PHP & web server tuning

The Drupal Operator supports:

  • Tuning PHP settings via a dedicated ConfigMap and variables.
  • Running Drupal with Apache (default image) or Nginx + PHP-FPM (when enabled).

This page focuses on how to adjust those settings using the variables from roles/setup/vars/main.yaml.

PHP configuration

PHP behavior is mainly controlled by:

  • drupal_php_memory_limit: 512M
  • drupal_php_post_max_size: 1024M
  • drupal_php_upload_max_filesize: 500M
  • drupal_php_ini_file: /usr/local/etc/php/conf.d/operator.ini
  • drupal_php_ini_subPath: operator.ini

The operator creates a ConfigMap for PHP configuration:

  • Name: <name>-drupal-php-ini
  • Data key: operator.ini
  • Content: drupal_php_ini

Default drupal_php_ini:

drupal_php_ini: |-
  post_max_size='{{ drupal_php_post_max_size }}';
  upload_max_filesize='{{ drupal_php_upload_max_filesize }}';
  memory_limit='{{ drupal_php_memory_limit }}';

This file is mounted into the PHP container at drupal_php_ini_file, overriding the relevant PHP directives.

Example: increase upload and memory limits

In your Drupal spec (or overrides), you might set:

spec:
  drupal_php_upload_max_filesize: 1024M
  drupal_php_post_max_size: 1024M
  drupal_php_memory_limit: 1024M
  change_cause: "larger-uploads-2025-01-01"

Adjusting change_cause ensures the operator’s checksum logic detects a change and triggers the necessary reconciliation and rollout.

PHP-FPM + Nginx mode

By default, the example Drupal image (drupal:11.2.8-php8.4-apache) uses Apache with mod_php. The operator also supports running PHP-FPM behind Nginx when you enable it.

Key flag:

  • php_fpm: false by default Set php_fpm: true to switch templates into PHP-FPM + Nginx mode.

When php_fpm: true, the operator:

  • Creates an Nginx ConfigMap:
  • Name: <name>-nginx-conf
  • Data key: nginx.conf

  • Content from nginx_conf

  • Creates a PHP-FPM ConfigMap:

  • Name: <name>-php-fpm-conf
  • Data key: zz-operator.conf
  • Content from php_fpm_conf

Nginx configuration

Important variables:

  • nginx_container_port: 8080
  • nginx_conf: a complete Nginx configuration, including:
  • HTTP server listening on port 8080
  • Gzip configuration
  • Cache headers
  • PHP forwarding to 127.0.0.1:9000 (PHP-FPM)

The default nginx_conf:

  • Enables gzip compression
  • Sets caching headers for static assets
  • Routes location ~ \.php$ through FastCGI to 127.0.0.1:9000
  • Sets client_max_body_size and various timeouts

You can customize this to:

  • Change timeouts (client_body_timeout, send_timeout, etc.)
  • Adjust gzip compression levels and types
  • Add more headers (security, caching, etc.)

PHP-FPM pool configuration

Controlled by php_fpm_conf, default:

[www]
php_admin_value[memory_limit] = "2048M"
pm = "ondemand"
pm.max_children = 100
pm.start_servers = 5
pm.min_spare_servers = 5
pm.max_spare_servers = 75
pm.max_requests = 500
pm.process_idle_timeout = "480s"
pm.status_path = "/status"

You can adjust:

  • pm (process manager, for example dynamic, ondemand)
  • pm.max_children (max PHP-FPM worker processes)
  • pm.max_requests (number of requests per process before recycle)
  • memory_limit for PHP in this pool

Changes here allow you to tune concurrency and memory usage under heavy load.

Security context hardening

The operator includes baseline security context settings for PHP-FPM and Apache containers (used in templates):

  • drupal_php_fpm_container_security_context:

    allowPrivilegeEscalation: false readOnlyRootFilesystem: true capabilities: drop: ["ALL"]

  • drupal_apache_container_security_context:

    allowPrivilegeEscalation: false

These settings:

  • Disallow privilege escalation
  • Drop all Linux capabilities
  • Optionally enforce a read-only root filesystem

You can extend these (for example, adding seccomp profiles) in your own overlays or templates, depending on your cluster’s security requirements.

When to use PHP-FPM + Nginx

Consider enabling php_fpm: true if:

  • You want more fine-grained HTTP and caching control via Nginx.
  • You need advanced TLS termination or reverse proxy patterns that fit better with Nginx.
  • You want to separate concerns:
  • Nginx: static files, HTTP-level optimizations
  • PHP-FPM: purely PHP execution

Make sure:

  • Your Drupal image and templates are compatible with PHP-FPM mode.
  • The container listens on 127.0.0.1:9000 for PHP-FPM, as expected by the default Nginx configuration.

Summary

  • Use drupal_php_* variables to control PHP limits (memory, upload sizes).
  • Enable php_fpm: true to switch to Nginx + PHP-FPM architecture.
  • Customize nginx_conf and php_fpm_conf for advanced performance and security tuning.
  • Leverage security context snippets to keep containers locked down.

For related performance topics, see Memcached & performance tuning.