Would appreciate any help, I am at my wits end.
Objective: Configure php-fpm so I can have multiple websites on the same server that do not have write access to one another, and have php-fpm run as their respective user, not www-data
Server info:
Ubuntu 20.04
Digital Ocean
PHP 7.4.18
Apache/2.4.41
Configuration File (php.ini) Path /etc/php/7.4/fpm
This is the error that generates when I disable the www.conf file:
[Thu May 20 20:49:03.608217 2021] [proxy:error] [pid 79221] (2)No such file or directory: AH02454: FCGI: attempt to connect to Unix domain socket /var/run/php/php7.4-fpm.sock (*) failed
[Thu May 20 20:49:03.608274 2021] [proxy_fcgi:error] [pid 79221] [client 192.88.134.39:42844] AH01079: failed to make connection to backend: httpd-UDS
I have gone through the configuration guides and updated all .conf files. I do see that there are php-fpm processes running for the users that I have specified:
systemctl status php7.4-fpm
CGroup: /system.slice/php7.4-fpm.service
├─79327 php-fpm: master process (/etc/php/7.4/fpm/php-fpm.conf)
├─79337 php-fpm: pool user1
├─79338 php-fpm: pool user1
├─79339 php-fpm: pool user2
├─79340 php-fpm: pool user2
├─79341 php-fpm: pool www
└─79342 php-fpm: pool www
However, when I run phpinfo on the website for user1, I see the following:
$_SERVER['USER'] www-data
$_SERVER['HOME'] /var/www
The user should be user1, and the home directory is actually /home/user1/website1.com
I've adjusted all the .conf files here according to the php-fpm tutorials:
/etc/php/7.4/fpm/pool.d
/etc/apache2/sites-available
/usr/lib/tmpfiles.d
Examples:
/etc/php/7.4/fpm/pool.d/user1.com.conf
; pool name ('www' here)
[user1]
user = user1
group = user1
listen = /var/lib/dpkg/alternatives/php-fpm-user1.sock
----
/etc/apache2/sites-available/user1.com.conf
<VirtualHost *:80>
ServerAdmin webmaster@localhost
ServerName user1.com
ServerAlias www.user1.com
DocumentRoot /home/user1/user1.com
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
<Directory /home/user1/user1.com/>
Options FollowSymLinks
AllowOverride All
Require all granted
</Directory>
<FilesMatch \.php$>
SetHandler "proxy:unix:/var/run/php/php7.4-fpm.sock|fcgi://localhost"
</FilesMatch>
</VirtualHost>
----
/usr/lib/tmpfiles.d/php7.4/php7.4-fpm.conf
#Type Path Mode UID GID Age Argument
d /run/php 0755 user1 user1 - -
The .sock files are correctly generating here:
/var/lib/dpkg/alternatives/php-fpm-user1.sock
/var/lib/dpkg/alternatives/php-fpm-user2.sock
And phpinfo correctly shows this:
Server API FPM/FastCGI
But when I rename/disable this file, the server throws a 503 Service Unavailable I assume because the websites are still running as www-data:
/etc/php/7.4/fpm/pool.d/www.conf
What am I missing, thank you.
Edit: I solved the problem by blowing the entire server away and starting from scratch using nginx instead of apache and following this guide:
https://www.vultr.com/docs/use-php-fpm-pools-to-secure-multiple-web-sites
And it works like a charm. What a relief.