PHP

One pool per site

The pool runs as the site's account user. exec is disabled unless an administrator turns it on for that site. Verified on the test server: a second site's pool cannot read the first site's files, or /etc/hostname.

The global defaults come from the hardware profile, each with the rule that produced it. klyrn profile prints all of them:

pm.max_children = 12
40% of RAM (2370 MB) / 48 MB per worker / 4 busy sites, clamped 4..48

Versions

klyrn php versions              # what is installed
klyrn site set example.com --php 8.3

The installer installs PHP 8.3 from ppa:ondrej/php with a pinned key fingerprint. Other versions from the same PPA can be installed by hand. KLYRN configures a version it has not seen before (writing its klyrn-global.conf) before it moves a live site onto it.

If the new pool will not start, the old one is restored. See Changing a site.

Per-site settings

klyrn site set example.com \
  --memory-limit 512M \
  --upload-max 64M \
  --post-max 64M \
  --max-execution 120 \
  --max-input-time 120 \
  --max-input-vars 3000

klyrn site set example.com --display-errors   # development only
klyrn site set example.com --reset-php        # clear them all

Values are validated. Memory up to 4096 MB, uploads up to 2048 MB, execution time up to 3600 seconds. Input time between −1 and 3600, input vars between 100 and 100000. Sizes are digits with an optional K, M or G. A value in kilobytes rounds up to 1 MB.

An upload limit larger than the post limit is refused, and the message says why.

Extensions

klyrn php extensions                    # every version, every catalogue entry and its state
klyrn php extensions --version 8.3 --all
klyrn php enable redis --version 8.3
klyrn php disable xdebug --version 8.3

The ionCube Loader is in the list too, for sites whose PHP files are encoded with ionCube. That is common in commercial scripts and in sites that have lived on cPanel or DirectAdmin for years. Enable it with klyrn php enable ioncube --version 8.1. KLYRN fetches release 15.5.0 from ionCube's own server, refuses it unless it matches a pinned checksum, and loads it ahead of OPcache. ionCube publishes no loader for PHP 8.0, so an encoded site has to run on another version.

You never type a package name. The only names are the 74 catalogue keys. For every one except the ionCube Loader the package installed is php<version>-<key>:

mysql, curl, mbstring, xml, gd, imagick, intl, zip, bcmath, gmp, soap, opcache, apcu, redis, memcached, mongodb, pgsql, sqlite3, ldap, ssh2, imap, xdebug

State is read from php -m and the packaging. The lookup folds case, so SimpleXML and Zend OPcache are matched correctly.

Four states are reported: builtin, enabled, disabled, available.

What happens when you change one

An extension is installed once for the whole machine and loaded into every site's PHP worker. Turning one on is an administrator action, and a job with four steps:

1. installOnly when enabling, and only the catalogue's own package name.
2. modulephpenmod or phpdismod.
3. reloadphp-fpm must accept the configuration first. If the reload fails, the module is put back the way it was. Entries marked as needing a restart get a real restart, which drops requests in flight. The panel says so.
4. verifyphp -m is read again through the running pool. If the change did not take, it is undone.

mysql, curl, mbstring and xml are marked required and cannot be turned off.