; PHP.ini Recommended Configuration for Biblioteca Application
; Production Performance Optimizations
; Copy relevant settings to your php.ini or .user.ini file

; ===================================
; OPCODE CACHE (OPcache) - CRITICAL
; ===================================
; OpCache stores precompiled script bytecode in memory
; Eliminates the need to load and parse PHP files on every request
; Expected performance improvement: +30-50% for PHP applications

opcache.enable=1
opcache.enable_cli=0
; 128 MB / 10000 files is enough for a stock Pinakes install. Raise to
; 256 / 20000 ONLY if opcache_get_status() shows saturation (memory_usage
; near full, num_cached_keys close to max_cached_keys, or oom_restarts > 0)
; — not a priori: oversizing just wastes shared memory.
opcache.memory_consumption=128
opcache.interned_strings_buffer=16
opcache.max_accelerated_files=10000
opcache.revalidate_freq=2
; NOTE: opcache.fast_shutdown was removed here on purpose — it has been a
; no-op since PHP 7.2 (the fast shutdown sequence is always used).

; Keep validate_timestamps=1. Setting it to 0 gives a marginal stat() saving
; but then EVERY code path that mutates PHP files (the in-app updater,
; plugin install/upgrade, manual deploys) must explicitly invalidate OPcache
; (opcache_reset()/opcache_invalidate() or an FPM reload) or the server keeps
; executing the OLD code indefinitely. Do not set it to 0 unless your deploy
; pipeline guarantees that invalidation.
opcache.validate_timestamps=1

; JIT: intentionally DISABLED. Pinakes is DB/IO-bound — JIT compiles CPU-bound
; loops, so it yields ~nothing for this workload while adding memory overhead
; and (historically) edge-case bugs. Set BOTH directives explicitly: opcache.jit
; alone is not enough because opcache.jit_buffer_size defaults to a non-zero value
; on some builds (notably PHP 8.4+), which would still reserve JIT memory.
opcache.jit=disable
opcache.jit_buffer_size=0

; ===================================
; SECURITY
; ===================================
; Pinakes does not use PHP's session upload progress. Turning it off lowers the
; exposure to CVE-2026-109618 / CVE-2026-109619 on an unpatched PHP; it does not
; replace updating PHP to 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later (or a
; distribution package with the fixes backported).
; Unlike the rest of this file, this one must be set administratively, in php.ini,
; the PHP-FPM pool (php_admin_value) or the server configuration, and every PHP
; worker restarted: .user.ini is applied too late for this case (PHP advisory
; GHSA-6wmf-4rv5-p3rp).
session.upload_progress.enabled=0

; ===================================
; MEMORY & PERFORMANCE
; ===================================
memory_limit=256M
max_execution_time=60
max_input_time=60
post_max_size=100M
upload_max_filesize=100M
; Per caricare audiobook fino a 500 MB, aumentare entrambi i valori a 512M
; e impostare max_execution_time=300 e max_input_time=300

; ===================================
; SESSION CONFIGURATION
; ===================================
session.cookie_httponly=1
session.cookie_samesite="Strict"
session.use_strict_mode=1
session.cookie_secure=0  ; Set to 1 in production with HTTPS

; ===================================
; ERROR HANDLING
; ===================================
; Production
display_errors=Off
display_startup_errors=Off
log_errors=On
error_log=/var/log/php_errors.log

; Development (comment out in production)
; display_errors=On
; display_startup_errors=On
; error_reporting=E_ALL

; ===================================
; SECURITY
; ===================================
expose_php=Off
allow_url_fopen=On
allow_url_include=Off

; ===================================
; DATE/TIME
; ===================================
date.timezone=UTC