expose_php = Off
allow_url_fopen = Off
allow_url_include = Off
enable_dl = Off
short_open_tag = Off

; --- block user_ini ---
user_ini.filename =

; -- disable functions ---
disable_functions = exec,passthru,shell_exec,system,proc_open,popen,putenv,dl,show_source,highlight_file,symlink,readlink,link,proc_terminate,proc_get_status,pfsockopen,posix_kill,posix_setuid,posix_setgid,posix_setsid,posix_setpgid,posix_getgrnam,posix_getpgid,posix_getpwuid,posix_getpwnam,posix_getrlimit,posix_initgroups,posix_mkfifo,posix_mknod,posix_uname,register_tick_function,openlog,syslog,proc_close,proc_nice,diskfreespace,disk_free_space,disk_total_space,leak,pcntl_alarm,pcntl_async_signals,pcntl_exec,pcntl_fork,pcntl_get_last_error,pcntl_getcpuaffinity,pcntl_getpriority,pcntl_rfork,pcntl_setcpuaffinity,pcntl_setpriority,pcntl_signal,pcntl_signal_dispatch,pcntl_signal_get_handler,pcntl_sigprocmask,pcntl_sigtimedwait,pcntl_sigwaitinfo,pcntl_strerror,pcntl_unshare,pcntl_wait,pcntl_waitid,pcntl_waitpid,pcntl_wexitstatus,pcntl_wifexited,pcntl_wifsignaled,pcntl_wifstopped,pcntl_wstopsig,pcntl_wtermsig,sys_getloadavg

; not use for LSAPI
;pm.max_children = {{children}}

; --- memory limit ---
max_memory_limit = {{max_memory_limit}}

; --- default (redefined per vhost) ---
memory_limit = {{memory_limit}}
max_execution_time = {{max_execution_time}}
max_input_time = 30
max_input_vars = 1000
output_buffering = 4096

; --- uploads ---
post_max_size = {{post_max_size}}
upload_max_filesize = {{upload_max_filesize}}
max_file_uploads = 10

; --- log --- (to stderr k3s?)
display_errors = Off
log_errors = On
;error_log = /usr/local/lsws/conf/logs/php_errors.log
error_log = /proc/self/fd/2

; --- sessions (redefined per vhost) ---
session.save_path = "/tmp"
session.use_only_cookies = 1
session.cookie_httponly = 1
session.cookie_secure = 1
session.cookie_samesite = "Lax"

; --- OPcache ---
opcache.enable = 1
opcache.enable_cli = 0
opcache.memory_consumption = 256
opcache.interned_strings_buffer = 16
opcache.max_accelerated_files = 100000
opcache.validate_timestamps = 1
opcache.revalidate_freq = 2
opcache.jit = "disable"