php5-fpm pools (shared-hosting model)

[andremacola]

Is it possible to determine/create php pools for each site? I would like to run every site with custom users and groups and not all with www-data

like: ee site create mysite.com --wp --umyuserr:gmygroup

Then ee create the php-fpm .conf file and the user:group.

I'm doing this manually every time.

[MiteshShah]

@andremacola

This is already in our roadmap to provide a shared hosting type environments.
So every site has there own php5-fpm pool and mysql user.

[rahul286]

@andremacola

We plan to give separate pools per user only. They will use common group www-data.

For different FPM pool groups to work, we will need to add nginx user www-data to every group.

May I know use case for different groups?

[Mermouy]

Can you explain me why www-data group?
I use differents pools per user which work as mermouy:mermouy
This way nothing to do with users uploads (they are already with right proprietary...)
Wha is the interest of dealing with www-data group?
Thanks!

[rahul286]

Packages we use uses default user and group as www-data

In our shared hosting model, we plan to create 1 PHP-FPM pool per linux user but all these pools will have group www-data and group permission will be read-only.

So nginx can access any files.

For a site to work, it's scripts must be readable by nginx. We are planning to use group permission for this.

Implementation details are not final yet.

[Mermouy]

Hmm that doesn't fit this way... If the objective is to make kind of multi-users hosting, we need users be able to upload to their webspace, I mean, files they'll upload come with user:user.
What's the plan then? Creating special sshusers?
Forgive my ignorance...

[andremacola]

I just tested with two ways. Php pool with user:user user:www-data and the user can access sftponly, I disabled the shell access. And just for testing I added a ftp server. All works fine, and the wordpress with nginx upload without problem.

Forgive my ignorance too, I'm not a pro just a enthusiastic, but I think is not safe let All users with read permissions to www-data when you are in a shared space.

Almost forget. I changed the php pool to use socket instead

[rahul286]

Let me summarize my understanding/assumptions first:

Assume there will be 2 users: steve and bill on a linux server with homes at /home/steve' and/home/bill` respectively.

With new conventions...
steve's websites will be under: /home/steve/www and
bill's websites will be under: /home/bill/www

All files under a /home/USER will be owned by users but for files under /home/USER/www group will be www-data. Also permissions will be 755 i.e. group user can read files.

Now, nginx runs with group www-data and can read files of both steve and bill because of group read permission.

steve and bill are NOT added into www-data group so they cannot read each others files via group permission.

Problems

1. First, I am not sure if my assumptions/understanding is correct/full-proof/secure.
2. I also think that nginx group read permission is needed for files that nginx wish to read directly e.g. images, css/js i.e. static files.
3. For .php file requests, nginx simply gets fpm involved which does actual reading. If this is the case, then FPM pools also need to have common www-data group.
4. I am yet to find a way to change group for all newly created files under /home/USER/www group. I think @MiteshShah might be able to solve this.
5. If read permissions are only needed, why not use other's read permission. (Hint: last 5 in 755).

Overall, we need to do a lot of homework before we can jump to shared-hosting implementation. That is why this feature is pushed down on roadmap even it is high in demand.

If anybody has better understanding of this stuff, I will be happy to follow their ideas/suggestions.

[rahul286]

@Wayne13 how do u make sure this command "automatically" takes care of new files created/uploaded by WordPress?

[Mermouy]

Exactly what I meant:
Creating newuser with minimal chrooted shell(just basic commands rm, ls, cd etc...) and their /home/newuser/public pointing to their corresponding domain name.
Newuser upload files: these files & folders will naturally belong to newuser: newuser, I really don't see the problem to run php-fpm pool under newuser:newuser? That way files & folders uploaded "from" user as files & folders uploaded from nginx will always be under newuser:newuser?
Is there something i've missed about this www-data group? Why should it be required?
I don't know if that solution could be a security risk?

[Mermouy]

Sure! But if fpm pool running as user:user it have all access to any files...

[rahul286]

@Wayne13 Keeping this engine "easy" will remain first priority.

Mail Server, Shared-hosting and other "features" will be installed on-demand.

For example: we have no plan to install mail-server when running ee system install.

For mail-server setup, it might be ee system install mail or ee mail install or ee mail setup

With this project, we are running an experiment. We document upcoming commands in advance and see if documentation is friendly and intuitive. First, we try to simplify documentation and then when it's almost final, we code commands which can meet docs.

Here is an example for upcoming release - https://rtcamp.com/easyengine/docs/commands/debug/

[rahul286]

Also a note about shared hosting model.

We plan to use linux-users as a shared-user. No FTP-only user that cPanel-style system offers but real-linux users. To allow these users to create sites, we are planning to make some commands e.g. ee site create available without root/sudo.

Based on who is creating a site, appropriate php-fpm pool user/group will be set for that site. Also folder location and other data relevant to the site.

[bazaglia]

@rahul286 This would be fantastic! Here's what I do in a server where I run two websites:

– In php-fpm.d, I create different pools to different websites. This way I can tweak values to each website (and also limit PHP max processes for each website to avoid a heavy website to end up using all system resources).

– In nginx.conf, there's a "include" to conf.d directory, where all the .conf files are store. I create different .conf files for each website. The "upstream php" is not in the nginx.conf as it's different for each website. So it's in the top of each website like example.com. I'll give you an example:

#This is the website example.com
upstream php {
        #this should match value of "listen" directive in php-fpm pool.
        #I'm using different sock's for different domains.
    server unix:/tmp/fpm.example.com.sock;
}
server {
    server_name example.com;
    #Rest of server block code goes here!
}

– I set disable_funcions in php.ini to limit some PHP commands like exec, shell_exec, etc (this is to garantee an user will never run system commands or use PHP to access other users folders).

Your idea to allow users to create websites through a command like ee site create is great. I was just thinking:

– Are you going to lock users to their website directories like what is explained here? [link] This is good, but I thought I could help creating a user web-based interface so that the user can see the disk usage, CPU usage, bandwidth usage, etc – this would be even easier to the final user. The only issue is: do you see a way of creating a panel like this without using PHP (as some important PHP functions to retrieve this kind of data might be disable in php.ini in order to secure the server)?