname('n'); if (empty($host)) { $host=empty($_SERVER['SERVER_NAME'])?$_SERVER['HOST_NAME']:$_SERVER['SERVER_NAME']; } $version=array('Host'=>$host); $version['PHP Version']='PHP '.(defined('PHP_VERSION')?PHP_VERSION:'???').' '.(defined('PHP_SAPI')?PHP_SAPI:'').' '.(defined('PHP_OS')?' '.PHP_OS:''); $version['Opcache Version']=empty($configuration['version']['version'])?'???':$configuration['version'][CACHEPREFIX.'product_name'].' '.$configuration['version']['version']; print_table($version); if ( !empty($opcache[2]) ) { echo preg_replace('/\\[^>]+\<\/td\>\[0-9\,\. ]+\<\/td\>\<\/tr\>/','',$opcache[2]); } if ( function_exists(CACHEPREFIX.'get_status') && $status=call_user_func(CACHEPREFIX.'get_status') ) { $uptime=array(); if ( !empty($status[CACHEPREFIX.'statistics']['start_time']) ) { $uptime['uptime']=time_since($time,$status[CACHEPREFIX.'statistics']['start_time'],1,''); } if ( !empty($status[CACHEPREFIX.'statistics']['last_restart_time']) ) { $uptime['last_restart']=time_since($time,$status[CACHEPREFIX.'statistics']['last_restart_time']); } if (!empty($uptime)) {print_table($uptime);} if ( !empty($status['cache_full']) ) { $status['memory_usage']['cache_full']=$status['cache_full']; } echo '

memory

'; print_table($status['memory_usage']); unset($status[CACHEPREFIX.'statistics']['start_time'],$status[CACHEPREFIX.'statistics']['last_restart_time']); echo '

statistics

'; print_table($status[CACHEPREFIX.'statistics']); } if ( empty($_GET['ALL']) ) { meta_display(); exit; } if ( !empty($configuration['blacklist']) ) { echo '

blacklist

'; print_table($configuration['blacklist']); } if ( !empty($opcache[3]) ) { echo '

runtime

'; echo $opcache[3]; } $name='zend opcache'; $functions=get_extension_funcs($name); if (!$functions) { $name='zend optimizer+'; $functions=get_extension_funcs($name); } if ($functions) { echo '

functions

'; print_table($functions); } else { $name=''; } $level=trim(CACHEPREFIX,'_').'.optimization_level'; if (isset($configuration['directives'][$level])) { echo '

optimization levels

'; $levelset=strrev(base_convert($configuration['directives'][$level], 10, 2)); $levels=array( 1=>'Constants subexpressions elimination (CSE) true, false, null, etc.
Optimize series of ADD_STRING / ADD_CHAR
Convert CAST(IS_BOOL,x) into BOOL(x)
Convert INIT_FCALL_BY_NAME + DO_FCALL_BY_NAME into DO_FCALL', 2=>'Convert constant operands to expected types
Convert conditional JMP with constant operands
Optimize static BRK and CONT', 3=>'Convert $a = $a + expr into $a += expr
Convert $a++ into ++$a
Optimize series of JMP', 4=>'PRINT and ECHO optimization (defunct)', 5=>'Block Optimization - most expensive pass
Performs many different optimization patterns based on control flow graph (CFG)', 9=>'Optimize register allocation (allows re-usage of temporary variables)', 10=>'Remove NOPs' ); echo ''; foreach ($levels as $pass=>$description) { $disabled=substr($levelset,$pass-1,1)!=='1' || $pass==4 ? ' white':''; echo ''; } echo '
PassDescription
'.$pass.''.$description.'
'; } if ( isset($_GET['DUMP']) ) { if ($name) { echo '

ini

'; print_table(ini_get_all($name,true)); } foreach ($configuration as $key=>$value) { echo '

',$key,'

'; print_table($configuration[$key]); } exit; } meta_display(); echo ''; exit; function time_since($time,$original,$extended=0,$text='ago') { $time = $time - $original; $day = $extended? floor($time/86400) : round($time/86400,0); $amount=0; $unit=''; if ( $time < 86400) { if ( $time < 60) { $amount=$time; $unit='second'; } elseif ( $time < 3600) { $amount=floor($time/60); $unit='minute'; } else { $amount=floor($time/3600); $unit='hour'; } } elseif ( $day < 14) { $amount=$day; $unit='day'; } elseif ( $day < 56) { $amount=floor($day/7); $unit='week'; } elseif ( $day < 672) { $amount=floor($day/30); $unit='month'; } else { $amount=intval(2*($day/365))/2; $unit='year'; } if ( $amount!=1) {$unit.='s';} if ($extended && $time>60) { $text=' and '.time_since($time,$time<86400?($time<3600?$amount*60:$amount*3600):$day*86400,0,'').$text; } return $amount.' '.$unit.' '.$text; } function print_table($array,$headers=false) { if ( empty($array) || !is_array($array) ) {return;} echo ''; if (!empty($headers)) { if (!is_array($headers)) {$headers=array_keys(reset($array));} echo ''; foreach ($headers as $value) { echo ''; } echo ''; } foreach ($array as $key=>$value) { echo ''; if ( !is_numeric($key) ) { $key=ucwords(str_replace('_',' ',$key)); echo ''; if ( is_numeric($value) ) { if ( $value>1048576) { $value=round($value/1048576,1).'M'; } elseif ( is_float($value) ) { $value=round($value,1); } } } if ( is_array($value) ) { foreach ($value as $column) { echo ''; } echo ''; } else { echo ''; } } echo '
',$value,'
',$key,'',$column,'
',$value,'
'; } function files_display() { $status=call_user_func(CACHEPREFIX.'get_status'); if ( empty($status['scripts']) ) {return;} if ( isset($_GET['DUMP']) ) { print_table($status['scripts']); exit;} $time=time(); $sort=0; $nogroup=preg_replace('/\&?GROUP\=[\-0-9]+/','',$_SERVER['REQUEST_URI']); $nosort=preg_replace('/\&?SORT\=[\-0-9]+/','',$_SERVER['REQUEST_URI']); $group=empty($_GET['GROUP'])?0:intval($_GET['GROUP']); if ( $group<0 || $group>9) { $group=1;} $groupset=array_fill(0,9,''); $groupset[$group]=' class="b" '; echo '
ungroup | 1 | 2 | 3 | 4 | 5
'; if ( !$group ) { $files =& $status['scripts']; } else { $files=array(); foreach ($status['scripts'] as $data) { if ( preg_match('@^[/]([^/]+[/]){'.$group.'}@',$data['full_path'],$path) ) { if ( empty($files[$path[0]])) { $files[$path[0]]=array('full_path'=>'','files'=>0,'hits'=>0,'memory_consumption'=>0,'last_used_timestamp'=>'','timestamp'=>''); } $files[$path[0]]['full_path']=$path[0]; $files[$path[0]]['files']++; $files[$path[0]]['memory_consumption']+=$data['memory_consumption']; $files[$path[0]]['hits']+=$data['hits']; if ( $data['last_used_timestamp']>$files[$path[0]]['last_used_timestamp']) {$files[$path[0]]['last_used_timestamp']=$data['last_used_timestamp'];} if ( $data['timestamp']>$files[$path[0]]['timestamp']) {$files[$path[0]]['timestamp']=$data['timestamp'];} } } } if ( !empty($_GET['SORT']) ) { $keys=array( 'full_path'=>SORT_STRING, 'files'=>SORT_NUMERIC, 'memory_consumption'=>SORT_NUMERIC, 'hits'=>SORT_NUMERIC, 'last_used_timestamp'=>SORT_NUMERIC, 'timestamp'=>SORT_NUMERIC ); $titles=array('','path',$group?'files':'','size','hits','last used','created'); $offsets=array_keys($keys); $key=intval($_GET['SORT']); $direction=$key>0?1:-1; $key=abs($key)-1; $key=isset($offsets[$key])&&!($key==1&&empty($group))?$offsets[$key]:reset($offsets); $sort=array_search($key,$offsets)+1; $sortflip=range(0,7); $sortflip[$sort]=-$direction*$sort; if ( $keys[$key]==SORT_STRING) {$direction=-$direction; } $arrow=array_fill(0,7,''); $arrow[$sort]=$direction>0?' ▼':' ▲'; $direction=$direction>0?SORT_DESC:SORT_ASC; $column=array(); foreach ($files as $data) { $column[]=$data[$key]; } array_multisort($column, $keys[$key], $direction, $files); } echo ''; foreach ($titles as $column=>$title) { if ($title) echo ''; } echo ' '; foreach ($files as $data) { echo '', ($group?'':''), '', '', '', ''; } echo '
',$title,$arrow[$column],'
x',$data['full_path'],''.number_format($data['files']).'',number_format(round($data['memory_consumption']/1024)),'K',number_format($data['hits']),'',time_since($time,$data['last_used_timestamp']),'',empty($data['timestamp'])?'':time_since($time,$data['timestamp']),'
'; } function graphs_display() { $graphs=array(); $colors=array('green','brown','red'); $primes=array(223, 463, 983, 1979, 3907, 7963, 16229, 32531, 65407, 130987); $configuration=call_user_func(CACHEPREFIX.'get_configuration'); $status=call_user_func(CACHEPREFIX.'get_status'); $graphs['memory']['total']=$configuration['directives']['opcache.memory_consumption']; $graphs['memory']['free']=$status['memory_usage']['free_memory']; $graphs['memory']['used']=$status['memory_usage']['used_memory']; $graphs['memory']['wasted']=$status['memory_usage']['wasted_memory']; $graphs['keys']['total']=$status[CACHEPREFIX.'statistics']['max_cached_keys']; foreach ($primes as $prime) { if ($prime>=$graphs['keys']['total']) { $graphs['keys']['total']=$prime; break;} } $graphs['keys']['free']=$graphs['keys']['total']-$status[CACHEPREFIX.'statistics']['num_cached_keys']; $graphs['keys']['scripts']=$status[CACHEPREFIX.'statistics']['num_cached_scripts']; $graphs['keys']['wasted']=$status[CACHEPREFIX.'statistics']['num_cached_keys']-$status[CACHEPREFIX.'statistics']['num_cached_scripts']; $graphs['hits']['total']=0; $graphs['hits']['hits']=$status[CACHEPREFIX.'statistics']['hits']; $graphs['hits']['misses']=$status[CACHEPREFIX.'statistics']['misses']; $graphs['hits']['blacklist']=$status[CACHEPREFIX.'statistics']['blacklist_misses']; $graphs['hits']['total']=array_sum($graphs['hits']); $graphs['restarts']['total']=0; $graphs['restarts']['manual']=$status[CACHEPREFIX.'statistics']['manual_restarts']; $graphs['restarts']['keys']=$status[CACHEPREFIX.'statistics']['hash_restarts']; $graphs['restarts']['memory']=$status[CACHEPREFIX.'statistics']['oom_restarts']; $graphs['restarts']['total']=array_sum($graphs['restarts']); foreach ( $graphs as $caption=>$graph) { echo '
',$caption,'
'; foreach ($graph as $label=>$value) { if ($caption!='hits'){ if ($label=='total') { $key=0; $total=$value; $totaldisplay=''; continue;} $percent=$total?floor($value*100/$total):''; $percent=!$percent||$percent>99?'':$percent.'%'; echo '',$totaldisplay,''; $key++; $totaldisplay=''; }else{ if ($label=='total') { $key=0; $total=$value; $totaldisplay=''; continue;} $percent=$total?floor($value*100/$total):''; $percent=!$percent||$percent>99?'':$percent.'%'; echo '',$totaldisplay,''; $key++; $totaldisplay=''; } } echo '
'.($total>999999?round($total/1024/1024).'M':($total>9999?round($total/1024).'K':$total)).'
', ($value>999999?round($value/1024/1024).'M':($value>9999?round($value/1024).'K':$value)),'',$percent,'',$label,'
'.($total>999999?round($total/1000/1000).'M':($total>9999?round($total/1000).'K':$total)).'
', ($value>999999?round($value/1000/1000).'M':($value>9999?round($value/1000).'K':$value)),'',$percent,'',$label,'
',"\n"; } } function meta_display() { ?>
directives guide | functions guide | wiki.php.net | pecl | Zend source | OCP latest
$testecho if grep -q "\-ne" $testecho; then while [ -e $1 ] do echo -n "." sleep 1 done echo else while [ -e $1 ] do echo -en "\b${sp:i++%${#sp}:1}" sleep .2 done echo -en "${reset}\b" fi ================================================ FILE: aegir/helpers/systemtime ================================================ #!/bin/bash # # system time hourly ntpdate pool.ntp.org exit 0 ================================================ FILE: aegir/helpers/websh.sh.txt ================================================ #!/bin/bash export PATH=/usr/local/bin:/usr/local/sbin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin:/usr/libexec:/usr/local/ssl3 _DEST_DRUSH="/opt/tools/drush/8/drush/drush.php" _forward_to_dash() { if [[ "${_ARGS}" =~ "sudo_noexec.so" ]] && [[ "${_LTD_GID}" =~ "ltd-shell-more"($) ]]; then ### echo FWD 0 DIRECT _R_M=`echo -n ${_ARGS} | sed 's|LD_PRELOAD.*.so||'` ### echo _R_M is ${_R_M} exec /bin/dash -c "${_R_M}" exit 0 fi # Path to the underlying shell (dash in this case) _shell="/bin/dash" # Name under which the shell should think it was invoked _shell_name="sh" # Arrays to hold options and positional parameters _options=() _positional=() # Variables to hold command strings or script files _command="" _script="" # Parse the options and arguments while [[ $# -gt 0 ]]; do case "$1" in --) # End of options shift _positional+=("$@") break ;; -c) # Command option if [[ -n "$2" ]]; then _options+=("-c" "$2") shift 2 _positional+=("$@") break else echo "sh: option requires an argument -- 'c'" >&2 exit 1 fi ;; -i|-l|-s) # Other common options _options+=("$1") shift ;; -*) # Unrecognized options _options+=("$1") shift ;; *) # First non-option argument is the script file _script="$1" shift _positional+=("$@") break ;; esac done # Prepare to execute the underlying shell if [[ -n "${_script}" ]]; then # Execute a script file ### echo FWD 1 PARSED exec -a "${_shell_name}" "${_shell}" "${_options[@]}" "${_script}" "${_positional[@]}" exit 0 else # Execute commands or start an interactive shell ### echo FWD 2 PARSED exec -a "${_shell_name}" "${_shell}" "${_options[@]}" "${_positional[@]}" exit 0 fi } # Capture all arguments _ALL="$@" ### echo "_ALL is ${_ALL}" # Capture environment variables _ENV=$(env 2>&1) ### echo "_ENV is ${_ENV}" # Determine _ARGS based on the first argument if [ "${1}" = "-c" ]; then _ARGS="${2}" else _ARGS="${1}" fi ### echo "_ARGS is ${_ARGS}" if [[ "${_ARGS}" =~ "--php=" ]]; then PHP_FWD=YES else PHP_FWD= fi if [[ "${_ARGS}" =~ "true COLUMNS=" ]]; then _R_M=`echo -n "${_ARGS}" | grep -o "true COLUMNS=[0-9]\+ "` _ARGS=`echo ${_ARGS} | sed "s/\${_R_M}//g"` fi if [[ "${_ARGS}" =~ "'" ]] && [[ "${_ARGS}" =~ "drush" ]]; then ### echo _ARGS RAW is ${_ARGS} _ARGS=$(echo -n ${_ARGS} | tr -d "'" 2>&1) ### echo _ARGS CLEAN is ${_ARGS} fi if [[ ! "${_ARGS}" =~ "composer" ]] \ && [[ ! "${_ARGS}" =~ "git" ]] \ && [[ ! "${_ARGS}" =~ "cd " ]] \ && [[ ! "${_ARGS}" =~ "mysql" ]] \ && [[ ! "${_ARGS}" =~ "sudo" ]]; then _ARR= if [[ "${_ARGS}" =~ "/vendor/drush/drush/drush.php " ]]; then _R_M=`echo -n ${_ARGS} | grep -o ".*/vendor/drush/drush/drush.php"` ### echo _R_M is ${_R_M} _R_M=${_R_M//\//\\\/} ### echo _R_M is ${_R_M} _CLR=`echo ${_ARGS} | sed "s/\${_R_M}//g"` _ARR=() # the buffer array for filtered parameters for arg in "${_CLR}"; do case ${_R_M} in $arg\ * | *\ $arg | *\ $arg\ *) ;; *) _ARR+=("$arg") ;; esac done ### echo _ARR is ${_ARR} elif [[ "${_ARGS}" =~ "vendor/drush/drush/drush.php " ]]; then _R_M=`echo -n ${_ARGS} | grep -o "vendor/drush/drush/drush.php"` ### echo _R_M is ${_R_M} _R_M=${_R_M//\//\\\/} ### echo _R_M is ${_R_M} _CLR=`echo ${_ARGS} | sed "s/\${_R_M}//g"` _ARR=() # the buffer array for filtered parameters for arg in "${_CLR}"; do case ${_R_M} in $arg\ * | *\ $arg | *\ $arg\ *) ;; *) _ARR+=("$arg") ;; esac done ### echo _ARR is ${_ARR} elif [[ "${_ARGS}" =~ "drush " ]]; then if [[ "${_ARGS}" =~ "set -m" ]]; then _R_M=`echo -n ${_ARGS} | grep -o "set -m\; drush"` else _R_M=`echo -n ${_ARGS} | grep -o "drush"` fi ### echo _R_M is ${_R_M} _CLR=`echo ${_ARGS} | sed "s/\${_R_M}//g"` _ARR=() # the buffer array for filtered parameters for arg in "${_CLR}"; do case ${_R_M} in $arg\ * | *\ $arg | *\ $arg\ *) ;; *) _ARR+=("$arg") ;; esac done ### echo _ARR is ${_ARR} elif [[ "${_ARGS}" =~ "drush8 " ]]; then if [[ "${_ARGS}" =~ "set -m" ]]; then _R_M=`echo -n ${_ARGS} | grep -o "set -m\; drush8"` else _R_M=`echo -n ${_ARGS} | grep -o "drush8"` fi ### echo _R_M is ${_R_M} _CLR=`echo ${_ARGS} | sed "s/\${_R_M}//g"` _ARR=() # the buffer array for filtered parameters for arg in "${_CLR}"; do case ${_R_M} in $arg\ * | *\ $arg | *\ $arg\ *) ;; *) _ARR+=("$arg") ;; esac done ### echo _ARR is ${_ARR} elif [[ "${_ARGS}" =~ "drush10 " ]]; then if [[ "${_ARGS}" =~ "set -m" ]]; then _R_M=`echo -n ${_ARGS} | grep -o "set -m\; drush10"` else _R_M=`echo -n ${_ARGS} | grep -o "drush10"` fi ### echo _R_M is ${_R_M} _CLR=`echo ${_ARGS} | sed "s/\${_R_M}//g"` _ARR=() # the buffer array for filtered parameters for arg in "${_CLR}"; do case ${_R_M} in $arg\ * | *\ $arg | *\ $arg\ *) ;; *) _ARR+=("$arg") ;; esac done ### echo _ARR is ${_ARR} elif [[ "${_ARGS}" =~ "drush11 " ]]; then if [[ "${_ARGS}" =~ "set -m" ]]; then _R_M=`echo -n ${_ARGS} | grep -o "set -m\; drush11"` else _R_M=`echo -n ${_ARGS} | grep -o "drush11"` fi ### echo _R_M is ${_R_M} _CLR=`echo ${_ARGS} | sed "s/\${_R_M}//g"` _ARR=() # the buffer array for filtered parameters for arg in "${_CLR}"; do case ${_R_M} in $arg\ * | *\ $arg | *\ $arg\ *) ;; *) _ARR+=("$arg") ;; esac done ### echo _ARR is ${_ARR} elif [[ "${_ARGS}" =~ "php /opt/tools/" ]]; then _R_M=`echo -n ${_ARGS} | grep -o "php /opt/tools/drush/.*/drush/drush.php"` ### echo _R_M is ${_R_M} _R_M=${_R_M//\//\\\/} ### echo _R_M is ${_R_M} _CLR=`echo ${_ARGS} | sed "s/\${_R_M}//g"` _ARR=() # the buffer array for filtered parameters for arg in "${_CLR}"; do case ${_R_M} in $arg\ * | *\ $arg | *\ $arg\ *) ;; *) _ARR+=("$arg") ;; esac done ### echo _ARR is ${_ARR} elif [[ "${_ARGS}" =~ "php /data/disk/" ]]; then _R_M=`echo -n ${_ARGS} | grep -o "php /data/disk/.*/tools/drush/drush.php"` ### echo _R_M is ${_R_M} _R_M=${_R_M//\//\\\/} ### echo _R_M is ${_R_M} _CLR=`echo ${_ARGS} | sed "s/\${_R_M}//g"` _ARR=() # the buffer array for filtered parameters for arg in "${_CLR}"; do case ${_R_M} in $arg\ * | *\ $arg | *\ $arg\ *) ;; *) _ARR+=("$arg") ;; esac done ### echo _ARR is ${_ARR} elif [[ "${_ARGS}" =~ php\ /mnt/.*/data/disk/ ]]; then _R_M=`echo -n ${_ARGS} | grep -o "php /mnt/.*/data/disk/.*/tools/drush/drush.php"` ### echo _R_M is ${_R_M} _R_M=${_R_M//\//\\\/} ### echo _R_M is ${_R_M} _CLR=`echo ${_ARGS} | sed "s/\${_R_M}//g"` _ARR=() # the buffer array for filtered parameters for arg in "${_CLR}"; do case ${_R_M} in $arg\ * | *\ $arg | *\ $arg\ *) ;; *) _ARR+=("$arg") ;; esac done ### echo _ARR is ${_ARR} fi fi _C_ARR= if [[ "${_ARGS}" =~ "composer " ]] && [[ ! "${_ARGS}" =~ "git remote add composer" ]]; then if [[ "${_ARGS}" =~ "set -m" ]]; then _C_RM=`echo -n ${_ARGS} | grep -o "set -m\; composer "` else _C_RM=`echo -n ${_ARGS} | grep -o "composer "` fi ### echo _C_RM is ${_C_RM} _CLR=`echo ${_ARGS} | sed "s/\${_C_RM}//g"` _C_ARR=() # the buffer array for filtered parameters for arg in "${_CLR}"; do case ${_C_RM} in $arg\ * | *\ $arg | *\ $arg\ *) ;; *) _C_ARR+=("$arg") ;; esac done ### echo _C_ARR is ${_C_ARR} fi _INTERNAL=NO _LTD_GID=$(id -nG ${USER} 2>&1) _LTD_UID=$(id -nu ${USER} 2>&1) if [ -z "${USER}" ]; then USER=$(id -nu ${USER} 2>&1) _LTD_QQQ=YES fi _X_USR=".*" if [ "${USER}" = "aegir" ] \ || [ "${HOME}" = "/var/aegir" ]; then _Y_USR=aegir _DRUSH_CLI_CTRL="/var/aegir/static/control" ### echo _DRUSH_CLI_CTRL is ${_DRUSH_CLI_CTRL} else _Y_USR=${USER%${_X_USR}} _DRUSH_CLI_CTRL="/data/disk/${_Y_USR}/static/control" ### echo _DRUSH_CLI_CTRL is ${_DRUSH_CLI_CTRL} fi if [ -z "${HOME}" ]; then if [ -d "/home/${USER}/.tmp" ]; then HOME="/home/${USER}" elif [ -d "/data/disk/${_Y_USR}/.tmp" ]; then HOME="/data/disk/${_Y_USR}" elif [ -d "/var/${_Y_USR}/.tmp" ]; then HOME="/var/${_Y_USR}" fi fi if [[ "${_ARR}" =~ " aliases" ]] || [[ "${_ARR}" =~ " sa" ]]; then if [[ "${_ALL}" =~ "drush10 " ]] || [[ "${_ALL}" =~ "drush11 " ]]; then _ARR="sa --format=list | egrep -v \"(none|hostmaster|hm|server_|platform_|@none|@self)\"" elif [[ "${_ALL}" =~ "drush " ]] || [[ "${_ALL}" =~ "drush8 " ]]; then _ARR="sa | egrep -v \"(none|hostmaster|hm|server_|platform_|@none|@self)\"" fi fi if [[ "${_ARR}" =~ "-c " ]]; then _R_M=`echo -n "${_ARR}" | grep -o "\-c "` _ARR=`echo ${_ARR} | sed "s/\${_R_M}//g"` fi if [[ "${HOME}" =~ (^)"/data/disk/" ]] \ && [ -z "${PHP_FWD}" ] \ && [[ "${_ARGS}" =~ (^)"php ${HOME}" ]]; then _OCTO_SYS="${USER}" _OCTO_SYS_ARR= if [[ "${_ARGS}" =~ "tools/drush/drush.php" ]]; then _R_M=`echo -n ${_ARGS} | grep -o "php /data/disk/.*/tools/drush/drush.php"` ### echo _R_M is ${_R_M} _R_M=${_R_M//\//\\\/} ### echo _R_M is ${_R_M} _CLR=`echo ${_ARGS} | sed "s/\${_R_M}//g"` _OCTO_SYS_ARR=() # the buffer array for filtered parameters for arg in "${_CLR}"; do case ${_R_M} in $arg\ * | *\ $arg | *\ $arg\ *) ;; *) _OCTO_SYS_ARR+=("$arg") ;; esac done ### echo _OCTO_SYS_ARR is ${_OCTO_SYS_ARR} fi else _OCTO_SYS= fi if [[ "${HOME}" =~ (^)"/yyydata/disk/" ]]; then _DRUSH_CLI_CTRL= ### echo _DRUSH_CLI_CTRL has been disabled fi if [ -d "/home/${USER}/.tmp" ]; then export TMP="/home/${USER}/.tmp" export TMPDIR="/home/${USER}/.tmp" export TEMP="/home/${USER}/.tmp" if [[ "${_ARGS}" =~ " id " ]] \ || [[ "${_ARGS}" =~ (^)"id " ]]; then exit 1 elif [[ "${_ARGS}" =~ (^)"newrelic" ]] \ || [[ "${_ARGS}" =~ (^)"nrsysm" ]]; then exit 1 fi elif [ -d "/data/disk/${_Y_USR}/.tmp" ]; then export TMP="/data/disk/${_Y_USR}/.tmp" export TMPDIR="/data/disk/${_Y_USR}/.tmp" export TEMP="/data/disk/${_Y_USR}/.tmp" elif [ -d "/var/${_Y_USR}/.tmp" ]; then export TMP="/var/${_Y_USR}/.tmp" export TMPDIR="/var/${_Y_USR}/.tmp" export TEMP="/var/${_Y_USR}/.tmp" else export TMP="/tmp" export TMPDIR="/tmp" export TEMP="/tmp" fi export HOME=${HOME} export TEMP=${TEMP} export USER=${USER} ### echo HOME is ${HOME} ### echo TEMP is ${TEMP} ### echo USER is ${USER} # ### echo _ALL is ${_ALL} ### echo _ARGS is ${_ARGS} ### echo _LTD_GID is ${_LTD_GID} ### echo _LTD_QQQ is ${_LTD_QQQ} ### echo _LTD_UID is ${_LTD_UID} ### echo _Y_USR is ${_Y_USR} # ### echo 0 is $0 ### echo 1 is $1 ### echo 2 is $2 ### echo 3 is $3 ### echo 4 is $4 ### echo 5 is $5 ### echo 6 is $6 ### echo 7 is $7 ### echo 8 is $8 ### echo 9 is $9 # Check PHP CLI version defined. check_php_cli_version() { ### echo CHK start check_php_cli_version if [ "${HOME}" = "/var/aegir" ] && [ -f "/var/aegir/drush/drush.php" ]; then _PHP_CLI=$(grep "/opt/php" /var/aegir/drush/drush.php 2>&1) else if [ -f "/data/disk/${_Y_USR}/tools/drush/drush.php" ]; then _PHP_CLI=$(grep "/opt/php" /data/disk/${_Y_USR}/tools/drush/drush.php 2>&1) elif [ -f "/data/disk/${_Y_USR}/static/control/cli.info" ]; then _PHP_CLI="php$(tr -d '.\n' < /data/disk/${_Y_USR}/static/control/cli.info)" fi fi ### echo CHK 1 _PHP_CLI is ${_PHP_CLI} _PHP_V="56 70 71 72 73 74 80 81 82 83 84 85" for e in ${_PHP_V}; do if [[ "${_PHP_CLI}" =~ "php${e}" ]] && [ -x "/opt/php${e}/bin/php" ]; then DRUSH_PHP="/opt/php${e}/bin/php" PHP_INI="/opt/php${e}/lib/php.ini" PHPRC="/opt/php${e}/lib" if [ -f "${HOME}/.drush/php${e}/php.ini" ]; then PHP_INI="${HOME}/.drush/php${e}/php.ini" PHPRC="${HOME}/.drush/php${e}" fi fi done ### echo CHK 2 DRUSH_PHP is ${DRUSH_PHP} ### echo CHK 2 PHP_INI is ${PHP_INI} ### echo CHK 2 PHPRC is ${PHPRC} for e in ${_PHP_V}; do if [ -e "${_DRUSH_CLI_CTRL}/php${e}.info" ] && [ -x "/opt/php${e}/bin/php" ]; then DRUSH_PHP="/opt/php${e}/bin/php" PHP_INI="/opt/php${e}/lib/php.ini" PHPRC="/opt/php${e}/lib" if [ -f "${HOME}/.drush/php${e}/php.ini" ]; then PHP_INI="${HOME}/.drush/php${e}/php.ini" PHPRC="${HOME}/.drush/php${e}" fi fi done ### echo CHK 3 DRUSH_PHP is ${DRUSH_PHP} ### echo CHK 3 PHP_INI is ${PHP_INI} ### echo CHK 3 PHPRC is ${PHPRC} if [ ! -z "${PHP_INI}" ]; then export DRUSH_PHP;export PHP_INI;export PHPRC; else DRUSH_PHP="/usr/bin/php" export DRUSH_PHP; ### echo CHK 4 DRUSH_PHP is ${DRUSH_PHP} fi ### echo CHK fin check_php_cli_version } if [ -n "${JENKINS_HOME}" ] \ || [ -n "${JENKINS_NODE_COOKIE}" ] \ || [ -n "${WORKSPACE_TMP}" ]; then _IS_JENKINS=TRUE else _IS_JENKINS=FALSE fi if [ "${_IS_JENKINS}" = "FALSE" ]; then check_php_cli_version fi if [ "${_LTD_GID}" = "www-data users" ] \ || [[ "${HOME}" =~ (^)"/var/aegir" ]] \ || [[ "${HOME}" =~ (^)"/data/disk/" ]] \ || [[ "${_LTD_GID}" =~ "lshellg"($) ]] \ || [[ "${_LTD_GID}" =~ "ltd-shell-more"($) ]] \ || [[ "${_LTD_GID}" =~ "lshellg rvm"($) ]] \ || [[ "${_LTD_GID}" =~ "ltd-shell"($) ]] \ || [[ "${_LTD_GID}" =~ "ltd-shell rvm"($) ]] \ || [[ "${_LTD_GID}" =~ "rvm ltd-shell"($) ]] \ || [[ "${_LTD_GID}" =~ (^)"users www-data"($) ]] \ || [[ "${_LTD_GID}" =~ (^)"aegir www-data users"($) ]]; then if [ "${1}" = "-c" ]; then _IS_SH_PATH=NO if [ "$0" = "/bin/sh" ] || [ "$0" = "/usr/bin/sh" ]; then _IS_SH_PATH=YES else echo echo " ERROR: Not Authorized Path" echo exit 1 fi if [[ $(whoami) == *.ftp ]] \ || [[ "${2}" =~ "drush" ]] \ || [[ "${2}" =~ "mysql " ]]; then _IN_PATH=YES _INTERNAL=YES if [[ "${_ARGS}" =~ "mysql " ]] \ || [[ "${_ARGS}" =~ "drush" ]] \ || [[ "${_ARGS}" =~ "drush8 " ]] \ || [[ "${_ARGS}" =~ "drush10 " ]] \ || [[ "${_ARGS}" =~ "drush11 " ]] \ || [[ "${_ARGS}" =~ "vendor/drush/drush/drush.php " ]]; then _PWD=$(pwd 2>&1) _DEST_DRUSH="/opt/tools/drush/8/drush/drush.php" if [[ "${_ARGS}" =~ "vendor/bin/drush " ]]; then _DEST_DRUSH="${_R_M}/vendor/drush/drush/drush.php" fi if [[ "${_ARGS}" =~ "vendor/drush/drush/drush " ]]; then _DEST_DRUSH="${_R_M}/vendor/drush/drush/drush.php" fi if [[ "${_ARGS}" =~ "/vendor/bin/drush " ]]; then _DEST_DRUSH="${_R_M}/vendor/drush/drush/drush.php" fi if [[ "${_ARGS}" =~ "vendor/drush/drush/drush.php " ]]; then # Detect if PWD ends with /web, /html, or /docroot if [[ "$PWD" =~ /(web|html|docroot)$ ]]; then _DEST_DRUSH="../vendor/drush/drush/drush.php" else _DEST_DRUSH="vendor/drush/drush/drush.php" fi ### echo INF 0 _DEST_DRUSH is ${_DEST_DRUSH} fi if [[ "${_ARGS}" =~ "drush11 " ]] \ || [[ "${_ARGS}" =~ "drush10 " ]]; then if [[ "${_ARGS}" =~ "drush11 " ]]; then _DEST_DRUSH="/usr/bin/drush11" elif [[ "${_ARGS}" =~ "drush10 " ]]; then _DEST_DRUSH="/usr/bin/drush10" fi if [[ ! "${HOME}" =~ (^)"/data/disk/" ]]; then _PHP_V="74 80 81 82 83 84 85" for e in ${_PHP_V}; do if [ -e "${_DRUSH_CLI_CTRL}/php${e}.info" ] && [ -x "/opt/php${e}/bin/php" ]; then DRUSH_PHP="/opt/php${e}/bin/php" PHP_INI="/opt/php${e}/lib/php.ini" PHPRC="/opt/php${e}/lib" if [ -f "${HOME}/.drush/php${e}/php.ini" ]; then PHP_INI="${HOME}/.drush/php${e}/php.ini" PHPRC="${HOME}/.drush/php${e}" fi fi done fi if [ ! -z "${DRUSH_PHP}" ] && [ ! -z "${PHP_INI}" ]; then export DRUSH_PHP;export PHP_INI;export PHPRC; ### echo INF 3 DRUSH_PHP is ${DRUSH_PHP} ### echo INF 3 PHP_INI is ${PHP_INI} ### echo INF 3 PHPRC is ${PHPRC} ### echo INF 3 _DEST_DRUSH is ${_DEST_DRUSH} else echo echo " Drush 11 and Drush 10 require at least PHP 7.4" echo " Please create empty control file:" echo echo " ${_DRUSH_CLI_CTRL}/php74.info" echo " or" echo " ${_DRUSH_CLI_CTRL}/php81.info" echo " or" echo " ${_DRUSH_CLI_CTRL}/php82.info" echo " or" echo " ${_DRUSH_CLI_CTRL}/php83.info" echo " or" echo " ${_DRUSH_CLI_CTRL}/php84.info" echo " or" echo " ${_DRUSH_CLI_CTRL}/php85.info" echo echo " NOTE: If you create more than one," echo " the highest version wins." echo " Bye" echo exit 0 fi elif [[ "${_ARGS}" =~ "drush" ]] \ || [[ "${_ARGS}" =~ "drush8 " ]]; then _DEST_DRUSH="/opt/tools/drush/8/drush/drush.php" if [[ "${_ARGS}" =~ "vendor/bin/drush " ]]; then _DEST_DRUSH="${_R_M}/vendor/drush/drush/drush.php" fi if [[ "${_ARGS}" =~ "vendor/drush/drush/drush " ]]; then _DEST_DRUSH="${_R_M}/vendor/drush/drush/drush.php" fi if [[ "${_ARGS}" =~ "/vendor/bin/drush " ]]; then _DEST_DRUSH="${_R_M}/vendor/drush/drush/drush.php" fi if [[ "${_ARGS}" =~ "vendor/drush/drush/drush.php " ]]; then # Detect if PWD ends with /web, /html, or /docroot if [[ "$PWD" =~ /(web|html|docroot)$ ]]; then _DEST_DRUSH="../vendor/drush/drush/drush.php" else _DEST_DRUSH="vendor/drush/drush/drush.php" fi ### echo INF 1 _DEST_DRUSH is ${_DEST_DRUSH} fi if [[ ! "${HOME}" =~ (^)"/data/disk/" ]] && [ "${_IS_JENKINS}" = "FALSE" ]; then _PHP_V="56 70 71 72 73 74 80 81 82 83 84 85" for e in ${_PHP_V}; do if [ -e "${_DRUSH_CLI_CTRL}/php${e}.info" ] && [ -x "/opt/php${e}/bin/php" ]; then DRUSH_PHP="/opt/php${e}/bin/php" PHP_INI="/opt/php${e}/lib/php.ini" PHPRC="/opt/php${e}/lib" if [ -f "${HOME}/.drush/php${e}/php.ini" ]; then PHP_INI="${HOME}/.drush/php${e}/php.ini" PHPRC="${HOME}/.drush/php${e}" fi fi done fi if [ ! -z "${DRUSH_PHP}" ] && [ ! -z "${PHP_INI}" ] && [ "${_IS_JENKINS}" = "FALSE" ]; then export DRUSH_PHP;export PHP_INI;export PHPRC; ### echo INF 4 DRUSH_PHP is ${DRUSH_PHP} ### echo INF 4 PHP_INI is ${PHP_INI} ### echo INF 4 PHPRC is ${PHPRC} ### echo INF 4 _DEST_DRUSH is ${_DEST_DRUSH} fi fi if [[ "${_ARGS}" =~ "drush make" ]] \ || [[ "${_ARGS}" =~ "drush8 make" ]] \ || [[ "${_ARGS}" =~ "drush cc drush" ]] \ || [[ "${_ARGS}" =~ "drush8 cc drush" ]] \ || [[ "${_ARGS}" =~ "drush10 cr drush" ]] \ || [[ "${_ARGS}" =~ "drush11 cr drush" ]] \ || [[ "${_ARGS}" =~ "vendor/drush/drush/drush.php cr drush" ]]; then if [[ "${_PWD}" =~ "/static" ]] \ || [[ "${_ARGS}" =~ "drush cc drush" ]] \ || [[ "${_ARGS}" =~ "drush8 cc drush" ]] \ || [[ "${_ARGS}" =~ "drush10 cr drush" ]] \ || [[ "${_ARGS}" =~ "drush11 cr drush" ]] \ || [[ "${_ARGS}" =~ "vendor/drush/drush/drush.php cr drush" ]]; then _CORRECT=YES _CORRECT_PWD_R=$(pwd 2>&1) _CORRECT_ARGS_R="${_ARGS}" ### echo _CORRECT_PWD_R is ${_CORRECT_PWD_R} ### echo _CORRECT_ARGS_R is ${_CORRECT_ARGS_R} else if [[ "${_ARGS}" =~ "make-generate" ]] \ && [ -f "${_PWD}/settings.php" ]; then _CORRECT=YES _CORRECT_PWD_S=$(pwd 2>&1) _CORRECT_ARGS_S="${_ARGS}" ### echo _CORRECT_PWD_S is ${_CORRECT_PWD_S} ### echo _CORRECT_ARGS_S is ${_CORRECT_ARGS_S} else echo echo " This drush command can not be run in ${_PWD}" if [[ "${2}" =~ "make-generate" ]]; then echo " Please cd to the valid sites/foo.com directory first" echo " or use a valid @alias, like: drush @foo.com status" echo " Hint: Use 'drush aliases' to display all Drush 8 aliases" echo " Hint: Use 'drush11 aliases' to display all Drush 10+ aliases" else echo " Please cd ~/static first" fi echo exit 0 fi fi else if [[ "${_ARGS}" =~ "drush @" ]] \ || [[ "${_ARGS}" =~ "drush8 @" ]] \ || [[ "${_ARGS}" =~ "drush10 @" ]] \ || [[ "${_ARGS}" =~ "drush11 @" ]] \ || [[ "${_ARGS}" =~ "vendor/drush/drush/drush.php @" ]] \ || [[ "${_ARGS}" =~ "vendor/bin/drush @" ]] \ || [[ "${_ARGS}" =~ "drush -vvv @" ]] \ || [[ "${_ARGS}" =~ "drush8 -vvv @" ]] \ || [[ "${_ARGS}" =~ "drush10 -vvv @" ]] \ || [[ "${_ARGS}" =~ "drush11 -vvv @" ]] \ || [[ "${_ARGS}" =~ "vendor/drush/drush/drush.php -vvv @" ]] \ || [[ "${_ARGS}" =~ "vendor/bin/drush -vvv @" ]]; then if [[ "${2}" =~ "restore"($) ]] \ || [[ "${2}" =~ "arr"($) ]] \ || [[ "${2}" =~ "cli"($) ]] \ || [[ "${2}" =~ "conf"($) ]] \ || [[ "${2}" =~ "config"($) ]] \ || [[ "${2}" =~ "execute"($) ]] \ || [[ "${2}" =~ "core-quick-drupal"($) ]] \ || [[ "${2}" =~ "exec"($) ]] \ || [[ "${2}" =~ "xstatus"($) ]] \ || [[ "${2}" =~ "redis-flush"($) ]] \ || [[ "${2}" =~ (^)"qd"($) ]] \ || [[ "${2}" =~ (^)"rs"($) ]] \ || [[ "${2}" =~ "runserver"($) ]] \ || [[ "${2}" =~ (^)"scr"($) ]] \ || [[ "${2}" =~ (^)"sha"($) ]] \ || [[ "${2}" =~ "shell-alias"($) ]] \ || [[ "${2}" =~ (^)"si"($) ]] \ || [[ "${2}" =~ "sql-create"($) ]] \ || [[ "${2}" =~ (^)"ssh"($) ]] \ || [[ "${2}" =~ (^)"sup"($) ]]; then echo echo " This drush command is not available (A)" echo exit 0 else _CORRECT=YES ### LSHELL ==> ALL vdrush commands WITH @alias START here ### LSHELL ==> ALL drush8 commands WITH @alias START here _CORRECT_PWD_T=$(pwd 2>&1) _CORRECT_ARGS_T="${_ARGS}" ### echo _CORRECT_PWD_T is ${_CORRECT_PWD_T} ### echo _CORRECT_ARGS_T is ${_CORRECT_ARGS_T} fi ### LSHELL ==> BASIC vdrush commands WITH @alias END here ### LSHELL ==> ALL drush8 commands WITH @alias END here ### LSHELL ==> RESPAWNED vdrush commands WITH @alias like updatedb CONTINUE here _CORRECT_PWD_U=$(pwd 2>&1) _CORRECT_ARGS_U="${_ARGS}" ### echo _CORRECT_PWD_U is ${_CORRECT_PWD_U} ### echo _CORRECT_ARGS_U is ${_CORRECT_ARGS_U} elif [[ "${_ARGS}" =~ "cc drush" ]] \ || [[ "${_ARGS}" =~ "cr drush" ]] \ || [[ "${_ARGS}" =~ "drush --version" ]] \ || [[ "${_ARGS}" =~ "drush aliases" ]] \ || [[ "${_ARGS}" =~ "drush dl" ]] \ || [[ "${_ARGS}" =~ "drush help" ]] \ || [[ "${_ARGS}" =~ "drush sa" ]] \ || [[ "${_ARGS}" =~ "drush10 --version" ]] \ || [[ "${_ARGS}" =~ "drush10 aliases" ]] \ || [[ "${_ARGS}" =~ "drush10 help" ]] \ || [[ "${_ARGS}" =~ "drush10 sa" ]] \ || [[ "${_ARGS}" =~ "drush11 --version" ]] \ || [[ "${_ARGS}" =~ "drush11 aliases" ]] \ || [[ "${_ARGS}" =~ "drush11 help" ]] \ || [[ "${_ARGS}" =~ "drush11 sa" ]] \ || [[ "${_ARGS}" =~ "drush8 --version" ]] \ || [[ "${_ARGS}" =~ "drush8 aliases" ]] \ || [[ "${_ARGS}" =~ "drush8 dl" ]] \ || [[ "${_ARGS}" =~ "drush8 help" ]] \ || [[ "${_ARGS}" =~ "drush8 pm-download" ]] \ || [[ "${_ARGS}" =~ "drush8 sa" ]] \ || [[ "${_ARGS}" =~ "drush pm-download" ]] \ || [[ "${_ARGS}" =~ "vendor/bin/drush --version" ]] \ || [[ "${_ARGS}" =~ "vendor/bin/drush help" ]] \ || [[ "${_ARGS}" =~ "/data/disk/" ]] \ || [[ "${_ARGS}" =~ "vendor/drush/drush/drush.php --version" ]] \ || [[ "${_ARGS}" =~ "vendor/drush/drush/drush.php help" ]]; then _CORRECT=YES ### LSHELL ==> RESPAWNED vdrush commands WITH @alias like updatedb END here ### LSHELL ==> Commands like drush11 aliases START and END here _CORRECT_PWD_V=$(pwd 2>&1) _CORRECT_ARGS_V="${_ARGS}" ### echo _CORRECT_PWD_V is ${_CORRECT_PWD_V} ### echo _CORRECT_ARGS_V is ${_CORRECT_ARGS_V} else ### LSHELL ==> ALL drush8 commands WITHOUT @alias START here _CORRECT_PWD_X=$(pwd 2>&1) _CORRECT_ARGS_X="${_ARGS}" ### echo _CORRECT_PWD_X is ${_CORRECT_PWD_X} ### echo _CORRECT_ARGS_X is ${_CORRECT_ARGS_X} if [ -f "${_PWD}/settings.php" ]; then if [[ "${_ARGS}" =~ "drush " ]] \ || [[ "${_ARGS}" =~ "drush8 " ]] \ || [[ "${_ARGS}" =~ "drush10 " ]] \ || [[ "${_ARGS}" =~ "drush11 " ]]; then _CORRECT=YES ### LSHELL ==> ALL drush8 commands WITHOUT @alias END here _CORRECT_PWD_Y=$(pwd 2>&1) _CORRECT_ARGS_Y="${_ARGS}" ### echo _CORRECT_PWD_Y is ${_CORRECT_PWD_Y} ### echo _CORRECT_ARGS_Y is ${_CORRECT_ARGS_Y} fi fi fi fi fi else if [[ "${_ARGS}" =~ "drush @" ]] \ || [[ "${_ARGS}" =~ "drush8 @" ]] \ || [[ "${_ARGS}" =~ "drush10 @" ]] \ || [[ "${_ARGS}" =~ "drush11 @" ]] \ || [[ "${_ARGS}" =~ "vendor/drush/drush/drush.php @" ]] \ || [[ "${_ARGS}" =~ "vendor/bin/drush @" ]] \ || [[ "${_ARGS}" =~ "drush -vvv @" ]] \ || [[ "${_ARGS}" =~ "drush8 -vvv @" ]] \ || [[ "${_ARGS}" =~ "drush10 -vvv @" ]] \ || [[ "${_ARGS}" =~ "drush11 -vvv @" ]] \ || [[ "${_ARGS}" =~ "vendor/drush/drush/drush.php -vvv @" ]] \ || [[ "${_ARGS}" =~ "vendor/bin/drush -vvv @" ]]; then if [[ "${2}" =~ "restore"($) ]] \ || [[ "${2}" =~ "arr"($) ]] \ || [[ "${2}" =~ "cli"($) ]] \ || [[ "${2}" =~ "conf"($) ]] \ || [[ "${2}" =~ "config"($) ]] \ || [[ "${2}" =~ "execute"($) ]] \ || [[ "${2}" =~ "core-quick-drupal"($) ]] \ || [[ "${2}" =~ "exec"($) ]] \ || [[ "${2}" =~ "xstatus"($) ]] \ || [[ "${2}" =~ "redis-flush"($) ]] \ || [[ "${2}" =~ (^)"qd"($) ]] \ || [[ "${2}" =~ (^)"rs"($) ]] \ || [[ "${2}" =~ "runserver"($) ]] \ || [[ "${2}" =~ (^)"scr"($) ]] \ || [[ "${2}" =~ (^)"sha"($) ]] \ || [[ "${2}" =~ "shell-alias"($) ]] \ || [[ "${2}" =~ (^)"si"($) ]] \ || [[ "${2}" =~ "sql-create"($) ]] \ || [[ "${2}" =~ (^)"ssh"($) ]] \ || [[ "${2}" =~ (^)"sup"($) ]]; then echo echo " This drush command is not available (B)" echo exit 0 fi _DEBUG_PWD_X=$(pwd 2>&1) _DEBUG_ARGS_X="${_ARGS}" ### echo _DEBUG_PWD_X is ${_DEBUG_PWD_X} ### echo _DEBUG_ARGS_X is ${_DEBUG_ARGS_X} fi _RAW_IN_PATH=${2//[^a-z/]/} if [[ "${2}" =~ (^)"/usr/" ]] \ || [[ "${2}" =~ (^)"/bin/" ]] \ || [[ "${2}" =~ (^)"/opt/" ]]; then _IN_PATH=YES elif [[ "${2}" =~ (^)"/data/disk/${_Y_USR}/tools/drush/drush.php" ]]; then _IN_PATH=YES elif [[ "${2}" =~ (^)"(/data/disk/${_Y_USR}/tools/drush/drush.php" ]]; then _IN_PATH=YES elif [[ "${2}" =~ (^)"/var/${_Y_USR}/drush/drush.php" ]]; then _IN_PATH=YES elif [[ "${2}" =~ (^)"(/var/${_Y_USR}/drush/drush.php" ]]; then _IN_PATH=YES elif [[ "${_RAW_IN_PATH}" =~ "/usr/bin/wkhtmltopdf" ]]; then _IN_PATH=YES elif [[ "${_RAW_IN_PATH}" =~ "/usr/bin/wkhtmltoimage" ]]; then _IN_PATH=YES elif [[ "${_RAW_IN_PATH}" =~ "/usr/local/bin/wkhtmltopdf" ]]; then _IN_PATH=YES elif [[ "${_RAW_IN_PATH}" =~ "/usr/local/bin/wkhtmltoimage" ]]; then _IN_PATH=YES elif [[ "${_RAW_IN_PATH}" =~ "/usr/bin/wkhtmltopdf-0.12.4" ]]; then _IN_PATH=YES elif [[ "${_RAW_IN_PATH}" =~ "/usr/bin/wkhtmltoimage-0.12.4" ]]; then _IN_PATH=YES elif [[ "${_RAW_IN_PATH}" =~ "/usr/local/bin/composer" ]]; then _IN_PATH=YES elif [[ "${_RAW_IN_PATH}" =~ "/usr/bin/composer" ]]; then _IN_PATH=YES elif [[ "${_RAW_IN_PATH}" =~ "/usr/bin/unzip" ]]; then _IN_PATH=YES elif [[ "${_RAW_IN_PATH}" =~ "/usr/bin/convert" ]]; then _IN_PATH=YES elif [[ "${_RAW_IN_PATH}" =~ "/usr/bin/gs" ]]; then _IN_PATH=YES elif [[ "${2}" =~ (^)"/home/" ]] \ || [[ "${2}" =~ (^)"/data/" ]] \ || [[ "${2}" =~ (^)"/tmp/" ]]; then if [ -e "${2}" ]; then _IN_PATH=NO fi else _WHICH_TEST="$(which ${2})" if [[ "${_WHICH_TEST}" =~ (^)"/usr/" ]] \ || [[ "${_WHICH_TEST}" =~ (^)"/bin/" ]] \ || [[ "${_WHICH_TEST}" =~ (^)"/opt/" ]]; then _IN_PATH=YES else _IN_PATH=NO fi fi fi else if [[ "${_ARGS}" =~ "drush @" ]] \ || [[ "${_ARGS}" =~ "drush8 @" ]] \ || [[ "${_ARGS}" =~ "drush10 @" ]] \ || [[ "${_ARGS}" =~ "drush11 @" ]] \ || [[ "${_ARGS}" =~ "vendor/drush/drush/drush.php @" ]] \ || [[ "${_ARGS}" =~ "vendor/bin/drush @" ]] \ || [[ "${_ARGS}" =~ "drush -vvv @" ]] \ || [[ "${_ARGS}" =~ "drush8 -vvv @" ]] \ || [[ "${_ARGS}" =~ "drush10 -vvv @" ]] \ || [[ "${_ARGS}" =~ "drush11 -vvv @" ]] \ || [[ "${_ARGS}" =~ "vendor/drush/drush/drush.php -vvv @" ]] \ || [[ "${_ARGS}" =~ "vendor/bin/drush -vvv @" ]]; then if [[ "${2}" =~ "restore"($) ]] \ || [[ "${2}" =~ "arr"($) ]] \ || [[ "${2}" =~ "cli"($) ]] \ || [[ "${2}" =~ "conf"($) ]] \ || [[ "${2}" =~ "config"($) ]] \ || [[ "${2}" =~ "execute"($) ]] \ || [[ "${2}" =~ "core-quick-drupal"($) ]] \ || [[ "${2}" =~ "exec"($) ]] \ || [[ "${2}" =~ "xstatus"($) ]] \ || [[ "${2}" =~ "redis-flush"($) ]] \ || [[ "${2}" =~ (^)"qd"($) ]] \ || [[ "${2}" =~ (^)"rs"($) ]] \ || [[ "${2}" =~ "runserver"($) ]] \ || [[ "${2}" =~ (^)"scr"($) ]] \ || [[ "${2}" =~ (^)"sha"($) ]] \ || [[ "${2}" =~ "shell-alias"($) ]] \ || [[ "${2}" =~ (^)"si"($) ]] \ || [[ "${2}" =~ "sql-create"($) ]] \ || [[ "${2}" =~ (^)"ssh"($) ]] \ || [[ "${2}" =~ (^)"sup"($) ]]; then echo echo " This drush command is not available (C)" echo exit 0 fi _DEBUG_PWD_Y=$(pwd 2>&1) _DEBUG_ARGS_Y="${_ARGS}" ### echo _DEBUG_PWD_Y is ${_DEBUG_PWD_Y} ### echo _DEBUG_ARGS_Y is ${_DEBUG_ARGS_Y} fi if [[ "${1}" =~ (^)"/usr/" ]] \ || [[ "${1}" =~ (^)"/bin/" ]] \ || [[ "${1}" =~ (^)"/opt/" ]]; then _IN_PATH=YES elif [[ "${1}" =~ (^)"/data/disk/${_Y_USR}/tools/drush/drush.php" ]]; then _IN_PATH=YES elif [[ "${1}" =~ (^)"(/data/disk/${_Y_USR}/tools/drush/drush.php" ]]; then _IN_PATH=YES elif [[ "${1}" =~ (^)"/var/${_Y_USR}/drush/drush.php" ]]; then _IN_PATH=YES elif [[ "${1}" =~ (^)"(/var/${_Y_USR}/drush/drush.php" ]]; then _IN_PATH=YES elif [[ "${1}" =~ (^)"/home/" ]] \ || [[ "${1}" =~ (^)"/data/" ]] \ || [[ "${1}" =~ (^)"/tmp/" ]]; then if [ -e "${1}" ]; then _IN_PATH=NO fi else _WHICH_TEST="$(which ${1})" if [[ "${_WHICH_TEST}" =~ (^)"/usr/" ]] \ || [[ "${_WHICH_TEST}" =~ (^)"/bin/" ]] \ || [[ "${_WHICH_TEST}" =~ (^)"/opt/" ]]; then _IN_PATH=YES else _IN_PATH=NO fi fi fi if [[ "${_LTD_GID}" =~ "lshellg"($) ]] \ || [[ "${_LTD_GID}" =~ "ltd-shell-more"($) ]] \ || [[ "${_LTD_GID}" =~ "lshellg rvm"($) ]] \ || [[ "${_LTD_GID}" =~ "ltd-shell"($) ]] \ || [[ "${_LTD_GID}" =~ "rvm ltd-shell"($) ]] \ || [[ "${_LTD_GID}" =~ "ltd-shell rvm"($) ]]; then if [[ "${_ARGS}" =~ "*" ]]; then if [[ $(whoami) == *.ftp ]]; then _SILENT=YES #### #### The [[ $(whoami) == *.ftp ]] ### OK for Drush and Drupal #### The [[ "${_ARGS}" =~ "set -m; " ]] ### Legacy defunct method #### else if [[ "${_ARGS}" =~ "__build__" ]] \ || [[ "${_ARGS}" =~ "_tmp_" ]] \ || [[ "${_ARGS}" =~ ".tmp" ]] \ || [[ "${_ARGS}" =~ "avconv" ]] \ || [[ "${_ARGS}" =~ "bzr " ]] \ || [[ "${_ARGS}" =~ "chdir " ]] \ || [[ "${_ARGS}" =~ "compass " ]] \ || [[ "${_ARGS}" =~ "composer " ]] \ || [[ "${_ARGS}" =~ "convert " ]] \ || [[ "${_ARGS}" =~ "curl " ]] \ || [[ "${_ARGS}" =~ "drush" ]] \ || [[ "${_ARGS}" =~ "ffmpeg " ]] \ || [[ "${_ARGS}" =~ "flvtool " ]] \ || [[ "${_ARGS}" =~ "git " ]] \ || [[ "${_ARGS}" =~ "is_" ]] \ || [[ "${_ARGS}" =~ "java" ]] \ || [[ "${_ARGS}" =~ "logger " ]] \ || [[ "${_ARGS}" =~ "php " ]] \ || [[ "${_ARGS}" =~ "php56 " ]] \ || [[ "${_ARGS}" =~ "php74 " ]] \ || [[ "${_ARGS}" =~ "php81 " ]] \ || [[ "${_ARGS}" =~ "php82 " ]] \ || [[ "${_ARGS}" =~ "php83 " ]] \ || [[ "${_ARGS}" =~ "php84 " ]] \ || [[ "${_ARGS}" =~ "php85 " ]] \ || [[ "${_ARGS}" =~ "unzip " ]] \ || [[ "${_ARGS}" =~ "rename " ]] \ || [[ "${_ARGS}" =~ "rrdtool " ]] \ || [[ "${_ARGS}" =~ "rsync " ]] \ || [[ "${_ARGS}" =~ "sass " ]] \ || [[ "${_ARGS}" =~ "scp " ]] \ || [[ "${_ARGS}" =~ "scss " ]] \ || [[ "${_ARGS}" =~ "sendmail " ]] \ || [[ "${_ARGS}" =~ "ssh " ]] \ || [[ "${_ARGS}" =~ "svn " ]] \ || [[ "${_ARGS}" =~ "tar " ]] \ || [[ "${_ARGS}" =~ "wget " ]] \ || [[ "${_ARGS}" =~ "wkhtmltoimage" ]] \ || [[ "${_ARGS}" =~ "wkhtmltopdf" ]]; then _SILENT=YES else echo fi fi fi fi if [ "${_IN_PATH}" = "YES" ]; then if [ -x "/usr/local/bin/ruby" ] && [ -x "/usr/local/bin/gem" ]; then if [[ $(whoami) == *.ftp ]] || [ ! -z "${SSH_CLIENT}" ]; then _RUBY_ALLOW=YES fi fi if [ "${_RUBY_ALLOW}" = "YES" ]; then if [ -d "/opt/user/gems/${USER}" ]; then export GEM_HOME="/opt/user/gems/${USER}" export GEM_PATH="/opt/user/gems/${USER}" export PATH="/opt/user/gems/${USER}/bin:$PATH" fi fi if [ -x "/usr/bin/npm" ] && [ -e "/home/${USER}/.npmrc" ]; then if [[ $(whoami) == *.ftp ]] || [ ! -z "${SSH_CLIENT}" ]; then _NPM_ALLOW=YES fi fi if [ "${_NPM_ALLOW}" = "YES" ]; then if [ -d "/opt/user/npm/${USER}" ]; then export NPM_PACKAGES="/opt/user/npm/${USER}/.npm-packages" export PATH="${NPM_PACKAGES}/bin:${PATH}" export NODE_PATH="${NPM_PACKAGES}/lib/node_modules:${NODE_PATH}" fi fi if [ "$0" = "/bin/sh" ] \ || [ "$0" = "/usr/bin/sh" ] \ || [ "$0" = "/opt/local/bin/websh" ] \ || [ "$0" = "/bin/websh" ]; then if [ -x "/bin/dash" ]; then if [ ! -z "${_ARR}" ] && [ -z "${_OCTO_SYS_ARR}" ]; then _DEST_DRUSH=${_DEST_DRUSH//\\/} ### echo EXD 1 DRUSH_PHP is ${DRUSH_PHP} ### echo EXD 1 PHP_INI is ${PHP_INI} ### echo EXD 1 _DEST_DRUSH is ${_DEST_DRUSH} ### echo EXD 1 _ARR is ${_ARR} ### echo EXD 1 ${DRUSH_PHP} ${_DEST_DRUSH} ${_ARR} exec /bin/dash -c "${DRUSH_PHP} ${_DEST_DRUSH} ${_ARR}" exit 0 elif [ ! -z "${PHP_FWD}" ] && [ ! -z "${_OCTO_SYS_ARR}" ]; then _DEST_DRUSH=${_DEST_DRUSH//\\/} ### echo EXD 3-PHP_FWD DRUSH_PHP is ${DRUSH_PHP} ### echo EXD 3-PHP_FWD PHP_INI is ${PHP_INI} ### echo EXD 3-PHP_FWD _DEST_DRUSH is ${_DEST_DRUSH} ### echo EXD 3-PHP_FWD _OCTO_SYS_ARR is ${_OCTO_SYS_ARR} ### echo EXD 3-PHP_FWD ${DRUSH_PHP} ${_DEST_DRUSH} ${_OCTO_SYS_ARR} exec /bin/dash -c "${DRUSH_PHP} ${_DEST_DRUSH} ${_OCTO_SYS_ARR}" exit 0 elif [ -z "${PHP_FWD}" ] && [ ! -z "${_OCTO_SYS_ARR}" ]; then _DEST_DRUSH=${_DEST_DRUSH//\\/} ### echo EXD 3-NO-PHP_FWD DRUSH_PHP is ${DRUSH_PHP} ### echo EXD 3-NO-PHP_FWD PHP_INI is ${PHP_INI} ### echo EXD 3-NO-PHP_FWD _DEST_DRUSH is ${_DEST_DRUSH} ### echo EXD 3-NO-PHP_FWD _OCTO_SYS_ARR is ${_OCTO_SYS_ARR} ### echo EXD 3-NO-PHP_FWD ${DRUSH_PHP} ${_DEST_DRUSH} ${_OCTO_SYS_ARR} exec /bin/dash -c "${DRUSH_PHP} ${_DEST_DRUSH} ${_OCTO_SYS_ARR}" exit 0 elif [ ! -z "${_C_ARR}" ]; then ### echo EXC 1 DRUSH_PHP is ${DRUSH_PHP} ### echo EXC 1 _C_ARR is ${_C_ARR} ### echo EXC 1 _F_ARR is "$@" ### echo EXC 1 ${DRUSH_PHP} /usr/local/bin/composer ${_C_ARR} exec /bin/dash -c "${DRUSH_PHP} /usr/local/bin/composer ${_C_ARR}" exit 0 else ### echo EXH 1 _forward_to_dash "$@" _forward_to_dash "$@" exit 0 fi else ### echo EXH 3 _F_ARR is "$@" ### echo EXH 3 /bin/bash "$@" exec /bin/bash "$@" exit 0 fi else ### echo EXO 1 _F_ARR is "$@" ### echo EXO 1 $0 "$@" exec $0 "$@" exit 0 fi else exit 1 fi else if [ "${USER}" = "root" ]; then if [[ "${1}" =~ "drush" ]] \ || [[ "${2}" =~ "drush" ]]; then if [[ "${2}" =~ "uli" ]] \ || [[ "${2}" =~ "vget" ]] \ || [[ "${2}" =~ "config-list" ]] \ || [[ "${2}" =~ "config-edit" ]] \ || [[ "${2}" =~ "config-get" ]] \ || [[ "${2}" =~ "config-set" ]] \ || [[ "${2}" =~ "--version" ]] \ || [[ "${2}" =~ "vset" ]] \ || [[ "${2}" =~ "status" ]]; then _ALLOW=YES else echo echo " Drush should never be run as root!" echo " Please su to some non-root account" echo exit 0 fi fi fi if [ "$0" = "/bin/sh" ] \ || [ "$0" = "/usr/bin/sh" ] \ || [ "$0" = "/opt/local/bin/websh" ] \ || [ "$0" = "/bin/websh" ]; then if [ -x "/bin/dash" ]; then ### echo EXH 4 _F_ARR is "$@" ### echo EXH 4 /bin/dash "$@" exec /bin/dash "$@" exit 0 else ### echo EXH 6 _F_ARR is "$@" ### echo EXH 6 /bin/bash "$@" exec /bin/bash "$@" exit 0 fi else ### echo EXO 2 _F_ARR is "$@" ### echo EXO 2 $0 "$@" exec $0 "$@" exit 0 fi exit 0 fi ================================================ FILE: aegir/makefiles/civicrm-4.5-d6.make ================================================ ; CiviCRM 4.5-d6 master makefile ; api = 2 core = 6.x projects[pressflow][type] = "core" projects[pressflow][download][type] = "get" projects[pressflow][download][url] = "http://files.aegir.cc/core/pressflow-6.60.1.tar.gz" projects[civicrm][type] = "module" projects[civicrm][directory_name] = "civicrm" projects[civicrm][download][type] = "get" projects[civicrm][download][url] = "http://sourceforge.net/projects/civicrm/files/civicrm-stable/4.5.8/civicrm-4.5.8-drupal6.tar.gz/download?use_mirror=autoselect" projects[civicrm_l10n][type] = "module" projects[civicrm_l10n][subdir] = "civicrm" projects[civicrm_l10n][download][type] = "get" projects[civicrm_l10n][download][url] = "http://sourceforge.net/projects/civicrm/files/civicrm-stable/4.5.8/civicrm-4.5.8-l10n.tar.gz/download?use_mirror=autoselect" projects[civicrm_l10n][overwrite] = TRUE projects[civicrm_theme][type] = "theme" projects[civicrm_theme][subdir] = "contrib" projects[civicrm_theme][version] = "1.4" projects[admin_menu][type] = "module" projects[admin_menu][subdir] = "contrib" projects[admin_menu][version] = "1.8" ================================================ FILE: aegir/makefiles/civicrm-4.5-d7.make ================================================ ; CiviCRM 4.5-d7 master makefile ; api = 2 core = 7.x projects[drupal][type] = "core" projects[drupal][download][type] = "get" projects[drupal][download][url] = "http://files.aegir.cc/core/drupal-7.105.1.tar.gz" projects[civicrm][type] = "module" projects[civicrm][directory_name] = "civicrm" projects[civicrm][download][type] = "get" projects[civicrm][download][url] = "http://sourceforge.net/projects/civicrm/files/civicrm-stable/4.5.8/civicrm-4.5.8-drupal.tar.gz/download?use_mirror=autoselect" projects[civicrml10n][type] = "module" projects[civicrml10n][subdir] = "civicrm" projects[civicrml10n][download][type] = "get" projects[civicrml10n][download][url] = "http://sourceforge.net/projects/civicrm/files/civicrm-stable/4.5.8/civicrm-4.5.8-l10n.tar.gz/download?use_mirror=autoselect" projects[admin_menu][type] = "module" projects[admin_menu][subdir] = "contrib" projects[admin_menu][version] = "3.0-rc6" ================================================ FILE: aegir/makefiles/civicrm-4.6-d6.make ================================================ ; CiviCRM 4.6-d6 master makefile ; api = 2 core = 6.x projects[pressflow][type] = "core" projects[pressflow][download][type] = "get" projects[pressflow][download][url] = "http://files.aegir.cc/core/pressflow-6.60.1.tar.gz" projects[civicrm][type] = "module" projects[civicrm][directory_name] = "civicrm" projects[civicrm][download][type] = "get" projects[civicrm][download][url] = "http://sourceforge.net/projects/civicrm/files/civicrm-stable/4.6.37/civicrm-4.6.37-drupal6.tar.gz/download?use_mirror=autoselect" projects[civicrm_l10n][type] = "module" projects[civicrm_l10n][subdir] = "civicrm" projects[civicrm_l10n][download][type] = "get" projects[civicrm_l10n][download][url] = "http://sourceforge.net/projects/civicrm/files/civicrm-stable/4.6.37/civicrm-4.6.37-l10n.tar.gz/download?use_mirror=autoselect" projects[civicrm_l10n][overwrite] = TRUE projects[civicrm_theme][type] = "theme" projects[civicrm_theme][subdir] = "contrib" projects[civicrm_theme][version] = "1.4" projects[admin_menu][type] = "module" projects[admin_menu][subdir] = "contrib" projects[admin_menu][version] = "1.8" ================================================ FILE: aegir/makefiles/civicrm-4.6-d7.make ================================================ ; CiviCRM 4.6-d7 master makefile ; api = 2 core = 7.x projects[drupal][type] = "core" projects[drupal][download][type] = "get" projects[drupal][download][url] = "http://files.aegir.cc/core/drupal-7.105.1.tar.gz" projects[civicrm][type] = "module" projects[civicrm][directory_name] = "civicrm" projects[civicrm][download][type] = "get" projects[civicrm][download][url] = "http://sourceforge.net/projects/civicrm/files/civicrm-stable/4.6.37/civicrm-4.6.37-drupal.tar.gz/download?use_mirror=autoselect" projects[civicrml10n][type] = "module" projects[civicrml10n][subdir] = "civicrm" projects[civicrml10n][download][type] = "get" projects[civicrml10n][download][url] = "http://sourceforge.net/projects/civicrm/files/civicrm-stable/4.6.37/civicrm-4.6.37-l10n.tar.gz/download?use_mirror=autoselect" projects[admin_menu][type] = "module" projects[admin_menu][subdir] = "contrib" projects[admin_menu][version] = "3.0-rc6" ================================================ FILE: aegir/makefiles/civicrm-4.7-d6.make ================================================ ; CiviCRM 4.7-d6 master makefile ; api = 2 core = 6.x projects[pressflow][type] = "core" projects[pressflow][download][type] = "get" projects[pressflow][download][url] = "http://files.aegir.cc/core/pressflow-6.60.1.tar.gz" projects[civicrm][type] = "module" projects[civicrm][directory_name] = "civicrm" projects[civicrm][download][type] = "get" projects[civicrm][download][url] = "http://sourceforge.net/projects/civicrm/files/civicrm-stable/4.7.31/civicrm-4.7.31-drupal6.tar.gz/download?use_mirror=autoselect" projects[civicrm_l10n][type] = "module" projects[civicrm_l10n][subdir] = "civicrm" projects[civicrm_l10n][download][type] = "get" projects[civicrm_l10n][download][url] = "http://sourceforge.net/projects/civicrm/files/civicrm-stable/4.7.31/civicrm-4.7.31-l10n.tar.gz/download?use_mirror=autoselect" projects[civicrm_l10n][overwrite] = TRUE projects[civicrm_theme][type] = "theme" projects[civicrm_theme][subdir] = "contrib" projects[civicrm_theme][version] = "1.4" projects[admin_menu][type] = "module" projects[admin_menu][subdir] = "contrib" projects[admin_menu][version] = "1.8" ================================================ FILE: aegir/makefiles/civicrm-4.7-d7.make ================================================ ; CiviCRM 4.7-d7 master makefile ; api = 2 core = 7.x projects[drupal][type] = "core" projects[drupal][download][type] = "get" projects[drupal][download][url] = "http://files.aegir.cc/core/drupal-7.105.1.tar.gz" projects[civicrm][type] = "module" projects[civicrm][directory_name] = "civicrm" projects[civicrm][download][type] = "get" projects[civicrm][download][url] = "http://sourceforge.net/projects/civicrm/files/civicrm-stable/4.7.31/civicrm-4.7.31-drupal.tar.gz/download?use_mirror=autoselect" projects[civicrml10n][type] = "module" projects[civicrml10n][subdir] = "civicrm" projects[civicrml10n][download][type] = "get" projects[civicrml10n][download][url] = "http://sourceforge.net/projects/civicrm/files/civicrm-stable/4.7.31/civicrm-4.7.31-l10n.tar.gz/download?use_mirror=autoselect" projects[admin_menu][type] = "module" projects[admin_menu][subdir] = "contrib" projects[admin_menu][version] = "3.0-rc6" ================================================ FILE: aegir/makefiles/civicrm-5.0-d6.make ================================================ ; CiviCRM 5.0-d6 master makefile ; api = 2 core = 6.x projects[pressflow][type] = "core" projects[pressflow][download][type] = "get" projects[pressflow][download][url] = "http://files.aegir.cc/core/pressflow-6.60.1.tar.gz" projects[civicrm][type] = "module" projects[civicrm][directory_name] = "civicrm" projects[civicrm][download][type] = "get" projects[civicrm][download][url] = "http://sourceforge.net/projects/civicrm/files/civicrm-stable/5.0.2/civicrm-5.0.2-drupal6.tar.gz/download?use_mirror=autoselect" projects[civicrm_l10n][type] = "module" projects[civicrm_l10n][subdir] = "civicrm" projects[civicrm_l10n][download][type] = "get" projects[civicrm_l10n][download][url] = "http://sourceforge.net/projects/civicrm/files/civicrm-stable/5.0.2/civicrm-5.0.2-l10n.tar.gz/download?use_mirror=autoselect" projects[civicrm_l10n][overwrite] = TRUE projects[civicrm_theme][type] = "theme" projects[civicrm_theme][subdir] = "contrib" projects[civicrm_theme][version] = "1.4" projects[admin_menu][type] = "module" projects[admin_menu][subdir] = "contrib" projects[admin_menu][version] = "1.8" ================================================ FILE: aegir/makefiles/civicrm-5.0-d7.make ================================================ ; CiviCRM 5.0-d7 master makefile ; api = 2 core = 7.x projects[drupal][type] = "core" projects[drupal][download][type] = "get" projects[drupal][download][url] = "http://files.aegir.cc/core/drupal-7.105.1.tar.gz" projects[civicrm][type] = "module" projects[civicrm][directory_name] = "civicrm" projects[civicrm][download][type] = "get" projects[civicrm][download][url] = "http://sourceforge.net/projects/civicrm/files/civicrm-stable/5.0.2/civicrm-5.0.2-drupal.tar.gz/download?use_mirror=autoselect" projects[civicrml10n][type] = "module" projects[civicrml10n][subdir] = "civicrm" projects[civicrml10n][download][type] = "get" projects[civicrml10n][download][url] = "http://sourceforge.net/projects/civicrm/files/civicrm-stable/5.0.2/civicrm-5.0.2-l10n.tar.gz/download?use_mirror=autoselect" projects[admin_menu][type] = "module" projects[admin_menu][subdir] = "contrib" projects[admin_menu][version] = "3.0-rc6" ================================================ FILE: aegir/makefiles/civicrm-5.1-d7.make ================================================ ; CiviCRM 5.1-d7 master makefile ; api = 2 core = 7.x projects[drupal][type] = "core" projects[drupal][download][type] = "get" projects[drupal][download][url] = "http://files.aegir.cc/core/drupal-7.105.1.tar.gz" projects[civicrm][type] = "module" projects[civicrm][directory_name] = "civicrm" projects[civicrm][download][type] = "get" projects[civicrm][download][url] = "http://sourceforge.net/projects/civicrm/files/civicrm-stable/5.1.2/civicrm-5.1.2-drupal.tar.gz/download?use_mirror=autoselect" projects[civicrml10n][type] = "module" projects[civicrml10n][subdir] = "civicrm" projects[civicrml10n][download][type] = "get" projects[civicrml10n][download][url] = "http://sourceforge.net/projects/civicrm/files/civicrm-stable/5.1.2/civicrm-5.1.2-l10n.tar.gz/download?use_mirror=autoselect" projects[admin_menu][type] = "module" projects[admin_menu][subdir] = "contrib" projects[admin_menu][version] = "3.0-rc6" ================================================ FILE: aegir/makefiles/civicrm-5.2-d7.make ================================================ ; CiviCRM 5.2-d7 master makefile ; api = 2 core = 7.x projects[drupal][type] = "core" projects[drupal][download][type] = "get" projects[drupal][download][url] = "http://files.aegir.cc/core/drupal-7.105.1.tar.gz" projects[civicrm][type] = "module" projects[civicrm][directory_name] = "civicrm" projects[civicrm][download][type] = "get" projects[civicrm][download][url] = "http://sourceforge.net/projects/civicrm/files/civicrm-stable/5.2.2/civicrm-5.2.2-drupal.tar.gz/download?use_mirror=autoselect" projects[civicrml10n][type] = "module" projects[civicrml10n][subdir] = "civicrm" projects[civicrml10n][download][type] = "get" projects[civicrml10n][download][url] = "http://sourceforge.net/projects/civicrm/files/civicrm-stable/5.2.2/civicrm-5.2.2-l10n.tar.gz/download?use_mirror=autoselect" projects[admin_menu][type] = "module" projects[admin_menu][subdir] = "contrib" projects[admin_menu][version] = "3.0-rc6" ================================================ FILE: aegir/makefiles/civicrm-5.3-d7.make ================================================ ; CiviCRM 5.3-d7 master makefile ; api = 2 core = 7.x projects[drupal][type] = "core" projects[drupal][download][type] = "get" projects[drupal][download][url] = "http://files.aegir.cc/core/drupal-7.105.1.tar.gz" projects[civicrm][type] = "module" projects[civicrm][directory_name] = "civicrm" projects[civicrm][download][type] = "get" projects[civicrm][download][url] = "http://sourceforge.net/projects/civicrm/files/civicrm-stable/5.3.0/civicrm-5.3.0-drupal.tar.gz/download?use_mirror=autoselect" projects[civicrml10n][type] = "module" projects[civicrml10n][subdir] = "civicrm" projects[civicrml10n][download][type] = "get" projects[civicrml10n][download][url] = "http://sourceforge.net/projects/civicrm/files/civicrm-stable/5.3.0/civicrm-5.3.0-l10n.tar.gz/download?use_mirror=autoselect" projects[admin_menu][type] = "module" projects[admin_menu][subdir] = "contrib" projects[admin_menu][version] = "3.0-rc6" ================================================ FILE: aegir/makefiles/civicrm-5.35-d7.make ================================================ ; CiviCRM 5.35-d7 master makefile ; api = 2 core = 7.x projects[drupal][type] = "core" projects[drupal][download][type] = "get" projects[drupal][download][url] = "http://files.aegir.cc/core/drupal-7.105.1.tar.gz" projects[civicrm][type] = "module" projects[civicrm][directory_name] = "civicrm" projects[civicrm][download][type] = "get" projects[civicrm][download][url] = "https://download.civicrm.org/civicrm-5.35.0-drupal.tar.gz" projects[civicrml10n][type] = "module" projects[civicrml10n][subdir] = "civicrm" projects[civicrml10n][download][type] = "get" projects[civicrml10n][download][url] = "https://download.civicrm.org/civicrm-5.35.0-l10n.tar.gz" projects[admin_menu][type] = "module" projects[admin_menu][subdir] = "contrib" projects[admin_menu][version] = "3.0-rc6" ================================================ FILE: aegir/makefiles/civicrm-5.9-d7.make ================================================ ; CiviCRM 5.9-d7 master makefile ; api = 2 core = 7.x projects[drupal][type] = "core" projects[drupal][download][type] = "get" projects[drupal][download][url] = "http://files.aegir.cc/core/drupal-7.105.1.tar.gz" projects[civicrm][type] = "module" projects[civicrm][directory_name] = "civicrm" projects[civicrm][download][type] = "get" projects[civicrm][download][url] = "http://sourceforge.net/projects/civicrm/files/civicrm-stable/5.9.0/civicrm-5.9.0-drupal.tar.gz/download?use_mirror=autoselect" projects[civicrml10n][type] = "module" projects[civicrml10n][subdir] = "civicrm" projects[civicrml10n][download][type] = "get" projects[civicrml10n][download][url] = "http://sourceforge.net/projects/civicrm/files/civicrm-stable/5.9.0/civicrm-5.9.0-l10n.tar.gz/download?use_mirror=autoselect" projects[admin_menu][type] = "module" projects[admin_menu][subdir] = "contrib" projects[admin_menu][version] = "3.0-rc6" ================================================ FILE: aegir/patches/0001-Print-site_footer-if-defined.patch ================================================ From c22f1e9aa41010d91f3105628a8652ef42e12efa Mon Sep 17 00:00:00 2001 From: Barracuda Team Date: Sat, 16 Apr 2016 18:11:35 +0200 Subject: [PATCH] Print $site_footer if defined --- page.tpl.php | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/page.tpl.php b/page.tpl.php index 6a68dc4..a7eda81 100644 --- a/page.tpl.php +++ b/page.tpl.php @@ -51,6 +51,11 @@ ', format_string('Contextual link placeholder with id @id exists.', ['@id' => $cached_id])); + $this->assertRaw(' $id, 'data-contextual-token' => $id_token]) . '>', format_string('Contextual link placeholder with id @id exists.', ['@id' => $id])); + $this->assertRaw(' $cached_id, 'data-contextual-token' => $cached_id_token]) . '>', format_string('Contextual link placeholder with id @id exists.', ['@id' => $cached_id])); // Get server-rendered contextual links. // @see \Drupal\contextual\Tests\ContextualDynamicContextTest:renderContextualLinks() - $post = ['ids[0]' => $id, 'ids[1]' => $cached_id]; + $post = ['ids[0]' => $id, 'ids[1]' => $cached_id, 'tokens[0]' => $id_token, 'tokens[1]' => $cached_id_token]; $url = 'contextual/render?_format=json,destination=test-page'; $this->getSession()->getDriver()->getClient()->request('POST', $url, $post); $this->assertResponse(200); diff --git a/core/modules/content_moderation/src/Plugin/Validation/Constraint/ModerationStateConstraint.php b/core/modules/content_moderation/src/Plugin/Validation/Constraint/ModerationStateConstraint.php index 7f7c756b6b..4fcde36059 100644 --- a/core/modules/content_moderation/src/Plugin/Validation/Constraint/ModerationStateConstraint.php +++ b/core/modules/content_moderation/src/Plugin/Validation/Constraint/ModerationStateConstraint.php @@ -16,5 +16,6 @@ class ModerationStateConstraint extends Constraint { public $message = 'Invalid state transition from %from to %to'; public $invalidStateMessage = 'State %state does not exist on %workflow workflow'; + public $invalidTransitionAccess = 'You do not have access to transition from %original_state to %new_state'; } diff --git a/core/modules/content_moderation/src/Plugin/Validation/Constraint/ModerationStateConstraintValidator.php b/core/modules/content_moderation/src/Plugin/Validation/Constraint/ModerationStateConstraintValidator.php index 65fc2a0c50..c3b9c815fe 100644 --- a/core/modules/content_moderation/src/Plugin/Validation/Constraint/ModerationStateConstraintValidator.php +++ b/core/modules/content_moderation/src/Plugin/Validation/Constraint/ModerationStateConstraintValidator.php @@ -2,10 +2,13 @@ namespace Drupal\content_moderation\Plugin\Validation\Constraint; +use Drupal\content_moderation\StateTransitionValidationInterface; use Drupal\Core\DependencyInjection\ContainerInjectionInterface; +use Drupal\Core\Entity\ContentEntityInterface; use Drupal\Core\Entity\EntityInterface; use Drupal\Core\Entity\EntityTypeManagerInterface; use Drupal\content_moderation\ModerationInformationInterface; +use Drupal\Core\Session\AccountInterface; use Symfony\Component\DependencyInjection\ContainerInterface; use Symfony\Component\Validator\Constraint; use Symfony\Component\Validator\ConstraintValidator; @@ -29,6 +32,20 @@ class ModerationStateConstraintValidator extends ConstraintValidator implements */ protected $moderationInformation; + /** + * The current user. + * + * @var \Drupal\Core\Session\AccountInterface + */ + protected $currentUser; + + /** + * The state transition validation service. + * + * @var \Drupal\content_moderation\StateTransitionValidationInterface + */ + protected $stateTransitionValidation; + /** * Creates a new ModerationStateConstraintValidator instance. * @@ -36,10 +53,16 @@ class ModerationStateConstraintValidator extends ConstraintValidator implements * The entity type manager. * @param \Drupal\content_moderation\ModerationInformationInterface $moderation_information * The moderation information. + * @param \Drupal\Core\Session\AccountInterface $current_user + * The current user. + * @param \Drupal\content_moderation\StateTransitionValidationInterface $state_transition_validation + * The state transition validation service. */ - public function __construct(EntityTypeManagerInterface $entity_type_manager, ModerationInformationInterface $moderation_information) { + public function __construct(EntityTypeManagerInterface $entity_type_manager, ModerationInformationInterface $moderation_information, AccountInterface $current_user, StateTransitionValidationInterface $state_transition_validation) { $this->entityTypeManager = $entity_type_manager; $this->moderationInformation = $moderation_information; + $this->currentUser = $current_user; + $this->stateTransitionValidation = $state_transition_validation; } /** @@ -48,7 +71,9 @@ public function __construct(EntityTypeManagerInterface $entity_type_manager, Mod public static function create(ContainerInterface $container) { return new static( $container->get('entity_type.manager'), - $container->get('content_moderation.moderation_information') + $container->get('content_moderation.moderation_information'), + $container->get('current_user'), + $container->get('content_moderation.state_transition_validation') ); } @@ -76,32 +101,59 @@ public function validate($value, Constraint $constraint) { return; } + $new_state = $workflow->getTypePlugin()->getState($entity->moderation_state->value); + $original_state = $this->getOriginalOrInitialState($entity); + // If a new state is being set and there is an existing state, validate // there is a valid transition between them. + if (!$original_state->canTransitionTo($new_state->id())) { + $this->context->addViolation($constraint->message, [ + '%from' => $original_state->label(), + '%to' => $new_state->label(), + ]); + } + else { + // If we're sure the transition exists, make sure the user has permission + // to use it. + if (!$this->stateTransitionValidation->isTransitionValid($workflow, $original_state, $new_state, $this->currentUser)) { + $this->context->addViolation($constraint->invalidTransitionAccess, [ + '%original_state' => $original_state->label(), + '%new_state' => $new_state->label(), + ]); + } + } + } + + /** + * Gets the original or initial state of the given entity. + * + * When a state is being validated, the original state is used to validate + * that a valid transition exists for target state and the user has access + * to the transition between those two states. If the entity has been + * moderated before, we can load the original unmodified revision and + * translation for this state. + * + * If the entity is new we need to load the initial state from the workflow. + * Even if a value was assigned to the moderation_state field, the initial + * state is used to compute an appropriate transition for the purposes of + * validation. + * + * @return \Drupal\workflows\StateInterface + * The original or default moderation state. + */ + protected function getOriginalOrInitialState(ContentEntityInterface $entity) { + $state = NULL; + $workflow_type = $this->moderationInformation->getWorkflowForEntity($entity)->getTypePlugin(); if (!$entity->isNew() && !$this->isFirstTimeModeration($entity)) { $original_entity = $this->entityTypeManager->getStorage($entity->getEntityTypeId())->loadRevision($entity->getLoadedRevisionId()); if (!$entity->isDefaultTranslation() && $original_entity->hasTranslation($entity->language()->getId())) { $original_entity = $original_entity->getTranslation($entity->language()->getId()); } - - // If the state of the original entity doesn't exist on the workflow, - // we cannot do any further validation of transitions, because none will - // be setup for a state that doesn't exist. Instead allow any state to - // take its place. - if (!$workflow->getTypePlugin()->hasState($original_entity->moderation_state->value)) { - return; - } - - $new_state = $workflow->getTypePlugin()->getState($entity->moderation_state->value); - $original_state = $workflow->getTypePlugin()->getState($original_entity->moderation_state->value); - - if (!$original_state->canTransitionTo($new_state->id())) { - $this->context->addViolation($constraint->message, [ - '%from' => $original_state->label(), - '%to' => $new_state->label(), - ]); + if ($workflow_type->hasState($original_entity->moderation_state->value)) { + $state = $workflow_type->getState($original_entity->moderation_state->value); } } + return $state ?: $workflow_type->getInitialState($entity); } /** diff --git a/core/modules/content_moderation/src/StateTransitionValidation.php b/core/modules/content_moderation/src/StateTransitionValidation.php index 01b2ad8458..35d657e550 100644 --- a/core/modules/content_moderation/src/StateTransitionValidation.php +++ b/core/modules/content_moderation/src/StateTransitionValidation.php @@ -4,7 +4,9 @@ use Drupal\Core\Entity\ContentEntityInterface; use Drupal\Core\Session\AccountInterface; +use Drupal\workflows\StateInterface; use Drupal\workflows\Transition; +use Drupal\workflows\WorkflowInterface; /** * Validates whether a certain state transition is allowed. @@ -47,4 +49,12 @@ public function getValidTransitions(ContentEntityInterface $entity, AccountInter }); } + /** + * {@inheritdoc} + */ + public function isTransitionValid(WorkflowInterface $workflow, StateInterface $original_state, StateInterface $new_state, AccountInterface $user) { + $transition = $workflow->getTypePlugin()->getTransitionFromStateToState($original_state->id(), $new_state->id()); + return $user->hasPermission('use ' . $workflow->id() . ' transition ' . $transition->id()); + } + } diff --git a/core/modules/content_moderation/src/StateTransitionValidationInterface.php b/core/modules/content_moderation/src/StateTransitionValidationInterface.php index 1acbf052fd..c793fe53e2 100644 --- a/core/modules/content_moderation/src/StateTransitionValidationInterface.php +++ b/core/modules/content_moderation/src/StateTransitionValidationInterface.php @@ -4,6 +4,8 @@ use Drupal\Core\Entity\ContentEntityInterface; use Drupal\Core\Session\AccountInterface; +use Drupal\workflows\StateInterface; +use Drupal\workflows\WorkflowInterface; /** * Validates whether a certain state transition is allowed. @@ -23,4 +25,21 @@ */ public function getValidTransitions(ContentEntityInterface $entity, AccountInterface $user); + /** + * Checks if a transition between two states if valid for the given user. + * + * @param \Drupal\workflows\WorkflowInterface $workflow + * The workflow entity. + * @param \Drupal\workflows\StateInterface $original_state + * The original workflow state. + * @param \Drupal\workflows\StateInterface $new_state + * The new workflow state. + * @param \Drupal\Core\Session\AccountInterface $user + * The user to validate. + * + * @return bool + * Returns TRUE if transition is valid, otherwise FALSE. + */ + public function isTransitionValid(WorkflowInterface $workflow, StateInterface $original_state, StateInterface $new_state, AccountInterface $user); + } diff --git a/core/modules/content_moderation/tests/src/Functional/ModerationStateNodeTest.php b/core/modules/content_moderation/tests/src/Functional/ModerationStateNodeTest.php index 11deaa72c0..5fd168d0bb 100644 --- a/core/modules/content_moderation/tests/src/Functional/ModerationStateNodeTest.php +++ b/core/modules/content_moderation/tests/src/Functional/ModerationStateNodeTest.php @@ -158,32 +158,15 @@ public function testNoContentModerationPermissions() { ]); $this->drupalLogin($limited_user); - // Check the user can add content, but can't see the moderation state - // select. + // Check the user can see the content entity form, but can't see the + // moderation state select or save the entity form. $this->drupalGet('node/add/moderated_content'); $session_assert->statusCodeEquals(200); $session_assert->fieldNotExists('moderation_state[0][state]'); $this->drupalPostForm(NULL, [ 'title[0][value]' => 'moderated content', ], 'Save'); - - // Manually move the content to archived because the user doesn't have - // permission to do this. - $node = $this->getNodeByTitle('moderated content'); - $node->moderation_state->value = 'archived'; - $node->save(); - - // Check the user can see the current state but not the select. - $this->drupalGet('node/' . $node->id() . '/edit'); - $session_assert->statusCodeEquals(200); - $session_assert->pageTextContains('Archived'); - $session_assert->fieldNotExists('moderation_state[0][state]'); - $this->drupalPostForm(NULL, [], 'Save'); - - // When saving they should still be on the edit form, and see the validation - // error message. - $session_assert->pageTextContains('Edit Moderated content moderated content'); - $session_assert->pageTextContains('Invalid state transition from Archived to Archived'); + $session_assert->pageTextContains('You do not have access to transition from Draft to Draft'); } } diff --git a/core/modules/content_moderation/tests/src/Kernel/EntityStateChangeValidationTest.php b/core/modules/content_moderation/tests/src/Kernel/EntityStateChangeValidationTest.php index dc1e7f6917..df90bf63c8 100644 --- a/core/modules/content_moderation/tests/src/Kernel/EntityStateChangeValidationTest.php +++ b/core/modules/content_moderation/tests/src/Kernel/EntityStateChangeValidationTest.php @@ -7,6 +7,7 @@ use Drupal\node\Entity\Node; use Drupal\node\Entity\NodeType; use Drupal\Tests\content_moderation\Traits\ContentModerationTestTrait; +use Drupal\Tests\user\Traits\UserCreationTrait; /** * @coversDefaultClass \Drupal\content_moderation\Plugin\Validation\Constraint\ModerationStateConstraintValidator @@ -15,6 +16,7 @@ class EntityStateChangeValidationTest extends KernelTestBase { use ContentModerationTestTrait; + use UserCreationTrait; /** * {@inheritdoc} @@ -29,6 +31,13 @@ class EntityStateChangeValidationTest extends KernelTestBase { 'workflows', ]; + /** + * An admin user. + * + * @var \Drupal\Core\Session\AccountInterface + */ + protected $adminUser; + /** * {@inheritdoc} */ @@ -40,6 +49,9 @@ protected function setUp() { $this->installEntitySchema('user'); $this->installEntitySchema('content_moderation_state'); $this->installConfig('content_moderation'); + $this->installSchema('system', ['sequences']); + + $this->adminUser = $this->createUser(array_keys($this->container->get('user.permissions')->getPermissions())); } /** @@ -48,6 +60,8 @@ protected function setUp() { * @covers ::validate */ public function testValidTransition() { + $this->setCurrentUser($this->adminUser); + $node_type = NodeType::create([ 'type' => 'example', ]); @@ -76,6 +90,8 @@ public function testValidTransition() { * @covers ::validate */ public function testInvalidTransition() { + $this->setCurrentUser($this->adminUser); + $node_type = NodeType::create([ 'type' => 'example', ]); @@ -125,6 +141,7 @@ public function testInvalidState() { * Test validation with content that has no initial state or an invalid state. */ public function testInvalidStateWithoutExisting() { + $this->setCurrentUser($this->adminUser); // Create content without moderation enabled for the content type. $node_type = NodeType::create([ 'type' => 'example', @@ -156,15 +173,24 @@ public function testInvalidStateWithoutExisting() { // validating. $workflow->getTypePlugin()->deleteState('deleted_state'); $workflow->save(); + + // When there is an invalid state, the content will revert to "draft". This + // will allow a draft to draft transition. $node->moderation_state->value = 'draft'; $violations = $node->validate(); $this->assertCount(0, $violations); + // This will disallow a draft to archived transition. + $node->moderation_state->value = 'archived'; + $violations = $node->validate(); + $this->assertCount(1, $violations); } /** * Test state transition validation with multiple languages. */ public function testInvalidStateMultilingual() { + $this->setCurrentUser($this->adminUser); + ConfigurableLanguage::createFromLangcode('fr')->save(); $node_type = NodeType::create([ 'type' => 'example', @@ -220,6 +246,8 @@ public function testInvalidStateMultilingual() { * Tests that content without prior moderation information can be moderated. */ public function testExistingContentWithNoModeration() { + $this->setCurrentUser($this->adminUser); + $node_type = NodeType::create([ 'type' => 'example', ]); @@ -254,6 +282,8 @@ public function testExistingContentWithNoModeration() { * Tests that content without prior moderation information can be translated. */ public function testExistingMultilingualContentWithNoModeration() { + $this->setCurrentUser($this->adminUser); + // Enable French. ConfigurableLanguage::createFromLangcode('fr')->save(); @@ -293,4 +323,81 @@ public function testExistingMultilingualContentWithNoModeration() { $node_fr->save(); } + /** + * @dataProvider transitionAccessValidationTestCases + */ + public function testTransitionAccessValidation($permissions, $target_state, $messages) { + $node_type = NodeType::create([ + 'type' => 'example', + ]); + $node_type->save(); + $workflow = $this->createEditorialWorkflow(); + $workflow->getTypePlugin()->addState('foo', 'Foo'); + $workflow->getTypePlugin()->addTransition('draft_to_foo', 'Draft to foo', ['draft'], 'foo'); + $workflow->getTypePlugin()->addTransition('foo_to_foo', 'Foo to foo', ['foo'], 'foo'); + $workflow->getTypePlugin()->addEntityTypeAndBundle('node', 'example'); + $workflow->save(); + + $this->setCurrentUser($this->createUser($permissions)); + + $node = Node::create([ + 'type' => 'example', + 'title' => 'Test content', + 'moderation_state' => $target_state, + ]); + $this->assertTrue($node->isNew()); + $violations = $node->validate(); + $this->assertCount(count($messages), $violations); + foreach ($messages as $i => $message) { + $this->assertEquals($message, $violations->get($i)->getMessage()); + } + } + + /** + * Test cases for ::testTransitionAccessValidation. + */ + public function transitionAccessValidationTestCases() { + return [ + 'Invalid transition, no permissions validated' => [ + [], + 'archived', + ['Invalid state transition from Draft to Archived'], + ], + 'Valid transition, missing permission' => [ + [], + 'published', + ['You do not have access to transition from Draft to Published'], + ], + 'Valid transition, granted published permission' => [ + ['use editorial transition publish'], + 'published', + [], + ], + 'Valid transition, granted draft permission' => [ + ['use editorial transition create_new_draft'], + 'draft', + [], + ], + 'Valid transition, incorrect permission granted' => [ + ['use editorial transition create_new_draft'], + 'published', + ['You do not have access to transition from Draft to Published'], + ], + // Test with an additional state and set of transitions, since the + // "published" transition can start from either "draft" or "published", it + // does not capture bugs that fail to correctly distinguish the initial + // workflow state from the set state of a new entity. + 'Valid transition, granted foo permission' => [ + ['use editorial transition draft_to_foo'], + 'foo', + [], + ], + 'Valid transition, incorrect foo permission granted' => [ + ['use editorial transition foo_to_foo'], + 'foo', + ['You do not have access to transition from Draft to Foo'], + ], + ]; + } + } diff --git a/core/modules/contextual/contextual.module b/core/modules/contextual/contextual.module index b9d61b76d2..8b9fc36fd7 100644 --- a/core/modules/contextual/contextual.module +++ b/core/modules/contextual/contextual.module @@ -191,13 +191,19 @@ function _contextual_links_to_id($contextual_links) { /** * Unserializes the result of _contextual_links_to_id(). * - * @see _contextual_links_to_id + * Note that $id is user input. Before calling this method the ID should be + * checked against the token stored in the 'data-contextual-token' attribute + * which is passed via the 'tokens' request parameter to + * \Drupal\contextual\ContextualController::render(). * * @param string $id * A serialized representation of a #contextual_links property value array. * * @return array * The value for a #contextual_links property. + * + * @see _contextual_links_to_id() + * @see \Drupal\contextual\ContextualController::render() */ function _contextual_id_to_links($id) { $contextual_links = []; diff --git a/core/modules/contextual/contextual.post_update.php b/core/modules/contextual/contextual.post_update.php new file mode 100644 index 0000000000..8decad05f0 --- /dev/null +++ b/core/modules/contextual/contextual.post_update.php @@ -0,0 +1,14 @@ + { - const html = storage.getItem(`Drupal.contextual.${contextualID}`); + const uncachedIDs = []; + const uncachedTokens = []; + ids.forEach(contextualID => { + const html = storage.getItem(`Drupal.contextual.${contextualID.id}`); if (html && html.length) { // Initialize after the current execution cycle, to make the AJAX // request for retrieving the uncached contextual links as soon as @@ -182,13 +186,14 @@ // Drupal.contextual.collection. window.setTimeout(() => { initContextual( - $context.find(`[data-contextual-id="${contextualID}"]`), + $context.find(`[data-contextual-id="${contextualID.id}"]`), html, ); }); - return false; + return; } - return true; + uncachedIDs.push(contextualID.id); + uncachedTokens.push(contextualID.token); }); // Perform an AJAX request to let the server render the contextual links @@ -197,7 +202,7 @@ $.ajax({ url: Drupal.url('contextual/render'), type: 'POST', - data: { 'ids[]': uncachedIDs }, + data: { 'ids[]': uncachedIDs, 'tokens[]': uncachedTokens }, dataType: 'json', success(results) { _.each(results, (html, contextualID) => { diff --git a/core/modules/contextual/js/contextual.js b/core/modules/contextual/js/contextual.js index 049233b4e1..d51eba21a9 100644 --- a/core/modules/contextual/js/contextual.js +++ b/core/modules/contextual/js/contextual.js @@ -95,25 +95,31 @@ var ids = []; $placeholders.each(function () { - ids.push($(this).attr('data-contextual-id')); + ids.push({ + id: $(this).attr('data-contextual-id'), + token: $(this).attr('data-contextual-token') + }); }); - var uncachedIDs = _.filter(ids, function (contextualID) { - var html = storage.getItem('Drupal.contextual.' + contextualID); + var uncachedIDs = []; + var uncachedTokens = []; + ids.forEach(function (contextualID) { + var html = storage.getItem('Drupal.contextual.' + contextualID.id); if (html && html.length) { window.setTimeout(function () { - initContextual($context.find('[data-contextual-id="' + contextualID + '"]'), html); + initContextual($context.find('[data-contextual-id="' + contextualID.id + '"]'), html); }); - return false; + return; } - return true; + uncachedIDs.push(contextualID.id); + uncachedTokens.push(contextualID.token); }); if (uncachedIDs.length > 0) { $.ajax({ url: Drupal.url('contextual/render'), type: 'POST', - data: { 'ids[]': uncachedIDs }, + data: { 'ids[]': uncachedIDs, 'tokens[]': uncachedTokens }, dataType: 'json', success: function success(results) { _.each(results, function (html, contextualID) { diff --git a/core/modules/contextual/src/ContextualController.php b/core/modules/contextual/src/ContextualController.php index 58e42ecd6b..d05c6a8527 100644 --- a/core/modules/contextual/src/ContextualController.php +++ b/core/modules/contextual/src/ContextualController.php @@ -2,8 +2,10 @@ namespace Drupal\contextual; +use Drupal\Component\Utility\Crypt; use Drupal\Core\DependencyInjection\ContainerInjectionInterface; use Drupal\Core\Render\RendererInterface; +use Drupal\Core\Site\Settings; use Symfony\Component\DependencyInjection\ContainerInterface; use Symfony\Component\HttpFoundation\JsonResponse; use Symfony\Component\HttpFoundation\Request; @@ -63,8 +65,16 @@ public function render(Request $request) { throw new BadRequestHttpException(t('No contextual ids specified.')); } + $tokens = $request->request->get('tokens'); + if (!isset($tokens)) { + throw new BadRequestHttpException(t('No contextual ID tokens specified.')); + } + $rendered = []; - foreach ($ids as $id) { + foreach ($ids as $key => $id) { + if (!isset($tokens[$key]) || !Crypt::hashEquals($tokens[$key], Crypt::hmacBase64($id, Settings::getHashSalt() . \Drupal::service('private_key')->get()))) { + throw new BadRequestHttpException('Invalid contextual ID specified.'); + } $element = [ '#type' => 'contextual_links', '#contextual_links' => _contextual_id_to_links($id), diff --git a/core/modules/contextual/src/Element/ContextualLinksPlaceholder.php b/core/modules/contextual/src/Element/ContextualLinksPlaceholder.php index 97afde9a24..5e993941a6 100644 --- a/core/modules/contextual/src/Element/ContextualLinksPlaceholder.php +++ b/core/modules/contextual/src/Element/ContextualLinksPlaceholder.php @@ -2,6 +2,8 @@ namespace Drupal\contextual\Element; +use Drupal\Component\Utility\Crypt; +use Drupal\Core\Site\Settings; use Drupal\Core\Template\Attribute; use Drupal\Core\Render\Element\RenderElement; use Drupal\Component\Render\FormattableMarkup; @@ -43,7 +45,12 @@ public function getInfo() { * @see _contextual_links_to_id() */ public static function preRenderPlaceholder(array $element) { - $element['#markup'] = new FormattableMarkup('', ['@attributes' => new Attribute(['data-contextual-id' => $element['#id']])]); + $token = Crypt::hmacBase64($element['#id'], Settings::getHashSalt() . \Drupal::service('private_key')->get()); + $attribute = new Attribute([ + 'data-contextual-id' => $element['#id'], + 'data-contextual-token' => $token, + ]); + $element['#markup'] = new FormattableMarkup('', ['@attributes' => $attribute]); return $element; } diff --git a/core/modules/contextual/tests/src/Functional/ContextualDynamicContextTest.php b/core/modules/contextual/tests/src/Functional/ContextualDynamicContextTest.php index 340b60821f..74a6d504e8 100644 --- a/core/modules/contextual/tests/src/Functional/ContextualDynamicContextTest.php +++ b/core/modules/contextual/tests/src/Functional/ContextualDynamicContextTest.php @@ -3,9 +3,10 @@ namespace Drupal\Tests\contextual\Functional; use Drupal\Component\Serialization\Json; +use Drupal\Component\Utility\Crypt; +use Drupal\Core\Site\Settings; use Drupal\Core\Url; use Drupal\language\Entity\ConfigurableLanguage; -use Drupal\Core\Template\Attribute; use Drupal\Tests\BrowserTestBase; /** @@ -140,17 +141,76 @@ public function testDifferentPermissions() { $this->assertRaw('
  • Edit menu - contextual
    • '); } + /** + * Tests the contextual placeholder content is protected by a token. + */ + public function testTokenProtection() { + $this->drupalLogin($this->editorUser); + + // Create a node that will have a contextual link. + $node1 = $this->drupalCreateNode(['type' => 'article', 'promote' => 1]); + + // Now, on the front page, all article nodes should have contextual links + // placeholders, as should the view that contains them. + $id = 'node:node=' . $node1->id() . ':changed=' . $node1->getChangedTime() . '&langcode=en'; + + // Editor user: can access contextual links and can edit articles. + $this->drupalGet('node'); + $this->assertContextualLinkPlaceHolder($id); + + $http_client = $this->getHttpClient(); + $url = Url::fromRoute('contextual.render', [], [ + 'query' => [ + '_format' => 'json', + 'destination' => 'node', + ], + ])->setAbsolute()->toString(); + + $response = $http_client->request('POST', $url, [ + 'cookies' => $this->getSessionCookies(), + 'form_params' => ['ids' => [$id], 'tokens' => []], + 'http_errors' => FALSE, + ]); + $this->assertEquals('400', $response->getStatusCode()); + $this->assertContains('No contextual ID tokens specified.', (string) $response->getBody()); + + $response = $http_client->request('POST', $url, [ + 'cookies' => $this->getSessionCookies(), + 'form_params' => ['ids' => [$id], 'tokens' => ['wrong_token']], + 'http_errors' => FALSE, + ]); + $this->assertEquals('400', $response->getStatusCode()); + $this->assertContains('Invalid contextual ID specified.', (string) $response->getBody()); + + $response = $http_client->request('POST', $url, [ + 'cookies' => $this->getSessionCookies(), + 'form_params' => ['ids' => [$id], 'tokens' => ['wrong_key' => $this->createContextualIdToken($id)]], + 'http_errors' => FALSE, + ]); + $this->assertEquals('400', $response->getStatusCode()); + $this->assertContains('Invalid contextual ID specified.', (string) $response->getBody()); + + $response = $http_client->request('POST', $url, [ + 'cookies' => $this->getSessionCookies(), + 'form_params' => ['ids' => [$id], 'tokens' => [$this->createContextualIdToken($id)]], + 'http_errors' => FALSE, + ]); + $this->assertEquals('200', $response->getStatusCode()); + } + /** * Asserts that a contextual link placeholder with the given id exists. * * @param string $id * A contextual link id. - * - * @return bool - * The result of the assertion. */ protected function assertContextualLinkPlaceHolder($id) { - return $this->assertRaw(' $id]) . '>', format_string('Contextual link placeholder with id @id exists.', ['@id' => $id])); + $this->assertSession()->elementAttributeContains( + 'css', + 'div[data-contextual-id="' . $id . '"]', + 'data-contextual-token', + $this->createContextualIdToken($id) + ); } /** @@ -158,12 +218,9 @@ protected function assertContextualLinkPlaceHolder($id) { * * @param string $id * A contextual link id. - * - * @return bool - * The result of the assertion. */ protected function assertNoContextualLinkPlaceHolder($id) { - return $this->assertNoRaw(' $id]) . '>', format_string('Contextual link placeholder with id @id does not exist.', ['@id' => $id])); + $this->assertSession()->elementNotExists('css', 'div[data-contextual-id="' . $id . '"]'); } /** @@ -178,6 +235,7 @@ protected function assertNoContextualLinkPlaceHolder($id) { * The response object. */ protected function renderContextualLinks($ids, $current_path) { + $tokens = array_map([$this, 'createContextualIdToken'], $ids); $http_client = $this->getHttpClient(); $url = Url::fromRoute('contextual.render', [], [ 'query' => [ @@ -188,9 +246,22 @@ protected function renderContextualLinks($ids, $current_path) { return $http_client->request('POST', $this->buildUrl($url), [ 'cookies' => $this->getSessionCookies(), - 'form_params' => ['ids' => $ids], + 'form_params' => ['ids' => $ids, 'tokens' => $tokens], 'http_errors' => FALSE, ]); } + /** + * Creates a contextual ID token. + * + * @param string $id + * The contextual ID to create a token for. + * + * @return string + * The contextual ID token. + */ + protected function createContextualIdToken($id) { + return Crypt::hmacBase64($id, Settings::getHashSalt() . $this->container->get('private_key')->get()); + } + } diff --git a/core/modules/node/src/Tests/Views/NodeContextualLinksTest.php b/core/modules/node/src/Tests/Views/NodeContextualLinksTest.php deleted file mode 100644 index dc23d0ce55..0000000000 --- a/core/modules/node/src/Tests/Views/NodeContextualLinksTest.php +++ /dev/null @@ -1,118 +0,0 @@ -drupalCreateContentType(['type' => 'page']); - $this->drupalCreateNode(['promote' => 1]); - $this->drupalGet('node'); - - $user = $this->drupalCreateUser(['administer nodes', 'access contextual links']); - $this->drupalLogin($user); - - $response = $this->renderContextualLinks(['node:node=1:'], 'node'); - $this->assertResponse(200); - $json = Json::decode($response); - $this->setRawContent($json['node:node=1:']); - - // @todo Add these back when the functionality for making Views displays - // appear in contextual links is working again. - // $this->assertLinkByHref('node/1/contextual-links', 0, 'The contextual link to the view was found.'); - // $this->assertLink('Test contextual link', 0, 'The contextual link to the view was found.'); - } - - /** - * Get server-rendered contextual links for the given contextual link ids. - * - * Copied from \Drupal\contextual\Tests\ContextualDynamicContextTest::renderContextualLinks(). - * - * @param array $ids - * An array of contextual link ids. - * @param string $current_path - * The Drupal path for the page for which the contextual links are rendered. - * - * @return string - * The response body. - */ - protected function renderContextualLinks($ids, $current_path) { - // Build POST values. - $post = []; - for ($i = 0; $i < count($ids); $i++) { - $post['ids[' . $i . ']'] = $ids[$i]; - } - - // Serialize POST values. - foreach ($post as $key => $value) { - // Encode according to application/x-www-form-urlencoded - // Both names and values needs to be urlencoded, according to - // http://www.w3.org/TR/html4/interact/forms.html#h-17.13.4.1 - $post[$key] = urlencode($key) . '=' . urlencode($value); - } - $post = implode('&', $post); - - // Perform HTTP request. - return $this->curlExec([ - CURLOPT_URL => \Drupal::url('contextual.render', [], ['absolute' => TRUE, 'query' => ['destination' => $current_path]]), - CURLOPT_POST => TRUE, - CURLOPT_POSTFIELDS => $post, - CURLOPT_HTTPHEADER => [ - 'Accept: application/json', - 'Content-Type: application/x-www-form-urlencoded', - ], - ]); - } - - /** - * Tests if the node page works if Contextual Links is disabled. - * - * All views have Contextual links enabled by default, even with the - * Contextual links module disabled. This tests if no calls are done to the - * Contextual links module by views when it is disabled. - * - * @see https://www.drupal.org/node/2379811 - */ - public function testPageWithDisabledContextualModule() { - \Drupal::service('module_installer')->uninstall(['contextual']); - \Drupal::service('module_installer')->install(['views_ui']); - - // Ensure that contextual links don't get called for admin users. - $admin_user = User::load(1); - $admin_user->setPassword('new_password'); - $admin_user->pass_raw = 'new_password'; - $admin_user->save(); - - $this->drupalCreateContentType(['type' => 'page']); - $this->drupalCreateNode(['promote' => 1]); - - $this->drupalLogin($admin_user); - $this->drupalGet('node'); - } - -} diff --git a/core/modules/node/src/Tests/NodeRevisionsTest.php b/core/modules/node/tests/src/Functional/NodeRevisionsTest.php similarity index 92% rename from core/modules/node/src/Tests/NodeRevisionsTest.php rename to core/modules/node/tests/src/Functional/NodeRevisionsTest.php index fdc929a84c..6b16ce8bdc 100644 --- a/core/modules/node/src/Tests/NodeRevisionsTest.php +++ b/core/modules/node/tests/src/Functional/NodeRevisionsTest.php @@ -1,6 +1,6 @@ assertTrue($node->isDefaultRevision(), 'Third node revision is the default one.'); - // Confirm that the "Edit" and "Delete" contextual links appear for the - // default revision. - $ids = ['node:node=' . $node->id() . ':changed=' . $node->getChangedTime()]; - $json = $this->renderContextualLinks($ids, 'node/' . $node->id()); - $this->verbose($json[$ids[0]]); - - $expected = '
  • Edit
    • '; - $this->assertTrue(strstr($json[$ids[0]], $expected), 'The "Edit" contextual link is shown for the default revision.'); - $expected = '
  • Delete
    • '; - $this->assertTrue(strstr($json[$ids[0]], $expected), 'The "Delete" contextual link is shown for the default revision.'); - // Confirm that revisions revert properly. $this->drupalPostForm("node/" . $node->id() . "/revisions/" . $nodes[1]->getRevisionid() . "/revert", [], t('Revert')); $this->assertRaw(t('@type %title has been reverted to the revision from %revision-date.', [ @@ -188,15 +177,6 @@ public function testRevisions() { $node = node_revision_load($node->getRevisionId()); $this->assertFalse($node->isDefaultRevision(), 'Third node revision is not the default one.'); - // Confirm that "Edit" and "Delete" contextual links don't appear for - // non-default revision. - $ids = ['node_revision::node=' . $node->id() . '&node_revision=' . $node->getRevisionId() . ':']; - $json = $this->renderContextualLinks($ids, 'node/' . $node->id() . '/revisions/' . $node->getRevisionId() . '/view'); - $this->verbose($json[$ids[0]]); - - $this->assertFalse(strstr($json[$ids[0]], '
  • '), 'The "Edit" contextual link is not shown for a non-default revision.'); - $this->assertFalse(strstr($json[$ids[0]], '
  • '), 'The "Delete" contextual link is not shown for a non-default revision.'); - // Confirm revisions delete properly. $this->drupalPostForm("node/" . $node->id() . "/revisions/" . $nodes[1]->getRevisionId() . "/delete", [], t('Delete')); $this->assertRaw(t('Revision from %revision-date of @type %title has been deleted.', [ diff --git a/core/modules/node/src/Tests/NodeTypeTest.php b/core/modules/node/tests/src/Functional/NodeTypeTest.php similarity index 94% rename from core/modules/node/src/Tests/NodeTypeTest.php rename to core/modules/node/tests/src/Functional/NodeTypeTest.php index 9938bb0ab5..84c549e8d5 100644 --- a/core/modules/node/src/Tests/NodeTypeTest.php +++ b/core/modules/node/tests/src/Functional/NodeTypeTest.php @@ -1,11 +1,12 @@ assertSession(); $this->drupalPlaceBlock('system_breadcrumb_block'); $web_user = $this->drupalCreateUser(['bypass node access', 'administer content types', 'administer node fields']); $this->drupalLogin($web_user); @@ -96,8 +99,8 @@ public function testNodeTypeEditing() { // Verify that title and body fields are displayed. $this->drupalGet('node/add/page'); - $this->assertRaw('Title', 'Title field was found.'); - $this->assertRaw('Body', 'Body field was found.'); + $assert->pageTextContains('Title'); + $assert->pageTextContains('Body'); // Rename the title field. $edit = [ @@ -106,8 +109,8 @@ public function testNodeTypeEditing() { $this->drupalPostForm('admin/structure/types/manage/page', $edit, t('Save content type')); $this->drupalGet('node/add/page'); - $this->assertRaw('Foo', 'New title label was displayed.'); - $this->assertNoRaw('Title', 'Old title label was not displayed.'); + $assert->pageTextContains('Foo'); + $assert->pageTextNotContains('Title'); // Change the name and the description. $edit = [ @@ -117,11 +120,11 @@ public function testNodeTypeEditing() { $this->drupalPostForm('admin/structure/types/manage/page', $edit, t('Save content type')); $this->drupalGet('node/add'); - $this->assertRaw('Bar', 'New name was displayed.'); - $this->assertRaw('Lorem ipsum', 'New description was displayed.'); + $assert->pageTextContains('Bar'); + $assert->pageTextContains('Lorem ipsum'); $this->clickLink('Bar'); - $this->assertRaw('Foo', 'Title field was found.'); - $this->assertRaw('Body', 'Body field was found.'); + $assert->pageTextContains('Foo'); + $assert->pageTextContains('Body'); // Change the name through the API /** @var \Drupal\node\NodeTypeInterface $node_type */ @@ -146,7 +149,7 @@ public function testNodeTypeEditing() { ]); // Check that the body field doesn't exist. $this->drupalGet('node/add/page'); - $this->assertNoRaw('Body', 'Body field was not found.'); + $assert->pageTextNotContains('Body'); } /** diff --git a/core/modules/node/src/Tests/PagePreviewTest.php b/core/modules/node/tests/src/Functional/PagePreviewTest.php similarity index 97% rename from core/modules/node/src/Tests/PagePreviewTest.php rename to core/modules/node/tests/src/Functional/PagePreviewTest.php index 2bc9cd3ce1..70305349d4 100644 --- a/core/modules/node/src/Tests/PagePreviewTest.php +++ b/core/modules/node/tests/src/Functional/PagePreviewTest.php @@ -1,6 +1,6 @@ drupalPostForm(NULL, ['field_image[0][alt]' => 'Picture of llamas'], t('Preview')); // Check that the preview is displaying the title, body and term. - $this->assertTitle(t('@title | Drupal', ['@title' => $edit[$title_key]]), 'Basic page title is preview.'); + $expected_title = $edit[$title_key] . ' | Drupal'; + $this->assertSession()->titleEquals($expected_title); $this->assertEscaped($edit[$title_key], 'Title displayed and escaped.'); $this->assertText($edit[$body_key], 'Body displayed.'); $this->assertText($edit[$term_key], 'Term displayed.'); @@ -210,13 +215,13 @@ public function testPagePreview() { $this->assertFieldByName($body_key, $edit[$body_key], 'Body field displayed.'); $this->assertFieldByName($term_key, $edit[$term_key], 'Term field displayed.'); $this->assertFieldByName('field_image[0][alt]', 'Picture of llamas'); - $this->drupalPostAjaxForm(NULL, [], ['field_test_multi_add_more' => t('Add another item')], NULL, [], [], 'node-page-form'); + $this->getSession()->getPage()->pressButton('Add another item'); $this->assertFieldByName('field_test_multi[0][value]'); $this->assertFieldByName('field_test_multi[1][value]'); // Return to page preview to check everything is as expected. $this->drupalPostForm(NULL, [], t('Preview')); - $this->assertTitle(t('@title | Drupal', ['@title' => $edit[$title_key]]), 'Basic page title is preview.'); + $this->assertSession()->titleEquals($expected_title); $this->assertEscaped($edit[$title_key], 'Title displayed and escaped.'); $this->assertText($edit[$body_key], 'Body displayed.'); $this->assertText($edit[$term_key], 'Term displayed.'); @@ -353,8 +358,8 @@ public function testPagePreview() { $this->assertText('Basic page ' . $title . ' has been created.'); $node = $this->drupalGetNodeByTitle($title); $this->drupalGet('node/' . $node->id() . '/edit'); - $this->drupalPostAjaxForm(NULL, [], ['field_test_multi_add_more' => t('Add another item')]); - $this->drupalPostAjaxForm(NULL, [], ['field_test_multi_add_more' => t('Add another item')]); + $this->getSession()->getPage()->pressButton('Add another item'); + $this->getSession()->getPage()->pressButton('Add another item'); $edit = [ 'field_test_multi[1][value]' => $example_text_2, 'field_test_multi[2][value]' => $example_text_3, diff --git a/core/modules/node/tests/src/Functional/Views/NodeContextualLinksTest.php b/core/modules/node/tests/src/Functional/Views/NodeContextualLinksTest.php new file mode 100644 index 0000000000..73ccfef758 --- /dev/null +++ b/core/modules/node/tests/src/Functional/Views/NodeContextualLinksTest.php @@ -0,0 +1,47 @@ +uninstall(['contextual']); + \Drupal::service('module_installer')->install(['views_ui']); + + // Ensure that contextual links don't get called for admin users. + $admin_user = User::load(1); + $admin_user->setPassword('new_password'); + $admin_user->passRaw = 'new_password'; + $admin_user->save(); + + $this->drupalCreateContentType(['type' => 'page']); + $this->drupalCreateNode(['promote' => 1]); + + $this->drupalLogin($admin_user); + $this->drupalGet('node'); + } + +} diff --git a/core/modules/node/tests/src/FunctionalJavascript/ContextualLinksTest.php b/core/modules/node/tests/src/FunctionalJavascript/ContextualLinksTest.php new file mode 100644 index 0000000000..98051262ec --- /dev/null +++ b/core/modules/node/tests/src/FunctionalJavascript/ContextualLinksTest.php @@ -0,0 +1,117 @@ +drupalCreateContentType([ + 'type' => 'page', + 'name' => 'Basic page', + 'display_submitted' => FALSE, + ]); + + // Create initial node. + $node = $this->drupalCreateNode(); + + $nodes = []; + + // Get original node. + $nodes[] = clone $node; + + // Create two revisions. + $revision_count = 2; + for ($i = 0; $i < $revision_count; $i++) { + + // Create revision with a random title and body and update variables. + $node->title = $this->randomMachineName(); + $node->body = [ + 'value' => $this->randomMachineName(32), + 'format' => filter_default_format(), + ]; + $node->setNewRevision(); + + $node->save(); + + // Make sure we get revision information. + $node = Node::load($node->id()); + $nodes[] = clone $node; + } + + $this->nodes = $nodes; + + $this->drupalLogin($this->createUser( + [ + 'view page revisions', + 'revert page revisions', + 'delete page revisions', + 'edit any page content', + 'delete any page content', + 'access contextual links', + 'administer content types', + ] + )); + } + + /** + * Tests the contextual links on revisions. + */ + public function testRevisionContextualLinks() { + // Confirm that the "Edit" and "Delete" contextual links appear for the + // default revision. + $this->drupalGet('node/' . $this->nodes[0]->id()); + $page = $this->getSession()->getPage(); + $page->waitFor(10, function () use ($page) { + return $page->find('css', "main .contextual"); + }); + + $this->toggleContextualTriggerVisibility('main'); + $page->find('css', 'main .contextual button')->press(); + $links = $page->findAll('css', "main .contextual-links li a"); + + $this->assertEquals('Edit', $links[0]->getText()); + $this->assertEquals('Delete', $links[1]->getText()); + + // Confirm that "Edit" and "Delete" contextual links don't appear for + // non-default revision. + $this->drupalGet("node/" . $this->nodes[0]->id() . "/revisions/" . $this->nodes[1]->getRevisionId() . "/view"); + $this->assertSession()->pageTextContains($this->nodes[1]->getTitle()); + $page->waitFor(10, function () use ($page) { + return $page->find('css', "main .contextual"); + }); + + $this->toggleContextualTriggerVisibility('main'); + $contextual_button = $page->find('css', 'main .contextual button'); + $this->assertEmpty(0, $contextual_button); + } + +} diff --git a/core/modules/path/tests/src/Functional/PathAliasTest.php b/core/modules/path/tests/src/Functional/PathAliasTest.php index b8ac5968db..19115cd27b 100644 --- a/core/modules/path/tests/src/Functional/PathAliasTest.php +++ b/core/modules/path/tests/src/Functional/PathAliasTest.php @@ -4,6 +4,7 @@ use Drupal\Core\Cache\Cache; use Drupal\Core\Database\Database; +use Drupal\Core\Url; /** * Add, edit, delete, and change alias and verify its consistency in the @@ -24,7 +25,7 @@ protected function setUp() { parent::setUp(); // Create test user and log in. - $web_user = $this->drupalCreateUser(['create page content', 'edit own page content', 'administer url aliases', 'create url aliases']); + $web_user = $this->drupalCreateUser(['create page content', 'edit own page content', 'administer url aliases', 'create url aliases', 'access content overview']); $this->drupalLogin($web_user); } @@ -327,6 +328,34 @@ public function testNodeAlias() { $node5->delete(); $path_alias = \Drupal::service('path.alias_storage')->lookupPathAlias('/node/' . $node5->id(), $node5->language()->getId()); $this->assertFalse($path_alias, 'Alias was successfully deleted when the referenced node was deleted.'); + + // Create sixth test node. + $node6 = $this->drupalCreateNode(); + + // Create an invalid alias with two leading slashes and verify that the + // extra slash is removed when the link is generated. This ensures that URL + // aliases cannot be used to inject external URLs. + // @todo The user interface should either display an error message or + // automatically trim these invalid aliases, rather than allowing them to + // be silently created, at which point the functional aspects of this + // test will need to be moved elsewhere and switch to using a + // programmatically-created alias instead. + $alias = $this->randomMachineName(8); + $edit = ['path[0][alias]' => '//' . $alias]; + $this->drupalPostForm($node6->toUrl('edit-form'), $edit, t('Save')); + $this->drupalGet(Url::fromRoute('system.admin_content')); + // This checks the link href before clicking it, rather than using + // \Drupal\Tests\BrowserTestBase::assertSession()->addressEquals() after + // clicking it, because the test browser does not always preserve the + // correct number of slashes in the URL when it visits internal links; + // using \Drupal\Tests\BrowserTestBase::assertSession()->addressEquals() + // would actually make the test pass unconditionally on the testbot (or + // anywhere else where Drupal is installed in a subdirectory). + $link_xpath = $this->xpath('//a[normalize-space(text())=:label]', [':label' => $node6->getTitle()]); + $link_href = $link_xpath[0]->getAttribute('href'); + $this->assertEquals($link_href, base_path() . $alias); + $this->clickLink($node6->getTitle()); + $this->assertResponse(404); } /** diff --git a/core/modules/system/src/Tests/Routing/RouterTest.php b/core/modules/system/src/Tests/Routing/RouterTest.php index 83a9c55b39..8d7c43e86a 100644 --- a/core/modules/system/src/Tests/Routing/RouterTest.php +++ b/core/modules/system/src/Tests/Routing/RouterTest.php @@ -320,6 +320,13 @@ public function testLeadingSlashes() { $this->drupalGet($url); $this->assertEqual(1, $this->redirectCount, $url . " redirected to " . $this->url); $this->assertUrl($request->getUriForPath('/router_test/test1') . '?qs=test'); + + // Ensure that external URLs in destination query params are not redirected + // to. + $url = $request->getUriForPath('/////////////////////////////////////////////////router_test/test1') . '?qs=test&destination=http://www.example.com%5c@drupal8alt.test'; + $this->drupalGet($url); + $this->assertEqual(1, $this->redirectCount, $url . " redirected to " . $this->url); + $this->assertUrl($request->getUriForPath('/router_test/test1') . '?qs=test'); } } diff --git a/core/tests/Drupal/Tests/Component/Utility/UrlHelperTest.php b/core/tests/Drupal/Tests/Component/Utility/UrlHelperTest.php index d185219c9a..beaa472c26 100644 --- a/core/tests/Drupal/Tests/Component/Utility/UrlHelperTest.php +++ b/core/tests/Drupal/Tests/Component/Utility/UrlHelperTest.php @@ -563,6 +563,10 @@ public function providerTestExternalIsLocal() { ['http://example.com/foo', 'http://example.com/bar', FALSE], ['http://example.com', 'http://example.com/bar', FALSE], ['http://example.com/bar', 'http://example.com/bar/', FALSE], + // Ensure \ is normalised to / since some browsers do that. + ['http://www.example.ca\@example.com', 'http://example.com', FALSE], + // Some browsers ignore or strip leading control characters. + ["\x00//www.example.ca", 'http://example.com', FALSE], ]; } diff --git a/core/tests/Drupal/Tests/Core/EventSubscriber/RedirectResponseSubscriberTest.php b/core/tests/Drupal/Tests/Core/EventSubscriber/RedirectResponseSubscriberTest.php index 8659a6f126..85b3da313c 100644 --- a/core/tests/Drupal/Tests/Core/EventSubscriber/RedirectResponseSubscriberTest.php +++ b/core/tests/Drupal/Tests/Core/EventSubscriber/RedirectResponseSubscriberTest.php @@ -11,7 +11,6 @@ use Symfony\Component\HttpFoundation\RedirectResponse; use Symfony\Component\HttpFoundation\Request; use Symfony\Component\HttpKernel\Event\FilterResponseEvent; -use Symfony\Component\HttpKernel\Event\GetResponseEvent; use Symfony\Component\HttpKernel\HttpKernelInterface; use Symfony\Component\HttpKernel\KernelEvents; @@ -192,74 +191,4 @@ public function providerTestDestinationRedirectWithInvalidUrl() { return $data; } - /** - * Tests that $_GET only contain internal URLs. - * - * @covers ::sanitizeDestination - * - * @dataProvider providerTestSanitizeDestination - * - * @see \Drupal\Component\Utility\UrlHelper::isExternal - */ - public function testSanitizeDestinationForGet($input, $output) { - $request = new Request(); - $request->query->set('destination', $input); - - $listener = new RedirectResponseSubscriber($this->urlAssembler, $this->requestContext); - $kernel = $this->getMock('Symfony\Component\HttpKernel\HttpKernelInterface'); - $event = new GetResponseEvent($kernel, $request, HttpKernelInterface::MASTER_REQUEST); - - $dispatcher = new EventDispatcher(); - $dispatcher->addListener(KernelEvents::REQUEST, [$listener, 'sanitizeDestination'], 100); - $dispatcher->dispatch(KernelEvents::REQUEST, $event); - - $this->assertEquals($output, $request->query->get('destination')); - } - - /** - * Tests that $_REQUEST['destination'] only contain internal URLs. - * - * @covers ::sanitizeDestination - * - * @dataProvider providerTestSanitizeDestination - * - * @see \Drupal\Component\Utility\UrlHelper::isExternal - */ - public function testSanitizeDestinationForPost($input, $output) { - $request = new Request(); - $request->request->set('destination', $input); - - $listener = new RedirectResponseSubscriber($this->urlAssembler, $this->requestContext); - $kernel = $this->getMock('Symfony\Component\HttpKernel\HttpKernelInterface'); - $event = new GetResponseEvent($kernel, $request, HttpKernelInterface::MASTER_REQUEST); - - $dispatcher = new EventDispatcher(); - $dispatcher->addListener(KernelEvents::REQUEST, [$listener, 'sanitizeDestination'], 100); - $dispatcher->dispatch(KernelEvents::REQUEST, $event); - - $this->assertEquals($output, $request->request->get('destination')); - } - - /** - * Data provider for testSanitizeDestination(). - */ - public function providerTestSanitizeDestination() { - $data = []; - // Standard internal example node path is present in the 'destination' - // parameter. - $data[] = ['node', 'node']; - // Internal path with one leading slash is allowed. - $data[] = ['/example.com', '/example.com']; - // External URL without scheme is not allowed. - $data[] = ['//example.com/test', '']; - // Internal URL using a colon is allowed. - $data[] = ['example:test', 'example:test']; - // External URL is not allowed. - $data[] = ['http://example.com', '']; - // Javascript URL is allowed because it is treated as an internal URL. - $data[] = ['javascript:alert(0)', 'javascript:alert(0)']; - - return $data; - } - } diff --git a/core/tests/Drupal/Tests/Core/Mail/MailManagerTest.php b/core/tests/Drupal/Tests/Core/Mail/MailManagerTest.php index ea523028a8..de2e3d943f 100644 --- a/core/tests/Drupal/Tests/Core/Mail/MailManagerTest.php +++ b/core/tests/Drupal/Tests/Core/Mail/MailManagerTest.php @@ -7,6 +7,7 @@ namespace Drupal\Tests\Core\Mail; +use Drupal\Core\DependencyInjection\ContainerBuilder; use Drupal\Core\Render\RenderContext; use Drupal\Core\Render\RendererInterface; use Drupal\Tests\UnitTestCase; @@ -103,6 +104,9 @@ protected function setUpMailManager($interface = []) { 'system.mail' => [ 'interface' => $interface, ], + 'system.site' => [ + 'mail' => 'test@example.com', + ], ]); $logger_factory = $this->getMock('\Drupal\Core\Logger\LoggerChannelFactoryInterface'); $string_translation = $this->getStringTranslationStub(); @@ -110,6 +114,11 @@ protected function setUpMailManager($interface = []) { // Construct the manager object and override its discovery. $this->mailManager = new TestMailManager(new \ArrayObject(), $this->cache, $this->moduleHandler, $this->configFactory, $logger_factory, $string_translation, $this->renderer); $this->mailManager->setDiscovery($this->discovery); + + // @see \Drupal\Core\Plugin\Factory\ContainerFactory::createInstance() + $container = new ContainerBuilder(); + $container->set('config.factory', $this->configFactory); + \Drupal::setContainer($container); } /** diff --git a/core/tests/Drupal/Tests/Core/Security/RequestSanitizerTest.php b/core/tests/Drupal/Tests/Core/Security/RequestSanitizerTest.php index 53147f3b7d..e828de086e 100644 --- a/core/tests/Drupal/Tests/Core/Security/RequestSanitizerTest.php +++ b/core/tests/Drupal/Tests/Core/Security/RequestSanitizerTest.php @@ -197,6 +197,147 @@ public function providerTestRequestSanitization() { return $tests; } + /** + * Tests acceptable destinations are not removed from GET requests. + * + * @param string $destination + * The destination string to test. + * + * @dataProvider providerTestAcceptableDestinations + */ + public function testAcceptableDestinationGet($destination) { + // Set up a GET request. + $request = $this->createRequestForTesting(['destination' => $destination]); + + $request = RequestSanitizer::sanitize($request, [], TRUE); + + $this->assertSame($destination, $request->query->get('destination', NULL)); + $this->assertNull($request->request->get('destination', NULL)); + $this->assertSame($destination, $_GET['destination']); + $this->assertSame($destination, $_REQUEST['destination']); + $this->assertArrayNotHasKey('destination', $_POST); + $this->assertEquals([], $this->errors); + } + + /** + * Tests unacceptable destinations are removed from GET requests. + * + * @param string $destination + * The destination string to test. + * + * @dataProvider providerTestSanitizedDestinations + */ + public function testSanitizedDestinationGet($destination) { + // Set up a GET request. + $request = $this->createRequestForTesting(['destination' => $destination]); + + $request = RequestSanitizer::sanitize($request, [], TRUE); + + $this->assertNull($request->request->get('destination', NULL)); + $this->assertNull($request->query->get('destination', NULL)); + $this->assertArrayNotHasKey('destination', $_POST); + $this->assertArrayNotHasKey('destination', $_REQUEST); + $this->assertArrayNotHasKey('destination', $_GET); + $this->assertError('Potentially unsafe destination removed from query parameter bag because it points to an external URL.', E_USER_NOTICE); + } + + /** + * Tests acceptable destinations are not removed from POST requests. + * + * @param string $destination + * The destination string to test. + * + * @dataProvider providerTestAcceptableDestinations + */ + public function testAcceptableDestinationPost($destination) { + // Set up a POST request. + $request = $this->createRequestForTesting([], ['destination' => $destination]); + + $request = RequestSanitizer::sanitize($request, [], TRUE); + + $this->assertSame($destination, $request->request->get('destination', NULL)); + $this->assertNull($request->query->get('destination', NULL)); + $this->assertSame($destination, $_POST['destination']); + $this->assertSame($destination, $_REQUEST['destination']); + $this->assertArrayNotHasKey('destination', $_GET); + $this->assertEquals([], $this->errors); + } + + /** + * Tests unacceptable destinations are removed from GET requests. + * + * @param string $destination + * The destination string to test. + * + * @dataProvider providerTestSanitizedDestinations + */ + public function testSanitizedDestinationPost($destination) { + // Set up a POST request. + $request = $this->createRequestForTesting([], ['destination' => $destination]); + + $request = RequestSanitizer::sanitize($request, [], TRUE); + + $this->assertNull($request->request->get('destination', NULL)); + $this->assertNull($request->query->get('destination', NULL)); + $this->assertArrayNotHasKey('destination', $_POST); + $this->assertArrayNotHasKey('destination', $_REQUEST); + $this->assertArrayNotHasKey('destination', $_GET); + $this->assertError('Potentially unsafe destination removed from request parameter bag because it points to an external URL.', E_USER_NOTICE); + } + + /** + * Creates a request and sets PHP globals for testing. + * + * @param array $query + * (optional) The GET parameters. + * @param array $request + * (optional) The POST parameters. + * + * @return \Symfony\Component\HttpFoundation\Request + * The request object. + */ + protected function createRequestForTesting(array $query = [], array $request = []) { + $request = new Request($query, $request); + + // Set up globals. + $_GET = $request->query->all(); + $_POST = $request->request->all(); + $_COOKIE = $request->cookies->all(); + $_REQUEST = array_merge($request->query->all(), $request->request->all()); + $request->server->set('QUERY_STRING', http_build_query($request->query->all())); + $_SERVER['QUERY_STRING'] = $request->server->get('QUERY_STRING'); + return $request; + } + + /** + * Data provider for testing acceptable destinations. + */ + public function providerTestAcceptableDestinations() { + $data = []; + // Standard internal example node path is present in the 'destination' + // parameter. + $data[] = ['node']; + // Internal path with one leading slash is allowed. + $data[] = ['/example.com']; + // Internal URL using a colon is allowed. + $data[] = ['example:test']; + // Javascript URL is allowed because it is treated as an internal URL. + $data[] = ['javascript:alert(0)']; + return $data; + } + + /** + * Data provider for testing sanitized destinations. + */ + public function providerTestSanitizedDestinations() { + $data = []; + // External URL without scheme is not allowed. + $data[] = ['//example.com/test']; + // External URL is not allowed. + $data[] = ['http://example.com']; + return $data; + } + /** * Catches and logs errors to $this->errors. * -- 2.14.1 ================================================ FILE: aegir/patches/992540-3-reset_flood_limit_on_password_reset-drush.patch ================================================ diff --git modules/user/user.pages.inc modules/user/user.pages.inc index 697a82d..797e3d1 100644 --- modules/user/user.pages.inc +++ modules/user/user.pages.inc @@ -135,6 +135,16 @@ function user_pass_reset($form, &$form_state, $uid, $timestamp, $hashed_pass, $a // Let the user's password be changed without the current password check. $token = drupal_hash_base64(drupal_random_bytes(55)); $_SESSION['pass_reset_' . $user->uid] = $token; + //clear out flood event for user trying to log in too many times + if (variable_get('user_failed_login_identifier_uid_only', FALSE)) { + $identifier = $account->uid; + } + else { + $identifier = $account->uid . '-' . ip_address(); + } + flood_clear_event('failed_login_attempt_user', $identifier); + //also clear out the ip attempts for that user + flood_clear_event('failed_login_attempt_ip'); drupal_goto('user/' . $user->uid . '/edit', array('query' => array('pass-reset-token' => $token))); } else { @@ -319,6 +329,15 @@ function user_profile_form_submit($form, &$form_state) { // Remove the password reset tag since a new password was saved. unset($_SESSION['pass_reset_'. $account->uid]); } + + // Clear the flood table. Since we don't know the IP address for this user + // we can't use flood_clear_event because we need to use the LIKE operator. + $identifier = $account->uid .'-%'; + db_delete('flood') + ->condition('event', 'failed_login_attempt_user') + ->condition('identifier', $identifier, 'LIKE') + ->execute(); + // Clear the page cache because pages can contain usernames and/or profile information: cache_clear_all(); diff --git modules/user/user.test modules/user/user.test index 6ecbfac..5c13145 100644 --- modules/user/user.test +++ modules/user/user.test @@ -396,6 +396,67 @@ class UserLoginTestCase extends DrupalWebTestCase { } /** + * Test that flood events are removed after an account has been updated. + */ + function testUpdatedUserFloodControl() { + // Set a high global limit out so that it is not relevant in the test. + variable_set('user_failed_login_ip_limit', 4000); + // Set the per-user login limit. + variable_set('user_failed_login_user_limit', 3); + + $user1 = $this->drupalCreateUser(array('administer users')); + $user2 = $this->drupalCreateUser(array()); + $user2->pass_raw .= 'incorrect'; + + // Try 3 failed logins. + for ($i = 0; $i < 3; $i++) { + $this->assertFailedLogin($user2); + } + + // The next login trial should result in an user-based flood error message. + $this->assertFailedLogin($user2, 'user'); + + // Update the account and assert the user can login again. + $this->drupalLogin($user1); + $user2->pass_raw = 'goodpass'; + $edit = array( + 'pass[pass1]' => $user2->pass_raw, + 'pass[pass2]' => $user2->pass_raw, + ); + $this->drupalPost('user/' . $user2->uid . '/edit', $edit, t('Save')); + $this->drupalLogout(); + $this->drupalLogin($user2); + } + + /** + * Test that flood events are removed after password reset. + */ + function testResetPasswordFloodControl() { + // Set a high global limit out so that it is not relevant in the test. + variable_set('user_failed_login_ip_limit', 4000); + // Set the per-user login limit. + variable_set('user_failed_login_user_limit', 3); + + $user1 = $this->drupalCreateUser(); + $correct = $user1->pass_raw; + $user1->pass_raw .= 'incorrect'; + + // Try 3 failed logins. + for ($i = 0; $i < 3; $i++) { + $this->assertFailedLogin($user1); + } + + // The next login trial should result in an user-based flood error message. + $this->assertFailedLogin($user1, 'user'); + + // Request new password, logout and login. + $this->drupalPost(user_pass_reset_url($user1), array(), t('Log in')); + $this->drupalLogout(); + $user1->pass_raw = $correct; + $this->drupalLogin($user1); + } + + /** * Test that user password is re-hashed upon login after changing $count_log2. */ function testPasswordRehashOnLogin() { ================================================ FILE: aegir/patches/MailManagerReplacement.php.patch ================================================ --- src/MailManagerReplacement.php.org 2024-01-25 12:04:50.463753755 +0100 +++ src/MailManagerReplacement.php 2024-01-25 12:02:53.223548904 +0100 @@ -86,17 +86,19 @@ // Create an email from the array. $builder = $this->emailBuilderManager->createInstanceFromMessage($message); - $email = $builder->fromArray($this->emailFactory, $message); + if ($builder) { + $email = $builder->fromArray($this->emailFactory, $message); - if ($send) { - $message['result'] = $email->send(); - } - else { - // We set 'result' to NULL, because FALSE indicates an error in sending. - $message['result'] = NULL; - } + if ($send) { + $message['result'] = $email->send(); + } + else { + // We set 'result' to NULL, because FALSE indicates an error in sending. + $message['result'] = NULL; + } - $this->legacyHelper->emailToArray($email, $message); + $this->legacyHelper->emailToArray($email, $message); + } return $message; } ================================================ FILE: aegir/patches/PHP-5.6.31-OpenSSL-1.1.0-compatibility-20170801.patch ================================================ diff -rupN php-5.6.31.orig/ext/openssl/openssl.c php-5.6.31/ext/openssl/openssl.c --- php-5.6.31.orig/ext/openssl/openssl.c 2017-07-06 00:25:00.000000000 +0200 +++ php-5.6.31/ext/openssl/openssl.c 2017-08-01 10:55:28.108819344 +0200 @@ -42,6 +42,12 @@ /* OpenSSL includes */ #include +#if OPENSSL_VERSION_NUMBER >= 0x10002000L +#include +#include +#include +#include +#endif #include #include #include @@ -531,6 +537,133 @@ zend_module_entry openssl_module_entry = ZEND_GET_MODULE(openssl) #endif +/* {{{ OpenSSL compatibility functions and macros */ +#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER) +#define EVP_PKEY_get0_RSA(_pkey) _pkey->pkey.rsa +#define EVP_PKEY_get0_DH(_pkey) _pkey->pkey.dh +#define EVP_PKEY_get0_DSA(_pkey) _pkey->pkey.dsa +#define EVP_PKEY_get0_EC_KEY(_pkey) _pkey->pkey.ec + +static int RSA_set0_key(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d) +{ + r->n = n; + r->e = e; + r->d = d; + + return 1; +} + +static int RSA_set0_factors(RSA *r, BIGNUM *p, BIGNUM *q) +{ + r->p = p; + r->q = q; + + return 1; +} + +static int RSA_set0_crt_params(RSA *r, BIGNUM *dmp1, BIGNUM *dmq1, BIGNUM *iqmp) +{ + r->dmp1 = dmp1; + r->dmq1 = dmq1; + r->iqmp = iqmp; + + return 1; +} + +static void RSA_get0_key(const RSA *r, const BIGNUM **n, const BIGNUM **e, const BIGNUM **d) +{ + *n = r->n; + *e = r->e; + *d = r->d; +} + +static void RSA_get0_factors(const RSA *r, const BIGNUM **p, const BIGNUM **q) +{ + *p = r->p; + *q = r->q; +} + +static void RSA_get0_crt_params(const RSA *r, const BIGNUM **dmp1, const BIGNUM **dmq1, const BIGNUM **iqmp) +{ + *dmp1 = r->dmp1; + *dmq1 = r->dmq1; + *iqmp = r->iqmp; +} + +static void DH_get0_pqg(const DH *dh, const BIGNUM **p, const BIGNUM **q, const BIGNUM **g) +{ + *p = dh->p; + *q = dh->q; + *g = dh->g; +} + +static int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g) +{ + dh->p = p; + dh->q = q; + dh->g = g; + + return 1; +} + +static void DH_get0_key(const DH *dh, const BIGNUM **pub_key, const BIGNUM **priv_key) +{ + *pub_key = dh->pub_key; + *priv_key = dh->priv_key; +} + +static int DH_set0_key(DH *dh, BIGNUM *pub_key, BIGNUM *priv_key) +{ + dh->pub_key = pub_key; + dh->priv_key = priv_key; + + return 1; +} + +static void DSA_get0_pqg(const DSA *d, const BIGNUM **p, const BIGNUM **q, const BIGNUM **g) +{ + *p = d->p; + *q = d->q; + *g = d->g; +} + +int DSA_set0_pqg(DSA *d, BIGNUM *p, BIGNUM *q, BIGNUM *g) +{ + d->p = p; + d->q = q; + d->g = g; + + return 1; +} + +static void DSA_get0_key(const DSA *d, const BIGNUM **pub_key, const BIGNUM **priv_key) +{ + *pub_key = d->pub_key; + *priv_key = d->priv_key; +} + +int DSA_set0_key(DSA *d, BIGNUM *pub_key, BIGNUM *priv_key) +{ + d->pub_key = pub_key; + d->priv_key = priv_key; + + return 1; +} + +#if OPENSSL_VERSION_NUMBER < 0x10002000L || defined (LIBRESSL_VERSION_NUMBER) +#define EVP_PKEY_id(_pkey) _pkey->type +#define EVP_PKEY_base_id(_key) EVP_PKEY_type(_key->type) + +static int X509_get_signature_nid(const X509 *x) +{ + return OBJ_obj2nid(x->sig_alg->algorithm); +} + +#endif + +#endif +/* }}} */ + static int le_key; static int le_x509; static int le_csr; @@ -825,7 +958,7 @@ static int add_oid_section(struct php_x5 } for (i = 0; i < sk_CONF_VALUE_num(sktmp); i++) { cnf = sk_CONF_VALUE_value(sktmp, i); - if (OBJ_create(cnf->value, cnf->name, cnf->name) == NID_undef) { + if (OBJ_sn2nid(cnf->name) == NID_undef && OBJ_ln2nid(cnf->name) == NID_undef && OBJ_create(cnf->value, cnf->name, cnf->name) == NID_undef) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "problem creating object %s=%s", cnf->name, cnf->value); return FAILURE; } @@ -967,7 +1100,7 @@ static void php_openssl_dispose_config(s } /* }}} */ -#ifdef PHP_WIN32 +#if defined(PHP_WIN32) || (OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)) #define PHP_OPENSSL_RAND_ADD_TIME() ((void) 0) #else #define PHP_OPENSSL_RAND_ADD_TIME() php_openssl_rand_add_timeval() @@ -1053,9 +1186,11 @@ static EVP_MD * php_openssl_get_evp_md_f mdtype = (EVP_MD *) EVP_md2(); break; #endif +#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER) case OPENSSL_ALGO_DSS1: mdtype = (EVP_MD *) EVP_dss1(); break; +#endif #if OPENSSL_VERSION_NUMBER >= 0x0090708fL case OPENSSL_ALGO_SHA224: mdtype = (EVP_MD *) EVP_sha224(); @@ -1146,6 +1281,12 @@ PHP_MINIT_FUNCTION(openssl) OpenSSL_add_all_digests(); OpenSSL_add_all_algorithms(); +#if !defined(OPENSSL_NO_AES) && defined(EVP_CIPH_CCM_MODE) && OPENSSL_VERSION_NUMBER < 0x100020000 + EVP_add_cipher(EVP_aes_128_ccm()); + EVP_add_cipher(EVP_aes_192_ccm()); + EVP_add_cipher(EVP_aes_256_ccm()); +#endif + SSL_load_error_strings(); /* register a resource id number with OpenSSL so that we can map SSL -> stream structures in @@ -1173,7 +1314,9 @@ PHP_MINIT_FUNCTION(openssl) #ifdef HAVE_OPENSSL_MD2_H REGISTER_LONG_CONSTANT("OPENSSL_ALGO_MD2", OPENSSL_ALGO_MD2, CONST_CS|CONST_PERSISTENT); #endif +#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER) REGISTER_LONG_CONSTANT("OPENSSL_ALGO_DSS1", OPENSSL_ALGO_DSS1, CONST_CS|CONST_PERSISTENT); +#endif #if OPENSSL_VERSION_NUMBER >= 0x0090708fL REGISTER_LONG_CONSTANT("OPENSSL_ALGO_SHA224", OPENSSL_ALGO_SHA224, CONST_CS|CONST_PERSISTENT); REGISTER_LONG_CONSTANT("OPENSSL_ALGO_SHA256", OPENSSL_ALGO_SHA256, CONST_CS|CONST_PERSISTENT); @@ -1251,7 +1394,9 @@ PHP_MINIT_FUNCTION(openssl) } php_stream_xport_register("ssl", php_openssl_ssl_socket_factory TSRMLS_CC); +#ifndef OPENSSL_NO_SSL3 php_stream_xport_register("sslv3", php_openssl_ssl_socket_factory TSRMLS_CC); +#endif #ifndef OPENSSL_NO_SSL2 php_stream_xport_register("sslv2", php_openssl_ssl_socket_factory TSRMLS_CC); #endif @@ -1308,7 +1453,9 @@ PHP_MSHUTDOWN_FUNCTION(openssl) #ifndef OPENSSL_NO_SSL2 php_stream_xport_unregister("sslv2" TSRMLS_CC); #endif +#ifndef OPENSSL_NO_SSL3 php_stream_xport_unregister("sslv3" TSRMLS_CC); +#endif php_stream_xport_unregister("tls" TSRMLS_CC); php_stream_xport_unregister("tlsv1.0" TSRMLS_CC); #if OPENSSL_VERSION_NUMBER >= 0x10001001L @@ -1893,6 +2040,7 @@ static int openssl_x509v3_subjectAltName { GENERAL_NAMES *names; const X509V3_EXT_METHOD *method = NULL; + ASN1_OCTET_STRING *extension_data; long i, length, num; const unsigned char *p; @@ -1901,8 +2049,9 @@ static int openssl_x509v3_subjectAltName return -1; } - p = extension->value->data; - length = extension->value->length; + extension_data = X509_EXTENSION_get_data(extension); + p = extension_data->data; + length = extension_data->length; if (method->it) { names = (GENERAL_NAMES*)(ASN1_item_d2i(NULL, &p, length, ASN1_ITEM_ptr(method->it))); @@ -1965,6 +2114,8 @@ PHP_FUNCTION(openssl_x509_parse) char * tmpstr; zval * subitem; X509_EXTENSION *extension; + X509_NAME *subject_name; + char *cert_name; char *extname; BIO *bio_out; BUF_MEM *bio_buf; @@ -1979,10 +2130,10 @@ PHP_FUNCTION(openssl_x509_parse) } array_init(return_value); - if (cert->name) { - add_assoc_string(return_value, "name", cert->name, 1); - } -/* add_assoc_bool(return_value, "valid", cert->valid); */ + subject_name = X509_get_subject_name(cert); + cert_name = X509_NAME_oneline(subject_name, NULL, 0); + add_assoc_string(return_value, "name", cert_name, 1); + OPENSSL_free(cert_name); add_assoc_name_entry(return_value, "subject", X509_get_subject_name(cert), useshortnames TSRMLS_CC); /* hash as used in CA directories to lookup cert by subject name */ @@ -2008,7 +2159,7 @@ PHP_FUNCTION(openssl_x509_parse) add_assoc_string(return_value, "alias", tmpstr, 1); } - sig_nid = OBJ_obj2nid((cert)->sig_alg->algorithm); + sig_nid = X509_get_signature_nid(cert); add_assoc_string(return_value, "signatureTypeSN", (char*)OBJ_nid2sn(sig_nid), 1); add_assoc_string(return_value, "signatureTypeLN", (char*)OBJ_nid2ln(sig_nid), 1); add_assoc_long(return_value, "signatureTypeNID", sig_nid); @@ -3217,7 +3368,21 @@ PHP_FUNCTION(openssl_csr_get_public_key) RETURN_FALSE; } - tpubkey=X509_REQ_get_pubkey(csr); +#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER) + /* Due to changes in OpenSSL 1.1 related to locking when decoding CSR, + * the pub key is not changed after assigning. It means if we pass + * a private key, it will be returned including the private part. + * If we duplicate it, then we get just the public part which is + * the same behavior as for OpenSSL 1.0 */ + csr = X509_REQ_dup(csr); +#endif + /* Retrieve the public key from the CSR */ + tpubkey = X509_REQ_get_pubkey(csr); + +#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER) + /* We need to free the CSR as it was duplicated */ + X509_REQ_free(csr); +#endif RETVAL_RESOURCE(zend_list_insert(tpubkey, le_key TSRMLS_CC)); return; } @@ -3482,13 +3647,20 @@ static int php_openssl_is_private_key(EV { assert(pkey != NULL); - switch (pkey->type) { + switch (EVP_PKEY_id(pkey)) { #ifndef NO_RSA case EVP_PKEY_RSA: case EVP_PKEY_RSA2: - assert(pkey->pkey.rsa != NULL); - if (pkey->pkey.rsa != NULL && (NULL == pkey->pkey.rsa->p || NULL == pkey->pkey.rsa->q)) { - return 0; + { + RSA *rsa = EVP_PKEY_get0_RSA(pkey); + if (rsa != NULL) { + const BIGNUM *p, *q; + + RSA_get0_factors(rsa, &p, &q); + if (p == NULL || q == NULL) { + return 0; + } + } } break; #endif @@ -3498,28 +3670,51 @@ static int php_openssl_is_private_key(EV case EVP_PKEY_DSA2: case EVP_PKEY_DSA3: case EVP_PKEY_DSA4: - assert(pkey->pkey.dsa != NULL); - - if (NULL == pkey->pkey.dsa->p || NULL == pkey->pkey.dsa->q || NULL == pkey->pkey.dsa->priv_key){ - return 0; + { + DSA *dsa = EVP_PKEY_get0_DSA(pkey); + if (dsa != NULL) { + const BIGNUM *p, *q, *g, *pub_key, *priv_key; + + DSA_get0_pqg(dsa, &p, &q, &g); + if (p == NULL || q == NULL) { + return 0; + } + + DSA_get0_key(dsa, &pub_key, &priv_key); + if (priv_key == NULL) { + return 0; + } + } } break; #endif #ifndef NO_DH case EVP_PKEY_DH: - assert(pkey->pkey.dh != NULL); - - if (NULL == pkey->pkey.dh->p || NULL == pkey->pkey.dh->priv_key) { - return 0; + { + DH *dh = EVP_PKEY_get0_DH(pkey); + if (dh != NULL) { + const BIGNUM *p, *q, *g, *pub_key, *priv_key; + + DH_get0_pqg(dh, &p, &q, &g); + if (p == NULL) { + return 0; + } + + DH_get0_key(dh, &pub_key, &priv_key); + if (priv_key == NULL) { + return 0; + } + } } break; #endif #ifdef HAVE_EVP_PKEY_EC case EVP_PKEY_EC: - assert(pkey->pkey.ec != NULL); - - if ( NULL == EC_KEY_get0_private_key(pkey->pkey.ec)) { - return 0; + { + EC_KEY *ec = EVP_PKEY_get0_EC_KEY(pkey); + if (ec != NULL && NULL == EC_KEY_get0_private_key(ec)) { + return 0; + } } break; #endif @@ -3531,34 +3726,80 @@ static int php_openssl_is_private_key(EV } /* }}} */ -#define OPENSSL_PKEY_GET_BN(_type, _name) do { \ - if (pkey->pkey._type->_name != NULL) { \ - int len = BN_num_bytes(pkey->pkey._type->_name); \ - char *str = emalloc(len + 1); \ - BN_bn2bin(pkey->pkey._type->_name, (unsigned char*)str); \ - str[len] = 0; \ - add_assoc_stringl(_type, #_name, str, len, 0); \ - } \ - } while (0) - -#define OPENSSL_PKEY_SET_BN(_ht, _type, _name) do { \ - zval **bn; \ - if (zend_hash_find(_ht, #_name, sizeof(#_name), (void**)&bn) == SUCCESS && \ - Z_TYPE_PP(bn) == IS_STRING) { \ - _type->_name = BN_bin2bn( \ - (unsigned char*)Z_STRVAL_PP(bn), \ - Z_STRLEN_PP(bn), NULL); \ - } \ +#define OPENSSL_GET_BN(_array, _bn, _name) do { \ + if (_bn != NULL) { \ + int len = BN_num_bytes(_bn); \ + char *str = emalloc(len + 1); \ + BN_bn2bin(_bn, (unsigned char*)str); \ + str[len] = 0; \ + add_assoc_stringl(_array, #_name, str, len, 0); \ + } \ } while (0); +#define OPENSSL_PKEY_GET_BN(_type, _name) OPENSSL_GET_BN(_type, _name, _name) + +#define OPENSSL_PKEY_SET_BN(_data, _name) do { \ + zval **bn; \ + if (zend_hash_find(Z_ARRVAL_P(_data), #_name, sizeof(#_name),(void**)&bn) == SUCCESS && \ + Z_TYPE_PP(bn) == IS_STRING) { \ + _name = BN_bin2bn( \ + (unsigned char*)Z_STRVAL_PP(bn), \ + Z_STRLEN_PP(bn), NULL); \ + } else { \ + _name = NULL; \ + } \ + } while (0); + +/* {{{ php_openssl_pkey_init_rsa */ +zend_bool php_openssl_pkey_init_and_assign_rsa(EVP_PKEY *pkey, RSA *rsa, zval *data) +{ + BIGNUM *n, *e, *d, *p, *q, *dmp1, *dmq1, *iqmp; + + OPENSSL_PKEY_SET_BN(data, n); + OPENSSL_PKEY_SET_BN(data, e); + OPENSSL_PKEY_SET_BN(data, d); + if (!n || !d || !RSA_set0_key(rsa, n, e, d)) { + return 0; + } + + OPENSSL_PKEY_SET_BN(data, p); + OPENSSL_PKEY_SET_BN(data, q); + if ((p || q) && !RSA_set0_factors(rsa, p, q)) { + return 0; + } + + OPENSSL_PKEY_SET_BN(data, dmp1); + OPENSSL_PKEY_SET_BN(data, dmq1); + OPENSSL_PKEY_SET_BN(data, iqmp); + if ((dmp1 || dmq1 || iqmp) && !RSA_set0_crt_params(rsa, dmp1, dmq1, iqmp)) { + return 0; + } + + if (!EVP_PKEY_assign_RSA(pkey, rsa)) { + return 0; + } + + return 1; +} +/* }}} */ + /* {{{ php_openssl_pkey_init_dsa */ -zend_bool php_openssl_pkey_init_dsa(DSA *dsa) +zend_bool php_openssl_pkey_init_dsa(DSA *dsa, zval *data) { - if (!dsa->p || !dsa->q || !dsa->g) { + BIGNUM *p, *q, *g, *priv_key, *pub_key; + const BIGNUM *priv_key_const, *pub_key_const; + + OPENSSL_PKEY_SET_BN(data, p); + OPENSSL_PKEY_SET_BN(data, q); + OPENSSL_PKEY_SET_BN(data, g); + if (!p || !q || !g || !DSA_set0_pqg(dsa, p, q, g)) { return 0; } - if (dsa->priv_key || dsa->pub_key) { - return 1; + + OPENSSL_PKEY_SET_BN(data, pub_key); + OPENSSL_PKEY_SET_BN(data, priv_key); + if (pub_key) { + return DSA_set0_key(dsa, pub_key, priv_key); } PHP_OPENSSL_RAND_ADD_TIME(); if (!DSA_generate_key(dsa)) { @@ -3566,7 +3807,8 @@ zend_bool php_openssl_pkey_init_dsa(DSA } /* if BN_mod_exp return -1, then DSA_generate_key succeed for failed key * so we need to double check that public key is created */ - if (!dsa->pub_key || BN_is_zero(dsa->pub_key)) { + DSA_get0_key(dsa, &pub_key_const, &priv_key_const); + if (!pub_key_const || BN_is_zero(pub_key_const)) { return 0; } /* all good */ @@ -3574,14 +3816,66 @@ zend_bool php_openssl_pkey_init_dsa(DSA } /* }}} */ +/* {{{ php_openssl_dh_pub_from_priv */ +static BIGNUM *php_openssl_dh_pub_from_priv(BIGNUM *priv_key, BIGNUM *g, BIGNUM *p) +{ + BIGNUM *pub_key, *priv_key_const_time; + BN_CTX *ctx; + + pub_key = BN_new(); + if (pub_key == NULL) { + return NULL; + } + + priv_key_const_time = BN_new(); + if (priv_key_const_time == NULL) { + BN_free(pub_key); + return NULL; + } + ctx = BN_CTX_new(); + if (ctx == NULL) { + BN_free(pub_key); + BN_free(priv_key_const_time); + return NULL; + } + + BN_with_flags(priv_key_const_time, priv_key, BN_FLG_CONSTTIME); + + if (!BN_mod_exp_mont(pub_key, g, priv_key_const_time, p, ctx, NULL)) { + BN_free(pub_key); + pub_key = NULL; + } + + BN_free(priv_key_const_time); + BN_CTX_free(ctx); + + return pub_key; +} +/* }}} */ + /* {{{ php_openssl_pkey_init_dh */ -zend_bool php_openssl_pkey_init_dh(DH *dh) +zend_bool php_openssl_pkey_init_dh(DH *dh, zval *data) { - if (!dh->p || !dh->g) { + BIGNUM *p, *q, *g, *priv_key, *pub_key; + + OPENSSL_PKEY_SET_BN(data, p); + OPENSSL_PKEY_SET_BN(data, q); + OPENSSL_PKEY_SET_BN(data, g); + if (!p || !g || !DH_set0_pqg(dh, p, q, g)) { return 0; } - if (dh->pub_key) { - return 1; + + OPENSSL_PKEY_SET_BN(data, priv_key); + OPENSSL_PKEY_SET_BN(data, pub_key); + if (pub_key) { + return DH_set0_key(dh, pub_key, priv_key); + } + if (priv_key) { + pub_key = php_openssl_dh_pub_from_priv(priv_key, g, p); + if (pub_key == NULL) { + return 0; + } + return DH_set0_key(dh, pub_key, priv_key); } PHP_OPENSSL_RAND_ADD_TIME(); if (!DH_generate_key(dh)) { @@ -3614,18 +3908,8 @@ PHP_FUNCTION(openssl_pkey_new) if (pkey) { RSA *rsa = RSA_new(); if (rsa) { - OPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), rsa, n); - OPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), rsa, e); - OPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), rsa, d); - OPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), rsa, p); - OPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), rsa, q); - OPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), rsa, dmp1); - OPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), rsa, dmq1); - OPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), rsa, iqmp); - if (rsa->n && rsa->d) { - if (EVP_PKEY_assign_RSA(pkey, rsa)) { - RETURN_RESOURCE(zend_list_insert(pkey, le_key TSRMLS_CC)); - } + if (php_openssl_pkey_init_and_assign_rsa(pkey, rsa, *data)) { + RETURN_RESOURCE(zend_list_insert(pkey, le_key TSRMLS_CC)); } RSA_free(rsa); } @@ -3638,12 +3922,7 @@ PHP_FUNCTION(openssl_pkey_new) if (pkey) { DSA *dsa = DSA_new(); if (dsa) { - OPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), dsa, p); - OPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), dsa, q); - OPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), dsa, g); - OPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), dsa, priv_key); - OPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), dsa, pub_key); - if (php_openssl_pkey_init_dsa(dsa)) { + if (php_openssl_pkey_init_dsa(dsa, *data)) { if (EVP_PKEY_assign_DSA(pkey, dsa)) { RETURN_RESOURCE(zend_list_insert(pkey, le_key TSRMLS_CC)); } @@ -3659,11 +3938,7 @@ PHP_FUNCTION(openssl_pkey_new) if (pkey) { DH *dh = DH_new(); if (dh) { - OPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), dh, p); - OPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), dh, g); - OPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), dh, priv_key); - OPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), dh, pub_key); - if (php_openssl_pkey_init_dh(dh)) { + if (php_openssl_pkey_init_dh(dh, *data)) { if (EVP_PKEY_assign_DH(pkey, dh)) { RETURN_RESOURCE(zend_list_insert(pkey, le_key TSRMLS_CC)); } @@ -3738,10 +4013,10 @@ PHP_FUNCTION(openssl_pkey_export_to_file cipher = NULL; } - switch (EVP_PKEY_type(key->type)) { + switch (EVP_PKEY_base_id(key)) { #ifdef HAVE_EVP_PKEY_EC case EVP_PKEY_EC: - pem_write = PEM_write_bio_ECPrivateKey(bio_out, EVP_PKEY_get1_EC_KEY(key), cipher, (unsigned char *)passphrase, passphrase_len, NULL, NULL); + pem_write = PEM_write_bio_ECPrivateKey(bio_out, EVP_PKEY_get0_EC_KEY(key), cipher, (unsigned char *)passphrase, passphrase_len, NULL, NULL); break; #endif default: @@ -3807,7 +4082,7 @@ PHP_FUNCTION(openssl_pkey_export) cipher = NULL; } - switch (EVP_PKEY_type(key->type)) { + switch (EVP_PKEY_base_id(key)) { #ifdef HAVE_EVP_PKEY_EC case EVP_PKEY_EC: pem_write = PEM_write_bio_ECPrivateKey(bio_out, EVP_PKEY_get1_EC_KEY(key), cipher, (unsigned char *)passphrase, passphrase_len, NULL, NULL); @@ -3928,25 +4203,33 @@ PHP_FUNCTION(openssl_pkey_get_details) /*TODO: Use the real values once the openssl constants are used * See the enum at the top of this file */ - switch (EVP_PKEY_type(pkey->type)) { + switch (EVP_PKEY_base_id(pkey)) { case EVP_PKEY_RSA: case EVP_PKEY_RSA2: - ktype = OPENSSL_KEYTYPE_RSA; - - if (pkey->pkey.rsa != NULL) { - zval *rsa; - - ALLOC_INIT_ZVAL(rsa); - array_init(rsa); - OPENSSL_PKEY_GET_BN(rsa, n); - OPENSSL_PKEY_GET_BN(rsa, e); - OPENSSL_PKEY_GET_BN(rsa, d); - OPENSSL_PKEY_GET_BN(rsa, p); - OPENSSL_PKEY_GET_BN(rsa, q); - OPENSSL_PKEY_GET_BN(rsa, dmp1); - OPENSSL_PKEY_GET_BN(rsa, dmq1); - OPENSSL_PKEY_GET_BN(rsa, iqmp); - add_assoc_zval(return_value, "rsa", rsa); + { + RSA *rsa = EVP_PKEY_get0_RSA(pkey); + ktype = OPENSSL_KEYTYPE_RSA; + + if (rsa != NULL) { + zval *z_rsa; + const BIGNUM *n, *e, *d, *p, *q, *dmp1, *dmq1, *iqmp; + + RSA_get0_key(rsa, &n, &e, &d); + RSA_get0_factors(rsa, &p, &q); + RSA_get0_crt_params(rsa, &dmp1, &dmq1, &iqmp); + + ALLOC_INIT_ZVAL(z_rsa); + array_init(z_rsa); + OPENSSL_PKEY_GET_BN(z_rsa, n); + OPENSSL_PKEY_GET_BN(z_rsa, e); + OPENSSL_PKEY_GET_BN(z_rsa, d); + OPENSSL_PKEY_GET_BN(z_rsa, p); + OPENSSL_PKEY_GET_BN(z_rsa, q); + OPENSSL_PKEY_GET_BN(z_rsa, dmp1); + OPENSSL_PKEY_GET_BN(z_rsa, dmq1); + OPENSSL_PKEY_GET_BN(z_rsa, iqmp); + add_assoc_zval(return_value, "rsa", z_rsa); + } } break; @@ -3954,42 +4237,55 @@ PHP_FUNCTION(openssl_pkey_get_details) case EVP_PKEY_DSA2: case EVP_PKEY_DSA3: case EVP_PKEY_DSA4: - ktype = OPENSSL_KEYTYPE_DSA; - - if (pkey->pkey.dsa != NULL) { - zval *dsa; - - ALLOC_INIT_ZVAL(dsa); - array_init(dsa); - OPENSSL_PKEY_GET_BN(dsa, p); - OPENSSL_PKEY_GET_BN(dsa, q); - OPENSSL_PKEY_GET_BN(dsa, g); - OPENSSL_PKEY_GET_BN(dsa, priv_key); - OPENSSL_PKEY_GET_BN(dsa, pub_key); - add_assoc_zval(return_value, "dsa", dsa); + { + DSA *dsa = EVP_PKEY_get0_DSA(pkey); + ktype = OPENSSL_KEYTYPE_DSA; + + if (dsa != NULL) { + zval *z_dsa; + const BIGNUM *p, *q, *g, *priv_key, *pub_key; + + DSA_get0_pqg(dsa, &p, &q, &g); + DSA_get0_key(dsa, &pub_key, &priv_key); + + ALLOC_INIT_ZVAL(z_dsa); + array_init(z_dsa); + OPENSSL_PKEY_GET_BN(z_dsa, p); + OPENSSL_PKEY_GET_BN(z_dsa, q); + OPENSSL_PKEY_GET_BN(z_dsa, g); + OPENSSL_PKEY_GET_BN(z_dsa, priv_key); + OPENSSL_PKEY_GET_BN(z_dsa, pub_key); + add_assoc_zval(return_value, "dsa", z_dsa); + } } break; case EVP_PKEY_DH: - - ktype = OPENSSL_KEYTYPE_DH; - - if (pkey->pkey.dh != NULL) { - zval *dh; - - ALLOC_INIT_ZVAL(dh); - array_init(dh); - OPENSSL_PKEY_GET_BN(dh, p); - OPENSSL_PKEY_GET_BN(dh, g); - OPENSSL_PKEY_GET_BN(dh, priv_key); - OPENSSL_PKEY_GET_BN(dh, pub_key); - add_assoc_zval(return_value, "dh", dh); + { + DH *dh = EVP_PKEY_get0_DH(pkey); + ktype = OPENSSL_KEYTYPE_DH; + + if (dh != NULL) { + zval *z_dh; + const BIGNUM *p, *q, *g, *priv_key, *pub_key; + + DH_get0_pqg(dh, &p, &q, &g); + DH_get0_key(dh, &pub_key, &priv_key); + + ALLOC_INIT_ZVAL(z_dh); + array_init(z_dh); + OPENSSL_PKEY_GET_BN(z_dh, p); + OPENSSL_PKEY_GET_BN(z_dh, g); + OPENSSL_PKEY_GET_BN(z_dh, priv_key); + OPENSSL_PKEY_GET_BN(z_dh, pub_key); + add_assoc_zval(return_value, "dh", z_dh); + } } break; #ifdef HAVE_EVP_PKEY_EC case EVP_PKEY_EC: ktype = OPENSSL_KEYTYPE_EC; - if (pkey->pkey.ec != NULL) { + if (EVP_PKEY_get0_EC_KEY(pkey) != NULL) { zval *ec; const EC_GROUP *ec_group; int nid; @@ -4546,13 +4842,13 @@ PHP_FUNCTION(openssl_private_encrypt) cryptedlen = EVP_PKEY_size(pkey); cryptedbuf = emalloc(cryptedlen + 1); - switch (pkey->type) { + switch (EVP_PKEY_id(pkey)) { case EVP_PKEY_RSA: case EVP_PKEY_RSA2: successful = (RSA_private_encrypt(data_len, (unsigned char *)data, cryptedbuf, - pkey->pkey.rsa, + EVP_PKEY_get0_RSA(pkey), padding) == cryptedlen); break; default: @@ -4604,13 +4900,13 @@ PHP_FUNCTION(openssl_private_decrypt) cryptedlen = EVP_PKEY_size(pkey); crypttemp = emalloc(cryptedlen + 1); - switch (pkey->type) { + switch (EVP_PKEY_id(pkey)) { case EVP_PKEY_RSA: case EVP_PKEY_RSA2: cryptedlen = RSA_private_decrypt(data_len, (unsigned char *)data, crypttemp, - pkey->pkey.rsa, + EVP_PKEY_get0_RSA(pkey), padding); if (cryptedlen != -1) { cryptedbuf = emalloc(cryptedlen + 1); @@ -4669,13 +4965,13 @@ PHP_FUNCTION(openssl_public_encrypt) cryptedlen = EVP_PKEY_size(pkey); cryptedbuf = emalloc(cryptedlen + 1); - switch (pkey->type) { + switch (EVP_PKEY_id(pkey)) { case EVP_PKEY_RSA: case EVP_PKEY_RSA2: successful = (RSA_public_encrypt(data_len, (unsigned char *)data, cryptedbuf, - pkey->pkey.rsa, + EVP_PKEY_get0_RSA(pkey), padding) == cryptedlen); break; default: @@ -4728,13 +5024,13 @@ PHP_FUNCTION(openssl_public_decrypt) cryptedlen = EVP_PKEY_size(pkey); crypttemp = emalloc(cryptedlen + 1); - switch (pkey->type) { + switch (EVP_PKEY_id(pkey)) { case EVP_PKEY_RSA: case EVP_PKEY_RSA2: cryptedlen = RSA_public_decrypt(data_len, (unsigned char *)data, crypttemp, - pkey->pkey.rsa, + EVP_PKEY_get0_RSA(pkey), padding); if (cryptedlen != -1) { cryptedbuf = emalloc(cryptedlen + 1); @@ -4798,7 +5094,7 @@ PHP_FUNCTION(openssl_sign) long keyresource = -1; char * data; int data_len; - EVP_MD_CTX md_ctx; + EVP_MD_CTX *md_ctx; zval *method = NULL; long signature_algo = OPENSSL_ALGO_SHA1; const EVP_MD *mdtype; @@ -4831,9 +5127,10 @@ PHP_FUNCTION(openssl_sign) siglen = EVP_PKEY_size(pkey); sigbuf = emalloc(siglen + 1); - EVP_SignInit(&md_ctx, mdtype); - EVP_SignUpdate(&md_ctx, data, data_len); - if (EVP_SignFinal (&md_ctx, sigbuf,(unsigned int *)&siglen, pkey)) { + md_ctx = EVP_MD_CTX_create(); + EVP_SignInit(md_ctx, mdtype); + EVP_SignUpdate(md_ctx, data, data_len); + if (EVP_SignFinal (md_ctx, sigbuf,(unsigned int *)&siglen, pkey)) { zval_dtor(signature); sigbuf[siglen] = '\0'; ZVAL_STRINGL(signature, (char *)sigbuf, siglen, 0); @@ -4842,7 +5139,7 @@ PHP_FUNCTION(openssl_sign) efree(sigbuf); RETVAL_FALSE; } - EVP_MD_CTX_cleanup(&md_ctx); + EVP_MD_CTX_destroy(md_ctx); if (keyresource == -1) { EVP_PKEY_free(pkey); } @@ -4856,7 +5153,7 @@ PHP_FUNCTION(openssl_verify) zval **key; EVP_PKEY *pkey; int err; - EVP_MD_CTX md_ctx; + EVP_MD_CTX *md_ctx; const EVP_MD *mdtype; long keyresource = -1; char * data; int data_len; @@ -4890,10 +5187,11 @@ PHP_FUNCTION(openssl_verify) RETURN_FALSE; } - EVP_VerifyInit (&md_ctx, mdtype); - EVP_VerifyUpdate (&md_ctx, data, data_len); - err = EVP_VerifyFinal (&md_ctx, (unsigned char *)signature, signature_len, pkey); - EVP_MD_CTX_cleanup(&md_ctx); + md_ctx = EVP_MD_CTX_create(); + EVP_VerifyInit (md_ctx, mdtype); + EVP_VerifyUpdate (md_ctx, data, data_len); + err = EVP_VerifyFinal (md_ctx, (unsigned char *)signature, signature_len, pkey); + EVP_MD_CTX_destroy(md_ctx); if (keyresource == -1) { EVP_PKEY_free(pkey); @@ -4917,7 +5215,7 @@ PHP_FUNCTION(openssl_seal) char *method =NULL; int method_len = 0; const EVP_CIPHER *cipher; - EVP_CIPHER_CTX ctx; + EVP_CIPHER_CTX *ctx; if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "szza/|s", &data, &data_len, &sealdata, &ekeys, &pubkeys, &method, &method_len) == FAILURE) { return; @@ -4950,6 +5248,7 @@ PHP_FUNCTION(openssl_seal) memset(eks, 0, sizeof(*eks) * nkeys); key_resources = safe_emalloc(nkeys, sizeof(long), 0); memset(key_resources, 0, sizeof(*key_resources) * nkeys); + memset(pkeys, 0, sizeof(*pkeys) * nkeys); /* get the public keys we are using to seal this data */ zend_hash_internal_pointer_reset_ex(pubkeysht, &pos); @@ -4967,27 +5266,28 @@ PHP_FUNCTION(openssl_seal) i++; } - if (!EVP_EncryptInit(&ctx,cipher,NULL,NULL)) { + ctx = EVP_CIPHER_CTX_new(); + if (ctx == NULL || !EVP_EncryptInit(ctx,cipher,NULL,NULL)) { RETVAL_FALSE; - EVP_CIPHER_CTX_cleanup(&ctx); + EVP_CIPHER_CTX_free(ctx); goto clean_exit; } #if 0 /* Need this if allow ciphers that require initialization vector */ - ivlen = EVP_CIPHER_CTX_iv_length(&ctx); + ivlen = EVP_CIPHER_CTX_iv_length(ctx); iv = ivlen ? emalloc(ivlen + 1) : NULL; #endif /* allocate one byte extra to make room for \0 */ - buf = emalloc(data_len + EVP_CIPHER_CTX_block_size(&ctx)); - EVP_CIPHER_CTX_cleanup(&ctx); + buf = emalloc(data_len + EVP_CIPHER_CTX_block_size(ctx)); + EVP_CIPHER_CTX_cleanup(ctx); - if (EVP_SealInit(&ctx, cipher, eks, eksl, NULL, pkeys, nkeys) <= 0 || - !EVP_SealUpdate(&ctx, buf, &len1, (unsigned char *)data, data_len) || - !EVP_SealFinal(&ctx, buf + len1, &len2)) { + if (EVP_SealInit(ctx, cipher, eks, eksl, NULL, pkeys, nkeys) <= 0 || + !EVP_SealUpdate(ctx, buf, &len1, (unsigned char *)data, data_len) || + !EVP_SealFinal(ctx, buf + len1, &len2)) { RETVAL_FALSE; efree(buf); - EVP_CIPHER_CTX_cleanup(&ctx); + EVP_CIPHER_CTX_free(ctx); goto clean_exit; } @@ -5018,7 +5318,7 @@ PHP_FUNCTION(openssl_seal) efree(buf); } RETVAL_LONG(len1 + len2); - EVP_CIPHER_CTX_cleanup(&ctx); + EVP_CIPHER_CTX_free(ctx); clean_exit: for (i=0; i keylen) { - EVP_CIPHER_CTX_set_key_length(&cipher_ctx, password_len); + EVP_CIPHER_CTX_set_key_length(cipher_ctx, password_len); } - EVP_EncryptInit_ex(&cipher_ctx, NULL, NULL, key, (unsigned char *)iv); + EVP_EncryptInit_ex(cipher_ctx, NULL, NULL, key, (unsigned char *)iv); if (options & OPENSSL_ZERO_PADDING) { - EVP_CIPHER_CTX_set_padding(&cipher_ctx, 0); + EVP_CIPHER_CTX_set_padding(cipher_ctx, 0); } if (data_len > 0) { - EVP_EncryptUpdate(&cipher_ctx, outbuf, &i, (unsigned char *)data, data_len); + EVP_EncryptUpdate(cipher_ctx, outbuf, &i, (unsigned char *)data, data_len); } outlen = i; - if (EVP_EncryptFinal(&cipher_ctx, (unsigned char *)outbuf + i, &i)) { + if (EVP_EncryptFinal(cipher_ctx, (unsigned char *)outbuf + i, &i)) { outlen += i; if (options & OPENSSL_RAW_DATA) { outbuf[outlen] = '\0'; @@ -5301,7 +5610,8 @@ PHP_FUNCTION(openssl_encrypt) if (free_iv) { efree(iv); } - EVP_CIPHER_CTX_cleanup(&cipher_ctx); + EVP_CIPHER_CTX_cleanup(cipher_ctx); + EVP_CIPHER_CTX_free(cipher_ctx); } /* }}} */ @@ -5313,7 +5623,7 @@ PHP_FUNCTION(openssl_decrypt) char *data, *method, *password, *iv = ""; int data_len, method_len, password_len, iv_len = 0; const EVP_CIPHER *cipher_type; - EVP_CIPHER_CTX cipher_ctx; + EVP_CIPHER_CTX *cipher_ctx; int i, outlen, keylen; unsigned char *outbuf, *key; int base64_str_len; @@ -5359,17 +5669,23 @@ PHP_FUNCTION(openssl_decrypt) outlen = data_len + EVP_CIPHER_block_size(cipher_type); outbuf = emalloc(outlen + 1); - EVP_DecryptInit(&cipher_ctx, cipher_type, NULL, NULL); + cipher_ctx = EVP_CIPHER_CTX_new(); + if (!cipher_ctx) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Failed to create cipher context"); + RETURN_FALSE; + } + + EVP_DecryptInit(cipher_ctx, cipher_type, NULL, NULL); if (password_len > keylen) { - EVP_CIPHER_CTX_set_key_length(&cipher_ctx, password_len); + EVP_CIPHER_CTX_set_key_length(cipher_ctx, password_len); } - EVP_DecryptInit_ex(&cipher_ctx, NULL, NULL, key, (unsigned char *)iv); + EVP_DecryptInit_ex(cipher_ctx, NULL, NULL, key, (unsigned char *)iv); if (options & OPENSSL_ZERO_PADDING) { - EVP_CIPHER_CTX_set_padding(&cipher_ctx, 0); + EVP_CIPHER_CTX_set_padding(cipher_ctx, 0); } - EVP_DecryptUpdate(&cipher_ctx, outbuf, &i, (unsigned char *)data, data_len); + EVP_DecryptUpdate(cipher_ctx, outbuf, &i, (unsigned char *)data, data_len); outlen = i; - if (EVP_DecryptFinal(&cipher_ctx, (unsigned char *)outbuf + i, &i)) { + if (EVP_DecryptFinal(cipher_ctx, (unsigned char *)outbuf + i, &i)) { outlen += i; outbuf[outlen] = '\0'; RETVAL_STRINGL((char *)outbuf, outlen, 0); @@ -5386,7 +5702,8 @@ PHP_FUNCTION(openssl_decrypt) if (base64_str) { efree(base64_str); } - EVP_CIPHER_CTX_cleanup(&cipher_ctx); + EVP_CIPHER_CTX_cleanup(cipher_ctx); + EVP_CIPHER_CTX_free(cipher_ctx); } /* }}} */ @@ -5424,6 +5741,7 @@ PHP_FUNCTION(openssl_dh_compute_key) zval *key; char *pub_str; int pub_len; + DH *dh; EVP_PKEY *pkey; BIGNUM *pub; char *data; @@ -5433,14 +5751,21 @@ PHP_FUNCTION(openssl_dh_compute_key) return; } ZEND_FETCH_RESOURCE(pkey, EVP_PKEY *, &key, -1, "OpenSSL key", le_key); - if (!pkey || EVP_PKEY_type(pkey->type) != EVP_PKEY_DH || !pkey->pkey.dh) { + if (pkey == NULL) { + RETURN_FALSE; + } + if (EVP_PKEY_base_id(pkey) != EVP_PKEY_DH) { + RETURN_FALSE; + } + dh = EVP_PKEY_get0_DH(pkey); + if (dh == NULL) { RETURN_FALSE; } pub = BN_bin2bn((unsigned char*)pub_str, pub_len, NULL); - data = emalloc(DH_size(pkey->pkey.dh) + 1); - len = DH_compute_key((unsigned char*)data, pub, pkey->pkey.dh); + data = emalloc(DH_size(dh) + 1); + len = DH_compute_key((unsigned char*)data, pub, dh); if (len >= 0) { data[len] = 0; diff -rupN php-5.6.31.orig/ext/openssl/tests/bug41033.phpt php-5.6.31/ext/openssl/tests/bug41033.phpt --- php-5.6.31.orig/ext/openssl/tests/bug41033.phpt 2017-07-06 00:25:00.000000000 +0200 +++ php-5.6.31/ext/openssl/tests/bug41033.phpt 2017-08-01 10:49:25.008823468 +0200 @@ -13,11 +13,11 @@ $pub = 'file://' . dirname(__FILE__) . ' $prkeyid = openssl_get_privatekey($prv, "1234"); $ct = "Hello I am some text!"; -openssl_sign($ct, $signature, $prkeyid, OPENSSL_ALGO_DSS1); +openssl_sign($ct, $signature, $prkeyid, OPENSSL_VERSION_NUMBER < 0x10100000 ? OPENSSL_ALGO_DSS1 : OPENSSL_ALGO_SHA1); echo "Signature: ".base64_encode($signature) . "\n"; $pukeyid = openssl_get_publickey($pub); -$valid = openssl_verify($ct, $signature, $pukeyid, OPENSSL_ALGO_DSS1); +$valid = openssl_verify($ct, $signature, $pukeyid, OPENSSL_VERSION_NUMBER < 0x10100000 ? OPENSSL_ALGO_DSS1 : OPENSSL_ALGO_SHA1); echo "Signature validity: " . $valid . "\n"; diff -rupN php-5.6.31.orig/ext/openssl/tests/bug66501.phpt php-5.6.31/ext/openssl/tests/bug66501.phpt --- php-5.6.31.orig/ext/openssl/tests/bug66501.phpt 2017-07-06 00:25:00.000000000 +0200 +++ php-5.6.31/ext/openssl/tests/bug66501.phpt 2017-08-01 10:49:25.008823468 +0200 @@ -16,7 +16,7 @@ AwEHoUQDQgAEPq4hbIWHvB51rdWr8ejrjWo4qVNW sqOTOnMoezkbSmVVMuwz9flvnqHGmQvmug== -----END EC PRIVATE KEY-----'; $key = openssl_pkey_get_private($pkey); -$res = openssl_sign($data ='alpha', $sign, $key, 'ecdsa-with-SHA1'); +$res = openssl_sign($data ='alpha', $sign, $key, OPENSSL_VERSION_NUMBER < 0x10100000 ? 'ecdsa-with-SHA1' : 'SHA1'); var_dump($res); --EXPECTF-- bool(true) diff -rupN php-5.6.31.orig/ext/openssl/tests/openssl_error_string_basic.phpt php-5.6.31/ext/openssl/tests/openssl_error_string_basic.phpt --- php-5.6.31.orig/ext/openssl/tests/openssl_error_string_basic.phpt 2017-07-06 00:25:00.000000000 +0200 +++ php-5.6.31/ext/openssl/tests/openssl_error_string_basic.phpt 2017-08-01 10:49:25.008823468 +0200 @@ -105,7 +105,7 @@ expect_openssl_errors('openssl_private_d // public encrypt and decrypt with failed padding check and padding @openssl_public_encrypt("data", $crypted, $public_key_file, 1000); @openssl_public_decrypt("data", $crypted, $public_key_file); -expect_openssl_errors('openssl_private_(en|de)crypt padding', ['0906D06C', '04068076', '0407006A', '04067072']); +expect_openssl_errors('openssl_private_(en|de)crypt padding', OPENSSL_VERSION_NUMBER < 0x10100000 ? ['0906D06C', '04068076', '0407006A', '04067072'] : ['0906D06C', '04068076', '04067072']); // X509 echo "X509 errors\n"; diff -rupN php-5.6.31.orig/ext/openssl/tests/sni_server.phpt php-5.6.31/ext/openssl/tests/sni_server.phpt --- php-5.6.31.orig/ext/openssl/tests/sni_server.phpt 2017-07-06 00:25:00.000000000 +0200 +++ php-5.6.31/ext/openssl/tests/sni_server.phpt 2017-08-01 10:49:25.012823468 +0200 @@ -27,6 +27,9 @@ CODE; $clientCode = <<<'CODE' $flags = STREAM_CLIENT_CONNECT; $ctxArr = [ + 'verify_peer' => false, + 'verify_peer_name' => false, + 'allow_self_signed' => true, 'cafile' => __DIR__ . '/sni_server_ca.pem', 'capture_peer_cert' => true ]; diff -rupN php-5.6.31.orig/ext/openssl/xp_ssl.c php-5.6.31/ext/openssl/xp_ssl.c --- php-5.6.31.orig/ext/openssl/xp_ssl.c 2017-07-06 00:25:00.000000000 +0200 +++ php-5.6.31/ext/openssl/xp_ssl.c 2017-08-01 10:49:25.012823468 +0200 @@ -935,7 +935,7 @@ static int set_local_cert(SSL_CTX *ctx, static const SSL_METHOD *php_select_crypto_method(long method_value, int is_client TSRMLS_DC) /* {{{ */ { if (method_value == STREAM_CRYPTO_METHOD_SSLv2) { -#ifndef OPENSSL_NO_SSL2 +#if !defined(OPENSSL_NO_SSL2) && OPENSSL_VERSION_NUMBER < 0x10100000L return is_client ? SSLv2_client_method() : SSLv2_server_method(); #else php_error_docref(NULL TSRMLS_CC, E_WARNING, @@ -1588,12 +1588,26 @@ int php_openssl_setup_crypto(php_stream } /* }}} */ +#define PHP_SSL_MAX_VERSION_LEN 32 + +static char *php_ssl_cipher_get_version(const SSL_CIPHER *c, char *buffer, size_t max_len) /* {{{ */ +{ + const char *version = SSL_CIPHER_get_version(c); + strncpy(buffer, version, max_len); + if (max_len <= strlen(version)) { + buffer[max_len - 1] = 0; + } + return buffer; +} +/* }}} */ + static zval *capture_session_meta(SSL *ssl_handle) /* {{{ */ { zval *meta_arr; char *proto_str; long proto = SSL_version(ssl_handle); const SSL_CIPHER *cipher = SSL_get_current_cipher(ssl_handle); + char version_str[PHP_SSL_MAX_VERSION_LEN]; switch (proto) { #if OPENSSL_VERSION_NUMBER >= 0x10001001L @@ -1611,7 +1625,7 @@ static zval *capture_session_meta(SSL *s add_assoc_string(meta_arr, "protocol", proto_str, 1); add_assoc_string(meta_arr, "cipher_name", (char *) SSL_CIPHER_get_name(cipher), 1); add_assoc_long(meta_arr, "cipher_bits", SSL_CIPHER_get_bits(cipher, NULL)); - add_assoc_string(meta_arr, "cipher_version", SSL_CIPHER_get_version(cipher), 1); + add_assoc_string(meta_arr, "cipher_version", php_ssl_cipher_get_version(cipher, version_str, PHP_SSL_MAX_VERSION_LEN), 1); return meta_arr; } diff -rupN php-5.6.31.orig/ext/phar/util.c php-5.6.31/ext/phar/util.c --- php-5.6.31.orig/ext/phar/util.c 2017-07-06 00:25:00.000000000 +0200 +++ php-5.6.31/ext/phar/util.c 2017-08-01 10:49:25.020823468 +0200 @@ -1531,7 +1531,7 @@ int phar_verify_signature(php_stream *fp BIO *in; EVP_PKEY *key; EVP_MD *mdtype = (EVP_MD *) EVP_sha1(); - EVP_MD_CTX md_ctx; + EVP_MD_CTX *md_ctx; #else int tempsig; #endif @@ -1608,7 +1608,8 @@ int phar_verify_signature(php_stream *fp return FAILURE; } - EVP_VerifyInit(&md_ctx, mdtype); + md_ctx = EVP_MD_CTX_create(); + EVP_VerifyInit(md_ctx, mdtype); read_len = end_of_phar; if (read_len > sizeof(buf)) { @@ -1620,7 +1621,7 @@ int phar_verify_signature(php_stream *fp php_stream_seek(fp, 0, SEEK_SET); while (read_size && (len = php_stream_read(fp, (char*)buf, read_size)) > 0) { - EVP_VerifyUpdate (&md_ctx, buf, len); + EVP_VerifyUpdate (md_ctx, buf, len); read_len -= (off_t)len; if (read_len < read_size) { @@ -1628,9 +1629,9 @@ int phar_verify_signature(php_stream *fp } } - if (EVP_VerifyFinal(&md_ctx, (unsigned char *)sig, sig_len, key) != 1) { + if (EVP_VerifyFinal(md_ctx, (unsigned char *)sig, sig_len, key) != 1) { /* 1: signature verified, 0: signature does not match, -1: failed signature operation */ - EVP_MD_CTX_cleanup(&md_ctx); + EVP_MD_CTX_destroy(md_ctx); if (error) { spprintf(error, 0, "broken openssl signature"); @@ -1639,7 +1640,7 @@ int phar_verify_signature(php_stream *fp return FAILURE; } - EVP_MD_CTX_cleanup(&md_ctx); + EVP_MD_CTX_destroy(md_ctx); #endif *signature_len = phar_hex_str((const char*)sig, sig_len, signature TSRMLS_CC); ================================================ FILE: aegir/patches/activity.patch ================================================ diff -urp a/activity.install b/activity.install --- a/activity.install 2010-06-30 21:04:18.000000000 +0000 +++ b/activity.install 2010-10-15 21:41:11.000000000 +0000 @@ -5,7 +5,7 @@ function activity_install() { drupal_install_schema('activity'); // Set Trigger's weight to 2 so that it will fire AFTER pathauto. This makes // pathauto alias' work. - if (activity_bad_trigger_weight()) { + if (activity_bad_trigger_weight() && isset($_SERVER['HTTP_USER_AGENT'])) { drupal_set_message(t('In order for proper Pathauto behavior with Activity module, the Trigger module\'s weight needs to be fixed up. !clickhere', array('!clickhere' => l(t('Click here to fix Trigger\'s weight'), 'admin/activity/weight', array('query' => drupal_get_destination())))), 'error'); } } @@ -214,4 +214,4 @@ function activity_update_6201() { $ret = array(); db_change_field($ret, 'activity_messages', 'amid', 'amid', array('type' => 'serial', 'unsigned' => TRUE, 'not null' => TRUE)); return $ret; -} \ No newline at end of file +} ================================================ FILE: aegir/patches/apps_msg.patch ================================================ diff -urp a/apps.profile.inc b/apps.profile.inc --- a/apps.profile.inc 2012-10-14 06:42:00.000000000 -0400 +++ b/apps.profile.inc 2012-10-14 06:42:48.000000000 -0400 @@ -177,7 +177,7 @@ function apps_profile_download_batch_fin 'title' => t('Downloading updates failed:'), 'items' => $results['errors'], ); - drupal_set_message(theme('item_list', $error_list), 'error'); + //drupal_set_message(theme('item_list', $error_list), 'error'); } elseif ($success) { drupal_set_message(t('Updates downloaded successfully.')); ================================================ FILE: aegir/patches/bug62886.patch ================================================ diff --git a/sapi/fpm/fpm/fpm.c b/sapi/fpm/fpm/fpm.c index dab415d..2f42175 100644 --- a/sapi/fpm/fpm/fpm.c +++ b/sapi/fpm/fpm/fpm.c @@ -39,7 +39,7 @@ struct fpm_globals_s fpm_globals = { .test_successful = 0, .heartbeat = 0, .run_as_root = 0, - .send_config_signal = 0, + .send_config_pipe = {0, 0}, }; int fpm_init(int argc, char **argv, char *config, char *prefix, char *pid, int test_conf, int run_as_root) /* {{{ */ diff --git a/sapi/fpm/fpm/fpm.h b/sapi/fpm/fpm/fpm.h index 7a2903d..c576876 100644 --- a/sapi/fpm/fpm/fpm.h +++ b/sapi/fpm/fpm/fpm.h @@ -55,7 +55,7 @@ struct fpm_globals_s { int test_successful; int heartbeat; int run_as_root; - int send_config_signal; + int send_config_pipe[2]; }; extern struct fpm_globals_s fpm_globals; diff --git a/sapi/fpm/fpm/fpm_main.c b/sapi/fpm/fpm/fpm_main.c index b058d7a..7d53927 100644 --- a/sapi/fpm/fpm/fpm_main.c +++ b/sapi/fpm/fpm/fpm_main.c @@ -1804,16 +1804,18 @@ consult the installation file that came with this distribution, or visit \n\ if (0 > fpm_init(argc, argv, fpm_config ? fpm_config : CGIG(fpm_config), fpm_prefix, fpm_pid, test_conf, php_allow_to_run_as_root)) { - if (fpm_globals.send_config_signal) { - zlog(ZLOG_DEBUG, "Sending SIGUSR2 (error) to parent %d", getppid()); - kill(getppid(), SIGUSR2); + if (fpm_globals.send_config_pipe[1]) { + int writeval = 0; + zlog(ZLOG_DEBUG, "Sending \"0\" (error) to parent via fd=%d", fpm_globals.send_config_pipe[1]); + write(fpm_globals.send_config_pipe[1], &writeval, sizeof(writeval)); } return FPM_EXIT_CONFIG; } - if (fpm_globals.send_config_signal) { - zlog(ZLOG_DEBUG, "Sending SIGUSR1 (OK) to parent %d", getppid()); - kill(getppid(), SIGUSR1); + if (fpm_globals.send_config_pipe[1]) { + int writeval = 1; + zlog(ZLOG_DEBUG, "Sending \"1\" (OK) to parent via fd=%d", fpm_globals.send_config_pipe[1]); + write(fpm_globals.send_config_pipe[1], &writeval, sizeof(writeval)); } fpm_is_running = 1; diff --git a/sapi/fpm/fpm/fpm_signals.c b/sapi/fpm/fpm/fpm_signals.c index 656269f..8993a86 100644 --- a/sapi/fpm/fpm/fpm_signals.c +++ b/sapi/fpm/fpm/fpm_signals.c @@ -249,15 +249,3 @@ int fpm_signals_get_fd() /* {{{ */ } /* }}} */ -void fpm_signals_sighandler_exit_ok(pid_t pid) /* {{{ */ -{ - exit(FPM_EXIT_OK); -} -/* }}} */ - -void fpm_signals_sighandler_exit_config(pid_t pid) /* {{{ */ -{ - exit(FPM_EXIT_CONFIG); -} -/* }}} */ - diff --git a/sapi/fpm/fpm/fpm_signals.h b/sapi/fpm/fpm/fpm_signals.h index 13484cb..eb80fae 100644 --- a/sapi/fpm/fpm/fpm_signals.h +++ b/sapi/fpm/fpm/fpm_signals.h @@ -11,9 +11,6 @@ int fpm_signals_init_main(); int fpm_signals_init_child(); int fpm_signals_get_fd(); -void fpm_signals_sighandler_exit_ok(pid_t pid); -void fpm_signals_sighandler_exit_config(pid_t pid); - extern const char *fpm_signal_names[NSIG + 1]; #endif diff --git a/sapi/fpm/fpm/fpm_unix.c b/sapi/fpm/fpm/fpm_unix.c index 5c5e37c..443f606 100644 --- a/sapi/fpm/fpm/fpm_unix.c +++ b/sapi/fpm/fpm/fpm_unix.c @@ -262,36 +262,19 @@ int fpm_unix_init_main() /* {{{ */ * The parent process has then to wait for the master * process to initialize to return a consistent exit * value. For this pupose, the master process will - * send USR1 if everything went well and USR2 - * otherwise. + * send \"1\" into the pipe if everything went well + * and \"0\" otherwise. */ - struct sigaction act; - struct sigaction oldact_usr1; - struct sigaction oldact_usr2; - struct timeval tv; - /* - * set sigaction for USR1 before fork - * save old sigaction to restore it after - * fork in the child process (the master process) - */ - memset(&act, 0, sizeof(act)); - memset(&act, 0, sizeof(oldact_usr1)); - act.sa_handler = fpm_signals_sighandler_exit_ok; - sigfillset(&act.sa_mask); - sigaction(SIGUSR1, &act, &oldact_usr1); + struct timeval tv; + fd_set rfds; + int ret; - /* - * set sigaction for USR2 before fork - * save old sigaction to restore it after - * fork in the child process (the master process) - */ - memset(&act, 0, sizeof(act)); - memset(&act, 0, sizeof(oldact_usr2)); - act.sa_handler = fpm_signals_sighandler_exit_config; - sigfillset(&act.sa_mask); - sigaction(SIGUSR2, &act, &oldact_usr2); + if (pipe(fpm_globals.send_config_pipe) == -1) { + zlog(ZLOG_SYSERROR, "failed to create pipe"); + return -1; + } /* then fork */ pid_t pid = fork(); @@ -302,24 +285,54 @@ int fpm_unix_init_main() /* {{{ */ return -1; case 0 : /* children */ - /* restore USR1 and USR2 sigaction */ - sigaction(SIGUSR1, &oldact_usr1, NULL); - sigaction(SIGUSR2, &oldact_usr2, NULL); - fpm_globals.send_config_signal = 1; + close(fpm_globals.send_config_pipe[0]); /* close the read side of the pipe */ break; default : /* parent */ - fpm_cleanups_run(FPM_CLEANUP_PARENT_EXIT); + close(fpm_globals.send_config_pipe[1]); /* close the write side of the pipe */ /* * wait for 10s before exiting with error - * the child is supposed to send USR1 or USR2 to tell the parent + * the child is supposed to send 1 or 0 into the pipe to tell the parent * how it goes for it */ + FD_ZERO(&rfds); + FD_SET(fpm_globals.send_config_pipe[0], &rfds); + tv.tv_sec = 10; tv.tv_usec = 0; - zlog(ZLOG_DEBUG, "The calling process is waiting for the master process to ping"); - select(0, NULL, NULL, NULL, &tv); + + zlog(ZLOG_DEBUG, "The calling process is waiting for the master process to ping via fd=%d", fpm_globals.send_config_pipe[0]); + ret = select(fpm_globals.send_config_pipe[0] + 1, &rfds, NULL, NULL, &tv); + if (ret == -1) { + zlog(ZLOG_SYSERROR, "failed to select"); + exit(FPM_EXIT_SOFTWARE); + } + if (ret) { /* data available */ + int readval; + ret = read(fpm_globals.send_config_pipe[0], &readval, sizeof(readval)); + if (ret == -1) { + zlog(ZLOG_SYSERROR, "failed to read from pipe"); + exit(FPM_EXIT_SOFTWARE); + } + + if (ret == 0) { + zlog(ZLOG_ERROR, "no data have been read from pipe"); + exit(FPM_EXIT_SOFTWARE); + } else { + if (readval == 1) { + zlog(ZLOG_DEBUG, "I received a valid acknoledge from the master process, I can exit without error"); + fpm_cleanups_run(FPM_CLEANUP_PARENT_EXIT); + exit(FPM_EXIT_OK); + } else { + zlog(ZLOG_ERROR, "The master process returned an error !"); + exit(FPM_EXIT_SOFTWARE); + } + } + } else { /* no date sent ! */ + zlog(ZLOG_ERROR, "the master process didn't send back its status (via the pipe to the calling process)"); + exit(FPM_EXIT_SOFTWARE); + } exit(FPM_EXIT_SOFTWARE); } } ================================================ FILE: aegir/patches/civicrm.drush.inc.patch.txt ================================================ diff -burp a/civicrm/drupal/drush/civicrm.drush.inc b/civicrm/drupal/drush/civicrm.drush.inc --- a/civicrm/drupal/drush/civicrm.drush.inc 2014-09-18 11:46:17.000000000 +0000 +++ b/civicrm/drupal/drush/civicrm.drush.inc 2015-02-04 16:13:25.000000000 +0000 @@ -257,6 +257,20 @@ function civicrm_drush_command() { * Implementation of drush_hook_COMMAND_validate for command 'civicrm-install' */ function drush_civicrm_install_validate() { + + switch (substr(drush_core_version(), 0, 1)) { + case '7': + $sql = drush_get_class('Drush\Sql\Sql', array(), array(drush_drupal_major_version())); + $db_spec = $sql->get_db_spec(); + break; + case '6': + case '5': + $db_spec = _drush_sql_get_db_spec(); + break; + default: + drush_set_error('DRUSH_UNSUPPORTED_VERSION', dt('Drush !version is not supported')); + } + // TODO: Replace these with required options (Drush 5). // Get the drupal credentials in case civi specific db info is not passed. if (drush_get_option('db-url', FALSE)) { @@ -445,7 +459,19 @@ function _civicrm_generate_settings_file } $baseUrl = !$baseUrl ? ($GLOBALS['base_url']) : ($protocol . '://' . $baseUrl); + + switch (substr(drush_core_version(), 0, 1)) { + case '7': + $sql = drush_get_class('Drush\Sql\Sql', array(), array(drush_drupal_major_version())); + $db_spec = $sql->get_db_spec(); + break; + case '6': + case '5': $db_spec = _drush_sql_get_db_spec(); + break; + default: + drush_set_error('DRUSH_UNSUPPORTED_VERSION', dt('Drush !version is not supported')); + } // Check version: since 4.1, Drupal6 must be used for the UF in D6 // The file civicrm-version.php appeared around 4.0, so it is safe to assume @@ -961,7 +987,19 @@ function drush_civicrm_restore() { $restore_backup_dir = rtrim($restore_backup_dir, '/'); // get confirmation from user - + switch (substr(drush_core_version(), 0, 1)) { + case '7': + $sql = drush_get_class('Drush\Sql\Sql', array(), array(drush_drupal_major_version())); + $db_spec = $sql->get_db_spec(); + break; + case '6': + case '5': $db_spec = _drush_sql_get_db_spec(); + break; + default: + drush_set_error('DRUSH_UNSUPPORTED_VERSION', dt('Drush !version is not supported')); + } + drush_print(dt("\nProcess involves :")); drush_print(dt("1. Restoring '\$restore-dir/civicrm' directory to '!toDir'.", array('!toDir' => $civicrm_root_base))); drush_print(dt("2. Dropping and creating '!db' database.", array('!db' => $db_spec['database']))); ================================================ FILE: aegir/patches/civicrm_engage.install ================================================ array( 'label' => 'Media Contact', 'parent_id' => 1, 'is_active' => 1, 'name' => 'Media_Contact', ), 'Funder_Contact' => array( 'label' => 'Funder Contact', 'parent_id' => 1, 'is_active' => 1, 'name' => 'Funder_Contact', ), 'Elected_Official' => array( 'label' => 'Elected Official', 'parent_id' => 1, 'is_active' => 1, 'name' => 'Elected_Official', ), 'Media_Outlet' => array( 'label' => 'Media Outlet', 'parent_id' => 3, 'is_active' => 1, 'name' => 'Media_Outlet', ), 'Foundation' => array( 'label' => 'Foundation', 'parent_id' => 3, 'is_active' => 1, 'name' => 'Foundation', ), ); require_once ("CRM/Contact/BAO/ContactType.php"); $existing_types = CRM_Contact_BAO_ContactType::subTypeInfo(); while (list($k) = each($existing_types)) { if (array_key_exists($k, $create)) { drupal_set_message(t("Not creating @type, already exists.", array("@type" => $k))); unset($create[$k]); } } $contact_type = new CRM_Contact_BAO_ContactType(); while (list($k, $v) = each($create)) { drupal_set_message(t("Creating %c", array('%c' => $k))); $contact_type->add($v); } } /** * Street parsing is required for walk lists because it needs to * sort by even/odd address numbers so, when canvassing a street * in which even addresses are on one side and odd on the other, you * can divide the task between two people with two different lists. */ function civcrm_engage_enable_street_address_parsing() { include_once 'CRM/Core/BAO/Setting.php'; $address_options = CRM_Core_BAO_Setting::valueOptions(CRM_Core_BAO_Setting::SYSTEM_PREFERENCES_NAME, 'address_options', TRUE, NULL, TRUE ); $address_options['street_address_parsing'] = 1; CRM_Core_BAO_Setting::setValueOption(CRM_Core_BAO_Setting::SYSTEM_PREFERENCES_NAME, 'address_options', $address_options ); } /** * Check Phone Number for auto complete. This setting doubles for batch * update, and when making a phone list in CiviCampaign you really need * to have the phone number included. */ function civcrm_engage_set_autocomplete_options() { include_once 'CRM/Core/BAO/Setting.php'; $contact_autocomplete_options = CRM_Core_BAO_Setting::valueOptions( CRM_Core_BAO_Setting::SYSTEM_PREFERENCES_NAME, 'contact_autocomplete_options', TRUE, NULL, TRUE ); $contact_autocomplete_options['phone'] = 1; CRM_Core_BAO_Setting::setValueOption( CRM_Core_BAO_Setting::SYSTEM_PREFERENCES_NAME, 'contact_autocomplete_options', $contact_autocomplete_options ); } function civicrm_engage_load_configuration() { drupal_set_message("Loading default civicrm_engage configuration."); // we need to build the path to the CustomGroupDate.xml file // shipped in the civicrm_engage directory. civicrm_engage could // be installed outside of the civicrm root, so we can't rely on // that contstant. // instead... start with the drupal root $root = getcwd(); // and then added the relative path to the module $civi_engage_path = drupal_get_path('module', 'civicrm_engage'); $xml_file = $root . '/' . $civi_engage_path . '/CustomGroupData.xml'; require_once 'CRM/Utils/Migrate/Import.php'; $import = new CRM_Utils_Migrate_Import(); $import->run($xml_file); } ================================================ FILE: aegir/patches/commerce_kickstart.patch ================================================ diff --git a/profiles/commerce_kickstart/modules/commerce_kickstart/commerce_kickstart_slideshow/commerce_kickstart_slideshow.module b/profiles/commerce_kickstart/modules/commerce_kickstart/commerce_kickstart_slideshow/commerce_kickstart_slideshow.module index ce7bbed..6e4af5a 100644 --- a/profiles/commerce_kickstart/modules/commerce_kickstart/commerce_kickstart_slideshow/commerce_kickstart_slideshow.module +++ b/profiles/commerce_kickstart/modules/commerce_kickstart/commerce_kickstart_slideshow/commerce_kickstart_slideshow.module @@ -15,7 +15,7 @@ function commerce_kickstart_slideshow_library() { 'website' => 'http://bxslider.com/', 'version' => '4.0', 'js' => array( - libraries_get_path('jquery.bxslider') . '/jquery.bxslider.min.js' => array(), + libraries_get_path('jquery.bxslider') . '/dist/jquery.bxslider.min.js' => array(), ), ); return $libraries; ================================================ FILE: aegir/patches/commons-1045778-fix-aegir-installs.patch ================================================ diff --git a/drupal_commons.profile b/drupal_commons.profile index 48f7a16..57b5089 100644 --- a/drupal_commons.profile +++ b/drupal_commons.profile @@ -68,7 +68,7 @@ function drupal_commons_profile_modules() { * language-specific profiles. */ function drupal_commons_profile_details() { - $logo = 'Drupal Commons'; + $logo = 'Drupal Commons'; $description = st('Select this profile to install the Drupal Commons distribution for powering your community website. Drupal Commons provides provides blogging, discussions, user profiles, and other useful community features for both private communities (e.g. an Intranet), or public communities (e.g. a customer community).'); $description .= '
    ' . $logo; ================================================ FILE: aegir/patches/commons-1060250-aegir-infinite-loop.patch ================================================ diff --git a/drupal_commons.profile b/drupal_commons.profile index 57b5089..ae0ffbd 100644 --- a/drupal_commons.profile +++ b/drupal_commons.profile @@ -116,7 +116,33 @@ function drupal_commons_profile_tasks(&$task, $url) { // Provide a form to choose features if ($task == 'configure-commons') { - $output = drupal_get_form('drupal_commons_features_form', $url); + if (defined('DRUSH_BASE_PATH')) { + // Set some sane defaults + $features = array( + 'commons_core', + 'commons_home', + 'commons_blog', + 'commons_discussion', + 'commons_document', + 'commons_wiki', + 'commons_poll', + 'commons_event', + 'commons_dashboard', + 'commons_notifications', + 'commons_reputation', + 'commons_group_aggregator', + 'commons_admin', + 'commons_seo' + ); + variable_set('commons_selected_features', $features); + + // Initiate the next installation step + $task = 'install-commons'; + variable_set('install_task', $task); + } + else { + $output = drupal_get_form('drupal_commons_features_form', $url); + } } // Installation batch process ================================================ FILE: aegir/patches/commons_chicken_egg.patch ================================================ diff -urp a/commons.install b/commons.install --- a/commons.install 2014-08-08 15:45:53.000000000 -0400 +++ b/commons.install 2014-08-08 15:38:43.000000000 -0400 @@ -474,7 +474,8 @@ function commons_add_user_avatar($accoun if ($account->uid) { $picture_directory = file_default_scheme() . '://' . variable_get('user_picture_path', 'pictures'); if(file_prepare_directory($picture_directory, FILE_CREATE_DIRECTORY)){ - $picture_result = drupal_http_request($base_url . '/profiles/commons/images/avatars/avatar-' . commons_normalize_name($account->name) . '.png'); + $tmp_url = 'http://127.0.0.1:8888'; + $picture_result = drupal_http_request($tmp_url . '/profiles/commons/images/avatars/avatar-' . commons_normalize_name($account->name) . '.png'); $picture_path = file_stream_wrapper_uri_normalize($picture_directory . '/picture-' . $account->uid . '-' . REQUEST_TIME . '.jpg'); $picture_file = file_save_data($picture_result->data, $picture_path, FILE_EXISTS_REPLACE); ================================================ FILE: aegir/patches/disable_SSLv2_for_openssl_1_0_0.patch ================================================ --- a/ext/openssl/xp_ssl.c +++ b/ext/openssl/xp_ssl.c @@ -328,10 +328,12 @@ static inline int php_openssl_setup_cryp sslsock->is_client = 1; method = SSLv23_client_method(); break; +#ifndef OPENSSL_NO_SSL2 case STREAM_CRYPTO_METHOD_SSLv2_CLIENT: sslsock->is_client = 1; method = SSLv2_client_method(); break; +#endif case STREAM_CRYPTO_METHOD_SSLv3_CLIENT: sslsock->is_client = 1; method = SSLv3_client_method(); @@ -348,10 +350,12 @@ static inline int php_openssl_setup_cryp sslsock->is_client = 0; method = SSLv3_server_method(); break; +#ifndef OPENSSL_NO_SSL2 case STREAM_CRYPTO_METHOD_SSLv2_SERVER: sslsock->is_client = 0; method = SSLv2_server_method(); break; +#endif case STREAM_CRYPTO_METHOD_TLS_SERVER: sslsock->is_client = 0; method = TLSv1_server_method(); @@ -629,9 +633,11 @@ static inline int php_openssl_tcp_sockop case STREAM_CRYPTO_METHOD_SSLv23_CLIENT: sock->method = STREAM_CRYPTO_METHOD_SSLv23_SERVER; break; +#ifndef OPENSSL_NO_SSL2 case STREAM_CRYPTO_METHOD_SSLv2_CLIENT: sock->method = STREAM_CRYPTO_METHOD_SSLv2_SERVER; break; +#endif case STREAM_CRYPTO_METHOD_SSLv3_CLIENT: sock->method = STREAM_CRYPTO_METHOD_SSLv3_SERVER; break; @@ -911,9 +917,11 @@ php_stream *php_openssl_ssl_socket_facto if (strncmp(proto, "ssl", protolen) == 0) { sslsock->enable_on_connect = 1; sslsock->method = STREAM_CRYPTO_METHOD_SSLv23_CLIENT; +#ifndef OPENSSL_NO_SSL2 } else if (strncmp(proto, "sslv2", protolen) == 0) { sslsock->enable_on_connect = 1; sslsock->method = STREAM_CRYPTO_METHOD_SSLv2_CLIENT; +#endif } else if (strncmp(proto, "sslv3", protolen) == 0) { sslsock->enable_on_connect = 1; sslsock->method = STREAM_CRYPTO_METHOD_SSLv3_CLIENT; ================================================ FILE: aegir/patches/drupal-eleven-aegir-console-02.patch ================================================ diff -urp a/console/Output/Output.php b/console/Output/Output.php --- a/console/Output/Output.php 2025-05-24 11:34:04.000000000 +0100 +++ b/console/Output/Output.php 2025-07-15 22:16:24.471373174 +0100 @@ -140,5 +140,5 @@ abstract class Output implements OutputI /** * Writes a message to the output. */ - abstract protected function doWrite(string $message, bool $newline): void; + abstract protected function doWrite($message, $newline); } ================================================ FILE: aegir/patches/drupal-eleven-aegir-core-01.patch ================================================ diff -urp a/core/lib/Drupal/Core/Logger/LoggerChannel.php b/core/lib/Drupal/Core/Logger/LoggerChannel.php --- a/core/lib/Drupal/Core/Logger/LoggerChannel.php 2025-06-26 14:56:54.000000000 +0100 +++ b/core/lib/Drupal/Core/Logger/LoggerChannel.php 2025-07-17 23:40:15.830594172 +0100 @@ -91,7 +91,7 @@ class LoggerChannel implements LoggerCha /** * {@inheritdoc} */ - public function log($level, string|\Stringable $message, array $context = []): void { + public function log($level, $message, array $context = []) { if ($this->callDepth == self::MAX_CALL_DEPTH) { return; } diff -urp a/core/lib/Drupal/Core/Logger/RfcLoggerTrait.php b/core/lib/Drupal/Core/Logger/RfcLoggerTrait.php --- a/core/lib/Drupal/Core/Logger/RfcLoggerTrait.php 2025-06-26 14:56:54.000000000 +0100 +++ b/core/lib/Drupal/Core/Logger/RfcLoggerTrait.php 2025-07-17 23:40:15.830594172 +0100 @@ -17,62 +17,62 @@ trait RfcLoggerTrait { /** * {@inheritdoc} */ - public function emergency(string|\Stringable $message, array $context = []): void { + public function emergency($message, array $context = []) { $this->log(RfcLogLevel::EMERGENCY, $message, $context); } /** * {@inheritdoc} */ - public function alert(string|\Stringable $message, array $context = []): void { + public function alert($message, array $context = []) { $this->log(RfcLogLevel::ALERT, $message, $context); } /** * {@inheritdoc} */ - public function critical(string|\Stringable $message, array $context = []): void { + public function critical($message, array $context = []) { $this->log(RfcLogLevel::CRITICAL, $message, $context); } /** * {@inheritdoc} */ - public function error(string|\Stringable $message, array $context = []): void { + public function error($message, array $context = []) { $this->log(RfcLogLevel::ERROR, $message, $context); } /** * {@inheritdoc} */ - public function warning(string|\Stringable $message, array $context = []): void { + public function warning($message, array $context = []) { $this->log(RfcLogLevel::WARNING, $message, $context); } /** * {@inheritdoc} */ - public function notice(string|\Stringable $message, array $context = []): void { + public function notice($message, array $context = []) { $this->log(RfcLogLevel::NOTICE, $message, $context); } /** * {@inheritdoc} */ - public function info(string|\Stringable $message, array $context = []): void { + public function info($message, array $context = []) { $this->log(RfcLogLevel::INFO, $message, $context); } /** * {@inheritdoc} */ - public function debug(string|\Stringable $message, array $context = []): void { + public function debug($message, array $context = []) { $this->log(RfcLogLevel::DEBUG, $message, $context); } /** * {@inheritdoc} */ - abstract public function log($level, string|\Stringable $message, array $context = []): void; + abstract public function log($level, $message, array $context = []); } diff -urp a/core/modules/dblog/src/Logger/DbLog.php b/core/modules/dblog/src/Logger/DbLog.php --- a/core/modules/dblog/src/Logger/DbLog.php 2025-06-26 14:56:54.000000000 +0100 +++ b/core/modules/dblog/src/Logger/DbLog.php 2025-07-17 23:57:11.122594172 +0100 @@ -52,7 +52,7 @@ class DbLog implements LoggerInterface { /** * {@inheritdoc} */ - public function log($level, string|\Stringable $message, array $context = []): void { + public function log($level, $message, array $context = []) { // Remove backtrace and exception since they may contain an unserializable // variable. unset($context['backtrace'], $context['exception']); diff -urp a/core/modules/syslog/src/Logger/SysLog.php b/core/modules/syslog/src/Logger/SysLog.php --- a/core/modules/syslog/src/Logger/SysLog.php 2025-06-26 14:56:54.000000000 +0100 +++ b/core/modules/syslog/src/Logger/SysLog.php 2025-07-17 23:40:15.842594172 +0100 @@ -67,7 +67,7 @@ class SysLog implements LoggerInterface /** * {@inheritdoc} */ - public function log($level, string|\Stringable $message, array $context = []): void { + public function log($level, $message, array $context = []) { global $base_url; $format = $this->config->get('format'); ================================================ FILE: aegir/patches/drupal-eleven-aegir-validator-03.patch ================================================ diff -urp a/core/modules/package_manager/src/Validator/DiskSpaceValidator.php b/core/modules/package_manager/src/Validator/DiskSpaceValidator.php --- a/core/modules/package_manager/src/Validator/DiskSpaceValidator.php 2025-06-26 14:56:54.000000000 +0100 +++ b/core/modules/package_manager/src/Validator/DiskSpaceValidator.php 2025-07-28 00:56:23.271822366 +0100 @@ -40,7 +40,7 @@ class DiskSpaceValidator implements Even * If the amount of free space could not be determined. */ protected function freeSpace(string $path): float { - $free_space = disk_free_space($path); + $free_space = function_exists('disk_free_space') ? disk_free_space($path) : 9999999999; // assume plenty of space if ($free_space === FALSE) { throw new \RuntimeException("Cannot get disk information for $path."); } ================================================ FILE: aegir/patches/drupal-ten-aegir-console-02.patch ================================================ diff -urp a/console/Output/Output.php b/console/Output/Output.php --- a/console/Output/Output.php 2025-05-07 08:05:04.000000000 +0100 +++ b/console/Output/Output.php 2025-07-24 03:21:09.032482294 +0100 @@ -151,5 +151,5 @@ abstract class Output implements OutputI * * @return void */ - abstract protected function doWrite(string $message, bool $newline); + abstract protected function doWrite($message, $newline); } ================================================ FILE: aegir/patches/drupal-ten-aegir-core-01.patch ================================================ diff -urp a/core/lib/Drupal/Core/Logger/LoggerChannel.php b/core/lib/Drupal/Core/Logger/LoggerChannel.php --- a/core/lib/Drupal/Core/Logger/LoggerChannel.php 2023-12-23 03:12:54.060219719 +0100 +++ b/core/lib/Drupal/Core/Logger/LoggerChannel.php 2023-12-23 03:12:39.896219719 +0100 @@ -91,7 +91,7 @@ class LoggerChannel implements LoggerCha /** * {@inheritdoc} */ - public function log($level, string|\Stringable $message, array $context = []): void { + public function log($level, $message, array $context = []) { if ($this->callDepth == self::MAX_CALL_DEPTH) { return; } diff -urp a/core/lib/Drupal/Core/Logger/RfcLoggerTrait.php b/core/lib/Drupal/Core/Logger/RfcLoggerTrait.php --- a/core/lib/Drupal/Core/Logger/RfcLoggerTrait.php 2023-12-23 03:12:54.060219719 +0100 +++ b/core/lib/Drupal/Core/Logger/RfcLoggerTrait.php 2023-12-23 03:12:39.896219719 +0100 @@ -17,62 +17,62 @@ trait RfcLoggerTrait { /** * {@inheritdoc} */ - public function emergency(string|\Stringable $message, array $context = []): void { + public function emergency($message, array $context = []) { $this->log(RfcLogLevel::EMERGENCY, $message, $context); } /** * {@inheritdoc} */ - public function alert(string|\Stringable $message, array $context = []): void { + public function alert($message, array $context = []) { $this->log(RfcLogLevel::ALERT, $message, $context); } /** * {@inheritdoc} */ - public function critical(string|\Stringable $message, array $context = []): void { + public function critical($message, array $context = []) { $this->log(RfcLogLevel::CRITICAL, $message, $context); } /** * {@inheritdoc} */ - public function error(string|\Stringable $message, array $context = []): void { + public function error($message, array $context = []) { $this->log(RfcLogLevel::ERROR, $message, $context); } /** * {@inheritdoc} */ - public function warning(string|\Stringable $message, array $context = []): void { + public function warning($message, array $context = []) { $this->log(RfcLogLevel::WARNING, $message, $context); } /** * {@inheritdoc} */ - public function notice(string|\Stringable $message, array $context = []): void { + public function notice($message, array $context = []) { $this->log(RfcLogLevel::NOTICE, $message, $context); } /** * {@inheritdoc} */ - public function info(string|\Stringable $message, array $context = []): void { + public function info($message, array $context = []) { $this->log(RfcLogLevel::INFO, $message, $context); } /** * {@inheritdoc} */ - public function debug(string|\Stringable $message, array $context = []): void { + public function debug($message, array $context = []) { $this->log(RfcLogLevel::DEBUG, $message, $context); } /** * {@inheritdoc} */ - abstract public function log($level, string|\Stringable $message, array $context = []): void; + abstract public function log($level, $message, array $context = []); } diff -urp a/core/modules/dblog/src/Logger/DbLog.php b/core/modules/dblog/src/Logger/DbLog.php --- a/core/modules/dblog/src/Logger/DbLog.php 2023-12-23 03:12:54.060219719 +0100 +++ b/core/modules/dblog/src/Logger/DbLog.php 2023-12-23 03:12:39.896219719 +0100 @@ -52,7 +52,7 @@ class DbLog implements LoggerInterface { /** * {@inheritdoc} */ - public function log($level, string|\Stringable $message, array $context = []): void { + public function log($level, $message, array $context = []) { // Remove backtrace and exception since they may contain an unserializable variable. unset($context['backtrace'], $context['exception']); diff -urp a/core/modules/syslog/src/Logger/SysLog.php b/core/modules/syslog/src/Logger/SysLog.php --- a/core/modules/syslog/src/Logger/SysLog.php 2023-12-06 10:22:56.000000000 +0100 +++ b/core/modules/syslog/src/Logger/SysLog.php 2023-12-23 03:10:01.744219719 +0100 @@ -65,7 +65,7 @@ class SysLog implements LoggerInterface /** * {@inheritdoc} */ - public function log($level, string|\Stringable $message, array $context = []): void { + public function log($level, $message, array $context = []) { global $base_url; $format = $this->config->get('format'); ================================================ FILE: aegir/patches/drush-remote_make_files.patch ================================================ Index: drush_make.utilities.inc =================================================================== RCS file: /cvs/drupal-contrib/contributions/modules/drush_make/Attic/drush_make.utilities.inc,v retrieving revision 1.1.2.55 diff -u -p -r1.1.2.55 drush_make.utilities.inc --- drush_make.utilities.inc 12 Nov 2010 08:19:52 -0000 1.1.2.55 +++ drush_make.utilities.inc 23 Nov 2010 13:02:49 -0000 @@ -454,7 +454,7 @@ function drush_make_get_data($data_sourc } // Remote file. else { - $file = _drush_make_download_file(array('url' => $datasource)); + $file = _drush_make_download_file(array('url' => $data_source)); $data = file_get_contents($file); drush_op('unlink', $file); } ================================================ FILE: aegir/patches/drush_make-drush-4.x-fix-do7-compatibility.patch ================================================ diff --git a/drush_make.drush.inc b/drush_make.drush.inc index c8a9b42..f6c541f 100644 --- a/drush_make.drush.inc +++ b/drush_make.drush.inc @@ -310,10 +310,22 @@ function drush_make_update_xml_download($project) { // Make an array of releases. foreach ($project['release_history']->releases->release as $release) { $version = (string) $release->version_major; + // Work around drupal.org D7 upgrade inconsistently including version_patch + // see https://drupal.org/node/2140621. + if (empty($release->version_patch)) { + $release->version_patch = 0; + } // there should be version_patch attribute for every stable release // so checking whether the attribute exists should be enough if (isset($release->version_patch) && ((string) $release->version_extra) != 'dev') { - $version .= '.' . (string) $release->version_patch; + // Set point version accounting for drupal.org D7 upgrade + // As of the drupal.org D7 upgrade version_minor replaces version_patch. + if (isset($release->version_minor) ) { + $version .= '.' . (string) $release->version_minor; + } + else { + $version .= '.' . (string) $release->version_patch; + } } // if version_patch attribute does not exist, then it should be a dev release // and the version string should be in format MAJOR_VERSION.x-dev ================================================ FILE: aegir/patches/drush_make.drush.inc.patch ================================================ Index: drush_make.drush.inc =================================================================== RCS file: /cvs/drupal-contrib/contributions/modules/drush_make/Attic/drush_make.drush.inc,v retrieving revision 1.11.2.74 diff -u -p -r1.11.2.74 drush_make.drush.inc --- drush_make.drush.inc 10 Oct 2010 18:04:07 -0000 1.11.2.74 +++ drush_make.drush.inc 24 Oct 2010 02:27:15 -0000 @@ -225,8 +225,8 @@ function drush_make_updatexml($project) $term_map = array( 'Modules' => 'module', 'Themes' => 'theme', - 'Drupal project' => 'core', - 'Installation profiles' => 'profile', + 'Drupal Project' => 'core', + 'Installation Profiles' => 'profile', 'Translations' => 'translation' ); // Iterate through all terms related to this project. ================================================ FILE: aegir/patches/features-1265168-19-roles.patch ================================================ diff --git a/includes/features.user.inc b/includes/features.user.inc index c76455d..bf6d6ff 100644 --- a/includes/features.user.inc +++ b/includes/features.user.inc @@ -122,7 +122,11 @@ function user_permission_features_rebuild($module) { $roles = _user_features_get_roles(); $permissions_by_role = _user_features_get_permissions(FALSE); + $modules = user_permission_get_modules(); foreach ($defaults as $permission) { + if (empty($modules[$permission['name']])) { + continue; + } $perm = $permission['name']; foreach ($roles as $role) { if (in_array($role, $permission['roles'])) { ================================================ FILE: aegir/patches/field_info_collate_fields-1400256-25.patch ================================================ diff --git a/modules/field/field.info.inc b/modules/field/field.info.inc index 9e7ab93..30c7cb1 100644 --- a/modules/field/field.info.inc +++ b/modules/field/field.info.inc @@ -183,10 +183,13 @@ function _field_info_collate_types($reset = FALSE) { */ function _field_info_collate_fields($reset = FALSE) { static $info; + static $rebuilding = FALSE; if ($reset) { - $info = NULL; - cache_clear_all('field_info_fields', 'cache_field'); + if(!$rebuilding) { + $info = NULL; + cache_clear_all('field_info_fields', 'cache_field'); + } return; } @@ -195,6 +198,7 @@ function _field_info_collate_fields($reset = FALSE) { $info = $cached->data; } else { + $rebuilding = TRUE; $definitions = array( 'field_ids' => field_read_fields(array(), array('include_deleted' => 1)), 'instances' => field_read_instances(), @@ -244,6 +248,7 @@ function _field_info_collate_fields($reset = FALSE) { } cache_set('field_info_fields', $info, 'cache_field'); + $rebuilding = FALSE; } } ================================================ FILE: aegir/patches/fpm_main.c.patch ================================================ --- a/fpm_main.c 2013-12-10 14:04:57.000000000 -0500 +++ b/fpm_main.c 2013-12-22 16:55:03.000000000 -0500 @@ -164,6 +164,7 @@ typedef struct _php_cgi_globals_struct { zend_bool rfc2616_headers; zend_bool nph; zend_bool fix_pathinfo; + char *fix_chrootpath; zend_bool force_redirect; zend_bool discard_path; zend_bool fcgi_logging; @@ -1058,6 +1059,27 @@ static void init_request_info(TSRMLS_D) char *ini; int apache_was_here = 0; + if (CGIG(fix_chrootpath)) { + size_t chroot_len = strlen(CGIG(fix_chrootpath)); + /* remove trail slash */ + while (chroot_len > 0 && CGIG(fix_chrootpath)[chroot_len-1] == '/') { + chroot_len--; + } + if (chroot_len > 0) { + char *env_document_root = sapi_cgibin_getenv("DOCUMENT_ROOT", sizeof("DOCUMENT_ROOT") - 1 TSRMLS_CC); + + if (strncmp(env_path_translated, CGIG(fix_chrootpath), chroot_len) == 0) { + env_path_translated += chroot_len; + env_path_translated = _sapi_cgibin_putenv("PATH_TRANSLATED", env_path_translated TSRMLS_CC); + } + + if (strncmp(env_document_root, CGIG(fix_chrootpath), chroot_len) == 0) { + env_document_root += chroot_len; + env_document_root = _sapi_cgibin_putenv("DOCUMENT_ROOT", env_document_root TSRMLS_CC); + } + } + } + /* some broken servers do not have script_filename or argv0 * an example, IIS configured in some ways. then they do more * broken stuff and set path_translated to the cgi script location */ @@ -1446,6 +1468,7 @@ PHP_INI_BEGIN() STD_PHP_INI_ENTRY("cgi.force_redirect", "1", PHP_INI_SYSTEM, OnUpdateBool, force_redirect, php_cgi_globals_struct, php_cgi_globals) STD_PHP_INI_ENTRY("cgi.redirect_status_env", NULL, PHP_INI_SYSTEM, OnUpdateString, redirect_status_env, php_cgi_globals_struct, php_cgi_globals) STD_PHP_INI_ENTRY("cgi.fix_pathinfo", "1", PHP_INI_SYSTEM, OnUpdateBool, fix_pathinfo, php_cgi_globals_struct, php_cgi_globals) + STD_PHP_INI_ENTRY("cgi.fix_chrootpath", NULL, PHP_INI_SYSTEM, OnUpdateString, fix_chrootpath, php_cgi_globals_struct, php_cgi_globals) STD_PHP_INI_ENTRY("cgi.discard_path", "0", PHP_INI_SYSTEM, OnUpdateBool, discard_path, php_cgi_globals_struct, php_cgi_globals) STD_PHP_INI_ENTRY("fastcgi.logging", "1", PHP_INI_SYSTEM, OnUpdateBool, fcgi_logging, php_cgi_globals_struct, php_cgi_globals) STD_PHP_INI_ENTRY("fastcgi.error_header", NULL, PHP_INI_SYSTEM, OnUpdateString, error_header, php_cgi_globals_struct, php_cgi_globals) @@ -1461,6 +1484,7 @@ static void php_cgi_globals_ctor(php_cgi php_cgi_globals->force_redirect = 1; php_cgi_globals->redirect_status_env = NULL; php_cgi_globals->fix_pathinfo = 1; + php_cgi_globals->fix_chrootpath = NULL; php_cgi_globals->discard_path = 0; php_cgi_globals->fcgi_logging = 1; zend_hash_init(&php_cgi_globals->user_config_cache, 0, NULL, (dtor_func_t) user_config_cache_entry_dtor, 1); ================================================ FILE: aegir/patches/freetype.patch ================================================ diff -u -r php-7.2.5/ext/gd/config.m4 php-7.2.5-freetype/ext/gd/config.m4 --- php-7.2.5/ext/gd/config.m4 2018-04-24 17:09:54.000000000 +0200 +++ php-7.2.5-freetype/ext/gd/config.m4 2018-05-09 14:49:03.647108948 +0200 @@ -186,6 +186,9 @@ AC_DEFUN([PHP_GD_FREETYPE2],[ if test "$PHP_FREETYPE_DIR" != "no"; then + AC_PATH_PROG(PKG_CONFIG, pkg-config, no) + + AC_MSG_CHECKING([for freetype]) for i in $PHP_FREETYPE_DIR /usr/local /usr; do if test -f "$i/bin/freetype-config"; then FREETYPE2_DIR=$i @@ -194,13 +197,20 @@ fi done - if test -z "$FREETYPE2_DIR"; then + if test -n "$FREETYPE2_CONFIG"; then + FREETYPE2_CFLAGS=`$FREETYPE2_CONFIG --cflags` + FREETYPE2_LIBS=`$FREETYPE2_CONFIG --libs` + AC_MSG_RESULT([found in $FREETYPE2_DIR]) + elif test "$PKG_CONFIG" != "no" && $PKG_CONFIG --exists freetype2; then + FREETYPE2_DIR=pkg-config + FREETYPE2_CFLAGS=`$PKG_CONFIG freetype2 --cflags` + FREETYPE2_LIBS=`$PKG_CONFIG freetype2 --libs` + AC_MSG_RESULT([found by pkg-config]) + else + AC_MSG_RESULT([not found]) AC_MSG_ERROR([freetype-config not found.]) fi - FREETYPE2_CFLAGS=`$FREETYPE2_CONFIG --cflags` - FREETYPE2_LIBS=`$FREETYPE2_CONFIG --libs` - PHP_EVAL_INCLINE($FREETYPE2_CFLAGS) PHP_EVAL_LIBLINE($FREETYPE2_LIBS, GD_SHARED_LIBADD) AC_DEFINE(HAVE_LIBFREETYPE,1,[ ]) ================================================ FILE: aegir/patches/hosting_advanced_cron.patch ================================================ diff -urp a/hosting_advanced_cron/hosting_advanced_cron.module b/hosting_advanced_cron/hosting_advanced_cron.module --- a/hosting_advanced_cron/hosting_advanced_cron.module 2012-05-27 13:12:12.000000000 +0100 +++ b/hosting_advanced_cron/hosting_advanced_cron.module 2012-05-27 15:09:14.000000000 +0100 @@ -1,7 +1,7 @@ nid); - if (variable_get('hosting_cron_use_backend', TRUE)) { - provision_backend_invoke($site_name, "cron"); - } - else { - $cmd = sprintf("wget -O - -q %s > /dev/null", escapeshellarg(_hosting_site_url($site) . '/cron.php')); - drush_shell_exec($cmd); - } + if (!preg_match("/(?:dev\.|devel\.)/", $site_name)) { + if (variable_get('hosting_cron_use_backend', TRUE)) { + provision_backend_invoke($site_name, "cron"); + } + else { + // Optionally add the cron_key querystring key if the site has one. + $url =_hosting_site_url($site) . '/cron.php'; + if (!empty($site->cron_key)) { + $url .= '?cron_key=' . rawurlencode($site->cron_key); + } + $cmd = sprintf("wget -O - -q %s > /dev/null", escapeshellarg($url)); + drush_shell_exec($cmd); + } + + // We are updating the site table here directly to avoid a possible race condition, + // with the task queue. There exists a chance that they might both try to save the + // same node at the same time, and then an old record from the cron queue might + // replace the newly updated record. + db_query("UPDATE {hosting_site} SET last_cron=%d WHERE nid=%d", time(), $site->nid); - // We are updating the site table here directly to avoid a possible race condition, - // with the task queue. There exists a chance that they might both try to save the - // same node at the same time, and then an old record from the cron queue might - // replace the newly updated record. - db_query("UPDATE {hosting_site} SET last_cron = %d WHERE nid = %d", time(), $site->nid); + // A small trick to avoid high load when still too many crons are started at once. + sleep(5); + } } } @@ -99,7 +109,7 @@ function hosting_advanced_cron_nodeapi(& if (!$result) { $result = array('cron_interval' => variable_get('hosting_advanced_cron_default_interval', 3600)); } - + return $result; case 'delete': @@ -125,8 +135,8 @@ function hosting_advanced_cron_get_sites $cron_interval = $site->cron_interval ? $site->cron_interval : variable_get('hosting_advanced_cron_default_interval', 3600); // Run cron if it has never ran before for this site, or if the cron - // interval since last cron run has been exceeded. - if ($cron_interval != HOSTING_ADVANCED_CRON_SITE_DISABLED && (!$site->last_cron || ($site->last_cron + $site->cron_interval < time()))) { + // interval since last cron run has been exceeded. + if ($cron_interval != HOSTING_ADVANCED_CRON_SITE_DISABLED && (!$site->last_cron || ($site->last_cron + $cron_interval < time()))) { $sites[$site->nid] = node_load($site->nid); } } @@ -191,9 +201,9 @@ function hosting_advanced_cron_form_site function hosting_advanced_cron_interval_options() { $options = array( HOSTING_ADVANCED_CRON_SITE_DISABLED => t('Disabled'), - HOSTING_ADVANCED_CRON_SITE_DEFAULT => t('Default'), + HOSTING_ADVANCED_CRON_SITE_DEFAULT => t('3h (default)'), ); - $options += drupal_map_assoc(array(60, 300, 900, 1800, 3600, 21600, 86400), 'format_interval'); + $options += drupal_map_assoc(array(60, 180, 300, 600, 900, 1800, 3600, 10800, 21600, 43200, 86400), 'format_interval'); return $options; } ================================================ FILE: aegir/patches/hosting_cron.module ================================================ HOSTING_QUEUE_TYPE_BATCH, 'name' => t('Advanced Cron queue'), 'description' => t('Run advanced cron on hosted sites.'), 'total_items' => hosting_cron_hosting_site_count(), 'frequency' => strtotime("1 min", 0), 'min_threads' => 6, 'max_threads' => 12, 'threshold' => 100, 'singular' => t('site'), 'plural' => t('sites'), ); return $items; } function hosting_cron_hosting_site_count() { $sql = "SELECT count(n.nid) FROM {node} n LEFT JOIN {hosting_site} hs ON n.nid = hs.nid LEFT JOIN {hosting_cron} hac ON n.nid = hac.nid WHERE n.type = :site AND hs.status = :status AND ((hac.cron_interval IS NOT NULL AND hac.cron_interval > 0) OR (hac.cron_interval IS NULL AND :cron_interval > 0))"; $result = db_query($sql, array(':site' => 'site', ':status' => HOSTING_SITE_ENABLED, ':cron_interval' => variable_get('hosting_cron_default_interval', ADV_CRON_DEFAULT)))->fetchField(); return $result; } /** * Implements hook_permission(). */ function hosting_cron_permission() { return array( 'configure site cron interval' => array( 'title' => t('configure site cron interval'), ), ); } /** * Queue callback (hosting__queue) for the advanced cron queue. * * This function is called by hosting_run_queue() whenever the "Advanced Cron" * queue is run. */ function hosting_cron_queue($count = ADV_CRON_MAX_PLL) { if (is_readable($_SERVER['HOME'] . '/static/control/cron-proxy.info')) { $use_proxy_mode = TRUE; } else { $use_proxy_mode = FALSE; } // Get a list of sites for which to run cron. $sites = hosting_cron_get_sites($count); foreach ($sites as $site) { $site_name = hosting_context_name($site->nid); $this_name = ltrim($site_name, '@'); $this_host = '-H "Host: ' . $this_name . '"'; $this_cuid = '.cron.' . md5($this_name . '.' . $site->nid) . '.pid'; $profile = node_load($site->profile); $platform = node_load($site->platform); if ($profile->short_name == 'hostmaster') { provision_backend_invoke($site_name, "cron"); } elseif (variable_get('hosting_cron_use_backend', TRUE)) { provision_backend_invoke($site_name, "elysia-cron"); sleep(3); provision_backend_invoke($site_name, "cron"); } else { if (is_readable($_SERVER['HOME'] . '/.tmp')) { $this_tmp = $_SERVER['HOME'] . '/.tmp/'; } else { $this_tmp = '/tmp/'; } $result = db_query("SELECT p.publish_path FROM {hosting_platform} p LEFT JOIN {hosting_site} s ON p.nid=s.platform WHERE platform = :platform", array(':platform' => $platform->nid)); foreach ($result as $row) { $this_platform_root = $row->publish_path; } if (is_readable($this_platform_root . '/core') || is_readable($this_platform_root . '/docroot/core') || is_readable($this_platform_root . '/html/core') || is_readable($this_platform_root . '/web/core')) { $url_own = 'https://' . $this_name . '/cron/'; $url = 'https://127.0.0.1/cron/'; // Optionally add the cron_key query string key if the site has one. if (!empty($site->cron_key)) { $url_own .= rawurlencode($site->cron_key); $url .= rawurlencode($site->cron_key); } } else { $url_own = 'https://' . $this_name . '/cron.php'; $url = 'https://127.0.0.1/cron.php'; // Optionally add the cron_key query string key if the site has one. if (!empty($site->cron_key)) { $url_own .= '?cron_key=' . rawurlencode($site->cron_key); $url .= '?cron_key=' . rawurlencode($site->cron_key); } } // Prepare the log file and command. $this_clog = $this_tmp . $this_cuid . '.log'; // Add a date-stamped entry to the log. $date = date("Y-m-d H:i:s"); if (!empty($use_proxy_mode)) { $date = date("Y-m-d H:i:s"); file_put_contents($this_clog, "\n$date cURL command via IP request\n", FILE_APPEND); file_put_contents($this_clog, "$date KEY $this_host KEY $url\n", FILE_APPEND); $second_cmd = 'curl -L --max-redirs 5 -k -s --retry 3 --retry-delay 5 --max-time 600 -A iCabProXy ' . $this_host . ' ' . $url; $second_output = []; $second_return_var = 0; exec($second_cmd, $second_output, $second_return_var); // Append curl response to the log. if (!empty($second_response)) { file_put_contents($this_clog, "$date First IP Response:\n" . implode("\n", $second_output) . "\n", FILE_APPEND); } else { file_put_contents($this_clog, "$date First IP request returned empty OK response.\n", FILE_APPEND); } } else { file_put_contents($this_clog, "\n$date cURL command via DOMAIN request\n", FILE_APPEND); file_put_contents($this_clog, "$date KEY $url_own\n", FILE_APPEND); $cmd = 'curl -L --max-redirs 5 -k -s --retry 3 --retry-delay 5 --max-time 600 -A iCabProXy ' . $url_own; $output = []; $return_var = 0; exec($cmd, $output, $return_var); $response = implode("\n", $output); if (!empty($response)) { $date = date("Y-m-d H:i:s"); file_put_contents($this_clog, "$date NON-EMPTY-RESPONSE FOLLOWS\n", FILE_APPEND); file_put_contents($this_clog, $response . "\n", FILE_APPEND); file_put_contents($this_clog, "$date Another cURL command, this time via IP request\n", FILE_APPEND); file_put_contents($this_clog, "$date KEY $this_host KEY $url\n", FILE_APPEND); $second_cmd = 'curl -L --max-redirs 5 -k -s --retry 3 --retry-delay 5 --max-time 600 -A iCabProXy ' . $this_host . ' ' . $url; $second_output = []; $second_return_var = 0; exec($second_cmd, $second_output, $second_return_var); if (!empty($second_response)) { file_put_contents($this_clog, "$date Second IP Response:\n" . implode("\n", $second_output) . "\n", FILE_APPEND); } else { file_put_contents($this_clog, "$date Second IP request returned empty OK response.\n", FILE_APPEND); } } else { $date = date("Y-m-d H:i:s"); file_put_contents($this_clog, "$date First DOMAIN request returned empty OK response.\n", FILE_APPEND); } } } db_update('hosting_site') ->fields(array( 'last_cron' => REQUEST_TIME, )) ->condition('nid', $site->nid) ->execute(); // A small trick to avoid high load when still too many crons are started at once. unset($site_name, $this_name, $this_host, $this_cuid, $this_clog, $profile, $platform, $this_tmp, $this_platform_root, $url); sleep(3); } } /** * Implements hook_node_load(). */ function hosting_cron_node_load($nodes, $types) { foreach ($nodes as $nid => &$node) { if ($node->type == 'site') { $this_cron_interval = db_query("SELECT cron_interval FROM {hosting_cron} WHERE nid = :nid", array(':nid' => $node->nid))->fetchField(); if ($this_cron_interval) { $this_cron_interval = array('cron_interval' => $this_cron_interval); } if (isset($node->cron_interval) && $node->cron_interval > -1) { $cron_interval_ok = TRUE; } else { if (isset($this_cron_interval) && $this_cron_interval > -1) { $node->cron_interval = $this_cron_interval; } } return $this_cron_interval; } } } /** * Implements hook_node_view(). */ function hosting_cron_node_view($node, $view_mode, $langcode) { if ($node->type == 'site') { if ($view_mode != 'teaser') { $this_cron_interval = db_query("SELECT cron_interval FROM {hosting_cron} WHERE nid = :nid", array(':nid' => $node->nid))->fetchField(); if (!$node->cron_interval && $this_cron_interval) { $node->cron_interval = $this_cron_interval; } $cron_text = $this_cron_interval == ADV_CRON_TURNED_OFF ? t('Disabled') : t('Every !interval', array('!interval' => format_interval($this_cron_interval))); $cron_text .= '
    ' . t('(Last run: !interval)', array('!interval' => hosting_format_interval($node->last_cron))); $node->content['info']['last_cron'] = array( '#type' => 'item', '#title' => t('Cron'), '#weight' => 20, '#markup' => $cron_text, ); } } } /** * Implements hook_node_delete(). */ function hosting_cron_node_delete($node) { if ($node->type == "site") { db_delete('hosting_cron') ->condition('nid', $node->nid) ->execute(); } } /** * Implements hook_node_update(). */ function hosting_cron_node_update($node) { if ($node->type == "site") { $use_cron_interval = ADV_CRON_TURNED_OFF; $this_cron_interval = db_query("SELECT cron_interval FROM {hosting_cron} WHERE nid = :nid", array(':nid' => $node->nid))->fetchField(); if ($node->cron_interval > -1) { $use_cron_interval = $node->cron_interval; } else { if ($this_cron_interval > -1) { $use_cron_interval = $this_cron_interval; } } if ($node->nid == 10) { if ($node->cron_interval == ADV_CRON_TURNED_OFF) { db_update('hosting_cron') ->fields(array('cron_interval' => '3600')) ->condition('nid', '10') ->execute(); } } if ($this_cron_interval > -1) { $cron_interval_ok = TRUE; } else { db_insert('hosting_cron') ->fields(array( 'nid' => $node->nid, 'cron_interval' => $use_cron_interval, )) ->execute(); } if ($use_cron_interval == ADV_CRON_TURNED_OFF) { db_update('hosting_cron') ->fields(array( 'cron_interval' => ADV_CRON_TURNED_OFF, )) ->condition('nid', $node->nid) ->execute(); } elseif ($use_cron_interval > ADV_CRON_TURNED_OFF) { db_update('hosting_cron') ->fields(array( 'cron_interval' => $use_cron_interval, )) ->condition('nid', $node->nid) ->execute(); } else { db_insert('hosting_cron') ->fields(array( 'nid' => $node->nid, 'cron_interval' => ADV_CRON_TURNED_OFF, )) ->execute(); } } } /** * Implements hook_node_insert(). */ function hosting_cron_node_insert($node) { if ($node->type == 'site') { $use_cron_interval = ADV_CRON_TURNED_OFF; $this_cron_interval = db_query("SELECT cron_interval FROM {hosting_cron} WHERE nid = :nid", array(':nid' => $node->nid))->fetchField(); if (isset($node->cron_interval) && $node->cron_interval > -1) { $use_cron_interval = $node->cron_interval; } else { if ($this_cron_interval > -1) { $use_cron_interval = $this_cron_interval; } } if ($node->nid == 10) { $use_cron_interval = '3600'; } if ($use_cron_interval == ADV_CRON_TURNED_OFF) { db_insert('hosting_cron') ->fields(array( 'nid' => $node->nid, 'cron_interval' => ADV_CRON_TURNED_OFF, )) ->execute(); } elseif ($use_cron_interval > ADV_CRON_TURNED_OFF) { db_insert('hosting_cron') ->fields(array( 'nid' => $node->nid, 'cron_interval' => $use_cron_interval, )) ->execute(); } else { db_insert('hosting_cron') ->fields(array( 'nid' => $node->nid, 'cron_interval' => ADV_CRON_TURNED_OFF, )) ->execute(); } } } /** * Retrieves a list of sites for which to run cron. */ function hosting_cron_get_sites($count) { $result = db_query('SELECT n.nid, hs.last_cron, hac.cron_interval FROM {node} n LEFT JOIN {hosting_site} hs ON n.nid = hs.nid LEFT JOIN {hosting_cron} hac ON n.nid = hac.nid WHERE n.type = :site AND hs.status = :status ORDER BY hs.last_cron ASC, n.nid ASC', array(':site' => 'site', ':status' => HOSTING_SITE_ENABLED)); $counter = 0; foreach ($result as $site) { if ($counter <= $count && $counter <= ADV_CRON_MAX_PLL) { // // Run cron if it has never ran before for this site, // but only if it has been enabled for this site. // // This shouldn't happen for any newly cloned site, // no matter if the cron is enabled on the source site or not, // to avoid running cron on the cloned copy without any prior control. // // Note that we can't use hosting_cron_default_interval here // if $site->cron_interval is empty / not set yet, so we have to ignore // the first cron run attempt by using ADV_CRON_TURNED_OFF by default // instead of hosting_cron_default_interval if we can't read // $site->cron_interval or it is empty for some reason. This means, however, // that we must store cron_interval also for sites using default value, // or the cron would never run on newly created/cloned site. // if (!$site->last_cron) { $this_cron_interval = db_query("SELECT cron_interval FROM {hosting_cron} WHERE nid = :nid", array(':nid' => $site->nid))->fetchField(); if ($this_cron_interval != ADV_CRON_TURNED_OFF) { $sites[$site->nid] = node_load($site->nid); $counter++; } } else { // // Determine the cron interval. If not specified for this site, // use the default hosting_cron_default_interval or // ADV_CRON_DEFAULT. // $this_cron_interval = db_query("SELECT cron_interval FROM {hosting_cron} WHERE nid = :nid", array(':nid' => $site->nid))->fetchField(); // // Run cron if it has already ran before for this site, // and the cron is enabled on this site, but cron interval // since last cron run has been exceeded. // if ($this_cron_interval != ADV_CRON_TURNED_OFF) { if ($site->last_cron + $this_cron_interval < time()) { $sites[$site->nid] = node_load($site->nid); $counter++; } } } } } return $sites; } /** * Implements hook_form__alter(). */ function hosting_cron_form_hosting_settings_alter(&$form, $form_state) { $options = hosting_cron_interval_options(); unset($options[0]); $form['hosting_cron_default_interval'] = array( '#type' => 'select', '#title' => t('Default cron interval'), '#options' => $options, '#description' => t('The cron interval to use for all sites unless overridden on the site node itself.'), '#default_value' => variable_get('hosting_cron_default_interval', ADV_CRON_DEFAULT), ); $form['hosting_cron_use_backend'] = array( '#type' => 'radios', '#title' => t('Cron method'), '#description' => t('For running cron on a site. You can use the drush cron implementation or a traditional wget method.'), '#options' => array('Wget', 'Drush'), '#default_value' => variable_get('hosting_cron_use_backend', TRUE), ); // Add some weight to the buttons to push them to the bottom of the form. $form['buttons']['#weight'] = 1000; } /** * Implements hook_form__alter(). * * Alter the node form for a site to the cron interval setting. */ function hosting_cron_form_site_node_form_alter(&$form, $form_state) { if (user_access('configure site cron interval')) { if (!empty($form['#node']) && isset($form['#node']->nid)) { if (empty($form['#node']->cron_interval)) { $default_value = ADV_CRON_TURNED_OFF; } else { $default_value = $form['#node']->cron_interval; } } else { $default_value = variable_get('hosting_cron_default_interval', ADV_CRON_DEFAULT); } $form['cron_interval'] = array( '#type' => 'select', '#title' => t('Cron interval'), '#options' => hosting_cron_interval_options(), '#description' => t('Cron will be automatically run for this site at the interval defined here.'), '#default_value' => $default_value, '#weight' => 3, ); return $form; } } /** * Returns an array of options for the cron interval. * * @return * An associative array with the interval in seconds as key, and a * human-readable interval as value. */ function hosting_cron_interval_options() { $options = array( ADV_CRON_TURNED_OFF => t('Disabled'), ADV_CRON_DEFAULT => t('1h (default)'), ); $options += drupal_map_assoc(array(60, 180, 300, 600, 900, 1800, 3600, 10800, 21600, 43200, 86400, 604800), 'format_interval'); return $options; } ================================================ FILE: aegir/patches/hosting_cron_queue-reliability.patch ================================================ From dc226392e0480bb4ea6fe98ff2f65bbf1fd89e65 Mon Sep 17 00:00:00 2001 From: BOA Dev Team Date: Mon, 9 Dec 2024 02:45:37 +0100 Subject: [PATCH] Improve hosting_cron_queue reliability --- cron/hosting_cron.module | 61 ++++++++++++++++++++++++++++++++++++---- 1 file changed, 56 insertions(+), 5 deletions(-) diff --git a/cron/hosting_cron.module b/cron/hosting_cron.module index 122e5378..ec5347d9 100644 --- a/cron/hosting_cron.module +++ b/cron/hosting_cron.module @@ -64,6 +64,12 @@ function hosting_cron_permission() { * queue is run. */ function hosting_cron_queue($count = ADV_CRON_MAX_PLL) { + if (is_readable($_SERVER['HOME'] . '/static/control/cron-proxy.info')) { + $use_proxy_mode = TRUE; + } + else { + $use_proxy_mode = FALSE; + } // Get a list of sites for which to run cron. $sites = hosting_cron_get_sites($count); foreach ($sites as $site) { @@ -96,26 +102,70 @@ function hosting_cron_queue($count = ADV_CRON_MAX_PLL) { is_readable($this_platform_root . '/docroot/core') || is_readable($this_platform_root . '/html/core') || is_readable($this_platform_root . '/web/core')) { + $url_own = 'https://' . $this_name . '/cron/'; $url = 'https://127.0.0.1/cron/'; // Optionally add the cron_key query string key if the site has one. if (!empty($site->cron_key)) { + $url_own .= rawurlencode($site->cron_key); $url .= rawurlencode($site->cron_key); } } else { + $url_own = 'https://' . $this_name . '/cron.php'; $url = 'https://127.0.0.1/cron.php'; // Optionally add the cron_key query string key if the site has one. if (!empty($site->cron_key)) { + $url_own .= '?cron_key=' . rawurlencode($site->cron_key); $url .= '?cron_key=' . rawurlencode($site->cron_key); } } - if (is_readable($this_tmp . $this_cuid)) { - system('touch ' . $this_tmp . '.busy' . $this_cuid); + // Prepare the log file and command. + $this_clog = $this_tmp . $this_cuid . '.log'; + // Add a date-stamped entry to the log. + $date = date("Y-m-d H:i:s"); + if (!empty($use_proxy_mode)) { + $date = date("Y-m-d H:i:s"); + file_put_contents($this_clog, "\n$date cURL command via IP request\n", FILE_APPEND); + file_put_contents($this_clog, "$date KEY $this_host KEY $url\n", FILE_APPEND); + $second_cmd = 'curl -L --max-redirs 5 -k -s --retry 3 --retry-delay 5 --max-time 600 -A iCabProXy ' . $this_host . ' ' . $url; + $second_output = []; + $second_return_var = 0; + exec($second_cmd, $second_output, $second_return_var); + // Append curl response to the log. + if (!empty($second_response)) { + file_put_contents($this_clog, "$date First IP Response:\n" . implode("\n", $second_output) . "\n", FILE_APPEND); + } else { + file_put_contents($this_clog, "$date First IP request returned empty OK response.\n", FILE_APPEND); + } } else { - system('touch ' . $this_tmp . $this_cuid); - system('curl -L --max-redirs 5 -k -s --retry 1 --retry-delay 10 --max-time 300 -A iCabProXy ' . $this_host . ' ' . $url . ' > /dev/null'); - system('rm -f ' . $this_tmp . $this_cuid); + file_put_contents($this_clog, "\n$date cURL command via DOMAIN request\n", FILE_APPEND); + file_put_contents($this_clog, "$date KEY $url_own\n", FILE_APPEND); + $cmd = 'curl -L --max-redirs 5 -k -s --retry 3 --retry-delay 5 --max-time 600 -A iCabProXy ' . $url_own; + $output = []; + $return_var = 0; + exec($cmd, $output, $return_var); + $response = implode("\n", $output); + if (!empty($response)) { + $date = date("Y-m-d H:i:s"); + file_put_contents($this_clog, "$date NON-EMPTY-RESPONSE FOLLOWS\n", FILE_APPEND); + file_put_contents($this_clog, $response . "\n", FILE_APPEND); + file_put_contents($this_clog, "$date Another cURL command, this time via IP request\n", FILE_APPEND); + file_put_contents($this_clog, "$date KEY $this_host KEY $url\n", FILE_APPEND); + $second_cmd = 'curl -L --max-redirs 5 -k -s --retry 3 --retry-delay 5 --max-time 600 -A iCabProXy ' . $this_host . ' ' . $url; + $second_output = []; + $second_return_var = 0; + exec($second_cmd, $second_output, $second_return_var); + if (!empty($second_response)) { + file_put_contents($this_clog, "$date Second IP Response:\n" . implode("\n", $second_output) . "\n", FILE_APPEND); + } else { + file_put_contents($this_clog, "$date Second IP request returned empty OK response.\n", FILE_APPEND); + } + } + else { + $date = date("Y-m-d H:i:s"); + file_put_contents($this_clog, "$date First DOMAIN request returned empty OK response.\n", FILE_APPEND); + } } } db_update('hosting_site') @@ -125,6 +175,7 @@ function hosting_cron_queue($count = ADV_CRON_MAX_PLL) { ->condition('nid', $site->nid) ->execute(); // A small trick to avoid high load when still too many crons are started at once. + unset($site_name, $this_name, $this_host, $this_cuid, $this_clog, $profile, $platform, $this_tmp, $this_platform_root, $url); sleep(3); } } -- 2.45.1 ================================================ FILE: aegir/patches/hosting_le_vhost.drush.inc ================================================ NULL); } /* * Implementation of hook_provision_nginx_vhost_config() */ function hosting_le_vhost_provision_nginx_vhost_config($uri, $data) { if (d()->type == 'site') { $aegir_root = d('@server_master')->aegir_root; $le_cert = d('@server_master')->aegir_root . "/tools/le/certs"; $is_boa = FALSE; $is_boa_ctrl = "/data/conf/global.inc"; if (provision_file()->exists($is_boa_ctrl)->status()) { $is_boa = TRUE; } $main_name = $real_name = substr(d()->name, 1); if ($real_name == 'hostmaster') { $real_name = $main_name = d()->uri; } if (d()->redirection) { $main_name = d()->redirection; if ($is_boa) { $cert_dir = $le_cert . "/" . $real_name; } else { $cert_dir = $le_cert . "/" . $main_name; } } else { $cert_dir = $le_cert . "/" . $main_name; } $chain_pem = $cert_dir . "/chain.pem"; $lines = array(); $lines[] = ""; if (d()->ssl_enabled) { if (provision_file()->exists($chain_pem)->status()) { $lines[] = " ssl_trusted_certificate $chain_pem;"; $lines[] = ""; } } $lines[] = " ###"; $lines[] = " ### Allow access to letsencrypt.org ACME challenges directory."; $lines[] = " ###"; $lines[] = " location ^~ /.well-known/acme-challenge {"; $lines[] = " allow all;"; $lines[] = " alias $aegir_root/tools/le/.acme-challenges;"; $lines[] = " try_files \$uri 404;"; $lines[] = " auth_basic off;"; $lines[] = " }"; $lines[] = "\n"; return implode("\n", $lines); } return ''; } /* * Implementation of hook_provision_apache_vhost_config() */ function hosting_le_vhost_provision_apache_vhost_config($uri, $data) { $aegir_root = d('@server_master')->aegir_root; if (d()->type == 'site') { $lines = array(); $lines[] = ""; $lines[] = " Alias /.well-known/acme-challenge $aegir_root/tools/le/.acme-challenges"; $lines[] = ""; $lines[] = " # Allow access to letsencrypt.org ACME challenges directory."; $lines[] = " "; $lines[] = " Order allow,deny"; $lines[] = " Allow from all"; $lines[] = " Require all granted"; $lines[] = " Satisfy Any"; $lines[] = " "; $lines[] = "\n"; return implode("\n", $lines); } return ''; } ================================================ FILE: aegir/patches/imagecache-1243258-5.patch ================================================ diff --git a/imagecache.module b/imagecache.module index 55d48ce..36ace81 100644 --- a/imagecache.module +++ b/imagecache.module @@ -442,7 +442,7 @@ function _imagecache_cache($presetname, $path) { } // umm yeah deliver it early if it is there. especially useful - // to prevent lock files from being created when delivering private files. + // to prevent locks from being created when delivering private files. $dst = imagecache_create_path($preset['presetname'], $path); if (is_file($dst)) { imagecache_transfer($dst); @@ -458,34 +458,39 @@ function _imagecache_cache($presetname, $path) { exit; }; - // Bail if the requested file isn't an image you can't request .php files + // Bail if the requested file isn't an image. You can't request .php files // etc... - if (!getimagesize($src)) { + if (!@getimagesize($src)) { watchdog('imagecache', '403: File is not an image %image ', array('%image' => $src), WATCHDOG_ERROR); header('HTTP/1.0 403 Forbidden'); exit; } - $lockfile = file_directory_temp() .'/'. $preset['presetname'] . basename($src); - if (file_exists($lockfile)) { - watchdog('imagecache', 'ImageCache already generating: %dst, Lock file: %tmp.', array('%dst' => $dst, '%tmp' => $lockfile), WATCHDOG_NOTICE); - // 307 Temporary Redirect, to myself. Lets hope the image is done next time around. - header('Location: '. request_uri(), TRUE, 307); - exit; + // Generate preset inside of a lock. + $lockname = $preset['presetname'] . basename($src); + $wait = FALSE; + if (lock_acquire($lockname)) { + imagecache_build_derivative($preset['actions'], $src, $dst); + lock_release($lockname); + } + else { + lock_wait($lockname); + $wait = TRUE; } - touch($lockfile); - // register the shtdown function to clean up lock files. by the time shutdown - // functions are being called the cwd has changed from document root, to - // server root so absolute paths must be used for files in shutdown functions. - register_shutdown_function('file_delete', realpath($lockfile)); - // check if deriv exists... (file was created between apaches request handler and reaching this code) - // otherwise try to create the derivative. - if (file_exists($dst) || imagecache_build_derivative($preset['actions'], $src, $dst)) { + // Make sure derivative image exists before trying to send it. + if (file_exists($dst)) { + // exit gets called inside this function. imagecache_transfer($dst); } + // Generate an error if image could not generate. - watchdog('imagecache', 'Failed generating an image from %image using imagecache preset %preset.', array('%image' => $path, '%preset' => $preset['presetname']), WATCHDOG_ERROR); + if ($wait) { + watchdog('imagecache', 'Acquired lock, but failed in generating an image from %image using imagecache preset %preset.', array('%image' => $path, '%preset' => $preset['presetname']), WATCHDOG_ERROR); + } + else { + watchdog('imagecache', 'Waited for the lock, but found no generated image from %image using imagecache preset %preset.', array('%image' => $path, '%preset' => $preset['presetname']), WATCHDOG_ERROR); + } header("HTTP/1.0 500 Internal Server Error"); exit; } ================================================ FILE: aegir/patches/imagefield_crop.patch ================================================ Index: imagefield_crop.module =================================================================== --- imagefield_crop.module (revision 1120) +++ imagefield_crop.module (working copy) @@ -45,6 +45,8 @@ * Delegated to filefield. */ function imagefield_crop_widget_settings($op, $widget) { + // make sure we have the functions as this may be called from update.php + module_load_include('inc', 'imagefield_crop', 'imagefield_crop_widget'); switch ($op) { case 'form': return imagefield_crop_widget_settings_form($widget); ================================================ FILE: aegir/patches/julio_profile.patch ================================================ diff --git a/julio.profile b/julio.profile index 340580d..8522810 100644 --- a/julio.profile +++ b/julio.profile @@ -1,6 +1,8 @@ ) is conditionally defined - to have different layout and size depending on the defined macros. - The correct macro is defined in my_config.h, which means it MUST be - included first (or at least before - so, practically, - before including any system headers). - - __GLIBC__ is defined in -*/ -#ifdef __GLIBC__ -#error MUST be included first! -#endif - #endif ================================================ FILE: aegir/patches/mysql.provision.patch ================================================ diff --git mysql_service.inc mysql_service.inc index 10dccaa..d3a3e10 100644 --- mysql_service.inc +++ mysql_service.inc @@ -113,6 +113,13 @@ class provisionService_db_mysql extends provisionService_db_pdo { $cmd = sprintf('mysqldump --defaults-file=/dev/fd/3 --opt --skip-lock-tables --order-by-primary --default-character-set=utf8 -Q --hex-blob --single-transaction --quick -r%s/database.sql %s', escapeshellcmd(d()->site_path), escapeshellcmd(drush_get_option('db_name'))); $success = $this->safe_shell_exec($cmd, drush_get_option('db_host'), urldecode(drush_get_option('db_user')), urldecode(drush_get_option('db_passwd'))); + $cmd = sprintf('sed \'s|/\*!50001 CREATE ALGORITHM=UNDEFINED \*/|/\*!50001 CREATE \*/|g\' %s/database.sql > %s/database_temp.sql', escapeshellcmd(d()->site_path), escapeshellcmd(d()->site_path)); + $success = $this->safe_shell_exec($cmd); + $cmd = sprintf('sed \'s|/\*!50013 DEFINER=.*||g\' %s/database_temp.sql > %s/database.sql', escapeshellcmd(d()->site_path), escapeshellcmd(d()->site_path)); + $success = $this->safe_shell_exec($cmd); + $cmd = sprintf('rm %s/database_temp.sql', escapeshellcmd(d()->site_path)); + $success = $this->safe_shell_exec($cmd); + if (!$success && !drush_get_option('force', false)) { drush_set_error('PROVISION_BACKUP_FAILED', dt('Could not generate database backup from mysqldump. (error: %msg)', array('%msg' => $this->safe_shell_exec_output))); } ================================================ FILE: aegir/patches/nik.patch ================================================ --- BARRACUDA.sh.txt 2010-10-03 14:15:01.000000000 +1100 +++ BARRACUDA-mod.sh.txt 2010-10-03 15:55:49.000000000 +1100 @@ -198,6 +198,14 @@ prompt_yes_no () { esac done } + +prompt_confirm_choice () { + read -p "$1 [$2]:" _CONFIRMED_ANSWER + if [ -z "$_CONFIRMED_ANSWER" ] ; then + _CONFIRMED_ANSWER=$2 + fi +} + # # Stop on error # set -e ### disable this for debugging @@ -703,34 +711,40 @@ if [ ! -f "/var/aegir/config/includes/ap cd /opt/tmp/$_BOA_REPO_NAME/aegir/helpers _MIRROR=`bash ffmirror.sh.txt < apt-list-ubuntu.txt` + _MIRROR="http://$_MIRROR/ubuntu/" + prompt_confirm_choice "Enter your own mirror to use or press enter to use the fastest found mirror " $_MIRROR + _MIRROR=$_CONFIRMED_ANSWER msg "$(date 2>&1) INFO: We will use $_THIS_OS mirror $_MIRROR" cd /var/opt echo "## MAIN REPOSITORIES" > /etc/apt/sources.list - echo "deb http://$_MIRROR/ubuntu/ $_REL_VERSION main restricted universe multiverse" >> /etc/apt/sources.list - echo "deb-src http://$_MIRROR/ubuntu/ $_REL_VERSION main restricted universe multiverse" >> /etc/apt/sources.list + echo "deb $_MIRROR $_REL_VERSION main restricted universe multiverse" >> /etc/apt/sources.list + echo "deb-src $_MIRROR $_REL_VERSION main restricted universe multiverse" >> /etc/apt/sources.list echo "" >> /etc/apt/sources.list echo "## MAJOR BUG FIX UPDATES produced after the final release" >> /etc/apt/sources.list - echo "deb http://$_MIRROR/ubuntu/ $_REL_VERSION-updates main restricted universe multiverse" >> /etc/apt/sources.list - echo "deb-src http://$_MIRROR/ubuntu/ $_REL_VERSION-updates main restricted universe multiverse" >> /etc/apt/sources.list + echo "deb $_MIRROR $_REL_VERSION-updates main restricted universe multiverse" >> /etc/apt/sources.list + echo "deb-src $_MIRROR $_REL_VERSION-updates main restricted universe multiverse" >> /etc/apt/sources.list echo "" >> /etc/apt/sources.list echo "## UBUNTU SECURITY UPDATES" >> /etc/apt/sources.list echo "deb http://security.ubuntu.com/ubuntu $_REL_VERSION-security main restricted universe multiverse" >> /etc/apt/sources.list echo "deb-src http://security.ubuntu.com/ubuntu $_REL_VERSION-security main restricted universe multiverse" >> /etc/apt/sources.list echo "" >> /etc/apt/sources.list echo "## BACKPORTS REPOSITORY" >> /etc/apt/sources.list - echo "deb http://$_MIRROR/ubuntu/ $_REL_VERSION-backports main restricted universe multiverse" >> /etc/apt/sources.list - echo "deb-src http://$_MIRROR/ubuntu/ $_REL_VERSION-backports main restricted universe multiverse" >> /etc/apt/sources.list + echo "deb $_MIRROR $_REL_VERSION-backports main restricted universe multiverse" >> /etc/apt/sources.list + echo "deb-src $_MIRROR $_REL_VERSION-backports main restricted universe multiverse" >> /etc/apt/sources.list elif [ "$_THIS_OS" = "Debian" ] ; then msg "$(date 2>&1) INFO: Now looking for the best/fastest $_THIS_OS mirror, this may take a while, please wait..." cd /opt/tmp/$_BOA_REPO_NAME/aegir/helpers _MIRROR=`bash ffmirror.sh.txt < apt-list-debian.txt` + _MIRROR="http://$_MIRROR/debian/" + prompt_confirm_choice "Enter your own mirror to use or press enter to use the fastest found mirror " $_MIRROR + _MIRROR=$_CONFIRMED_ANSWER msg "$(date 2>&1) INFO: We will use $_THIS_OS mirror $_MIRROR" cd /var/opt - echo "deb http://$_MIRROR/debian/ $_REL_VERSION main contrib non-free" > /etc/apt/sources.list - echo "deb-src http://$_MIRROR/debian/ $_REL_VERSION main contrib non-free" >> /etc/apt/sources.list + echo "deb $_MIRROR $_REL_VERSION main contrib non-free" > /etc/apt/sources.list + echo "deb-src $_MIRROR $_REL_VERSION main contrib non-free" >> /etc/apt/sources.list echo "deb http://security.debian.org/ $_REL_VERSION/updates main contrib non-free" >> /etc/apt/sources.list echo "deb-src http://security.debian.org/ $_REL_VERSION/updates main contrib non-free" >> /etc/apt/sources.list echo "deb http://volatile.debian.org/debian-volatile $_REL_VERSION/volatile main contrib non-free" >> /etc/apt/sources.list @@ -758,31 +772,31 @@ fi ###--------------------### msg "$(date 2>&1) INFO: Run apt update, please wait..." -runner "apt-fast update" +runner "apt-fast update -y" if [ "$_THIS_OS" = "Ubuntu" ] ; then runner "apt-fast upgrade -y" - runner "apt-fast update" - runner "apt-fast clean" - runner "apt-fast dist-upgrade" - runner "apt-fast autoclean" + runner "apt-fast update -y" + runner "apt-fast clean -y" + runner "apt-fast dist-upgrade -y" + runner "apt-fast autoclean -y" elif [ "$_THIS_OS" = "Debian" ] ; then runner "apt-fast upgrade -y" - runner "apt-fast update" - runner "apt-fast clean" - runner "apt-fast dist-upgrade" + runner "apt-fast update -y" + runner "apt-fast clean -y" + runner "apt-fast dist-upgrade -y" runner "aptitude full-upgrade -y" - runner "apt-fast autoclean" + runner "apt-fast autoclean -y" fi ###--------------------### msg "$(date 2>&1) INFO: Run apt update again, please wait..." -runner "apt-fast update" -runner "apt-fast clean" +runner "apt-fast update -y" +runner "apt-fast clean -y" if [ "$_THIS_OS" = "Ubuntu" ] ; then runner "apt-fast upgrade -y" - runner "apt-fast dist-upgrade" - runner "apt-fast autoclean" + runner "apt-fast dist-upgrade -y" + runner "apt-fast autoclean -y" elif [ "$_THIS_OS" = "Debian" ] ; then runner "aptitude full-upgrade -y" fi @@ -790,12 +804,12 @@ fi ###--------------------### msg "$(date 2>&1) INFO: Run apt update again, please wait..." -runner "apt-fast update" -runner "apt-fast clean" +runner "apt-fast update -y" +runner "apt-fast clean -y" if [ "$_THIS_OS" = "Ubuntu" ] ; then runner "apt-fast upgrade -y" - runner "apt-fast dist-upgrade" - runner "apt-fast autoclean" + runner "apt-fast dist-upgrade -y" + runner "apt-fast autoclean -y" elif [ "$_THIS_OS" = "Debian" ] ; then runner "aptitude full-upgrade -y" fi ================================================ FILE: aegir/patches/object_conversion_menu_router_build-972536-1.patch ================================================ --- includes/menu.inc.orig 2010-11-15 07:55:27.000000000 -0500 +++ includes/menu.inc 2010-11-15 13:38:36.000000000 -0500 @@ -3367,7 +3367,7 @@ function _menu_router_build($callbacks) $sort[$path] = $number_parts; } } - array_multisort($sort, SORT_NUMERIC, $menu); + array_multisort($sort, SORT_NUMERIC, $menu, SORT_STRING); // Apply inheritance rules. foreach ($menu as $path => $v) { $item = &$menu[$path]; ================================================ FILE: aegir/patches/octopus_video.patch ================================================ diff -urp a/octopus_video/modules/features/video_core/video_core.strongarm.inc b/octopus_video/modules/features/video_core/video_core.strongarm.inc --- a/octopus_video/modules/features/video_core/video_core.strongarm.inc 2012-04-03 12:12:51.000000000 -0400 +++ b/octopus_video/modules/features/video_core/video_core.strongarm.inc 2012-04-04 21:26:51.000000000 -0400 @@ -293,7 +293,7 @@ function video_core_strongarm() { $strongarm->disabled = FALSE; /* Edit this to true to make a default strongarm disabled initially */ $strongarm->api_version = 1; $strongarm->name = 'videojs_directory'; - $strongarm->value = 'profiles/octopus/libraries/video-js/video-js'; + $strongarm->value = 'profiles/octopus_video/libraries/video-js'; $export['videojs_directory'] = $strongarm; $strongarm = new stdClass; diff -urp a/octopus_video/octopus_video.info b/octopus_video/octopus_video.info --- a/octopus_video/octopus_video.info 2012-04-03 12:12:51.000000000 -0400 +++ b/octopus_video/octopus_video.info 2012-04-04 22:52:53.000000000 -0400 @@ -16,8 +16,8 @@ dependencies[] = statistics dependencies[] = syslog ; Contrib -dependencies[] = admin_menu -dependencies[] = admin_menu_toolbar +dependencies[] = zencoderapi +dependencies[] = toolbar dependencies[] = amazons3 dependencies[] = awssdk dependencies[] = awssdk_ui @@ -68,4 +68,8 @@ dependencies[] = video_user ; custom dependencies[] = jwplayer -dependencies[] = octopus_helper \ No newline at end of file +dependencies[] = octopus_helper + +version = "1.0-alpha6" +project = "octopus_video" + diff -urp a/octopus_video/octopus_video.install b/octopus_video/octopus_video.install --- a/octopus_video/octopus_video.install 2012-04-03 12:12:51.000000000 -0400 +++ b/octopus_video/octopus_video.install 2012-04-04 23:05:32.000000000 -0400 @@ -5,9 +5,10 @@ */ function octopus_video_install() { // set themes - theme_enable(array('octopus_video')); + theme_enable(array('octopus_video','rubik')); variable_set('theme_default', 'octopus_video'); - variable_set('admin_theme', 'seven'); + variable_set('admin_theme', 'rubik'); + variable_set('node_admin_theme', '0'); // Add text formats. $filtered_html_format = array( 'format' => 'filtered_html', diff -urp a/octopus_video/themes/octopus_video/octopus_video.info b/octopus_video/themes/octopus_video/octopus_video.info --- a/octopus_video/themes/octopus_video/octopus_video.info 2012-04-03 12:12:51.000000000 -0400 +++ b/octopus_video/themes/octopus_video/octopus_video.info 2012-04-04 21:24:25.000000000 -0400 @@ -118,13 +118,13 @@ settings[alpha_css][omega-menu.css] = '0 settings[alpha_css][omega-forms.css] = '0' settings[alpha_css][omega-visuals.css] = '0' settings[alpha_exclude][modules/comment/comment.css] = '0' -settings[alpha_exclude][profiles/octopus/modules/contrib/date/date_api/date.css] = '0' +settings[alpha_exclude][profiles/octopus_video/modules/contrib/date/date_api/date.css] = '0' settings[alpha_exclude][modules/field/theme/field.css] = '0' -settings[alpha_exclude][profiles/octopus/modules/contrib/logintoboggan/logintoboggan.css] = '0' +settings[alpha_exclude][profiles/octopus_video/modules/contrib/logintoboggan/logintoboggan.css] = '0' settings[alpha_exclude][modules/node/node.css] = '0' settings[alpha_exclude][modules/search/search.css] = '0' settings[alpha_exclude][modules/user/user.css] = '0' -settings[alpha_exclude][profiles/octopus/modules/contrib/views/css/views.css] = '0' +settings[alpha_exclude][profiles/octopus_video/modules/contrib/views/css/views.css] = '0' settings[alpha_exclude][misc/vertical-tabs.css] = '0' settings[alpha_exclude][modules/aggregator/aggregator.css] = '0' settings[alpha_exclude][modules/block/block.css] = '0' ================================================ FILE: aegir/patches/og_update_6205_commons_fix.patch ================================================ diff -urp a/og.install b/og.install --- a/og.install 2012-01-18 23:55:27.000000000 +0000 +++ b/og.install 2012-03-17 13:46:41.000000000 +0000 @@ -447,12 +447,13 @@ function og_update_6204() { } /** - * Add an index on og_uid.uid. + * Add an index on og_uid.uid. Already applied in drupal_commons.make */ function og_update_6205() { - $ret = array(); - db_add_index($ret, 'og_uid', 'uid', array('uid')); - return $ret; + //$ret = array(); + //db_add_index($ret, 'og_uid', 'uid', array('uid')); + //return $ret; + return array(); } // end updates // ================================================ FILE: aegir/patches/openacademy-search-off.patch ================================================ diff -urp a/openacademy.info b/openacademy.info --- a/openacademy.info 2012-07-20 21:37:28.000000000 +0000 +++ b/openacademy.info 2012-09-02 00:03:45.000000000 +0000 @@ -69,13 +69,6 @@ dependencies[] = simplified_menu_admin dependencies[] = references_dialog dependencies[] = backports -; Panopoly - Contrib - Search -dependencies[] = search_api -dependencies[] = search_api_solr -dependencies[] = facetapi -dependencies[] = search_api_facetapi -dependencies[] = search_api_views - ; Panopoly - Contrib - Products dependencies[] = apps dependencies[] = features diff -urp a/openacademy.profile b/openacademy.profile --- a/openacademy.profile 2012-08-18 18:57:09.000000000 +0000 +++ b/openacademy.profile 2012-09-02 00:02:54.000000000 +0000 @@ -30,7 +30,6 @@ function openacademy_install_tasks($inst 'panopoly_images', 'panopoly_magic', 'panopoly_pages', - 'panopoly_search', 'panopoly_theme', 'panopoly_users', 'panopoly_widgets', @@ -42,7 +41,6 @@ function openacademy_install_tasks($inst 'panopoly_images', 'panopoly_magic', 'panopoly_pages', - 'panopoly_search', 'panopoly_theme', 'panopoly_users', 'panopoly_widgets', ================================================ FILE: aegir/patches/openacademy.patch ================================================ diff -urp a/openacademy/openacademy.info b/openacademy/openacademy.info --- a/openacademy/openacademy.info 2012-05-31 14:51:19.000000000 -0400 +++ b/openacademy/openacademy.info 2012-06-03 12:35:45.000000000 -0400 @@ -31,6 +31,8 @@ dependencies[] = views dependencies[] = views_content dependencies[] = views_ui dependencies[] = token +dependencies[] = ds +dependencies[] = ds_extras ; Panopoly - Contrib - Field UI and Content Types dependencies[] = tablefield @@ -70,13 +72,6 @@ dependencies[] = simplified_menu_admin dependencies[] = references_dialog dependencies[] = backports -; Panopoly - Contrib - Search -dependencies[] = search_api -dependencies[] = search_api_solr -dependencies[] = facetapi -dependencies[] = search_api_facetapi -dependencies[] = search_api_views - ; Panopoly - Contrib - Products dependencies[] = apps dependencies[] = features @@ -86,9 +81,6 @@ dependencies[] = defaultcontent dependencies[] = strongarm dependencies[] = libraries -; Panopoly - Contrib - Performance -dependencies[] = redis - ; Panopoly - Contrib - Development dependencies[] = devel dependencies[] = devel_generate diff -urp a/openacademy/openacademy.profile b/openacademy/openacademy.profile --- a/openacademy/openacademy.profile 2012-05-29 18:39:27.000000000 -0400 +++ b/openacademy/openacademy.profile 2012-06-03 12:38:48.000000000 -0400 @@ -26,7 +26,6 @@ function openacademy_install_tasks($inst 'panopoly_images', 'panopoly_magic', 'panopoly_pages', - 'panopoly_search', 'panopoly_theme', 'panopoly_users', 'panopoly_widgets', @@ -38,7 +37,6 @@ function openacademy_install_tasks($inst 'panopoly_images', 'panopoly_magic', 'panopoly_pages', - 'panopoly_search', 'panopoly_theme', 'panopoly_users', 'panopoly_widgets', @@ -315,7 +313,12 @@ function openacademy_theme_form($form, & function openacademy_theme_form_submit($form, &$form_state) { // Enable and set the theme of choice - $theme = $form_state['input']['theme']; + if (defined('DRUSH_BASE_PATH')) { + $theme = "openacademy_default"; + } + else { + $theme = $form_state['input']['theme']; + } theme_enable(array($theme)); variable_set('theme_default', $theme); ================================================ FILE: aegir/patches/openaid-tpl.patch ================================================ diff -urp a/openaid/themes/openaid/templates/page.tpl.php b/openaid/themes/openaid/templates/page.tpl.php --- a/openaid/themes/openaid/templates/page.tpl.php 2012-04-12 00:48:17.000000000 +0000 +++ b/openaid/themes/openaid/templates/page.tpl.php 2012-04-12 23:00:59.000000000 +0000 @@ -20,7 +20,7 @@ - + ================================================ FILE: aegir/patches/openenterprise.patch ================================================ diff -urp a/openenterprise.profile b/openenterprise.profile --- a/openenterprise.profile 2011-02-11 15:47:05.000000000 +0000 +++ b/openenterprise.profile 2011-04-18 04:55:30.000000000 +0000 @@ -11,9 +11,10 @@ define('OPENENTERPRISE_FILTERED_HTML', ' * Implementation of hook_profile_details(). */ function openenterprise_profile_details() { + $description = st('Open Enterprise by LevelTen Interactive.'); return array( - 'name' => t('Open Enterprise'), - 'description' => t('Open Enterprise by LevelTen Interactive.'), + 'name' => 'Open Enterprise', + 'description' => $description, 'old_short_name' => 'enterprise_installer', ); } @@ -657,4 +658,4 @@ function openenterprise_config_date_form variable_set('date_format_date_only', 'l, F j, Y'); variable_set('date_format_time_only', 'g:i a'); -} \ No newline at end of file +} ================================================ FILE: aegir/patches/openoutreach.patch ================================================ From b72102ef8f5fb913d2f197067d8c2cd7ee3e99ed Mon Sep 17 00:00:00 2001 From: Nedjo Rogers Date: Wed, 04 Feb 2015 19:27:16 +0000 Subject: Issue #2293949: fix drush install time errors by enabling file_entity earlier. --- diff --git a/openoutreach.info b/openoutreach.info index ea5540c..1471c80 100644 --- a/openoutreach.info +++ b/openoutreach.info @@ -14,7 +14,7 @@ dependencies[] = "dashboard" dependencies[] = "dblog" dependencies[] = "features" dependencies[] = "field_ui" -dependencies[] = "file" +dependencies[] = "file_entity" dependencies[] = "help" dependencies[] = "image" dependencies[] = "libraries" @@ -85,4 +85,4 @@ subprofiles[membership][features][debut_section] = TRUE subprofiles[membership][features][debut_seo] = TRUE subprofiles[membership][features][debut_social] = TRUE subprofiles[membership][features][debut_wysiwyg] = TRUE -subprofiles[membership][features][openoutreach_front_page] = TRUE \ No newline at end of file +subprofiles[membership][features][openoutreach_front_page] = TRUE -- cgit v0.9.2 ================================================ FILE: aegir/patches/openpublic.patch ================================================ diff -urp a/openpublic.profile b/openpublic.profile --- a/openpublic.profile 2011-07-10 16:30:50.000000000 -0400 +++ b/openpublic.profile 2011-07-11 10:39:52.000000000 -0400 @@ -13,7 +13,7 @@ * called through custom invocation, so $form_state is not populated. */ function openpublic_form_alter(&$form, $form_state, $form_id) { - if ($form_id == 'install_configure_form') { + if ($form_id == 'install_configure_form' && !defined('DRUSH_BASE_PATH')) { $roles = array(DRUPAL_AUTHENTICATED_RID); $policy = _password_policy_load_active_policy($roles); ================================================ FILE: aegir/patches/openscholar.profile.patch ================================================ diff -urp a/openscholar.profile b/openscholar.profile --- a/openscholar.profile 2010-08-24 20:16:19.000000000 +0000 +++ b/openscholar.profile 2010-10-16 01:00:00.000000000 +0000 @@ -35,16 +35,43 @@ function openscholar_profile_modules() { ); } + +/** + * Returns an array list of core contributed modules to be installed first. + */ +function _openscholar_core_modules_first() { + $contrib_modules = array( + //cck + 'content', + 'content_copy', + 'diff', + 'date_timezone', + 'date_api', + 'date', + 'date_popup', + 'filefield', + 'fieldgroup', + 'imagecache', + 'imagecache_ui', + 'imagefield', + 'link', + 'text', + 'number', + 'nodereference', + 'nodereference_url', + 'optionwidgets', + ); + return $contrib_modules; +} + + /** * Returns an array list of core contributed modules. */ function _openscholar_core_modules() { $contrib_modules = array( - // sites/all/contrib - 'activity', 'addthis', 'advanced_help', - 'calendar', 'litecal', 'context', 'context_contrib', @@ -83,7 +110,6 @@ function _openscholar_core_modules() { 'stringoverrides', 'strongarm', 'token', - 'trigger', 'transliteration', 'twitter_pull', 'ucreate', @@ -95,38 +121,17 @@ function _openscholar_core_modules() { 'views_attach', 'vertical_tabs', 'wysiwyg', - - //cck - 'content', - 'content_copy', - 'diff', - 'date_timezone', - 'date_api', - 'date', - 'date_popup', - 'filefield', - 'fieldgroup', - 'imagecache', - 'imagecache_ui', - 'imagefield', - 'imagefield_crop', - 'link', - 'text', - 'number', - 'nodereference', - 'nodereference_url', - 'optionwidgets', - 'install_profile_api', 'schema', - // Optional Development Resources - //'admin_menu', + 'admin_menu', //'devel', //'devel_generate', - + 'calendar', + 'trigger', + 'imagefield_crop', + 'activity', ); - return $contrib_modules; } @@ -190,8 +195,6 @@ function openscholar_profile_task_list() global $conf; $conf['site_name'] = 'OpenScholar'; $conf['site_footer'] = 'OpenScholar by IQSS at Harvard University'; - - $tasks = array( 'openscholar-configure' => st('openscholar configuration'), ); @@ -206,11 +209,15 @@ function openscholar_profile_tasks(&$tas $output = ''; if ($task == 'profile') { + + $modules_first = _openscholar_core_modules_first(); $modules = _openscholar_core_modules(); $modules = array_merge($modules, _openscholar_scholar_modules()); - $files = module_rebuild_cache(); $operations = array(); + foreach ($modules_first as $module) { + $operations[] = array('_install_module_batch', array($module, $files[$module]->info['name'])); + } foreach ($modules as $module) { $operations[] = array('_install_module_batch', array($module, $files[$module]->info['name'])); } ================================================ FILE: aegir/patches/openscholar_projects.profile.patch ================================================ diff -urp a/openscholar_projects.profile b/openscholar_projects.profile --- a/openscholar_projects.profile 2010-08-18 15:16:43.000000000 +0000 +++ b/openscholar_projects.profile 2010-10-16 02:17:04.000000000 +0000 @@ -35,16 +35,43 @@ function openscholar_projects_profile_mo ); } + +/** + * Returns an array list of core contributed modules to be installed first. + */ +function _openscholar_projects_core_modules_first() { + $contrib_modules = array( + //cck + 'content', + 'content_copy', + 'diff', + 'date_timezone', + 'date_api', + 'date', + 'date_popup', + 'filefield', + 'fieldgroup', + 'imagecache', + 'imagecache_ui', + 'imagefield', + 'link', + 'text', + 'number', + 'nodereference', + 'nodereference_url', + 'optionwidgets', + ); + return $contrib_modules; +} + + /** * Returns an array list of core contributed modules. */ function _openscholar_projects_core_modules() { $contrib_modules = array( - // sites/all/contrib - 'activity', 'addthis', 'advanced_help', - 'calendar', 'litecal', 'context', 'context_contrib', @@ -83,7 +110,6 @@ function _openscholar_projects_core_modu 'stringoverrides', 'strongarm', 'token', - 'trigger', 'transliteration', 'twitter_pull', 'ucreate', @@ -95,38 +121,17 @@ function _openscholar_projects_core_modu 'views_attach', 'vertical_tabs', 'wysiwyg', - - //cck - 'content', - 'content_copy', - 'diff', - 'date_timezone', - 'date_api', - 'date', - 'date_popup', - 'filefield', - 'fieldgroup', - 'imagecache', - 'imagecache_ui', - 'imagefield', - 'imagefield_crop', - 'link', - 'text', - 'number', - 'nodereference', - 'nodereference_url', - 'optionwidgets', - 'install_profile_api', 'schema', - // Optional Development Resources - //'admin_menu', + 'admin_menu', //'devel', //'devel_generate', - + 'calendar', + 'trigger', + 'imagefield_crop', + 'activity', ); - return $contrib_modules; } @@ -180,8 +185,6 @@ function _openscholar_projects_scholar_m 'scholar_reader', 'scholar_front', 'scholar_profiles', - - ); } @@ -192,7 +195,6 @@ function openscholar_projects_profile_ta global $conf; $conf['site_name'] = 'OpenScholar'; $conf['site_footer'] = 'OpenScholar by IQSS at Harvard University'; - $tasks = array( 'scholar_projects-configure' => st('Projects configuration'), ); @@ -207,11 +209,15 @@ function openscholar_projects_profile_ta $output = ''; if ($task == 'profile') { + + $modules_first = _openscholar_projects_core_modules_first(); $modules = _openscholar_projects_core_modules(); $modules = array_merge($modules, _openscholar_projects_scholar_modules()); - $files = module_rebuild_cache(); $operations = array(); + foreach ($modules_first as $module) { + $operations[] = array('_install_module_batch', array($module, $files[$module]->info['name'])); + } foreach ($modules as $module) { $operations[] = array('_install_module_batch', array($module, $files[$module]->info['name'])); } ================================================ FILE: aegir/patches/panopoly-search-off.patch ================================================ diff -urp a/panopoly.info b/panopoly.info --- a/panopoly.info 2012-06-21 16:21:56.000000000 +0000 +++ b/panopoly.info 2012-08-27 09:08:43.000000000 +0000 @@ -68,14 +68,6 @@ dependencies[] = simplified_menu_admin dependencies[] = references_dialog dependencies[] = backports -; Panopoly - Contrib - Search -dependencies[] = facetapi -dependencies[] = search_api -dependencies[] = search_api_solr -dependencies[] = search_api_facetapi -dependencies[] = search_api_views -dependencies[] = search_api_db - ; Panopoly - Contrib - Products dependencies[] = apps dependencies[] = features diff -urp a/panopoly.profile b/panopoly.profile --- a/panopoly.profile 2012-08-18 18:57:09.000000000 +0000 +++ b/panopoly.profile 2012-08-27 09:14:04.000000000 +0000 @@ -31,7 +31,6 @@ function panopoly_install_tasks($install 'panopoly_images', 'panopoly_magic', 'panopoly_pages', - 'panopoly_search', 'panopoly_theme', 'panopoly_users', 'panopoly_widgets', @@ -43,7 +42,6 @@ function panopoly_install_tasks($install 'panopoly_images', 'panopoly_magic', 'panopoly_pages', - 'panopoly_search', 'panopoly_theme', 'panopoly_users', 'panopoly_widgets', ================================================ FILE: aegir/patches/panopoly-search-redis.patch ================================================ diff -urp a/panopoly/panopoly.info b/panopoly/panopoly.info --- a/panopoly/panopoly.info 2012-05-05 02:11:30.000000000 +0000 +++ b/panopoly/panopoly.info 2012-05-17 00:45:16.000000000 +0000 @@ -70,13 +70,6 @@ dependencies[] = simplified_menu_admin dependencies[] = references_dialog dependencies[] = backports -; Contrib - Search -dependencies[] = search_api -dependencies[] = search_api_solr -dependencies[] = facetapi -dependencies[] = search_api_facetapi -dependencies[] = search_api_views - ; Contrib - Products dependencies[] = apps dependencies[] = features @@ -86,9 +79,6 @@ dependencies[] = defaultcontent dependencies[] = strongarm dependencies[] = libraries -; Contrib - Performance -dependencies[] = redis - ; Contrib - Development dependencies[] = devel dependencies[] = devel_generate diff -urp a/panopoly/panopoly.profile b/panopoly/panopoly.profile --- a/panopoly/panopoly.profile 2012-05-05 01:40:14.000000000 +0000 +++ b/panopoly/panopoly.profile 2012-05-17 00:45:30.000000000 +0000 @@ -27,7 +27,6 @@ function panopoly_install_tasks($install 'panopoly_images', 'panopoly_magic', 'panopoly_pages', - 'panopoly_search', 'panopoly_theme', 'panopoly_users', 'panopoly_widgets', ================================================ FILE: aegir/patches/patch_commit_6fabd31b0f81.patch ================================================ diff --git a/includes/file.inc b/includes/file.inc index c5e5cf07d636d2454c3e158eda0e2c0f6f7297fa..57a4e4734a8a175c4ae8dd8894a281699529b95b 100644 --- a/includes/file.inc +++ b/includes/file.inc @@ -476,6 +476,9 @@ function file_ensure_htaccess() { * The default is TRUE which indicates a private and protected directory. */ function file_create_htaccess($directory, $private = TRUE) { + // Skip this on BOA since .htaccess is never used in Nginx. + return; + if (file_uri_scheme($directory)) { $directory = file_stream_wrapper_uri_normalize($directory); } ================================================ FILE: aegir/patches/patch_commit_fa47bad85589.patch ================================================ diff --git a/Provision/Config/cdn.tpl.php b/Provision/Config/cdn.tpl.php index a4ce098ea323d9855642ab4b17a54d93cb2d1d0f..00597f8795768bc43dea4fa0eae8afca75a22f67 100644 --- a/Provision/Config/cdn.tpl.php +++ b/Provision/Config/cdn.tpl.php @@ -3,7 +3,16 @@ $ip_address = !empty($ip_address) ? $ip_address : '*'; ?> server { limit_conn limreq 555; # like mod_evasive - this allows max 555 simultaneous connections from one IP address - listen ; +ip_addresses as $ip) { + print " listen {$ip}:{$http_port};\n"; + } +} +?> server_name cdn as $cdn_domain) : if (trim($cdn_domain)) : ?> ; root root}"; ?>; diff --git a/Provision/Config/cdn_disabled.tpl.php b/Provision/Config/cdn_disabled.tpl.php index 396e309a3e746794759bb910edeb500bea38aa41..cee2eb0acaabb7304cd4cc9e61f5d81d4a1fd3bf 100644 --- a/Provision/Config/cdn_disabled.tpl.php +++ b/Provision/Config/cdn_disabled.tpl.php @@ -2,10 +2,19 @@ $ip_address = !empty($ip_address) ? $ip_address : '*'; ?> server { - listen ; + limit_conn limreq 555; +ip_addresses as $ip) { + print " listen {$ip}:{$http_port};\n"; + } +} +?> server_name cdn); ?>; root /var/www/nginx-default; index index.html index.htm; - ### Do not reveal Aegir front-end URL here. } ================================================ FILE: aegir/patches/php-8.1-openssl3.patch ================================================ diff -Naur a/ext/openssl/openssl.c b/ext/openssl/openssl.c --- a/ext/openssl/openssl.c 2021-07-20 19:08:50.000000000 +0300 +++ b/ext/openssl/openssl.c 2021-07-21 15:44:11.395257764 +0300 @@ -1198,7 +1198,6 @@ REGISTER_LONG_CONSTANT("OPENSSL_CMS_NOSIGS", CMS_NOSIGS, CONST_CS|CONST_PERSISTENT); REGISTER_LONG_CONSTANT("OPENSSL_PKCS1_PADDING", RSA_PKCS1_PADDING, CONST_CS|CONST_PERSISTENT); - REGISTER_LONG_CONSTANT("OPENSSL_SSLV23_PADDING", RSA_SSLV23_PADDING, CONST_CS|CONST_PERSISTENT); REGISTER_LONG_CONSTANT("OPENSSL_NO_PADDING", RSA_NO_PADDING, CONST_CS|CONST_PERSISTENT); REGISTER_LONG_CONSTANT("OPENSSL_PKCS1_OAEP_PADDING", RSA_PKCS1_OAEP_PADDING, CONST_CS|CONST_PERSISTENT); ================================================ FILE: aegir/patches/provision/patch_commit_e4abc685f9b4.patch ================================================ diff --git a/http/Provision/Config/Nginx/server.tpl.php b/http/Provision/Config/Nginx/server.tpl.php index 1158df5756ca13516f8eb16c34ba16a2742c95ed..4ce8cebf9583c17a5d335f2e691bba9e5531169c 100644 --- a/http/Provision/Config/Nginx/server.tpl.php +++ b/http/Provision/Config/Nginx/server.tpl.php @@ -16,7 +16,7 @@ fastcgi_param DOCUMENT_ROOT $document_root; fastcgi_param SERVER_PROTOCOL $server_protocol; fastcgi_param GATEWAY_INTERFACE CGI/1.1; - fastcgi_param SERVER_SOFTWARE ApacheSolaris/$nginx_version; + fastcgi_param SERVER_SOFTWARE ApacheSolarisNginx/$nginx_version; fastcgi_param REMOTE_ADDR $remote_addr; fastcgi_param REMOTE_PORT $remote_port; fastcgi_param SERVER_ADDR $server_addr; diff --git a/http/Provision/Service/http/fastcgi_params.conf b/http/Provision/Service/http/fastcgi_params.conf index 70d62e38d15a93c5ce3bb8502664290c7efd95a7..e1991a74580e1b11f6942506f71de9929c308abe 100644 --- a/http/Provision/Service/http/fastcgi_params.conf +++ b/http/Provision/Service/http/fastcgi_params.conf @@ -12,7 +12,7 @@ fastcgi_param DOCUMENT_URI $document_uri; fastcgi_param DOCUMENT_ROOT $document_root; fastcgi_param SERVER_PROTOCOL $server_protocol; fastcgi_param GATEWAY_INTERFACE CGI/1.1; -fastcgi_param SERVER_SOFTWARE ApacheSolaris/$nginx_version; +fastcgi_param SERVER_SOFTWARE ApacheSolarisNginx/$nginx_version; fastcgi_param REMOTE_ADDR $remote_addr; fastcgi_param REMOTE_PORT $remote_port; fastcgi_param SERVER_ADDR $server_addr; diff --git a/http/Provision/Service/http/fastcgi_ssl_params.conf b/http/Provision/Service/http/fastcgi_ssl_params.conf index c24a765bcfe90216283d8177f9acead6bb749d46..2b7eedaf06eb12aa17017059c25f9a45555d6bcb 100644 --- a/http/Provision/Service/http/fastcgi_ssl_params.conf +++ b/http/Provision/Service/http/fastcgi_ssl_params.conf @@ -12,7 +12,7 @@ fastcgi_param DOCUMENT_URI $document_uri; fastcgi_param DOCUMENT_ROOT $document_root; fastcgi_param SERVER_PROTOCOL $server_protocol; fastcgi_param GATEWAY_INTERFACE CGI/1.1; -fastcgi_param SERVER_SOFTWARE SSLApacheSolaris/$nginx_version; +fastcgi_param SERVER_SOFTWARE ApacheSolarisSSLNginx/$nginx_version; fastcgi_param REMOTE_ADDR $remote_addr; fastcgi_param REMOTE_PORT $remote_port; fastcgi_param SERVER_ADDR $server_addr; ================================================ FILE: aegir/patches/provision_hosting_le.drush.inc ================================================ type == 'site') { $le_root = d('@server_master')->aegir_root . "/tools/le"; $le_cert = d('@server_master')->aegir_root . "/tools/le/certs"; $le_acme = d('@server_master')->aegir_root . "/tools/le/.acme-challenges"; $le_ctrl = d('@server_master')->aegir_root . "/tools/le/.ctrl"; $le_exec = d('@server_master')->aegir_root . "/tools/le/dehydrated"; $le_conf = d('@server_master')->aegir_root . "/tools/le/config.sh"; $le_cnfx = d('@server_master')->aegir_root . "/tools/le/config"; $le_acct = d('@server_master')->aegir_root . "/tools/le/accounts"; $le_hook = d('@server_master')->aegir_root . "/tools/le/letsencrypt-sh-hooks.sh"; $cf_hook = d('@server_master')->aegir_root . "/tools/le/hooks/cloudflare/hook.py"; $is_boa = FALSE; $is_boa_ctrl = "/data/conf/global.inc"; if (provision_file()->exists($is_boa_ctrl)->status()) { $is_boa = TRUE; } $main_name = $real_name = substr(d()->name, 1); if ($real_name == 'hostmaster') { $real_name = $main_name = d()->uri; } if (d()->redirection) { drush_log('[hosting_le] This sitename redirection target is ' . d()->redirection, 'info'); $main_name = d()->redirection; if ($is_boa) { $cert_dir = $le_cert . "/" . $real_name; } else { $cert_dir = $le_cert . "/" . $main_name; drush_log('[hosting_le] LE SSL certificate will be valid only for ' . d()->redirection, 'info'); } } else { $cert_dir = $le_cert . "/" . $main_name; } drush_log('[hosting_le] This cert_dir is ' . $cert_dir, 'info'); if ($is_boa) { drush_log('[hosting_le] This site main SSL name is ' . $real_name, 'info'); drush_log('[hosting_le] BOA system detected, congrats!', 'info'); } else { drush_log('[hosting_le] This site main SSL name is ' . $main_name, 'info'); } $wildcard_ctrl = d('@server_master')->aegir_root . "/static/control/wildcard-enable-" . $main_name . ".info"; drush_log('[hosting_le] The optional wildcard flag is ' . $wildcard_ctrl, 'info'); $legacy_tls_ctrl = d('@server_master')->aegir_root . "/static/control/tls-legacy-enable-" . $main_name . ".info"; drush_log('[hosting_le] The optional legacy TLSv1.1 flag is ' . $legacy_tls_ctrl, 'info'); $no_san_ctrl = d('@server_master')->aegir_root . "/static/control/ssl-no-san-" . $main_name . ".info"; drush_log('[hosting_le] The optional no-SAN flag is ' . $no_san_ctrl, 'info'); $yes_dev_ctrl = d('@server_master')->aegir_root . "/static/control/ssl-yes-dev-" . $main_name . ".info"; drush_log('[hosting_le] The optional enable-DEV flag is ' . $yes_dev_ctrl, 'info'); $immutable = $le_ctrl . "/dont-overwrite-" . $main_name . ".pid"; drush_log('[hosting_le] The optional immutable flag is ' . $immutable, 'info'); $demo_mode_ctrl = $le_ctrl . "/ssl-demo-mode.pid"; drush_log('[hosting_le] The optional demo flag is ' . $demo_mode_ctrl, 'info'); // https://community.letsencrypt.org/t/revoking-certain-certificates-on-march-4/114864 $forced_renewal_ctrl = $le_ctrl . "/forced-renewal-02-" . $main_name . ".pid"; $site_mode_demo_ctrl = $le_ctrl . "/demo-" . $main_name . ".pid"; $site_mode_live_ctrl = $le_ctrl . "/live-" . $main_name . ".pid"; $force_renew = FALSE; $on_remote_server = !provision_is_local_host(d()->platform->web_server->remote_host); } $is_wildcard = FALSE; if (provision_file()->exists($wildcard_ctrl)->status()) { if (provision_file()->exists($cf_hook)->status()) { if (provision_file()->exists($le_cnfx)->status()) { $is_wildcard = TRUE; $main_name = preg_replace('`^www\.`', '', $main_name); $real_name = preg_replace('`^www\.`', '', $real_name); } } } if (d()->type == 'site' && !d()->ssl_enabled && !provision_file()->exists($immutable)->status()) { if (file_exists($cert_dir)) { exec("/bin/bash " . $le_exec . " --cleanup", $output_b); $acme_result_b = implode(' ', $output_b); drush_log('[hosting_le] ACME Cleanup Output: ' . $acme_result_b, 'info'); exec("symlinks -dr " . $cert_dir, $output_c); $acme_result_c = implode(' ', $output_c); drush_log('[hosting_le] ACME Cleanup Symlinks: ' . $acme_result_c, 'info'); } } elseif (d()->type == 'site' && d()->ssl_enabled) { provision_file()->create_dir($le_root, dt('[hosting_le] LE root'), 0711); provision_file()->create_dir($le_cert, dt('[hosting_le] LE certs'), 0700); provision_file()->create_dir($le_acme, dt('[hosting_le] LE challenges'), 0711); provision_file()->create_dir($le_ctrl, dt('[hosting_le] LE ctrl'), 0711); if (!provision_file()->exists($le_exec)->status()) { drush_log('[hosting_le] Please upload dehydrated to ' . $le_exec, 'warning'); drush_log('[hosting_le] URL: https://raw.githubusercontent.com/omega8cc/dehydrated/master/dehydrated', 'warning'); return FALSE; } if ($on_remote_server && !provision_file()->exists($le_hook)->status()) { drush_log('[hosting_le] Please copy letsencrypt-sh-hooks.sh to ' . $le_root, 'warning'); return FALSE; } $enable_dev_ctrl = FALSE; if (provision_file()->exists($yes_dev_ctrl)->status()) { $enable_dev_ctrl = TRUE; drush_log('[hosting_le] SSL enable-DEV mode ctrl file detected for ' . $main_name, 'info'); } if ($is_boa) { if (preg_match("/\.(?:host8|boa|aegir|o8)\.(?:biz|io|cc)$/", $main_name) || preg_match("/\.(?:nodns)\./", $main_name) ) { drush_log('[hosting_le] Skipping LE setup for ' . $main_name, 'warning'); return FALSE; } if (!$enable_dev_ctrl) { if (preg_match("/\.(?:temp|tmp|temporary)\./", $main_name) || preg_match("/\.(?:test|testing)\./", $main_name) || preg_match("/\.(?:dev|devel)\./", $main_name) ) { drush_log('[hosting_le] Skipping LE setup for ' . $main_name, 'warning'); return FALSE; } } } if (provision_file()->exists($demo_mode_ctrl)->status()) { if (!provision_file()->exists($le_conf)->status()) { $le_conf_lines = "CA=\"https://acme-staging-v02.api.letsencrypt.org/directory\"\n"; provision_file()->file_put_contents($le_conf, $le_conf_lines) ->succeed('[hosting_le] Created cnf ' . $le_conf) ->fail('[hosting_le] Could not create cnf ' . $le_conf); copy($le_conf, $le_cnfx); if (provision_file()->exists($le_acct)->status()) { drush_log('[hosting_le] Demo LE account will be created.', 'info'); rename($le_acct, $le_acct . "-live"); } drush_log('[hosting_le] New LE accounts require registration on ACMEv2.', 'info'); drush_log('[hosting_le] Running --register --accept-terms as required by ACMEv2.', 'info'); $le_register = " --register --accept-terms"; exec("/bin/bash " . $le_exec . $le_register . " 2>&1", $register_output); $acme_register = implode(' ', $register_output); drush_log("[hosting_le] ACMEv2 Demo Register Output: " . $acme_register, 'info'); $acme_register = ""; } drush_log('[hosting_le] Demo LE mode active. No real LE certs will be generated.', 'info'); $demo_mode = TRUE; } else { if (provision_file()->exists($le_conf)->status()) { unlink($le_conf); unlink($le_cnfx); if (provision_file()->exists($le_acct)->status()) { rename($le_acct, $le_acct . "-demo"); } drush_log('[hosting_le] Live LE account will be registered.', 'info'); drush_log('[hosting_le] New LE accounts require registration on ACMEv2.', 'info'); drush_log('[hosting_le] Running --register --accept-terms as required by ACMEv2.', 'info'); $le_register = " --register --accept-terms"; exec("/bin/bash " . $le_exec . $le_register . " 2>&1", $register_output); $acme_register = implode(' ', $register_output); drush_log("[hosting_le] ACMEv2 Live Register Output: " . $acme_register, 'info'); $acme_register = ""; } drush_log('[hosting_le] Live LE mode active. Real LE certs will be generated.', 'info'); $demo_mode = FALSE; } if ($demo_mode) { if (file_exists($site_mode_live_ctrl) || !file_exists($site_mode_demo_ctrl)) { unlink($site_mode_live_ctrl); $force_renew = TRUE; drush_log('[hosting_le] Forcing DEMO certificate renew for ' . $main_name, 'info'); } if (!file_exists($site_mode_demo_ctrl)) { provision_file()->file_put_contents($site_mode_demo_ctrl, $main_name) ->succeed('[hosting_le] Created pid ' . $site_mode_demo_ctrl) ->fail('[hosting_le] Could not create pid ' . $site_mode_demo_ctrl); } } else { if (file_exists($site_mode_demo_ctrl) || !file_exists($site_mode_live_ctrl)) { @unlink($site_mode_demo_ctrl); $force_renew = TRUE; drush_log('[hosting_le] Forcing LIVE certificate renew for ' . $main_name, 'info'); } if (!file_exists($site_mode_live_ctrl)) { provision_file()->file_put_contents($site_mode_live_ctrl, $main_name) ->succeed('[hosting_le] Created pid ' . $site_mode_live_ctrl) ->fail('[hosting_le] Could not create pid ' . $site_mode_live_ctrl); } } if (!file_exists($forced_renewal_ctrl)) { $force_renew = TRUE; provision_file()->file_put_contents($forced_renewal_ctrl, $main_name) ->succeed('[hosting_le] Created pid ' . $forced_renewal_ctrl) ->fail('[hosting_le] Could not create pid ' . $forced_renewal_ctrl); } // WIP: needed after certs deleted // $force_renew = TRUE; drush_log('[hosting_le] LE certificate for ' . $main_name, 'info'); if (provision_file()->exists($no_san_ctrl)->status()) { $no_alt_names = TRUE; drush_log('[hosting_le] SSL no-SAN mode ctrl file detected for ' . $main_name, 'info'); } else { $no_alt_names = FALSE; if ($is_boa) { if (!empty(d()->aliases)) { foreach (d()->aliases as $alias) { if ($is_wildcard) { if (!preg_match("/\.(?:host8|boa|aegir|o8)\.(?:biz|io|cc)$/", $alias) && !preg_match("/\.(?:nodns)\./", $alias) && !strpos($alias, $main_name)) { $alt_names .= ' --domain ' . str_replace('/', '.', $alias); } } else { if (!preg_match("/\.(?:host8|boa|aegir|o8)\.(?:biz|io|cc)$/", $alias) && !preg_match("/\.(?:nodns)\./", $alias)) { $alt_names .= ' --domain ' . str_replace('/', '.', $alias); } } } } } else { if (!empty(d()->aliases)) { $alt_names = implode(' --domain ', str_replace('/', '.', d()->aliases)); $alt_names = ' --domain ' . $alt_names; } } drush_log('[hosting_le] ALT names:' . $alt_names, 'info'); } $web_server = d()->platform->web_server; // check if server is a pack if ($web_server->master_web_servers) { // use pack master $web_server = d(reset($web_server->master_web_servers)); } $site_vhost = $web_server->http_vhostd_path . "/" . $real_name; if (provision_file()->exists($site_vhost)->status()) { $grep_output = ''; $redirect_result = ''; $http_service_type = $web_server->http_service_type; if ($http_service_type == 'nginx_ssl') { exec("/bin/grep \"alias redirection virtual host\" " . $site_vhost, $grep_output); } elseif ($http_service_type == 'apache_ssl') { exec("/bin/grep \"Redirect all aliases\" " . $site_vhost, $grep_output); } $redirect_result = implode(' ', $grep_output); drush_log('[hosting_le] Redirect check result for ' . $main_name . ' : ' . $redirect_result, 'info'); if ($redirect_result && !$no_alt_names && !$is_boa) { drush_log("[hosting_le] Aliases redirection must be disabled if all aliases are expected to be listed as SAN names.", 'info'); drush_log("[hosting_le] The alternative is to disable SAN mode for this site with empty ctrl file: " . $no_san_ctrl, 'info'); drush_log('[hosting_le] Forcing no-SAN-mode for ' . $main_name, 'info'); $no_alt_names = TRUE; } } else { drush_log("[hosting_le] The site's vhost must already exist, or the LE agent will not be able to proceed.", 'warning'); drush_log('[hosting_le] Path to vhost: ' . $site_vhost, 'info'); drush_log('[hosting_le] Skipping LE setup for ' . $main_name, 'warning'); return FALSE; } if (provision_file()->exists($immutable)->status() && provision_file()->exists($cert_dir)->status()) { $needs_update = FALSE; drush_log("[hosting_le] Immutable protection mode detected for this domain: " . $cert_dir, 'info'); drush_log("[hosting_le] SSL Certificate for this domain already exists in: " . $cert_dir, 'info'); drush_log("[hosting_le] You can replace it with any other certificate since it will be left here as-is forever.", 'info'); drush_log("[hosting_le] To re-activate LE auto-renewals please delete this file: " . $immutable, 'info'); drush_log("[hosting_le] NOTE: On hosted Ægir service you need to contact your host support for further assistance.", 'info'); } else { drush_log("[hosting_le] To stop the LE Certificate auto-renewals please create an empty ctrl file.", 'info'); drush_log("[hosting_le] Path to use for this site specific empty ctrl file: " . $immutable, 'info'); drush_log("[hosting_le] You could then replace existing cert with any other cert since it will be left here as-is forever.", 'info'); drush_log("[hosting_le] NOTE: On hosted Ægir service you need to contact your host support for further assistance.", 'info'); $output = ''; $le_options = " --cron --ipv4"; $le_challenge = " --domain " . $real_name . " --challenge dns-01 --hook " . $cf_hook; if ($on_remote_server) { $le_options .= " --hook " . $le_hook; } if ($force_renew) { if ($no_alt_names || empty($alt_names)) { if ($is_wildcard) { $le_options .= " --alias " . $real_name . " --domain *." . $real_name . $le_challenge; exec("/bin/bash " . $le_exec . $le_options . " --force 2>&1", $output); } else { exec("/bin/bash " . $le_exec . $le_options . " --force --domain " . $main_name . ' 2>&1', $output); } } else { if ($is_wildcard) { $le_options .= " --alias " . $real_name . " --domain *." . $real_name . $alt_names . $le_challenge; exec("/bin/bash " . $le_exec . $le_options . " --force 2>&1", $output); } else { exec("/bin/bash " . $le_exec . $le_options . " --force --domain " . $real_name . $alt_names . ' 2>&1', $output); } } } else { if ($no_alt_names || empty($alt_names)) { if ($is_wildcard) { $le_options .= " --alias " . $real_name . " --domain *." . $real_name . $le_challenge; exec("/bin/bash " . $le_exec . $le_options . " 2>&1", $output); } else { exec("/bin/bash " . $le_exec . $le_options . " --domain " . $main_name . ' 2>&1', $output); } } else { if ($is_wildcard) { $le_options .= " --alias " . $real_name . " --domain *." . $real_name . $alt_names . $le_challenge; exec("/bin/bash " . $le_exec . $le_options . " 2>&1", $output); } else { exec("/bin/bash " . $le_exec . $le_options . " --domain " . $real_name . $alt_names . ' 2>&1', $output); } } } $acme_result = implode(' ', $output); drush_log("[hosting_le] ACME Output: " . $acme_result, 'info'); if (!provision_file()->exists($cert_dir)->status()) { $needs_update = FALSE; drush_log("[hosting_le] Hmm.. For some reason cert_dir doesn't exist: " . $cert_dir, 'info'); drush_log("[hosting_le] I couldn't generate LE cert during this Verify procedure.", 'info'); drush_log("[hosting_le] It's normal while running a series of Verify sub-tasks during Rename/Migrate.", 'info'); drush_log("[hosting_le] But if this happens during standalone Verify, maybe permissions are incorrect.", 'info'); drush_log("[hosting_le] Let's abort the procedure here. Bye.", 'info'); return FALSE; } else { if (preg_match("/unchanged.*Skipping/i", $acme_result)) { $needs_update = FALSE; drush_log("[hosting_le] The existing LE Certificate is up to date in " . $cert_dir, 'success'); } elseif (preg_match("/Forcing.*renew/i", $acme_result) && preg_match("/Creating.*fullchain/i", $acme_result)) { $needs_update = TRUE; drush_log("[hosting_le] The LE Certificate has been successfully updated in " . $cert_dir, 'success'); } elseif (preg_match("/Forcing.*renew/i", $acme_result) && !preg_match("/Creating.*fullchain/i", $acme_result)) { $needs_update = FALSE; drush_log("[hosting_le] The LE Certificate attempted update looks incomplete in " . $cert_dir, 'warning'); drush_log("[hosting_le] Make sure that all aliases have valid DNS names pointing to your instance IP address.", 'warning'); if (!$is_boa) { drush_log("[hosting_le] Aliases redirection must be disabled, or the LE agent will not be able to proceed.", 'warning'); } drush_log("[hosting_le] The alternative is to disable SAN mode for this site with empty ctrl file: " . $no_san_ctrl, 'warning'); } elseif (preg_match("/Requesting.*challenge/i", $acme_result) && !preg_match("/Forcing.*renew/i", $acme_result) && !preg_match("/Creating.*fullchain/i", $acme_result)) { $needs_update = FALSE; drush_log("[hosting_le] The LE Certificate attempted creation failed in " . $cert_dir, 'warning'); drush_log("[hosting_le] Make sure that all aliases have valid DNS names pointing to your instance IP address.", 'warning'); if (!$is_boa) { drush_log("[hosting_le] Aliases redirection must be disabled, or the LE agent will not be able to proceed.", 'warning'); } drush_log("[hosting_le] The alternative is to disable SAN mode for this site with empty ctrl file: " . $no_san_ctrl, 'warning'); } else { $needs_update = TRUE; drush_log("[hosting_le] The LE Certificate has been successfully [re]generated in " . $cert_dir, 'success'); } } } if ($needs_update && !provision_file()->exists($immutable)->status()) { exec("/bin/bash " . $le_exec . " --cleanup", $output_clean); $acme_result_clean = implode(' ', $output_clean); drush_log('[hosting_le] ACME Cleanup Output: ' . $acme_result_clean, 'info'); $ssl_symlinks[] = d('@server_master')->ssld_path . "/" . $real_name; $ssl_symlinks[] = $web_server->http_ssld_path . "/" . $real_name; foreach ($ssl_symlinks as $symlink) { if (provision_file()->exists($symlink)->status()) { drush_log('[hosting_le] File exists: ' . $symlink, 'info'); if (!is_link($symlink)) { drush_log('[hosting_le] Moving original directory out of the way: ' . $symlink, 'info'); // This will overwrite symlink.bak if necessary, so we don't end up // with dozens of backups of unused certificates. rename($symlink, $symlink . ".bak"); } else { drush_log('[hosting_le] SSL certificate already symlinked: ' . $symlink, 'success'); continue; } } drush_log('[hosting_le] Creating symlink at ' . $symlink, 'info'); if (symlink($cert_dir, $symlink)) { drush_log('[hosting_le] Symlinked cert directory to ' . $symlink, 'success'); } else { drush_log('[hosting_le] Could not symlink cert directory to ' . $symlink, 'warning'); } } drush_log('[hosting_le] Replacing openssl symlinks.', 'info'); $filenames = array( 'openssl.crt' => 'cert.pem', 'openssl.csr' => 'cert.csr', 'openssl.key' => 'privkey.pem', 'openssl_chain.crt' => 'fullchain.pem', ); $success = TRUE; foreach ($filenames as $original => $target) { // Remove current symlink or file (this would have been generated by // Ægir AFTER the original dir symlinking, meaning it's self-generated // and therefore unimportant. @unlink($cert_dir . "/" . $original); $success = ($success && symlink($cert_dir . "/" . $target, $cert_dir . "/" . $original)); } if ($success) { drush_log('[hosting_le] Successfully replaced all symlinks.', 'success'); } else { drush_log('[hosting_le] Could not replace one or more symlinks. Check ' . $certdir, 'warning'); } $web_server->sync($le_cert . '/' . $real_name); $web_server->sync($web_server->http_ssld_path); $pid = $le_ctrl . "/" . $main_name . ".pid"; if (file_exists($cert_dir) && !file_exists($pid)) { provision_file()->file_put_contents($pid, $main_name) ->succeed('[hosting_le] Created pid ' . $pid) ->fail('[hosting_le] Could not create pid ' . $pid); // We will not run the secondary Verify if pid file doesn't exist, // to avoid verify-inside-verify loop which could overload the system. if (provision_file()->exists($pid)->status()) { drush_log('[hosting_le] Running Verify again to reload web server once openssl_chain.crt is present in the vhost', 'info'); $local_uri_verify = '@' . $real_name; provision_backend_invoke($local_uri_verify, 'provision-verify'); // We could run it via frontend but it is not needed currently. //provision_backend_invoke('@hostmaster', 'hosting-task', array($local_uri_verify, 'verify'), array('force' => TRUE)); sleep(5); // A small trick to avoid high load and race conditions. } } drush_log('[hosting_le] Restarting webserver', 'info'); $web_server->restart(); } } } ================================================ FILE: aegir/patches/remove_usr1_usr2_fpm_unix.patch ================================================ diff --git a/sapi/fpm/fpm/fpm_unix.c b/sapi/fpm/fpm/fpm_unix.c index 5c5e37c..ed3b352 100644 --- a/sapi/fpm/fpm/fpm_unix.c +++ b/sapi/fpm/fpm/fpm_unix.c @@ -271,28 +271,6 @@ int fpm_unix_init_main() /* {{{ */ struct sigaction oldact_usr2; struct timeval tv; - /* - * set sigaction for USR1 before fork - * save old sigaction to restore it after - * fork in the child process (the master process) - */ - memset(&act, 0, sizeof(act)); - memset(&act, 0, sizeof(oldact_usr1)); - act.sa_handler = fpm_signals_sighandler_exit_ok; - sigfillset(&act.sa_mask); - sigaction(SIGUSR1, &act, &oldact_usr1); - - /* - * set sigaction for USR2 before fork - * save old sigaction to restore it after - * fork in the child process (the master process) - */ - memset(&act, 0, sizeof(act)); - memset(&act, 0, sizeof(oldact_usr2)); - act.sa_handler = fpm_signals_sighandler_exit_config; - sigfillset(&act.sa_mask); - sigaction(SIGUSR2, &act, &oldact_usr2); - /* then fork */ pid_t pid = fork(); switch (pid) { @@ -311,15 +289,6 @@ int fpm_unix_init_main() /* {{{ */ default : /* parent */ fpm_cleanups_run(FPM_CLEANUP_PARENT_EXIT); - /* - * wait for 10s before exiting with error - * the child is supposed to send USR1 or USR2 to tell the parent - * how it goes for it - */ - tv.tv_sec = 10; - tv.tv_usec = 0; - zlog(ZLOG_DEBUG, "The calling process is waiting for the master process to ping"); - select(0, NULL, NULL, NULL, &tv); exit(FPM_EXIT_SOFTWARE); } } ================================================ FILE: aegir/patches/restaurant_demo.patch ================================================ diff -urp a/texts.csv b/texts.csv --- a/texts.csv 2014-08-25 11:19:44.000000000 +0000 +++ b/texts.csv 2014-08-25 12:22:37.000000000 +0000 @@ -1,3 +1,3 @@ "Title","Text","Overrides" -"About Restaurant","

    The Restaurant distribution is powered by Drupal and Panopoly.

    Download Restaurant

    Learn more · Try on Pantheon

    ","site_template_panel_context__new-7" -"How to book a table","

    Step 1

    Fill in the reservation form with your contact information, the date of your reservation and the number of persons.

    Step 2

    Wait for our email that confirms that your reservation has been received.

    Step 3

    We will email you or call you back when your reservation has been confirmed.

    ","reservation__page_reservation_panel_context_2__new-2" \ No newline at end of file +"About Restaurant","

    The Restaurant distribution is powered by Drupal and Panopoly.

    Download Restaurant

    Learn more · Try on Aegir

    ","site_template_panel_context__new-7" +"How to book a table","

    Step 1

    Fill in the reservation form with your contact information, the date of your reservation and the number of persons.

    Step 2

    Wait for our email that confirms that your reservation has been received.

    Step 3

    We will email you or call you back when your reservation has been confirmed.

    ","reservation__page_reservation_panel_context_2__new-2" ================================================ FILE: aegir/patches/singular.mft.patch ================================================ diff -urp singular/style.css singular/style.css --- singular/style.css 2011-03-10 20:28:50.000000000 +0100 +++ singular/style.css 2011-03-10 20:28:44.000000000 +0100 @@ -22,13 +22,13 @@ a { -moz-border-radius-bottomright:5px; -webkit-border-top-right-radius:5px; -webkit-border-bottom-right-radius:5px; + border-top-right-radius:5px; + border-bottom-right-radius:5px; font-size:13px; line-height:20px; - background:url(images/mask.png); color:#fff; - margin:100px 0px 0px; float:right; width:220px; @@ -36,9 +36,9 @@ a { #main { -moz-border-radius:10px; - -moz-border-radius:10px; - -webkit-border-radius:10px; -webkit-border-radius:10px; + border-radius:10px; + background:url(images/mask.png); width:740px; } @@ -102,6 +102,8 @@ body.fluid #sidebar { width:20%; } #branding div.primary ul.links a { -moz-border-radius:10px; -webkit-border-radius:10px; + border-radius:10px; + background:url(images/mask.png); padding:0px 15px; } @@ -123,6 +125,8 @@ body.fluid #sidebar { width:20%; } -moz-border-radius-topright:5px; -webkit-border-top-left-radius:5px; -webkit-border-top-right-radius:5px; + border-top-left-radius:5px; + border-top-right-radius:5px; color:#ccc; background:url(images/mask.png); @@ -195,6 +199,8 @@ div.left div.admin-panel { margin-right: -moz-border-radius-bottomright:5px; -webkit-border-bottom-left-radius:5px; -webkit-border-bottom-right-radius:5px; + border-bottom-right-radius: 5px; + border-bottom-left-radius: 5px; } #page #content div.block { @@ -212,6 +218,8 @@ div.left div.admin-panel { margin-right: #page #content div.block-content { -moz-border-radius:10px; -webkit-border-radius:10px; + border-radius:10px; + background:#fff; padding:10px; } @@ -262,6 +270,7 @@ div.left div.admin-panel { margin-right: #growl div.messages { -moz-border-radius:5px; -webkit-border-radius:5px; + border-radius:5px; margin:5px 0px; background:#eff; @@ -320,6 +329,8 @@ dl dd { -moz-border-radius-bottomleft:5px; -webkit-border-top-left-radius:5px; -webkit-border-bottom-left-radius:5px; + border-top-left-radius: 5px; + border-bottom-left-radius: 5px; } #sidebar div.block h2.block-title { @@ -390,6 +401,8 @@ div.node-links ul.links { margin:20px 0px 0px; -moz-border-radius:5px; -webkit-border-radius:5px; + border-radius:5px; + background:#fff; float:right; } ================================================ FILE: aegir/patches/singular.patch ================================================ diff -urp singular/style.css singular/style.css --- singular/style.css 2009-08-12 21:41:25.000000000 +0200 +++ singular/style.css 2009-08-18 14:51:26.000000000 +0200 @@ -20,6 +20,8 @@ a { #sidebar { -moz-border-radius-topright:5px; -moz-border-radius-bottomright:5px; + -webkit-border-top-right-radius:5px; + -webkit-border-bottom-right-radius:5px; font-size:13px; line-height:20px; @@ -35,6 +37,8 @@ a { #main { -moz-border-radius:10px; -moz-border-radius:10px; + -webkit-border-radius:10px; + -webkit-border-radius:10px; background:url(images/mask.png); width:740px; } @@ -187,9 +191,10 @@ div.left div.admin-panel { margin-right: background:#f8f8f8; border-top:1px solid #ddd; padding:19px 20px 20px; - -moz-border-radius-bottomleft:5px; -moz-border-radius-bottomright:5px; + -webkit-border-bottom-left-radius:5px; + -webkit-border-bottom-right-radius:5px; } #page #content div.block { @@ -206,6 +211,7 @@ div.left div.admin-panel { margin-right: #page #content div.block-content { -moz-border-radius:10px; + -webkit-border-radius:10px; background:#fff; padding:10px; } @@ -383,6 +389,7 @@ div.node-submitted { margin:0px 0px 20px div.node-links ul.links { margin:20px 0px 0px; -moz-border-radius:5px; + -webkit-border-radius:5px; background:#fff; float:right; } ================================================ FILE: aegir/patches/skwashd.commons.patch ================================================ diff -aburN --exclude='CVS*' drupal_commons.orig/profiles/drupal_commons/drupal_commons.profile drupal_commons/profiles/drupal_commons/drupal_commons.profile --- drupal_commons.orig/profiles/drupal_commons/drupal_commons.profile 2010-08-17 08:36:12.000000000 +1000 +++ drupal_commons/profiles/drupal_commons/drupal_commons.profile 2010-10-11 12:46:40.428489204 +1100 @@ -177,6 +177,7 @@ * modify the $task, otherwise discarded. */ function drupal_commons_profile_tasks(&$task, $url) { + drupal_commons_config_vars(); drupal_commons_build_directories(); drupal_commons_config_taxonomy(); drupal_commons_config_profile(); @@ -193,7 +194,6 @@ drupal_commons_config_views(); drupal_commons_config_theme(); drupal_commons_config_images(); - drupal_commons_config_vars(); drupal_commons_cleanup(); } ================================================ FILE: aegir/patches/taxonomy-6.20.patch ================================================ From a88b4ae0ec60221b93cd5ed14ac67b1ff5719ddb Mon Sep 17 00:00:00 2001 From: Thomas Skovgaard Gielfeldt Date: Sun, 22 May 2011 10:34:56 +0200 Subject: [PATCH] Use Taxonomy Edge functionality. --- modules/taxonomy/taxonomy.module | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) mode change 100644 => 100755 modules/taxonomy/taxonomy.module diff --git a/modules/taxonomy/taxonomy.module b/modules/taxonomy/taxonomy.module index 0141120..26a6845 --- a/modules/taxonomy/taxonomy.module +++ b/modules/taxonomy/taxonomy.module @@ -835,6 +835,9 @@ function taxonomy_get_children($tid, $vid = 0, $key = 'tid') { * Results are statically cached. */ function taxonomy_get_tree($vid, $parent = 0, $depth = -1, $max_depth = NULL) { + if (function_exists('taxonomy_edge_taxonomy_get_tree')) { + return taxonomy_edge_taxonomy_get_tree($vid, $parent, $depth, $max_depth); + } static $children, $parents, $terms; $depth++; @@ -1130,6 +1133,9 @@ function theme_taxonomy_term_select($element) { * A resource identifier pointing to the query results. */ function taxonomy_select_nodes($tids = array(), $operator = 'or', $depth = 0, $pager = TRUE, $order = 'n.sticky DESC, n.created DESC') { + if (function_exists('taxonomy_edge_taxonomy_select_nodes')) { + return taxonomy_edge_taxonomy_select_nodes($tids, $operator, $depth, $pager, $order); + } if (count($tids) > 0) { // For each term ID, generate an array of descendant term IDs to the right depth. $descendant_tids = array(); -- 1.7.4 ================================================ FILE: aegir/patches/taxonomy-6.26.patch ================================================ --- modules/taxonomy/taxonomy.module.orig 2012-02-29 17:44:11.000000000 +0100 +++ modules/taxonomy/taxonomy.module 2012-03-14 18:46:54.000000000 +0100 @@ -846,6 +846,9 @@ * Results are statically cached. */ function taxonomy_get_tree($vid, $parent = 0, $depth = -1, $max_depth = NULL) { + if (function_exists('taxonomy_edge_get_tree')) { + return taxonomy_edge_get_tree($vid, $parent, $depth, $max_depth); + } static $children, $parents, $terms; // We cache trees, so it's not CPU-intensive to call get_tree() on a term @@ -1181,6 +1184,9 @@ * A resource identifier pointing to the query results. */ function taxonomy_select_nodes($tids = array(), $operator = 'or', $depth = 0, $pager = TRUE, $order = 'n.sticky DESC, n.created DESC') { + if (function_exists('taxonomy_edge_select_nodes')) { + return taxonomy_edge_select_nodes($tids, $operator, $depth, $pager, $order); + } if (count($tids) > 0) { // For each term ID, generate an array of descendant term IDs to the right depth. $descendant_tids = array(); ================================================ FILE: aegir/patches/taxonomy-7.12.patch ================================================ --- modules/taxonomy/taxonomy.module.orig 2012-02-01 23:03:14.000000000 +0100 +++ modules/taxonomy/taxonomy.module 2012-03-18 19:24:09.000000000 +0100 @@ -968,6 +968,9 @@ * depending on the $load_entities parameter. */ function taxonomy_get_tree($vid, $parent = 0, $max_depth = NULL, $load_entities = FALSE) { + if (module_exists('taxonomy_edge') && function_exists('taxonomy_edge_get_tree')) { + return taxonomy_edge_get_tree($vid, $parent, $max_depth, $load_entities); + } $children = &drupal_static(__FUNCTION__, array()); $parents = &drupal_static(__FUNCTION__ . ':parents', array()); $terms = &drupal_static(__FUNCTION__ . ':terms', array()); ================================================ FILE: aegir/patches/taxonomy-7.7.patch ================================================ From f2b5994fe2c2236fb763bdc811437e0fb595c7c5 Mon Sep 17 00:00:00 2001 From: Thomas Skovgaard Gielfeldt Date: Sun, 21 Aug 2011 07:45:59 +0200 Subject: [PATCH] Patch for Taxonomy Edge. --- modules/taxonomy/taxonomy.module | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/modules/taxonomy/taxonomy.module b/modules/taxonomy/taxonomy.module index dc2847d..e3337de 100644 --- a/modules/taxonomy/taxonomy.module +++ b/modules/taxonomy/taxonomy.module @@ -925,6 +925,9 @@ function taxonomy_get_children($tid, $vid = 0) { * depending on the $load_entities parameter. */ function taxonomy_get_tree($vid, $parent = 0, $max_depth = NULL, $load_entities = FALSE) { + if (function_exists('taxonomy_edge_get_tree')) { + return taxonomy_edge_get_tree($vid, $parent, $max_depth, $load_entities); + } $children = &drupal_static(__FUNCTION__, array()); $parents = &drupal_static(__FUNCTION__ . ':parents', array()); $terms = &drupal_static(__FUNCTION__ . ':terms', array()); -- 1.7.5.1 ================================================ FILE: aegir/patches/ubercart-1167276-reroll.patch ================================================ diff --git a/uc_cart/uc_cart.module b/uc_cart/uc_cart.module index a3cc27f..dd6722f 100644 --- a/uc_cart/uc_cart.module +++ b/uc_cart/uc_cart.module @@ -374,12 +374,19 @@ function uc_cart_block($op = 'list', $delta = 0, $edit = array()) { case 'view': // 0 = Default shopping cart block. if ($delta == 0) { - $cachable = !$user->uid && variable_get('cache', CACHE_DISABLED) != CACHE_DISABLED; + $cachable = TRUE; + if (function_exists('drupal_page_is_cacheable')) { + $cachable = drupal_page_is_cacheable(); + } + else { + $cachable = !$user->uid && variable_get('cache', CACHE_DISABLED) != CACHE_DISABLED; + } + $product_count = count(uc_cart_get_contents()); // Display nothing if the block is set to hide on empty and there are no // items in the cart. - if (!$cachable && variable_get('uc_cart_block_empty_hide', FALSE) && !$product_count) { + if (variable_get('uc_cart_block_empty_hide', FALSE) && !$product_count) { return; } ================================================ FILE: aegir/patches/user.drush.inc.patch ================================================ --- /dev/null 2010-06-09 13:49:44.501193278 -0500 +++ commands/user/user.drush.inc 2010-06-24 14:18:14.000000000 -0500 @@ -0,0 +1,548 @@ + 'drush_user_information', + 'description' => 'Print information about the specified user(s).', + 'aliases' => array('uinf'), + 'examples' => array( + 'drush user-information 2,3,someguy,somegal,billgates@microsoft.com' => + 'Display information about any users with uids, names, or mail addresses matching the strings between commas.', + ), + 'arguments' => array( + 'users' => 'A comma delimited list of uids, user names, or email addresses.', + ), + 'options' => array( + '--full' => 'show extended information about the user', + '--short' => 'show basic information about the user (this is the default)', + ), + ); + $items['user-block'] = array( + 'callback' => 'drush_user_block', + 'description' => 'Block the specified user(s).', + 'aliases' => array('ublk'), + 'arguments' => array( + 'users' => 'A comma delimited list of uids, user names, or email addresses.', + ), + 'examples' => array( + 'drush user-block 5,user3 --uid=2,3 --name=someguy,somegal --mail=billgates@microsoft.com' => + 'Block the users with name, id, or email 5 or user3, uids 2 and 3, names someguy and somegal, and email address of billgates@microsoft.com', + ), + 'options' => array( + '--uid' => 'A comma delimited list of uids to block', + '--name' => 'A comma delimited list of user names to block', + '--mail' => 'A comma delimited list of user mail addresses to block', + ), + ); + $items['user-unblock'] = array( + 'callback' => 'drush_user_unblock', + 'description' => 'Unblock the specified user(s).', + 'aliases' => array('uublk'), + 'arguments' => array( + 'users' => 'A comma delimited list of uids, user names, or email addresses.', + ), + 'examples' => array( + 'drush user-unblock 5,user3 --uid=2,3 --name=someguy,somegal --mail=billgates@microsoft.com' => + 'Unblock the users with name, id, or email 5 or user3, uids 2 and 3, names someguy and somegal, and email address of billgates@microsoft.com', + ), + 'options' => array( + '--uid' => 'A comma delimited list of uids to unblock', + '--name' => 'A comma delimited list of user names to unblock', + '--mail' => 'A comma delimited list of user mail addresses to unblock', + ), + ); + $items['user-add-role'] = array( + 'callback' => 'drush_user_add_role', + 'description' => 'Add a role to the specified user accounts.', + 'aliases' => array('urol'), + 'arguments' => array( + 'role' => 'The name of the role to add', + 'users' => '(optional) A comma delimited list of uids, user names, or email addresses.', + ), + 'examples' => array( + 'drush user-add-role "power user" 5,user3 --uid=2,3 --name=someguy,somegal --mail=billgates@microsoft.com' => + 'Add the "power user" role to the accounts with name, id, or email 5 or user3, uids 2 and 3, names someguy and somegal, and email address of billgates@microsoft.com', + ), + 'options' => array( + '--uid' => 'A comma delimited list of uids', + '--name' => 'A comma delimited list of user names', + '--mail' => 'A comma delimited list of user mail addresses', + ), + ); + $items['user-remove-role'] = array( + 'callback' => 'drush_user_remove_role', + 'description' => 'Remove a role from the specified user accounts.', + 'aliases' => array('urrol'), + 'arguments' => array( + 'role' => 'The name of the role to remove', + 'users' => '(optional) A comma delimited list of uids, user names, or email addresses.', + ), + 'examples' => array( + 'drush user-remove-role "power user" 5,user3 --uid=2,3 --name=someguy,somegal --mail=billgates@microsoft.com' => + 'Remove the "power user" role from the accounts with name, id, or email 5 or user3, uids 2 and 3, names someguy and somegal, and email address of billgates@microsoft.com', + ), + 'options' => array( + '--uid' => 'A comma delimited list of uids', + '--name' => 'A comma delimited list of user names', + '--mail' => 'A comma delimited list of user mail addresses', + ), + ); + $items['user-create'] = array( + 'callback' => 'drush_user_create', + 'description' => 'Create a user account with the specified name.', + 'aliases' => array('ucrt'), + 'arguments' => array( + 'name' => 'The name of the account to add' + ), + 'examples' => array( + 'drush user-create newuser --mail="person@example.com" --password="letmein"' => + 'Create a new user account with the name newuser, the email address person@example.com, and the password letmein', + ), + 'options' => array( + '--password' => 'The password for the new account', + '--mail' => 'The email address for the new account', + ), + ); + $items['user-cancel'] = array( + 'callback' => 'drush_user_cancel', + 'description' => 'Cancel a user account with the specified name.', + 'aliases' => array('ucan'), + 'arguments' => array( + 'name' => 'The name of the account to cancel', + ), + 'examples' => array( + 'drush user-cancel username' => + 'Cancel the user account with the name username and anonymize all content created by that user.', + ), + ); + $items['user-password'] = array( + 'callback' => 'drush_user_password', + 'description' => '(Re)Set the password for the user account with the specified name.', + 'aliases' => array('upwd'), + 'arguments' => array( + 'name' => 'The name of the account to modify' + ), + 'options' => array( + '--password' => '(required) The new password for the account', + ), + 'examples' => array( + 'drush user-password someuser --password="gr3@tP@$s"' => + 'Set the password for the username someuser to gr3@tP@$s.', + ), + ); + + // Drupal 7 only options. + if (drush_drupal_major_version() >= 7) { + $items['user-cancel']['options'] = array( + 'delete-content' => 'Delete all content created by the user', + ); + $items['user-cancel']['examples']['drush user-cancel --delete-content=true username'] = + 'Cancel the user account with the name username and delete all content created by that user.'; + } + return $items; +} + +// Implementation of hook_drush_init(). +function user_drush_init() { + $command_info = drush_get_command(); + $command = $command_info['command']; + $needs_parse_args = array('user-block', 'user-unblock', 'user-add-role', 'user-remove-role'); + if (in_array($command, $needs_parse_args)) { + // parse args and call drush_set_option for --uids + $users = array(); + foreach (array('uid', 'name', 'mail' ) as $user_attr) { + if ($arg = drush_get_option($user_attr)) { + foreach(explode(',', $arg) as $search) { + $uid_query = FALSE; + switch ($user_attr) { + case 'uid': + if (drush_drupal_major_version() >= 7) { + $uid_query = db_query("SELECT uid FROM {users} WHERE uid = :uid", array(':uid' => $search)); + } + else { + $uid_query = db_query("SELECT uid FROM {users} WHERE uid = %d", $search); + } + break; + case 'name': + if (drush_drupal_major_version() >= 7) { + $uid_query = db_query("SELECT uid FROM {users} WHERE name = :name", array(':name' => $search)); + } + else { + $uid_query = db_query("SELECT uid FROM {users} WHERE name = '%s'", $search); + } + break; + case 'mail': + if (drush_drupal_major_version() >= 7) { + $uid_query = db_query("SELECT uid FROM {users} WHERE mail = :mail", array(':mail' => $search)); + } + else { + $uid_query = db_query("SELECT uid FROM {users} WHERE mail = '%s'", $search); + } + break; + } + if ($uid_query !== FALSE) { + if ($uid = drush_db_result($uid_query)) { + $users[] = $uid; + } + else { + drush_set_error("Could not find a uid for $user_attr = $search"); + } + } + } + } + } + if (!empty($users)) { + drush_set_option('uids', $users); + } + } +} + +/** + * Prints information about the specified user(s). + */ +function drush_user_information($users) { + $users = explode(',', $users); + foreach($users as $user) { + $uid = _drush_user_get_uid($user); + if ($uid !== FALSE) { + _drush_user_print_info($uid); + } + } +} + +/** + * Block the specified user(s). + */ +function drush_user_block($users = '') { + $uids = drush_get_option('uids'); + if ($users !== '') { + $users = explode(',', $users); + foreach($users as $user) { + $uid = _drush_user_get_uid($user); + if ($uid !== FALSE) { + $uids[] = $uid; + } + } + } + if (!empty($uids)) { + user_user_operations_block($uids); + } + else { + return drush_set_error("Could not find any valid uids!"); + } +} + +/** + * Unblock the specified user(s). + */ +function drush_user_unblock($users = '') { + $uids = drush_get_option('uids'); + if ($users !== '') { + $users = explode(',', $users); + foreach($users as $user) { + $uid = _drush_user_get_uid($user); + if ($uid !== FALSE) { + $uids[] = $uid; + } + } + } + if (!empty($uids)) { + user_user_operations_unblock($uids); + } + else { + return drush_set_error("Could not find any valid uids!"); + } +} + +/** + * Add a role to the specified user accounts. + */ +function drush_user_add_role($role, $users = '') { + $uids = drush_get_option('uids'); + if ($users !== '') { + $users = explode(',', $users); + foreach($users as $user) { + $uid = _drush_user_get_uid($user); + if ($uid !== FALSE) { + $uids[] = $uid; + } + } + } + if (drush_drupal_major_version() >= 7) { + $rid_query = db_query("SELECT rid FROM {role} WHERE name = :role", array(':role' => $role)); + } + else { + $rid_query = db_query("SELECT rid FROM {role} WHERE name = '%s'", $role); + } + if (!empty($uids)) { + if ($rid = drush_db_result($rid_query)) { + user_multiple_role_edit($uids, 'add_role', $rid); + foreach($uids as $uid) { + drush_log(dt("Added the %role role to uid %uid", array('%role' => $role, '%uid' => $uid)), 'success'); + } + } + else { + return drush_set_error("There is no role named: \"$role\"!"); + } + } + else { + return drush_set_error("Could not find any valid uids!"); + } +} + +/** + * Remove a role from the specified user accounts. + */ +function drush_user_remove_role($role, $users = '') { + $uids = drush_get_option('uids'); + if ($users !== '') { + $users = explode(',', $users); + foreach($users as $user) { + $uid = _drush_user_get_uid($user); + if ($uid !== FALSE) { + $uids[] = $uid; + } + } + } + if (drush_drupal_major_version() >= 7) { + $rid_query = db_query("SELECT rid FROM {role} WHERE name = :role", array(':role' => $role)); + } + else { + $rid_query = db_query("SELECT rid FROM {role} WHERE name = '%s'", $role); + } + if (!empty($uids)) { + if ($rid = drush_db_result($rid_query)) { + user_multiple_role_edit($uids, 'remove_role', $rid); + foreach($uids as $uid) { + drush_log(dt("Removed the %role role from uid %uid", array('%role' => $role, '%uid' => $uid)), 'success'); + } + } + else { + return drush_set_error("There is no role named: \"$role\"!"); + } + } + else { + return drush_set_error("Could not find any valid uids!"); + } +} + +/** + * Creates a new user account. + */ +function drush_user_create($name) { + $mail = drush_get_option('mail'); + $pass = drush_get_option('password'); + $new_user = array( + 'name' => $name, + 'pass' => $pass, + 'mail' => $mail, + 'access' => '0', + 'status' => 1, + ); + if (drush_drupal_major_version() >= 7) { + $result = db_query("SELECT uid FROM {users} WHERE name = :name OR mail = :mail", array(':name' => $name, ':mail' => $new_user['mail'])); + } + else { + $result = db_query("SELECT uid FROM {users} WHERE name = '%s' OR mail = '%s'", $name, $new_user['mail']); + } + if (drush_db_result($result) === FALSE) { + $new_user_object = user_save(NULL, $new_user, NULL); + if ($new_user_object !== FALSE) { + _drush_user_print_info($new_user_object->uid); + } + else { + drush_set_error("Could not create a new user account with the name " . $name . "!"); + } + } + else { + drush_set_error("There is already a user account with the name " . $name . " or email address " . $new_user['mail'] . "!"); + } +} + +/** + * Cancels a user account. + */ +function drush_user_cancel($name) { + if (drush_drupal_major_version() >= 7) { + $result = db_query("SELECT uid FROM {users} WHERE name = :name", array(':name' => $name)); + } + else { + $result = db_query("SELECT uid FROM {users} WHERE name = '%s'", $name); + } + $uid = drush_db_result($result); + if ($uid !== FALSE) { + drush_print("Cancelling the user account with the following information:"); + _drush_user_print_info($uid); + if (drush_get_option('delete-content') && drush_drupal_major_version() >= 7) { + drush_print("All content created by this user will be deleted!"); + } + if (drush_confirm('Cancel user account?: ')) { + if (drush_drupal_major_version() >= 7) { + if (drush_get_option('delete-content')) { + user_cancel(array(), $uid, 'user_cancel_delete'); + } + else { + user_cancel(array(), $uid, 'user_cancel_reassign'); + } + // I got the following technique here: https://drupal.org/node/638712 + $batch =& batch_get(); + $batch['progressive'] = FALSE; + batch_process(); + } + else { + user_delete(array(), $uid); + } + } + } + else { + drush_set_error("Could not find a user account with the name " . $name . "!"); + } +} + +/** + * Sets the password for the account with the given username + */ +function drush_user_password($name) { + $pass = drush_get_option('password'); + if (empty($pass)) { + return drush_set_error("You must specify a password!"); + } + if (drush_drupal_major_version() >= 7) { + $result = db_query("SELECT uid, name FROM {users} WHERE name = :name", array(':name' => $name)); + $userinfo = drush_db_fetch_object($result); + if ($userinfo->name != $name) return drush_set_error("Could not find a user with the name '" . $name . "'!"); + $user = user_load(drush_db_result($result)); + } + else { + $user = user_load(array('name' => $name)); + } + if ($user !== FALSE) { + $user_object = user_save($user, array('pass' => $pass)); + if ($user_object === FALSE) { + drush_set_error("Could not change the password for the user account with the name " . $name . "!"); + } + } + else { + drush_set_error("The user account with the name " . $name . " could not be loaded!"); + } +} + +/** + * Print information about a given uid + */ +function _drush_user_print_info($uid) { + if (drush_drupal_major_version() >= 7) { + $userinfo = user_load($uid); + } + else { + $userinfo = user_load(array('uid' => $uid)); + } + if (drush_get_option('full')) { + $userinfo = (array)$userinfo; + $userinfo_pipe = array(); + unset($userinfo['data']); + unset($userinfo['block']); + unset($userinfo['form_build_id']); + foreach($userinfo as $key => $val) { + if (is_array($val)) { + drush_print($key . ': '); + drush_print_r($val); + $userinfo_pipe[] = '"' . implode(",", $val) . '"'; + } + else { + if ($key === 'created' OR $key === 'access' OR $key === 'login') { + drush_print($key . ': ' . format_date($val)); + $userinfo_pipe[] = $val; + } + else { + drush_print($key . ': ' . $val); + $userinfo_pipe[] = $val; + } + } + } + drush_print_pipe(implode(",", $userinfo_pipe)); + drush_print_pipe("\n"); + } + else { + $userinfo_short = array( + 'User ID' => $userinfo->uid, + 'User name' => $userinfo->name, + 'User mail' => $userinfo->mail, + ); + $userinfo_short['User roles'] = implode(', ', $userinfo->roles); + $userinfo->status ? $userinfo_short['User status'] = 'active' : $userinfo_short['User status'] = 'blocked'; + drush_print_table(drush_key_value_to_array_table($userinfo_short)); + drush_print_pipe("$userinfo->name, $userinfo->uid, $userinfo->mail, $userinfo->status, \"" . implode(', ', $userinfo->roles) . "\"\n"); + } +} + +/** + * Get uid(s) from a uid, user name, or email address. + * Returns a uid, or FALSE if none found. + */ +function _drush_user_get_uid($search) { + // We use a DB query while looking for the uid to keep things speedy. + $uids = array(); + if (is_numeric($search)) { + if (drush_drupal_major_version() >= 7) { + $uid_query = db_query("SELECT uid, name FROM {users} WHERE uid = :uid OR name = :name", array(':uid' => $search, ':name' => $search)); + } + else { + $uid_query = db_query("SELECT uid, name FROM {users} WHERE uid = %d OR name = '%d'", $search, $search); + } + } + else { + if (drush_drupal_major_version() >= 7) { + $uid_query = db_query("SELECT uid, name FROM {users} WHERE mail = :mail OR name = :name", array(':mail' => $search, ':name' => $search)); + } + else { + $uid_query = db_query("SELECT uid, name FROM {users} WHERE mail = '%s' OR name = '%s'", $search, $search); + } + } + while ($uid = drush_db_fetch_object($uid_query)) { + $uids[$uid->uid] = $uid->name; + } + switch (count($uids)) { + case 0: + return drush_set_error("Could not find a uid for the search term '" . $search . "'!"); + break; + case 1: + return array_pop(array_keys($uids)); + break; + default: + drush_print('More than one user account was found for the search string "' . $search . '".'); + return(drush_choice($uids, 'Please choose a name:', '!value (uid=!key)')); + } +} ================================================ FILE: aegir/patches/videola.patch ================================================ diff -urp a/videola.info b/videola.info --- a/videola.info 2011-06-15 10:17:14.000000000 +0000 +++ b/videola.info 2011-07-01 13:15:48.000000000 +0000 @@ -119,7 +119,7 @@ dependencies[] = jquery_ui dependencies[] = jquery_update dependencies[] = vertical_tabs dependencies[] = better_formats -dependencies[] = bueditor +;dependencies[] = bueditor ; Other @@ -132,7 +132,7 @@ dependencies[] = commentmail dependencies[] = context dependencies[] = context_ui dependencies[] = date -dependencies[] = devel +;dependencies[] = devel dependencies[] = diff dependencies[] = features dependencies[] = flag @@ -154,6 +154,11 @@ dependencies[] = strongarm dependencies[] = term_node_count dependencies[] = token +; o_contrib +dependencies[] = cache +dependencies[] = path_alias_cache +dependencies[] = filefield_nginx_progress + ; Videola dependencies[] = videola_core dependencies[] = videola_video @@ -197,6 +202,8 @@ users[superduper][status] = 1 variables[site_name] = Videola variables[site_mail] = testing@testing.com variables[site_frontpage] = videola-front +variables[admin_theme] = rubik +variables[node_admin_theme] = 1 variables[pathauto_node_pattern] = 0 variables[pathauto_node_videola_video_pattern] = videos/[title-raw] diff -urp a/videola.profile b/videola.profile --- a/videola.profile 2011-06-15 10:17:14.000000000 +0000 +++ b/videola.profile 2011-07-01 12:47:56.000000000 +0000 @@ -67,7 +67,12 @@ function videola_profile_tasks(&$task, $ profiler_profile_tasks(profiler_v2_load_config('videola'), $task, $url); // Profiler stets the $task to 'profile-finished', in order to add our own // tasks we need to override that and set it to our task. - $task = 'videola'; + if (defined('DRUSH_BASE_PATH')) { + $task = 'profile-finished'; // Required to support Aegir. + } + else { + $task = 'videola'; + } } if ($task == 'videola') { ================================================ FILE: aegir/patches/views-853864_2.patch ================================================ Index: includes/cache.inc =================================================================== RCS file: /cvs/drupal-contrib/contributions/modules/views/includes/cache.inc,v retrieving revision 1.25.2.4 diff -u -p -r1.25.2.4 cache.inc --- includes/cache.inc 12 Mar 2010 01:51:47 -0000 1.25.2.4 +++ includes/cache.inc 4 Jan 2011 12:16:36 -0000 @@ -100,20 +100,64 @@ function _views_discover_default_views() static $cache = NULL; if (!isset($cache)) { + $lock_name = __FUNCTION__; $index = views_cache_get('views_default_views_index', TRUE); + $rebuild_cache = TRUE; // Retrieve each cached default view if (isset($index->data) && is_array($index->data)) { + $rebuild_cache = FALSE; $cache = array(); foreach ($index->data as $view_name) { - $data = views_cache_get('views_default:' . $view_name, TRUE); - if (isset($data->data) && is_object($data->data)) { - $cache[$view_name] = $data->data; + $cid = 'views_default:' . $view_name; + if ($cached = views_cache_get($cid, TRUE)) { + $cache[$view_name] = $cached->data; + } + else { + // As soon as there is a cache miss on one item, try to acquire a + // lock. + if (!$lock_acquired = lock_acquire($lock_name)) { + lock_wait($lock_name); + // After waiting, try to fetch the default view from cache again. + // If available another process may have rebuilt it, so do not + // attempt to rebuild the cache. + if ($cached = views_cache_get($cid, TRUE)) { + $cache[$view_name] = $cached->data; + } + // If the item is still not in the cache, try to acquire the lock + // again and rebuild the cache. + else { + $lock_acquired = lock_acquire($lock_name); + $rebuild_cache = TRUE; + break; + } + } + // If the lock was acquired, always rebuild the cache. + else { + $rebuild_cache = TRUE; + break; + } } } } - // If missing index, rebuild the cache else { + if (!$lock_acquired = lock_acquire($lock_name)) { + lock_wait($lock_name); + if ($cached = views_cache_get('views_default_views_index', TRUE)) { + // Another process has rebuilt the cache while we waited. Re-run the + // function to avoid a full cache rebuild. + $cache = _views_discover_default_views(); + $rebuild_cache = FALSE; + } + else { + // Try to re-acquire the lock and re-build the cache either way. + lock_acquire($lock_name); + $rebuild_cache = TRUE; + } + } + } + // Rebuild the cache if necessary. + if ($rebuild_cache) { views_include_default_views(); $cache = array(); @@ -139,13 +183,16 @@ function _views_discover_default_views() // Allow modules to modify default views before they are cached. drupal_alter('views_default_views', $cache); - // Cache the index - $index = array_keys($cache); - views_cache_set('views_default_views_index', $index, TRUE); - - // Cache each view - foreach ($cache as $name => $view) { - views_cache_set('views_default:' . $name, $view, TRUE); + if (!empty($lock_acquired)) { + // Cache the index + $index = array_keys($cache); + views_cache_set('views_default_views_index', $index, TRUE); + + // Cache each view + foreach ($cache as $name => $view) { + views_cache_set('views_default:' . $name, $view, TRUE); + } + lock_release($lock_name); } } } ================================================ FILE: aegir/patches/views-exposed-sorts-2037469-1.patch ================================================ diff --git a/plugins/views_plugin_exposed_form.inc b/plugins/views_plugin_exposed_form.inc index 5d54600..1d19ed1 100644 --- a/plugins/views_plugin_exposed_form.inc +++ b/plugins/views_plugin_exposed_form.inc @@ -220,17 +220,24 @@ class views_plugin_exposed_form extends views_plugin { } if (count($exposed_sorts)) { + if (isset($form_state['input']['sort_by']) && isset($this->view->sort[$form_state['input']['sort_by']])) { + $default_sort_order = $form_state['input']['sort_by']; + } else { + $first_sort = reset($this->view->sort); + $default_sort_order = $first_sort->options['order']; + } $form['sort_by'] = array( '#type' => 'select', '#options' => $exposed_sorts, '#title' => $this->options['exposed_sorts_label'], + '#default_value' => $default_sort_order, ); $sort_order = array( 'ASC' => $this->options['sort_asc_label'], 'DESC' => $this->options['sort_desc_label'], ); if (isset($form_state['input']['sort_by']) && isset($this->view->sort[$form_state['input']['sort_by']])) { - $default_sort_order = $this->view->sort[$form_state['input']['sort_by']]->options['order']; + $default_sort_order = $form_state['input']['sort_order']; } else { $first_sort = reset($this->view->sort); $default_sort_order = $first_sort->options['order']; ================================================ FILE: aegir/patches/views-revert-broken-filter-or-groups-1766338-7.patch ================================================ diff --git a/modules/field/views_handler_filter_field_list.inc b/modules/field/views_handler_filter_field_list.inc index 440d55b..b955e70 100644 --- a/modules/field/views_handler_filter_field_list.inc +++ b/modules/field/views_handler_filter_field_list.inc @@ -10,21 +10,7 @@ * * @ingroup views_filter_handlers */ -class views_handler_filter_field_list extends views_handler_filter_many_to_one { - - function init(&$view, &$options) { - parent::init($view, $options); - // Migrate the settings from the old filter_in_operator values to filter_many_to_one. - if ($this->options['operator'] == 'in') { - $this->options['operator'] = 'or'; - } - if ($this->options['operator'] == 'not in') { - $this->options['operator'] = 'not'; - } - $this->operator = $this->options['operator']; - } - - +class views_handler_filter_field_list extends views_handler_filter_in_operator { function get_value_options() { $field = field_info_field($this->definition['field_name']); $this->value_options = list_allowed_values($field); ================================================ FILE: aegir/patches/views-unpack_options-cache-6.2-51.patch ================================================ diff --git a/plugins/views_plugin_display.inc b/plugins/views_plugin_display.inc index 3c47037..a66c3c0 100644 --- a/plugins/views_plugin_display.inc +++ b/plugins/views_plugin_display.inc @@ -39,7 +39,28 @@ class views_plugin_display extends views_plugin { unset($options['defaults']); } - $this->unpack_options($this->options, $options); + // Cache for unpack_options, but not if we are in the ui. + static $unpack_options = array(); + if (empty($view->editing)) { + $cid = 'unpack_options:' . md5(serialize(array($this->options, $options))); + if (empty($unpack_options[$cid])) { + $cache = views_cache_get($cid, TRUE); + if (!empty($cache->data)) { + $this->options = $cache->data; + } + else { + $this->unpack_options($this->options, $options); + views_cache_set($cid, $this->options, TRUE); + } + $unpack_options[$cid] = $this->options; + } + else { + $this->options = $unpack_options[$cid]; + } + } + else { + $this->unpack_options($this->options, $options); + } } function destroy() { ================================================ FILE: aegir/scripts/AegirSetupA.sh.txt ================================================ #!/bin/bash ###----------------------------------------### ### ### Octopus Ægir Installer ### ### Copyright (C) 2009-2026 Omega8.cc ### noc@omega8.cc www.omega8.cc ### ### This program is free software. You can ### redistribute it and/or modify it under ### the terms of the GNU GPL as published by ### the Free Software Foundation, version 2 ### or later. ### ### This program is distributed in the hope ### that it will be useful, but WITHOUT ANY ### WARRANTY; without even the implied ### warranty of MERCHANTABILITY or FITNESS ### FOR A PARTICULAR PURPOSE. See the GNU GPL ### for more details. ### ### You should have received a copy of the ### GNU GPL along with this program. ### If not, see http://www.gnu.org/licenses/ ### ### Code: https://github.com/omega8cc/boa ### ###----------------------------------------### ###----------------------------------------### ### DON'T EDIT ANYTHING BELOW THIS LINE ### ###----------------------------------------### ### ### Helper variables ### _bldPth="/opt/tmp/boa" _crlGet="-L --max-redirs 3 -k -s --retry 9 --retry-delay 9 -A iCab" _wgetGet="--max-redirect=3 --no-check-certificate -q --tries=9 --wait=9 --user-agent='iCab'" _filIncO="octopus.sh.cnf" _gCb="git clone --branch" _gitHub="https://github.com/omega8cc" _gitLab="https://gitlab.com/omega8cc" _libFnc="${_bldPth}/lib/functions" _tocIncO="${_filIncO}.$1" _vBs="/var/backups" _vSet="variable-set --always-set" export _tRee=dev ### ### Panic on missing include ### _panic_exit() { echo echo " EXIT: Required lib file not available?" echo " EXIT: $1" echo " EXIT: Cannot continue" echo " EXIT: Bye (0)" echo touch /opt/tmp/status-AegirSetupA-FAIL exit 1 } ### ### Include helper functions ### if [ -e "${_vBs}/${_tocIncO}" ]; then source "${_vBs}/${_tocIncO}" _tInc="${_vBs}/${_tocIncO}" elif [ -e "${_vBs}/${_filIncO}" ]; then source "${_vBs}/${_filIncO}" _tInc="${_vBs}/${_filIncO}" else _panic_exit "${_tInc}" fi ### ### Env debugging ### if [ "${_DEBUG_MODE}" = "YES" ]; then echo DEBUG AegirSetupA echo DEBUG AegirSetupA echo Effective _USER is $1 [ -r "${_vBs}/${_tocIncO}" ] && echo Effective _tocIncO is ${_tocIncO} echo DEBUG AegirSetupA echo DEBUG AegirSetupA env echo DEBUG AegirSetupA echo DEBUG AegirSetupA fi ### ### More helper variables ### export _urlDev="http://${_USE_MIR}/dev" export _urlHmr="http://${_USE_MIR}/versions/${_tRee}/boa/aegir" ### ### Include shared functions ### _FL="helper satellite" for f in ${_FL}; do [ -r "${_libFnc}/${f}.sh.inc" ] || _panic_exit "${f}" source "${_libFnc}/${f}.sh.inc" done ### ### Local variables ### if [ "${_THIS_DB_HOST}" = "FQDN" ]; then _THIS_DB_HOST="$(cat /etc/hostname 2>/dev/null | tr -d '\n' || hostname -f 2>/dev/null)" fi _DIST_INSTALL=NO _STATUS=INIT _LOCAL_STATUS="${_STATUS}" _ROOT="/data/disk/${_USER}" _HM_ROOT="${_ROOT}/aegir/distro/${_HM_DISTRO}" _DISTRO_ROOT="${_ROOT}/distro/${_DISTRO}" _D="/data/all" _SRCDIR="/opt/tmp/files" if [ "${_PHP_CLI_VERSION}" = "8.5" ] \ && [ -x "/opt/php85/bin/php" ]; then _T_CLI=/opt/php85/bin elif [ "${_PHP_CLI_VERSION}" = "8.4" ] \ && [ -x "/opt/php84/bin/php" ]; then _T_CLI=/opt/php84/bin elif [ "${_PHP_CLI_VERSION}" = "8.3" ] \ && [ -x "/opt/php83/bin/php" ]; then _T_CLI=/opt/php83/bin elif [ "${_PHP_CLI_VERSION}" = "8.2" ] \ && [ -x "/opt/php82/bin/php" ]; then _T_CLI=/opt/php82/bin elif [ "${_PHP_CLI_VERSION}" = "8.1" ] \ && [ -x "/opt/php81/bin/php" ]; then _T_CLI=/opt/php81/bin elif [ "${_PHP_CLI_VERSION}" = "8.0" ] \ && [ -x "/opt/php80/bin/php" ]; then _T_CLI=/opt/php80/bin elif [ "${_PHP_CLI_VERSION}" = "7.4" ] \ && [ -x "/opt/php74/bin/php" ]; then _T_CLI=/opt/php74/bin elif [ "${_PHP_CLI_VERSION}" = "7.3" ] \ && [ -x "/opt/php73/bin/php" ]; then _T_CLI=/opt/php73/bin elif [ "${_PHP_CLI_VERSION}" = "7.2" ] \ && [ -x "/opt/php72/bin/php" ]; then _T_CLI=/opt/php72/bin elif [ "${_PHP_CLI_VERSION}" = "7.1" ] \ && [ -x "/opt/php71/bin/php" ]; then _T_CLI=/opt/php71/bin elif [ "${_PHP_CLI_VERSION}" = "7.0" ] \ && [ -x "/opt/php70/bin/php" ]; then _T_CLI=/opt/php70/bin elif [ "${_PHP_CLI_VERSION}" = "5.6" ] \ && [ -x "/opt/php56/bin/php" ]; then _T_CLI=/opt/php56/bin fi _DRUSHCMD="${_T_CLI}/php ${_ROOT}/tools/drush/drush.php" PATH=${_T_CLI}:/usr/local/bin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin SHELL=/bin/bash ### ### Status check and update on the fly ### if [ -e "${_ROOT}/aegir.sh" ]; then _STATUS=UPGRADE cd ${_ROOT} rm -f ${_ROOT}/AegirSetupC.sh.txt* rm -f ${_ROOT}/AegirSetupB.sh.txt* _LOCAL_STATUS="${_STATUS}" fi ### ### User check ### if [ "$(id -u)" -eq 0 ]; then if [ "${_DEBUG_MODE}" = "YES" ]; then _msg "${_STATUS} A: Ægir automated install script part A" fi else _msg "${_STATUS} A: FATAL ERROR: This script should be run as a root user" _msg "${_STATUS} A: FATAL ERROR: Aborting AegirSetupA installer NOW!" touch /opt/tmp/status-AegirSetupA-FAIL exit 1 fi ### ### Run key pre/child/post procedures ### _satellite_hot_sauce_check _satellite_add_user_dirs _satellite_if_add_snail_access _satellite_prepare_child_scripts _satellite_run_pre_install if [ "${_OS_CODE}" = "excalibur" ]; then _DB_SERVER=Percona else _DB_SERVER=Percona fi if [ "$(boa info | grep -c ${_DB_SERVER})" -lt 3 ] || [ ! -e "/usr/sbin/csf" ]; then if [ ! -e "/opt/tmp/make_local/hostmaster/hostmaster.make" ] \ || [ ! -e "/opt/tmp/make_local/hosting/server/hosting_server.install" ] \ || [ ! -e "/opt/tmp/make_local/drupal/includes/database/mysql/schema.inc" ]; then _satellite_download_for_local_build fi else _satellite_download_for_local_build fi _satellite_run_child_b ### ### Run accelerated tasks queue ### if [ -e "/var/xdrago/run-${_USER}" ]; then _msg "${_STATUS} A: Ægir accelerated task queue will run for 60 seconds..." su -s /bin/bash - ${_USER} -c "drush8 @hostmaster ${_vSet} hosting_queue_tasks_items 3" &> /dev/null _msg "${_STATUS} A: Please wait..." for _iteration in {1..10}; do nohup /var/xdrago/run-${_USER} > /dev/null 2>&1 & sleep 5 done fi su -s /bin/bash - ${_USER} -c "drush8 @hostmaster ${_vSet} hosting_queue_tasks_items 1" &> /dev/null ### ### Run more pre/child/post procedures ### _satellite_if_create_local_bin _satellite_run_post_install _satellite_set_permissions_for_all _satellite_run_child_c _satellite_child_scripts_cleanup _satellite_if_add_ftps_lshell_access _satellite_if_add_update_user_symlinks _satellite_if_add_update_user_dot_dirs _satellite_if_read_create_pass_txt _satellite_if_add_update_user_platforms_symlinks _satellite_if_add_update_backend_user_dirs_files_clean [ ! -e "/root/.silent.update.cnf" ] && _satellite_prepare_setup_email_tpl [ ! -e "/root/.silent.update.cnf" ] && _satellite_send_welcome_email _satellite_letsencrypt_vhost_setup _satellite_log_update _satellite_batch_cleanup _satellite_display_url_finalize ###----------------------------------------### ### ### Octopus Ægir Installer ### Copyright (C) 2009-2026 Omega8.cc ### noc@omega8.cc www.omega8.cc ### ###----------------------------------------### ================================================ FILE: aegir/scripts/AegirSetupB.sh.txt ================================================ #!/bin/bash ###----------------------------------------### ### ### Octopus Ægir Installer ### ### Copyright (C) 2009-2026 Omega8.cc ### noc@omega8.cc www.omega8.cc ### ### This program is free software. You can ### redistribute it and/or modify it under ### the terms of the GNU GPL as published by ### the Free Software Foundation, version 2 ### or later. ### ### This program is distributed in the hope ### that it will be useful, but WITHOUT ANY ### WARRANTY; without even the implied ### warranty of MERCHANTABILITY or FITNESS ### FOR A PARTICULAR PURPOSE. See the GNU GPL ### for more details. ### ### You should have received a copy of the ### GNU GPL along with this program. ### If not, see http://www.gnu.org/licenses/ ### ### Code: https://github.com/omega8cc/boa ### ###----------------------------------------### ###----------------------------------------### ### DON'T EDIT ANYTHING BELOW THIS LINE ### ###----------------------------------------### ### ### Helper variables ### _bldPth="/opt/tmp/boa" _crlGet="-L --max-redirs 3 -k -s --retry 9 --retry-delay 9 -A iCab" _wgetGet="--max-redirect=3 --no-check-certificate -q --tries=9 --wait=9 --user-agent='iCab'" _filIncO="octopus.sh.cnf" _gCb="git clone --branch" _gitHub="https://github.com/omega8cc" _gitLab="https://gitlab.com/omega8cc" _libFnc="${_bldPth}/lib/functions" _tocIncO="${_filIncO}.$1" _vBs="/var/backups" _vSet="variable-set --always-set" export _tRee=dev ### ### Panic on missing include ### _panic_exit() { echo echo " EXIT: Required lib file not available?" echo " EXIT: $1" echo " EXIT: Cannot continue" echo " EXIT: Bye (0)" echo touch /opt/tmp/status-AegirSetupB-FAIL exit 1 } ### ### Include helper functions ### if [ -e "${_vBs}/${_tocIncO}" ]; then source "${_vBs}/${_tocIncO}" _tInc="${_vBs}/${_tocIncO}" elif [ -e "${_vBs}/${_filIncO}" ]; then source "${_vBs}/${_filIncO}" _tInc="${_vBs}/${_filIncO}" else _panic_exit "${_tInc}" fi ### ### Env debugging ### if [ "${_DEBUG_MODE}" = "YES" ]; then echo DEBUG AegirSetupB echo DEBUG AegirSetupB echo Effective _USER is $1 [ -r "${_vBs}/${_tocIncO}" ] && echo Effective _tocIncO is ${_tocIncO} echo DEBUG AegirSetupB echo DEBUG AegirSetupB env echo DEBUG AegirSetupB echo DEBUG AegirSetupB fi ### ### More helper variables ### export _urlDev="http://${_USE_MIR}/dev" export _urlHmr="http://${_USE_MIR}/versions/${_tRee}/boa/aegir" ### ### Include shared functions ### _FL="helper satellite" for f in ${_FL}; do [ -r "${_libFnc}/${f}.sh.inc" ] || _panic_exit "${f}" source "${_libFnc}/${f}.sh.inc" done ### ### Local variables ### if [ "${_THIS_DB_HOST}" = "FQDN" ]; then _THIS_DB_HOST="$(cat /etc/hostname 2>/dev/null | tr -d '\n' || hostname -f 2>/dev/null)" fi _DIST_INSTALL=NO _STATUS=INIT _LOCAL_STATUS="${_STATUS}" _ROOT="/data/disk/${_USER}" _HM_ROOT="${_ROOT}/aegir/distro/${_HM_DISTRO}" _DISTRO_ROOT="${_ROOT}/distro/${_DISTRO}" _PREV_HM_ROOT="${_ROOT}/aegir/distro/${_LAST_HMR}" _D="/data/all" _SRCDIR="/opt/tmp/files" if [ "${_PHP_CLI_VERSION}" = "8.5" ] \ && [ -x "/opt/php85/bin/php" ]; then _T_CLI=/opt/php85/bin elif [ "${_PHP_CLI_VERSION}" = "8.4" ] \ && [ -x "/opt/php84/bin/php" ]; then _T_CLI=/opt/php84/bin elif [ "${_PHP_CLI_VERSION}" = "8.3" ] \ && [ -x "/opt/php83/bin/php" ]; then _T_CLI=/opt/php83/bin elif [ "${_PHP_CLI_VERSION}" = "8.2" ] \ && [ -x "/opt/php82/bin/php" ]; then _T_CLI=/opt/php82/bin elif [ "${_PHP_CLI_VERSION}" = "8.1" ] \ && [ -x "/opt/php81/bin/php" ]; then _T_CLI=/opt/php81/bin elif [ "${_PHP_CLI_VERSION}" = "8.0" ] \ && [ -x "/opt/php80/bin/php" ]; then _T_CLI=/opt/php80/bin elif [ "${_PHP_CLI_VERSION}" = "7.4" ] \ && [ -x "/opt/php74/bin/php" ]; then _T_CLI=/opt/php74/bin elif [ "${_PHP_CLI_VERSION}" = "7.3" ] \ && [ -x "/opt/php73/bin/php" ]; then _T_CLI=/opt/php73/bin elif [ "${_PHP_CLI_VERSION}" = "7.2" ] \ && [ -x "/opt/php72/bin/php" ]; then _T_CLI=/opt/php72/bin elif [ "${_PHP_CLI_VERSION}" = "7.1" ] \ && [ -x "/opt/php71/bin/php" ]; then _T_CLI=/opt/php71/bin elif [ "${_PHP_CLI_VERSION}" = "7.0" ] \ && [ -x "/opt/php70/bin/php" ]; then _T_CLI=/opt/php70/bin elif [ "${_PHP_CLI_VERSION}" = "5.6" ] \ && [ -x "/opt/php56/bin/php" ]; then _T_CLI=/opt/php56/bin fi _DRUSHCMD="${_T_CLI}/php ${_ROOT}/tools/drush/drush.php" PATH=${_T_CLI}:/usr/local/bin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin SHELL=/bin/bash ### ### Status check and update on the fly ### if [ -e "${_ROOT}/aegir.sh" ]; then _STATUS=UPGRADE cd ${_ROOT} fi ### ### User check ### if [ "$(id -u)" -eq 0 ]; then _msg "${_STATUS} B: FATAL ERROR: This script should be run as a non-root user" _msg "${_STATUS} B: FATAL ERROR: Aborting AegirSetupB installer NOW!" touch /opt/tmp/status-AegirSetupB-FAIL exit 1 else if [ "${_DEBUG_MODE}" = "YES" ]; then _msg "${_STATUS} B: Ægir automated install script part B" fi fi ### ### Run all child B procedures ### _satellite_child_b_prepare_dirs_permissions _satellite_child_b_install_drush _satellite_child_b_drush_xts_cleanup _satellite_child_b_drush_xts_install _satellite_child_b_drush_test _satellite_child_b_aegir_build _satellite_child_b_aegir_health_check _satellite_child_b_letsencrypt _satellite_child_b_aegir_ui_enhance _satellite_child_b_vhosts_hotfix _satellite_child_b_symlink_global_inc _satellite_child_b_redis_enable_finalize ###----------------------------------------### ### ### Octopus Ægir Installer ### Copyright (C) 2009-2026 Omega8.cc ### noc@omega8.cc www.omega8.cc ### ###----------------------------------------### ================================================ FILE: aegir/scripts/AegirSetupC.sh.txt ================================================ #!/bin/bash ###----------------------------------------### ### ### Octopus Ægir Installer ### ### Copyright (C) 2009-2026 Omega8.cc ### noc@omega8.cc www.omega8.cc ### ### This program is free software. You can ### redistribute it and/or modify it under ### the terms of the GNU GPL as published by ### the Free Software Foundation, version 2 ### or later. ### ### This program is distributed in the hope ### that it will be useful, but WITHOUT ANY ### WARRANTY; without even the implied ### warranty of MERCHANTABILITY or FITNESS ### FOR A PARTICULAR PURPOSE. See the GNU GPL ### for more details. ### ### You should have received a copy of the ### GNU GPL along with this program. ### If not, see http://www.gnu.org/licenses/ ### ### Code: https://github.com/omega8cc/boa ### ###----------------------------------------### ###----------------------------------------### ### DON'T EDIT ANYTHING BELOW THIS LINE ### ###----------------------------------------### ### ### Helper variables ### export _bldPth="/opt/tmp/boa" export _crlGet="-L --max-redirs 3 -k -s --retry 9 --retry-delay 9 -A iCab" export _wgetGet="--max-redirect=3 --no-check-certificate -q --tries=9 --wait=9 --user-agent='iCab'" export _filIncO="octopus.sh.cnf" export _gCb="git clone --branch" export _gitHub="https://github.com/omega8cc" export _gitLab="https://gitlab.com/omega8cc" export _libFnc="${_bldPth}/lib/functions" export _tocIncO="${_filIncO}.$1" export _vBs="/var/backups" export _vSet="variable-set --always-set" export _tRee=dev ### ### Panic on missing include ### _panic_exit() { echo echo " EXIT: Required lib file not available?" echo " EXIT: $1" echo " EXIT: Cannot continue" echo " EXIT: Bye (0)" echo touch /opt/tmp/status-AegirSetupC-FAIL exit 1 } ### ### Include helper functions ### if [ -e "${_vBs}/${_tocIncO}" ]; then source "${_vBs}/${_tocIncO}" _tInc="${_vBs}/${_tocIncO}" elif [ -e "${_vBs}/${_filIncO}" ]; then source "${_vBs}/${_filIncO}" _tInc="${_vBs}/${_filIncO}" else _panic_exit "${_tInc}" fi ### ### Env debugging ### if [ "${_DEBUG_MODE}" = "YES" ]; then echo DEBUG AegirSetupC echo DEBUG AegirSetupC echo Effective _USER is $1 [ -r "${_vBs}/${_tocIncO}" ] && echo Effective _tocIncO is ${_tocIncO} echo DEBUG AegirSetupC echo DEBUG AegirSetupC env echo DEBUG AegirSetupC echo DEBUG AegirSetupC fi ### ### More helper variables ### export _urlDev="http://${_USE_MIR}/dev" export _urlHmr="http://${_USE_MIR}/versions/${_tRee}/boa/aegir" ### ### Include shared functions ### _FL="helper satellite" for f in ${_FL}; do [ -r "${_libFnc}/${f}.sh.inc" ] || _panic_exit "${f}" source "${_libFnc}/${f}.sh.inc" done ### ### Local variables ### if [ "${_THIS_DB_HOST}" = "FQDN" ]; then export _THIS_DB_HOST="$(cat /etc/hostname 2>/dev/null | tr -d '\n' || hostname -f 2>/dev/null)" fi export _USE_AEGIR_VER=SRC export _T_BUILD=SRC export _DIST_INSTALL=NO export _STATUS=INIT export _USE_DISTRO_CORE=NO export _LOCAL_STATUS="${_STATUS}" export _ROOT="/data/disk/${_USER}" export _HM_ROOT="${_ROOT}/aegir/distro/${_HM_DISTRO}" export _DISTRO_ROOT="${_ROOT}/distro/${_DISTRO}" export _PREV_HM_ROOT="${_ROOT}/aegir/distro/${_LAST_HMR}" export _D="/data/all" export _SRCDIR="/opt/tmp/files" if [ "${_PHP_CLI_VERSION}" = "8.5" ] \ && [ -x "/opt/php85/bin/php" ]; then _T_CLI=/opt/php85/bin elif [ "${_PHP_CLI_VERSION}" = "8.4" ] \ && [ -x "/opt/php84/bin/php" ]; then _T_CLI=/opt/php84/bin elif [ "${_PHP_CLI_VERSION}" = "8.3" ] \ && [ -x "/opt/php83/bin/php" ]; then _T_CLI=/opt/php83/bin elif [ "${_PHP_CLI_VERSION}" = "8.2" ] \ && [ -x "/opt/php82/bin/php" ]; then _T_CLI=/opt/php82/bin elif [ "${_PHP_CLI_VERSION}" = "8.1" ] \ && [ -x "/opt/php81/bin/php" ]; then _T_CLI=/opt/php81/bin elif [ "${_PHP_CLI_VERSION}" = "8.0" ] \ && [ -x "/opt/php80/bin/php" ]; then _T_CLI=/opt/php80/bin elif [ "${_PHP_CLI_VERSION}" = "7.4" ] \ && [ -x "/opt/php74/bin/php" ]; then _T_CLI=/opt/php74/bin elif [ "${_PHP_CLI_VERSION}" = "7.3" ] \ && [ -x "/opt/php73/bin/php" ]; then _T_CLI=/opt/php73/bin elif [ "${_PHP_CLI_VERSION}" = "7.2" ] \ && [ -x "/opt/php72/bin/php" ]; then _T_CLI=/opt/php72/bin elif [ "${_PHP_CLI_VERSION}" = "7.1" ] \ && [ -x "/opt/php71/bin/php" ]; then _T_CLI=/opt/php71/bin elif [ "${_PHP_CLI_VERSION}" = "7.0" ] \ && [ -x "/opt/php70/bin/php" ]; then _T_CLI=/opt/php70/bin elif [ "${_PHP_CLI_VERSION}" = "5.6" ] \ && [ -x "/opt/php56/bin/php" ]; then _T_CLI=/opt/php56/bin fi export _DRUSHCMD="${_T_CLI}/php ${_ROOT}/tools/drush/drush.php" # export PATH=${_T_CLI}:/usr/local/bin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin export SHELL=/bin/bash # export _pthPch="/opt/tmp/boa/aegir/patches" export _urlDrp="http://ftp.drupal.org/files/projects" export _urlPrt="https://drupal.org/project" # export _noT="not installed" export _yOk="installation in progress..." ###---### Checking status. # if [ -e "${_ROOT}/log/setupmail.txt" ] \ || [ -e "${_ROOT}/log/legacy_setupmail.txt" ] \ || [ -e "${_ROOT}/log/latest_setupmail.txt" ]; then _STATUS=UPGRADE cd ${_ROOT} fi ###---### User check. # if [ "${_DEBUG_MODE}" = "YES" ]; then _msg "${_STATUS} C: Ægir automated install script part C" fi if [ "$(id -u)" -eq 0 ]; then _msg "${_STATUS} C: FATAL ERROR: This script should be run as a non-root user" _msg "${_STATUS} C: FATAL ERROR: Aborting AegirSetupC installer NOW!" touch /opt/tmp/status-AegirSetupC-FAIL exit 1 fi ###---### Hot Sauce check. # if [ "${_HOT_SAUCE}" = "NO" ]; then export _CORE="/data/all/${_LAST_ALL}" export _THIS_CORE="${_LAST_ALL}" if [ "${_USE_CURRENT}" = "YES" ] \ && [ -e "/data/all/000/core-v-${_SMALLCORE6_V}.txt" ] \ && [ -e "/data/all/000/core-v-${_SMALLCORE7_V}.txt" ]; then if [ "${_DEBUG_MODE}" = "YES" ]; then _msg "${_STATUS} C: Shared platforms code v.${_LAST_ALL} will be used" fi elif [ "${_USE_CURRENT}" = "NO" ] \ || [ ! -e "/data/all/000/core-v-${_SMALLCORE6_V}.txt" ] \ || [ ! -e "/data/all/000/core-v-${_SMALLCORE7_V}.txt" ]; then export _CORE="/data/all/${_ALL_DISTRO}" export _THIS_CORE="${_ALL_DISTRO}" _msg "${_STATUS} C: Shared platforms code v.${_ALL_DISTRO} (new) will be created" else if [ "${_DEBUG_MODE}" = "YES" ]; then _msg "${_STATUS} C: Shared platforms code v.${_LAST_ALL} will be used" fi fi else export _CORE="/data/all/${_ALL_DISTRO}" export _THIS_CORE="${_ALL_DISTRO}" _msg "${_STATUS} C: Shared platforms code v.${_ALL_DISTRO} (new) will be created" fi export _D6_CORE_DIR="/data/all/000/core/${_DRUPAL6}" export _D7_CORE_DIR="/data/all/000/core/${_DRUPAL7}" export _pthDst="${_ROOT}/distro/${_THIS_CORE}" mkdir -p ${_pthDst} chmod 0711 ${_ROOT}/distro &> /dev/null chmod 0711 ${_pthDst} &> /dev/null ###---### export _ALLOW_ALL=YES if [ "${_CLIENT_CORES}" -lt 1 ]; then _ALLOW_ALL=NO _D_8_ALLOW=NO fi ### ###---### Functions. ### # # Prepare for Save & Verify Platforms. _prepare_for_save_verify_platforms() { _LOCAL_STATUS="NOT_SET" if [ "${_LOCAL_STATUS}" = "INIT" ]; then _THIS_HM="${_HM_ROOT}/sites/${_DOMAIN}" else if [ -e "${_ROOT}/.drush/hostmaster.alias.drushrc.php" ]; then _THIS_HM=$(cat ${_ROOT}/.drush/hostmaster.alias.drushrc.php \ | grep 'site_path' \ | cut -d: -f2 \ | awk '{ print $3}' 2>&1) _THIS_HM=$(echo ${_THIS_HM} | sed "s/[\,']//g" 2>&1) else _THIS_HM="${_HM_ROOT}/sites/${_DOMAIN}" fi fi if [ ! -d "${_THIS_HM}" ]; then _THIS_HM="${_PREV_HM_ROOT}/sites/${_DOMAIN}" fi if [ -d "${_THIS_HM}" ] && [ ! -e "${_THIS_HM}/make_platform.php" ]; then cp -af /opt/tmp/boa/aegir/helpers/make_platform.php.txt ${_THIS_HM}/make_platform.php fi if [ "${_SERIES_RESULT}" = "OK" ]; then export _drhSrc="sites/all/drush/drushrc.php" else export _drhSrc="drushrc.php" fi } # # Save & Verify Platform _save_verify_this_platform() { # Declare 'params' as local to the function local -A params=( [dist]="$1" [version]="$2" [core_version]="$3" [description]="$4" [profile_path]="$5" [profile_name]="$6" [web_dir]="$7" [php_version]="$8" [url]="$9" ) if [ "${_DEBUG_MODE}" = "YES" ]; then _msg "DEBUG: _save_verify_this_platform" for key in "${!params[@]}"; do _msg "DEBUG: _save_verify_this_platform ${key} is '${params[$key]}'" done fi # _save_verify_this_platform "${1}" "${_SHRD_PLNAME}" "${3}" "${params[description]} [P.${_THIS_CORE}]" "${5}" "${6}" "${7}" # _save_verify_this_platform "${1}" "${2}" "${3}" "${_DIST_PLNAME}" "${5}" "${6}" "${7}" # _save_verify_this_platform 'OCS' '2.2.1' '10.3.6' 'openculturas-2.2.1-10.3.6' 'contrib/' 'openculturas' '/web' # make_platform 'ezcontent-2.2.15-10.3.6' ezcontent /data/disk/o8/distro/001/ezcontent-2.2.15-10.3.6/web # make_platform 'commerce_base-2.40-10.1.8' commerce_base /data/disk/o8/distro/001/commerce_base-2.40-10.1.8/web _make_p="${_pthDst}/${params[profile_name]}-${params[version]}-${params[core_version]}${params[web_dir]}" # _save_verify_this_platform 'UC7' '3.13' '7.105.1' 'ubercart-3.13-7.105.1' '/' 'minimal' '' _make_u="${_pthDst}/ubercart-${params[version]}-${params[core_version]}${params[web_dir]}" # _save_verify_this_platform 'DX3' '10.3.6' '10.3.6' 'drupal-10.3.6-dev' '/' 'standard' '/web' # /data/disk/o8/distro/001/drupal-10.3.6-prod _make_x="${_pthDst}/${params[version]}${params[web_dir]}" if [ -d "${_make_p}" ]; then if [ ! -e "${_make_p}/${_drhSrc}" ]; then if [ -d "${_THIS_HM}" ] && [ -e "${_THIS_HM}/make_platform.php" ]; then cd ${_THIS_HM} [ "${_DEBUG_MODE}" = "YES" ] && _msg "DEBUG: ${_DRUSHCMD} php-script make_platform '${4}' ${6} ${_make_p}" ${_DRUSHCMD} php-script make_platform "${4}" ${6} ${_make_p} &> /dev/null fi fi elif [ -d "${_make_u}" ]; then if [ ! -e "${_make_u}/${_drhSrc}" ]; then if [ -d "${_THIS_HM}" ] && [ -e "${_THIS_HM}/make_platform.php" ]; then cd ${_THIS_HM} [ "${_DEBUG_MODE}" = "YES" ] && _msg "DEBUG: ${_DRUSHCMD} php-script make_platform '${4}' ${6} ${_make_u}" ${_DRUSHCMD} php-script make_platform "${4}" ${6} ${_make_u} &> /dev/null fi fi elif [ -d "${_make_x}" ]; then if [ ! -e "${_make_x}/${_drhSrc}" ]; then if [ -d "${_THIS_HM}" ] && [ -e "${_THIS_HM}/make_platform.php" ]; then cd ${_THIS_HM} [ "${_DEBUG_MODE}" = "YES" ] && _msg "DEBUG: ${_DRUSHCMD} php-script make_platform '${4}' ${6} ${_make_x}" ${_DRUSHCMD} php-script make_platform "${4}" ${6} ${_make_x} &> /dev/null fi fi fi } # # Download and extract from core archive. _get_core_ext() { if [ ! -z "$1" ]; then _max_attempts=10 _attempt_num=1 _success=0 while [ ${_attempt_num} -le ${_max_attempts} ]; do [ "${_DEBUG_MODE}" = "YES" ] && _msg "DNLD: Attempt ${_attempt_num} of ${_max_attempts}: Downloading $1..." if curl ${_crlGet} "http://${_USE_MIR}/core/$1" -o "$1"; then _success=1 break else [ "${_DEBUG_MODE}" = "YES" ] && _msg "DNLD: Attempt ${_attempt_num} failed." _attempt_num=$((_attempt_num+1)) if [ "${_attempt_num}" -le "${_max_attempts}" ]; then [ "${_DEBUG_MODE}" = "YES" ] && _msg "DNLD: Retrying in 9 seconds..." sleep 9 fi fi done if [ "${_success}" -eq 1 ]; then _extract_archive "$1" else _msg "OOPS: Failed to download http://${_USE_MIR}/core/$1 after ${_max_attempts} attempts" return 1 # Exit the function but continue the script fi fi } # # Download and extract from distro archive. _get_distro_ext() { if [ ! -z "$1" ]; then _max_attempts=10 _attempt_num=1 _success=0 while [ ${_attempt_num} -le ${_max_attempts} ]; do [ "${_DEBUG_MODE}" = "YES" ] && _msg "DNLD: Attempt ${_attempt_num} of ${_max_attempts}: Downloading $1..." if curl ${_crlGet} "http://${_USE_MIR}/distro/$1" -o "$1"; then _success=1 break else [ "${_DEBUG_MODE}" = "YES" ] && _msg "DNLD: Attempt ${_attempt_num} failed." _attempt_num=$((_attempt_num+1)) if [ "${_attempt_num}" -le "${_max_attempts}" ]; then [ "${_DEBUG_MODE}" = "YES" ] && _msg "DNLD: Retrying in 9 seconds..." sleep 9 fi fi done if [ "${_success}" -eq 1 ]; then _extract_archive "$1" else _msg "OOPS: Failed to download http://${_USE_MIR}/distro/$1 after ${_max_attempts} attempts" return 1 # Exit the function but continue the script fi fi } # # Create standard directories. _fix_dirs_files() { rm -f ./*.txt rm -f ./modules/*.txt rm -f ./themes/*.txt rm -rf ./modules/cookie_cache_bypass mkdir -p ./sites/default/files mkdir -p ./cache/{normal,perm} chmod -R 777 ./cache if [ -e "./sites/default/default.settings.php" ]; then cp -af ./sites/default/default.settings.php ./sites/default/settings.php fi chmod a+rw ./sites/default/settings.php chmod a+rwx ./sites/default/files mkdir -p ./profiles mkdir -p ./sites/all/{modules,libraries,themes} rm -f ./core/modules/*.txt rm -f ./core/themes/*.txt rm -f ./modules/*.txt rm -f ./themes/*.txt rm -f ./sites/all/*.txt echo empty > ./profiles/EMPTY.txt echo empty > ./sites/all/EMPTY.txt echo empty > ./sites/all/modules/EMPTY.txt echo empty > ./sites/all/libraries/EMPTY.txt echo empty > ./sites/all/themes/EMPTY.txt chmod 0755 ./profiles &> /dev/null chmod 0755 ./sites chmod 0755 ./sites/all chmod 02775 ./sites/all/{modules,libraries,themes} cp -af /opt/tmp/boa/aegir/conf/var/get.htaccess.txt ./.htaccess cp -af /opt/tmp/boa/aegir/conf/var/crossdomain.xml ./ } # # Create D6 symlinks. _create_d6_symlinks() { if [ ! -L "includes" ]; then ln -sfn ${_D6_CORE_DIR}/.htaccess .htaccess ln -sfn ${_D6_CORE_DIR}/boost_stats.php boost_stats.php ln -sfn ${_D6_CORE_DIR}/cron.php cron.php ln -sfn ${_D6_CORE_DIR}/crossdomain.xml crossdomain.xml ln -sfn ${_D6_CORE_DIR}/includes includes ln -sfn ${_D6_CORE_DIR}/index.php index.php ln -sfn ${_D6_CORE_DIR}/install.php install.php ln -sfn ${_D6_CORE_DIR}/js.php js.php ln -sfn ${_D6_CORE_DIR}/misc misc ln -sfn ${_D6_CORE_DIR}/modules modules ln -sfn ${_D6_CORE_DIR}/themes themes ln -sfn ${_D6_CORE_DIR}/update.php update.php ln -sfn ${_D6_CORE_DIR}/xmlrpc.php xmlrpc.php cp -af ${_D6_CORE_DIR}/sites ./ fi if [ ! -L "${_OCTO_PLPATH}/profiles" ] && [ -d "${_SHRD_PLPATH}/profiles" ]; then rm -rf ${_OCTO_PLPATH}/profiles ln -sfn ${_SHRD_PLPATH}/profiles ${_OCTO_PLPATH}/profiles fi } # # Create D7 symlinks. _create_d7_symlinks() { if [ ! -L "web.config" ]; then ln -sfn ${_D7_CORE_DIR}/.htaccess .htaccess ln -sfn ${_D7_CORE_DIR}/authorize.php authorize.php ln -sfn ${_D7_CORE_DIR}/cron.php cron.php ln -sfn ${_D7_CORE_DIR}/crossdomain.xml crossdomain.xml ln -sfn ${_D7_CORE_DIR}/includes includes ln -sfn ${_D7_CORE_DIR}/index.php index.php ln -sfn ${_D7_CORE_DIR}/install.php install.php ln -sfn ${_D7_CORE_DIR}/js.php js.php ln -sfn ${_D7_CORE_DIR}/misc misc ln -sfn ${_D7_CORE_DIR}/modules modules ln -sfn ${_D7_CORE_DIR}/themes themes ln -sfn ${_D7_CORE_DIR}/update.php update.php ln -sfn ${_D7_CORE_DIR}/web.config web.config ln -sfn ${_D7_CORE_DIR}/xmlrpc.php xmlrpc.php cp -af ${_D7_CORE_DIR}/sites ./ fi if [ ! -L "${_OCTO_PLPATH}/profiles" ] && [ -d "${_SHRD_PLPATH}/profiles" ]; then rm -rf ${_OCTO_PLPATH}/profiles ln -sfn ${_SHRD_PLPATH}/profiles ${_OCTO_PLPATH}/profiles fi } # # Create distro own D7 core symlinks. _create_distro_d7_symlinks() { if [ ! -L "web.config" ]; then if [ ! -f "${_SHRD_PLPATH}/crossdomain.xml" ]; then rm -f ${_SHRD_PLPATH}/crossdomain.xml cd ${_SHRD_PLPATH} _fix_dirs_files fi if [ ! -L "${_SHRD_PLPATH}/modules/o_contrib_seven" ]; then ln -sfn ${_CORE}/o_contrib_seven ${_SHRD_PLPATH}/modules/o_contrib_seven fi cd ${_OCTO_PLPATH} ln -sfn ${_SHRD_PLPATH}/.htaccess .htaccess ln -sfn ${_SHRD_PLPATH}/authorize.php authorize.php ln -sfn ${_SHRD_PLPATH}/cron.php cron.php ln -sfn ${_SHRD_PLPATH}/crossdomain.xml crossdomain.xml ln -sfn ${_SHRD_PLPATH}/includes includes ln -sfn ${_SHRD_PLPATH}/index.php index.php ln -sfn ${_SHRD_PLPATH}/install.php install.php ln -sfn ${_CORE}/o_contrib_seven/js/js.php js.php ln -sfn ${_SHRD_PLPATH}/misc misc ln -sfn ${_SHRD_PLPATH}/modules modules ln -sfn ${_SHRD_PLPATH}/themes themes ln -sfn ${_SHRD_PLPATH}/update.php update.php ln -sfn ${_SHRD_PLPATH}/web.config web.config ln -sfn ${_SHRD_PLPATH}/xmlrpc.php xmlrpc.php cp -af ${_SHRD_PLPATH}/sites ./ fi if [ ! -L "${_OCTO_PLPATH}/profiles" ] && [ -d "${_SHRD_PLPATH}/profiles" ]; then rm -rf ${_OCTO_PLPATH}/profiles ln -sfn ${_SHRD_PLPATH}/profiles ${_OCTO_PLPATH}/profiles fi } # # Rename D7 profiles. _rename_drupal7_profiles() { for _Files in `find ./profiles -type f`; do sed -i "s/name = Minimal/name = Vanilla Minimal/g" ${_Files} &> /dev/null wait sed -i "s/name = Standard/name = Vanilla Standard/g" ${_Files} &> /dev/null wait sed -i "s/name = Testing/name = Vanilla Testing/g" ${_Files} &> /dev/null wait sed -i "s/hidden = TRUE//g" ${_Files} &> /dev/null wait done } # # Rename D9 profiles. _rename_drupal9_profiles() { for _Files in `find ./core/profiles -type f`; do sed -i "s/name: Minimal/name: Vanilla Minimal/g" ${_Files} &> /dev/null wait sed -i "s/name: Standard/name: Vanilla Standard/g" ${_Files} &> /dev/null wait sed -i "s/name: Testing/name: Vanilla Testing/g" ${_Files} &> /dev/null wait done } # # Prepare D6 core. _prepare_drupal6_core() { if [ ! -e "${_D6_CORE_DIR}" ]; then if [ -L "${_D6_CORE_DIR}" ]; then unlink ${_D6_CORE_DIR} fi cd /data/all/000/core [ "${_DEBUG_MODE}" = "YES" ] && _msg "DEBUG: _get_core_ext '${_DRUPAL6}.tar.gz'" _get_core_ext "${_DRUPAL6}.tar.gz" find ${_D6_CORE_DIR} -type d -exec chmod 0755 {} \; &> /dev/null find ${_D6_CORE_DIR} -type f -exec chmod 0644 {} \; &> /dev/null cd ${_D6_CORE_DIR}/ _fix_dirs_files patch -p0 < ${_pthPch}/taxonomy-6.26.patch &> /dev/null rm -f ${_D6_CORE_DIR}/modules/taxonomy/taxonomy.module.orig rm -f modules/o_contrib ln -sfn ${_CORE}/o_contrib modules/o_contrib ln -sfn ${_CORE}/o_contrib/js/js.php js.php cp -af ${_CORE}/o_contrib/image/image.imagemagick.inc includes/ cp -af ${_CORE}/o_contrib/boost/stats/boost_stats.php ./ &> /dev/null rm -rf ${_D6_CORE_DIR}/scripts cd ${_D6_CORE_DIR}/themes _get_dev_contrib "rubik-6.x-3.0-beta5.tar.gz" _get_dev_contrib "tao-6.x-3.3.tar.gz" rm -f ${_D6_CORE_DIR}/sites/all/*.txt cd ${_CORE} fi } # # Prepare D7 core. _prepare_drupal7_core() { if [ ! -e "${_D7_CORE_DIR}" ]; then if [ -L "${_D7_CORE_DIR}" ]; then unlink ${_D7_CORE_DIR} fi cd /data/all/000/core [ "${_DEBUG_MODE}" = "YES" ] && _msg "DEBUG: _get_core_ext '${_DRUPAL7}.tar.gz'" _get_core_ext "${_DRUPAL7}.tar.gz" find ${_D7_CORE_DIR} -type d -exec chmod 0755 {} \; &> /dev/null find ${_D7_CORE_DIR} -type f -exec chmod 0644 {} \; &> /dev/null cd ${_D7_CORE_DIR}/ _fix_dirs_files _rename_drupal7_profiles patch -p0 < ${_pthPch}/taxonomy-7.12.patch &> /dev/null rm -f ${_D7_CORE_DIR}/modules/taxonomy/taxonomy.module.orig rm -f modules/o_contrib_seven ln -sfn ${_CORE}/o_contrib_seven modules/o_contrib_seven ln -sfn ${_CORE}/o_contrib_seven/js/js.php js.php rm -rf ${_D7_CORE_DIR}/scripts cd ${_D7_CORE_DIR}/themes _get_dev_contrib "rubik-7.x-4.4.tar.gz" _get_dev_contrib "tao-7.x-3.1.tar.gz" cd ${_CORE} fi } # # Remove D6 core from distro directory. _nocore_d6_dist_clean() { rm -f ${_SHRD_PLPATH}/.gitignore rm -f ${_SHRD_PLPATH}/.htaccess rm -f ${_SHRD_PLPATH}/*.php rm -f ${_SHRD_PLPATH}/*.txt rm -f ${_SHRD_PLPATH}/*.xml rm -rf ${_SHRD_PLPATH}/cache rm -rf ${_SHRD_PLPATH}/includes rm -rf ${_SHRD_PLPATH}/misc rm -rf ${_SHRD_PLPATH}/modules rm -rf ${_SHRD_PLPATH}/sites rm -rf ${_SHRD_PLPATH}/scripts rm -rf ${_SHRD_PLPATH}/themes if [ ! -d "${_SHRD_PLPATH}/profiles" ] && [ -d "${_D6_CORE_DIR}/profiles" ]; then rm -rf ${_SHRD_PLPATH}/profiles cp -af ${_D6_CORE_DIR}/profiles ${_SHRD_PLPATH}/ fi sed -i "s/'dblog'/'robotstxt', 'path_alias_cache'/g" \ ${_SHRD_PRPATH}/${_REAL_PRNAME}.profile &> /dev/null } # # Remove D7 core from distro directory. _nocore_d7_dist_clean() { if [ "${_USE_DISTRO_CORE}" = "NO" ]; then rm -f ${_SHRD_PLPATH}/.gitignore rm -f ${_SHRD_PLPATH}/.htaccess rm -f ${_SHRD_PLPATH}/*.php rm -f ${_SHRD_PLPATH}/*.txt rm -f ${_SHRD_PLPATH}/*.xml rm -f ${_SHRD_PLPATH}/web.config rm -rf ${_SHRD_PLPATH}/cache rm -rf ${_SHRD_PLPATH}/includes rm -rf ${_SHRD_PLPATH}/misc rm -rf ${_SHRD_PLPATH}/modules rm -rf ${_SHRD_PLPATH}/sites rm -rf ${_SHRD_PLPATH}/scripts rm -rf ${_SHRD_PLPATH}/themes _REVISIONS="34 35 36 37 38 39" for i in ${_REVISIONS}; do if [ -d "${_CORE}/drupal-7.$i" ] && [ ! -e "${_SHRD_PLPATH}" ]; then mv ${_CORE}/drupal-7.$i ${_SHRD_PLPATH} fi done if [ ! -d "${_SHRD_PLPATH}/profiles" ] && [ -d "${_D7_CORE_DIR}/profiles" ]; then rm -rf ${_SHRD_PLPATH}/profiles cp -af ${_D7_CORE_DIR}/profiles ${_SHRD_PLPATH}/ fi fi } # # Enable D6 admin. _enable_drupal6_admin() { sed -i "s/'path_alias_cache'/'path_alias_cache', 'admin'/g" \ ${_SHRD_PRPATH}/${_REAL_PRNAME}.profile &> /dev/null } # # Remove default core seven profiles. _remove_default_core_seven_profiles() { rm -rf ${_SHRD_PLPATH}/profiles/minimal rm -rf ${_SHRD_PLPATH}/profiles/standard rm -rf ${_SHRD_PLPATH}/profiles/testing } # # Init this distro root. _init_this_distro_root() { mkdir -p ${_OCTO_PLPATH} cd ${_OCTO_PLPATH} if [[ "${_USE_DISTRO_CORE}" = "YES" ]]; then _create_distro_d7_symlinks else if [[ "${_SHRD_PLNAME}" =~ "-${_SMALLCORE6_V}" ]]; then _create_d6_symlinks elif [[ "${_SHRD_PLNAME}" =~ "-${_SMALLCORE7_V}" ]]; then _create_d7_symlinks fi fi } # # Upgrade contrib less. _upgrade_contrib_less() { if [ -e "${_SHRD_PRPATH}/modules/contrib/rules_conditional" ]; then rm -rf ${_SHRD_PRPATH}/modules/contrib/rules_conditional cd ${_SHRD_PRPATH}/modules/contrib _get_dev_contrib "rules_conditional-7.x-1.x-dev.tar.gz" if [ ! -e "${_SHRD_PRPATH}/modules/contrib/rules_conditional" ]; then _get_dev_contrib "rules_conditional-7.x-1.x-dev.tar.gz" fi cd ${_CORE} fi if [ -e "${_SHRD_PRPATH}/modules/contrib/webform" ]; then rm -rf ${_SHRD_PRPATH}/modules/contrib/webform cd ${_SHRD_PRPATH}/modules/contrib _get_dev_contrib "webform-7.x-4.18.tar.gz" if [ ! -e "${_SHRD_PRPATH}/modules/contrib/webform" ]; then _get_dev_contrib "webform-7.x-4.18.tar.gz" fi cd ${_CORE} fi if [ -e "${_SHRD_PRPATH}/modules/contrib/panels" ]; then rm -rf ${_SHRD_PRPATH}/modules/contrib/panels cd ${_SHRD_PRPATH}/modules/contrib _get_dev_contrib "panels-7.x-3.8.tar.gz" if [ ! -e "${_SHRD_PRPATH}/modules/contrib/panels" ]; then _get_dev_contrib "panels-7.x-3.8.tar.gz" fi cd ${_CORE} fi if [ -e "${_SHRD_PRPATH}/modules/contrib/rules" ]; then rm -rf ${_SHRD_PRPATH}/modules/contrib/rules cd ${_SHRD_PRPATH}/modules/contrib _get_dev_contrib "rules-7.x-2.12.tar.gz" if [ ! -e "${_SHRD_PRPATH}/modules/contrib/rules" ]; then _get_dev_contrib "rules-7.x-2.12.tar.gz" fi cd ${_CORE} fi if [ -e "${_SHRD_PRPATH}/modules/rules" ]; then rm -rf ${_SHRD_PRPATH}/modules/rules cd ${_SHRD_PRPATH}/modules _get_dev_contrib "rules-7.x-2.12.tar.gz" if [ ! -e "${_SHRD_PRPATH}/modules/rules" ]; then _get_dev_contrib "rules-7.x-2.12.tar.gz" fi cd ${_CORE} fi } # Create Drupal basic platform for versions 6 and 7. _create_drupal6_or_7_basic() { local version="$1" # Accepts "6" or "7" if [ ! -d "${_SHRD_PLPATH}" ]; then mkdir -p "${_SHRD_PLPATH}" local core_dir_var="_D${version}_CORE_DIR" local core_dir="${!core_dir_var}" if [ ! -e "${core_dir}" ]; then local prepare_func="_prepare_drupal${version}_core" if declare -f "$prepare_func" > /dev/null; then "$prepare_func" else echo "Function $prepare_func does not exist." fi fi if [ "$version" = "6" ]; then cd "${_CORE}" _nocore_d6_dist_clean _enable_drupal6_admin elif [ "$version" = "7" ]; then _nocore_d7_dist_clean fi fi _init_this_distro_root } # Create Drupal basic platform for versions 9 and 10.x. _create_drupal_basic_version() { local version="$1" # Accepts "9", "10_0", "10_1", etc. if [ ! -d "${_OCTO_PLPATH}" ]; then cd "${_pthDst}" local drupal_var="_DRUPAL${version}" local drupal_version="${!drupal_var}" [ "${_DEBUG_MODE}" = "YES" ] && _msg "DEBUG: _get_core_ext '${drupal_version}.tar.gz'" _get_core_ext "${drupal_version}.tar.gz" mv -f "${drupal_version}" "${_SHRD_PLNAME}" if [ "$version" = "9" ]; then cd "${_pthDst}/${_SHRD_PLNAME}/web" _rename_drupal9_profiles fi fi } # Create Drupal core-only basic platform. _create_drupal_core_basic() { local version_code="$1" case "$version_code" in "DL6") _create_drupal6_or_7_basic "6" ;; "DL7") _create_drupal6_or_7_basic "7" ;; "DL9") _create_drupal_basic_version "9" ;; "DX0") _create_drupal_basic_version "10_0" ;; "DX1") _create_drupal_basic_version "10_1" ;; "DX2") _create_drupal_basic_version "10_2" ;; "DX3") _create_drupal_basic_version "10_3" ;; "DX4") _create_drupal_basic_version "10_4" ;; "DX5") _create_drupal_basic_version "10_5" ;; "DX6") _create_drupal_basic_version "10_6" ;; "DE1") _create_drupal_basic_version "11_1" ;; "DE2") _create_drupal_basic_version "11_2" ;; "DE3") _create_drupal_basic_version "11_3" ;; *) echo "Unsupported version code: $version_code" ;; esac } # Define distros names and their key-words for configuration declare -A _distros_names=( ["CMS"]="Drupal CMS" ["CK1"]="Commerce v.1" ["CK2"]="Commerce v.2" ["CK3"]="Commerce v.3" ["DXP"]="DXPR Marketing" ["EZC"]="EzContent" ["FOS"]="farmOS" ["LGV"]="LocalGov" ["OCS"]="OpenCulturas" ["OFD"]="OpenFed" ["OLS"]="OpenLucius" ["OPG"]="Opigno LMS" ["SCR"]="Sector" ["SOC"]="Social" ["THR"]="Thunder" ["UC6"]="Ubercart" ["UC7"]="Ubercart" ["VB9"]="Varbase" ["VBX"]="Varbase" ["DL6"]="Pressflow" ["DL7"]="Drupal" ["DL9"]="Drupal" ["DX0"]="Drupal" ["DX1"]="Drupal" ["DX2"]="Drupal" ["DX3"]="Drupal" ["DX4"]="Drupal" ["DX5"]="Drupal" ["DX6"]="Drupal" ["DE1"]="Drupal" ["DE2"]="Drupal" ["DE3"]="Drupal" ) # Define distros versions for configuration declare -A _distros_versions=( ["CMS"]="2.0.0" ["CK1"]="2.77" ["CK2"]="2.40" ["CK3"]="3.2.0" ["DXP"]="10.3.0" ["EZC"]="2.2.15" ["FOS"]="3.5.1" ["LGV"]="3.4.0" ["OCS"]="2.5.4" ["OFD"]="12.2.4" ["OLS"]="2.0.0" ["OPG"]="3.1.0" ["SCR"]="11.0.x-dev" ["SOC"]="12.4.5" ["THR"]="8.3.1" ["UC6"]="2.15" ["UC7"]="3.13" ["VB9"]="9.1.13" ["VBX"]="10.1.0" ["DL6"]="${_SMALLCORE6_V}" ["DL7"]="${_SMALLCORE7_V}" ["DL9"]="${_SMALLCORE9_V}" ["DX0"]="${_SMALLCORE10_0_V}" ["DX1"]="${_SMALLCORE10_1_V}" ["DX2"]="${_SMALLCORE10_2_V}" ["DX3"]="${_SMALLCORE10_3_V}" ["DX4"]="${_SMALLCORE10_4_V}" ["DX5"]="${_SMALLCORE10_5_V}" ["DX6"]="${_SMALLCORE10_6_V}" ["DE1"]="${_SMALLCORE11_1_V}" ["DE2"]="${_SMALLCORE11_2_V}" ["DE3"]="${_SMALLCORE11_3_V}" ) # Define distros Drupal cores versions for configuration declare -A _distros_drupal_cores=( ["CMS"]="${_SMALLCORE11_3_V}" ["CK1"]="${_SMALLCORE7_V}" ["CK2"]="${_SMALLCORE10_1_V}" ["CK3"]="${_SMALLCORE11_3_V}" ["DXP"]="10.3.6" ["EZC"]="10.3.6" ["FOS"]="10.6.2" ["LGV"]="${_SMALLCORE10_6_V}" ["OCS"]="${_SMALLCORE10_5_V}" ["OFD"]="10.2.10" ["OLS"]="${_SMALLCORE9_V}" ["OPG"]="${_SMALLCORE9_V}" ["SCR"]="${_SMALLCORE11_3_V}" ["SOC"]="10.2.10" ["THR"]="${_SMALLCORE11_3_V}" ["UC6"]="${_SMALLCORE6_V}" ["UC7"]="${_SMALLCORE7_V}" ["VB9"]="10.6.1" ["VBX"]="11.3.1" ["DL6"]="${_SMALLCORE6_V}" ["DL7"]="${_SMALLCORE7_V}" ["DL9"]="${_SMALLCORE9_V}" ["DX0"]="${_SMALLCORE10_0_V}" ["DX1"]="${_SMALLCORE10_1_V}" ["DX2"]="${_SMALLCORE10_2_V}" ["DX3"]="${_SMALLCORE10_3_V}" ["DX4"]="${_SMALLCORE10_4_V}" ["DX5"]="${_SMALLCORE10_5_V}" ["DX6"]="${_SMALLCORE10_6_V}" ["DE1"]="${_SMALLCORE11_1_V}" ["DE2"]="${_SMALLCORE11_2_V}" ["DE3"]="${_SMALLCORE11_3_V}" ) # Define distros profiles names for configuration declare -A _distros_profiles_names=( ["CMS"]="drupal_cms_installer" ["CK1"]="commerce_kickstart" ["CK2"]="commerce_base" ["CK3"]="commerce_kickstart" ["DXP"]="dxpr_marketing_cms" ["EZC"]="ezcontent" ["FOS"]="farm" ["LGV"]="localgov" ["OCS"]="openculturas" ["OFD"]="openfed" ["OLS"]="openlucius" ["OPG"]="opigno_lms" ["SCR"]="sector" ["SOC"]="social" ["THR"]="thunder" ["UC6"]="uberdrupal" ["UC7"]="minimal" ["VB9"]="varbase" ["VBX"]="varbase" ["DL6"]="default" ["DL7"]="standard" ["DL9"]="standard" ["DX0"]="standard" ["DX1"]="standard" ["DX2"]="standard" ["DX3"]="standard" ["DX4"]="standard" ["DX5"]="standard" ["DX6"]="standard" ["DE1"]="standard" ["DE2"]="standard" ["DE3"]="standard" ) # Define distros profiles paths for configuration declare -A _distros_profiles_paths=( ["CMS"]="/" ["CK1"]="/" ["CK2"]="contrib/" ["CK3"]="contrib/" ["DXP"]="contrib/" ["EZC"]="contrib/" ["FOS"]="/" ["LGV"]="contrib/" ["OCS"]="contrib/" ["OFD"]="contrib/" ["OLS"]="contrib/" ["OPG"]="contrib/" ["SCR"]="contrib/" ["SOC"]="contrib/" ["THR"]="contrib/" ["UC6"]="/" ["UC7"]="/" ["VB9"]="/" ["VBX"]="contrib/" ["DL6"]="/" ["DL7"]="/" ["DL9"]="/" ["DX0"]="/" ["DX1"]="/" ["DX2"]="/" ["DX3"]="/" ["DX4"]="/" ["DX5"]="/" ["DX6"]="/" ["DE1"]="/" ["DE2"]="/" ["DE3"]="/" ) # Define distros web dirs for configuration declare -A _distros_web_dirs=( ["CMS"]="/web" ["CK1"]="" ["CK2"]="/web" ["CK3"]="/web" ["DXP"]="/web" ["EZC"]="/web" ["FOS"]="/web" ["LGV"]="/web" ["OCS"]="/web" ["OFD"]="/docroot" ["OLS"]="/web" ["OPG"]="/web" ["SCR"]="/web" ["SOC"]="/html" ["THR"]="/docroot" ["UC6"]="" ["UC7"]="" ["VB9"]="/docroot" ["VBX"]="/docroot" ["DL6"]="" ["DL7"]="" ["DL9"]="/web" ["DX0"]="/web" ["DX1"]="/web" ["DX2"]="/web" ["DX3"]="/web" ["DX4"]="/web" ["DX5"]="/web" ["DX6"]="/web" ["DE1"]="/web" ["DE2"]="/web" ["DE3"]="/web" ) # Define distros names and their URLs for information declare -A _distros_urls=( ["CMS"]="https://new.drupal.org/drupal-cms" ["CK1"]="${_urlPrt}/commerce_kickstart" ["CK2"]="${_urlPrt}/commerce" ["CK3"]="${_urlPrt}/commerce_kickstart" ["DXP"]="${_urlPrt}/dxpr_marketing_cms" ["EZC"]="${_urlPrt}/ezcontent" ["FOS"]="${_urlPrt}/farm" ["LGV"]="${_urlPrt}/localgov" ["OCS"]="${_urlPrt}/openculturas" ["OFD"]="${_urlPrt}/openfed" ["OLS"]="${_urlPrt}/openlucius" ["OPG"]="${_urlPrt}/opigno_lms" ["SCR"]="${_urlPrt}/sector" ["SOC"]="${_urlPrt}/social" ["THR"]="${_urlPrt}/thunder" ["UC6"]="${_urlPrt}/ubercart" ["UC7"]="${_urlPrt}/ubercart" ["VB9"]="${_urlPrt}/varbase" ["VBX"]="${_urlPrt}/varbase" ["DL6"]="${_urlPrt}/drupal/releases/${_SMALLCORE6_V}" ["DL7"]="${_urlPrt}/drupal/releases/${_SMALLCORE7_V}" ["DL9"]="${_urlPrt}/drupal/releases/${_SMALLCORE9_V}" ["DX0"]="${_urlPrt}/drupal/releases/${_SMALLCORE10_0_V}" ["DX1"]="${_urlPrt}/drupal/releases/${_SMALLCORE10_1_V}" ["DX2"]="${_urlPrt}/drupal/releases/${_SMALLCORE10_2_V}" ["DX3"]="${_urlPrt}/drupal/releases/${_SMALLCORE10_3_V}" ["DX4"]="${_urlPrt}/drupal/releases/${_SMALLCORE10_4_V}" ["DX5"]="${_urlPrt}/drupal/releases/${_SMALLCORE10_5_V}" ["DX6"]="${_urlPrt}/drupal/releases/${_SMALLCORE10_6_V}" ["DE1"]="${_urlPrt}/drupal/releases/${_SMALLCORE11_1_V}" ["DE2"]="${_urlPrt}/drupal/releases/${_SMALLCORE11_2_V}" ["DE3"]="${_urlPrt}/drupal/releases/${_SMALLCORE11_3_V}" ) # Define distros names and their compatible max PHP versions for information declare -A _distros_php_versions=( ["CMS"]="8.4" ["CK1"]="7.4" ["CK2"]="8.3" ["CK3"]="8.4" ["DXP"]="8.3" ["EZC"]="8.3" ["FOS"]="8.3" ["LGV"]="8.3" ["OCS"]="8.3" ["OFD"]="8.3" ["OLS"]="8.3" ["OPG"]="8.3" ["SCR"]="8.4" ["SOC"]="8.3" ["THR"]="8.4" ["UC6"]="7.4" ["UC7"]="7.4" ["VB9"]="8.3" ["VBX"]="8.4" ["DL6"]="7.4" ["DL7"]="8.3" ["DL9"]="8.3" ["DX0"]="8.3" ["DX1"]="8.3" ["DX2"]="8.3" ["DX3"]="8.3" ["DX4"]="8.3" ["DX5"]="8.3" ["DX6"]="8.3" ["DE1"]="8.4" ["DE2"]="8.4" ["DE3"]="8.4" ) _commerce_7_2_install() { ###---### Commerce 7.x-2.x # # Declare 'params' as local to the function local -A params=( [dist]="$1" [version]="$2" [core_version]="$3" [description]="$4" [profile_path]="$5" [profile_name]="$6" [web_dir]="$7" [php_version]="$8" [url]="$9" ) if [ "${_DEBUG_MODE}" = "YES" ]; then _msg "DEBUG: _commerce_7_2_install" for key in "${!params[@]}"; do _msg "DEBUG: _commerce_7_2_install ${key} is '${params[$key]}'" done fi # /data/disk/o8/distro/001/commerce_kickstart-2.77-7.105.1 _REAL_PRNAME="${params[profile_name]}" _SHRD_PLNAME="${params[profile_name]}-${params[version]}-${params[core_version]}" _SHRD_PLPATH="${_CORE}/${_SHRD_PLNAME}" _SHRD_PRPATH="${_SHRD_PLPATH}/profiles/${_REAL_PRNAME}" _OCTO_PLPATH="${_pthDst}/${_SHRD_PLNAME}" if [ "${_ALLOW_ALL}" = "YES" ]; then if [[ "${_PLATFORMS_LIST}" =~ ALL ]] \ || [[ "${_PLATFORMS_LIST}" =~ ${params[dist]} ]]; then if [ ! -d "${_OCTO_PLPATH}" ]; then if _prompt_yes_no "${params[description]} - ${params[url]}" ; then true [ "${_DEBUG_MODE}" = "YES" ] && _msg "DISTRO: ${params[description]} ${_yOk}" if [ ! -d "${_SHRD_PLPATH}" ]; then cd ${_CORE} if [ "${_DL_MODE}" = "GIT" ] \ && [ "${_T_BUILD}" = "SRC" ]; then if [ ! -e "${_D7_CORE_DIR}" ]; then _prepare_drupal7_core fi [ "${_DEBUG_MODE}" = "YES" ] && _msg "DEBUG: _get_distro_ext '${params[profile_name]}-7.x-${params[version]}-core.tar.gz'" _get_distro_ext "${params[profile_name]}-7.x-${params[version]}-core.tar.gz" if [ -d "${_CORE}/commerce-7.x-${params[version]}" ]; then mv -f commerce-7.x-${params[version]} ${_SHRD_PLNAME} elif [ -d "${_CORE}/${_REAL_PRNAME}-7.x-${params[version]}" ]; then mv -f ${_REAL_PRNAME}-7.x-${params[version]} ${_SHRD_PLNAME} fi _nocore_d7_dist_clean _remove_default_core_seven_profiles _upgrade_contrib_less else [ "${_DEBUG_MODE}" = "YES" ] && _msg "DEBUG: _get_distro_ext '${_SHRD_PLNAME}.tar.gz'" _get_distro_ext "${_SHRD_PLNAME}.tar.gz" fi fi _init_this_distro_root _msg "DISTRO: ${params[description]} installed" [ "${_DEBUG_MODE}" = "YES" ] && _msg "DEBUG: _save_verify_this_platform '${1}' '${2}' '${3}' '${params[description]}' '${5}' '${6}' '${7}'" _save_verify_this_platform "${1}" "${2}" "${3}" "${params[description]}" "${5}" "${6}" "${7}" else [ "${_DEBUG_MODE}" = "YES" ] && _msg "DISTRO: ${params[description]} ${_noT}" fi fi fi fi } _ubercart6_install() { ###---### Ubercart 2 # # Declare 'params' as local to the function local -A params=( [dist]="$1" [version]="$2" [core_version]="$3" [description]="$4" [profile_path]="$5" [profile_name]="$6" [web_dir]="$7" [php_version]="$8" [url]="$9" ) if [ "${_DEBUG_MODE}" = "YES" ]; then _msg "DEBUG: _ubercart6_install" for key in "${!params[@]}"; do _msg "DEBUG: _ubercart6_install ${key} is '${params[$key]}'" done fi # /data/disk/o8/distro/001/ubercart-2.15-6.60.1 _REAL_PRNAME="${params[profile_name]}" _VIRT_PRNAME="ubercart" _SHRD_PLNAME="${_VIRT_PRNAME}-${params[version]}-${params[core_version]}" _SHRD_PLPATH="${_CORE}/${_SHRD_PLNAME}" _SHRD_PRPATH="${_SHRD_PLPATH}/profiles/${_REAL_PRNAME}" _OCTO_PLPATH="${_pthDst}/${_SHRD_PLNAME}" if [[ "${_PLATFORMS_LIST}" =~ ALL ]] \ || [[ "${_PLATFORMS_LIST}" =~ ${params[dist]} ]]; then if [ ! -d "${_OCTO_PLPATH}/modules/path_alias_cache" ]; then if _prompt_yes_no "${params[description]} - ${params[url]}" ; then true [ "${_DEBUG_MODE}" = "YES" ] && _msg "DISTRO: ${params[description]} ${_yOk}" if [ ! -d "${_SHRD_PLPATH}" ]; then if [ "${_DL_MODE}" = "GIT" ] \ && [ "${_T_BUILD}" = "SRC" ]; then cd ${_CORE} if [ ! -e "${_D6_CORE_DIR}" ]; then _prepare_drupal6_core fi mkdir -p ${_SHRD_PLPATH} _nocore_d6_dist_clean rm -rf ${_SHRD_PLPATH}/profiles/default cd ${_SHRD_PLPATH}/profiles _get_dev_contrib "uberdrupal.tar.gz" cd ${_CORE} mkdir -p ${_SHRD_PRPATH}/{modules,themes,libraries} cd ${_SHRD_PRPATH}/libraries _get_dev_contrib "colorbox-1.3.18.zip" cd ${_SHRD_PRPATH}/modules _get_dev_contrib "admin_menu-6.x-3.x-dev.tar.gz" _get_dev_contrib "cck-6.x-3.0-alpha4.tar.gz" _get_dev_contrib "colorbox-6.x-1.4.tar.gz" _get_dev_contrib "date-6.x-2.9.tar.gz" _get_dev_contrib "filefield-6.x-3.14.tar.gz" _get_dev_contrib "google_analytics-6.x-4.3.tar.gz" _get_dev_contrib "imageapi-6.x-1.10.tar.gz" _get_dev_contrib "imagecache-6.x-2.x-dev.tar.gz" _get_dev_contrib "imagefield-6.x-3.11.tar.gz" _get_dev_contrib "jquery_update-6.x-2.0-alpha1.tar.gz" _get_dev_contrib "libraries-6.x-1.0.tar.gz" _get_dev_contrib "lightbox2-6.x-1.x-dev.tar.gz" _get_dev_contrib "rules-6.x-1.5.tar.gz" _get_dev_contrib "skinr-6.x-1.7.tar.gz" _get_dev_contrib "token-6.x-1.19.tar.gz" _get_dev_contrib "ubercart-6.x-${params[version]}.tar.gz" _get_dev_contrib "views-6.x-3.3.tar.gz" _get_dev_contrib "webform-6.x-3.23.tar.gz" ### https://drupal.org/node/1167276#comment-5138248 cd ${_SHRD_PRPATH}/modules/${_VIRT_PRNAME} patch -p1 < ${_pthPch}/${_VIRT_PRNAME}-1167276-reroll.patch &> /dev/null cd ${_SHRD_PRPATH}/modules/imagecache # https://drupal.org/node/1243258#comment-4850634 patch -p1 < ${_pthPch}/imagecache-1243258-5.patch &> /dev/null cd ${_SHRD_PRPATH}/themes _get_dev_contrib "fusion-6.x-1.x-dev.tar.gz" _get_dev_contrib "acquia_prosper-6.x-1.1.tar.gz" else cd ${_CORE} [ "${_DEBUG_MODE}" = "YES" ] && _msg "DEBUG: _get_distro_ext '${_SHRD_PLNAME}.tar.gz'" _get_distro_ext "${_SHRD_PLNAME}.tar.gz" fi fi _init_this_distro_root _msg "DISTRO: ${params[description]} installed" [ "${_DEBUG_MODE}" = "YES" ] && _msg "DEBUG: _save_verify_this_platform '${1}' '${2}' '${3}' '${params[description]}' '${5}' '${6}' '${7}'" _save_verify_this_platform "${1}" "${2}" "${3}" "${params[description]}" "${5}" "${6}" "${7}" else [ "${_DEBUG_MODE}" = "YES" ] && _msg "DISTRO: ${params[description]} ${_noT}" fi fi fi } _ubercart7_install() { ###---### Ubercart 3 # # Declare 'params' as local to the function local -A params=( [dist]="$1" [version]="$2" [core_version]="$3" [description]="$4" [profile_path]="$5" [profile_name]="$6" [web_dir]="$7" [php_version]="$8" [url]="$9" ) if [ "${_DEBUG_MODE}" = "YES" ]; then _msg "DEBUG: _ubercart7_install" for key in "${!params[@]}"; do _msg "DEBUG: _ubercart7_install ${key} is '${params[$key]}'" done fi # /data/disk/o8/distro/001/ubercart-3.13-7.105.1 _REAL_PRNAME="${params[profile_name]}" _VIRT_PRNAME="ubercart" _SHRD_PLNAME="${_VIRT_PRNAME}-${params[version]}-${params[core_version]}" _SHRD_PLPATH="${_CORE}/${_SHRD_PLNAME}" _SHRD_PRPATH="${_SHRD_PLPATH}/profiles/${_REAL_PRNAME}" _OCTO_PLPATH="${_pthDst}/${_SHRD_PLNAME}" if [ "${_ALLOW_ALL}" = "YES" ]; then if [[ "${_PLATFORMS_LIST}" =~ ALL ]] \ || [[ "${_PLATFORMS_LIST}" =~ ${params[dist]} ]]; then if [ ! -d "${_OCTO_PLPATH}" ]; then if _prompt_yes_no "${params[description]} - ${params[url]}" ; then true [ "${_DEBUG_MODE}" = "YES" ] && _msg "DISTRO: ${params[description]} ${_yOk}" if [ ! -d "${_SHRD_PLPATH}" ]; then cd ${_CORE} if [ "${_DL_MODE}" = "GIT" ] \ && [ "${_T_BUILD}" = "SRC" ]; then if [ ! -e "${_D7_CORE_DIR}" ]; then _prepare_drupal7_core fi mkdir -p ${_SHRD_PLPATH} _nocore_d7_dist_clean rm -rf ${_SHRD_PLPATH}/profiles/standard rm -rf ${_SHRD_PLPATH}/profiles/testing sed -i "s/version = VERSION/version = \"${_SMALLCORE7_V}\"/g" \ ${_SHRD_PLPATH}/profiles/minimal/minimal.info &> /dev/null mkdir -p ${_SHRD_PRPATH}/libraries cd ${_SHRD_PRPATH}/libraries _get_dev_contrib "colorbox-1.5.13.zip" if [ -d "colorbox-master" ]; then mv -f colorbox-master colorbox fi mkdir -p ${_SHRD_PRPATH}/modules cd ${_SHRD_PRPATH}/modules _get_dev_contrib "colorbox-7.x-2.13.tar.gz" _get_dev_contrib "ctools-7.x-1.21.tar.gz" _get_dev_contrib "entity-7.x-1.12.tar.gz" _get_dev_contrib "google_analytics-7.x-2.6.tar.gz" _get_dev_contrib "libraries-7.x-2.5.tar.gz" _get_dev_contrib "pathauto-7.x-1.3.tar.gz" _get_dev_contrib "rules-7.x-2.12.tar.gz" _get_dev_contrib "token-7.x-1.7.tar.gz" _get_dev_contrib "ubercart-7.x-${params[version]}.tar.gz" _get_dev_contrib "views-7.x-3.30.tar.gz" cd ${_SHRD_PRPATH}/modules/views # https://drupal.org/node/1766338#comment-6445882 patch -p1 < \ ${_pthPch}/views-revert-broken-filter-or-groups-1766338-7.patch &> /dev/null # https://drupal.org/node/2037469 patch -p1 < \ ${_pthPch}/views-exposed-sorts-2037469-1.patch &> /dev/null else [ "${_DEBUG_MODE}" = "YES" ] && _msg "DEBUG: _get_distro_ext '${_SHRD_PLNAME}.tar.gz'" _get_distro_ext "${_SHRD_PLNAME}.tar.gz" fi fi _init_this_distro_root _msg "DISTRO: ${params[description]} installed" [ "${_DEBUG_MODE}" = "YES" ] && _msg "DEBUG: _save_verify_this_platform '${1}' '${2}' '${3}' '${params[description]}' '${5}' '${6}' '${7}'" _save_verify_this_platform "${1}" "${2}" "${3}" "${params[description]}" "${5}" "${6}" "${7}" # _save_verify_this_platform 'UC7' '3.13' '7.105.1' 'ubercart-3.13-7.105.1' '/' 'minimal' '' else [ "${_DEBUG_MODE}" = "YES" ] && _msg "DISTRO: ${params[description]} ${_noT}" fi fi fi fi } _d_dist_custom_platform_install() { ###---### Template function for distros-custom-type platforms # # Declare 'params' as local to the function local -A params=( [dist]="$1" [version]="$2" [core_version]="$3" [description]="$4" [profile_path]="$5" [profile_name]="$6" [web_dir]="$7" [php_version]="$8" [url]="$9" ) if [ "${_DEBUG_MODE}" = "YES" ]; then _msg "DEBUG: _d_dist_custom_platform_install" for key in "${!params[@]}"; do _msg "DEBUG: _d_dist_custom_platform_install ${key} is '${params[$key]}'" done fi if [[ "${1}" == "CK1" ]]; then _commerce_7_2_install "${1}" "${2}" "${3}" "${4}" "${5}" "${6}" "${7}" "${8}" "${9}" elif [[ "${1}" == "UC6" ]]; then _ubercart6_install "${1}" "${2}" "${3}" "${4}" "${5}" "${6}" "${7}" "${8}" "${9}" elif [[ "${1}" == "UC7" ]]; then _ubercart7_install "${1}" "${2}" "${3}" "${4}" "${5}" "${6}" "${7}" "${8}" "${9}" fi } _d_dist_platform_install() { ###---### Template function for distros-type platforms # # Declare 'params' as local to the function local -A params=( [dist]="$1" [version]="$2" [core_version]="$3" [description]="$4" [profile_path]="$5" [profile_name]="$6" [web_dir]="$7" [php_version]="$8" [url]="$9" ) if [ "${_DEBUG_MODE}" = "YES" ]; then _msg "DEBUG: _d_dist_platform_install" for key in "${!params[@]}"; do _msg "DEBUG: _d_dist_platform_install ${key} is '${params[$key]}'" done fi # Access parameters by name _REAL_PRNAME="${params[profile_name]}" _DIST_PLNAME="${params[profile_name]}-${params[version]}-${params[core_version]}" _DIST_PLPATH="${_CORE}/${_DIST_PLNAME}" _DIST_PRPATH="${_DIST_PLPATH}/profiles/${params[profile_path]}${params[profile_name]}" _OCTO_PLPATH="${_pthDst}/${_DIST_PLNAME}${7}" if [ "${_ALLOW_ALL}" = "YES" ]; then if [[ "${_PLATFORMS_LIST}" =~ ALL ]] \ || [[ "${_PLATFORMS_LIST}" =~ ${params[dist]} ]]; then if [ ! -d "${_OCTO_PLPATH}" ]; then if _prompt_yes_no "${params[description]} - ${params[url]}" ; then true [ "${_DEBUG_MODE}" = "YES" ] && _msg "DISTRO: ${params[description]} ${_yOk}" if [ ! -d "${_OCTO_PLPATH}" ]; then cd ${_pthDst} [ "${_DEBUG_MODE}" = "YES" ] && _msg "DEBUG: _get_distro_ext '${_DIST_PLNAME}.tar.gz'" _get_distro_ext "${_DIST_PLNAME}.tar.gz" fi if [ -d "${_OCTO_PLPATH}" ]; then _msg "DISTRO: ${params[description]} installed" [ "${_DEBUG_MODE}" = "YES" ] && _msg "DEBUG: _save_verify_this_platform '${1}' '${2}' '${3}' '${params[description]}' '${5}' '${6}' '${7}'" _save_verify_this_platform "${1}" "${2}" "${3}" "${params[description]}" "${5}" "${6}" "${7}" fi else [ "${_DEBUG_MODE}" = "YES" ] && _msg "DISTRO: ${params[description]} ${_noT}" fi fi fi fi } _d_core_platform_install() { ###---### Template function for core-only-type platforms # if [ "${1}" = "DE1" ]; then _CORE_DEV="${_DRUPAL11_1_D}" _CORE_STG="${_DRUPAL11_1_S}" _CORE_PRD="${_DRUPAL11_1_P}" elif [ "${1}" = "DE2" ]; then _CORE_DEV="${_DRUPAL11_2_D}" _CORE_STG="${_DRUPAL11_2_S}" _CORE_PRD="${_DRUPAL11_2_P}" elif [ "${1}" = "DE3" ]; then _CORE_DEV="${_DRUPAL11_3_D}" _CORE_STG="${_DRUPAL11_3_S}" _CORE_PRD="${_DRUPAL11_3_P}" elif [ "${1}" = "DX6" ]; then _CORE_DEV="${_DRUPAL10_6_D}" _CORE_STG="${_DRUPAL10_6_S}" _CORE_PRD="${_DRUPAL10_6_P}" elif [ "${1}" = "DX5" ]; then _CORE_DEV="${_DRUPAL10_5_D}" _CORE_STG="${_DRUPAL10_5_S}" _CORE_PRD="${_DRUPAL10_5_P}" elif [ "${1}" = "DX4" ]; then _CORE_DEV="${_DRUPAL10_4_D}" _CORE_STG="${_DRUPAL10_4_S}" _CORE_PRD="${_DRUPAL10_4_P}" elif [ "${1}" = "DX3" ]; then _CORE_DEV="${_DRUPAL10_3_D}" _CORE_STG="${_DRUPAL10_3_S}" _CORE_PRD="${_DRUPAL10_3_P}" elif [ "${1}" = "DX2" ]; then _CORE_DEV="${_DRUPAL10_2_D}" _CORE_STG="${_DRUPAL10_2_S}" _CORE_PRD="${_DRUPAL10_2_P}" elif [ "${1}" = "DX1" ]; then _CORE_DEV="${_DRUPAL10_1_D}" _CORE_STG="${_DRUPAL10_1_S}" _CORE_PRD="${_DRUPAL10_1_P}" elif [ "${1}" = "DX0" ]; then _CORE_DEV="${_DRUPAL10_0_D}" _CORE_STG="${_DRUPAL10_0_S}" _CORE_PRD="${_DRUPAL10_0_P}" elif [ "${1}" = "DL9" ]; then _CORE_DEV="${_DRUPAL9_D}" _CORE_STG="${_DRUPAL9_S}" _CORE_PRD="${_DRUPAL9_P}" elif [ "${1}" = "DL7" ]; then _CORE_DEV="${_DRUPAL7_D}" _CORE_STG="${_DRUPAL7_S}" _CORE_PRD="${_DRUPAL7_P}" elif [ "${1}" = "DL6" ]; then _CORE_DEV="${_DRUPAL6_D}" _CORE_STG="${_DRUPAL6_S}" _CORE_PRD="${_DRUPAL6_P}" fi # Declare 'params' as local to the function local -A params=( [dist]="$1" [version]="$2" [core_version]="$3" [description]="$4" [profile_path]="$5" [profile_name]="$6" [web_dir]="$7" [php_version]="$8" [url]="$9" ) if [ "${_DEBUG_MODE}" = "YES" ]; then _msg "DEBUG: _d_core_platform_install" for key in "${!params[@]}"; do _msg "DEBUG: _d_core_platform_install ${key} is '${params[$key]}'" done fi # Access parameters by name _REAL_PRNAME="${params[profile_name]}" if [[ "${_PLATFORMS_LIST}" =~ ALL ]] \ || [[ "${_PLATFORMS_LIST}" =~ ${params[dist]} ]]; then if [ ! -d "${_pthDst}/${_CORE_DEV}" ]; then if _prompt_yes_no "${params[description]} - ${params[url]}" ; then true ###---### Drupal Core-Only Development # _SHRD_PLNAME="${_CORE_DEV}" [[ "${1}" =~ DL7 || "${1}" =~ DL6 ]] && _SHRD_PLPATH="${_CORE}/${_SHRD_PLNAME}" [[ "${1}" =~ DL7 || "${1}" =~ DL6 ]] && _SHRD_PRPATH="${_SHRD_PLPATH}/profiles/${_REAL_PRNAME}" _OCTO_PLPATH="${_pthDst}/${_SHRD_PLNAME}" [ "${_DEBUG_MODE}" = "YES" ] && _msg "DISTRO: ${params[description]} [D.${_THIS_CORE}] ${_yOk}" _create_drupal_core_basic "${params[dist]}" if [ -d "${_OCTO_PLPATH}" ]; then _msg "DISTRO: ${params[description]} [D.${_THIS_CORE}] installed" [ "${_DEBUG_MODE}" = "YES" ] && _msg "DEBUG: _save_verify_this_platform '${1}' '${_SHRD_PLNAME}' '${3}' '${params[description]} [D.${_THIS_CORE}]' '${5}' '${6}' '${7}'" _save_verify_this_platform "${1}" "${_SHRD_PLNAME}" "${3}" "${params[description]} [D.${_THIS_CORE}]" "${5}" "${6}" "${7}" fi ###---### Drupal Core-Only Staging # _SHRD_PLNAME="${_CORE_STG}" [[ "${1}" =~ DL7 || "${1}" =~ DL6 ]] && _SHRD_PLPATH="${_CORE}/${_SHRD_PLNAME}" [[ "${1}" =~ DL7 || "${1}" =~ DL6 ]] && _SHRD_PRPATH="${_SHRD_PLPATH}/profiles/${_REAL_PRNAME}" _OCTO_PLPATH="${_pthDst}/${_SHRD_PLNAME}" [ "${_DEBUG_MODE}" = "YES" ] && _msg "DISTRO: ${params[description]} [S.${_THIS_CORE}] ${_yOk}" _create_drupal_core_basic "${params[dist]}" if [ -d "${_OCTO_PLPATH}" ]; then _msg "DISTRO: ${params[description]} [S.${_THIS_CORE}] installed" [ "${_DEBUG_MODE}" = "YES" ] && _msg "DEBUG: _save_verify_this_platform '${1}' '${_SHRD_PLNAME}' '${3}' '${params[description]} [S.${_THIS_CORE}]' '${5}' '${6}' '${7}'" _save_verify_this_platform "${1}" "${_SHRD_PLNAME}" "${3}" "${params[description]} [S.${_THIS_CORE}]" "${5}" "${6}" "${7}" fi ###---### Drupal Core-Only Production # _SHRD_PLNAME="${_CORE_PRD}" [[ "${1}" =~ DL7 || "${1}" =~ DL6 ]] && _SHRD_PLPATH="${_CORE}/${_SHRD_PLNAME}" [[ "${1}" =~ DL7 || "${1}" =~ DL6 ]] && _SHRD_PRPATH="${_SHRD_PLPATH}/profiles/${_REAL_PRNAME}" _OCTO_PLPATH="${_pthDst}/${_SHRD_PLNAME}" [ "${_DEBUG_MODE}" = "YES" ] && _msg "DISTRO: ${params[description]} [P.${_THIS_CORE}] ${_yOk}" _create_drupal_core_basic "${params[dist]}" if [ -d "${_OCTO_PLPATH}" ]; then _msg "DISTRO: ${params[description]} [P.${_THIS_CORE}] installed" [ "${_DEBUG_MODE}" = "YES" ] && _msg "DEBUG: _save_verify_this_platform '${1}' '${_SHRD_PLNAME}' '${3}' '${params[description]} [P.${_THIS_CORE}]' '${5}' '${6}' '${7}'" _save_verify_this_platform "${1}" "${_SHRD_PLNAME}" "${3}" "${params[description]} [P.${_THIS_CORE}]" "${5}" "${6}" "${7}" fi else [ "${_DEBUG_MODE}" = "YES" ] && _msg "DISTRO: ${params[description]} ${_noT}" fi fi fi } _d_dist_loop() { # Loop through the _distros_names for _dist in "${!_distros_names[@]}"; do _d_name="${_distros_names[${_dist}]}" _d_vers="${_distros_versions[${_dist}]}" _d_core="${_distros_drupal_cores[${_dist}]}" _d_desc="${_d_name} ${_d_vers} ${_d_core} [${_THIS_CORE}]" _d_xdes="${_d_name} ${_d_vers}" _d_ppth="${_distros_profiles_paths[${_dist}]}" _d_prfn="${_distros_profiles_names[${_dist}]}" _d_webd="${_distros_web_dirs[${_dist}]}" _d_phpv="${_distros_php_versions[${_dist}]}" _d_xurl="${_distros_urls[${_dist}]}" if [[ "${_dist}" =~ DL || "${_dist}" =~ DX || "${_dist}" =~ DE ]]; then _d_core_platform_install "${_dist}" "${_d_vers}" "${_d_core}" "${_d_xdes}" "${_d_ppth}" "${_d_prfn}" "${_d_webd}" "${_d_phpv}" "${_d_xurl}" elif [[ "${_dist}" =~ CK1 || "${_dist}" =~ UC ]]; then _d_dist_custom_platform_install "${_dist}" "${_d_vers}" "${_d_core}" "${_d_desc}" "${_d_ppth}" "${_d_prfn}" "${_d_webd}" "${_d_phpv}" "${_d_xurl}" else _d_dist_platform_install "${_dist}" "${_d_vers}" "${_d_core}" "${_d_desc}" "${_d_ppth}" "${_d_prfn}" "${_d_webd}" "${_d_phpv}" "${_d_xurl}" fi done } ### ###---### Action starts here. ### ###---### Prepare D6 and D7 shared core # _prepare_drupal6_core _prepare_drupal7_core # Prepare _prepare_for_save_verify_platforms # Loop _d_dist_loop ###---### Remove some unused core files. # if [ "${_DEBUG_MODE}" = "YES" ]; then echo " " _msg "${_STATUS} C: Removing some unused core files..." fi if [[ "${_CORE}" =~ "/data/all/" ]]; then rm -rf ${_CORE}/*/scripts rm -f ${_CORE}/*{.make,.tar,.tar.gz,.zip} fi [ -e "${_THIS_HM}/make_platform.php" ] && rm -f ${_THIS_HM}/make_platform.php [ -e "${_THIS_HM}/make_client.php" ] && rm -f ${_THIS_HM}/make_client.php [ -e "${_THIS_HM}/make_home.php" ] && rm -f ${_THIS_HM}/make_home.php cd ${_CORE} ###----------------------------------------### ### ### Octopus Ægir Installer ### Copyright (C) 2009-2026 Omega8.cc ### noc@omega8.cc www.omega8.cc ### ###----------------------------------------### ================================================ FILE: aegir/scripts/AegirSetupM.sh.txt ================================================ #!/bin/bash ###----------------------------------------### ### ### Barracuda Ægir Installer ### ### Copyright (C) 2009-2026 Omega8.cc ### noc@omega8.cc www.omega8.cc ### ### This program is free software. You can ### redistribute it and/or modify it under ### the terms of the GNU GPL as published by ### the Free Software Foundation, version 2 ### or later. ### ### This program is distributed in the hope ### that it will be useful, but WITHOUT ANY ### WARRANTY; without even the implied ### warranty of MERCHANTABILITY or FITNESS ### FOR A PARTICULAR PURPOSE. See the GNU GPL ### for more details. ### ### You should have received a copy of the ### GNU GPL along with this program. ### If not, see http://www.gnu.org/licenses/ ### ### Code: https://github.com/omega8cc/boa ### ###----------------------------------------### ###----------------------------------------### ### DON'T EDIT ANYTHING BELOW THIS LINE ### ###----------------------------------------### ### ### Default variables ### _bldPth="/opt/tmp/boa" _filIncB="barracuda.sh.cnf" _libFnc="${_bldPth}/lib/functions" _vBs="/var/backups" export _tRee=dev ### ### Panic on missing include ### _panic_exit() { echo echo " EXIT: Required lib file not available?" echo " EXIT: $1" echo " EXIT: Cannot continue" echo " EXIT: Bye (0)" echo touch /opt/tmp/status-AegirSetupM-FAIL exit 1 } ### ### Include default settings and basic functions ### [ -r "${_vBs}/${_filIncB}" ] || _panic_exit "${_vBs}/${_filIncB}" source "${_vBs}/${_filIncB}" ### ### Include shared functions ### _FL="helper master" for f in ${_FL}; do [ -r "${_libFnc}/${f}.sh.inc" ] || _panic_exit "${f}" source "${_libFnc}/${f}.sh.inc" done ### ### Local settings ### if [ "${_THIS_DB_HOST}" = "FQDN" ]; then _THIS_DB_HOST="$(cat /etc/hostname 2>/dev/null | tr -d '\n' || hostname -f 2>/dev/null)" fi if [ "${_PHP_CLI_VERSION}" = "8.4" ] \ && [ -x "/opt/php84/bin/php" ]; then _T_CLI=/opt/php84/bin elif [ "${_PHP_CLI_VERSION}" = "8.5" ] \ && [ -x "/opt/php85/bin/php" ]; then _T_CLI=/opt/php85/bin elif [ "${_PHP_CLI_VERSION}" = "8.3" ] \ && [ -x "/opt/php83/bin/php" ]; then _T_CLI=/opt/php83/bin fi _ROOT="${HOME}" _DRUSHCMD="${_T_CLI}/php ${_ROOT}/drush/drush.php" # PATH=${_T_CLI}:/usr/local/bin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin SHELL=/bin/bash # _crlGet="-L --max-redirs 3 -k -s --retry 9 --retry-delay 9 -A iCab" _wgetGet="--max-redirect=3 --no-check-certificate -q --tries=9 --wait=9 --user-agent='iCab'" _gCb="git clone --branch" _gitHub="https://github.com/omega8cc" _gitLab="https://gitlab.com/omega8cc" # export _urlDev="http://${_USE_MIR}/dev" export _urlHmr="http://${_USE_MIR}/versions/${_tRee}/boa/aegir" ###--------------------### if [ "$(id -u)" -eq 0 ]; then _msg "FATAL ERROR: This script should be run as a non-root user" _msg "FATAL ERROR: Aborting AegirSetupM installer NOW!" touch /opt/tmp/status-AegirSetupM-FAIL exit 1 fi if [ "${_DEBUG_MODE}" = "YES" ]; then _msg "INFO: Installing Ægir Provision backend..." fi _hostmaster_dr_up _provision_backend_up if ${_DRUSHCMD} help | grep "^ provision-install" > /dev/null ; then if [ "${_DEBUG_MODE}" = "YES" ]; then _msg "INFO: Drush test result OK" fi else _msg "FATAL ERROR: Drush is broken (${_DRUSHCMD} help failed)" _msg "FATAL ERROR: Aborting AegirSetupM installer NOW!" touch /opt/tmp/status-AegirSetupM-FAIL exit 1 fi sed -i "s/files.aegir.cc/${_USE_MIR}/g" ${_ROOT}/.drush/sys/provision/aegir.make &> /dev/null if [ "${_DEBUG_MODE}" = "YES" ]; then _msg "INFO: Installing the frontend" fi ${_DRUSHCMD} cc drush >${_ROOT}/install.log 2>&1 rm -rf ${_ROOT}/.tmp/cache _HM_ROOT="${_ROOT}/hostmaster-${_AEGIR_VERSION}" ${_DRUSHCMD} hostmaster-install \ --aegir_host=${_AEGIR_HOST} \ --aegir_db_user=${_AEGIR_DB_USER} \ --aegir_db_pass=${_ESC_PASS} \ --aegir_root=${_ROOT} \ --root=${_HM_ROOT} \ --version=${_AEGIR_VERSION} $@ mkdir -p /var/aegir/backups/system chmod 700 /var/aegir/backups/system _L_SYS="/var/aegir/backups/system/.${_AEGIR_DB_USER}.pass.txt" echo "${_ESC_PASS}" > ${_L_SYS} chmod 0600 ${_L_SYS} ###----------------------------------------### ### ### Barracuda Ægir Installer ### Copyright (C) 2009-2026 Omega8.cc ### noc@omega8.cc www.omega8.cc ### ###----------------------------------------### ================================================ FILE: aegir/scripts/AegirUpgrade.sh.txt ================================================ #!/bin/bash ###----------------------------------------### ### ### Barracuda Ægir Installer ### ### Copyright (C) 2009-2026 Omega8.cc ### noc@omega8.cc www.omega8.cc ### ### This program is free software. You can ### redistribute it and/or modify it under ### the terms of the GNU GPL as published by ### the Free Software Foundation, version 2 ### or later. ### ### This program is distributed in the hope ### that it will be useful, but WITHOUT ANY ### WARRANTY; without even the implied ### warranty of MERCHANTABILITY or FITNESS ### FOR A PARTICULAR PURPOSE. See the GNU GPL ### for more details. ### ### You should have received a copy of the ### GNU GPL along with this program. ### If not, see http://www.gnu.org/licenses/ ### ### Code: https://github.com/omega8cc/boa ### ###----------------------------------------### ###----------------------------------------### ### DON'T EDIT ANYTHING BELOW THIS LINE ### ###----------------------------------------### ### ### Default variables ### _bldPth="/opt/tmp/boa" _filIncB="barracuda.sh.cnf" _libFnc="${_bldPth}/lib/functions" _vBs="/var/backups" export _tRee=dev ### ### Panic on missing include ### _panic_exit() { echo echo " EXIT: Required lib file not available?" echo " EXIT: $1" echo " EXIT: Cannot continue" echo " EXIT: Bye (0)" echo touch /opt/tmp/status-AegirUpgrade-FAIL exit 1 } ### ### Include default settings and basic functions ### [ -r "${_vBs}/${_filIncB}" ] || _panic_exit "${_vBs}/${_filIncB}" source "${_vBs}/${_filIncB}" ### ### Include shared functions ### _FL="helper master" for f in ${_FL}; do [ -r "${_libFnc}/${f}.sh.inc" ] || _panic_exit "${f}" source "${_libFnc}/${f}.sh.inc" done ### ### Local settings ### if [ "${_THIS_DB_HOST}" = "FQDN" ]; then _THIS_DB_HOST="$(cat /etc/hostname 2>/dev/null | tr -d '\n' || hostname -f 2>/dev/null)" fi if [ "${_PHP_CLI_VERSION}" = "8.4" ] \ && [ -x "/opt/php84/bin/php" ]; then _T_CLI=/opt/php84/bin elif [ "${_PHP_CLI_VERSION}" = "8.5" ] \ && [ -x "/opt/php85/bin/php" ]; then _T_CLI=/opt/php85/bin elif [ "${_PHP_CLI_VERSION}" = "8.3" ] \ && [ -x "/opt/php83/bin/php" ]; then _T_CLI=/opt/php83/bin fi _ROOT="${HOME}" _DRUSHCMD="${_T_CLI}/php ${_ROOT}/drush/drush.php" # PATH=${_T_CLI}:/usr/local/bin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin SHELL=/bin/bash # _crlGet="-L --max-redirs 3 -k -s --retry 9 --retry-delay 9 -A iCab" _wgetGet="--max-redirect=3 --no-check-certificate -q --tries=9 --wait=9 --user-agent='iCab'" _gCb="git clone --branch" _gitHub="https://github.com/omega8cc" _gitLab="https://gitlab.com/omega8cc" # export _urlDev="http://${_USE_MIR}/dev" export _urlHmr="http://${_USE_MIR}/versions/${_tRee}/boa/aegir" ###---### Local functions # # export DEBIAN_FRONTEND=noninteractive export APT_LISTCHANGES_FRONTEND=none if [ -z "${TERM+x}" ]; then export TERM=vt100 fi # _hostmaster_mv_up() { if [ "${_DEBUG_MODE}" = "YES" ]; then _msg "INFO: Moving old directories" fi mkdir -p ${_ROOT}/backups/system chmod 700 ${_ROOT}/backups/system mv -f ${_ROOT}/backups/drush-pre* ${_ROOT}/backups/system/ &> /dev/null _D_EXT="provision clean_missing_modules drupalgeddon drush_ecl make_local \ provision_boost provision_cdn provision_civicrm provision_site_backup \ provision_tasks_extra registry_rebuild remote_import \ safe_cache_form_clear security_check security_review utf8mb4_convert" for e in ${_D_EXT}; do if [ -e "${_ROOT}/.drush/$e" ]; then mv -f ${_ROOT}/.drush/$e \ ${_ROOT}/backups/system/$e-pre-${_DISTRO}-${_NOW} &> /dev/null mv -f ${_ROOT}/backups/$e-pre* ${_ROOT}/backups/system/ &> /dev/null fi if [ -e "${_ROOT}/.drush/xts/$e" ]; then mv -f ${_ROOT}/.drush/xts/$e \ ${_ROOT}/backups/system/$e-pre-${_DISTRO}-${_NOW} &> /dev/null mv -f ${_ROOT}/backups/$e-pre* ${_ROOT}/backups/system/ &> /dev/null fi if [ -e "${_ROOT}/.drush/usr/$e" ]; then mv -f ${_ROOT}/.drush/usr/$e \ ${_ROOT}/backups/system/$e-pre-${_DISTRO}-${_NOW} &> /dev/null mv -f ${_ROOT}/backups/$e-pre* ${_ROOT}/backups/system/ &> /dev/null fi if [ -e "${_ROOT}/.drush/sys/$e" ]; then mv -f ${_ROOT}/.drush/sys/$e \ ${_ROOT}/backups/system/$e-pre-${_DISTRO}-${_NOW} &> /dev/null mv -f ${_ROOT}/backups/$e-pre* ${_ROOT}/backups/system/ &> /dev/null fi done } # _hostmaster_go_up() { if [ "${_DEBUG_MODE}" = "YES" ]; then _msg "INFO: Installing Ægir Provision backend..." fi mkdir -p ${_ROOT}/.drush/{sys,xts,usr} rm -rf ${_ROOT}/.drush/drush_make rm -rf ${_ROOT}/.drush/sys/drush_make cd ${_ROOT}/.drush if [ "${_DL_MODE}" = "BATCH" ]; then if [ "${_DEBUG_MODE}" = "YES" ]; then _msg "INFO: Downloading Drush and Provision extensions from ${_DL_MODE}-${_AEGIR_VERSION}..." fi rm -rf ${_ROOT}/.drush/{sys,xts,usr} rm -rf ${_ROOT}/.drush/{provision,drush_make} _get_dev_ext "backend.tar.gz" mv -f ${_ROOT}/.drush/backend/sys ${_ROOT}/.drush/ mv -f ${_ROOT}/.drush/backend/xts ${_ROOT}/.drush/ mv -f ${_ROOT}/.drush/backend/usr ${_ROOT}/.drush/ if [ -e "${_ROOT}/.drush/sys/provision/provision.inc" ] \ && [ -d "${_ROOT}/.drush/xts/security_review" ] \ && [ -d "${_ROOT}/.drush/usr/registry_rebuild" ]; then [ -e "${_ROOT}/.drush/backend" ] && rm -rf ${_ROOT}/.drush/backend* fi elif [ "${_DL_MODE}" = "GIT" ]; then if [ "${_DEBUG_MODE}" = "YES" ]; then _msg "INFO: Downloading Drush and Provision extensions from ${_DL_MODE}-${_AEGIR_VERSION}..." fi rm -rf ${_ROOT}/.drush/{sys,xts,usr} rm -rf ${_ROOT}/.drush/{provision,drush_make} mkdir -p ${_ROOT}/.drush/{sys,xts,usr} _rD="${_ROOT}/.drush" ${_gCb} ${_BRANCH_PRN} ${_gitHub}/provision.git ${_rD}/sys/provision &> /dev/null ${_gCb} 7.x-1.x-dev ${_gitHub}/drupalgeddon.git ${_rD}/usr/drupalgeddon &> /dev/null ${_gCb} 7.x-1.x ${_gitHub}/drush_ecl.git ${_rD}/usr/drush_ecl &> /dev/null ${_gCb} 7.x-1.x ${_gitHub}/security_review.git ${_rD}/xts/security_review &> /dev/null ${_gCb} 7.x-2.x ${_gitHub}/provision_boost.git ${_rD}/xts/provision_boost &> /dev/null ${_gCb} 7.x-2.x ${_gitHub}/registry_rebuild.git ${_rD}/usr/registry_rebuild &> /dev/null ${_gCb} 7.x-1.x ${_gitHub}/safe_cache_form_clear.git ${_rD}/usr/safe_cache_form_clear &> /dev/null rm -rf ${_rD}/*/.git rm -rf ${_rD}/*/*/.git cd ${_rD}/usr _get_dev_ext "clean_missing_modules.tar.gz" _get_dev_ext "utf8mb4_convert-7.x-1.3.tar.gz" else if [ "${_DEBUG_MODE}" = "YES" ]; then _msg "INFO: Downloading Drush and Provision extensions from ${_DL_MODE}-${_AEGIR_VERSION}..." fi cd ${_ROOT}/.drush/sys _get_dev_ext "provision.tar.gz" cd ${_ROOT}/.drush/usr _get_dev_ext "clean_missing_modules.tar.gz" _get_dev_ext "drupalgeddon.tar.gz" _get_dev_ext "drush_ecl.tar.gz" _get_dev_ext "registry_rebuild.tar.gz" _get_dev_ext "safe_cache_form_clear.tar.gz" _get_dev_ext "utf8mb4_convert-7.x-1.3.tar.gz" cd ${_ROOT}/.drush/xts _get_dev_ext "provision_boost.tar.gz" _get_dev_ext "security_review.tar.gz" fi rm -rf ${_ROOT}/.drush/*/.git rm -rf ${_ROOT}/.drush/*/*/.git sed -i "s/files.aegir.cc/${_USE_MIR}/g" ${_ROOT}/.drush/sys/provision/aegir.make &> /dev/null cd ${_PREV_HM_ROOT} } # _hostmaster_dr_tt() { if ${_DRUSHCMD} help | grep "^ provision-install" > /dev/null ; then if [ "${_DEBUG_MODE}" = "YES" ]; then _msg "${_STATUS} B: Drush test result OK" fi else _msg "FATAL ERROR: Drush is broken (${_DRUSHCMD} help failed)" _msg "FATAL ERROR: Aborting AegirUpgrade installer NOW!" touch /opt/tmp/status-AegirUpgrade-FAIL exit 1 fi } # _hostmaster_mi_up() { _msg "INFO: Running hostmaster-migrate, please wait..." ### security_review breaks the upgrade if active mv -f ${_ROOT}/.drush/xts/security_review/security_review.drush.inc \ ${_ROOT}/.drush/xts/security_review/foo.txt &> /dev/null export DEBIAN_FRONTEND=noninteractive export APT_LISTCHANGES_FRONTEND=none if [ -z "${TERM+x}" ]; then export TERM=vt100 fi # # Fix broken Entity module if needed. # _pthA="profiles/hostmaster/modules/contrib/entity" _pthB="module_filter.module" # if [ -e "${_PREV_HM_ROOT}/${_pthA}/${_pthB}" ]; then _msg "INFO: Fixing broken Entity module..." rm -rf ${_PREV_HM_ROOT}/${_pthA} cd ${_PREV_HM_ROOT}/profiles/hostmaster/modules/contrib _get_dev_stc "entity-7.x-1.12.tar.gz" ${_DRUSHCMD} @hostmaster en entity -y ${_DRUSHCMD} @hostmaster dis hosting_ssl -y ${_DRUSHCMD} @hostmaster dis hosting_le -y ${_DRUSHCMD} @hostmaster dis hosting_le_vhost -y ${_DRUSHCMD} @hostmaster dis hosting_nginx_ssl -y ${_DRUSHCMD} @hostmaster sqlq "DELETE FROM hosting_service WHERE service LIKE 'http'" ${_DRUSHCMD} @hostmaster sqlq "INSERT INTO hosting_service (nid, vid, service, type, restart_cmd, port, available) VALUES ('2', '2', 'http', 'nginx', 'sudo /etc/init.d/nginx reload', '80', '1')" ${_DRUSHCMD} @hostmaster sqlq "UPDATE hosting_service SET type='nginx' WHERE service='http'" ${_DRUSHCMD} @hostmaster hosting-task @server_master verify --force ${_DRUSHCMD} @hostmaster hosting-dispatch wait sleep 5 ${_DRUSHCMD} @hostmaster hosting-tasks --force wait sleep 5 ${_DRUSHCMD} @hostmaster hosting-tasks --force wait sleep 5 ${_DRUSHCMD} @hostmaster hosting-tasks --force wait _msg "INFO: Waiting 15 seconds..." sleep 15 fi _BROKEN_SSL_TEST=$(grep "nginx default ssl server" /var/aegir/config/server_master/nginx.conf 2>&1) if [ ! -z "${_BROKEN_SSL_TEST}" ]; then _msg "INFO: Disabling nginx_ssl on master..." ${_DRUSHCMD} @hostmaster dis hosting_ssl -y ${_DRUSHCMD} @hostmaster dis hosting_le -y ${_DRUSHCMD} @hostmaster dis hosting_le_vhost -y ${_DRUSHCMD} @hostmaster dis hosting_nginx_ssl -y ${_DRUSHCMD} @hostmaster sqlq "DELETE FROM hosting_service WHERE service LIKE 'http'" ${_DRUSHCMD} @hostmaster sqlq "INSERT INTO hosting_service (nid, vid, service, type, restart_cmd, port, available) VALUES ('2', '2', 'http', 'nginx', 'sudo /etc/init.d/nginx reload', '80', '1')" ${_DRUSHCMD} @hostmaster sqlq "UPDATE hosting_service SET type='nginx' WHERE service='http'" ${_DRUSHCMD} @hostmaster hosting-task @server_master verify --force ${_DRUSHCMD} @hostmaster hosting-dispatch wait sleep 5 ${_DRUSHCMD} @hostmaster hosting-tasks --force wait sleep 5 ${_DRUSHCMD} @hostmaster hosting-tasks --force wait sleep 5 ${_DRUSHCMD} @hostmaster hosting-tasks --force wait touch /var/aegir/disable_nginx_ssl.log _msg "INFO: Waiting 5 seconds..." sleep 5 fi if [ -e "${_PREV_HM_ROOT}/modules/path_alias_cache" ]; then if [ "${_DEBUG_MODE}" = "YES" ]; then ${_DRUSHCMD} @hostmaster dis aegir_custom_settings -y ${_DRUSHCMD} @hostmaster pm-uninstall aegir_custom_settings -y ${_DRUSHCMD} @hostmaster dis hosting_advanced_cron -y ${_DRUSHCMD} @hostmaster en ctools -y ${_DRUSHCMD} @hostmaster registry-rebuild else ${_DRUSHCMD} @hostmaster dis aegir_custom_settings -y &> /dev/null ${_DRUSHCMD} @hostmaster pm-uninstall aegir_custom_settings -y &> /dev/null ${_DRUSHCMD} @hostmaster dis hosting_advanced_cron -y &> /dev/null ${_DRUSHCMD} @hostmaster en ctools -y &> /dev/null ${_DRUSHCMD} @hostmaster registry-rebuild &> /dev/null fi else if [ "${_DEBUG_MODE}" = "YES" ]; then ${_DRUSHCMD} @hostmaster dis hosting_custom_settings -y ${_DRUSHCMD} @hostmaster pm-uninstall hosting_custom_settings -y ${_DRUSHCMD} @hostmaster registry-rebuild else ${_DRUSHCMD} @hostmaster dis hosting_custom_settings -y &> /dev/null ${_DRUSHCMD} @hostmaster pm-uninstall hosting_custom_settings -y &> /dev/null ${_DRUSHCMD} @hostmaster registry-rebuild &> /dev/null fi fi ${_DRUSHCMD} cc drush &> /dev/null rm -rf ${_ROOT}/.tmp/cache ${_DRUSHCMD} @hostmaster sqlc < ${_bldPth}/aegir/helpers/hosting_cron.sql &> /dev/null ${_DRUSHCMD} @hostmaster sqlq "DELETE FROM hosting_task_log \ WHERE timestamp < UNIX_TIMESTAMP(DATE_SUB(NOW(), INTERVAL 3 MONTH))" &> /dev/null ${_DRUSHCMD} @hostmaster sqlq "OPTIMIZE TABLE hosting_task_log" &> /dev/null ${_DRUSHCMD} @hostmaster sqlq "DELETE FROM hosting_task \ WHERE task_type='delete' AND task_status='-1'" &> /dev/null ${_DRUSHCMD} @hostmaster sqlq "DELETE FROM hosting_task \ WHERE task_type='delete' AND task_status='0' AND executed='0'" &> /dev/null if [ "${_DEBUG_MODE}" = "YES" ]; then ${_DRUSHCMD} hostmaster-migrate ${_DOMAIN} ${_HM_ROOT} -y -d else ${_DRUSHCMD} hostmaster-migrate ${_DOMAIN} ${_HM_ROOT} -y &> /dev/null fi if [ -e "${_ROOT}/.drush/hostmaster.alias.drushrc.php" ]; then _THIS_HM_ROOT=$(cat ${_ROOT}/.drush/hostmaster.alias.drushrc.php \ | grep "root'" \ | cut -d: -f2 \ | awk '{ print $3}' \ | sed "s/[\,']//g" 2>&1) if [ -e "${_THIS_HM_ROOT}/sites/all" ] \ && [ ! -e "${_THIS_HM_ROOT}/sites/all/libraries" ]; then mkdir -p \ ${_THIS_HM_ROOT}/sites/all/{modules,themes,libraries} &> /dev/null fi fi if [ "${_DEBUG_MODE}" = "YES" ]; then ${_DRUSHCMD} @hostmaster registry-rebuild ${_DRUSHCMD} @hostmaster en hosting_cron -y ${_DRUSHCMD} @hostmaster cache-clear all ${_DRUSHCMD} @hostmaster updb -y else ${_DRUSHCMD} @hostmaster registry-rebuild &> /dev/null ${_DRUSHCMD} @hostmaster en hosting_cron -y &> /dev/null ${_DRUSHCMD} @hostmaster cache-clear all &> /dev/null ${_DRUSHCMD} @hostmaster updb -y &> /dev/null fi export DEBIAN_FRONTEND=text mv -f ${_ROOT}/.drush/xts/security_review/foo.txt \ ${_ROOT}/.drush/xts/security_review/security_review.drush.inc &> /dev/null mkdir -p ${_ROOT}/backups/system/old_hostmaster chmod 700 ${_ROOT}/backups/system/old_hostmaster chmod 700 ${_ROOT}/backups/system mv -f ${_ROOT}/backups/*host8* \ ${_ROOT}/backups/system/old_hostmaster/ &> /dev/null mv -f ${_ROOT}/backups/*o8.io* \ ${_ROOT}/backups/system/old_hostmaster/ &> /dev/null mv -f ${_ROOT}/backups/*boa.io* \ ${_ROOT}/backups/system/old_hostmaster/ &> /dev/null mv -f ${_ROOT}/backups/*aegir.cc* \ ${_ROOT}/backups/system/old_hostmaster/ &> /dev/null chmod 600 ${_ROOT}/backups/system/old_hostmaster/* &> /dev/null } ###--------------------### _LASTNUM=001 _DISTRO=001 _PREV_HM_ROOT=$(find ${_ROOT} -maxdepth 1 -type d | grep hostmaster 2>&1) if [ -d "${_ROOT}/host_master" ]; then if [ ! -d "${_ROOT}/host_master/000" ]; then mkdir -p ${_ROOT}/host_master/000 if [ ! -e "${_ROOT}/host_master/000/placeholder_dont_remove.txt" ]; then touch ${_ROOT}/host_master/000/placeholder_dont_remove.txt fi fi fi if [ -d "${_ROOT}/host_master/000" ]; then cd ${_ROOT}/host_master _list=([0-9]*) _last=${_list[@]: -1} _LASTNUM=$_last _BASH_TEST=$(bash --version 2>&1) if [[ "${_BASH_TEST}" =~ "version 5.1" ]] || [[ "${_BASH_TEST}" =~ "version 5.2" ]]; then _nextnum=00$((10#0${_last%%[^0-9]*} + 1)) else _nextnum=00$((10#${_last%%[^0-9]*} + 1)) fi _nextnum=${_nextnum: -3} _PREV_HM_ROOT_TEST="${_ROOT}/host_master/${_LASTNUM}" if [ "${_DEBUG_MODE}" = "YES" ]; then _msg "INFO: Testing previous install..." fi if [ -e "${_PREV_HM_ROOT_TEST}/sites/${_DOMAIN}/settings.php" ]; then _DISTRO=${_nextnum} _PREV_HM_ROOT="${_ROOT}/host_master/${_LASTNUM}" if [ -e "${_PREV_HM_ROOT}/modules/path_alias_cache" ]; then _DEBUG_MODE=YES fi else _DEBUG_MODE=YES _msg "INFO: Testing previous install..." _msg "INFO: OPS, zombie found, moving it to backups..." sleep 1 mv -f ${_PREV_HM_ROOT_TEST} \ ${_ROOT}/backups/system/empty-hm-${_LASTNUM}-${_NOW} &> /dev/null cd ${_ROOT}/host_master _list=([0-9]*) _last=${_list[@]: -1} _LASTNUM=$_last _BASH_TEST=$(bash --version 2>&1) if [[ "${_BASH_TEST}" =~ "version 5.1" ]] || [[ "${_BASH_TEST}" =~ "version 5.2" ]]; then _nextnum=00$((10#0${_last%%[^0-9]*} + 1)) else _nextnum=00$((10#${_last%%[^0-9]*} + 1)) fi _nextnum=${_nextnum: -3} _DISTRO=${_nextnum} _PREV_HM_ROOT_TEST="${_ROOT}/host_master/${_LASTNUM}" _msg "INFO: Testing previous install again after removing zombie..." sleep 1 if [ -e "${_PREV_HM_ROOT_TEST}/sites/${_DOMAIN}/settings.php" ]; then _DISTRO=${_nextnum} _PREV_HM_ROOT="${_ROOT}/host_master/${_LASTNUM}" else _DEBUG_MODE=YES _msg "INFO: Testing previous install again..." _msg "INFO: OPS, another zombie found, moving it to backups..." sleep 1 mv -f ${_PREV_HM_ROOT_TEST} \ ${_ROOT}/backups/system/empty-hm-${_LASTNUM}-${_NOW}-sec &> /dev/null cd ${_ROOT}/host_master _list=([0-9]*) _last=${_list[@]: -1} _LASTNUM=$_last _BASH_TEST=$(bash --version 2>&1) if [[ "${_BASH_TEST}" =~ "version 5.1" ]] || [[ "${_BASH_TEST}" =~ "version 5.2" ]]; then _nextnum=00$((10#0${_last%%[^0-9]*} + 1)) else _nextnum=00$((10#${_last%%[^0-9]*} + 1)) fi _nextnum=${_nextnum: -3} _DISTRO=${_nextnum} _PREV_HM_ROOT_TEST="${_ROOT}/host_master/${_LASTNUM}" _msg "INFO: Testing previous install again after removing second zombie..." sleep 1 if [ -e "${_PREV_HM_ROOT_TEST}/sites/${_DOMAIN}/settings.php" ]; then _DISTRO=${_nextnum} _PREV_HM_ROOT="${_ROOT}/host_master/${_LASTNUM}" fi fi fi fi _HM_ROOT="${_ROOT}/host_master/${_DISTRO}" if [ -d "${_HM_ROOT}" ]; then _msg "FATAL ERROR: ${_HM_ROOT} already exists" _msg "FATAL ERROR: Too many zombies to delete! Try again..." _msg "FATAL ERROR: Aborting AegirUpgrade installer NOW!" touch /opt/tmp/status-AegirUpgrade-FAIL exit 1 fi mkdir -p ${_ROOT}/host_master chmod 711 ${_ROOT}/host_master &> /dev/null if [ ! -d "/var/aegir/.drush/sys/provision/http" ]; then _msg "FATAL ERROR: Required directory does not exist:" _msg "FATAL ERROR: /var/aegir/.drush/sys/provision/http" _msg "FATAL ERROR: Aborting AegirUpgrade installer NOW!" touch /opt/tmp/status-AegirUpgrade-FAIL exit 1 fi if [ -e "${_PREV_HM_ROOT}/sites/${_DOMAIN}/settings.php" ]; then if [ "${_DEBUG_MODE}" = "YES" ]; then _msg "INFO: Test OK, we can proceed with Hostmaster upgrade" fi _hostmaster_mv_up _hostmaster_dr_up _hostmaster_go_up _hostmaster_dr_tt _hostmaster_mi_up else _msg "FATAL ERROR: Your setup is probably broken because required file" _msg "FATAL ERROR: ${_PREV_HM_ROOT}/sites/${_DOMAIN}/settings.php" _msg "FATAL ERROR: does not exist" _msg "FATAL ERROR: Aborting AegirUpgrade installer NOW!" touch /opt/tmp/status-AegirUpgrade-FAIL exit 1 fi ###----------------------------------------### ### ### Barracuda Ægir Installer ### Copyright (C) 2009-2026 Omega8.cc ### noc@omega8.cc www.omega8.cc ### ###----------------------------------------### ================================================ FILE: aegir/scripts/run-xdrago ================================================ #!/bin/bash export HOME=/root export SHELL=/bin/bash export PATH=/usr/local/bin:/usr/local/sbin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin:/usr/libexec export _tRee=dev _H_USER=EDIT_USER _check_root() { if [ "$(id -u)" -eq 0 ]; then ionice -c2 -n7 -p $$ renice 9 -p $$ chmod a+w /dev/null else echo "ERROR: This script should be run as a root user" exit 1 fi _DF_TEST="$(command df -P -l / 2>/dev/null | awk ' NR==1 { for (i=1; i<=NF; i++) if ($i=="Use%" || $i=="Capacity") u=i } NR==2 { gsub(/%/,"",$u); print $u }')" if [ ! -z "${_DF_TEST}" ] && [ "${_DF_TEST}" -gt 90 ]; then echo "ERROR: Your disk space is almost full !!! ${_DF_TEST}/100" echo "ERROR: We can not proceed until it is below 90/100" exit 1 fi } _check_root _run_cleanup() { _buildTest="1" _tpDir="/data/disk/${_H_USER}/.tmp" _ceDir="${_tpDir}/cache" _dlDir="${_ceDir}/download" _gtDir="${_ceDir}/git" _clCtr="/data/disk/${_H_USER}/static/control/clear-drush-cache.info" _exCtr="/data/disk/${_H_USER}/backups/tmp_expim/metadata" if [ -e "${_tpDir}" ]; then _buildTest=$(ls ${_tpDir} | grep "_tmp_" | wc -l | tr -d "\n" 2>&1) _buildTest=${_buildTest//[^0-9]/} fi if [ -e "${_clCtr}" ]; then if [ -e "${_exCtr}" ]; then rm -f ${_exCtr} rm -f ${_clCtr} _buildTest="0" fi if [ -e "${_gtDir}" ] || [ "${_buildTest}" -ge 1 ]; then rm -rf ${_tpDir}/* rm -f ${_clCtr} _buildTest="0" fi fi if [ "${_buildTest}" = "0" ] && [ -e "${_gtDir}" ]; then rm -rf ${_gtDir} rm -rf ${_dlDir} fi } _run_cleanup # Remove dangerous stuff from the string. _sanitize_string() { echo "$1" | sed 's/[\\\/\^\?\>\`\#\"\{\(\&\|\*]//g; s/\(['"'"'\]\)//g' } # Generate new sftp password and update expiration date _if_sftp_password_update() { _upCtr="/data/disk/${_H_USER}/static/control/run-sftp-password-update.pid" if [ -e "${_upCtr}" ]; then _sftpUser="${_H_USER}.ftp" rm -f ${_upCtr} _PWD_CHARS=64 _RANDPASS_TEST=$(randpass -V 2>&1) if [[ "${_RANDPASS_TEST}" =~ "alnum" ]]; then _ESC_PASS=$(randpass "${_PWD_CHARS}" alnum 2>&1) else _ESC_PASS=$(shuf -zer -n64 {A..Z} {a..z} {0..9} % @ | tr -d '\0' 2>&1) _ESC_PASS=$(echo -n "${_ESC_PASS}" | tr -d "\n" 2>&1) _ESC_PASS=$(_sanitize_string "${_ESC_PASS}" 2>&1) fi _ESC_PASS=$(echo -n "${_ESC_PASS}" | tr -d "\n" 2>&1) _LEN_PASS=$(echo ${#_ESC_PASS} 2>&1) if [ -z "${_ESC_PASS}" ] || [ "${_LEN_PASS}" -lt 9 ]; then _ESC_PASS=$(shuf -zer -n64 {A..Z} {a..z} {0..9} % @ | tr -d '\0' 2>&1) _ESC_PASS=$(echo -n "${_ESC_PASS}" | tr -d "\n" 2>&1) _ESC_PASS=$(_sanitize_string "${_ESC_PASS}" 2>&1) fi _LEN_PASS=$(echo ${#_ESC_PASS} 2>&1) if [ ! -z "${_ESC_PASS}" ] && [ "${_LEN_PASS}" -gt 9 ]; then chage -I -1 -m 0 -M 99999 -E -1 ${_sftpUser} echo "${_sftpUser}:${_ESC_PASS}" | chpasswd chage -M 90 ${_sftpUser} chage -W 7 ${_sftpUser} chage -d $(date +%Y-%m-%d) ${_sftpUser} echo "${_ESC_PASS}" > /data/disk/${_H_USER}/static/control/new-${_sftpUser}-password.txt fi fi } _if_octopus_upgrade() { _upCtr="/data/disk/${_H_USER}/static/control/run-upgrade.pid" _plCtr="/data/disk/${_H_USER}/static/control/platforms.info" if [ -e "${_plCtr}" ] && [ -e "${_upCtr}" ]; then rm -f ${_upCtr} [ -e "/root/.silent.update.cnf" ] && rm -f /root/.silent.update.cnf _TODAY=$(date +%y%m%d) _TODAY=${_TODAY//[^0-9]/} _NOW=$(date +%y%m%d-%H%M%S) _NOW=${_NOW//[^0-9-]/} _vBs="/var/backups" _LOG_UP_DIR="${_vBs}/reports/up/$(basename "$0")/${_TODAY}" _UP_OCTOPUS_LOG="${_LOG_UP_DIR}/$(basename "$0")-up-octopus-${_NOW}.log" mkdir -p ${_LOG_UP_DIR} nohup /opt/local/bin/octopus up-${_tRee} ${_H_USER} force log noscreen >${_UP_OCTOPUS_LOG} 2>&1 & fi } _run_action() { if [ "${_buildTest}" = "0" ] \ || [ -z "${_buildTest}" ] \ || [ ! -e "${_ceDir}" ]; then su -s /bin/bash - ${_H_USER} -c "drush8 cc drush" &> /dev/null wait su -s /bin/bash - ${_H_USER} -c "bash /data/disk/${_H_USER}/aegir.sh" wait touch /var/log/boa/last-run-${_H_USER} else touch /var/log/boa/skip-run-${_H_USER} fi } if [ -e "/run/boa_wait.pid" ]; then touch /var/log/boa/wait-${_H_USER} exit 0 else _if_sftp_password_update _if_octopus_upgrade _run_action exit 0 fi ================================================ FILE: aegir/tools/BOND.sh.txt ================================================ #!/bin/bash ###----------------------------------------### ### ### Barracuda-Octopus-Nginx-Drupal Tuner ### ### Copyright (C) 2009-2026 Omega8.cc ### noc@omega8.cc www.omega8.cc ### ### This program is free software. You can ### redistribute it and/or modify it under ### the terms of the GNU GPL as published by ### the Free Software Foundation, version 2 ### or later. ### ### This program is distributed in the hope ### that it will be useful, but WITHOUT ANY ### WARRANTY; without even the implied ### warranty of MERCHANTABILITY or FITNESS ### FOR A PARTICULAR PURPOSE. See the GNU GPL ### for more details. ### ### You should have received a copy of the ### GNU GPL along with this program. ### If not, see http://www.gnu.org/licenses/ ### ### Code: https://github.com/omega8cc/boa ### ###----------------------------------------### ###----------------------------------------### ### How To: run it with bash, not with sh ### ###----------------------------------------### ### ### $ bash BOND.sh.txt ### ### Note: to restore default values it is ### enough to start this script with ### any values defined below and answer ### NO when it prompts for confirmation ### "Are you ready to tune your Ægir". ### ###----------------------------------------### ### EDITME ### ###----------------------------------------### ### ### Enter below the settings you wish to use. ### ###----------------------------------------### ### Hostmaster root directory - /var/aegir ### ### Note: most of values tuned by this script ### are server-vide, while some, like ### mod_evasive settings will affect ### only sites hosted on the Ægir ### Satellite Instance defined below. ### _TUNE_HOSTMASTER=/data/disk/o1 ###----------------------------------------### ### Nginx server mod_evasive - default ON ### ### Note: running verify task on any SITE ### will restore default value ON ### for that site only, while TUNER ### will turn OFF/ON this feature ### for all sites hosted on the ### Hostmaster defined above. ### _TUNE_NGINX_CONNECT=OFF ###----------------------------------------### ### Nginx server fastcgi timeout - default 180 ### ### Note: running verify task on the SERVER ### in the Hostmaster created ### by Barracuda (not Octopus!) ### will restore default value ### for the server and all existing ### Ægir Satellite Instances. ### _TUNE_NGINX_TIMEOUT=9999 ###----------------------------------------### ### Nginx server firewall limit - default 300 ### ### Note: don't change the default value ### if you are the only visitor, or ### you will lock yourself easily. ### ### The default value 300 means the ### firewall limit is OFF because ### it scans only the last 300 lines ### of your web server log file. ### ### If you will set this value to 100 ### then every visitor IP with more ### than 100 out of the last 300 ### requests will be locked. ### ### Only dynamic requests (pages) are ### counted because static files like ### images are generally not logged. ### _TUNE_NGINX_FIREWALL=300 ###----------------------------------------### ### Database server timeout - default 9999 ### _TUNE_SQL_TIMEOUT=9999 ###----------------------------------------### ### PHP-FPM server timeout - default 180 ### _TUNE_PHP_FPM_TIMEOUT=9999 ###----------------------------------------### ### PHP-CLI server timeout - default 9999 ### _TUNE_PHP_CLI_TIMEOUT=9999 ###----------------------------------------### ### DON'T EDIT ANYTHING BELOW THIS LINE ### ###----------------------------------------### export HOME=/root export SHELL=/bin/bash export PATH=/usr/local/bin:/usr/local/sbin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin:/usr/libexec export _tRee=dev export _xSrl=591devT01 _AEGIR_VERSION="${_tRee}" _BRANCH_BOA="5.x-${_tRee}" _X_VERSION="BOA-5.9.1-${_tRee}" _MYSQLTUNER_VRN=1.9.4 _NOW=$(date +%y%m%d-%H%M%S) _NOW=${_NOW//[^0-9-]/} _RAM=$(free -mt | grep Mem: | awk '{ print $2 }' 2>&1) _SPINNER=NO if [ -n "${STY+x}" ]; then _SPINNER=NO fi _PHP56_API=20131226 _PHP56_VRN=5.6.40 _PHP70_API=20151012 _PHP70_VRN=7.0.33 _PHP71_API=20160303 _PHP71_VRN=7.1.33 _PHP72_API=20170718 _PHP72_VRN=7.2.34 _PHP73_API=20180731 _PHP73_VRN=7.3.33 _PHP74_API=20190902 _PHP74_VRN=7.4.33 _PHP80_API=20200930 _PHP80_VRN=8.0.30 _PHP81_API=20210902 _PHP81_VRN=8.1.34 _PHP82_API=20220829 _PHP82_VRN=8.2.31 _PHP83_API=20230831 _PHP83_VRN=8.3.31 _PHP84_API=20240924 _PHP84_VRN=8.4.21 _PHP85_API=20250925 _PHP85_VRN=8.5.6 ### ### Helper variables ### _bldPth="/opt/tmp/boa" _crlGet="-L --max-redirs 3 -k -s --retry 9 --retry-delay 9 -A iCab" _wgetGet="--max-redirect=3 --no-check-certificate -q --tries=9 --wait=9 --user-agent='iCab'" _aptAllow="--allow-unauthenticated" _aptYesUnth="-y ${_aptAllow}" _gCb="git clone --branch" _gitHub="https://github.com/omega8cc" _gitLab="https://gitlab.com/omega8cc" _libFnc="${_bldPth}/lib/functions" _locCnf="${_bldPth}/aegir/conf" _vBs="/var/backups" ### ### Avoid too many questions ### export DEBIAN_FRONTEND=noninteractive export APT_LISTCHANGES_FRONTEND=none if [ -z "${TERM+x}" ]; then export TERM=vt100 fi ###---### Functions # # Clean pid files on exit. _clean_pid_exit() { if [ -n "${1}" ]; then echo "REASON ${1} on $(date)" >> /root/.bond.sh.exit.exceptions.log [ -e "/opt/tmp/boa" ] && rm -rf /opt/tmp/* fi [ -e "/run/boa_wait.pid" ] && rm -f /run/boa_wait.pid [ -e "/run/boa_run.pid" ] && rm -f /run/boa_run.pid service cron start &> /dev/null exit 1 } _check_root() { if [ "$(id -u)" -eq 0 ]; then # shellcheck disable=SC1091 [ -e "/root/.barracuda.cnf" ] && source /root/.barracuda.cnf # Sanitize to allow only digits and minus sign export _B_NICE=${_B_NICE//[^0-9-]/} # Validate and set default if necessary if ! [[ "${_B_NICE}" =~ ^-?[0-9]+$ ]]; then _B_NICE=0 fi # Clamp the value within -20 to 19 if (( _B_NICE < -20 )); then _B_NICE=-20 elif (( _B_NICE > 19 )); then _B_NICE=19 fi renice ${_B_NICE} -p $$ &> /dev/null ionice -c2 -n7 -p $$ else echo "ERROR: This script should be run as a root user" _clean_pid_exit fi _hName="$(cat /etc/hostname 2>/dev/null | tr -d '\n' || hostname -f 2>/dev/null)" } _check_root _os_detection_minimal() { _APT_UPDATE="apt-get update" _OS_CODE=$(lsb_release -ar 2>/dev/null | grep -i codename | cut -s -f2) _OS_LIST="excalibur daedalus chimaera beowulf buster bullseye bookworm trixie" for e in ${_OS_LIST}; do if [ "${e}" = "${_OS_CODE}" ]; then _APT_UPDATE="apt-get update --allow-releaseinfo-change" fi done } _os_detection_minimal _apt_clean_update() { ${_APT_UPDATE} -qq 2>/dev/null _CALLER_SCRIPT="$(basename "${BASH_SOURCE[-1]}")" _CALLER_SCRIPT="${_CALLER_SCRIPT//[^a-zA-Z0-9._-]/_}" date +%s > "/run/_latest_apt_clean_update.${_CALLER_SCRIPT}.pid" } _if_hosted_sys() { if [ -e "/root/.host8.cnf" ] \ || [[ "${_hName}" =~ ".aegir.cc"($) ]]; then _hostedSys=YES else _hostedSys=NO fi } _check_sql_running() { while [ -z "${_IS_MYSQLD_RUNNING}" ] \ || [ ! -e "/run/mysqld/mysqld.sock" ]; do _IS_MYSQLD_RUNNING=$(pgrep -f /usr/sbin/mysqld) echo "INFO: Waiting for MySQLD availability..." sleep 3 done } _check_sql_running _check_sql_access() { if [ -e "/root/.my.pass.txt" ] && [ -e "/root/.my.cnf" ]; then _SQL_PSWD=$(cat /root/.my.pass.txt 2>/dev/null | tr -d '\n') _IS_SYNC_SQL_PSWD=$(grep "${_SQL_PSWD}" /root/.my.cnf 2>&1) else echo "ALERT: /root/.my.cnf or /root/.my.pass.txt not found." echo "ALERT: Please fix this before trying again, giving up." echo "Bye" echo " " _clean_pid_exit _check_sql_access_a fi if [ -z "${_IS_SYNC_SQL_PSWD}" ] \ || [[ ! "${_IS_SYNC_SQL_PSWD}" =~ "password=${_SQL_PSWD}" ]]; then echo "ALERT: SQL password is out of sync between" echo "ALERT: /root/.my.cnf and /root/.my.pass.txt" echo "ALERT: Please fix this before trying again, giving up." echo "Bye" echo " " _clean_pid_exit _check_sql_access_b else _IS_MYSQLD_RUNNING=$(pgrep -f /usr/sbin/mysqld) if [ -z "${_IS_MYSQLD_RUNNING}" ]; then echo "ALERT: SQL server on this system is not running at all." echo "ALERT: Please fix this before trying again, giving up." echo "Bye" echo " " _clean_pid_exit _check_sql_access_c else _MYSQL_CONN_TEST=$(mysql -u root -e "status" 2>&1) if [ -z "${_MYSQL_CONN_TEST}" ] \ || [[ "${_MYSQL_CONN_TEST}" =~ "Access denied" ]]; then echo "ALERT: SQL password in /root/.my.cnf does not work." echo "ALERT: Please fix this before trying again, giving up." echo "Bye" echo " " _clean_pid_exit _check_sql_access_d fi fi fi } _check_sql_access # # Noticeable messages. _msg() { echo "Tuner [$(date)] ==> $*" } # Simple prompt. _prompt_yes_no() { if [ "${_AUTOPILOT}" = "YES" ]; then return 0 else while true; do printf "$* [Y/n] " read _answer if [ -z "${_answer}" ]; then return 0 fi case ${_answer} in [Yy]|[Yy][Ee][Ss]) return 0 ;; [Nn]|[Nn][Oo]) return 1 ;; *) echo "Please answer yes or no" ;; esac done fi } # # Count system CPUs. _count_cpu() { _CPU_INFO="$(grep -c processor /proc/cpuinfo)" _CPU_INFO=${_CPU_INFO//[^0-9]/} _NPROC_TEST="$(which nproc)" if [ -z "${_NPROC_TEST}" ]; then _CPU_NR="${_CPU_INFO}" else _CPU_NR=$(nproc 2>&1) fi _CPU_NR=${_CPU_NR//[^0-9]/} if [ ! -z "${_CPU_NR}" ] \ && [ ! -z "${_CPU_INFO}" ] \ && [ "${_CPU_NR}" -gt "${_CPU_INFO}" ] \ && [ "${_CPU_INFO}" -gt 0 ]; then _CPU_NR="${_CPU_INFO}" fi if [ -z "${_CPU_NR}" ] || [ "${_CPU_NR}" -lt 1 ]; then _CPU_NR=1 fi } # # Find the fastest mirror. _find_fast_mirror_early() { _isNetc="$(which netcat)" if [ ! -x "${_isNetc}" ] || [ -z "${_isNetc}" ]; then if [ ! -e "/etc/apt/apt.conf.d/00sandboxoff" ] \ && [ -e "/etc/apt/apt.conf.d" ]; then echo "APT::Sandbox::User \"root\";" > /etc/apt/apt.conf.d/00sandboxoff fi _apt_clean_update apt-get install netcat-traditional ${_aptYesUnth} 2> /dev/null wait fi _ffMirr=/opt/local/bin/ffmirror if [ -x "${_ffMirr}" ]; then _ffList="/var/backups/boa-mirrors-2025-01.txt" [ -d "/var/backups" ] || mkdir -p /var/backups if [ ! -e "${_ffList}" ]; then echo "eu.files.aegir.cc" > ${_ffList} echo "us.files.aegir.cc" >> ${_ffList} echo "ao.files.aegir.cc" >> ${_ffList} fi if [ -e "${_ffList}" ]; then _BROKEN_FFMIRR_TEST=$(grep "stuff" ${_ffMirr} 2>&1) if [[ "${_BROKEN_FFMIRR_TEST}" =~ "stuff" ]]; then _CHECK_MIRROR=$(bash ${_ffMirr} < ${_ffList} 2>&1) _CHECK_MIRROR=$(bash ${_ffMirr} < ${_ffList} 2>&1) _USE_MIR="${_CHECK_MIRROR}" [[ "${_USE_MIR}" =~ "printf" ]] && _USE_MIR="files.aegir.cc" else _USE_MIR="files.aegir.cc" fi else _USE_MIR="files.aegir.cc" fi else _USE_MIR="files.aegir.cc" fi _urlDev="http://${_USE_MIR}/dev" _urlHmr="http://${_USE_MIR}/versions/${_tRee}/boa/aegir" } # # Find correct IP. _find_correct_ip() { if [ -e "/root/.found_correct_ipv4.cnf" ]; then _LOC_IP=$(cat /root/.found_correct_ipv4.cnf 2>/dev/null | tr -d '\n') else _LOC_IP=$(curl ${_crlGet} https://api.ipify.org | sed 's/[^0-9\.]//g') if [ -z "${_LOC_IP}" ]; then _LOC_IP=$(curl ${_crlGet} http://ipv4.icanhazip.com | sed 's/[^0-9\.]//g') fi if [ ! -z "${_LOC_IP}" ]; then echo ${_LOC_IP} > /root/.found_correct_ipv4.cnf fi fi } # # Fix php.ini files to remove ionCube _fix_php_ini_ioncube() { if [ -e "${_THIS_FILE}" ] && [ "${_PHP_IONCUBE}" = "NO" ]; then _IONCUBE_INI_TEST=$(grep "ioncube_loader" ${_THIS_FILE} 2>&1) if [[ "${_IONCUBE_INI_TEST}" =~ "ioncube_loader" ]]; then sed -i "s/.*ioncube_loader.*//g" ${_THIS_FILE} &> /dev/null wait fi fi } # # Fix php.ini files to remove jsmin.so _remove_php_ini_jsmin() { if [ -e "${_THIS_FILE}" ]; then _JSMIN_INI_TEST=$(grep "^extension=jsmin.so" ${_THIS_FILE} 2>&1) if [[ "${_JSMIN_INI_TEST}" =~ "extension=jsmin.so" ]]; then sed -i "s/.*jsmin.*//g" ${_THIS_FILE} &> /dev/null wait fi fi } # # Fix php.ini files to remove suhosin.so _remove_php_ini_suhosin() { if [ -e "${_THIS_FILE}" ]; then _SUHOSIN_INI_TEST=$(grep "^extension=suhosin.so" ${_THIS_FILE} 2>&1) if [[ "${_SUHOSIN_INI_TEST}" =~ "extension=suhosin.so" ]]; then sed -i "s/.*suhosin.*//g" ${_THIS_FILE} &> /dev/null wait fi fi } # # Fix php.ini files to add mailparse.so _fix_php_ini_mailparse() { if [ -e "${_THIS_FILE}" ]; then _MAILPARSE_INI_TEST=$(grep "^extension=mailparse.so" ${_THIS_FILE} 2>&1) if [[ "${_MAILPARSE_INI_TEST}" =~ "extension=mailparse.so" ]]; then _DO_NOTHING=YES else echo "extension=mailparse.so" >> ${_THIS_FILE} fi fi } # # Fix php.ini files to add yaml.so _fix_php_ini_yaml() { if [ -e "${_THIS_FILE}" ]; then _YAML_INI_TEST=$(grep "^extension=yaml.so" ${_THIS_FILE} 2>&1) if [[ "${_YAML_INI_TEST}" =~ "extension=yaml.so" ]]; then _DO_NOTHING=YES else echo "extension=yaml.so" >> ${_THIS_FILE} fi fi } # # Fix php.ini files to add jsmin.so _add_php_ini_jsmin() { if [ -e "${_THIS_FILE}" ]; then _JSMIN_INI_TEST=$(grep "^extension=jsmin.so" ${_THIS_FILE} 2>&1) if [[ "${_JSMIN_INI_TEST}" =~ "extension=jsmin.so" ]]; then _DO_NOTHING=YES else echo "extension=jsmin.so" >> ${_THIS_FILE} fi fi } # # Fix php.ini files to add twig.so _fix_php_ini_twig() { if [ -e "${_THIS_FILE}" ]; then _TWIG_INI_TEST=$(grep "^extension=twig.so" ${_THIS_FILE} 2>&1) if [[ "${_TWIG_INI_TEST}" =~ "extension=twig.so" ]]; then _DO_NOTHING=YES else echo "extension=twig.so" >> ${_THIS_FILE} fi fi } # # Fix php.ini files to add redis.so _fix_php_ini_redis() { if [ -e "${_THIS_FILE}" ]; then _REDIS_INI_TEST=$(grep "^extension=redis.so" ${_THIS_FILE} 2>&1) if [[ "${_REDIS_INI_TEST}" =~ "extension=redis.so" ]]; then _DO_NOTHING=YES else echo "extension=redis.so" >> ${_THIS_FILE} fi fi } # # Fix php.ini files to add mcrypt.so _fix_php_ini_mcrypt() { if [ -e "${_THIS_FILE}" ]; then _MCRYPT_INI_TEST=$(grep "^extension=mcrypt.so" ${_THIS_FILE} 2>&1) if [[ "${_MCRYPT_INI_TEST}" =~ "extension=mcrypt.so" ]]; then _DO_NOTHING=YES else echo "extension=mcrypt.so" >> ${_THIS_FILE} fi fi } # # Fix php.ini files to add apcu.so _fix_php_ini_apcu() { if [ -e "${_THIS_FILE}" ]; then _APCU_INI_TEST=$(grep "^apc.shm_size" ${_THIS_FILE} 2>&1) if [[ "${_APCU_INI_TEST}" =~ "apc.shm_size" ]]; then _DO_NOTHING=YES else echo " " >> ${_THIS_FILE} echo "; APCu" >> ${_THIS_FILE} echo "extension=apcu.so" >> ${_THIS_FILE} echo "apc.enable_cli=1" >> ${_THIS_FILE} echo "apc.gc_ttl=300" >> ${_THIS_FILE} echo "apc.shm_segments=1" >> ${_THIS_FILE} echo "apc.shm_size=256M" >> ${_THIS_FILE} echo "apc.slam_defense=0" >> ${_THIS_FILE} echo "apc.ttl=0" >> ${_THIS_FILE} echo ";" >> ${_THIS_FILE} fi fi } # # Fix php.ini files to add igbinary.so _fix_php_ini_igbinary() { if [ -e "${_THIS_FILE}" ]; then _IGBINARY_INI_TEST=$(grep "^extension=igbinary.so" ${_THIS_FILE} 2>&1) if [[ "${_IGBINARY_INI_TEST}" =~ "extension=igbinary.so" ]]; then _DO_NOTHING=YES else echo "extension=igbinary.so" >> ${_THIS_FILE} fi fi } # # Fix php.ini file to add newrelic.ini _fix_php_ini_newrelic() { _NR_TPL="${_locCnf}/php/newrelic.ini" if [ -e "${_THIS_FILE}" ]; then _NEWRELIC_INI_TEST_A=$(grep "^extension=newrelic.so" ${_THIS_FILE} 2>&1) if [[ "${_NEWRELIC_INI_TEST_A}" =~ "extension=newrelic.so" ]]; then _DO_NOTHING=YES else cat ${_NR_TPL} >> ${_THIS_FILE} fi _NEWRELIC_INI_TEST_B=$(grep "newrelic.framework.drupal.modules" ${_THIS_FILE} 2>&1) if [[ "${_NEWRELIC_INI_TEST_B}" =~ "newrelic.framework.drupal.modules" ]]; then _DO_NOTHING=YES else echo "newrelic.framework.drupal.modules = 1" >> ${_THIS_FILE} fi sed -i "/REPLACE_WITH_REAL_KEY//g" ${_THIS_FILE} &> /dev/null wait sed -i "s/license_key=//g" ${_THIS_FILE} &> /dev/null wait fi } # # Fix all php.ini files to add newrelic.ini _fix_php_ini_newrelic_all() { if [ -e "/etc/newrelic/newrelic.cfg" ]; then if [ -z "${_NEWRELIC_KEY}" ]; then _NEWRELIC_KEY=$(grep license_key /etc/newrelic/newrelic.cfg 2>/dev/null | tr -d '\n') fi _PHP_V="84 83 82 81 80 74 73 72" for e in ${_PHP_V}; do _THIS_FILE=/opt/php${e}/etc/php${e}.ini _fix_php_ini_newrelic _THIS_FILE=/opt/php${e}/lib/php.ini _fix_php_ini_newrelic done fi } # # Fix FMP php.ini file to add opcache.so _fix_php_ini_opcache() { if [ "${_DEBUG_MODE}" = "YES" ]; then _msg "PROC: _fix_php_ini_opcache $1" fi if [ -e "${_THIS_FILE}" ]; then if grep -q "opcache.so" -- "${_THIS_FILE}"; then _DO_NOTHING=YES else { echo echo "; Zend OPcache" echo "zend_extension=\"${_OPCACHE_SO}\"" echo "opcache.enable=1" echo "opcache.memory_consumption=181" echo "opcache.revalidate_freq=60" echo "opcache.dups_fix=1" echo "opcache.file_update_protection=8" echo "opcache.huge_code_pages=0" case "${1}" in 80|74|73|72|71|70|56) echo "opcache.interned_strings_buffer=32" ;; 81|82|83|84) echo "opcache.interned_strings_buffer=128" ;; *) echo "opcache.interned_strings_buffer=128" if [ "${_DEBUG_MODE}" = "YES" ]; then _msg "WARN: Unknown PHP version '${1}', using default buffer=128" fi ;; esac echo "opcache.jit=off" echo "opcache.lockfile_path=/var/tmp/fpm" echo "opcache.max_accelerated_files=200000" echo "opcache.restrict_api=/var/www" echo "opcache.revalidate_path=1" echo "opcache.save_comments=1" echo "opcache.use_cwd=1" echo "opcache.validate_permission=1" echo "opcache.validate_root=1" echo "opcache.validate_timestamps=1" echo ";" } >> "${_THIS_FILE}" fi fi } # # Fix all FMP php.ini files to add Zend OPcache _fix_php_ini_opcache_all() { _PHP_V="85 84 83 82 81 80 74 73 72 71 70 56" for e in ${_PHP_V}; do _P_API= case "${e}" in 85) _P_API="${_PHP85_API}" ;; 84) _P_API="${_PHP84_API}" ;; 83) _P_API="${_PHP83_API}" ;; 82) _P_API="${_PHP82_API}" ;; 81) _P_API="${_PHP81_API}" ;; 80) _P_API="${_PHP80_API}" ;; 74) _P_API="${_PHP74_API}" ;; 73) _P_API="${_PHP73_API}" ;; 72) _P_API="${_PHP72_API}" ;; 71) _P_API="${_PHP71_API}" ;; 70) _P_API="${_PHP70_API}" ;; 56) _P_API="${_PHP56_API}" ;; *) _msg "WARN: Unknown PHP API version for PHP ${e}" ;; esac _THIS_FILE=/opt/php${e}/etc/php${e}.ini _OPCACHE_LP="/opt/php${e}/lib/php/extensions/no-debug-non-zts" _OPCACHE_SO="${_OPCACHE_LP}-${_P_API}/opcache.so" _fix_php_ini_opcache "${e}" done } # # Fix php.ini file to add php_tet.so _fix_php_ini_tet() { if [ -e "${_THIS_FILE}" ]; then _TET_INI_TEST=$(grep "^extension=php_tet.so" ${_THIS_FILE} 2>&1) if [[ "${_TET_INI_TEST}" =~ "extension=php_tet.so" ]]; then _DO_NOTHING=YES else echo "extension=php_tet.so" >> ${_THIS_FILE} fi fi } # # Fix all php.ini files to add php_tet.so _fix_php_ini_tet_all() { if [ "${_PHP_TET}" = "YES" ] || [[ "${_XTRAS_LIST}" =~ "TET" ]]; then _PHP_V="85 84 83 82 81 80 74 73 72 71 70 56" for e in ${_PHP_V}; do _P_API= case "${e}" in 85) _P_API="${_PHP85_API}" ;; 84) _P_API="${_PHP84_API}" ;; 83) _P_API="${_PHP83_API}" ;; 82) _P_API="${_PHP82_API}" ;; 81) _P_API="${_PHP81_API}" ;; 80) _P_API="${_PHP80_API}" ;; 74) _P_API="${_PHP74_API}" ;; 73) _P_API="${_PHP73_API}" ;; 72) _P_API="${_PHP72_API}" ;; 71) _P_API="${_PHP71_API}" ;; 70) _P_API="${_PHP70_API}" ;; 56) _P_API="${_PHP56_API}" ;; *) _msg "WARN: Unknown PHP API version for PHP ${e}" ;; esac _TET_BASE="/opt/php${e}/lib/php/extensions/no-debug-non-zts" _TET_SO="${_TET_BASE}-${_P_API}/php_tet.so" if [ ! -e "${_TET_SO}" ]; then if [[ "${e}" =~ "80" ]] || [[ "${e}" =~ "74" ]] || [[ "${e}" =~ "73" ]]; then _TET_VRN="5.3-Linux-x64-Perl-PHP-Python-Ruby" else _TET_VRN="5.2-Linux-x86_64-Perl-PHP-Python-Ruby" fi if [ ! -e "/var/opt/TET-${_TET_VRN}/bind/php" ]; then mkdir -p /var/opt cd /var/opt _get_dev_src "TET-${_TET_VRN}.tar.gz" fi if [ -e "/var/opt/TET-${_TET_VRN}/bind/php/php-${e}0-nts" ]; then cd /var/opt/TET-${_TET_VRN}/bind/php/php-${e}0-nts/ cp -a php_tet.so ${_TET_SO} fi fi if [ -e "${_TET_SO}" ]; then _THIS_FILE=/opt/php${e}/etc/php${e}.ini _fix_php_ini_tet _THIS_FILE=/opt/php${e}/lib/php.ini _fix_php_ini_tet fi done fi } # # Fix php.ini file to add geos.so _fix_php_ini_geos() { if [ -e "${_THIS_FILE}" ]; then _GEOS_INI_TEST=$(grep "^extension=geos.so" ${_THIS_FILE} 2>&1) if [[ "${_GEOS_INI_TEST}" =~ "extension=geos.so" ]]; then _DO_NOTHING=YES else echo "extension=geos.so" >> ${_THIS_FILE} fi fi } # # Fix all php.ini files to add geos.so _fix_php_ini_geos_all() { if [ "${_PHP_GEOS}" = "YES" ] || [[ "${_XTRAS_LIST}" =~ "GEO" ]]; then _PHP_V="56" for e in ${_PHP_V}; do _THIS_FILE=/opt/php${e}/etc/php${e}.ini _fix_php_ini_geos _THIS_FILE=/opt/php${e}/lib/php.ini _fix_php_ini_geos done fi } # # Fix php.ini file to add mongo.so _fix_php_ini_mongo() { if [ -e "${_THIS_FILE}" ]; then _MONGO_INI_TEST=$(grep "^extension=mongo.so" ${_THIS_FILE} 2>&1) if [[ "${_MONGO_INI_TEST}" =~ "extension=mongo.so" ]]; then _DO_NOTHING=YES else echo "extension=mongo.so" >> ${_THIS_FILE} fi fi } # # Fix php.ini file to add mongodb.so _fix_php_ini_mongodb() { if [ -e "${_THIS_FILE}" ]; then _MONGODB_INI_TEST=$(grep "^extension=mongodb.so" ${_THIS_FILE} 2>&1) if [[ "${_MONGODB_INI_TEST}" =~ "extension=mongodb.so" ]]; then _DO_NOTHING=YES else echo "extension=mongodb.so" >> ${_THIS_FILE} fi fi } # # Fix all php.ini files to add mongo.so or mongodb.so _fix_php_ini_mongo_all() { if [ "${_PHP_MONGODB}" = "YES" ] || [[ "${_XTRAS_LIST}" =~ "MNG" ]]; then _PHP_V="56" for e in ${_PHP_V}; do _THIS_FILE=/opt/php${e}/etc/php${e}.ini _fix_php_ini_mongo _THIS_FILE=/opt/php${e}/lib/php.ini _fix_php_ini_mongo done _PHP_V="72 71 70" for e in ${_PHP_V}; do _THIS_FILE=/opt/php${e}/etc/php${e}.ini _fix_php_ini_mongodb _THIS_FILE=/opt/php${e}/lib/php.ini _fix_php_ini_mongodb done fi } # # Update PHP Config. _php_conf_update() { if [ -z "${_THISHTIP}" ]; then _LOC_DOM="${_hName}" _find_correct_ip _THISHTIP="${_LOC_IP}" fi if [ ! -e "/opt/etc/fpm" ] \ || [ ! -e "/opt/etc/fpm/fpm-pool-common.conf" ] \ || [ ! -e "/opt/etc/fpm/fpm-pool-common-legacy.conf" ] \ || [ ! -e "/opt/etc/fpm/fpm-pool-common-modern.conf" ]; then mkdir -p /opt/etc/fpm fi cp -af ${_locCnf}/php/fpm-pool-common.conf /opt/etc/fpm/fpm-pool-common.conf cp -af ${_locCnf}/php/fpm-pool-common-legacy.conf /opt/etc/fpm/fpm-pool-common-legacy.conf cp -af ${_locCnf}/php/fpm-pool-common-modern.conf /opt/etc/fpm/fpm-pool-common-modern.conf sed -i "s/127.0.0.1/127.0.0.1,${_THISHTIP}/g" /opt/etc/fpm/fpm-pool-commo*.conf wait sed -i "s/mode =.*/mode = 0660/g" /opt/etc/fpm/fpm-pool-commo*.conf wait _PHP_V="85 84 83 82 81 80 74 73 72 71 70 56" for e in ${_PHP_V}; do if [ ! -e "/var/www/www${e}" ]; then adduser --system --group --home /var/www/www${e} www${e} &> /dev/null usermod -aG www-data www${e} fi if [ ! -e "/opt/php${e}/etc/php${e}.ini" ] \ || [ ! -e "/opt/php${e}/etc/pool.d/www${e}.conf" ]; then mkdir -p /opt/php${e}/etc/pool.d cp -af ${_locCnf}/php/php${e}.ini /opt/php${e}/etc/php${e}.ini fi cp -af ${_locCnf}/php/fpm${e}-pool-www.conf /opt/php${e}/etc/pool.d/www${e}.conf if [ ! -e "/opt/php${e}/lib/php.ini" ]; then mkdir -p /opt/php${e}/lib cp -af ${_locCnf}/php/php${e}-cli.ini /opt/php${e}/lib/php.ini fi cp -af ${_locCnf}/php/php${e}.ini /opt/php${e}/etc/php${e}.ini cp -af ${_locCnf}/php/php${e}-cli.ini /opt/php${e}/lib/php.ini cp -af ${_locCnf}/php/php${e}-fpm.conf /opt/php${e}/etc/php${e}-fpm.conf _THIS_FILE=/opt/php${e}/etc/php${e}.ini if [ "${e}" != "56" ]; then _fix_php_ini_apcu fi if [ "${e}" != "56" ] && [ "${e}" != "70" ] && [ "${e}" != "71" ]; then _fix_php_ini_mcrypt fi if [ "${e}" = 56 ]; then _fix_php_ini_mailparse _fix_php_ini_twig fi if [ "${e}" != 80 ] && [ "${e}" != 81 ]; then _add_php_ini_jsmin fi if [ "${e}" = 80 ] || [ "${e}" = 81 ]; then _remove_php_ini_jsmin fi _fix_php_ini_igbinary _fix_php_ini_redis _fix_php_ini_ioncube _remove_php_ini_suhosin _fix_php_ini_yaml _THIS_FILE=/opt/php${e}/lib/php.ini if [ "${e}" != "56" ]; then _fix_php_ini_apcu fi if [ "${e}" != "56" ] && [ "${e}" != "70" ] && [ "${e}" != "71" ]; then _fix_php_ini_mcrypt fi if [ "${e}" = 56 ]; then _fix_php_ini_mailparse _fix_php_ini_twig fi if [ "${e}" != 80 ] && [ "${e}" != 81 ]; then _add_php_ini_jsmin fi if [ "${e}" = 80 ] || [ "${e}" = 81 ]; then _remove_php_ini_jsmin fi _fix_php_ini_igbinary _fix_php_ini_redis _fix_php_ini_ioncube _remove_php_ini_suhosin _fix_php_ini_yaml if [ -e "/opt/php${e}/etc/php${e}.ini" ]; then sed -i "s/^zlib.output_compression.*/zlib.output_compression = Off/g" /opt/php${e}/etc/php${e}.ini wait sed -i "s/.*zlib.output_compression_level/;zlib.output_compression_level/g" /opt/php${e}/etc/php${e}.ini wait fi if [ -e "/opt/php${e}/lib/php.ini" ]; then sed -i "s/^zlib.output_compression.*/zlib.output_compression = Off/g" /opt/php${e}/lib/php.ini wait sed -i "s/.*zlib.output_compression_level/;zlib.output_compression_level/g" /opt/php${e}/lib/php.ini wait fi done rm -f /etc/php5/conf.d/{opcache.ini,apc.ini,imagick.ini,memcached.ini} rm -f /etc/php5/conf.d/{redis.ini,suhosin.ini,newrelic.ini} _fix_php_ini_newrelic_all _fix_php_ini_geos_all _fix_php_ini_mongo_all _fix_php_ini_tet_all _fix_php_ini_opcache_all } # _restore_default_php() { _msg "INFO: Restoring default PHP configuration" cp -af ${_locCnf}/php/php85-cli.ini /opt/php85/lib/php.ini &> /dev/null cp -af ${_locCnf}/php/php85.ini /opt/php85/etc/php85.ini &> /dev/null cp -af ${_locCnf}/php/php84-cli.ini /opt/php84/lib/php.ini &> /dev/null cp -af ${_locCnf}/php/php84.ini /opt/php84/etc/php84.ini &> /dev/null cp -af ${_locCnf}/php/php83-cli.ini /opt/php83/lib/php.ini &> /dev/null cp -af ${_locCnf}/php/php83.ini /opt/php83/etc/php83.ini &> /dev/null cp -af ${_locCnf}/php/php82-cli.ini /opt/php82/lib/php.ini &> /dev/null cp -af ${_locCnf}/php/php82.ini /opt/php82/etc/php82.ini &> /dev/null cp -af ${_locCnf}/php/php81-cli.ini /opt/php81/lib/php.ini &> /dev/null cp -af ${_locCnf}/php/php81.ini /opt/php81/etc/php81.ini &> /dev/null cp -af ${_locCnf}/php/php80-cli.ini /opt/php80/lib/php.ini &> /dev/null cp -af ${_locCnf}/php/php80.ini /opt/php80/etc/php80.ini &> /dev/null cp -af ${_locCnf}/php/php74-cli.ini /opt/php74/lib/php.ini &> /dev/null cp -af ${_locCnf}/php/php74.ini /opt/php74/etc/php74.ini &> /dev/null cp -af ${_locCnf}/php/php73-cli.ini /opt/php73/lib/php.ini &> /dev/null cp -af ${_locCnf}/php/php73.ini /opt/php73/etc/php73.ini &> /dev/null cp -af ${_locCnf}/php/php72-cli.ini /opt/php72/lib/php.ini &> /dev/null cp -af ${_locCnf}/php/php72.ini /opt/php72/etc/php72.ini &> /dev/null cp -af ${_locCnf}/php/php71-cli.ini /opt/php71/lib/php.ini &> /dev/null cp -af ${_locCnf}/php/php71.ini /opt/php71/etc/php71.ini &> /dev/null cp -af ${_locCnf}/php/php70-cli.ini /opt/php70/lib/php.ini &> /dev/null cp -af ${_locCnf}/php/php70.ini /opt/php70/etc/php70.ini &> /dev/null cp -af ${_locCnf}/php/php56-cli.ini /opt/php56/lib/php.ini &> /dev/null cp -af ${_locCnf}/php/php56.ini /opt/php56/etc/php56.ini &> /dev/null } # _tune_php() { _msg "INFO: Tuning PHP configuration" if [ "${_TUNE_PHP_FPM_TIMEOUT}" -lt 60 ]; then _TUNE_PHP_FPM_TIMEOUT=60 fi # PHP-FPM pools sed -i "s/180s/${_TUNE_PHP_FPM_TIMEOUT}s/g" /opt/php*/etc/pool.d/*.conf &> /dev/null wait sed -i "s/180s/${_TUNE_PHP_FPM_TIMEOUT}s/g" /opt/php*/etc/php*-fpm.conf &> /dev/null wait sed -i "s/180/${_TUNE_PHP_FPM_TIMEOUT}/g" /opt/etc/fpm/fpm-pool-common*.conf &> /dev/null wait # PHP-FPM INI sed -i "s/^default_socket_timeout =.*/default_socket_timeout = ${_TUNE_PHP_FPM_TIMEOUT}/g" /opt/php*/etc/php*.ini &> /dev/null wait sed -i "s/^max_execution_time =.*/max_execution_time = ${_TUNE_PHP_FPM_TIMEOUT}/g" /opt/php*/etc/php*.ini &> /dev/null wait sed -i "s/^max_input_time =.*/max_input_time = ${_TUNE_PHP_FPM_TIMEOUT}/g" /opt/php*/etc/php*.ini &> /dev/null wait # PHP-CLI INI sed -i "s/^max_execution_time =.*/max_execution_time = ${_TUNE_PHP_CLI_TIMEOUT}/g" /opt/php*/lib/php.ini &> /dev/null wait sed -i "s/^max_input_time =.*/max_input_time = ${_TUNE_PHP_CLI_TIMEOUT}/g" /opt/php*/lib/php.ini &> /dev/null wait sed -i "s/^default_socket_timeout =.*/default_socket_timeout = ${_TUNE_PHP_CLI_TIMEOUT}/g" /opt/php*/lib/php.ini &> /dev/null wait # Redis config should sync with PHP-CLI sed -i "s/^timeout .*/timeout ${_TUNE_PHP_CLI_TIMEOUT}/g" /etc/redis/redis.conf &> /dev/null wait } # # Update innodb_log_file_size. _innodb_log_file_size_update() { _msg "INFO: InnoDB log file will be set to ${_INNODB_LOG_FILE_SIZE_MB}..." _DBS_TEST="$(which mysql)" if [ ! -z "${_DBS_TEST}" ]; then _DB_SERVER_TEST=$(mysql -V 2>&1) fi if [[ "${_DB_SERVER_TEST}" =~ "Ver 8.4." ]]; then _DB_V=8.4 elif [[ "${_DB_SERVER_TEST}" =~ "Ver 8.0." ]]; then _DB_V=8.0 elif [[ "${_DB_SERVER_TEST}" =~ "Distrib 5.7." ]]; then _DB_V=5.7 fi _IS_MYSQLD_RUNNING=$(pgrep -f /usr/sbin/mysqld) if [ ! -z "${_IS_MYSQLD_RUNNING}" ] && [ "${_DB_V}" = "5.7" ]; then _SQL_PSWD=$(cat /root/.my.pass.txt 2>/dev/null | tr -d '\n') mysql -u root -e "SET GLOBAL innodb_max_dirty_pages_pct = 0;" &> /dev/null mysql -u root -e "SET GLOBAL innodb_change_buffering = 'none';" &> /dev/null mysql -u root -e "SET GLOBAL innodb_buffer_pool_dump_at_shutdown = 1;" &> /dev/null mysql -u root -e "SET GLOBAL innodb_io_capacity=3000;" &> /dev/null mysql -u root -e "SET GLOBAL innodb_io_capacity_max=6000;" &> /dev/null if [ "${_DB_V}" = "5.7" ]; then mysql -u root -e "SET GLOBAL innodb_buffer_pool_dump_pct = 100;" &> /dev/null mysql -u root -e "SET GLOBAL innodb_buffer_pool_dump_now = ON;" &> /dev/null fi mysql -u root -e "SET GLOBAL innodb_fast_shutdown = 0;" &> /dev/null fi service mysql stop echo "Waiting 15 seconds..." sleep 15 if [ ! -e "/run/mysqld/mysqld.sock" ] \ && [ ! -e "/run/mysqld/mysqld.pid" ]; then mkdir -p ${_vBs}/old-sql-ib-log-${_NOW} sleep 5 mv -f /var/lib/mysql/ib_logfile0 ${_vBs}/old-sql-ib-log-${_NOW}/ &> /dev/null mv -f /var/lib/mysql/ib_logfile1 ${_vBs}/old-sql-ib-log-${_NOW}/ &> /dev/null sed -i "s/.*innodb_log_file_size.*/innodb_log_file_size = ${_INNODB_LOG_FILE_SIZE_MB}/g" /etc/mysql/my.cnf wait echo "Waiting 15 seconds..." sleep 15 fi if [ ! -e "/run/mysqld/mysqld.sock" ]; then service mysql start &> /dev/null fi } # _restore_default_sql() { _msg "INFO: Restoring default SQL configuration" sed -i "s/.*check_for_crashed_tables/#check_for_crashed_tables/g" /etc/mysql/debian-start &> /dev/null wait _if_hosted_sys if [ "${_CUSTOM_CONFIG_SQL}" = "NO" ] \ || [ "${_hostedSys}" = "YES" ]; then if [ "${_CUSTOM_CONFIG_SQL}" = "YES" ]; then _DO_NOTHING=YES else cp -af /etc/mysql/my.cnf \ /var/backups/dragon/t/my.cnf-pre-${_xSrl}-${_X_VERSION}-${_NOW} &> /dev/null cp -af ${_locCnf}/var/my.cnf.txt /etc/mysql/my.cnf _INNODB_LOG_FILE_SIZE=${_INNODB_LOG_FILE_SIZE//[^0-9]/} if [ ! -z "${_INNODB_LOG_FILE_SIZE}" ]; then if [ "${_INNODB_LOG_FILE_SIZE}" -ge 50 ]; then _INNODB_LOG_FILE_SIZE_MB="${_INNODB_LOG_FILE_SIZE}M" _INNODB_LOG_FILE_SIZE_TEST=$(grep "innodb_log_file_size" \ /var/backups/dragon/t/my.cnf-pre-${_xSrl}-${_X_VERSION}-${_NOW} 2>&1) if [[ "${_INNODB_LOG_FILE_SIZE_TEST}" =~ "= ${_INNODB_LOG_FILE_SIZE_MB}" ]]; then _INNODB_LOG_FILE_SIZE_SAME=YES else _INNODB_LOG_FILE_SIZE_SAME=NO fi fi fi sed -i "s/.*slow_query_log/#slow_query_log/g" /etc/mysql/my.cnf wait sed -i "s/.*long_query_time/#long_query_time/g" /etc/mysql/my.cnf wait sed -i "s/.*slow_query_log_file/#slow_query_log_file/g" /etc/mysql/my.cnf wait if [ ! -e "/etc/mysql/skip-name-resolve.txt" ]; then sed -i "s/.*skip-name-resolve/#skip-name-resolve/g" /etc/mysql/my.cnf wait fi fi fi mv -f /etc/mysql/my.cnf-pre* /var/backups/dragon/t/ &> /dev/null sed -i "s/.*default-table-type/#default-table-type/g" /etc/mysql/my.cnf &> /dev/null wait sed -i "s/.*language/#language/g" /etc/mysql/my.cnf &> /dev/null wait sed -i "s/.*innodb_lazy_drop_table.*//g" /etc/mysql/my.cnf &> /dev/null wait if [ "${_CUSTOM_CONFIG_SQL}" = "NO" ]; then if [ "${_DB_BINARY_LOG}" = "NO" ]; then # Disable binary logging sed -i \ -e "s/^\s*\(log_bin\s*=.*\)/#\1/" \ -e "s/^\s*#\s*\(skip-log-bin\)/\1/" \ -e "s/^\s*\(max_binlog_size\s*=.*\)/#\1/" \ -e "s/^\s*\(binlog_row_image\s*=.*\)/#\1/" \ -e "s/^\s*\(binlog_format\s*=.*\)/#\1/" \ /etc/mysql/my.cnf &> /dev/null elif [ "${_DB_BINARY_LOG}" = "YES" ]; then # Enable binary logging sed -i \ -e "s/^\s*#\s*\(log_bin\s*=.*\)/\1/" \ -e "s/^\s*\(skip-log-bin\)/#\1/" \ -e "s/^\s*#\s*\(max_binlog_size\s*=.*\)/\1/" \ -e "s/^\s*#\s*\(binlog_row_image\s*=.*\)/\1/" \ -e "s/^\s*#\s*\(binlog_format\s*=.*\)/\1/" \ /etc/mysql/my.cnf &> /dev/null fi if [ ! -z "${_INNODB_LOG_FILE_SIZE}" ]; then if [ "${_INNODB_LOG_FILE_SIZE}" -ge 50 ]; then _INNODB_LOG_FILE_SIZE_MB="${_INNODB_LOG_FILE_SIZE}M" _INNODB_LOG_FILE_SIZE_TEST=$(grep "innodb_log_file_size" /etc/mysql/my.cnf 2>&1) if [[ "${_INNODB_LOG_FILE_SIZE_TEST}" =~ "= ${_INNODB_LOG_FILE_SIZE_MB}" ]]; then _DO_NOTHING=YES else if [ "${_INNODB_LOG_FILE_SIZE_SAME}" = "YES" ]; then sed -i "s/.*innodb_log_file_size.*/innodb_log_file_size = ${_INNODB_LOG_FILE_SIZE_MB}/g" \ /etc/mysql/my.cnf &> /dev/null wait else _innodb_log_file_size_update fi fi fi fi fi } # _tune_sql() { _msg "INFO: Tuning SQL configuration" sed -i "s/9999/${_TUNE_SQL_TIMEOUT}/g" /etc/mysql/my.cnf &> /dev/null wait sed -i "s/9999/${_TUNE_SQL_TIMEOUT}/g" /var/xdrago/minute.sh &> /dev/null wait } # _restore_default_nginx() { _msg "INFO: Restoring default Nginx configuration" if [ -d "${_TUNE_HOSTMASTER}" ]; then for _Files in `find ${_TUNE_HOSTMASTER}/config/server_master/nginx/vhost.d -type f`; do sed -i "s/#limit_conn /limit_conn /g" ${_Files} &> /dev/null wait done fi su -s /bin/bash - aegir -c "drush8 @server_master provision-verify" &> /dev/null wait sleep 8 } # _tune_nginx() { _msg "INFO: Tuning Nginx configuration" sed -i "s/60/${_TUNE_NGINX_TIMEOUT}/g" /var/aegir/config/server_master/nginx.conf &> /dev/null wait sed -i "s/300/${_TUNE_NGINX_TIMEOUT}/g" /var/aegir/config/server_master/nginx.conf &> /dev/null wait sed -i "s/180/${_TUNE_NGINX_TIMEOUT}/g" /var/aegir/config/server_master/nginx.conf &> /dev/null wait if [ "${_TUNE_NGINX_CONNECT}" = "OFF" ]; then sed -i "s/limit_conn /#limit_conn /g" /var/aegir/config/server_master/nginx.conf &> /dev/null wait if [ -d "${_TUNE_HOSTMASTER}" ]; then for _Files in `find ${_TUNE_HOSTMASTER}/config/server_master/nginx/vhost.d -type f`; do sed -i "s/limit_conn /#limit_conn /g" ${_Files} &> /dev/null wait done fi fi } # _restart_services() { _msg "INFO: Reloading services" _PHP_V="85 84 83 82 81 80 74 73 72 71 70 56" for e in ${_PHP_V}; do if [ -e "/etc/init.d/php${e}-fpm" ]; then service "php${e}-fpm" reload &> /dev/null fi done bash /var/xdrago/move_sql.sh &> /dev/null wait service nginx reload &> /dev/null if [ -e "/etc/init.d/valkey-server" ]; then service valkey-server reload &> /dev/null elif [ -e "/etc/init.d/redis-server" ]; then service redis-server reload &> /dev/null fi if [ -x "/usr/sbin/csf" ] && [ -e "/etc/csf/csf.deny" ]; then if [ -e "/etc/csf/csfpost.d/synproxy.sh" ]; then csf -ra &> /dev/null synproxy_reassert -p "443 80" --no-quic -q &> /dev/null else csf -r &> /dev/null fi ### Linux kernel TCP SACK CVEs mitigation ### CVE-2019-11477 SACK Panic ### CVE-2019-11478 SACK Slowness ### CVE-2019-11479 Excess Resource Consumption Due to Low MSS Values if [ -x "/usr/sbin/csf" ] && [ -e "/etc/csf/csf.deny" ]; then _SACK_TEST=$(ip6tables --list | grep tcpmss) if [[ ! "${_SACK_TEST}" =~ "tcpmss" ]]; then sysctl net.ipv4.tcp_mtu_probing=0 &> /dev/null iptables -A INPUT -p tcp -m tcpmss --mss 1:500 -j DROP &> /dev/null ip6tables -A INPUT -p tcp -m tcpmss --mss 1:500 -j DROP &> /dev/null [ -e "/etc/csf/csfpost.d/synproxy.sh" ] && synproxy_reassert -p "443 80" --no-quic -q &> /dev/null fi fi fi } # # Tune Web Sever configuration. _tune_web_server_config() { _LIM_FPM="${_L_PHP_FPM_WORKERS}" if [ "${_LIM_FPM}" -lt 48 ]; then _if_hosted_sys if [ "${_hostedSys}" = "YES" ]; then _LIM_FPM=48 fi fi _CHILD_MAX_FPM=$(( _LIM_FPM * 2 )) if [ "${_PHP_FPM_WORKERS}" != "AUTO" ]; then _PHP_FPM_WORKERS=${_PHP_FPM_WORKERS//[^0-9]/} if [ ! -z "${_PHP_FPM_WORKERS}" ] && [ "${_PHP_FPM_WORKERS}" -gt 0 ]; then _CHILD_MAX_FPM="${_PHP_FPM_WORKERS}" fi fi _PHP_V="85 84 83 82 81 80 74 73 72 71 70 56" for e in ${_PHP_V}; do sed -i "s/pm.max_children =.*/pm.max_children = ${_CHILD_MAX_FPM}/g" \ /opt/php${e}/etc/pool.d/www${e}.conf &> /dev/null wait if [ ! -z "${_PHP_FPM_DENY}" ]; then sed -i "s/passthru,/${_PHP_FPM_DENY},/g" \ /opt/php${e}/etc/pool.d/www${e}.conf &> /dev/null wait fi done # PHP-FPM INI sed -i "s/^default_socket_timeout =.*/default_socket_timeout = 180/g" /opt/php*/etc/php*.ini &> /dev/null wait sed -i "s/^max_execution_time =.*/max_execution_time = 180/g" /opt/php*/etc/php*.ini &> /dev/null wait sed -i "s/^max_input_time =.*/max_input_time = 180/g" /opt/php*/etc/php*.ini &> /dev/null wait # PHP-CLI INI sed -i "s/^default_socket_timeout =.*/default_socket_timeout = 3600/g" /opt/php*/lib/php.ini &> /dev/null wait sed -i "s/^max_execution_time =.*/max_execution_time = 3600/g" /opt/php*/lib/php.ini &> /dev/null wait sed -i "s/^max_input_time =.*/max_input_time = 3600/g" /opt/php*/lib/php.ini &> /dev/null wait # Redis config should sync with PHP-CLI sed -i "s/^timeout .*/timeout 3600/g" /etc/redis/redis.conf &> /dev/null wait } # # _check_mysqld_running() { while [ -z "${_IS_MYSQLD_RUNNING}" ] \ || [ ! -e "/run/mysqld/mysqld.sock" ]; do _IS_MYSQLD_RUNNING=$(pgrep -f /usr/sbin/mysqld) _msg "INFO: Waiting for MySQLD availability before _tune_sql_memory_limits..." sleep 5 service mysql start &> /dev/null done } # # Tune memory limits for SQL server. _tune_sql_memory_limits() { _check_mysqld_running # https://raw.githubusercontent.com/major/MySQLTuner-perl/master/mysqltuner.pl _pthTun="/var/opt/mysqltuner.pl" _outTun="/var/opt/mysqltuner-${_xSrl}-${_X_VERSION}-${_NOW}.txt" if [ ! -e "${_outTun}" ] \ && [ "${_STATUS}" = "UPGRADE" ]; then _msg "INFO: Running MySQLTuner check on all databases" _msg "WAIT: This may take a while, please wait..." _MYSQLTUNER_TEST_RESULT=OK rm -f /var/opt/mysqltuner* curl ${_crlGet} "${_urlDev}/mysqltuner.pl.${_MYSQLTUNER_VRN}" -o ${_pthTun} if [ ! -e "${_pthTun}" ]; then curl ${_crlGet} "${_urlDev}/mysqltuner.pl" -o ${_pthTun} fi if [ -e "${_pthTun}" ]; then perl ${_pthTun} > ${_outTun} 2>&1 fi fi if [ -e "${_pthTun}" ] \ && [ -e "${_outTun}" ] \ && [ "${_STATUS}" = "UPGRADE" ]; then _REC_MYISAM_MEM=$(cat ${_outTun} \ | grep "Data in MyISAM tables" \ | cut -d: -f2 \ | awk '{ print $1}' 2>&1) _REC_INNODB_MEM=$(cat ${_outTun} \ | grep "data size:" \ | cut -d/ -f3 \ | awk '{ print $1}' 2>&1) _MYSQLTUNER_TEST=$(cat ${_outTun} 2>&1) cp -a ${_outTun} ${_pthLog}/ if [ -z "${_REC_INNODB_MEM}" ] \ || [[ "${_MYSQLTUNER_TEST}" =~ "Cannot calculate MyISAM index" ]] \ || [[ "${_MYSQLTUNER_TEST}" =~ "InnoDB is enabled but isn" ]]; then _MYSQLTUNER_TEST_RESULT=FAIL _msg "NOTE: The MySQLTuner test failed!" _msg "NOTE: Please review ${_outTun}" _msg "NOTE: We will use some sane SQL defaults instead, do not worry!" fi ###--------------------### if [ ! -z "${_REC_MYISAM_MEM}" ] \ && [ "${_MYSQLTUNER_TEST_RESULT}" = "OK" ]; then _RAW_MYISAM_MEM=$(echo ${_REC_MYISAM_MEM} | sed "s/[A-Z]//g" 2>&1) if [[ "${_REC_MYISAM_MEM}" =~ "G" ]]; then _RAW_MYISAM_MEM=$(( _RAW_MYISAM_MEM * 1024 )) fi if [ "${_RAW_MYISAM_MEM}" -gt "${_USE_SQL}" ]; then _USE_MYISAM_MEM="${_USE_SQL}" else _USE_MYISAM_MEM="${_RAW_MYISAM_MEM}" fi if [ "${_USE_MYISAM_MEM}" -lt 256 ] || [ -z "${_USE_MYISAM_MEM}" ]; then _USE_MYISAM_MEM="${_USE_SQL}" fi _USE_MYISAM_MEM="${_USE_MYISAM_MEM}M" sed -i "s/^key_buffer_size.*/key_buffer_size = ${_USE_MYISAM_MEM}/g" /etc/mysql/my.cnf wait else _USE_MYISAM_MEM="${_USE_SQL}M" if [ "${_MYSQLTUNER_TEST_RESULT}" = "FAIL" ]; then _msg "NOTE: _USE_MYISAM_MEM is ${_USE_MYISAM_MEM} because _REC_MYISAM_MEM was empty!" fi sed -i "s/^key_buffer_size.*/key_buffer_size = ${_USE_MYISAM_MEM}/g" /etc/mysql/my.cnf wait fi ###--------------------### if [ ! -z "${_REC_INNODB_MEM}" ] && [ "${_MYSQLTUNER_TEST_RESULT}" = "OK" ]; then _RAW_INNODB_MEM=$(echo ${_REC_INNODB_MEM} | sed "s/[A-Z]//g" 2>&1) if [[ "${_REC_INNODB_MEM}" =~ "G" ]]; then _RAW_INNODB_MEM=$(echo ${_RAW_INNODB_MEM} | awk '{print int($1+0.6)}' 2>&1) _RAW_INNODB_MEM=$(echo "${_RAW_INNODB_MEM} * 1024" | bc -l 2>&1) elif [[ "${_REC_INNODB_MEM}" =~ "M" ]]; then _RAW_INNODB_MEM=$(echo ${_RAW_INNODB_MEM} | awk '{print int($1+0.6)}' 2>&1) _RAW_INNODB_MEM=$(echo "${_RAW_INNODB_MEM} * 1" | bc -l 2>&1) fi _RAW_INNODB_MEM=$(echo "(${_RAW_INNODB_MEM}+0.5)/1" | bc 2>&1) if [ "${_RAW_INNODB_MEM}" -gt "${_USE_SQL}" ] \ || [ -z "${_USE_INNODB_MEM}" ] \ || [ "${_RAW_INNODB_MEM}" -lt 512 ]; then _USE_INNODB_MEM="${_USE_SQL}" else _RAW_INNODB_MEM=$(echo "scale=2; (${_RAW_INNODB_MEM} * 1.1)" | bc 2>&1) _USE_INNODB_MEM=$(echo "(${_RAW_INNODB_MEM}+0.5)/1" | bc 2>&1) fi _INNODB_BPI=$(echo "scale=0; ${_USE_INNODB_MEM}/1024/2" | bc 2>&1) if [ "${_INNODB_BPI}" -lt 1 ] || [ -z "${_INNODB_BPI}" ]; then _INNODB_BPI="1" fi sed -i "s/^innodb_buffer_pool_instances.*/innodb_buffer_pool_instances = ${_INNODB_BPI}/g" /etc/mysql/my.cnf wait sed -i "s/^innodb_page_cleaners.*/innodb_page_cleaners = ${_INNODB_BPI}/g" /etc/mysql/my.cnf wait _USE_INNODB_MEM="${_USE_INNODB_MEM}M" sed -i "s/^innodb_buffer_pool_size.*/innodb_buffer_pool_size = ${_USE_INNODB_MEM}/g" /etc/mysql/my.cnf wait else _USE_INNODB_MEM="${_USE_SQL}M" _msg "NOTE: _USE_INNODB_MEM is ${_USE_INNODB_MEM} because _REC_INNODB_MEM was empty!" sed -i "s/^innodb_buffer_pool_size.*/innodb_buffer_pool_size = ${_USE_INNODB_MEM}/g" /etc/mysql/my.cnf wait fi else _THIS_USE_MEM="${_USE_SQL}M" if [ "${_MYSQLTUNER_TEST_RESULT}" = "FAIL" ] \ && [ "${_STATUS}" = "UPGRADE" ]; then _msg "NOTE: _USE_MYISAM_MEM is ${_THIS_USE_MEM} because _REC_MYISAM_MEM was empty!" _msg "NOTE: _USE_INNODB_MEM is ${_THIS_USE_MEM} because _REC_INNODB_MEM was empty!" fi sed -i "s/= 181/= ${_USE_SQL}/g" /etc/mysql/my.cnf wait fi } # # Tune memory limits for PHP, Nginx and Percona. _tune_memory_limits() { _msg "INFO: Default Memory Tuning" _VM_TEST="$(uname -a)" if [ -e "/proc/bean_counters" ]; then _VMFAMILY="VZ" elif [ -e "/root/.tg.cnf" ]; then _VMFAMILY="TG" else _VMFAMILY="XEN" fi if [[ "${_VM_TEST}" =~ "-beng" ]]; then _VMFAMILY="VS" fi # Check for Amazon EC2 in the system manufacturer field if dmidecode -s system-manufacturer | grep -i 'Amazon EC2' &> /dev/null; then _VMFAMILY="AWS" fi _CPU_INFO="$(grep -c processor /proc/cpuinfo)" _CPU_INFO=${_CPU_INFO//[^0-9]/} _NPROC_TEST="$(which nproc)" if [ -z "${_NPROC_TEST}" ]; then _CPU_NR="${_CPU_INFO}" else _CPU_NR=$(nproc 2>&1) fi _CPU_NR=${_CPU_NR//[^0-9]/} if [ ! -z "${_CPU_NR}" ] && [ ! -z "${_CPU_INFO}" ] \ && [ "${_CPU_NR}" -gt "${_CPU_INFO}" ] && [ "${_CPU_INFO}" -gt 0 ]; then _CPU_NR="${_CPU_INFO}" fi if [ -z "${_CPU_NR}" ] || [ "${_CPU_NR}" -lt 1 ]; then _CPU_NR=1 fi _CPU_MX=$(( _CPU_NR * 2 )) if [ "${_CPU_MX}" -lt 4 ]; then _CPU_MX=4 fi _CPU_TG=$(( _CPU_NR / 2 )) if [ "${_CPU_TG}" -lt 4 ]; then _CPU_TG=4 fi _CPU_VS=$(( _CPU_NR / 12 )) if [ "${_CPU_VS}" -lt 2 ]; then _CPU_VS=2 fi _PrTest=$(grep "POWER" /root/.*.octopus.cnf 2>&1) if [[ "${_PrTest}" =~ "POWER" ]]; then if [ "${_CPU_VS}" -lt 8 ]; then _CPU_VS=8 fi fi _PrTest=$(grep "PHANTOM" /root/.*.octopus.cnf 2>&1) if [[ "${_PrTest}" =~ "PHANTOM" ]]; then if [ "${_CPU_VS}" -lt 8 ]; then _CPU_VS=8 fi fi _PrTest=$(grep "CLUSTER" /root/.*.octopus.cnf 2>&1) if [[ "${_PrTest}" =~ "CLUSTER" ]]; then if [ "${_CPU_VS}" -lt 8 ]; then _CPU_VS=8 fi fi _PrTest=$(grep "ULTRA" /root/.*.octopus.cnf 2>&1) if [[ "${_PrTest}" =~ "ULTRA" ]]; then if [ "${_CPU_VS}" -lt 8 ]; then _CPU_VS=8 fi fi _PrTest=$(grep "MONSTER" /root/.*.octopus.cnf 2>&1) if [[ "${_PrTest}" =~ "MONSTER" ]]; then if [ "${_CPU_VS}" -lt 8 ]; then _CPU_VS=8 fi fi _RAM=$(free -mt | grep Mem: | awk '{ print $2 }' 2>&1) if [ "${_RESERVED_RAM}" -gt 0 ]; then _RAM=$(( _RAM - _RESERVED_RAM )) else _RESERVED_RAM=$(( _RAM / 4 )) _RAM=$(( _RAM - _RESERVED_RAM )) fi _USE=$(( _RAM / 4 )) _if_hosted_sys if [ "${_VMFAMILY}" = "VS" ] \ || [ "${_hostedSys}" = "YES" ]; then if [ "${_VMFAMILY}" = "VS" ]; then if [ -e "/root/.tg.cnf" ]; then _USE_SQL=$(( _RAM / 12 )) else _USE_SQL=$(( _RAM / 24 )) fi else _USE_SQL=$(( _RAM / 8 )) fi else _USE_SQL=$(( _RAM / 8 )) fi if [ "${_USE_SQL}" -lt 64 ]; then _USE_SQL=64 fi _TMP_SQL="${_USE_SQL}M" _SRT_SQL=$(( _USE_SQL * 2 )) _SRT_SQL="${_SRT_SQL}K" if [ "${_USE}" -ge 512 ] && [ "${_USE}" -lt 2048 ]; then _USE_PHP=1024 _USE_OPC=1024 _USE_CLI=2048 _QCE_SQL=32M _RND_SQL=8M _JBF_SQL=4M if [ "${_PHP_FPM_WORKERS}" = "AUTO" ]; then _L_PHP_FPM_WORKERS=$(( _CPU_NR * 4 )) else _L_PHP_FPM_WORKERS=${_PHP_FPM_WORKERS} fi _MXC_SQL=$(( _L_PHP_FPM_WORKERS * 4 )) if [ "${_NGINX_WORKERS}" = "AUTO" ]; then _L_NGX_WRKS=${_CPU_MX} else _L_NGX_WRKS=${_NGINX_WORKERS} fi elif [ "${_USE}" -ge 2048 ]; then if [ "${_VMFAMILY}" = "XEN" ] || [ "${_VMFAMILY}" = "AWS" ]; then _USE_PHP=2048 _USE_OPC=2048 _USE_CLI=2048 _QCE_SQL=64M _RND_SQL=8M _JBF_SQL=4M if [ "${_PHP_FPM_WORKERS}" = "AUTO" ]; then _L_PHP_FPM_WORKERS=$(( _CPU_NR * 4 )) else _L_PHP_FPM_WORKERS=${_PHP_FPM_WORKERS} fi _MXC_SQL=$(( _L_PHP_FPM_WORKERS * 4 )) if [ "${_NGINX_WORKERS}" = "AUTO" ]; then _L_NGX_WRKS=${_CPU_MX} else _L_NGX_WRKS=${_NGINX_WORKERS} fi elif [ "${_VMFAMILY}" = "VS" ] || [ "${_VMFAMILY}" = "TG" ]; then if [ -e "/boot/grub/grub.cfg" ] \ || [ -e "/boot/grub/menu.lst" ] \ || [ -e "/root/.tg.cnf" ]; then _USE_PHP=2048 _USE_OPC=2048 _USE_CLI=2048 _QCE_SQL=64M _RND_SQL=8M _JBF_SQL=4M if [ "${_PHP_FPM_WORKERS}" = "AUTO" ]; then _L_PHP_FPM_WORKERS=$(( _CPU_NR * 4 )) else _L_PHP_FPM_WORKERS=${_PHP_FPM_WORKERS} fi _MXC_SQL=$(( _L_PHP_FPM_WORKERS * 4 )) if [ "${_MXC_SQL}" -lt 10 ]; then _MXC_SQL=10 fi if [ "${_NGINX_WORKERS}" = "AUTO" ]; then _L_NGX_WRKS=${_CPU_TG} else _L_NGX_WRKS=${_NGINX_WORKERS} fi sed -i "s/64000/128000/g" /opt/php85/etc/php85.ini &> /dev/null sed -i "s/64000/128000/g" /opt/php84/etc/php84.ini &> /dev/null sed -i "s/64000/128000/g" /opt/php83/etc/php83.ini &> /dev/null sed -i "s/64000/128000/g" /opt/php82/etc/php82.ini &> /dev/null sed -i "s/64000/128000/g" /opt/php81/etc/php81.ini &> /dev/null sed -i "s/64000/128000/g" /opt/php80/etc/php80.ini &> /dev/null sed -i "s/64000/128000/g" /opt/php74/etc/php74.ini &> /dev/null sed -i "s/64000/128000/g" /opt/php73/etc/php73.ini &> /dev/null sed -i "s/64000/128000/g" /opt/php72/etc/php72.ini &> /dev/null sed -i "s/64000/128000/g" /opt/php71/etc/php71.ini &> /dev/null sed -i "s/64000/128000/g" /opt/php70/etc/php70.ini &> /dev/null sed -i "s/64000/128000/g" /opt/php56/etc/php56.ini &> /dev/null else _USE_PHP=2048 _USE_OPC=2048 _USE_CLI=2048 _QCE_SQL=64M _RND_SQL=2M _JBF_SQL=2M if [ "${_PHP_FPM_WORKERS}" = "AUTO" ]; then _L_PHP_FPM_WORKERS=$(( _CPU_NR * 4 )) else _L_PHP_FPM_WORKERS=${_PHP_FPM_WORKERS} fi _MXC_SQL=$(( _L_PHP_FPM_WORKERS * 4 )) if [ "${_NGINX_WORKERS}" = "AUTO" ]; then _L_NGX_WRKS=${_CPU_VS} else _L_NGX_WRKS=${_NGINX_WORKERS} fi fi else _USE_PHP=512 _USE_OPC=512 _USE_CLI=512 _QCE_SQL=32M _RND_SQL=2M _JBF_SQL=2M if [ "${_PHP_FPM_WORKERS}" = "AUTO" ]; then _L_PHP_FPM_WORKERS=$(( _CPU_NR * 4 )) else _L_PHP_FPM_WORKERS=${_PHP_FPM_WORKERS} fi _MXC_SQL=$(( _L_PHP_FPM_WORKERS * 4 )) if [ "${_NGINX_WORKERS}" = "AUTO" ]; then _L_NGX_WRKS=${_CPU_MX} else _L_NGX_WRKS=${_NGINX_WORKERS} fi fi else _USE_PHP="${_USE}" _USE_OPC="${_USE}" _USE_CLI="${_USE}" _QCE_SQL=32M _RND_SQL=1M _JBF_SQL=1M if [ "${_PHP_FPM_WORKERS}" = "AUTO" ]; then _L_PHP_FPM_WORKERS=$(( _CPU_NR * 4 )) else _L_PHP_FPM_WORKERS=${_PHP_FPM_WORKERS} fi _MXC_SQL=$(( _L_PHP_FPM_WORKERS * 4 )) if [ "${_NGINX_WORKERS}" = "AUTO" ]; then _L_NGX_WRKS=${_CPU_MX} else _L_NGX_WRKS=${_NGINX_WORKERS} fi fi _USE_JETTY="-Xmx${_USE_OPC}m" if [ "${_VMFAMILY}" = "VZ" ]; then _USE_OPC=64 fi if [ "${_USE_PHP}" -lt 1024 ]; then _USE_PHP=1024 fi _USE_FPM=$(( _USE_PHP / 2 )) if [ "${_USE_FPM}" -lt 1024 ]; then _USE_FPM=1024 fi if [ ! -e "/var/xdrago/conf/fpm-pool-foo-multi.conf" ]; then mkdir -p /var/xdrago/conf fi if [ ! -e "/data/conf" ]; then mkdir -p /data/conf fi cp -af ${_locCnf}/php/fpm-pool-foo-multi.conf /var/xdrago/conf/ cp -af ${_locCnf}/php/fpm-pool-foo.conf /var/xdrago/conf/ cp -af ${_locCnf}/php/fpm-pool-common.conf /var/xdrago/conf/ cp -af ${_locCnf}/php/fpm-pool-common-legacy.conf /var/xdrago/conf/ cp -af ${_locCnf}/php/fpm-pool-common-modern.conf /var/xdrago/conf/ sed -i "s/127.0.0.1/127.0.0.1,${_THISHTIP}/g" /var/xdrago/conf/fpm-pool-commo*.conf if [ -e "/opt/etc/fpm/fpm-pool-common.conf" ]; then sed -i "s/395/${_USE_FPM}/g" /opt/etc/fpm/fpm-pool-commo*.conf &> /dev/null wait fi if [ -e "/opt/php85/etc/php85.ini" ]; then sed -i "s/395/${_USE_FPM}/g" /opt/php85/etc/php85.ini &> /dev/null wait sed -i "s/181/${_USE_OPC}/g" /opt/php85/etc/php85.ini &> /dev/null sed -i "s/395/${_USE_CLI}/g" /opt/php85/lib/php.ini &> /dev/null fi if [ -e "/opt/php84/etc/php84.ini" ]; then sed -i "s/395/${_USE_FPM}/g" /opt/php84/etc/php84.ini &> /dev/null wait sed -i "s/181/${_USE_OPC}/g" /opt/php84/etc/php84.ini &> /dev/null sed -i "s/395/${_USE_CLI}/g" /opt/php84/lib/php.ini &> /dev/null fi if [ -e "/opt/php83/etc/php83.ini" ]; then sed -i "s/395/${_USE_FPM}/g" /opt/php83/etc/php83.ini &> /dev/null wait sed -i "s/181/${_USE_OPC}/g" /opt/php83/etc/php83.ini &> /dev/null sed -i "s/395/${_USE_CLI}/g" /opt/php83/lib/php.ini &> /dev/null fi if [ -e "/opt/php82/etc/php82.ini" ]; then sed -i "s/395/${_USE_FPM}/g" /opt/php82/etc/php82.ini &> /dev/null wait sed -i "s/181/${_USE_OPC}/g" /opt/php82/etc/php82.ini &> /dev/null sed -i "s/395/${_USE_CLI}/g" /opt/php82/lib/php.ini &> /dev/null fi if [ -e "/opt/php81/etc/php81.ini" ]; then sed -i "s/395/${_USE_FPM}/g" /opt/php81/etc/php81.ini &> /dev/null wait sed -i "s/181/${_USE_OPC}/g" /opt/php81/etc/php81.ini &> /dev/null sed -i "s/395/${_USE_CLI}/g" /opt/php81/lib/php.ini &> /dev/null fi if [ -e "/opt/php80/etc/php80.ini" ]; then sed -i "s/395/${_USE_FPM}/g" /opt/php80/etc/php80.ini &> /dev/null wait sed -i "s/181/${_USE_OPC}/g" /opt/php80/etc/php80.ini &> /dev/null sed -i "s/395/${_USE_CLI}/g" /opt/php80/lib/php.ini &> /dev/null fi if [ -e "/opt/php74/etc/php74.ini" ]; then sed -i "s/395/${_USE_FPM}/g" /opt/php74/etc/php74.ini &> /dev/null wait sed -i "s/181/${_USE_OPC}/g" /opt/php74/etc/php74.ini &> /dev/null sed -i "s/395/${_USE_CLI}/g" /opt/php74/lib/php.ini &> /dev/null fi if [ -e "/opt/php73/etc/php73.ini" ]; then sed -i "s/395/${_USE_FPM}/g" /opt/php73/etc/php73.ini &> /dev/null wait sed -i "s/181/${_USE_OPC}/g" /opt/php73/etc/php73.ini &> /dev/null sed -i "s/395/${_USE_CLI}/g" /opt/php73/lib/php.ini &> /dev/null fi if [ -e "/opt/php72/etc/php72.ini" ]; then sed -i "s/395/${_USE_FPM}/g" /opt/php72/etc/php72.ini &> /dev/null wait sed -i "s/181/${_USE_OPC}/g" /opt/php72/etc/php72.ini &> /dev/null sed -i "s/395/${_USE_CLI}/g" /opt/php72/lib/php.ini &> /dev/null fi if [ -e "/opt/php71/etc/php71.ini" ]; then sed -i "s/395/${_USE_FPM}/g" /opt/php71/etc/php71.ini &> /dev/null wait sed -i "s/181/${_USE_OPC}/g" /opt/php71/etc/php71.ini &> /dev/null sed -i "s/395/${_USE_CLI}/g" /opt/php71/lib/php.ini &> /dev/null fi if [ -e "/opt/php70/etc/php70.ini" ]; then sed -i "s/395/${_USE_FPM}/g" /opt/php70/etc/php70.ini &> /dev/null wait sed -i "s/181/${_USE_OPC}/g" /opt/php70/etc/php70.ini &> /dev/null sed -i "s/395/${_USE_CLI}/g" /opt/php70/lib/php.ini &> /dev/null fi if [ -e "/opt/php56/etc/php56.ini" ]; then sed -i "s/395/${_USE_FPM}/g" /opt/php56/etc/php56.ini &> /dev/null wait sed -i "s/181/${_USE_OPC}/g" /opt/php56/etc/php56.ini &> /dev/null sed -i "s/395/${_USE_CLI}/g" /opt/php56/lib/php.ini &> /dev/null fi if [ "${_CUSTOM_CONFIG_SQL}" = "NO" ]; then _tune_sql_memory_limits _PrTestPower=$(grep "POWER" /root/.*.octopus.cnf 2>&1) _PrTestPhantom=$(grep "PHANTOM" /root/.*.octopus.cnf 2>&1) _PrTestCluster=$(grep "CLUSTER" /root/.*.octopus.cnf 2>&1) _PrTestUltra=$(grep "ULTRA" /root/.*.octopus.cnf 2>&1) _PrTestMonster=$(grep "MONSTER" /root/.*.octopus.cnf 2>&1) if [[ "${_PrTestPower}" =~ "POWER" ]] \ || [[ "${_PrTestPhantom}" =~ "PHANTOM" ]] \ || [[ "${_PrTestUltra}" =~ "ULTRA" ]] \ || [[ "${_PrTestMonster}" =~ "MONSTER" ]] \ || [[ "${_PrTestCluster}" =~ "CLUSTER" ]] \ || [ -e "/root/.my.cluster_root_pwd.txt" ]; then _UXC_SQL="${_MXC_SQL}" else _UXC_SQL=$(echo "scale=0; ${_MXC_SQL}/2" | bc 2>&1) fi sed -i "s/= 191/= ${_UXC_SQL}/g" /etc/mysql/my.cnf wait sed -i "s/= 292/= ${_MXC_SQL}/g" /etc/mysql/my.cnf wait sed -i "s/^tmp_table_size.*/tmp_table_size = ${_TMP_SQL}/g" /etc/mysql/my.cnf wait sed -i "s/^max_heap_table_size.*/max_heap_table_size = ${_TMP_SQL}/g" /etc/mysql/my.cnf wait sed -i "s/^myisam_sort_buffer_size.*/myisam_sort_buffer_size = ${_SRT_SQL}/g" /etc/mysql/my.cnf wait sed -i "s/^read_rnd_buffer_size.*/read_rnd_buffer_size = ${_RND_SQL}/g" /etc/mysql/my.cnf wait sed -i "s/^join_buffer_size.*/join_buffer_size = ${_JBF_SQL}/g" /etc/mysql/my.cnf wait fi if [ "${_USE_OPC}" -gt 2048 ]; then _MAX_MEM_VALKEY=2048 else _MAX_MEM_VALKEY="${_USE_OPC}" fi _MAX_MEM_VALKEY="${_MAX_MEM_VALKEY}MB" sed -i "s/^maxmemory .*/maxmemory ${_MAX_MEM_VALKEY}/g" /etc/valkey/valkey.conf &> /dev/null sed -i "s/^maxmemory .*/maxmemory ${_MAX_MEM_VALKEY}/g" /etc/redis/redis.conf &> /dev/null wait if [ -e "/etc/default/jetty9" ] && [ -e "/opt/solr4" ]; then sed -i "s/^JAVA_OPTIONS.*/JAVA_OPTIONS=\"-Xms64m ${_USE_JETTY} -Djava.awt.headless=true -Dsolr.solr.home=\/opt\/solr4 \$JAVA_OPTIONS\" # Options/g" /etc/default/jetty9 wait fi _tune_web_server_config } # _check_git_repos() { if [ "${_DL_MODE}" != "GIT" ]; then return 1 # Exit the function but continue the script fi _GITHUB_WORKS=NO _GITLAB_WORKS=NO if [ "${_FORCE_GIT_MIRROR}" = "drupal" ]; then _FORCE_GIT_MIRROR=github fi if [ "${_FORCE_GIT_MIRROR}" = "gitorious" ]; then _FORCE_GIT_MIRROR=gitlab fi if [ "${_FORCE_GIT_MIRROR}" = "github" ]; then _msg "INFO: We will use forced GitHub repository without testing connection" _GITHUB_WORKS=YES _GITLAB_WORKS=NO sleep 1 elif [ "${_FORCE_GIT_MIRROR}" = "gitlab" ]; then _msg "INFO: We will use forced GitLab mirror without testing connection" _GITHUB_WORKS=NO _GITLAB_WORKS=YES sleep 1 else if [ "${_DEBUG_MODE}" = "YES" ]; then _msg "INFO: Testing repository mirror servers availability..." fi sleep 1 _GITHUB_WORKS=YES _GITLAB_WORKS=YES if ! command nc -w 10 -z github.com 443 >/dev/null 2>&1 ; then _GITHUB_WORKS=NO _msg "WARN: The GitHub master repository server doesn't respond..." elif ! command nc -w 10 -z gitlab.com 443 >/dev/null 2>&1 ; then _GITLAB_WORKS=NO _msg "WARN: The GitLab mirror repository server doesn't respond..." fi fi if [ "${_GITHUB_WORKS}" = "YES" ]; then _BOA_REPO_NAME="boa" _BOA_REPO_GIT_URL="https://github.com/omega8cc" if [ "${_DEBUG_MODE}" = "YES" ]; then _msg "INFO: GitHub master repository will be used" fi elif [ "${_GITLAB_WORKS}" = "YES" ]; then _BOA_REPO_NAME="boa" _BOA_REPO_GIT_URL="${_gitLab}" if [ "${_DEBUG_MODE}" = "YES" ]; then _msg "INFO: GitLab mirror repository will be used" fi else cat <&1) if [[ "${_VERSIONS_TEST}" =~ "${_X_VERSION}" ]]; then _VERSIONS_TEST_RESULT=OK else _msg "ERROR: Please upgrade this system to BOA version ${_X_VERSION} first" _msg "Bye" _clean_pid_exit version_b fi fi # # rm -f /opt/tmp/testecho* _SRCDIR="/opt/tmp/files" mkdir -p ${_SRCDIR} chmod -R 777 /opt/tmp &> /dev/null cd /opt/tmp rm -rf /opt/tmp/boa if [ "${_DL_MODE}" = "GIT" ]; then ${_gCb} ${_BRANCH_BOA} ${_BOA_REPO_GIT_URL}/${_BOA_REPO_NAME}.git &> /dev/null else curl ${_crlGet} "${_urlDev}/${_AEGIR_VERSION}/boa.tar.gz" | tar -xzf - _BOA_REPO_NAME="boa" fi # # Create tmp stuff _LOG=/var/backups/bond-${_NOW}.log # # ###---### Tune Your Ægir Hosting System # echo " " if [ "${_DEBUG_MODE}" = "YES" ]; then _msg "TUNER START -> checkpoint: " cat <&1) if _prompt_yes_no "${_tPrmt}?" ; then true if [ ! -e "/root/.upstart.cnf" ]; then _msg "INFO: We will stop cron and then wait 30 seconds..." service cron stop &> /dev/null sleep 30 fi _msg "INFO: Tuning in progress, please wait..." _restore_default_php _php_conf_update _tune_php _restore_default_sql _tune_sql _restore_default_nginx _tune_nginx _tune_memory_limits _restart_services _msg "INFO: Tuning completed" else if [ ! -e "/root/.upstart.cnf" ]; then _msg "INFO: We will stop cron and then wait 30 seconds..." service cron stop &> /dev/null sleep 30 fi _restore_default_php _php_conf_update _restore_default_sql _restore_default_nginx _tune_memory_limits _restart_services _msg "INFO: Tuning stopped and default settings restored" fi [ -e "/run/boa_run.pid" ] && rm -f /run/boa_run.pid if [ ! -e "/root/.upstart.cnf" ]; then service cron start &> /dev/null fi if [ "${_DEBUG_MODE}" = "YES" ]; then _msg "INFO: Cron started again" fi _msg "BYE!" ###----------------------------------------### ### ### Barracuda-Octopus-Nginx-Drupal Tuner ### Copyright (C) 2009-2026 Omega8.cc ### noc@omega8.cc www.omega8.cc ### ###----------------------------------------### ================================================ FILE: aegir/tools/backup/run/create_config_readme.sh ================================================ #!/bin/bash export HOME=/root export SHELL=/bin/bash export PATH=/usr/local/bin:/usr/local/sbin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin:/usr/libexec export _sPid="f62" # Base directory for user configurations _BASE_DIR="/data/disk" # Function to ensure the config directory exists _ensure_config_dir() { _user=$1 _config_dir="${_BASE_DIR}/${_user}/static/control/remote_backups/config" _dir_ctrl_file="${_BASE_DIR}/${_user}/log/.backboa.${_user}.${_sPid}.config.dir.ctrl" if [ ! -d "${_config_dir}" ] || [ ! -e "${_dir_ctrl_file}" ]; then mkdir -p "${_config_dir}" chown -R ${_user}.ftp:users "${_config_dir}" chmod 700 "${_config_dir}" touch "${_dir_ctrl_file}" echo "Created config directory for user: ${_user}" fi } # Function to create a README file in the config directory _create_config_readme_file() { _user=$1 _config_dir="${_BASE_DIR}/${_user}/static/control/remote_backups/config" _readme_file="${_config_dir}/README.txt" _readme_ctrl_file="${_BASE_DIR}/${_user}/log/.backboa.${_user}.${_sPid}.config.readme.ctrl" _user_static_dir="/data/disk/${_user}/static" _user_ftp_dir="/home/${_user}.ftp" _user_ftp_dir_regex="/home/${_user}\.ftp" _ensure_config_dir "${_user}" if [ ! -f "${_readme_ctrl_file}" ]; then cat << EOF > "${_readme_file}" Backup Configuration README This directory contains configuration files for customizing backup behavior. Users can define include and exclude directives for their backups. Allowed paths for backups are restricted to: - ${_user_static_dir} - ${_user_ftp_dir} Available Configuration Files: 1. include.txt Use this file to specify additional directories or files to include in the backup. 2. exclude.txt Use this file to specify directories or files to exclude from the backup. 3. include_regexp.txt Use this file to specify patterns for including directories or files using regular expressions. 4. exclude_regexp.txt Use this file to specify patterns for excluding directories or files using regular expressions. Usage Instructions: 1. include.txt List full paths to the directories or files you want to include in the backup. Example: --include ${_user_static_dir}/documents --include ${_user_ftp_dir}/documents 2. exclude.txt List full paths to the directories or files you want to exclude from the backup. Example: --exclude ${_user_static_dir}/cache --exclude ${_user_ftp_dir}/temp 3. include_regexp.txt Use regular expressions to specify patterns for directories or files to include in the backup. Example: --include-regexp '^${_user_ftp_dir_regex}/documents/.*\.pdf$' --include-regexp '^${_user_static_dir}/project_data/.*' 4. exclude_regexp.txt Use regular expressions to specify patterns for directories or files to exclude from the backup. Example: --exclude-regexp '^${_user_static_dir}/trash/.*' --exclude-regexp '^${_user_ftp_dir_regex}/temp_files/.*' Security: - Ensure these files are restricted to the user only: - Files should have permissions set to 600 (chmod 600 ). - The directory should have permissions set to 700 (chmod 700 ). Notes: - Directives in these files will be merged with default system directives during backup operations. - Patterns defined in exclude_regexp.txt will take precedence over those in include_regexp.txt. - You can only define paths in the /data/disk/${_user}/static/ directory tree. - Paths for platforms without direct access in /data/disk/${_user}/distro are included by default. - Invalid entries may cause the backup process to fail. Example Configuration: If you want to exclude temporary files: - Add the following to exclude_regexp.txt: --exclude-regexp '^${_user_static_dir}/temp/.*' --exclude-regexp '^${_user_ftp_dir_regex}/temp/.*' If you want to include specific documents: - Add the following to include_regexp.txt: --include-regexp '^${_user_ftp_dir_regex}/documents/.*\.pdf$' --include-regexp '^${_user_static_dir}/important_data/.*' EOF chmod 600 "${_readme_file}" chown ${_user}.ftp:users "${_readme_file}" echo "Created README file for config directory of user: ${_user}" touch "${_readme_ctrl_file}" else echo "README file already updated for config directory of user: ${_user}" fi } # Main function to create README files for all users _main() { for _user_dir in "${_BASE_DIR}"/*; do if [ -d "${_user_dir}" ]; then _user=$(basename "${_user_dir}") if [ "${_user}" != "arch" ] \ && [ "${_user}" != "data" ] \ && [ "${_user}" != "global" ] \ && [ "${_user}" != "static" ] \ && [ "${_user}" != "custom" ]; then _create_config_readme_file "${_user}" fi fi done } # Execute the script _main ================================================ FILE: aegir/tools/backup/run/create_credentials_templates.sh ================================================ #!/bin/bash export HOME=/root export SHELL=/bin/bash export PATH=/usr/local/bin:/usr/local/sbin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin:/usr/libexec # Global credentials directory _GLOBAL_CREDENTIALS_DIR="/root/.remote_backups/credentials" # Base directory for user-specific credentials _USER_BASE_DIR="/data/disk" # Function to ensure a directory exists _ensure_directory() { _dir=$1 if [ ! -d "${_dir}" ]; then mkdir -p "${_dir}" chmod 700 "${_dir}" echo "Created directory: ${_dir}" fi } # Function to create credentials template files _create_credentials_templates() { _target_dir=$1 # List of supported services _services=( "aws_one_zone" "aws_standard_ia" "aws" "azure" "b2" "cloudflare" "do_spaces" "gcs" "ibm" "linode" "wasabi" ) for _service in "${_services[@]}"; do _template_file="${_target_dir}/${_service}.txt" if [ -e "${_user_pid_dir}" ] && [ ! -e "${_user_pid_dir}/.backboa.${_user}.credentials.${_service}.tpl.ctrl" ]; then sed -i "s/FULL_BACKUP_FREQUENCY=.*/FULL_BACKUP_FREQUENCY=\"28D\"/g" ${_template_file} touch ${_user_pid_dir}/.backboa.${_user}.credentials.${_service}.tpl.ctrl fi if [ ! -f "${_template_file}" ]; then case "${_service}" in aws|aws_one_zone|aws_standard_ia) cat << EOF > "${_template_file}" export AWS_ACCESS_KEY_ID="your_aws_access_key" export AWS_SECRET_ACCESS_KEY="your_aws_secret_key" export AWS_REGION="your_aws_region" # E.g., "us-east-1" export KEEP_WITHIN="3M" export FULL_BACKUP_FREQUENCY="28D" EOF ;; azure) cat << EOF > "${_template_file}" export AZURE_STORAGE_ACCOUNT="your_azure_storage_account" export AZURE_STORAGE_KEY="your_azure_storage_key" export KEEP_WITHIN="3M" export FULL_BACKUP_FREQUENCY="28D" EOF ;; b2) cat << EOF > "${_template_file}" export B2_ACCOUNT_ID="your_b2_account_id" export B2_APPLICATION_KEY="your_b2_application_key" export KEEP_WITHIN="3M" export FULL_BACKUP_FREQUENCY="28D" EOF ;; cloudflare) cat << EOF > "${_template_file}" export R2_ACCOUNT_ID="your_account_id" export R2_ACCESS_KEY_ID="your_access_key_id" export R2_SECRET_ACCESS_KEY="your_secret_access_key" export KEEP_WITHIN="3M" export FULL_BACKUP_FREQUENCY="28D" EOF ;; do_spaces) cat << EOF > "${_template_file}" export DO_SPACES_KEY="your_do_spaces_key" export DO_SPACES_SECRET="your_do_spaces_secret" export DO_SPACES_REGION="your_do_spaces_region" # E.g., "nyc3" export KEEP_WITHIN="3M" export FULL_BACKUP_FREQUENCY="28D" EOF ;; gcs) cat << EOF > "${_template_file}" export GCS_PROJECT_ID="your_gcs_project_id" export GCS_SERVICE_ACCOUNT_KEY="your_gcs_service_account_key" export KEEP_WITHIN="3M" export FULL_BACKUP_FREQUENCY="28D" EOF ;; ibm) cat << EOF > "${_template_file}" export IBM_API_KEY_ID="your_ibm_api_key_id" export IBM_SERVICE_INSTANCE_ID="your_ibm_service_instance_id" export IBM_REGION="your_ibm_region" export KEEP_WITHIN="3M" export FULL_BACKUP_FREQUENCY="28D" EOF ;; linode) cat << EOF > "${_template_file}" export LINODE_ACCESS_KEY="your_linode_access_key" export LINODE_SECRET_KEY="your_linode_secret_key" export LINODE_REGION="your_linode_region" # E.g., "us-east-1" export KEEP_WITHIN="3M" export FULL_BACKUP_FREQUENCY="28D" EOF ;; wasabi) cat << EOF > "${_template_file}" export WASABI_ACCESS_KEY="your_wasabi_access_key" export WASABI_SECRET_KEY="your_wasabi_secret_key" export WASABI_REGION="your_wasabi_region" # E.g., "us-east-1" export KEEP_WITHIN="3M" export FULL_BACKUP_FREQUENCY="28D" EOF ;; esac chmod 600 "${_template_file}" echo "Created template for service: ${_service} at ${_template_file}" else echo "Template for service: ${_service} already exists at ${_template_file}" fi done } # Main function to create templates globally and for all users _main() { # Create templates in the global credentials directory _ensure_directory "${_GLOBAL_CREDENTIALS_DIR}" _create_credentials_templates "${_GLOBAL_CREDENTIALS_DIR}" # Iterate over user directories and create templates for each user for _user_dir in "${_USER_BASE_DIR}"/*; do if [ -d "${_user_dir}" ]; then _user=$(basename "${_user_dir}") if [ "${_user}" != "arch" ] \ && [ "${_user}" != "data" ] \ && [ "${_user}" != "global" ] \ && [ "${_user}" != "static" ] \ && [ "${_user}" != "custom" ]; then _user_pid_dir="${_USER_BASE_DIR}/${_user}/log" _user_credentials_dir="${_USER_BASE_DIR}/${_user}/static/control/remote_backups/credentials" _ensure_directory "${_user_credentials_dir}" _create_credentials_templates "${_user_credentials_dir}" fi fi done } # Execute the script _main ================================================ FILE: aegir/tools/backup/run/create_cron_entries.sh ================================================ #!/bin/bash export HOME=/root export SHELL=/bin/bash export PATH=/usr/local/bin:/usr/local/sbin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin:/usr/libexec # Configurable in /root/.barracuda.cnf interval in minutes between backup cycles _BACKUP_INTERVAL=360 _WRAPPER_DIR="/root/.remote_backups/run" _WRAPPER_SCRIPT="${_WRAPPER_DIR}/sequential_backups.sh" _SCHEDULE_DIR="/root/.remote_backups/schedule" _SCHEDULE_FILE="${_SCHEDULE_DIR}/backup_schedule.txt" _CRON_FILE="/etc/cron.d/duplicity_backup" _LOGFILE="/var/log/backup_runtime.log" # Function to verify root access _check_root() { if [ "$(id -u)" -eq 0 ]; then ionice -c2 -n7 -p $$ renice 0 -p $$ chmod a+w /dev/null [ -e "/root/.gnupg" ] && chmod 700 /root/.gnupg else echo "ERROR: This script should be run as a root user" exit 1 fi _DF_TEST="$(command df -P -l / 2>/dev/null | awk ' NR==1 { for (i=1; i<=NF; i++) if ($i=="Use%" || $i=="Capacity") u=i } NR==2 { gsub(/%/,"",$u); print $u }')" if [ ! -z "${_DF_TEST}" ] && [ "${_DF_TEST}" -gt 90 ]; then echo "ERROR: Your disk space is almost full !!! ${_DF_TEST}/100" echo "ERROR: We can not proceed until it is below 90/100" exit 1 fi } _check_root # shellcheck disable=SC1091 [ -e "/root/.barracuda.cnf" ] && source /root/.barracuda.cnf export _BACKUP_INTERVAL=${_BACKUP_INTERVAL//[^0-9]/} : "${_BACKUP_INTERVAL:=360}" # Ensure global run directory exists and is owned by root mkdir -p "${_WRAPPER_DIR}" chown root:root "${_WRAPPER_DIR}" chmod 700 "${_WRAPPER_DIR}" # Ensure global schedule directory exists and is owned by root mkdir -p "${_SCHEDULE_DIR}" chown root:root "${_SCHEDULE_DIR}" chmod 700 "${_SCHEDULE_DIR}" # Function to generate the wrapper script _generate_wrapper_script() { cat << 'EOF' > "${_WRAPPER_SCRIPT}" #!/bin/bash # Enable strict error handling for debugging only # set -euo pipefail # Environment setup export HOME=/root export SHELL=/bin/bash export PATH=/usr/local/bin:/usr/local/sbin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin:/usr/libexec # File paths _SCHEDULE_FILE="/root/.remote_backups/schedule/backup_schedule.txt" _PID_DIR="/run" _LOGFILE="/var/log/backup_runtime.log" # Function to create PID file _create_pid_file() { local _pidfile=$1 if [ -e "${_pidfile}" ]; then echo "Process already running with PID file ${_pidfile}" exit 1 else echo $$ > "${_pidfile}" fi } # Function to remove PID file _remove_pid_file() { local _pidfile=$1 if [ -f "${_pidfile}" ]; then rm -f "${_pidfile}" || { echo "Warning: Failed to remove PID file: ${_pidfile}" } fi } # Function to remove stale multiback PID file _remove_stale_multiback_pid() { _multiback_pidfile="/run/duplicity_${_service}_${_user}.pid" if [ -f "${_multiback_pidfile}" ]; then _old_pid=$(cat "${_multiback_pidfile}") if [ -n "${_old_pid}" ] && ! kill -0 "${_old_pid}" 2>/dev/null; then echo "Stale multiback PID file detected: ${_multiback_pidfile}. Removing it." rm -f "${_multiback_pidfile}" fi fi } # Read backup services and users from the configuration file if [ ! -f "${_SCHEDULE_FILE}" ]; then echo "Error: Backup schedule file ${_SCHEDULE_FILE} not found." exit 1 fi # Function to print env for debugging _print_env() { if [ "$(id -u)" -eq 0 ] && [ -e "/root/.dev.server.cnf" ]; then _ENV=$(env 2>&1) echo echo "_ENV in $1 start" echo "${_ENV}" echo "_ENV in $1 end" echo _ENV= fi } # Process each line in the backup configuration file while IFS= read -r _line || [ -n "${_line}" ]; do # Skip empty lines and comments if [[ "${_line}" =~ ^\s*# ]] || [[ -z "${_line}" ]]; then continue fi # Parse the service and user _service=$(echo "${_line}" | cut -d' ' -f1) _user=$(echo "${_line}" | cut -d' ' -f2) # Ensure both service and user are defined if [ -z "${_service}" ] || [ -z "${_user}" ]; then echo "Error: Invalid line in configuration file: ${_line}" continue fi echo "Starting backup for ${_service} (${_user})..." export _service="${_service}" export _user="${_user}" # Define the PID file path _CURRENT_PIDFILE="${_PID_DIR}/duplicity_${_service}_${_user}_sequential.pid" # Create the PID file _create_pid_file "${_CURRENT_PIDFILE}" trap "rm -f ${_PIDFILE}; exit" EXIT # Remove stale multiback PID file if necessary _remove_stale_multiback_pid # Determine the paths configuration file if [ "${_user}" = "global" ] || [ "${_user}" = "data" ] || [ "${_user}" = "custom" ]; then _paths_file="/root/.remote_backups/paths/${_user}_paths.txt" _credentials_file="/root/.remote_backups/credentials/${_service}.txt" _secret_file="/root/.remote_backups/.secret.txt" if [ ! -f "${_secret_file}" ]; then echo "Secret file ${_secret_file} not found." _remove_pid_file "${_CURRENT_PIDFILE}" continue fi # Check if _paths_file exists if [ ! -f "${_paths_file}" ]; then echo "Error: Paths configuration file ${_paths_file} not found." _remove_pid_file "${_CURRENT_PIDFILE}" continue fi # Check if credentials file exists if [ ! -f "${_credentials_file}" ]; then echo "Error: Credentials file ${_credentials_file} not found." _remove_pid_file "${_CURRENT_PIDFILE}" continue fi # Change to the directory where _paths_file and credentials are located cd /root/.remote_backups _print_env "sequential_backups_a" elif [ "${_user}" != "arch" ] \ && [ "${_user}" != "data" ] \ && [ "${_user}" != "global" ] \ && [ "${_user}" != "static" ] \ && [ "${_user}" != "custom" ]; then _paths_file="/data/disk/${_user}/remote_backups/paths/paths.txt" _credentials_file="/data/disk/${_user}/static/control/remote_backups/credentials/${_service}.txt" _secret_file="/data/disk/${_user}/remote_backups/.secret.txt" if [ ! -f "${_secret_file}" ]; then echo "Secret file ${_secret_file} not found." _remove_pid_file "${_CURRENT_PIDFILE}" continue fi if [ ! -f "${_paths_file}" ]; then echo "Error: Paths configuration file ${_paths_file} not found." _remove_pid_file "${_CURRENT_PIDFILE}" continue fi if [ ! -f "${_credentials_file}" ]; then echo "Error: Credentials file ${_credentials_file} not found." _remove_pid_file "${_CURRENT_PIDFILE}" continue fi # Change to the directory where _paths_file and credentials are located cd "/data/disk/${_user}/remote_backups" _print_env "sequential_backups_b" fi # Perform the backup if multiback backup "${_service}" "${_user}"; then echo "Backup for ${_service} (${_user}) completed successfully." else echo "Backup for ${_service} (${_user}) failed." fi # Wipe out exported variables to clean up env after running the backup export _service= export _user= # Return to the original directory cd - _print_env "sequential_backups_d" # Remove the PID file _remove_pid_file "${_CURRENT_PIDFILE}" done < "${_SCHEDULE_FILE}" EOF chmod +x "${_WRAPPER_SCRIPT}" echo "Wrapper script created at ${_WRAPPER_SCRIPT}" } # Function to create cron entries _create_cron_entries() { echo "# Cron job for sequential backups" > "${_CRON_FILE}" echo "0 */$((_BACKUP_INTERVAL / 60)) * * * root ${_WRAPPER_SCRIPT}" >> "${_CRON_FILE}" chmod 644 "${_CRON_FILE}" echo "Cron entry created at ${_CRON_FILE}" # Validate the cron file _validate_cron_file } # Function to validate the cron file _validate_cron_file() { if ! grep -q -E "^[^#]*${_WRAPPER_SCRIPT}" "${_CRON_FILE}"; then echo "Error: Cron file validation failed. Please check the file at ${_CRON_FILE}." exit 1 fi echo "Cron file validated successfully." } # Function to generate the backup schedule _generate_backup_schedule() { echo "# Backup schedule (service user)" > "${_SCHEDULE_FILE}" # Add global backups _custom_paths_file="/root/.remote_backups/paths/custom_paths.txt" _GLOBAL_CRED_DIR="/root/.remote_backups/credentials" for _service in aws aws_one_zone aws_standard_ia azure b2 cloudflare do_spaces gcs ibm linode wasabi; do if [ -f "${_GLOBAL_CRED_DIR}/${_service}.txt" ] && ! grep -q "your_" "${_GLOBAL_CRED_DIR}/${_service}.txt"; then echo "${_service} global" >> "${_SCHEDULE_FILE}" echo "${_service} data" >> "${_SCHEDULE_FILE}" [ -s "${_custom_paths_file}" ] && echo "${_service} custom" >> "${_SCHEDULE_FILE}" fi done # Add user-specific backups for _user_dir in /data/disk/*; do if [ -d "${_user_dir}" ]; then _user=$(basename "${_user_dir}") _USER_CRED_DIR="/data/disk/${_user}/static/control/remote_backups/credentials" for _service in aws aws_one_zone aws_standard_ia azure b2 cloudflare do_spaces gcs ibm linode wasabi; do if [ -f "${_USER_CRED_DIR}/${_service}.txt" ] && ! grep -q "your_" "${_USER_CRED_DIR}/${_service}.txt"; then echo "${_service} ${_user}" >> "${_SCHEDULE_FILE}" fi done fi done echo "Backup schedule created at ${_SCHEDULE_FILE}" } # Function to adjust the backup interval dynamically _adjust_backup_interval() { if [ -f "${_LOGFILE}" ]; then _TOTAL_RUNTIME=$(tail -n1 "${_LOGFILE}" | awk '{print $NF}') _NEW_INTERVAL=$(( (_TOTAL_RUNTIME / 3600 + 1) * 60 )) # Round up to the next hour if [ "${_NEW_INTERVAL}" -gt "${_BACKUP_INTERVAL}" ]; then _BACKUP_INTERVAL="${_NEW_INTERVAL}" echo "Adjusted backup interval to $((_BACKUP_INTERVAL / 60)) hours." _create_cron_entries fi fi } # Main script execution _generate_wrapper_script _generate_backup_schedule _adjust_backup_interval _create_cron_entries ================================================ FILE: aegir/tools/backup/run/create_global_paths_config.sh ================================================ #!/bin/bash export HOME=/root export SHELL=/bin/bash export PATH=/usr/local/bin:/usr/local/sbin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin:/usr/libexec export _sPid="f62" # Function to create or update global paths configuration _create_global_paths_config() { _global_config_dir="/root/.remote_backups/paths" _include_list="${_global_config_dir}/.backboa.include.list" _exclude_list="${_global_config_dir}/.backboa.exclude.list" _custom_include_list="${_global_config_dir}/.backboa.custom_include.list" _custom_exclude_list="${_global_config_dir}/.backboa.custom_exclude.list" _include_global_regexp_file="${_global_config_dir}/.backboa.include_global_regexp.file" _include_global_file="${_global_config_dir}/.backboa.include_global.file" _exclude_global_file="${_global_config_dir}/.backboa.exclude.file" _merged_global_include_file="${_global_config_dir}/.backboa.global_include.merged.file" _merged_global_exclude_file="${_global_config_dir}/.backboa.global_exclude.merged.file" _include_data_file="${_global_config_dir}/.backboa.include_data.file" _exclude_data_file="${_global_config_dir}/.backboa.exclude_data.file" _merged_data_include_file="${_global_config_dir}/.backboa.data_include.merged.file" _merged_data_exclude_file="${_global_config_dir}/.backboa.data_exclude.merged.file" _global_ctrl_file="${_global_config_dir}/.backboa.${_sPid}.paths.ctrl.file" _global_paths_file="${_global_config_dir}/global_paths.txt" _data_paths_file="${_global_config_dir}/data_paths.txt" _custom_paths_file="${_global_config_dir}/custom_paths.txt" _disk_dir="/data/disk" _home_dir="/home" # Ensure global configuration directory exists and is owned by root mkdir -p "${_global_config_dir}" chown root:root "${_global_config_dir}" chmod 700 "${_global_config_dir}" # Function to validate configuration files _validate_config() { _file=$1 _type=$2 # Check for invalid entries if [ "${_type}" = "regexp" ]; then _invalid_lines=$(grep -Ev "^--(include-regexp|exclude-regexp)" "${_file}" || true) if [ -n "${_invalid_lines}" ]; then echo "Error: Invalid entries in ${_file}:" echo "${_invalid_lines}" exit 1 fi else _invalid_lines=$(grep -Ev "^--(include|exclude)" "${_file}" || true) if [ -n "${_invalid_lines}" ]; then echo "Error: Invalid entries in ${_file}:" echo "${_invalid_lines}" exit 1 fi fi } # Function to append unique entries from source to target file _append_unique_entries() { _source_file=$1 _target_file=$2 if [ -f "${_source_file}" ]; then grep -v -F -x -f "${_target_file}" "${_source_file}" >> "${_target_file}" fi } if [ ! -f "${_global_ctrl_file}" ]; then ### Migrate legacy exclude/include files if present and merge unique entries # _include_list if [ -f "/root/.backboa.include" ]; then if [ ! -f "${_include_list}" ]; then cp "/root/.backboa.include" "${_include_list}" else _append_unique_entries "/root/.backboa.include" "${_include_list}" fi fi # _exclude_list if [ -f "/root/.backboa.exclude" ]; then if [ ! -f "${_exclude_list}" ]; then cp "/root/.backboa.exclude" "${_exclude_list}" else _append_unique_entries "/root/.backboa.exclude" "${_exclude_list}" fi else cat << EOF > "${_exclude_list}" **files/advagg_css/** **files/advagg_js/** **files/css/** **files/js/** **private/temp/** EOF fi # _custom_include_list if [ -f "/root/.backboa.custom.include" ]; then if [ ! -f "${_custom_include_list}" ]; then cp "/root/.backboa.custom.include" "${_custom_include_list}" else _append_unique_entries "/root/.backboa.custom.include" "${_custom_include_list}" fi fi # _custom_exclude_list if [ -f "/root/.backboa.custom.exclude" ]; then if [ ! -f "${_custom_exclude_list}" ]; then cp "/root/.backboa.custom.exclude" "${_custom_exclude_list}" else _append_unique_entries "/root/.backboa.custom.exclude" "${_custom_exclude_list}" fi fi ### Create default exclude/include files if they don't exist # _include_global_file cat << EOF > "${_include_global_file}" --include /data/disk/arch --include /var/backups/csf --include /var/backups/dragon --include /var/backups/reports EOF # _exclude_global_file cat << EOF > "${_exclude_global_file}" --exclude /var/aegir/backups --exclude /var/aegir/.tmp EOF # _include_data_file # Start writing to the include data file cat << EOF > "${_include_data_file}" EOF # Iterate over each item in the disk directory for subdir in "${_disk_dir}"/*/; do # Check if it's a directory if [ -d "${subdir}" ]; then # Remove the trailing slash for consistency sanitized_subdir="${subdir%/}" # Append the --include line to the include data file if [ "${sanitized_subdir}" != "/data/disk/arch" ] \ && [ "${sanitized_subdir}" != "/data/disk/static" ]; then echo "--include ${sanitized_subdir}" >> "${_include_data_file}" fi fi done # Append the additional include statements cat << EOF >> "${_include_data_file}" --include /data/all --include /data/conf --include /home EOF # _include_global_regexp_file cat << EOF > "${_include_global_regexp_file}" --include-regexp '^/root/\..*\.cnf$' EOF # _exclude_data_file # Start writing to the exclude data file cat << EOF > "${_exclude_data_file}" EOF # Iterate over each item in the disk directory for subdir in "${_disk_dir}"/*/; do # Check if it's a directory if [ -d "${subdir}" ]; then # Remove the trailing slash for consistency sanitized_subdir="${subdir%/}" # Append the --exclude line to the exclude data path if [ "${sanitized_subdir}" != "/data/disk/arch" ] \ && [ "${sanitized_subdir}" != "/data/disk/static" ]; then echo "--exclude ${sanitized_subdir}/.tmp" >> "${_exclude_data_file}" echo "--exclude ${sanitized_subdir}/backup-exports" >> "${_exclude_data_file}" echo "--exclude ${sanitized_subdir}/backups" >> "${_exclude_data_file}" echo "--exclude ${sanitized_subdir}/clients" >> "${_exclude_data_file}" echo "--exclude ${sanitized_subdir}/src" >> "${_exclude_data_file}" echo "--exclude ${sanitized_subdir}/static/.tmp" >> "${_exclude_data_file}" echo "--exclude ${sanitized_subdir}/static/restores" >> "${_exclude_data_file}" echo "--exclude ${sanitized_subdir}/static/tmp" >> "${_exclude_data_file}" echo "--exclude ${sanitized_subdir}/static/trash" >> "${_exclude_data_file}" echo "--exclude ${sanitized_subdir}/u" >> "${_exclude_data_file}" echo "--exclude ${sanitized_subdir}/undo" >> "${_exclude_data_file}" else echo "--exclude ${sanitized_subdir}" >> "${_exclude_data_file}" fi fi done # Iterate over each item in the home directory for subdir in "${_home_dir}"/*/; do # Check if it's a directory if [ -d "${subdir}" ]; then # Remove the trailing slash for consistency sanitized_subdir="${subdir%/}" # Append the --exclude line to the exclude home path if [[ "${sanitized_subdir}" =~ ".ftp"($) ]]; then echo "--exclude ${sanitized_subdir}/.tmp" >> "${_exclude_data_file}" echo "--exclude ${sanitized_subdir}/backups" >> "${_exclude_data_file}" echo "--exclude ${sanitized_subdir}/clients" >> "${_exclude_data_file}" echo "--exclude ${sanitized_subdir}/platforms" >> "${_exclude_data_file}" echo "--exclude ${sanitized_subdir}/static" >> "${_exclude_data_file}" else echo "--exclude ${sanitized_subdir}" >> "${_exclude_data_file}" fi fi done # Append the additional exclude statements cat << EOF >> "${_exclude_data_file}" --exclude /var/www EOF # Validate and merge exclude/include files [ -e "${_include_data_file}" ] && _validate_config "${_include_data_file}" [ -e "${_include_global_file}" ] && _validate_config "${_include_global_file}" [ -e "${_exclude_global_file}" ] && _validate_config "${_exclude_global_file}" [ -e "${_include_data_file}" ] && cat "${_include_data_file}" > "${_merged_data_include_file}" [ -e "${_include_global_file}" ] && cat "${_include_global_file}" > "${_merged_global_include_file}" [ -e "${_exclude_global_file}" ] && cat "${_exclude_global_file}" > "${_merged_global_exclude_file}" # Merge regexp files into final configurations if [ -s "${_include_global_regexp_file}" ]; then _validate_config "${_include_global_regexp_file}" "regexp" cat "${_include_global_regexp_file}" >> "${_merged_global_include_file}" fi if [ -s "${_exclude_data_file}" ]; then _validate_config "${_exclude_data_file}" cat "${_exclude_data_file}" > "${_merged_data_exclude_file}" fi # Convert the exclude file contents to a single-line variable without backslashes and excessive whitespace [ -e "${_merged_data_include_file}" ] && _MERGED_DATA_INCLUDE=$(cat "${_merged_data_include_file}" | tr '\n' ' ' | tr -s ' ' | sed 's/^ *//;s/ *$//') [ -e "${_merged_data_exclude_file}" ] && _MERGED_DATA_EXCLUDE=$(cat "${_merged_data_exclude_file}" | tr '\n' ' ' | tr -s ' ' | sed 's/^ *//;s/ *$//') [ -e "${_merged_global_include_file}" ] && _MERGED_GLOBAL_INCLUDE=$(cat "${_merged_global_include_file}" | tr '\n' ' ' | tr -s ' ' | sed 's/^ *//;s/ *$//') [ -e "${_merged_global_exclude_file}" ] && _MERGED_GLOBAL_EXCLUDE=$(cat "${_merged_global_exclude_file}" | tr '\n' ' ' | tr -s ' ' | sed 's/^ *//;s/ *$//') # Create the final paths configuration file cat << EOF > "${_global_paths_file}" _SOURCE="/etc /opt/solr4 /var/aegir /var/solr7 /var/solr9 /var/www /var/xdrago" _INCLUDE_PATHS="${_MERGED_GLOBAL_INCLUDE}" _EXCLUDE_PATHS="${_MERGED_GLOBAL_EXCLUDE}" _INCLUDE_LIST="${_include_list}" _EXCLUDE_LIST="${_exclude_list}" EOF echo "Global paths configuration created or updated at ${_global_paths_file}" # Create the final paths configuration file cat << EOF > "${_data_paths_file}" _SOURCE="" _INCLUDE_PATHS="${_MERGED_DATA_INCLUDE}" _EXCLUDE_PATHS="${_MERGED_DATA_EXCLUDE}" _INCLUDE_LIST="${_include_list}" _EXCLUDE_LIST="${_exclude_list}" EOF echo "Global paths configuration created or updated at ${_data_paths_file}" [ -s "${_custom_include_list}" ] && cat << EOF > "${_custom_paths_file}" _SOURCE="" _INCLUDE_PATHS="" _EXCLUDE_PATHS="" _INCLUDE_LIST="${_custom_include_list}" EOF [ -s "${_custom_exclude_list}" ] && cat << EOF >> "${_custom_paths_file}" _EXCLUDE_LIST="${_custom_exclude_list}" EOF [ -s "${_custom_paths_file}" ] && echo "Global paths configuration created or updated at ${_custom_paths_file}" rm -f ${_global_config_dir}/.backboa*paths.ctrl.file touch ${_global_ctrl_file} fi } #### Generate Passphrase for Root _generate_global_secret_file() { local _secret_file="/root/.remote_backups/.secret.txt" if [ ! -s "${_secret_file}" ]; then openssl rand -base64 32 > "${_secret_file}" chmod 600 "${_secret_file}" chattr +i "${_secret_file}" echo "Global secret file created at ${_secret_file} and made immutable." else echo "Global secret file already exists at ${_secret_file}." fi } # Main execution _create_global_paths_config _generate_global_secret_file exit 0 ================================================ FILE: aegir/tools/backup/run/create_readme.sh ================================================ #!/bin/bash export HOME=/root export SHELL=/bin/bash export PATH=/usr/local/bin:/usr/local/sbin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin:/usr/libexec export _sPid="f62" # Directory for storing README files _BASE_DIR="/data/disk" # Function to ensure the README directory exists _ensure_readme_dir() { _user=$1 _credentials_dir="${_BASE_DIR}/${_user}/static/control/remote_backups/credentials" _dir_ctrl_file="${_BASE_DIR}/${_user}/log/.backboa.${_user}.${_sPid}.credentials.dir.ctrl" if [ ! -d "${_credentials_dir}" ] || [ ! -e "${_dir_ctrl_file}" ]; then mkdir -p "${_credentials_dir}" chown -R ${_user}.ftp:users "${_credentials_dir}" chmod 700 "${_credentials_dir}" touch "${_dir_ctrl_file}" echo "Created credentials directory for user: ${_user}" fi } # Function to create a README file for a specific user _create_readme_file() { _user=$1 _credentials_dir="${_BASE_DIR}/${_user}/static/control/remote_backups/credentials" _readme_file="${_credentials_dir}/README.txt" _readme_ctrl_file="${_BASE_DIR}/${_user}/log/.backboa.${_user}.${_sPid}.credentials.readme.ctrl" _ensure_readme_dir "${_user}" if [ ! -f "${_readme_ctrl_file}" ]; then cat << EOF > "${_readme_file}" # Backup Credentials README This directory contains credentials files for the backup services supported by the system. Each file corresponds to a specific backup service and must follow the correct format. ## Supported Services and Corresponding Files: Amazon S3 (Standard, One Zone, Standard-IA) File: aws.txt export AWS_ACCESS_KEY_ID="your_aws_access_key" export AWS_SECRET_ACCESS_KEY="your_aws_secret_key" export AWS_REGION="your_aws_region" # E.g., "us-east-1" export KEEP_WITHIN="3M" # Retain backups from the last 3 months export FULL_BACKUP_FREQUENCY="28D" # Create a full backup every 28 days Google Cloud Storage File: gcs.txt export GCS_PROJECT_ID="your_gcs_project_id" export GCS_SERVICE_ACCOUNT_KEY="your_gcs_service_account_key" export KEEP_WITHIN="3M" export FULL_BACKUP_FREQUENCY="28D" Backblaze B2 File: b2.txt export B2_ACCOUNT_ID="your_b2_account_id" export B2_APPLICATION_KEY="your_b2_application_key" export KEEP_WITHIN="3M" export FULL_BACKUP_FREQUENCY="28D" Cloudflare R2 Object Storage File: cloudflare.txt export R2_ACCOUNT_ID="your_account_id" export R2_ACCESS_KEY_ID="your_access_key_id" export R2_SECRET_ACCESS_KEY="your_secret_access_key" export KEEP_WITHIN="3M" export FULL_BACKUP_FREQUENCY="28D" Azure Blob Storage File: azure.txt export AZURE_STORAGE_ACCOUNT="your_azure_storage_account" export AZURE_STORAGE_KEY="your_azure_storage_key" export KEEP_WITHIN="3M" export FULL_BACKUP_FREQUENCY="28D" IBM Cloud Object Storage File: ibm.txt export IBM_API_KEY_ID="your_ibm_api_key_id" export IBM_SERVICE_INSTANCE_ID="your_ibm_service_instance_id" export IBM_REGION="your_ibm_region" export KEEP_WITHIN="3M" export FULL_BACKUP_FREQUENCY="28D" Wasabi Hot Cloud Storage File: wasabi.txt export WASABI_ACCESS_KEY="your_wasabi_access_key" export WASABI_SECRET_KEY="your_wasabi_secret_key" export WASABI_REGION="your_wasabi_region" # E.g., "us-east-1" export KEEP_WITHIN="3M" export FULL_BACKUP_FREQUENCY="28D" DigitalOcean Spaces File: do_spaces.txt export DO_SPACES_KEY="your_do_spaces_key" export DO_SPACES_SECRET="your_do_spaces_secret" export DO_SPACES_REGION="your_do_spaces_region" # E.g., "nyc3" export KEEP_WITHIN="3M" export FULL_BACKUP_FREQUENCY="28D" Linode Object Storage by Akamai File: linode.txt export LINODE_ACCESS_KEY="your_linode_access_key" export LINODE_SECRET_KEY="your_linode_secret_key" export LINODE_REGION="your_linode_region" # E.g., "us-east-1" export KEEP_WITHIN="3M" export FULL_BACKUP_FREQUENCY="28D" ## Security - Ensure credentials files are securely managed: - Files should have permissions set to 600 (\`chmod 600 \`). - The credentials directory should have permissions set to 700 (\`chmod 700 \`). ## Notes - The backup process will fail if the credentials file for a required service is missing or contains invalid placeholders. - Users are responsible for managing these credentials files securely. EOF chmod 600 "${_readme_file}" chown ${_user}.ftp:users "${_readme_file}" echo "Created README file for user: ${_user}" touch "${_readme_ctrl_file}" else echo "README file already updated for user: ${_user}" fi } # Main function to create README files for all users _main() { for _user_dir in "${_BASE_DIR}"/*; do if [ -d "${_user_dir}" ]; then _user=$(basename "${_user_dir}") if [ "${_user}" != "arch" ] \ && [ "${_user}" != "data" ] \ && [ "${_user}" != "global" ] \ && [ "${_user}" != "static" ] \ && [ "${_user}" != "custom" ]; then _create_readme_file "${_user}" fi fi done } # Execute the script _main ================================================ FILE: aegir/tools/backup/run/create_user_paths_config.sh ================================================ #!/bin/bash export HOME=/root export SHELL=/bin/bash export PATH=/usr/local/bin:/usr/local/sbin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin:/usr/libexec export _sPid="f62" # Log file for escape attempts and validation issues _VALIDATION_LOG_FILE="/var/log/backup_validation_issues.log" _check_root() { if [ "$(id -u)" -eq 0 ]; then # shellcheck disable=SC1091 [ -e "/root/.barracuda.cnf" ] && source /root/.barracuda.cnf fi } _check_root ### ### Load + normalize _INCIDENT_REPORT ### ### Legacy values: ### NO becomes OFF (see below) ### YES becomes MINI (see below) ### ### Current values: ### OFF == Total silence, no email alerts ### ALL == Very noisy, good for debugging ### MINI == Only the most important alerts (default) ### CRIT == Only critical if _lvl=ALERT ### _normalize_incident_report() { : "${_INCIDENT_REPORT:=MINI}" _INCIDENT_REPORT="${_INCIDENT_REPORT^^}" _INCIDENT_REPORT="${_INCIDENT_REPORT//[^A-Z]/}" ### ### Map legacy + validate ### case "${_INCIDENT_REPORT}" in NO) _INCIDENT_REPORT="OFF" ;; YES) _INCIDENT_REPORT="MINI" ;; OFF|ALL|MINI|CRIT) : ;; *) _INCIDENT_REPORT="MINI" ;; esac } _normalize_incident_report # Function to generate passphrase for user level backups _generate_user_secret_file() { local _user=$1 local _secret_file="/data/disk/${_user}/remote_backups/.secret.txt" if [ ! -s "${_secret_file}" ]; then openssl rand -base64 32 > "${_secret_file}" chmod 600 "${_secret_file}" chattr +i "${_secret_file}" echo "User secret file created at ${_secret_file} and made immutable." else echo "User secret file already exists at ${_secret_file}." fi } # Function to log validation issues _log_issue() { local _type=$1 local _file=$2 local _message=$3 echo "[$(date)] Validation issue: [${_type}] in file: [${_file}] with error: ${_message}" >> "${_VALIDATION_LOG_FILE}" if [ -n "${_MY_EMAIL}" ] && [ "${_INCIDENT_REPORT}" = "ALL" ]; then # Alert the admin echo "Sending Backup Validation Alert to ${_MY_EMAIL} on $(date)" >> ${_VALIDATION_LOG_FILE} s-nail -s "Backup Validation Alert for [$(hostname)] on $(date)" ${_MY_EMAIL} < ${_VALIDATION_LOG_FILE} fi } # Function to validate and merge configuration files _validate_and_merge_paths() { local _file=$1 local _user=$2 local _allowed_prefixes="'^/((data/disk/${_user}/static)|(home/${_user}\.ftp))" local _output_file=$3 local _if_validate=$4 local _invalid_paths_found=false # Ensure output file exists and is empty > "${_output_file}" while IFS= read -r _line; do # Skip empty lines and comments if [[ "${_line}" =~ ^\s*(#|$) ]]; then echo "${_line}" >> "${_output_file}" continue fi if [ "${_if_validate}" = "YES" ]; then # Validate directives if [[ "${_line}" =~ ^--(include|exclude|include-regexp|exclude-regexp) ]]; then if echo "${_line}" | grep -Eq "^--(include|exclude|include-regexp|exclude-regexp) ${_allowed_prefixes}"; then echo "${_line}" >> "${_output_file}" else _log_issue "${_user}" "${_file}" "Invalid path: ${_line}" _invalid_paths_found=true fi else _log_issue "${_user}" "${_file}" "Invalid directive: ${_line}" _invalid_paths_found=true fi elif [ "${_if_validate}" = "NO" ]; then echo "${_line}" >> "${_output_file}" fi done < "${_file}" # If invalid paths were found, alert and skip merging if [ "${_invalid_paths_found}" = true ]; then echo "Skipping invalid file '${_file}' for user '${_user}'." > "${_output_file}" # Clear output to avoid invalid entries fi } # Function to create or update a user's paths configuration file _create_user_paths_config() { local _user=$1 local _user_config_dir="/data/disk/${_user}/remote_backups/paths" local _user_control_dir="/data/disk/${_user}/static/control/remote_backups/config" local _include_list="${_user_config_dir}/.backboa.${_user}.include.list" local _exclude_list="${_user_config_dir}/.backboa.${_user}.exclude.list" local _include_file="${_user_config_dir}/.backboa.${_user}.include.file" local _exclude_file="${_user_config_dir}/.backboa.${_user}.exclude.file" local _include_regexp_file="${_user_config_dir}/.backboa.${_user}.include_regexp.file" local _exclude_regexp_file="${_user_config_dir}/.backboa.${_user}.exclude_regexp.file" local _merged_include_file="${_user_config_dir}/.backboa.${_user}.include.merged.file" local _merged_exclude_file="${_user_config_dir}/.backboa.${_user}.exclude.merged.file" local _merged_regexp_include_file="${_user_config_dir}/.backboa.${_user}.include_regexp.merged.file" local _merged_regexp_exclude_file="${_user_config_dir}/.backboa.${_user}.exclude_regexp.merged.file" local _user_ctrl_file="${_user_config_dir}/.backboa.${_sPid}.paths.ctrl.file" local _include_ctrl_file="${_user_config_dir}/.backboa.${_user}.${_sPid}.include.ctrl.file" local _exclude_ctrl_file="${_user_config_dir}/.backboa.${_user}.${_sPid}.exclude.ctrl.file" local _merged_all_include_file="${_user_config_dir}/.backboa.${_user}.all.include.merged.file" local _merged_all_exclude_file="${_user_config_dir}/.backboa.${_user}.all.exclude.merged.file" local _user_paths_file="${_user_config_dir}/paths.txt" # Ensure user configuration directory exists and is owned by root mkdir -p "${_user_config_dir}" chown root:root "${_user_config_dir}" chmod 755 "${_user_config_dir}" # Function to append unique entries from source to target file _append_unique_entries() { _source_file=$1 _target_file=$2 if [ -f "${_source_file}" ]; then grep -v -F -x -f "${_target_file}" "${_source_file}" >> "${_target_file}" fi } if [ ! -f "${_user_ctrl_file}" ]; then ### Migrate legacy exclude/include files if present and merge unique entries # _include_list if [ -f "/root/.backboa.include" ]; then if [ ! -f "${_include_list}" ]; then cp "/root/.backboa.include" "${_include_list}" else _append_unique_entries "/root/.backboa.include" "${_include_list}" fi fi # _exclude_list if [ -f "/root/.backboa.exclude" ]; then if [ ! -f "${_exclude_list}" ]; then cp "/root/.backboa.exclude" "${_exclude_list}" else _append_unique_entries "/root/.backboa.exclude" "${_exclude_list}" fi else cat << EOF > "${_exclude_list}" **files/advagg_css/** **files/advagg_js/** **files/css/** **files/js/** **private/temp/** EOF fi ### Create default exclude/include files if they don't exist # _include_file if [ ! -f "${_include_ctrl_file}" ]; then cat << EOF > "${_include_file}" --include /data/disk/${_user}/distro --include /data/disk/${_user}/platforms --include /data/disk/${_user}/static --include /home/${_user}.ftp EOF rm -f "${_user_config_dir}/.backboa.${_user}.*.include.ctrl.file" touch "${_include_ctrl_file}" fi # _exclude_file if [ ! -f "${_exclude_ctrl_file}" ]; then cat << EOF > "${_exclude_file}" --exclude /data/disk/${_user}/.tmp --exclude /data/disk/${_user}/clients --exclude /data/disk/${_user}/static/restores --exclude /data/disk/${_user}/static/tmp --exclude /data/disk/${_user}/static/trash --exclude /data/disk/${_user}/u --exclude /data/disk/${_user}/undo --exclude /home/${_user}.ftp/.tmp --exclude /home/${_user}.ftp/backups --exclude /home/${_user}.ftp/clients --exclude /home/${_user}.ftp/platforms --exclude /home/${_user}.ftp/static EOF rm -f ${_user_config_dir}/.backboa.${_user}.*.exclude.ctrl.file touch "${_exclude_ctrl_file}" fi # Cleanup for empty or not used include config files if [ ! -f "${_user_control_dir}/include_regexp.txt" ]; then [ -e "${_include_regexp_file}" ] && rm -f "${_include_regexp_file}" [ -e "${_merged_regexp_include_file}" ] && rm -f "${_merged_regexp_include_file}" fi # Cleanup for empty or not used exclude config files if [ ! -f "${_user_control_dir}/exclude_regexp.txt" ]; then [ -e "${_exclude_regexp_file}" ] && rm -f "${_exclude_regexp_file}" [ -e "${_merged_regexp_exclude_file}" ] && rm -f "${_merged_regexp_exclude_file}" fi # Validate and merge system and user-space include files _validate_and_merge_paths "${_include_file}" "${_user}" "${_merged_include_file}" NO if [ -f "${_user_control_dir}/include.txt" ]; then _validate_and_merge_paths "${_user_control_dir}/include.txt" "${_user}" "${_merged_include_file}" YES fi # Validate and merge system and user-space exclude files _validate_and_merge_paths "${_exclude_file}" "${_user}" "${_merged_exclude_file}" NO if [ -f "${_user_control_dir}/exclude.txt" ]; then _validate_and_merge_paths "${_user_control_dir}/exclude.txt" "${_user}" "${_merged_exclude_file}" YES fi # Validate and merge regexp include files if [ -f "${_include_regexp_file}" ]; then _validate_and_merge_paths "${_include_regexp_file}" "${_user}" "${_merged_regexp_include_file}" NO fi if [ -f "${_user_control_dir}/include_regexp.txt" ]; then _validate_and_merge_paths "${_user_control_dir}/include_regexp.txt" "${_user}" "${_merged_regexp_include_file}" YES fi # Validate and merge regexp exclude files if [ -f "${_exclude_regexp_file}" ]; then _validate_and_merge_paths "${_exclude_regexp_file}" "${_user}" "${_merged_regexp_exclude_file}" NO fi if [ -f "${_user_control_dir}/exclude_regexp.txt" ]; then _validate_and_merge_paths "${_user_control_dir}/exclude_regexp.txt" "${_user}" "${_merged_regexp_exclude_file}" YES fi # Merge all include path directives into single file cat "${_merged_include_file}" > "${_merged_all_include_file}" cat "${_merged_regexp_include_file}" >> "${_merged_all_include_file}" # Merge all exclude path directives into single file cat "${_merged_exclude_file}" > "${_merged_all_exclude_file}" cat "${_merged_regexp_exclude_file}" >> "${_merged_all_exclude_file}" # Convert the include file contents to a single-line variable without extra backslashes and excessive whitespace local _MERGED_ALL_INCLUDE=$(cat "${_merged_all_include_file}" | tr '\n' ' ' | tr -s ' ' | sed 's/^ *//;s/ *$//') # Convert the exclude file contents to a single-line variable without extra backslashes and excessive whitespace local _MERGED_ALL_EXCLUDE=$(cat "${_merged_all_exclude_file}" | tr '\n' ' ' | tr -s ' ' | sed 's/^ *//;s/ *$//') # Create the final paths configuration file cat << EOF > "${_user_paths_file}" _SOURCE="" _USER_INCLUDE_PATHS="${_MERGED_ALL_INCLUDE}" _USER_EXCLUDE_PATHS="${_MERGED_ALL_EXCLUDE}" _INCLUDE_LIST="${_include_list}" _EXCLUDE_LIST="${_exclude_list}" EOF rm -f ${_user_config_dir}/.backboa*paths.ctrl.file touch ${_user_ctrl_file} echo "Paths configuration for '${_user}' created or updated at '${_user_paths_file}'." fi } # Generate paths configuration for each user for _user_dir in /data/disk/*; do if [ -d "${_user_dir}" ]; then _user=$(basename "${_user_dir}") if [ "${_user}" != "arch" ] \ && [ "${_user}" != "data" ] \ && [ "${_user}" != "global" ] \ && [ "${_user}" != "static" ] \ && [ "${_user}" != "custom" ]; then _create_user_paths_config "${_user}" _generate_user_secret_file "${_user}" fi fi done ================================================ FILE: aegir/tools/backup/run/duplicity_backup.sh ================================================ #!/bin/bash # Environment setup export HOME=/root export SHELL=/bin/bash export PATH=/usr/local/bin:/usr/local/sbin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin:/usr/libexec export _tRee=dev # Function to print env for debugging _print_env() { if [ "$(id -u)" -eq 0 ] && [ -e "/root/.dev.server.cnf" ]; then _ENV=$(env 2>&1) echo echo "_ENV in $1 start" echo "${_ENV}" echo "_ENV in $1 end" echo _ENV= fi } # Function to verify BOA keys _verify_boa_keys() { if [ -e "/root/.dev.server.cnf" ]; then echo "PROC: _verify_boa_keys in multiback" fi if [ "${_tRee}" = "pro" ] || [ "${_tRee}" = "dev" ]; then _allw=NO _crlGet="-L --max-redirs 3 -k -s --retry 9 --retry-delay 9 -A iCab" _urlEnc="http://files.aegir.cc/enc/2024" _encName=$(echo ${_hName} \ | openssl md5 \ | awk '{ print $2}' \ | tr -d "\n" 2>&1) if [[ "${_hName}" =~ ".aegir.cc"($) ]] \ || [[ "${_hName}" =~ ".o8.io"($) ]] \ || [[ "${_hName}" =~ ".boa.io"($) ]]; then _allw=YES fi mkdir -p /var/opt rm -f /var/opt/_encN* curl ${_crlGet} "${_urlEnc}/${_encName}" -o /var/opt/_encN.${_encName}.tmp wait echo "${_hName}.${_encName}" > /var/opt/_encN_local.${_encName}.tmp wait if [ -e "/var/opt/_encN.${_encName}.tmp" ] && [ -e "/var/opt/_encN_local.${_encName}.tmp" ]; then _diffTestIf=$(diff -w -B /var/opt/_encN.${_encName}.tmp /var/opt/_encN_local.${_encName}.tmp 2>&1) if [ ! -z "${_diffTestIf}" ] && [ "${_allw}" = "NO" ]; then echo echo "Your system requires valid license to use this function" echo "Please visit https://omega8.cc/licenses to purchase your own" echo if [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "/var/aegir/key/barracuda_key.txt" ]; then mkdir -p /var/aegir/key cat /var/opt/_encN_local.${_encName}.tmp > /var/aegir/key/barracuda_key.txt fi rm -f /var/opt/_encN* exit 0 else if [ -e "/var/aegir/.drush/hm.alias.drushrc.php" ] \ && [ ! -e "/var/aegir/key/barracuda_key.txt" ]; then mkdir -p /var/aegir/key cat /var/opt/_encN_local.${_encName}.tmp > /var/aegir/key/barracuda_key.txt fi fi else echo echo "Your system requires valid license to use this BOA feature" echo "Unfortunately it was not possible to verify your system status" echo "Please contact our support but visit https://omega8.cc/licenses first" echo exit 0 fi fi } _if_hosted_sys() { if [ -e "/root/.host8.cnf" ] \ || [[ "${_hName}" =~ ".aegir.cc"($) ]]; then _hostedSys=YES else _hostedSys=NO fi } # Function to calculate RAM usage percentage as an integer _calculate_ram_usage_percent() { _total_ram_kb=$1 _available_ram_kb=$2 used_ram_kb=$((_total_ram_kb - _available_ram_kb)) # Using integer division to get a whole number percentage echo $(( (used_ram_kb * 100) / _total_ram_kb )) } # Function to check and display system info _check_system_ram() { # Get the total and available RAM in KB _total_ram_kb=$(grep MemTotal /proc/meminfo | awk '{print $2}') _available_ram_kb=$(grep MemAvailable /proc/meminfo | awk '{print $2}') # Calculate RAM usage percentage _ram_usage_percent=$(_calculate_ram_usage_percent ${_total_ram_kb} ${_available_ram_kb}) } # Function to check and optimize RAM and disk caches _optimize_ram() { swapoff -a _check_system_ram if [ "${_ram_usage_percent}" -gt 50 ]; then sync && echo 3 | tee /proc/sys/vm/drop_caches fi swapon -a } ### ### Load + normalize _INCIDENT_REPORT ### ### Legacy values: ### NO becomes OFF (see below) ### YES becomes MINI (see below) ### ### Current values: ### OFF == Total silence, no email alerts ### ALL == Very noisy, good for debugging ### MINI == Only the most important alerts (default) ### CRIT == Only critical if _lvl=ALERT ### _normalize_incident_report() { : "${_INCIDENT_REPORT:=MINI}" _INCIDENT_REPORT="${_INCIDENT_REPORT^^}" _INCIDENT_REPORT="${_INCIDENT_REPORT//[^A-Z]/}" ### ### Map legacy + validate ### case "${_INCIDENT_REPORT}" in NO) _INCIDENT_REPORT="OFF" ;; YES) _INCIDENT_REPORT="MINI" ;; OFF|ALL|MINI|CRIT) : ;; *) _INCIDENT_REPORT="MINI" ;; esac } # Function to verify root access _check_root() { if [ "$(id -u)" -eq 0 ]; then ionice -c2 -n7 -p $$ renice 19 -p $$ chmod a+w /dev/null [ -e "/root/.gnupg" ] && chmod 700 /root/.gnupg else echo "ERROR: This script should be run as a root user" exit 1 fi _DF_TEST="$(command df -P -l / 2>/dev/null | awk ' NR==1 { for (i=1; i<=NF; i++) if ($i=="Use%" || $i=="Capacity") u=i } NR==2 { gsub(/%/,"",$u); print $u }')" if [ ! -z "${_DF_TEST}" ] && [ "${_DF_TEST}" -gt 90 ]; then echo "ERROR: Your disk space is almost full !!! ${_DF_TEST}/100" echo "ERROR: We can not proceed until it is below 90/100" exit 1 fi # shellcheck disable=SC1091 [ -e "/root/.barracuda.cnf" ] && source /root/.barracuda.cnf _AWS_VLV=${_AWS_VLV//[^a-z]/} if [ -z "${_AWS_VLV}" ]; then _AWS_VLV="warning" fi _hName="$(cat /etc/hostname 2>/dev/null | tr -d '\n' || hostname -f 2>/dev/null)" _cpuNr="$(cat /data/all/cpuinfo 2>/dev/null | tr -d '\n' || nproc 2>/dev/null)" if [ -n "${_cpuNr}" ]; then [ "${_cpuNr}" -gt 8 ] && _useCpu=4 [ "${_cpuNr}" -le 8 ] && _useCpu=2 [ "${_cpuNr}" -le 4 ] && _useCpu=1 else _useCpu=1 fi } _check_root _normalize_incident_report _optimize_ram _if_hosted_sys _verify_boa_keys _print_env "multiback_init" [ -e "/root/.pause_heavy_tasks_maint.cnf" ] && exit 0 # New OpenSSL 3.x version is required if [ ! -x "/usr/local/ssl3/bin/openssl" ]; then echo "New OpenSSL 3.x version is required" exit 1 fi # Function to notify about still running backup _waiting_notify() { local _templog="/var/backups/multiback_waiting_queue.log" cat /root/.remote_backups/schedule/backup_schedule.txt > ${_templog} ps axf | grep multiback >> ${_templog} ps axf | grep duplicity >> ${_templog} ls -la /tmp/duplicity-*-tempdir >> ${_templog} tree /root/.cache/duplicity >> ${_templog} ls -laR /root/.cache/duplicity >> ${_templog} grep "Out of memory: Killed process.*duplicity" /var/log/iptables.log >> ${_templog} boa info >> ${_templog} if [ -n "${_MY_EMAIL}" ] && [ "${_INCIDENT_REPORT}" = "ALL" ]; then s-nail -s "Multiback Waiting Report for [${_hName}] on $(date)" ${_MY_EMAIL} < ${_templog} fi } _CNT=$(pgrep -fc duplicity) if (( _CNT > 0 )); then echo "[$(date)] Active duplicity process detected, will try again later..." >> /var/log/mybackup_waiting_queue.log _waiting_notify exit 1 fi # Function to display usage information _usage() { echo "Usage: $0 {backup|cleanup|restore} [RESTORE_TARGET] [RESTORE_PATH] [RESTORE_TIME]" echo echo "Example commands:" echo " Backup:" echo " $0 backup aws john" echo " $0 backup b2 jane" echo echo " Cleanup:" echo " $0 cleanup aws john" echo " $0 cleanup gcs jane" echo echo " Restore:" echo " $0 restore aws john /restore/target /specific/path 1D" echo " $0 restore b2 jane /restore/target /another/path 2W" echo echo "Supported services:" echo " aws, aws_one_zone, aws_standard_ia, azure, b2, cloudflare, do_spaces, gcs, ibm, linode, wasabi" echo echo "NOTE: [RESTORE_PATH] must be an absolute path (no leading slash) of the file or directory to restore" echo exit 1 } # Function to create PID file _create_pid_file() { local _pidfile=$1 if [ -e "${_pidfile}" ]; then echo "Process already running with PID file ${_pidfile}" exit 1 else echo $$ > "${_pidfile}" fi } # Function to remove PID file _remove_pid_file() { local _pidfile=$1 if [ -f "${_pidfile}" ]; then rm -f "${_pidfile}" || { echo "Warning: Failed to remove PID file: ${_pidfile}" } fi } # Function to remove stale multiback PID file _remove_stale_multiback_pid() { local _service=$1 local _user=$2 _multiback_pidfile="/run/duplicity_${_service}_${_user}.pid" if [ -f "${_multiback_pidfile}" ]; then _old_pid=$(cat "${_multiback_pidfile}") if [ -n "${_old_pid}" ] && ! kill -0 "${_old_pid}" 2>/dev/null; then echo "Stale multiback PID file detected: ${_multiback_pidfile}. Removing it." rm -f "${_multiback_pidfile}" fi fi } # Function to log validation issues _log_issue() { local _type=$1 local _file=$2 local _message=$3 echo "[$(date)] Validation issue type: [${_type}] in file: [${_file}] with error: ${_message}" >> "${_VALIDATION_LOG_FILE}" if [ -n "${_MY_EMAIL}" ] && [ "${_INCIDENT_REPORT}" = "ALL" ]; then # Alert the admin boa info >> ${_LOGFILE} echo "Sending Backup Validation Alert to ${_MY_EMAIL} on $(date)" >> ${_LOGFILE} s-nail -s "Backup Validation Alert for [$(hostname)] on $(date)" ${_MY_EMAIL} < ${_LOGFILE} fi } # Helper function to URL-encode using jq _url_encode() { echo -n "$1" | jq -s -R -r @uri } # Function to escape values _escape_value() { printf '%q' "$1" } # Function to sanitize and validate credentials file _validate_credentials() { local _cred_file="$1" local _service="$2" local _line_number=0 while IFS= read -r _line || [ -n "${_line}" ]; do _line_number=$(( _line_number + 1 )) # Trim leading and trailing whitespace _line="${_line#"${_line%%[![:space:]]*}"}" _line="${_line%"${_line##*[![:space:]]}"}" # Skip empty lines immediately if [[ -z "${_line}" ]]; then continue fi # Remove full-line comments: lines that *start* with '#' if [[ "${_line}" == \#* ]]; then continue fi # Remove anything after (and including) the first '#' for inline comments # (This is a naive approach that does not consider # within quotes) if [[ "${_line}" == *"#"* ]]; then _line="${_line%%#*}" # Re-trim after removing the comment _line="${_line#"${_line%%[![:space:]]*}"}" _line="${_line%"${_line##*[![:space:]]}"}" fi # Skip if there's nothing left after stripping inline comment if [[ -z "${_line}" ]]; then continue fi # Remove 'export ' prefix if present _line="${_line#export }" # Validate the variable assignment (key=value) if [[ "${_line}" =~ ^([A-Za-z_][A-Za-z0-9_]*)=(\".*\"|'.*'|[^[:space:]]+)$ ]]; then export _varname="${BASH_REMATCH[1]}" export _value="${BASH_REMATCH[2]}" # Remove surrounding quotes if present if [[ "${_value}" =~ ^\".*\"$ || "${_value}" =~ ^\'.*\'$ ]]; then export _value="${_value:1:-1}" fi # Check for forbidden characters in value if echo "${_value}" | grep -q -E '[$`(){};&|<>]'; then _log_issue "credentials" "${_cred_file}" \ "Forbidden characters in value at line ${_line_number}: ${_line}" continue fi # Safely export the variable (URL-encode if needed) if [ "${_service}" = "b2" ]; then export ${_varname}=$(_url_encode "${_value}") else export ${_varname}="${_value}" fi else _log_issue "credentials" "${_cred_file}" \ "Invalid syntax at line ${_line_number}: ${_line}" fi done < "${_cred_file}" _print_env "multiback_validate_credentials" } # Function to load credentials _load_credentials() { local _service="$1" local _user="$2" if [ "${_user}" != "arch" ] \ && [ "${_user}" != "data" ] \ && [ "${_user}" != "global" ] \ && [ "${_user}" != "static" ] \ && [ "${_user}" != "custom" ]; then local _cred_file="/data/disk/${_user}/static/control/remote_backups/credentials/${_service}.txt" local _secret_file="/data/disk/${_user}/remote_backups/.secret.txt" fi if [ "${_user}" = "global" ] || [ "${_user}" = "data" ] || [ "${_user}" = "custom" ]; then local _cred_file="/root/.remote_backups/credentials/${_service}.txt" local _secret_file="/root/.remote_backups/.secret.txt" fi if [ -s "${_secret_file}" ]; then export PASSPHRASE=$(cat "${_secret_file}") else echo "Secret file ${_secret_file} not found. Unable to proceed." exit 1 fi if [ ! -s "${_cred_file}" ]; then echo "Error: Credentials file '${_cred_file}' not found." exit 1 fi _validate_credentials "${_cred_file}" "${_service}" _print_env "multiback_load_credentials" } # Function to load paths configuration _load_paths() { local _user="$1" if [ "${_user}" != "arch" ] \ && [ "${_user}" != "data" ] \ && [ "${_user}" != "global" ] \ && [ "${_user}" != "static" ] \ && [ "${_user}" != "custom" ]; then local _paths_file="/data/disk/${_user}/remote_backups/paths/paths.txt" elif [ "${_user}" = "global" ] || [ "${_user}" = "data" ] || [ "${_user}" = "custom" ]; then local _paths_file="/root/.remote_backups/paths/${_user}_paths.txt" fi if [ ! -f "${_paths_file}" ]; then echo "Error: Paths configuration file '${_paths_file}' not found." exit 1 fi if [ "${_user}" != "arch" ]; then source "${_paths_file}" fi _print_env "multiback_load_paths" } # Function to validate duration format and fallback to default _validate_or_default_duration() { local _value=$1 local _var_name=$2 local _default=$3 # Supported formats: number followed by D (days), W (weeks), M (months), Y (years) if [[ ! "${_value}" =~ ^[0-9]+[DWMY]$ ]] || [[ "${_value}" =~ ^[0][DWMY]$ ]]; then echo "Warning: Invalid value '${_value}' for ${_var_name}. Using default '${_default}'." eval "${_var_name}='${_default}'" _print_env "multiback_validate_or_default_duration" fi # Enforced min value for KEEP_WITHIN (1M) if [ "${_var_name}" = "KEEP_WITHIN" ] && [[ ! "${_value}" =~ ^[0-9]+[MY]$ ]]; then echo "Warning: Invalid value '${_value}' for ${_var_name}. It must be at least 1M. Using default '${_default}'." eval "${_var_name}='${_default}'" _print_env "multiback_validate_or_default_duration_keep" fi # Enforced min and max value for FULL_BACKUP_FREQUENCY (7D to 60D) if [ "${_var_name}" = "FULL_BACKUP_FREQUENCY" ] && [[ ! "${_value}" =~ ^([7-9]|[1-5][0-9]|60)D$ ]]; then echo "Warning: Invalid value '${_value}' for ${_var_name}. It must be between 7D and 60D. Using default '${_default}'." eval "${_var_name}='${_default}'" _print_env "multiback_validate_or_default_duration_freq" fi } # Function to construct _BUCKET_NAME _construct_bucket_name() { local _service_abbr=$1 local _user=$2 _service_dash=$(echo -n ${_service_abbr} | tr _ -) _hst_dash=$(echo -n ${_hName} | tr . -) export _BUCKET_NAME="back-to-${_user}-${_hst_dash}-${_service_dash}" export _NAME="${_user}-${_service_dash}" export _LOGFILE="${_LOGPTH}/${_BUCKET_NAME}.log" _print_env "multiback_construct_bucket_name" } # Function to generate duplicity-compatible include directives _generate_include_directives() { local _source=$1 local _include="" for _cdir in ${_source}; do _include="${_include} --include ${_cdir}" done echo "${_include}" } # Function to prepare backup directives _backup_prepare() { if [ -e "/root/.cache/duplicity/${_NAME}" ]; then _CacheTest=$(find /root/.cache/duplicity/${_NAME} \ -maxdepth 1 \ -mindepth 1 \ -type f \ | sort 2>&1) if [[ "${_CacheTest}" =~ "No such file or directory" ]] \ || [ -z "${_CacheTest}" ]; then export _cached=NO else export _cached=YES fi fi # Generate include directives dynamically [ -n "${_SOURCE}" ] && _SRC_INCLUDE=$(_generate_include_directives "${_SOURCE}") # [ -n "${_INCLUDE_PATHS}" ] && _MERGED_ALL_INCLUDE="${_INCLUDE_PATHS}" [ -n "${_EXCLUDE_PATHS}" ] && _MERGED_ALL_EXCLUDE="${_EXCLUDE_PATHS}" # [ -n "${_USER_INCLUDE_PATHS}" ] && _USER_MERGED_ALL_INCLUDE="${_USER_INCLUDE_PATHS}" [ -n "${_USER_EXCLUDE_PATHS}" ] && _USER_MERGED_ALL_EXCLUDE="${_USER_EXCLUDE_PATHS}" # [ -s "${_INCLUDE_LIST}" ] && _LST_INCLUDE="--include-filelist ${_INCLUDE_LIST}" [ -s "${_EXCLUDE_LIST}" ] && _LST_EXCLUDE="--exclude-filelist ${_EXCLUDE_LIST}" ### [ -n "${_MERGED_ALL_INCLUDE}" ] && _BATCH_INCLUDE="${_MERGED_ALL_INCLUDE}" [ -n "${_USER_MERGED_ALL_INCLUDE}" ] && _BATCH_INCLUDE="${_USER_MERGED_ALL_INCLUDE}" [ -n "${_LST_INCLUDE}" ] && _BATCH_INCLUDE="${_BATCH_INCLUDE} ${_LST_INCLUDE}" [ -n "${_SRC_INCLUDE}" ] && _BATCH_INCLUDE="${_BATCH_INCLUDE} ${_SRC_INCLUDE}" # [ -n "${_MERGED_ALL_EXCLUDE}" ] && _BATCH_EXCLUDE="${_MERGED_ALL_EXCLUDE}" [ -n "${_USER_MERGED_ALL_EXCLUDE}" ] && _BATCH_EXCLUDE="${_USER_MERGED_ALL_EXCLUDE}" [ -n "${_LST_EXCLUDE}" ] && _BATCH_EXCLUDE="${_BATCH_EXCLUDE} ${_LST_EXCLUDE}" # export _BATCH_INCLUDE export _BATCH_EXCLUDE _print_env "multiback_backup_prepare" } # Function to set backup mode _set_mode() { local _user="${_USER}" [ -z "${_MODE}" ] && _MODE="backup" if [ -e "${_LOGPTH}/${_BUCKET_NAME}.archive.log" ] && [ "${_cached}" = "YES" ]; then export _MODE="incremental" else [ ! -e "${_LOGPTH}/${_BUCKET_NAME}.${_TODAY}.full.log" ] && export _MODE="full" fi [ -e "/root/.dev.server.cnf" ] && echo "The _MODE has been set to (${_MODE}) in _set_mode for ${_BUCKET_NAME} on $(date)" >> ${_LOGFILE} if [ "${_hostedSys}" = "YES" ]; then if [ "${_user}" = "global" ] || [ "${_user}" = "data" ] || [ "${_user}" = "custom" ]; then if [ "${_DOM}" = 1 ] && [ ! -e "${_LOGPTH}/${_BUCKET_NAME}.${_TODAY}.full.log" ]; then _MODE="full" echo "The _MODE has been re-set to (${_MODE}) in _set_mode for ${_BUCKET_NAME} on $(date)" >> ${_LOGFILE} fi fi else [ -e "/root/.dev.server.cnf" ] && echo "The FULL_BACKUP_FREQUENCY is (${FULL_BACKUP_FREQUENCY}) for ${_BUCKET_NAME}" >> ${_LOGFILE} fi export _MODE _print_env "multiback_set_mode" } # Function to construct backup command _set_cmd() { local _user="${_USER}" if [ -z "${KEEP_WITHIN}" ] && [ -n "${_AWS_TTL}" ]; then export KEEP_WITHIN="${_AWS_TTL}" fi if [ -z "${FULL_BACKUP_FREQUENCY}" ] && [ -n "${_AWS_FLC}" ]; then export FULL_BACKUP_FREQUENCY="${_AWS_FLC}" fi # Validate or set default for KEEP_WITHIN _validate_or_default_duration "${KEEP_WITHIN}" "KEEP_WITHIN" "${_DEFAULT_KEEP_WITHIN}" # Validate or set default for FULL_BACKUP_FREQUENCY _validate_or_default_duration "${FULL_BACKUP_FREQUENCY}" "FULL_BACKUP_FREQUENCY" "${_DEFAULT_FULL_BACKUP_FREQUENCY}" ### Default backup command with encryption export _DCY_BUP_CMD="/usr/local/bin/duplicity ${_MODE} \ -v ${_AWS_VLV} \ --name=${_NAME} \ --allow-source-mismatch \ --concurrency ${_useCpu} \ --copy-links \ --full-if-older-than ${FULL_BACKUP_FREQUENCY} \ --volsize 300" ### Default utility command with encryption export _DCY_UTL_CMD="/usr/local/bin/duplicity \ -v ${_AWS_VLV} \ --name=${_NAME} \ --allow-source-mismatch \ --concurrency ${_useCpu}" ### Custom backup command with encryption and enforced own FULL_BACKUP_FREQUENCY export _FBF_BUP_CMD="/usr/local/bin/duplicity ${_MODE} \ -v ${_AWS_VLV} \ --name=${_NAME} \ --allow-source-mismatch \ --concurrency ${_useCpu} \ --copy-links \ --volsize 300" ### Custom backup command without encryption and enforced own FULL_BACKUP_FREQUENCY export _NOE_BUP_CMD="/usr/local/bin/duplicity ${_MODE} \ -v ${_AWS_VLV} \ --name=${_NAME} \ --allow-source-mismatch \ --concurrency ${_useCpu} \ --no-encryption \ --volsize 300" ### Custom utility command without encryption export _NOE_UTL_CMD="/usr/local/bin/duplicity \ -v ${_AWS_VLV} \ --name=${_NAME} \ --allow-source-mismatch \ --no-encryption \ --concurrency ${_useCpu}" if [ "${_hostedSys}" = "YES" ]; then if [ "${_user}" = "global" ] || [ "${_user}" = "data" ]; then export _DCY_BUP_CMD="${_FBF_BUP_CMD}" elif [ "${_user}" = "custom" ]; then export _DCY_BUP_CMD="${_NOE_BUP_CMD}" export _DCY_UTL_CMD="${_NOE_UTL_CMD}" fi fi _print_env "multiback_set_cmd" } _test() { local _mode="$1" if [ "${_mode}" != "only" ]; then _set_mode _set_cmd fi echo "Running ${_BUCKET_NAME} connection test, please wait..." echo "Command is ${_DCY_UTL_CMD} cleanup --dry-run --timeout 8 ${_BACKUP_TARGET}" _ConnTest=$(${_DCY_UTL_CMD} cleanup --dry-run --timeout 8 ${_BACKUP_TARGET} 2>&1) if [[ "${_ConnTest}" =~ "No connection to backend" ]] \ || [[ "${_ConnTest}" =~ "does not exist" ]] \ || [[ "${_ConnTest}" =~ "IllegalLocationConstraintException" ]]; then echo "Sorry, I can't connect to ${_BUCKET_NAME}" echo >> ${_LOGFILE} echo "Sorry, I can't connect to ${_BUCKET_NAME}" >> ${_LOGFILE} echo "Please check if the bucket has expected name:" >> ${_LOGFILE} echo " ${_BUCKET_NAME}" >> ${_LOGFILE} echo "This bucket must exist in the specified ${_SERVICE} region" >> ${_LOGFILE} echo >> ${_LOGFILE} else echo "OK, I can connect to ${_BUCKET_NAME}" fi } # Function to check collection-status only _status() { echo "Command is ${_DCY_UTL_CMD} collection-status ${_BACKUP_TARGET}" ${_DCY_UTL_CMD} collection-status ${_BACKUP_TARGET} wait } # Function to list-current-files only _list() { echo "Command is ${_DCY_UTL_CMD} list-current-files ${_BACKUP_TARGET}" ${_DCY_UTL_CMD} list-current-files ${_BACKUP_TARGET} wait } _remove_older_than() { echo "Running remove-older-than ${KEEP_WITHIN} for ${_BUCKET_NAME} on $(date)" >> ${_LOGFILE} echo "Command is ${_DCY_UTL_CMD} remove-older-than ${KEEP_WITHIN} --force ${_BACKUP_TARGET}" ${_DCY_UTL_CMD} remove-older-than ${KEEP_WITHIN} --force ${_BACKUP_TARGET} >> ${_LOGFILE} wait } _collection_status() { echo "Running collection-status for ${_BUCKET_NAME} on $(date)" >> ${_LOGFILE} echo "Command is ${_DCY_UTL_CMD} collection-status ${_BACKUP_TARGET}" ${_DCY_UTL_CMD} collection-status ${_BACKUP_TARGET} >> ${_LOGFILE} wait } # Function to only repair incomplete backup sets _repair_only() { echo "Running repair via cleanup --force for ${_BUCKET_NAME} on $(date)" >> ${_LOGFILE} echo "Command is ${_DCY_UTL_CMD} cleanup --force ${_BACKUP_TARGET}" ${_DCY_UTL_CMD} cleanup --force ${_BACKUP_TARGET} >> ${_LOGFILE} wait } # Function to repair incomplete backup sets _repair() { _repair_only _collection_status } # Function to check if repair incomplete backup sets is needed _check_if_repair() { if grep -q "found incomplete backup sets" "${_LOGFILE}"; then _repair_only fi } # Function to check if backup worked cleanly or log the errors _check_if_worked_cleanly_or_log_err() { if [ "${_user}" = "global" ] || [ "${_user}" = "data" ] || [ "${_user}" = "custom" ]; then local _logs_dir="/root/.remote_backups/logs" else local _logs_dir="/data/disk/${_user}/static/control/remote_backups/logs" fi if grep -q "Backup Statistics" "${_LOGFILE}"; then [ ! -e "${_logs_dir}" ] && mkdir -p ${_logs_dir} cp -af "${_LOGFILE}" "${_logs_dir}/OK-${_BUCKET_NAME}.log" else [ ! -e "${_logs_dir}" ] && mkdir -p ${_logs_dir} cp -af "${_LOGFILE}" "${_logs_dir}/ERR-${_BUCKET_NAME}.log" fi } # Function to wipe the bucket completely _wipe() { echo "Running wipe via remove-all-but-n-full 0 --force for ${_BUCKET_NAME} on $(date)" >> ${_LOGFILE} echo "Command is ${_DCY_UTL_CMD} remove-all-but-n-full 0 --force ${_BACKUP_TARGET}" ${_DCY_UTL_CMD} remove-all-but-n-full 0 --force ${_BACKUP_TARGET} >> ${_LOGFILE} wait } # Function to purge all backup sets _purge() { _repair_only _wipe _collection_status } # Function to run weekly cleanup _weekly_cleanup() { if [ -e "${_LOGPTH}/${_BUCKET_NAME}.archive.log" ] \ && [ ! -e "${_LOGPTH}/${_BUCKET_NAME}.${_TODAY}.cleanup.log" ] \ && [ "${_DOW}" = 7 ] \ && [ "${_cached}" = "YES" ]; then _test "only" _remove_older_than echo "$(date)" >> ${_LOGPTH}/${_BUCKET_NAME}.${_TODAY}.cleanup.log else _test "only" fi } # Function to clean up old backups _cleanup() { _remove_older_than _collection_status } # Function to perform backup _run_backup() { export _FULL_BACK_CMD="${_DCY_BUP_CMD} ${_BATCH_EXCLUDE} ${_BATCH_INCLUDE} --exclude '**' / ${_BACKUP_TARGET}" echo "Running in ${_MODE} mode for ${_BUCKET_NAME} on $(date)" >> ${_LOGFILE} echo "$(date)" >> ${_LOGPTH}/${_BUCKET_NAME}.${_TODAY}.${_MODE}.log ${_DCY_BUP_CMD} ${_BATCH_EXCLUDE} ${_BATCH_INCLUDE} --exclude '**' / ${_BACKUP_TARGET} >> ${_LOGFILE} wait _print_env "multiback_run_backup" } # Function to prepare backup _backup() { _backup_prepare _set_mode _set_cmd _run_backup _check_if_repair _weekly_cleanup _check_if_worked_cleanly_or_log_err if [ -n "${_MY_EMAIL}" ] && [ "${_INCIDENT_REPORT}" != "OFF" ]; then boa info >> ${_LOGFILE} echo "Sending email report on $(date)" >> ${_LOGFILE} echo >> ${_LOGFILE} s-nail -s "Backup report (${_MODE}) for ${_BUCKET_NAME} on $(date)" ${_MY_EMAIL} < ${_LOGFILE} fi cat ${_LOGFILE} >> ${_LOGPTH}/${_BUCKET_NAME}.archive.log rm -f ${_LOGFILE} _print_env "multiback_backup" } ### Legacy procedure for reference # # Note: Be careful while restoring not to prepend a slash to the path! # # $ backboa restore file [time] destination # # Restoring a single file to tmp/ # $ backboa restore data/disk/o1/backups/foo.tar.gz tmp/foo.tar.gz # # Restoring an older version of a directory to tmp/ - interval or full date # $ backboa restore data/disk/o1/backups 7D8h8s tmp/backups # $ backboa restore data/disk/o1/backups 2014/11/11 tmp/backups # # _restore() { # if [ $# = 2 ]; then # echo "Command is ${_DCY_UTL_CMD} restore --path-to-restore $1 ${_BACKUP_TARGET} $2" # ${_DCY_UTL_CMD} restore --path-to-restore $1 ${_BACKUP_TARGET} $2 # else # echo "Command is ${_DCY_UTL_CMD} restore --path-to-restore $1 --time $2 ${_BACKUP_TARGET} $3" # ${_DCY_UTL_CMD} restore --path-to-restore $1 --time $2 ${_BACKUP_TARGET} $3 # fi # } # ### Legacy procedure for reference ### Duplicity man page https://duplicity.gitlab.io/devel/duplicity.1.html#name # # duplicity [backup|full|incremental] [options] source_directory target_url # duplicity verify [options] [--compare-data] [--path-to-restore ] [--time time] source_url target_directory # duplicity collection-status [options] [--file-changed ] [--show-changes-in-set ] [--jsonstat]] target_url # duplicity list-current-files [options] [--time time] target_url # duplicity [restore] [options] [--path-to-restore ] [--time time] source_url target_directory # duplicity remove-older-than