$OpenBSD: README-main,v 1.9 2019/01/29 20:25:15 sthen Exp $

+-----------------------------------------------------------------------
| Running  on OpenBSD
+-----------------------------------------------------------------------

Connecting your web server software to php
==========================================
Web server programs such as httpd(8), nginx and Apache listen for
network requests and decide whether to respond themselves (as is the
case with simple "static" files) or pass the request on to other
software for handling. The web server must be configured to handle
this - different methods are used depending on the server software.

FastCGI: httpd(8), nginx, lighttpd, etc
---------------------------------------
Most modern web servers support FastCGI which is a simple method of
interfacing to many kinds of application server. This is usually the
preferred method of passing requests to php, and is the only method
possible for many servers such as httpd(8), nginx and lighttpd.

The main OpenBSD php packages include php-fpm, FastCGI Process Manager.
This manages pools of FastCGI processes: starts/restarts them and
maintains a minimum and maximum number of spare processes as
configured. You can use rcctl(8) to enable php-fpm at boot,
and start it at runtime:

    rcctl enable php72_fpm
    rcctl start php72_fpm

php-fpm has its own configuration file, /etc/php-fpm.conf.
This controls how the php processes are started. The default settings
are suitable for many standard cases, but can be changed to provide
greater control for sites handling high loads or to provide
separation between different php applications by running them
under different uids or in individual chroot(2) jails.

Your HTTP server needs to be configured to pass requests for PHP
resources to php-fpm. See the documentation and sample configuration.
For nginx, an example is provided in /usr/local/share/nginx/nginx.conf.
For OpenBSD base's httpd(8) you can use a configuration fragment like:

	location "*.php" {
		fastcgi socket "/run/php-fpm.sock"
	}

Apache httpd
------------
For Apache, the most common option is with the mod_php Apache module
provided in the php-apache package. This is loaded directly as part of
the web server process. Configuration is fairly simple, but in this
case the operating system can't provide memory protection between
the two; therefore bugs in php can potentially do more damage.

Another option is to use FastCGI via php-fpm as in the above section;
you can use mod_proxy_fcgi to interface it with Apache.

If you wish to use the Apache module, make sure the php-apache-7.2
package is installed, then enable it by creating a symbolic link:

    # ln -sf /var/www/conf/modules.sample/php-7.2.conf \
	/var/www/conf/modules/php.conf

To disable:

    # rm -f /var/www/conf/modules/php.conf

After making either of these changes, restart Apache.

php configuration
=================
The recommended php configuration has been installed to:
    /etc/php-7.2.ini.

Modify this as required for your use.

Extension modules
=================
Many language features in php are provided by extensions, which come
in several classes.

- some extensions are included in the main PHP package and are always
enabled; they don't need to be installed or enabled separately.

- opcache is in the main package but must be configured.

- some 'core' extensions with extra dependencies are packaged separately
(e.g. php-pdo_mysql, php-ldap, php-soap, and others) and can be installed
with pkg_add(1).

- various useful third-party extensions from the PECL repository have
also been packaged. Examples include pecl-memcache (for use with
sysutils/memcached), pecl-imagick (image manipulation using ImageMagick),
pecl-libsodium (a wrapper for the libsodium cryptographic library), etc.

For all extensions packaged separately (and for opcache), you will find a
file named /etc/php-7.2.sample/(MODULE_NAME).ini. To enable it,
add a symlink into /etc/php-7.2 and restart:

    ln -sf ../php-7.2.sample/MODULE_NAME.ini /etc/php-7.2/

To disable, remove the symlink from /etc/php-7.2 and restart:

    rm /etc/php-7.2/MODULE_NAME.ini

If you have installed a number of extensions and wish to enable them all,
you can use these shell commands:

    # cd /etc/php-7.2.sample
    # for i in *; do ln -sf ../php-7.2.sample/$i ../php-7.2/; done

After enabling or disabling extensions (or otherwise modifying php's
configuration), use rcctl(8) to restart php72_fpm or Apache.

PHP's OpenSSL functions
=======================
The chroot jail commonly used with PHP on OpenBSD means that only files
inside /var/www can be used. Functions for making TLS connections usually
need access to CA certificates, and key generation functions may need
access to configuration files.

To use these, copy the relevant files into the /var/www jail:

    # mkdir -p /var/www/etc/ssl
    # install -m 444 -o root -g bin /etc/ssl/cert.pem /etc/ssl/openssl.cnf \
          /var/www/etc/ssl/

As these files are updated from time to time, you might like to add
the above "install" line to /etc/rc.local.
