# {{ ansible_managed }} # # This service can be enabled for each user. # It uses a single php-fpm configuration file. # User-specific settings can be overridden via environment variables (see "FPM_SOCKET_PATH" below). [Unit] Description=The PHP FastCGI Process Manager for %I Documentation=man:php-fpm{{ php_version.stdout }}(8) After=network.target Requires=php-fpm@%i.socket StartLimitInterval=10 StartLimitBurst=10 [Service] User={{ php_fpm_user | default('%i') }} Group={{ php_fpm_group | default('%i') }} Type=notify Environment="FPM_SOCKETS=/run/php/php-fpm-%i.sock=3" Environment="FPM_ERROR_LOG={{ php_fpm_log_dir }}/{{ php_fpm_log_file | default('%i.log') }}" # this variable is used in the pool configuration file Environment="FPM_SOCKET_PATH=/run/php/php-fpm-%i.sock" ExecStart=/usr/sbin/php-fpm{{ php_version.stdout }} --nodaemonize --fpm-config {{ php_fpm_pool_config_file }} ExecReload=/bin/kill -USR2 $MAINPID KillMode=process Restart=always RestartSec=15s # Hardening # https://github.com/php/php-src/blob/master/sapi/fpm/php-fpm.service.in PrivateDevices=true PrivateTmp=true ProtectClock=true ProtectControlGroups=true ProtectKernelModules=true ProtectKernelTunables=true ProtectSystem=full RestrictRealtime=true RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK AF_UNIX RestrictNamespaces=true SystemCallArchitectures=native SystemCallErrorNumber=EPERM SystemCallFilter=@system-service {% if php_fpm_cpu_quota is defined %} # Resources CPUQuota={{ php_fpm_cpu_quota }} {% endif %} {% if php_fpm_memory_high is defined %} MemoryHigh={{ php_fpm_memory_high }} {% endif %} {% if php_fpm_memory_max is defined %} MemoryMax={{ php_fpm_memory_max }} {% endif %} [Install] WantedBy=multi-user.target