PHP package stability in OpenBSD

[ershiba]

i am aware that this question might be somehow unrelated,

but i guess probably there are many if not some OpenBSD server administrator who runs PHP/PHP-FPM along with Apache/Nginx/Lighttpd webservers.
( where should i get advice from OpenBSD masters if not here? )

i am quite new, so i really appreciate your advice regarding running PHP/PHP-FPM along your webserver of choice in OpenBSD,

is there anything that we should particularly concern?

how bout the stability of PHP, or it should be something that be avoided at all cost?

and if there exists any particular method of installation / settings that followed by most OpenBSD administrator when they add PHP into their server?

[jggimi]

Several months ago I began experimenting with php-fpm FastCGI appservers and nginx webservers under OpenBSD. The environment remains in the lab only and is not yet in production.

All app and web servers run chrooted. The environment is further secured with read-only access to .php code by the appservers, making it more difficult for arbitrary injected code to be executed. PHP on OpenBSD includes the Suhosin security features as well.

Running PHP chrooted requires having the complete set of executables and libraries within the chroot structure. I use a small script after upgrades to refresh the php chrooted environment:

#!/bin/sh
cd /var/www
tar cf - `ls -d /etc/php* /usr/local/{lib,bin,sbin}/php*` | tar xpf -
tar cf - `ldd /usr/local/sbin/php* | grep usr | awk '{print $7}'` | tar xpf -