Some more info:

Using prefork

Minimal Apache CGI config:

<Directory "/var/www/cgi-bin">
    AddHandler php-script .php
    Action php-script "/cgi-bin/php80-cgi"
</Directory>

Where /cgi-bin/php80-cgi is just:

#!/opt/remi/php80/root/usr/bin/php-cgi

Same issue with PHP 8.1

>We need CGI + Suexec for some folders for security purposes. While most of a virtual site can happily run using
> the normal module mode (i.e. apache2handler) we have a small number of scripts that must run under a specific
> username as they modify some data and we can't allow module scripts to make those changes.

Exactly what FPM is designed for.

See: https://blog.remirepo.net/post/2022/02/ … orkstation

Each vhost/directory/app can be served by a specific FPM pool running a specific  PHP version under a specific user, in a separate process.

Hi Remi,

OK I will try that (FPM + CGI)

The big issue for me is that we have a large (arguably "legacy") infrastructire using EL-7 + php_mod + and CGI. This design works up to PHP 7.4, but fails for PHP 8.0+.

I am not sure what changed in PHP 8+, but Apache + php_mod + CGI no longer works. I suspect this is more of a PHP issue, so perhaps I should move this discussion there, though I suspect as per your comments, moving to FPM is probably the best approach. Your comments have been very helpful.

The short term solution for me is to run EL-7, php_mod (7.4) and CGI (8.0+) which does work.

In the longer term it looks like as we move to EL-8 (we are also looking at going straight to EL-9) we should also move to FPM rather than module. Our plan for this migration was to take some years ( we still haven't totally finished EL-6 + PHP 5.6 migration - we still have one legacy VM for sites that wont work on EL-7 + PHP 7.4)

Another issue for us is we have hundreds of low use web sites (vhosts) per VM that work well with php_mod. We couldn't have a separate FPM or pool for each site as this would use too many resources. Even using CGI, the average number of processes per vhost is < 0.1.

However, we can probably separate out the php_mod to FPM migration and bring it forward to the existing EL-7 VMs and keep CGI for its special use.

I note tht cPanel uses FPM with a per vhost pool. However, our cPanel VMs need significantly more resources than our non cPanel VMs.

Cheers, Simon

> OK I will try that (FPM + CGI)

This should also work with mod_php (but I don't have working mod_php config to test this)

Biggest issues with mod_php:

- only works with apache (FPM can be used by httpd, nginx, lighttpd...)
- only works in prefork mode, apache perf is much better in "event" (threaded) mode, especially for static files
- only one module (single version)
- only one user (for all sites)

> The big issue for me is that we have a large (arguably "legacy") infrastructire using EL-7 + php_mod + and CGI. This design works up to PHP 7.4, but fails for PHP 8.0+.

I don't see how PHP version may change this, handler choice is done by HTTP.

So can only be related to httpd configuration
If you only use "CGI", ensure mod_php and php-fpm are not installed (which provides the php.conf with some handler config). Config files order may also change.

> Another issue for us is we have hundreds of low use web sites (vhosts) per VM that work well with php_mod. We couldn't have a separate FPM or pool for each site as this would use too many resources.

If hundreds of sites can run with mod_php, so with the same user, they can run with the same pool.
Multiple pools make sense only for

- multiple versions
- multiple users
- multiple configuration

Also notice the "ondemand" pool configuration, useful for small sites (while big sites will take benefit of "static")

OK, I found it.

We have been using an action definition named php-script.

<Directory /usr/local/httpd/test80/cgi-bin>
  Action php-script /cgi-bin/php80-cgi
  AddHandler php-script .php
</Directory>

It turns out this name is reserved from PHP 8.0+. In 7.4 the reserved name is php7-script.

If I change it to

<Directory /usr/local/httpd/test80/cgi-bin>
  Action my-php-script /cgi-bin/php80-cgi
  AddHandler my-php-script .php
</Directory>

it works fine.

The change is in sapi_apache2.c

(Almost) always something simple in the end!