php-fpm.toml

[server]
listen = ["0.0.0.0:80"]
tls_listen = ["0.0.0.0:443"]
default_vhost = "php.example.test"

[tls]
enabled = true
backend = "rustls"

[tls.acme]
enabled = true
storage = "acme"
contact_email = "admin@example.test"
challenge = "http-01"

[[vhosts]]
name = "php.example.test"
hosts = ["php.example.test"]

[vhosts.tls]
enabled = true

[vhosts.tls.acme]
enabled = true
domains = ["php.example.test"]

[vhosts.php]
# WordPress preset applies the front-controller fallback and blocks PHP
# execution under common upload/files directories.
preset = "wordpress"
enabled = true
runtime = "php-fpm"
root = "/srv/sites/php.example.test/public"
# Default false. When true, only the final php.root component may be a symlink;
# Fluxheim resolves it once at startup and still rejects symlinked parents.
# resolve_root_symlink = true
# Optional: path visible inside a separate php-fpm container.
# When omitted, Fluxheim sends php.root as DOCUMENT_ROOT/SCRIPT_FILENAME.
fpm_root = "/app/public"
index = "index.php"
allowed_extensions = ["php"]
# Optional extra deny prefixes can still be added on top of the preset.
# deny_path_prefixes = ["/custom-uploads/"]
# Use `strict` for try_files $uri =404 style PHP execution.
# try_files = "strict"
# Advanced migration switches; both default to true.
pass_request_headers = true
pass_request_body = true
# Optional override for CGI SERVER_PORT. When omitted, Fluxheim uses an
# explicit Host port or falls back to 443 for TLS and 80 for cleartext.
# server_port = 443
request_timeout_secs = 30
# Default 8. Caps concurrent PHP-FPM requests before request body buffering and
# FastCGI dispatch. Raise only with matching memory and php-fpm worker capacity.
max_in_flight = 8
max_request_body_bytes = "64MiB"
# Optional upload spooling for larger request bodies. Configure both fields
# together; the directory must be safe for the Fluxheim service user.
# request_body_spool_threshold_bytes = "4MiB"
# request_body_spool_dir = "/var/lib/fluxheim/php-spool/php.example.test"
max_response_bytes = "64MiB"
max_response_header_bytes = "64KiB"
stderr_log = true
stderr_log_level = "warn"
stderr_max_bytes = "2KiB"
# Treat matching STDERR output as an invalid FastCGI response. Pair with
# php.fpm.retry_invalid_response for safe-method failover.
# stderr_failure_patterns = ["PHP Fatal error:"]
# Remove selected headers emitted by PHP before the response is sent.
hide_response_headers = ["x-powered-by"]
# Let Fluxheim own cache headers after consuming PHP cache/offload controls.
# ignore_origin_cache_headers = false
# Convert selected PHP error statuses into Fluxheim-generated error responses.
intercept_error_statuses = []
# Use "split" only when the application expects PATH_INFO after script.php.
path_info = "disabled"

#[[vhosts.php.error_pages]]
#status = 502
#path = "/502.html"
#
#[vhosts.php.error_pages.web]
#root = "/srv/errors"
#index_files = ["index.html"]

[vhosts.php.params]
# Optional administrator-controlled FastCGI params. Core CGI values such as
# SCRIPT_FILENAME, CONTENT_LENGTH, HTTPS, and HTTP_PROXY are managed by
# Fluxheim and cannot be overridden here.
# APP_ENV = "production"
# PHP_VALUE = "memory_limit=256M"

[vhosts.php.fpm]
# Default: connect to an operator-managed external php-fpm pool.
# mode = "external"
# Use either a container/network endpoint:
tcp = "php-fpm:9000"
# Or list multiple TCP endpoints for simple safe-method failover:
# tcp_upstreams = ["php-fpm-a:9000", "php-fpm-b:9000"]
# Or a local Unix socket with hardened ownership/permissions:
# socket = "/run/php/php-fpm.sock"
# Optional FastCGI keep-connection pool. Leave disabled for the most
# conservative migration path; enable after validating your php-fpm pool.
# keepalive = true
# pool_max_idle = 8
# idle_timeout_secs = 60
# Optional stricter php-fpm I/O timeouts, bounded by php.request_timeout_secs.
# connect_timeout_secs = 5
# read_timeout_secs = 30
# write_timeout_secs = 30
# Conservative retry policy for connection failures before php-fpm returns data.
# max_retries = 1
# retry_timeout_secs = 5
# retry_methods = ["GET", "HEAD", "OPTIONS"]
# retry_invalid_response = false
# retry_statuses = [500, 502, 503, 504]
#
# Or let Fluxheim start a private php-fpm pool while still using the same
# FastCGI/php-fpm request path. Do not set tcp, tcp_upstreams, or socket when
# mode = "managed".
# mode = "managed"
# php_fpm_binary = "/usr/sbin/php-fpm"
# socket_dir = "/run/fluxheim/php"
# workers = 4
# max_requests_per_worker = 1000
# process_manager = "static" # "static", "dynamic", or "ondemand"
# listen_backlog = 128
# Optional socket ownership controls for managed pools that drop workers to a
# different user/group. Defaults to a private 0600 socket for rootless/same-user
# deployments. Use 0660 only with an intentional shared service group.
# listen_owner = "fluxheim"
# listen_group = "php"
# listen_mode = "0660" # "0600" or "0660"
#
# Dynamic pool sizing:
# start_servers = 2
# min_spare_servers = 1
# max_spare_servers = 4
# max_spawn_rate = 8
#
# Ondemand pool sizing:
# process_idle_timeout_secs = 10
#
# Request lifecycle and diagnostics:
# request_terminate_timeout_secs = 30
# request_terminate_timeout_track_finished = false
# request_slowlog_timeout_secs = 5
# request_slowlog_trace_depth = 20
# clear_env = true
# catch_workers_output = true
# decorate_workers_output = true
# session_save_path = "/run/fluxheim/php/session"
# upload_tmp_dir = "/run/fluxheim/php/upload"
#
# Optional, configure both together when php-fpm starts as root and should drop
# worker privileges. Pair with listen_owner/listen_group/listen_mode above when
# Fluxheim itself is not running as the same user.
# user = "fluxheim"
# group = "fluxheim"
# Generated socket/config/pid/log files live under socket_dir. Forced process
# termination can leave stale files; remove them only while Fluxheim is stopped.

# Optional shared cache migration preset for WordPress sites. Enable only for
# routes where public-page caching is wanted; logged-in and query-string
# requests bypass lookup and storage through the preset.
# [vhosts.cache]
# preset = "wordpress"
# enabled = true
# status_ttls = { "200" = 300, "301" = 300, "302" = 300, "404" = 60 }
# stale_if_error_secs = 60

[vhosts.web]
root = "/srv/sites/php.example.test/public"
index_files = ["index.html", "index.php"]
deny_dotfiles = true