Fix systemic 502 risk: align new PHP-FPM pool ownership with nginx's actual user

php_install_script() installed php{ver}-fpm but never checked whether
nginx's worker user (the 'user' directive in nginx.conf) matched the
new pool's listen.owner/listen.group (package defaults: www-data on
Debian, apache/nginx on RHEL). On this server nginx runs as 'nginx',
but PHP 8.5's pool (installed after the phpMyAdmin installer's
one-time owner-fix loop had already run for other versions) kept
www-data - causing 'connect() ... failed (13: Permission denied)' and
502 Bad Gateway for every site on PHP 8.5, including phpMyAdmin.

Now detects nginx's actual user and aligns listen.owner/listen.group
for every newly-installed PHP version on both Debian and RHEL-family,
so this can't recur for future App Store PHP installs.

Author: BrowserlessAPI

panel/routes/os_utils.py

@@ -120,20 +120,37 @@ def nginx_install_script(channel='stable'):
 def php_install_script(ver):
     """PHP install script for all distros"""
     os_info = get_os()
+    # After installing PHP-FPM, align the pool's listen.owner/listen.group
+    # with nginx's actual worker user. Package defaults (www-data on
+    # Debian/Ubuntu, apache/nginx on RHEL) may not match what nginx is
+    # actually configured to run as - a mismatch causes nginx to fail
+    # connecting to the FPM socket with "(13: Permission denied)", i.e.
+    # every website on this PHP version returns 502 Bad Gateway.
+    fix_pool_owner = (
+        'NGINX_USER=$(grep -oP "^user\\s+\\K\\S+" /etc/nginx/nginx.conf 2>/dev/null | tr -d ";" | head -1); '
+        'NGINX_USER=${NGINX_USER:-www-data}; '
+        f'for POOL in /etc/php/{ver}/fpm/pool.d/www.conf /etc/php-fpm.d/www.conf; do '
+        '  [ -f "$POOL" ] || continue; '
+        '  grep -q "^listen.owner" "$POOL" && sed -i "s|^listen.owner.*|listen.owner = $NGINX_USER|" "$POOL" || echo "listen.owner = $NGINX_USER" >> "$POOL"; '
+        '  grep -q "^listen.group" "$POOL" && sed -i "s|^listen.group.*|listen.group = $NGINX_USER|" "$POOL" || echo "listen.group = $NGINX_USER" >> "$POOL"; '
+        'done'
+    )
     if os_info['family'] == 'debian':
         return (
             f'add-apt-repository -y ppa:ondrej/php 2>/dev/null; '
             f'{pkg_update()} && '
             f'{pkg_install(f"php{ver} php{ver}-fpm php{ver}-common php{ver}-mysql php{ver}-xml php{ver}-curl php{ver}-mbstring php{ver}-zip php{ver}-gd php{ver}-bcmath php{ver}-intl php{ver}-soap php{ver}-redis")} && '
-            f'systemctl enable php{ver}-fpm && systemctl start php{ver}-fpm'
+            f'systemctl enable php{ver}-fpm && systemctl start php{ver}-fpm && '
+            f'{fix_pool_owner} && systemctl restart php{ver}-fpm'
         )
     elif os_info['family'] in ('rhel','fedora'):
         return (
             f'dnf install -y https://rpms.remirepo.net/enterprise/remi-release-$(rpm -E %rhel).rpm 2>/dev/null; '
             f'dnf module reset php -y 2>/dev/null; '
             f'dnf module enable php:remi-{ver} -y 2>/dev/null; '
             f'{pkg_install(f"php php-fpm php-common php-mysql php-xml php-curl php-mbstring php-zip php-gd php-bcmath php-intl php-soap")} && '
-            f'systemctl enable php-fpm && systemctl start php-fpm'
+            f'systemctl enable php-fpm && systemctl start php-fpm && '
+            f'{fix_pool_owner} && systemctl restart php-fpm'
         )
     return f'{pkg_install(f"php{ver}-fpm")} && systemctl enable php{ver}-fpm'