DNS, SSL & PHP on Linux: A Practical Guide for DevOps Engineers
Learn DNS records, SPF, DKIM, DMARC, SSL certificates, Let's Encrypt, PHP-FPM, Nginx, and PHP troubleshooting with practical Linux commands.
DNS, SSL & PHP on Linux: What Every DevOps Engineer Should Know
A website can be running perfectly on a server and still be unreachable.
Why?
Because infrastructure has layers.
Your application may be healthy.
Your web server may be running.
Your SSL certificate may be valid.
But if DNS points to the wrong IP, users never reach your server.
And if SSL is misconfigured, they may reach it—but receive a certificate error.
And if PHP-FPM is broken, Nginx may return a 502 Bad Gateway.
This is why DevOps engineers need to understand the entire path:
Domain → DNS → Server → Web Server → SSL/TLS → Application Runtime
Let's break down the most important concepts and commands.
1. Understanding DNS Records
DNS, or Domain Name System, translates human-readable domain names into information computers can use.
For example:
example.com → 192.168.1.100
The most important DNS records to know are:
| Record | Purpose |
|---|---|
| A | Maps a domain to an IPv4 address |
| AAAA | Maps a domain to an IPv6 address |
| CNAME | Creates an alias to another domain |
| MX | Defines mail servers |
| TXT | Stores text data such as SPF and verification records |
| NS | Defines authoritative nameservers |
| SOA | Contains authority information for a DNS zone |
| PTR | Maps an IP address back to a domain |
| SRV | Defines the location of specific services |
| CAA | Controls which certificate authorities can issue certificates |
The key distinction to remember:
A record → IP address
CNAME → another domain name
That simple difference appears frequently in DevOps and infrastructure interviews.
2. DNS Troubleshooting With Linux Commands
When a domain isn't resolving correctly, don't immediately blame the application.
Start with DNS.
Check the A record
dig example.com
Or:
dig example.com A
For a cleaner result:
dig +short example.com
Query a specific DNS resolver
Google DNS:
dig @8.8.8.8 example.com
Cloudflare DNS:
dig @1.1.1.1 example.com
This is useful when troubleshooting DNS propagation or resolver-specific problems.
Check MX records
dig example.com MX
Check TXT records
dig example.com TXT
Check nameservers
dig example.com NS
Check reverse DNS
dig -x 192.168.1.100
This checks the PTR record.
3. SPF, DKIM and DMARC
DNS isn't only about websites.
It's also critical for email security.
Three records you should understand are:
SPF
DKIM
DMARC
SPF
SPF specifies which servers are authorized to send email for a domain.
Example:
v=spf1 ip4:192.168.1.100 include:_spf.google.com include:sendgrid.net ~all
The important idea:
SPF answers: “Which servers are allowed to send email for this domain?”
DKIM
DKIM adds a cryptographic signature to outgoing email.
The receiving mail server can use that signature to verify that the message hasn't been improperly modified.
A DKIM record is commonly stored under:
selector._domainkey.example.com
DMARC
DMARC tells receiving mail servers what to do when SPF or DKIM checks fail.
Example:
v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; pct=100
Possible policies include:
p=none
p=quarantine
p=reject
A useful mental model is:
SPF → Who can send?
DKIM → Was the message cryptographically signed?
DMARC → What should happen if authentication fails?
4. SSL/TLS: Securing Web Traffic
DNS gets users to your server.
SSL/TLS secures the communication between the client and server.
Modern systems use TLS. SSL is the older terminology.
For most Linux web servers, HTTPS traffic is handled on:
443
HTTP commonly uses:
80
5. Let's Encrypt and Certbot
One of the most common ways to obtain free TLS certificates is Let's Encrypt.
Certbot automates much of the certificate process.
Install it:
sudo apt update
sudo apt install certbot
Apache
sudo apt install python3-certbot-apache
sudo certbot --apache -d example.com -d www.example.com
Nginx
sudo apt install python3-certbot-nginx
sudo certbot --nginx -d example.com -d www.example.com
Standalone mode
If no web server is running:
sudo certbot certonly --standalone -d example.com
Webroot mode
If a web server is already running:
sudo certbot certonly \
--webroot \
-w /var/www/example.com/public \
-d example.com \
-d www.example.com
6. SSL Renewal
Getting the certificate is only half the job.
You also need to make sure it doesn't expire.
Check certificates:
sudo certbot certificates
Test renewal:
sudo certbot renew --dry-run
Renew certificates:
sudo certbot renew
You can also verify the Certbot systemd timer:
sudo systemctl status certbot.timer
A good production habit is:
Don't wait for users to discover that your certificate expired.
Automate renewal and test it before you need it.
7. Troubleshooting SSL From the Command Line
When HTTPS isn't behaving correctly, OpenSSL is one of your best friends.
Check the TLS connection:
openssl s_client \
-connect example.com:443 \
-servername example.com
Check certificate dates:
echo | openssl s_client \
-connect example.com:443 2>/dev/null |
openssl x509 -noout -dates
Check certificate details:
echo | openssl s_client \
-connect example.com:443 2>/dev/null |
openssl x509 -noout -text
These commands help you investigate:
- Certificate expiration
- Certificate details
- TLS connections
- Certificate configuration
8. Common SSL Errors
ERR_CERT_HAS_EXPIRED
The certificate has expired.
Potential solution:
sudo certbot renew
ERR_CERT_COMMON_NAME_INVALID
The certificate doesn't match the requested domain.
For example:
Requested:
api.example.com
Certificate:
example.com
The certificate needs to cover the appropriate hostname.
Certificate chain incomplete
The server may be missing an intermediate certificate.
A full certificate chain may be required.
Mixed content
The main website uses HTTPS, but some resources still use HTTP.
For example:
https://example.com
loading:
http://example.com/style.css
That can trigger browser security warnings.
9. Installing PHP on Linux
PHP is commonly used for dynamic web applications.
With Apache:
sudo apt install php libapache2-mod-php
With Nginx, PHP typically runs through PHP-FPM:
sudo apt install php-fpm php-cli
PHP-FPM stands for:
PHP FastCGI Process Manager
It manages PHP worker processes separately from Nginx.
10. Why PHP-FPM Matters With Nginx
Nginx doesn't execute PHP code directly.
Instead, the architecture looks like this:
Client
↓
Nginx
↓
PHP-FPM
↓
PHP Application
↓
Database
Nginx receives the HTTP request.
PHP-FPM manages PHP processes.
The PHP application executes.
This separation is one reason PHP-FPM is commonly used with Nginx.
11. Configure PHP-FPM
A common PHP-FPM pool configuration is:
/etc/php/8.2/fpm/pool.d/www.conf
Important settings include:
user = www-data
group = www-data
listen = /var/run/php/php8.2-fpm.sock
PHP-FPM can communicate through a Unix socket or TCP:
listen = /var/run/php/php8.2-fpm.sock
or:
listen = 127.0.0.1:9000
Unix sockets are commonly used when Nginx and PHP-FPM are on the same server.
12. PHP-FPM Process Management
PHP-FPM supports different process manager modes:
pm = dynamic
Other options include:
static
ondemand
For dynamic mode, important settings include:
pm.max_children = 50
pm.start_servers = 5
pm.min_spare_servers = 5
pm.max_spare_servers = 35
pm.max_requests = 500
These settings control how PHP worker processes are created and managed.
The important operational lesson is:
PHP performance isn't only about PHP code. Process management matters too.
13. PHP Configuration
The main PHP configuration file is php.ini.
Find the configuration being used:
php --ini
You can also inspect specific settings:
php -i | grep memory_limit
php -i | grep upload_max_filesize
Common production settings include:
memory_limit = 256M
upload_max_filesize = 64M
post_max_size = 70M
max_execution_time = 300
max_input_time = 300
max_input_vars = 5000
date.timezone = Asia/Kolkata
For production:
display_errors = Off
log_errors = On
A production server should log errors rather than expose them directly to visitors.
14. OPcache for PHP Performance
PHP can improve performance by caching compiled bytecode.
That's where OPcache comes in.
Example configuration:
opcache.enable = 1
opcache.memory_consumption = 128
opcache.max_accelerated_files = 10000
opcache.revalidate_freq = 2
The principle is simple:
Don't repeatedly do work that can be cached safely.
This is one of the small configuration decisions that can have a meaningful effect on application performance.
15. Multiple PHP Versions
Sometimes different applications require different PHP versions.
You can install multiple PHP-FPM versions:
sudo apt install php7.4-fpm php8.0-fpm php8.1-fpm php8.2-fpm
You can also change the CLI version:
sudo update-alternatives --config php
The bigger advantage is that Nginx can route different websites to different PHP-FPM sockets.
For example:
location ~ \.php$ {
fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
}
Another site could use:
location ~ \.php$ {
fastcgi_pass unix:/var/run/php/php8.2-fpm.sock;
}
This allows different applications to coexist on the same server with different runtime requirements.
16. Composer
Composer is the package manager commonly used for PHP projects.
Install it and then use commands such as:
composer install
composer update
composer require package/name
composer dump-autoload
The important distinction:
composer install
is generally used to install the dependencies defined by the project.
Whereas:
composer update
updates dependency versions according to the project's dependency constraints.
17. A Practical Troubleshooting Mindset
Here's the most important lesson.
Don't troubleshoot randomly.
Follow the request path.
If a website isn't working, think:
1. Does DNS resolve?
↓
2. Does the server respond?
↓
3. Is the web server running?
↓
4. Is port 80/443 reachable?
↓
5. Is TLS configured correctly?
↓
6. Is Nginx/Apache routing correctly?
↓
7. Is PHP-FPM running?
↓
8. Is the PHP application working?
↓
9. Can the application reach its database?
This turns troubleshooting from guessing into a process.
Final Takeaway
DevOps isn't about memorizing hundreds of commands.
It's about understanding how systems connect.
DNS tells users where to go.
SSL/TLS protects the connection.
Nginx or Apache handles HTTP traffic.
PHP-FPM executes PHP workloads.
The application talks to its dependencies.
And Linux gives you the tools to inspect every layer.
If you understand that chain, troubleshooting becomes much easier.
Because instead of asking:
“Why is my website down?”
you start asking better questions:
“Where does the request fail?”
That's the mindset that turns a person who knows commands into an engineer who knows how systems work.
Quick Interview Revision
A vs CNAME?
A points to an IPv4 address. CNAME points to another domain name.
What does SPF do?
Defines authorized email senders for a domain.
What does DKIM do?
Provides a cryptographic signature for email authentication.
What does DMARC do?
Defines how receivers should handle SPF/DKIM authentication failures.
What is TLS?
A protocol used to secure network communication, including HTTPS.
What is PHP-FPM?
A process manager for PHP applications, commonly used with Nginx.
How do you check SSL expiry?
sudo certbot certificates
or:
echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -dates
How do you check DNS?
dig example.com
How do you test certificate renewal?
sudo certbot renew --dry-run
The biggest DevOps lesson?
Understand the request path. Troubleshoot the layer where the request actually fails.
Part 3: DNS, SSL Certificates & PHP Environments
3.1 DNS & Domain Configuration
DNS Record Types (MUST KNOW ALL)
| Record | Purpose | Example |
|---|---|---|
| A | Maps domain to IPv4 address | example.com → 192.168.1.100 |
| AAAA | Maps domain to IPv6 address | example.com → 2001:db8::1 |
| CNAME | Alias pointing to another domain | www.example.com → example.com |
| MX | Mail server for the domain | example.com → mail.example.com (priority 10) |
| TXT | Text records (SPF, DKIM, verification) | v=spf1 include:_spf.google.com ~all |
| NS | Nameservers for the domain | example.com → ns1.digitalocean.com |
| SOA | Start of Authority (primary NS, admin email) | Auto-managed by DNS provider |
| PTR | Reverse DNS (IP to domain) | 192.168.1.100 → example.com |
| SRV | Service location records | Used for SIP, XMPP, etc. |
| CAA | Certificate Authority Authorization | Controls who can issue SSL for domain |
SPF, DKIM & DMARC (Email Authentication - CRITICAL)
# SPF (Sender Policy Framework) - TXT record
# Specifies which servers can send email for your domain
# Add as TXT record for @ (root domain):
v=spf1 ip4:192.168.1.100 include:_spf.google.com include:sendgrid.net ~all
# Explanation:
# v=spf1 - SPF version 1
# ip4:192.168.1.100 - Allow this IP to send mail
# include:_spf.google.com - Allow Google Workspace to send mail
# include:sendgrid.net - Allow SendGrid to send mail
# ~all - Soft fail everything else (mark as suspicious)
# -all - Hard fail everything else (reject)
# DKIM (DomainKeys Identified Mail) - TXT record
# Adds a digital signature to emails to verify they're not tampered
# Usually provided by your email service
# Add as TXT record for selector._domainkey.example.com:
# Name: google._domainkey
# Value: v=DKIM1; k=rsa; p=MIGfMA0GCS... (public key from provider)
# DMARC (Domain-based Message Authentication Reporting & Conformance) - TXT record
# Tells receivers what to do when SPF/DKIM fail
# Add as TXT record for _dmarc.example.com:
v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; pct=100
# Explanation:
# v=DMARC1 - DMARC version 1
# p=none - Monitor only (start here)
# p=quarantine - Send to spam if fails
# p=reject - Reject email if fails
# rua=mailto:... - Where to send aggregate reports
# pct=100 - Apply to 100% of emails
DNS Troubleshooting Commands
# Query DNS records
dig example.com # A record
dig example.com A # A record explicitly
dig example.com AAAA # IPv6
dig example.com MX # Mail records
dig example.com TXT # TXT records (SPF, DKIM)
dig example.com NS # Nameservers
dig example.com CNAME # CNAME records
dig example.com ANY # All records
dig +short example.com # Short output
dig @8.8.8.8 example.com # Query specific DNS server (Google)
dig @1.1.1.1 example.com # Query Cloudflare DNS
# Alternative tools
nslookup example.com # Basic DNS lookup
nslookup -type=MX example.com # MX records
host example.com # Simple DNS lookup
# Check DNS propagation
# Use online tools: dnschecker.org, whatsmydns.net
# Check PTR (reverse DNS)
dig -x 192.168.1.100
# Check current DNS cache
systemd-resolve --status # systemd-resolved stats
systemd-resolve --flush-caches # Flush DNS cache on Ubuntu
# Trace DNS resolution
dig +trace example.com # Shows full DNS resolution path
# Check SPF record
dig TXT example.com | grep spf
# Check DKIM record
dig TXT google._domainkey.example.com
# Check DMARC record
dig TXT _dmarc.example.com
Practical DNS Setup Scenarios
# Scenario 1: Point domain to new server
# In DNS provider (Cloudflare/GoDaddy/Route53):
# Type: A | Name: @ | Value: NEW_SERVER_IP | TTL: 300
# Type: A | Name: www | Value: NEW_SERVER_IP | TTL: 300
# Scenario 2: Subdomain for staging
# Type: A | Name: staging | Value: STAGING_SERVER_IP | TTL: 300
# Scenario 3: Setup Google Workspace email
# Type: MX | Name: @ | Value: aspmx.l.google.com | Priority: 1
# Type: MX | Name: @ | Value: alt1.aspmx.l.google.com | Priority: 5
# Type: MX | Name: @ | Value: alt2.aspmx.l.google.com | Priority: 5
# Type: TXT | Name: @ | Value: v=spf1 include:_spf.google.com ~all
# Scenario 4: Cloudflare CDN setup
# Change nameservers to Cloudflare NS at domain registrar
# Cloudflare manages all DNS records after that
Interview Q&A: DNS
| Question | Answer |
|---|---|
| What is DNS propagation? | Time for DNS changes to spread globally (can take up to 48 hours, usually 15 min - 4 hours) |
| How to speed up DNS propagation? | Lower TTL before making changes (e.g., 300 seconds), then change, then raise TTL back |
| A record vs CNAME? | A maps to IP, CNAME maps to another domain name. Root domain (@) cannot have CNAME |
| What is TTL? | Time To Live - how long DNS resolvers cache the record (in seconds) |
| What happens if MX records are wrong? | Email for your domain won't be delivered |
| How to verify DNS changes? |
dig @8.8.8.8 example.com, use dnschecker.org, whatsmydns.net |
| What is reverse DNS? | Maps IP to domain name (PTR record). Important for email delivery |
| Why is SPF important? | Prevents email spoofing by specifying authorized mail servers |
| What does DKIM do? | Adds cryptographic signature to emails proving they're not tampered |
| What does DMARC do? | Tells receiving servers what to do when SPF/DKIM checks fail |
3.2 SSL Certificate Management
Let's Encrypt (Free SSL - Most Common)
# Install Certbot
sudo apt update
sudo apt install certbot
# For Apache
sudo apt install python3-certbot-apache
sudo certbot --apache -d example.com -d www.example.com
# For Nginx
sudo apt install python3-certbot-nginx
sudo certbot --nginx -d example.com -d www.example.com
# Standalone (when no web server is running)
sudo certbot certonly --standalone -d example.com
# Webroot (web server running, no plugin)
sudo certbot certonly --webroot -w /var/www/example.com/public -d example.com -d www.example.com
# Wildcard certificate (covers *.example.com)
sudo certbot certonly --manual --preferred-challenges dns -d "*.example.com" -d example.com
# This requires adding a TXT record to DNS
# Check certificate expiry
sudo certbot certificates
# Renew all certificates
sudo certbot renew
# Renew with dry run (test)
sudo certbot renew --dry-run
# Auto-renewal cron (usually set up automatically)
# Verify timer exists:
sudo systemctl status certbot.timer
# Or add to crontab:
0 0,12 * * * certbot renew --quiet --post-hook "systemctl reload nginx"
Manual SSL Installation (Paid certificates)
# SSL files you'll receive:
# 1. certificate.crt - Your domain certificate
# 2. ca_bundle.crt - Intermediate/CA bundle
# 3. private.key - Private key (you generated this)
# Step 1: Generate CSR (Certificate Signing Request)
openssl req -new -newkey rsa:2048 -nodes -keyout example.com.key -out example.com.csr
# Fill in: Country, State, City, Org, Common Name (example.com)
# Step 2: Submit CSR to certificate provider (GoDaddy, DigiCert, Comodo, etc.)
# Step 3: Download and install certificates
sudo mkdir -p /etc/ssl/example.com
sudo cp example.com.crt /etc/ssl/example.com/
sudo cp ca_bundle.crt /etc/ssl/example.com/
sudo cp example.com.key /etc/ssl/example.com/
sudo chmod 600 /etc/ssl/example.com/example.com.key
# Step 4: Configure in Nginx
ssl_certificate /etc/ssl/example.com/example.com.crt;
ssl_certificate_key /etc/ssl/example.com/example.com.key;
# Note: you may need to combine cert + CA bundle:
cat example.com.crt ca_bundle.crt > fullchain.crt
# Step 4b: Configure in Apache
SSLCertificateFile /etc/ssl/example.com/example.com.crt
SSLCertificateKeyFile /etc/ssl/example.com/example.com.key
SSLCACertificateFile /etc/ssl/example.com/ca_bundle.crt
SSL Troubleshooting
# Check SSL certificate from command line
openssl s_client -connect example.com:443 -servername example.com
# Check certificate expiry date
echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -dates
# Check certificate details
echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -text
# Verify certificate chain
openssl verify -CAfile ca_bundle.crt example.com.crt
# Check if private key matches certificate
openssl x509 -noout -modulus -in cert.crt | openssl md5
openssl rsa -noout -modulus -in private.key | openssl md5
# Both MD5 hashes should match!
# Online tools for SSL checking:
# ssllabs.com/ssltest
# sslshopper.com/ssl-checker.html
Common SSL Issues & Fixes
| Issue | Cause | Fix |
|---|---|---|
| ERR_CERT_HAS_EXPIRED | Certificate expired | Renew with certbot renew or get new cert |
| ERR_CERT_COMMON_NAME_INVALID | Domain doesn't match cert | Issue cert for correct domain name |
| Mixed content warnings | HTTP resources on HTTPS page | Update all URLs to HTTPS in code/DB |
| Certificate chain incomplete | Missing intermediate cert | Add CA bundle/intermediate certificate |
| SSL handshake failed | Protocol/cipher mismatch | Update ssl_protocols, check TLS version |
| Let's Encrypt rate limit | Too many certs in short time | Wait, use staging for testing |
Interview Q&A: SSL
| Question | Answer |
|---|---|
| What is SSL/TLS? | Encryption protocol securing data between browser and server. SSL is deprecated, TLS is current (1.2/1.3) |
| How does Let's Encrypt work? | Free, automated CA. Validates domain ownership via HTTP challenge or DNS challenge, issues 90-day certs |
| How do you handle SSL renewal? | Certbot auto-renewal via systemd timer or cron job, runs twice daily |
| What is a wildcard SSL? | Covers all subdomains: *.example.com. Requires DNS challenge for Let's Encrypt |
| What is HSTS? | HTTP Strict Transport Security. Forces browsers to always use HTTPS |
| What is a CSR? | Certificate Signing Request. Contains public key + domain info, sent to CA to get certificate |
| How to troubleshoot "certificate not trusted"? | Check chain is complete, intermediate certs included, cert matches domain |
| What's the difference between DV, OV, EV certs? | DV: domain validation only. OV: org verified. EV: extended validation (green bar, most trust) |
3.3 PHP Server Environment
PHP Installation & Management
# Install PHP (with Apache)
sudo apt install php libapache2-mod-php
# Install PHP (with Nginx - uses PHP-FPM)
sudo apt install php-fpm php-cli
# Install specific PHP version
sudo add-apt-repository ppa:ondrej/php # Add PHP repository
sudo apt update
sudo apt install php8.2-fpm php8.2-cli
# Install common PHP extensions
sudo apt install php8.2-mysql php8.2-pgsql php8.2-sqlite3 # Database
sudo apt install php8.2-curl php8.2-gd php8.2-mbstring # Common
sudo apt install php8.2-xml php8.2-zip php8.2-intl # Processing
sudo apt install php8.2-bcmath php8.2-soap php8.2-redis # Additional
sudo apt install php8.2-imagick php8.2-opcache # Performance
# Check PHP version
php -v
# List installed modules
php -m
# Find php.ini location
php --ini
php -i | grep "php.ini"
# Check specific PHP config
php -i | grep memory_limit
php -i | grep upload_max_filesize
PHP Configuration (php.ini)
# Find and edit php.ini
# For CLI:
sudo nano /etc/php/8.2/cli/php.ini
# For Apache:
sudo nano /etc/php/8.2/apache2/php.ini
# For FPM (Nginx):
sudo nano /etc/php/8.2/fpm/php.ini
# IMPORTANT settings to know:
memory_limit = 256M # Max memory per script
upload_max_filesize = 64M # Max file upload size
post_max_size = 70M # Max POST data (must be > upload_max_filesize)
max_execution_time = 300 # Max script execution time (seconds)
max_input_time = 300 # Max time to parse input
max_input_vars = 5000 # Max input variables
date.timezone = Asia/Kolkata # Timezone
# Error handling
display_errors = Off # NEVER On in production
log_errors = On # Always log errors
error_log = /var/log/php/error.log # Error log path
error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT
# Session settings
session.save_handler = files
session.save_path = "/var/lib/php/sessions"
session.gc_maxlifetime = 1440
# OPcache (Performance - MUST enable)
opcache.enable = 1
opcache.memory_consumption = 128
opcache.max_accelerated_files = 10000
opcache.revalidate_freq = 2
# After changes:
sudo systemctl restart php8.2-fpm # For Nginx
sudo systemctl restart apache2 # For Apache
PHP-FPM Configuration (for Nginx)
# Pool config file
sudo nano /etc/php/8.2/fpm/pool.d/www.conf
# Key settings:
user = www-data
group = www-data
listen = /var/run/php/php8.2-fpm.sock # Unix socket (preferred)
# OR
listen = 127.0.0.1:9000 # TCP socket
# Process manager settings
pm = dynamic # dynamic, static, or ondemand
pm.max_children = 50 # Max worker processes
pm.start_servers = 5 # Initial workers
pm.min_spare_servers = 5 # Min idle workers
pm.max_spare_servers = 35 # Max idle workers
pm.max_requests = 500 # Requests before worker restart (prevents memory leaks)
# Status page (for monitoring)
pm.status_path = /php-fpm-status
# Slow log (for debugging)
slowlog = /var/log/php/slow.log
request_slowlog_timeout = 5s # Log requests taking > 5s
# Restart PHP-FPM
sudo systemctl restart php8.2-fpm
sudo systemctl status php8.2-fpm
Multiple PHP Versions
# Install multiple versions
sudo apt install php7.4-fpm php8.0-fpm php8.1-fpm php8.2-fpm
# Switch CLI version
sudo update-alternatives --set php /usr/bin/php8.2
sudo update-alternatives --config php # Interactive selection
# Use different PHP versions for different sites in Nginx:
# Site 1 (PHP 7.4):
location ~ \.php$ {
fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
}
# Site 2 (PHP 8.2):
location ~ \.php$ {
fastcgi_pass unix:/var/run/php/php8.2-fpm.sock;
}
Composer (PHP Package Manager)
# Install Composer
curl -sS https://getcomposer.org/installer | php
sudo mv composer.phar /usr/local/bin/composer
# Usage
composer install # Install dependencies from composer.json
composer update # Update dependencies
composer require package/name # Add new package
composer dump-autoload # Regenerate autoloader
Interview Q&A: PHP
| Question | Answer |
|---|---|
| What is PHP-FPM? | FastCGI Process Manager. Manages PHP worker processes. Used with Nginx |
| Difference between mod_php and PHP-FPM? | mod_php runs inside Apache (simpler). PHP-FPM is separate process (better performance, works with Nginx) |
| How to increase file upload limit? | Change upload_max_filesize and post_max_size in php.ini, also client_max_body_size in Nginx |
| What is OPcache? | Caches compiled PHP bytecode in memory, massive performance improvement |
| How to check which PHP extensions are installed? |
php -m or php -i
|
| What causes a PHP memory limit error? | Script needs more memory than memory_limit in php.ini. Increase it or optimize code |
| How to handle multiple PHP versions? | Install via ondrej PPA, each version runs its own FPM pool, configure per-site in Nginx |
| Where do PHP errors go? | Check error_log in php.ini, or /var/log/php/error.log, or site-specific error log |
What is pm = dynamic vs static vs ondemand? |
Dynamic: scales workers within limits. Static: fixed workers. Ondemand: creates workers only when needed |
