Ansible Role: php-fpm

Install and configure php-fpm for lamp and lemp stack, add your own pools configurations, and customize all the php.ini config from yaml variables

Bonus : add extensions for blackfire and newrelic APM

This role is a part of my OPS project, follow this link to see it in action. OPS provides a lot of stuff, like a vagrant file for development VMs, playbooks for roles orchestration, inventory files, examples for roles configuration, ansible configuration file, and many more.

Compatibility

Tested and approved on :

• Debian jessie (8+)
• Ubuntu Trusty (14.04 LTS)
• Ubuntu Xenial (16.04 LTS)

Role Variables

# use custom repositoryphp_use_custom_repository: yesphp_custom_repositories_key_url: https://www.dotdeb.org/dotdeb.gpgphp_custom_repositories:
- deb http://packages.dotdeb.org jessie all
- deb-src http://packages.dotdeb.org jessie all# Use a ppa REPOphp_custom_repositories:
- ppa:ondrej/php# Or Choose a version and set php_version variables# Choose packages to installphp_version: 7.2php_packages:
- php{{php_version}}-fpm
- php{{php_version}}-cli
- php{{php_version}}-common
- php{{php_version}}-dev
- php{{php_version}}-opcache
- php{{php_version}}-mbstring
- php{{php_version}}-memcached
- php{{php_version}}-mysql
- php{{php_version}}-redis
- php{{php_version}}-curl
- php{{php_version}}-json
- php{{php_version}}-xsl
- php{{php_version}}-xml
- php{{php_version}}-mongodb
- php{{php_version}}-imagick# Define your own poolsphp_pools:
www:
user: "www-data"group: "www-data"listen: "/var/run/php-fpm.sock"listen.owner: "www-data"listen.group: "www-data"listen.allowed_clients: "127.0.0.1"pm: "dynamic"pm.max_children: "5"pm.start_servers: "2"pm.min_spare_servers: "1"pm.max_spare_servers: "3"pm.process_idle_timeout: "30s"pm.max_requests: "500"# Custom php.ini configsphp_ini_custom:
opcache:
opcache.blacklist_filename: "{{ php_fpm_root_dir }}/fpm/opcache.blacklist"newrelic:
newrelic.enabled: "true"newrelic.license: "REPLACE IT WITH YOUR KEY"newrelic.logfile: "/var/log/newrelic/php_agent.log"newrelic.appname: "{{ ansible_hostname|default('VM Test') }}"newrelic.daemon.logfile: "/var/log/newrelic/newrelic-daemon.log"newrelic.daemon.port: "/tmp/.newrelic.sock"newrelic.daemon.location: "/usr/bin/newrelic-daemon"newrelic.daemon.collector_host: "collector.newrelic.com"newrelic.analytics_events.enabled: "true"# Opcache blacklistphp_opcache_blacklist: []# Php FPM basic configurationphp_fpm_root_dir: /etc/php/7.0php_fpm_daemon: php7.0-fpmphp_fpm_pid: /run/php-fpm.pidphp_fpm_error_log: /var/log/php-fpm.logphp_fpm_syslog_facility: daemonphp_fpm_syslog_ident: php-fpmphp_fpm_log_level: noticephp_fpm_emergency_restart_threshold: 0php_fpm_emergency_restart_interval: 0php_fpm_process_control_timeout: 0php_fpm_process_max: 128php_fpm_process_priority: -19php_fpm_daemonize: yesphp_fpm_rlimit_files: 1024php_fpm_rlimit_core: 0php_fpm_events_mechanism: epollphp_fpm_systemd_interval: 10php_fpm_pools_include: "{{ php_fpm_root_dir }}/fpm/pool.d/*.conf"# Enable extrasphp_blackfire_enabled: truephp_composer_enabled: truephp_newrelic_enabled: true# BLackfire.io configurationphp_blackfire_daemon: blackfire-agentphp_blackfire_test_mode: falsephp_blackfire_key_url: https://packagecloud.io/gpg.keyphp_blackfire_package_url: http://packages.blackfire.io/debianphp_blackfire_directory: /etc/blackfirephp_blackfire_packages:
- blackfire-agent
- blackfire-php# Blackfire agent configurationphp_blackfire_cert: # Sets the PEM encoded certicatesphp_blackfire_collector: https://blackfire.io # Sets the URL of Blackfire's data collectorphp_blackfire_http_proxy: # Sets the http proxy to usephp_blackfire_https_proxy: # Sets the https proxy to usephp_blackfire_log_file: stderr # Sets the path of the log file. Use stderr to log to stderrphp_blackfire_log_level: 1# log verbosity level (4: debug, 3: info, 2: warning, 1: error)php_blackfire_server_id: "REPLACE_IT_WITH_YOUR_KEY"# Sets the server id used to authenticate with Blackfire APIphp_blackfire_server_token: "REPLACE_IT_WITH_YOUR_KEY"# Sets the server token used to authenticate with Blackfire API. It is unsafe to set this from the command linephp_blackfire_socket: "unix:///var/run/blackfire/agent.sock"# Sets the socket the agent should read traces from. Possible value can be a unix socket or a TCP addressphp_blackfire_spec: # Sets the path to the json specifications file# Composer configurationphp_composer_download_url: https://getcomposer.org/installerphp_composer_path: /usr/local/bin/composerphp_composer_version: ''# Newrelic APM configurationphp_newrelic_apt_key_url: https://download.newrelic.com/548C16BF.gpgphp_newrelic_apt_url: http://apt.newrelic.com/debian/php_newrelic_packages:
- newrelic-php5# Configure php session on memcache wit MCrouter# default set to falsephp_memcache_mcrouter_enabled: true

Example Playbook

- hosts: serversroles:
- { role: jebovic.php }

Example : config

# Define your own poolsphp_pools:
my_pool:
user: "me"group: "me"listen: "/var/run/php-fpm.sock"listen.owner: "www-data"listen.group: "www-data"listen.allowed_clients: "127.0.0.1"pm: "dynamic"pm.max_children: "10"pm.start_servers: "4"pm.min_spare_servers: "2"pm.max_spare_servers: "6"pm.process_idle_timeout: "300s"pm.max_requests: "300"# Custom php config, link it with my other roles, mailhog (mail catcher), memcached, newrelic, blackfire...php_ini_custom:
Session:
session.save_handler: memcachedsession.save_path: "{{ memcache_listen_address }}:{{ memcache_port }}"mail function:
sendmail_from: me@example.comsendmail_path: "{{ mailhog_mhsendmail_path }}"opcache:
opcache.enable_cli: Offopcache.blacklist_filename: /etc/php5/fpm/opcache.blacklistnewrelic:
newrelic.enabled: "true"newrelic.license: "{{ newrelic_license }}"newrelic.logfile: "/var/log/newrelic/php_agent.log"newrelic.appname: "{{ ansible_hostname|default('VM Test') }}"newrelic.daemon.logfile: "/var/log/newrelic/newrelic-daemon.log"newrelic.daemon.port: "/tmp/.newrelic.sock"newrelic.daemon.location: "/usr/bin/newrelic-daemon"newrelic.daemon.collector_host: "collector.newrelic.com"newrelic.analytics_events.enabled: "true"

Example2 : use ubuntu PPA and Memcache MCroute

php_blackfire_enabled: falsephp_composer_enabled: falsephp_newrelic_enabled: falsephp_memcache_mcrouter_enabled: truephp_use_custom_repository: yesphp_version: 7.2php_custom_repositories:
- ppa:ondrej/phpphp_packages:
- php{{php_version}}-fpm
- php{{php_version}}-cli
- php{{php_version}}-common
- php{{php_version}}-json
- php{{php_version}}-mbstring
- php{{php_version}}-mysql
- php{{php_version}}-opcache
- php{{php_version}}-readline
- php{{php_version}}-xmlphp_pools:
www:
user: "www-data"group: "www-data"listen: "/run/php/php{{php_version}}-fpm.sock"listen.owner: "www-data"listen.group: "www-data"listen.allowed_clients: "127.0.0.1"pm: "dynamic"pm.max_children: "10"pm.start_servers: "4"pm.min_spare_servers: "2"pm.max_spare_servers: "6"pm.process_idle_timeout: "300s"pm.max_requests: "300"php_ini_custom:
Session:
session.save_handler: memcachedsession.save_path: "{{ memcache_listen_address }}:{{ memcache_port }}"

Tags

• php_blackfire_config : only configure blackfire and restart php and blackfire services
• php_config : only update config and restart service
• php_composer : only install coposer
• php_blackfire : only install, configure and start blackfire service
• php_newrelic : only add newrelic apm plugin for php

Testing

---

Tests are performed using Molecule.

Install Molecule or use docker-compose run --rm molecule to run a local Docker container, based on the enterclousuite/molecule project, from where you can use molecule.

1. Run molecule create to start the target Docker container on your local engine.
2. Use molecule login to log in to the running container.
3. Edit the role files.
4. Add other required roles (external) in the molecule/default/requirements.yml file.
5. Edit the molecule/default/playbook.yml.
6. Define infra tests under the molecule/default/tests folder using the goos verifier.
7. When ready, use molecule converge to run the Ansible Playbook and molecule verify to execute the test suite.
   Note that the converge process starts performing a syntax check of the role.
   Destroy the Docker container with the command molecule destroy.

To run all the steps with just one command, run molecule test.

In order to run the role targeting a VM, use the playbook_deploy.yml file for example with the following command: ansible-playbook ansible-prometheus/molecule/default/playbook_deploy.yml -i VM_IP_OR_FQDN, -u ubuntu --private-key private.pem.

Fast Test

---

docker-compose run --rm molecule molecule create molecule converge

License

MIT

Author Information

Jérémy Baumgarth https://github.com/jebovic