Securing PHP Execution: Expert Setup of PHP-FPM with NGINX

PHP-FPM is a process manager that is necessary for handling web requests. This approach is significantly faster compared to traditional CGI methods, such as mod_php or SUPHP. The major benefit of this method is that it needs less CPU and memory.  

How PHP-FPM Works Behind the Scenes

To get a better understanding of how everything works, let’s review behind the scenes. Here are the major steps of how everything functions:

1. Handling of request. When the request from a PHP script is received by the server, it is passed via FastCGI to PHP-FPM.
2. Process management. After the request is received, PHP-FPM functions by choosing the available process from the pool to deal with the request. In case there is no available process, then the new one can be created.
3. It is possible to manage various types of processes, such as master and worker processes. The master process is needed for listening for the current requests and dividing them to the available worker processes. The worker process is needed for the execution of the PHP scripts. They can function in various modes such as static, dynamic, and on-demand.
4. Execution. When the request reaches the worker process, the PHP script is executed, and there is an output to the server.
5. Recycling of the process. The worker processes can be recycled after a specific number of requests. This is necessary for the prevention of memory leaks

Requirements Before Configuring PHP-FPM with NGINX

-        SSH session in your system can be opened with the sudo or root user.

-        Installation of PHP and NGINX on your system. If not, there are various detailed instructions about the installation process.

Step-by-Step Guide to Setting Up PHP-FPM with NGINX

-        Installation of PHP-FPM

-        Setting Up the PHP-FPM Pool

-        Configuring NGINX to Use PHP-FPM

-        Verifying the PHP-FPM and NGINX Integration

Step 1: Installing PHP-FPM on Your Server

The PHP script could not run on Nginx because there should be PHP-FPM for effective management. PHP-FPM functions outside NGINX by creating its own process. When the user tries to reach a PHP page, the server passes this request to PHP-FPM.

The installation process on Ubuntu depends on its version and PHP. Once you have checked whether you have the latest PHP version, you can use he following command for the FPM installation:

sudo apt install -y php8.2-fpm

After the usage of the above command, the server will start automatically after the installation. For the verification, use the next command:

sudo systemctl status php8.2-fpm

Step 2: Setting Up the PHP-FPM Pool

The default pool can be found in /etc/php/8.2/fpm/pool.d/ folder, which can be customized to suit your requirements. However, a more common approach is to create separate pools for better level of control for every FPM process. Each pool will have its master process, and every PHP application can be configured with its own cache. This is a rather convenient approach because the pools will be separate, and any changes to one pool will not impact the others.

Now, let's create an FPM pool for running the app via a separate user. To begin with, let’s create a new user:

# Create a system group named wordpress

sudo groupadd --system wordpress

# Create a system user named wordpress, assign it to the wordpress group, and set no login shell

sudo useradd --system --gid wordpress --shell /usr/sbin/nologin --home-dir /var/www/wordpress wordpress

The next step is navigating to the configuration directory and creating a config file via a text editor:

# cd /etc/php/8.2/fpm/pool.d

# vi wordpress_pool.conf

[wordpress_site]

user = wordpress

group = wordpress

listen = /run/php/php8.2-fpm-wordpress.sock

listen.owner = www-data

listen.group = www-data

php_admin_value[disable_functions] = exec,passthru,shell_exec,system

php_admin_flag[allow_url_fopen] = off

pm = dynamic

pm.max_children = 75

pm.start_servers = 10

pm.min_spare_servers = 5

pm.max_spare_servers = 20

pm.process_idle_timeout = 10s

Let’s describe some of the above-mentioned values:

-        [wordpress_site]: there should be mentioned unique name for the pool.

-        User/group: mention under which the pool will run.

-        Listen: socket file name.

-        Listen.owner/group: must be the same as the user/group of NGINX.

-        Admin_value/flag: allows the setting of the custom values and Boolean flags.

-        pm: when selecting Dynamic, it means that the number of child processes is chosen based on the next directives.

-        max_children: the max that can be alive at the same time.

-        start_servers: the number of children created on startup.

-         max/min_spare_servers: the max and min number of children in the idle state.

-        idle_timeout: max number of idle server processes.

Also, it is possible to choose static and on-demand settings. The static option will have a fixed number of processes, and on demand, children will be forked for the new requests.

Once you have finished with the config file, restart the fpm service:

sudo systemctl restart php8.2-fpm

Step 3: Configuring NGINX to Use PHP-FPM

The next step is the creation of the NGINX server block. For this process, it is necessary to edit the NGINX config file and add the path of the pool’s socket file via fastcgi_pass as follows:

location ~ \.php$ {

    fastcgi_split_path_info ^(.+\.php)(/.+)$;

    fastcgi_pass unix:/run/php/php8.2-fpm-wordpress.sock;

    fastcgi_index index.php;

    include fastcgi.conf;

}

After that, restart NGINX:

sudo nginx -t

sudo systemctl reload nginx

Step 4: Verifying the PHP-FPM and NGINX Integration

To check whether the config file is really using the new pool, it is needed to create a php info file in the root.

# Navigate to the WordPress directory

cd /var/www/html/wordpress

# Create a PHP info file using safer quoting

echo '<?php phpinfo(); ?>' | sudo tee info.php > /dev/null

Once the info page is created, check the values, and if they are the same as you have mentioned in the FPM config file, then everything functions as intended.

Common Questions and Troubleshooting

What is PHP-FPM and why pair it with NGINX?

PHP-FPM is a process manager that is necessary for the management of PHP processes. When paired with NGINX, then it can significantly improve the security, performance, and management of resources.

How can I link NGINX to PHP-FPM correctly?

For linking, it is necessary to configure NGINX to use PHP-FPM. This can be done by including fastcgi pass directive in the config file. This can be done as follows:

location ~ \.php$ {

fastcgi_split_path_info ^(.+\.php)(/.+)$;

fastcgi_pass unix:/run/php/php8.2-fpm-wordpress.sock;

fastcgi_index index.php;

include fastcgi.conf;

}

When should I use a socket vs. a port in PHP-FPM?

The usage of sockets gives a possibility of faster communication, because there is no need for network overhead. A port needs network communication, and such an approach is way slower. Nevertheless, the port usage can be used in such variants when FPM is functioning on various containers or servers.

What causes a 502 Bad Gateway error, and how do I fix it?

To fix this error, it is crucial to check whether FPM is functioning and whether TCP or socket is specified correctly in the NGINX config. Review FPM logs for any issues and change the pool setting accordingly. Also, check whether the NGINX configuration is passing PHP requests correctly.

To check logs, use the following command:

tail -f /var/log/php8.2-fpm.log

Can I run multiple PHP versions in one NGINX setup?

Sure, it can be done by configuring separate pools and specifying the right pool for each domain/subdomain. For instance, in case you are using PHP 7.4 and 7.2, you can do it. After that, specify the right pool for every domain. 

Where can I find the PHP-FPM pool settings?

Usually, the pool is located in /etc/php/8.2/fpm/pool.d/.

What are the best practices to boost PHP-FPM performance?

For better performance, you might need to adjust pm.min_spare_servers, pm.max_children and pm.start_servers in configuration. Also, you may try to enable pm.status_path and pm.max_requests.

Final Thoughts

In the article, we practically showed how to configure separate pools, install PHP-FPM, configure the NGINX server block, and connect to the service. By using this approach, it is possible to guarantee better scalability, security, and improve performance characteristics. Now, you know how to allocate server resources most optimally.