php processes stil running under www-data after configuring php-fpm

Question

Would appreciate any help, I am at my wits end.

Objective: Configure php-fpm so I can have multiple websites on the same server that do not have write access to one another, and have php-fpm run as their respective user, not www-data

Server info:

Ubuntu 20.04
Digital Ocean
PHP 7.4.18
Apache/2.4.41
Configuration File (php.ini) Path /etc/php/7.4/fpm

This is the error that generates when I disable the www.conf file:

[Thu May 20 20:49:03.608217 2021] [proxy:error] [pid 79221] (2)No such file or directory: AH02454: FCGI: attempt to connect to Unix domain socket /var/run/php/php7.4-fpm.sock (*) failed
[Thu May 20 20:49:03.608274 2021] [proxy_fcgi:error] [pid 79221] [client 192.88.134.39:42844] AH01079: failed to make connection to backend: httpd-UDS

I have gone through the configuration guides and updated all .conf files. I do see that there are php-fpm processes running for the users that I have specified:

systemctl status php7.4-fpm
     CGroup: /system.slice/php7.4-fpm.service
             ├─79327 php-fpm: master process (/etc/php/7.4/fpm/php-fpm.conf)
             ├─79337 php-fpm: pool user1
             ├─79338 php-fpm: pool user1
             ├─79339 php-fpm: pool user2
             ├─79340 php-fpm: pool user2
             ├─79341 php-fpm: pool www
             └─79342 php-fpm: pool www

However, when I run phpinfo on the website for user1, I see the following:

$_SERVER['USER'] www-data
$_SERVER['HOME'] /var/www

The user should be user1, and the home directory is actually /home/user1/website1.com

I've adjusted all the .conf files here according to the php-fpm tutorials:

/etc/php/7.4/fpm/pool.d
/etc/apache2/sites-available
/usr/lib/tmpfiles.d

Examples:

/etc/php/7.4/fpm/pool.d/user1.com.conf

; pool name ('www' here)
[user1]
user = user1
group = user1
listen = /var/lib/dpkg/alternatives/php-fpm-user1.sock

----

/etc/apache2/sites-available/user1.com.conf

<VirtualHost *:80>
    ServerAdmin webmaster@localhost
    ServerName user1.com
    ServerAlias www.user1.com
    DocumentRoot /home/user1/user1.com
    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined

<Directory /home/user1/user1.com/>
Options FollowSymLinks
AllowOverride All
Require all granted
</Directory>

<FilesMatch \.php$>
SetHandler "proxy:unix:/var/run/php/php7.4-fpm.sock|fcgi://localhost"
</FilesMatch>

</VirtualHost>

----

/usr/lib/tmpfiles.d/php7.4/php7.4-fpm.conf

#Type Path                  Mode UID      GID      Age Argument
    d /run/php              0755 user1 user1 -   -

The .sock files are correctly generating here:

/var/lib/dpkg/alternatives/php-fpm-user1.sock
/var/lib/dpkg/alternatives/php-fpm-user2.sock

And phpinfo correctly shows this:

Server API FPM/FastCGI

But when I rename/disable this file, the server throws a 503 Service Unavailable I assume because the websites are still running as www-data:

/etc/php/7.4/fpm/pool.d/www.conf

What am I missing, thank you.

Edit: I solved the problem by blowing the entire server away and starting from scratch using nginx instead of apache and following this guide:

https://www.vultr.com/docs/use-php-fpm-pools-to-secure-multiple-web-sites

And it works like a charm. What a relief.

Answer 1

I haven't fully investigated the issue here, but see no one has answered in 3 days, so offering an observation:

I would expect Apache to communicate to php via the specific user sock. Specifically, expect this line:

SetHandler "proxy:unix:/var/run/php/php7.4-fpm.sock|fcgi://localhost"

to be:

SetHandler "proxy:unix:/var/lib/dpkg/alternatives/php-fpm-user1.sock|fcgi://localhost"