Auto-rotate occupied ports and fix Windows-only Apache/PHP issues

When the configured port for a service is in use, scan upward (up to +20)
for the next free one and bind there. Apache's httpd.conf and MySQL's
my.ini are regenerated each spawn so the actual bind matches what RAMP
probes for readiness; PHP's port is passed via CLI flag. The chosen port
is surfaced in the UI (yellow when remapped) and ramp.toml is left
untouched so user preferences persist across launches.

Along the way, fixed several latent issues that were combining with the
port-conflict path to produce a crash loop:
- check_port_available now uses TcpStream::connect rather than bind, so
  TIME_WAIT zombies after a crash loop don't show as false conflicts.
- ProcessExit transitions now emit KillService so orphaned processes
  from a readiness timeout don't accumulate across retries.
- Apache readiness probes /__ramp_health (a deliberate 404) instead of
  / so the check doesn't hang behind the FastCGI proxy when PHP is
  still warming up; any Apache Server header counts as ready.
- httpd.conf's PHP handler switched from <FilesMatch>+SetHandler to
  ProxyPassMatch with explicit script path — the SetHandler form
  produces a malformed proxy URL on Windows ("fcgi://host:9000c:/...")
  that mod_proxy_fcgi parses as a bad hostname.
- php.ini sets doc_root + cgi.fix_pathinfo so PHP-CGI resolves
  scripts relative to htdocs without absolute drive-letter paths in
  SCRIPT_FILENAME.
- fatal() now shows a MessageBoxW dialog so failures are visible under
  windows_subsystem = "windows" instead of silently exiting.
- MySQL init non-fatal: surfaced via mysql.last_error in the UI;
  initialize_mysql wipes any leftovers in data_dir before running
  --initialize-insecure so a partially-initialized dir self-heals.
- Apache config drops mod_unixd (POSIX-only) and the deprecated
  BindAddress; mod_authn_core added.
- Long error messages truncated to 40 chars in the UI with the full
  text on hover so they don't push other rows' buttons off-screen.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: rbenzing

src/apache_conf.rs

@@ -3,6 +3,12 @@ use crate::state::RampConfig;
 /// Generate a minimal httpd.conf for RAMP's bundled Apache layout.
 /// Only called when the file does not already exist (never overwrites user edits).
 pub fn generate_httpd_conf(cfg: &RampConfig) -> String {
+    generate_httpd_conf_with_ports(cfg, cfg.apache.port, cfg.php.port)
+}
+
+/// Same as `generate_httpd_conf` but with explicit port overrides — used by the
+/// executor when the configured port was occupied and a different one was chosen.
+pub fn generate_httpd_conf_with_ports(cfg: &RampConfig, port: u16, php_port: u16) -> String {
     let apache_dir = cfg.install_dir.join("apache");
     let apache_dir = apache_dir.display().to_string().replace('\\', "/");
 
@@ -58,10 +64,20 @@ DocumentRoot "{apache_dir}/htdocs"
     DirectoryIndex index.php index.html index.htm
 </IfModule>
 
-# Proxy .php requests to PHP-CGI FastCGI listener
-<FilesMatch "\.php$">
-    SetHandler "proxy:fcgi://127.0.0.1:{php_port}"
-</FilesMatch>
+# Proxy .php requests to PHP-CGI FastCGI listener.
+#
+# Why this is the way it is:
+# - The naive `<FilesMatch> + SetHandler "proxy:fcgi://..."` pattern breaks on
+#   Windows because mod_proxy_fcgi appends the script's drive-lettered path
+#   directly to the proxy URL ("fcgi://host:9000c:/..."), which the URL parser
+#   sees as a malformed authority → "DNS lookup failure".
+# - ProxyPassMatch with an explicit script-path target avoids the URL parsing
+#   bug. The capture group `$1` holds the relative script path; PHP-CGI then
+#   joins it against `doc_root` from php.ini to find the real file. We rely on
+#   `doc_root` (set in php.ini) rather than absolute paths in the proxy URL,
+#   because absolute Windows paths in fcgi:// URLs trigger the same parser bug.
+ProxyFCGIBackendType GENERIC
+ProxyPassMatch "^/(.+\.php(/.*)?)$" "fcgi://127.0.0.1:{php_port}/$1"
 
 # Deny .htaccess and .htpasswd access
 <Files ".ht*">
@@ -81,13 +97,25 @@ LogLevel warn
     AddType application/x-compress .Z
     AddType application/x-gzip .gz .tgz
 </IfModule>
-"#,
-        apache_dir = apache_dir,
-        port = cfg.apache.port,
-        php_port = cfg.php.port,
+"#
     )
 }
 
+/// Force-rewrite httpd.conf with explicit port overrides. Used when the executor
+/// has resolved Apache or PHP to a different port than the configured one.
+pub fn rewrite_httpd_conf_with_ports(
+    cfg: &RampConfig,
+    port: u16,
+    php_port: u16,
+) -> Result<(), String> {
+    let conf_path = &cfg.apache.conf;
+    let dir = conf_path.parent().ok_or("httpd.conf has no parent dir")?;
+    std::fs::create_dir_all(dir).map_err(|e| format!("cannot create apache/conf dir: {e}"))?;
+    let content = generate_httpd_conf_with_ports(cfg, port, php_port);
+    crate::config::atomic_write(conf_path, content.as_bytes())
+        .map_err(|e| format!("cannot rewrite httpd.conf: {e}"))
+}
+
 /// Write httpd.conf only if it doesn't already exist.
 pub fn ensure_httpd_conf(cfg: &RampConfig) -> Result<(), String> {
     let conf_path = &cfg.apache.conf;
@@ -158,7 +186,8 @@ mod tests {
         let tmp = TempDir::new().unwrap();
         let cfg = test_cfg(tmp.path());
         let conf = generate_httpd_conf(&cfg);
-        assert!(conf.contains("proxy:fcgi://127.0.0.1:9000"));
+        assert!(conf.contains("fcgi://127.0.0.1:9000"));
+        assert!(conf.contains("ProxyPassMatch"));
         assert!(conf.contains("mod_proxy_fcgi.so"));
     }
 

src/events.rs

@@ -28,6 +28,12 @@ pub enum Event {
 
     // Port management
     PortConflictDetected(Service),
+    /// Executor resolved the port the service will actually bind to.
+    /// Emitted before a successful spawn so the UI/reducer know the chosen port.
+    PortAssigned {
+        service: Service,
+        port: u16,
+    },
 
     // Config — boxed to keep the enum variant size uniform
     ConfigReloaded(Box<crate::state::RampConfig>),

src/executor.rs

@@ -1,9 +1,11 @@
+use crate::apache_conf::rewrite_httpd_conf_with_ports;
 use crate::config::atomic_write;
 use crate::events::{Event, SideEffect};
 use crate::health::{poll_until_ready, run_health_checker};
 use crate::logger::SharedLog;
-use crate::process::{check_port_available, spawn_service, ServiceProcess};
-use crate::state::{AppState, PersistedState, RampConfig, Service};
+use crate::mysql_conf::rewrite_my_ini_with_port;
+use crate::process::{find_available_port, spawn_service, ServiceProcess};
+use crate::state::{AppState, PersistedState, RampConfig, Service, PORT_SCAN_RANGE};
 use crossbeam_channel::Sender;
 use std::collections::HashMap;
 
@@ -27,6 +29,10 @@ pub struct Executor {
     tx: Sender<Event>,
     log: SharedLog,
     handles: HashMap<Service, ServiceHandles>,
+    /// Effective port per service — set when do_spawn resolves a free port.
+    /// Used by readiness/health checks and by config regen for cross-service ports
+    /// (e.g. Apache's httpd.conf needs PHP's effective port for the FastCGI proxy).
+    effective_ports: HashMap<Service, u16>,
 }
 
 impl Executor {
@@ -36,9 +42,18 @@ impl Executor {
             tx,
             log,
             handles: HashMap::new(),
+            effective_ports: HashMap::new(),
         }
     }
 
+    /// Effective port to bind/probe — falls back to the configured port until a spawn resolves one.
+    fn effective_port(&self, svc: Service) -> u16 {
+        self.effective_ports
+            .get(&svc)
+            .copied()
+            .unwrap_or_else(|| self.port(svc))
+    }
+
     pub fn execute(&mut self, effects: Vec<SideEffect>, state: &AppState) {
         for effect in effects {
             match effect {
@@ -61,7 +76,7 @@ impl Executor {
     /// Start health checks for a service that just became Running.
     pub fn start_health_check(&mut self, svc: Service) {
         self.do_stop_health(svc);
-        let port = self.port(svc);
+        let port = self.effective_port(svc);
         let (stop_tx, stop_rx) = crossbeam_channel::bounded(1);
         let entry = self.handles.entry(svc).or_insert_with(|| {
             let (kill_tx, _) = crossbeam_channel::bounded(1);
@@ -79,20 +94,63 @@ impl Executor {
     }
 
     fn do_spawn(&mut self, svc: Service) {
-        let port = self.port(svc);
+        let configured = self.port(svc);
 
-        // Pre-check port
-        if !check_port_available(port) {
-            let _ = self.tx.send(Event::PortConflictDetected(svc));
+        // Scan upward for a free port. None → every port in the range is occupied.
+        let chosen = match find_available_port(configured, PORT_SCAN_RANGE) {
+            Some(p) => p,
+            None => {
+                let _ = self.tx.send(Event::PortConflictDetected(svc));
+                return;
+            }
+        };
+
+        // Always regenerate the service config file from the chosen port. This is
+        // critical: skipping the rewrite when chosen == configured leaves any stale
+        // config on disk (e.g. Listen 127.0.0.1:8081 from a previous crash-loop run)
+        // pointing at a different port than the one we'll probe for readiness, which
+        // turns into a phantom crash loop. PHP doesn't need a config rewrite — its
+        // port is a CLI flag.
+        let result = match svc {
+            Service::Apache => {
+                let php_port = self.effective_port(Service::Php);
+                rewrite_httpd_conf_with_ports(&self.config, chosen, php_port)
+            }
+            Service::Mysql => rewrite_my_ini_with_port(&self.config, chosen),
+            Service::Php => Ok(()),
+        };
+        if let Err(reason) = result {
+            let _ = self.tx.send(Event::ProcessSpawnFailed {
+                service: svc,
+                reason: format!("config regen for port {chosen}: {reason}"),
+            });
             return;
         }
 
+        // If this is PHP and Apache is currently running, refresh httpd.conf so the
+        // FastCGI proxy points at PHP's chosen port. Apache stays on its current port.
+        if svc == Service::Php && self.handles.contains_key(&Service::Apache) {
+            let apache_port = self.effective_port(Service::Apache);
+            if let Err(reason) = rewrite_httpd_conf_with_ports(&self.config, apache_port, chosen) {
+                self.log.push(format!(
+                    "warn: could not refresh httpd.conf for new PHP port: {reason}"
+                ));
+            }
+        }
+
+        // Record the resolution before spawn so later emits/queries see it.
+        self.effective_ports.insert(svc, chosen);
+        let _ = self.tx.send(Event::PortAssigned {
+            service: svc,
+            port: chosen,
+        });
+
         // Kill any existing handles for this service
         self.do_kill(svc);
 
         let (kill_tx, kill_rx) = crossbeam_channel::bounded::<()>(1);
 
-        match spawn_service(svc, &self.config, self.tx.clone()) {
+        match spawn_service(svc, &self.config, chosen, self.tx.clone()) {
             Ok(proc) => {
                 let tx = self.tx.clone();
                 let join = std::thread::spawn(move || watcher(proc, tx, kill_rx));
@@ -131,7 +189,7 @@ impl Executor {
     }
 
     fn do_readiness_check(&self, svc: Service) {
-        let port = self.port(svc);
+        let port = self.effective_port(svc);
         let tx = self.tx.clone();
         std::thread::spawn(move || poll_until_ready(svc, port, tx));
     }

src/health.rs

@@ -7,19 +7,29 @@ use std::io::Read;
 use std::net::TcpStream;
 use std::time::{Duration, Instant};
 
-/// Check if Apache is ready: TCP connect + HTTP 200–399 + Apache signature.
+/// Check if Apache is ready.
+///
+/// Probes a deliberately-nonexistent path so Apache returns 404 from its own error
+/// handler (with the Server header) without invoking the PHP FastCGI proxy. This
+/// avoids hanging the readiness check when PHP-CGI isn't running yet — requesting
+/// "/" would route through `mod_proxy_fcgi` and block for the proxy connect timeout.
+///
+/// Any HTTP response identifying as Apache via the Server header counts as ready.
 pub fn check_apache_ready(port: u16) -> bool {
-    let url = format!("http://127.0.0.1:{port}/");
+    let url = format!("http://127.0.0.1:{port}/__ramp_health");
     match ureq::get(&url).timeout(Duration::from_secs(2)).call() {
-        Ok(resp) => {
-            let status = resp.status();
-            let server = resp.header("Server").unwrap_or("").to_lowercase();
-            (200..400).contains(&status) && server.contains("apache")
-        }
+        Ok(resp) => server_is_apache(resp.header("Server").unwrap_or("")),
+        // 4xx/5xx responses come back as Err::Status with the underlying response —
+        // a 404 from Apache is exactly what we want to see here.
+        Err(ureq::Error::Status(_, resp)) => server_is_apache(resp.header("Server").unwrap_or("")),
         Err(_) => false,
     }
 }
 
+fn server_is_apache(header: &str) -> bool {
+    header.to_lowercase().contains("apache")
+}
+
 /// Check if MySQL is ready: TCP connect + reads MySQL greeting packet prefix.
 pub fn check_mysql_ready(port: u16) -> bool {
     let addr = std::net::SocketAddr::from(([127, 0, 0, 1], port));

src/mysql_conf.rs

@@ -3,9 +3,15 @@ use crate::state::RampConfig;
 /// Generate a minimal my.ini for MySQL 9.x compatible with RAMP's layout.
 /// Only called when the file does not already exist.
 pub fn generate_my_ini(cfg: &RampConfig) -> String {
-    let mysql_dir = cfg.install_dir.join("mysql");
-    let mysql_dir_s = mysql_dir.display().to_string().replace('\\', "/");
-    let data_dir_s = cfg.mysql.data_dir.display().to_string().replace('\\', "/");
+    generate_my_ini_with_port(cfg, cfg.mysql.port)
+}
+
+/// Same as `generate_my_ini` but with an explicit port — used by the executor
+/// when the configured port was occupied and a different one was chosen.
+pub fn generate_my_ini_with_port(cfg: &RampConfig, port: u16) -> String {
+    let mysql_dir_path = cfg.install_dir.join("mysql");
+    let mysql_dir = mysql_dir_path.display().to_string().replace('\\', "/");
+    let data_dir = cfg.mysql.data_dir.display().to_string().replace('\\', "/");
 
     format!(
         r#"# RAMP — generated my.ini
@@ -33,13 +39,21 @@ sql_mode = ""
 [client]
 port        = {port}
 default-character-set = utf8mb4
-"#,
-        mysql_dir = mysql_dir_s,
-        data_dir = data_dir_s,
-        port = cfg.mysql.port,
+"#
     )
 }
 
+/// Force-rewrite my.ini with an explicit port override. Used when the executor
+/// has resolved MySQL to a different port than the configured one.
+pub fn rewrite_my_ini_with_port(cfg: &RampConfig, port: u16) -> Result<(), String> {
+    let ini_path = &cfg.mysql.ini;
+    let dir = ini_path.parent().ok_or("my.ini has no parent dir")?;
+    std::fs::create_dir_all(dir).map_err(|e| format!("cannot create mysql dir: {e}"))?;
+    let content = generate_my_ini_with_port(cfg, port);
+    crate::config::atomic_write(ini_path, content.as_bytes())
+        .map_err(|e| format!("cannot rewrite my.ini: {e}"))
+}
+
 /// Write my.ini only if it doesn't already exist.
 pub fn ensure_my_ini(cfg: &RampConfig) -> Result<(), String> {
     let ini_path = &cfg.mysql.ini;

src/php_conf.rs

@@ -7,6 +7,13 @@ pub fn generate_php_ini(cfg: &RampConfig) -> String {
     let php_dir_s = php_dir.display().to_string().replace('\\', "/");
     let ext_dir = php_dir.join("ext");
     let ext_dir_s = ext_dir.display().to_string().replace('\\', "/");
+    let doc_root = cfg
+        .install_dir
+        .join("apache")
+        .join("htdocs")
+        .display()
+        .to_string()
+        .replace('\\', "/");
 
     format!(
         r#"; RAMP — generated php.ini
@@ -36,8 +43,11 @@ auto_globals_jit = On
 post_max_size = 64M
 default_mimetype = "text/html"
 default_charset = "UTF-8"
-doc_root =
+doc_root = "{doc_root}"
 user_dir =
+cgi.fix_pathinfo = 1
+cgi.force_redirect = 0
+cgi.discard_path = 0
 extension_dir = "{ext_dir}"
 enable_dl = Off
 file_uploads = On
@@ -128,6 +138,7 @@ session.sid_bits_per_character = 5
 "#,
         php_dir = php_dir_s,
         ext_dir = ext_dir_s,
+        doc_root = doc_root,
         mysql_port = cfg.mysql.port,
     )
 }