From 6f10738652b6f99f319aef2824cd11e248f7734a Mon Sep 17 00:00:00 2001
From: Luis Guzman <luisguzman@appdevforall.org>
Date: Fri, 4 Sep 2026 15:50:36 -0600
Subject: [PATCH] K2GO-386 fix(rootfs): stop php-fpm running idle by default
 (barrier 1)

An idle php-fpm (enabled unconditionally by the nginx role) is the disk-fill
offender: orphaned off proot by a relaunch/restore it busy-loops on epoll_wait
ENOSYS (~600 MB/min) and fills /data. Move php-fpm ownership from nginx to the
roles that use it, in one carried patch:

0002-php-fpm-role-ownership.patch (tools/upstream-patches):
- nginx no longer manages php-fpm (drops both the proot enable/restart block and
  the non-proot systemd restart); nginx does not need it.
- the Matomo role enables its own php-fpm.

So on the default build (no php-consuming role) php-fpm stays installed but not
enabled -> never runs -> cannot orphan and fill the disk. Carried via
tools/upstream-patches (WIP); it only affects our build until presented upstream,
where it pairs with every IIAB php role self-managing its php.

The app-side free-space guard (barrier 2, the general net) is tracked on K2GO-386.
---
 .../patches/0002-php-fpm-role-ownership.patch | 47 +++++++++++++++++++
 1 file changed, 47 insertions(+)
 create mode 100644 tools/upstream-patches/patches/0002-php-fpm-role-ownership.patch

diff --git a/tools/upstream-patches/patches/0002-php-fpm-role-ownership.patch b/tools/upstream-patches/patches/0002-php-fpm-role-ownership.patch
new file mode 100644
index 000000000..c4800d642
--- /dev/null
+++ b/tools/upstream-patches/patches/0002-php-fpm-role-ownership.patch
@@ -0,0 +1,47 @@
+Upstream-PR:     WIP — to be presented to IIAB upstream
+Upstream-Status: open
+Applies-to:      roles/nginx/tasks/install.yml, roles/matomo/tasks/install.yml
+Summary:         Move php-fpm ownership from nginx to the roles that use it — nginx no longer manages php-fpm (both proot and non-proot), Matomo enables its own. Stops idle php-fpm running by default (K2GO-386). Carried for our build; WIP for upstream (pairs with every php role self-managing).
+
+diff --git a/roles/matomo/tasks/install.yml b/roles/matomo/tasks/install.yml
+index 65bf441..eceddd1 100644
+--- a/roles/matomo/tasks/install.yml
++++ b/roles/matomo/tasks/install.yml
+@@ -47,6 +47,10 @@
+   include_tasks: roles/www_options/tasks/php-settings.yml
+   when: php_settings_done is undefined
+ 
++- name: Enable 'php-fpm' via pdsm (proot) so Matomo owns its php-fpm (do not rely on the nginx role)
++  command: pdsm enable php-fpm
++  when: is_proot
++
+ - name: Start 'php-fpm' via pdsm (proot)
+   command: pdsm start php-fpm
+   register: pdsm_start
+diff --git a/roles/nginx/tasks/install.yml b/roles/nginx/tasks/install.yml
+index 2d24a48..4b9ad3a 100644
+--- a/roles/nginx/tasks/install.yml
++++ b/roles/nginx/tasks/install.yml
+@@ -64,22 +64,6 @@
+     msg: roles/nginx/tasks/homepage.yml will run LATER (invoked by roles/www_options/tasks/main.yml) SO THAT NGINX CAN REDIRECT http://box TO http://box{{ iiab_home_url }} (based on var iiab_home_url)
+ # - include_tasks: roles/nginx/tasks/homepage.yml
+ 
+-- name: Restart php{{ php_version }}-fpm systemd service
+-  systemd:
+-    name: "php{{ php_version }}-fpm"
+-    state: restarted
+-  when: not is_proot
+-
+-- name: Enable & Restart recently installed 'php-fpm' via pdsm (proot)
+-  when: is_proot
+-  block:
+-    - name: Enable 'php-fpm' via pdsm (proot)
+-      command: pdsm enable php-fpm
+-
+-    - name: Restart 'php-fpm' via pdsm (proot)
+-      command: pdsm restart php-fpm
+-
+-
+ # RECORD NGINX AS INSTALLED
+ 
+ - name: Record (final) disk space used