FastCGI Engine Contrib

Permits Foswiki to be executed with FastCGI?

Overview

FastCGI is a technology to deliver dynamic web content. It differs from CGI cause it remains persistent between requests, instead of CGI approach of a new forked process per request. This way there is a significant performance improvement, since all overhead related to create a new process, load the interpreter and compile the code is skipped.

Some FastCGI features:

• The number of persistent processes is configurable, independent of the web server. This leads to easier capacity planning/management.
• Processes can be run with a different user: more security.
• Processes can be run on another machines: easier load balancing.

Installation Instructions

Configure

Foswiki bin

Foswiki root

This section is about how to configure FastCGIEngineContrib, considering many possible environments:

• Apache web server
  • Using only .htaccess (typically on host services)
  • With access to apache configuration files
    • Remote FastCGI processes
  • Using mod_fcgid or mod_fastcgi
• Lighttpd web server
  • Remote FastCGI processes
• nginx web server
  • remote FastCGI processes

Installation of the FCGI CPAN library

FastCGIEngineContrib uses a CPAN library called FCGI which is not normally distributed with Perl. Version of FCGI should be 0.67 or later

Generic CPAN references as well as the most popular distribution packages are listed below

• CPAN - http://search.cpan.org/dist/FCGI/ (generic CPAN installation perl -MCPAN -e 'install FCGI')
• RedHat/Centos RPM from Dag - http://dag.wieers.com/rpm/packages/perl-FCGI/
• Mandriva/Suse/Fedora/Redhat RPM from Dries - http://dries.ulyssis.org/ayo/packages/perl-FCGI/info.html
• Debian - http://packages.debian.org/search?searchon=names&keywords=libfcgi-perl
• Ubuntu - http://packages.ubuntu.com/search?searchon=names&keywords=libfcgi-perl

Apache

Apache Module

There are two options that basicly do the same thing

• mod_fastcgi which is the oldest implementation. It is released under a custom non-free license but it is free of charge.
• mod_fcgid which is the newer implementation released under the GPL license and now part of the Apache Foundation.

It is difficult to recommend one or the other. In some cases one will work and the other will not. Most positive reports have been with mod_fcgidbut both have been tested and work with standard out-of-the-box Apache and Foswiki setups. mod_fcgid is easier to find as package because of its GPL license so it may be the best place to start. Fedora has mod_fcgid on the installation DVD now.

Below are some resources for the most common Linux distributions. The actual versions of the latest packages may have changed since this documentation was written.

mod_fcgid resources

• Sources - http://httpd.apache.org/mod_fcgid/
• RedHat/Centos EL5 64 bit - http://centos.karan.org/el5/extras/testing/x86_64/RPMS/mod_fcgid-2.2-4.el5.kb.x86_64.rpm
• RedHat/Centos EL5 32 bit - http://centos.karan.org/el5/extras/testing/i386/RPMS/mod_fcgid-2.2-4.el5.kb.i386.rpm
• Debian - http://packages.debian.org/search?searchon=names&keywords=libapache2-mod-fcgid

mod_fastcgi resources

• RedHat/Centos - http://rugmonster.org/2009/03/building-mod_fastcgi-on-rhel5/ and http://www.nagare.org/trac/blog/apache_mod_fastcgi
• Debian - http://packages.debian.org/unstable/httpd/libapache2-mod-fastcgi

Apache Configuration

Using only .htaccess

Using only .htaccess file it's not possible to control the number of FastCGI processes, nor the user it'll be run with. We assume the webserver is configured to recognize files with .fcgi extension to be FastCGI scripts. We also need mod_rewrite or mod_actions enabled.

Examples

Using mod_rewrite:

# bin/.htaccess file

Options +ExecCGI

RewriteEngine On

# configure script is a special case, it must run as a CGI script:
RewriteCond %{REQUEST_URI} !/configure 

# avoid loops:
RewriteCond %{REQUEST_URI} !/foswiki.fcgi

RewriteRule ^(.*) /foswiki/bin/foswiki.fcgi/$1

<Files configure>
    SetHandler cgi-script
</Files>

Using mod_actions:

# bin/.htaccess file

Options +ExecCGI

Action foswiki-fcgid /foswiki/bin/foswiki.fcgi
SetHandler foswiki-fcgid

<Files configure>
    SetHandler cgi-script
</Files>

<Files foswiki.fcgi>
   SetHandler fcgid-script
</Files>

Using apache .conf

Direct access to Apache configuration files open more possibilities than with .htaccess, such as:

• Configurable number of FastCGI processes
• With mod_fastcgi:
  • Use remote FastCGI processes to service requests
    • This might be possible under mod_fcgid using a custom wrapper script with the FcgidWrapper directive and the virtual flag
  • Control the user the FastCGI processes run under

Using mod_fastcgi

We can use static or dynamic servers: static servers are initialized with Apache itself and exists as long Apache is running. Dynamic servers are loaded on demand and killed if the aren't needed anymore.

See mod_fastcgi documentation for more options.

# Simple and traditional example.
Alias /foswiki/bin/configure /var/www/foswiki/bin/configure
Alias /foswiki/bin   /var/www/foswiki/bin/foswiki.fcgi

# Commenting the next line makes foswiki to be a dynamic server, loaded on demand
FastCgiServer /var/www/foswiki/bin/foswiki.fcgi -processes 3

<Directory /var/www/foswiki/bin>
   Options +ExecCGI
    <Files configure>
        SetHandler cgi-script
    </Files>
    <Files foswiki.fcgi>
        SetHandler fastcgi-script
    </Files>
</Directory>

Refer to tuning section below for a little discussion about the number of FastCGI processes.

# External server: could be running at another machine and/or a different user from the webserver

Alias /foswiki/bin/configure /var/www/foswiki/bin/configure
Alias /foswiki/bin   /var/www/foswiki/bin/foswiki.fcgi

# Running an external server on the same machine:
FastCgiExternalServer /var/www/foswiki/bin/foswiki.fcgi -socket /path/to/foswiki.sock

# Or at another machine:
FastCgiExternalServer /var/www/foswiki/bin/foswiki.fcgi -host example.com:8080

<Directory /var/www/foswiki/bin>
    Options +ExecCGI
    <Files configure>
        SetHandler cgi-script
    </Files>
    <Files foswiki.fcgi>
        SetHandler fastcgi-script
    </Files>
</Directory>

When you're using external servers you must run the FastCGI processes manually:

$ cd /var/www/foswiki/bin
# To start a pool of processes, listening to a local UNIX socket:
$ ./foswiki.fcgi --listen /path/to/foswiki.sock --nproc 3 --pidfile /path/to/pidfile.pid --daemon
# Or listening to a local :port address:
$ ./foswiki.fcgi --listen :port --nproc 3 --pidfile /path/to/pidfile.pid --daemon

Run ./foswiki.fcgi --help for details on the options.

Using mod_fcgid

Comparison to mod_fastcgi:

• Compatible API from Foswiki's point of view, drop-in replacement
• Maintained as a part of the standard Apache httpd distribution
• Does not itself provide a mechanism to run the FastCGI processes as a different user (possible through other means)
• mod_fcgid documentation suggests that only dynamic servers are supported
• No (easy) way to use FastCGI processes running on another machine; but it might be possible with a custom wrapper script and the FcgidWrapper directive with the virtual flag

# Simple and traditional example.
Alias /foswiki/bin/configure /var/www/foswiki/bin/configure
Alias /foswiki/bin   /var/www/foswiki/bin/foswiki.fcgi

<Directory /var/www/foswiki/bin>
   Options +ExecCGI
    <Files configure>
        SetHandler cgi-script
    </Files>
    <Files foswiki.fcgi>
        SetHandler fcgid-script
    </Files>
</Directory>

ApacheLogin

If you use ApacheLogin instead of TemplateLogin you'll need to add something like the following directives:

<LocationMatch "^/+foswiki/+bin/+(attach|edit|manage|rename|save|upload|.*auth|rest|login|logon)">
   AuthType Basic
   AuthName "Foswiki login realm"
   AuthUserFile "/var/www/foswiki/data/.htpasswd"
   Require valid-user
</LocationMatch>

Lighttpd

You need to load both mod_cgi and mod_fastcgi. The first is used to run configure script?. From what I understood from the documentation, lighttpd doesn't support dynamic servers.

# Example with FastCGI processes launched by the webserver
$HTTP["url"] =~ "^/foswiki/bin/configure" {
    alias.url += ( "/foswiki/bin" => "/var/www/foswiki/bin" )
    cgi.assign = ( "" => "" )
}

$HTTP["url"] =~ "^/foswiki/bin/" {
    alias.url += ( "/foswiki/bin" => "/var/www/foswiki/bin/foswiki.fcgi" )
    fastcgi.server = ( ".fcgi" => (
            (
                "socket"    => "/var/www/foswiki/working/tmp/foswiki.sock",
                "bin-path"  => "/var/www/foswiki/bin/foswiki.fcgi",
                "max-procs" => 3
            ),
        )
    )
}

# Example with external FastCGI processes (running on the same host, with another user or at a remote machine)
$HTTP["url"] =~ "^/foswiki/bin/configure" {
    alias.url += ( "/foswiki/bin" => "/var/www/foswiki/bin" )
    cgi.assign = ( "" => "" )
}

$HTTP["url"] =~ "^/foswiki/bin/" {
    alias.url += ( "/foswiki/bin" => "/var/www/foswiki/bin/foswiki.fcgi" )
    fastcgi.server = ( ".fcgi" => (
            (
                "host"    => "example.com",
                "port"    => "8080",
            ),
        )
    )
}

Nginx

In contrast to Apache or Lighttpd Nginx does not control the life time of the foswiki.fcgi backend process. Instead you will have to start it yourself using the system's init process. The FCGI::ProcManager class will then take care of (re-)spawning enough child processes as required.

First, let's configure nginx to contact a foswiki.fcgi process on some socket on the localhost:

server {
...
  root /var/www/foswiki;

  location = / {
    try_files $uri @foswiki;
  }

  location ~ ^/(?:/foswiki/bin/)?([A-Z_].*)$ {
    rewrite ^/(.*)$ /foswiki/bin/view/$1;
  }

  location ~ ^/pub/(System|Applications|images|cache)/ {
    expires 8h;
    gzip_static on;
  }

  location /pub {
    rewrite ^/pub/(.*)$ /foswiki/bin/viewfile/$1;
  }

  location /foswiki/bin {
    try_files $uri @foswiki;
  }

  location @foswiki {
     gzip off;

     fastcgi_pass 127.0.0.1:9000; 

     fastcgi_split_path_info ^/foswiki/bin/(.+?)(/.*)$;
     fastcgi_param SCRIPT_FILENAME /var/www/foswiki/bin/foswiki.fcgi;
     fastcgi_param PATH_INFO $fastcgi_path_info;

     include fastcgi_params;
  }

  location ~ (^/lib|^/data|^/locale|^/templates|^/tools|^/work) {
     deny all;
  }

...
}

Next, to integrate the foswiki.fgi process into the system's init process use the two helper scripts in the tools directory:

• foswiki.init-script: copy this to /etc/init.d/foswiki; make the file executable using chmod +x /etc/init.d/foswiki
• foswiki.defaults: copy this to /etc/defaults/foswiki and make appropriate adjustmenst; make sure the process uses the same socket as configured in nginx (see above, defaults to 127.0.0.1:9000)

You should now be able to control the backend processes using service foswiki start/stop/reload/restart/status.

Finally, add the service to the runlevels using update-rc.d foswiki defaults to make sure the service is started on system startup time.

Tuning

Except from Apache using only .htaccess file, it's possible to adjust the number of FastCGI processes. There is no magic number: it depends on some variables, like the hardware resources and access load. If you set this number too low, users may experience high latencies and you'll not use all hardware potential, on the other hand if this setting is adjusted too high then the server can be forced to use swap, what degrades performance a lot.

Dynamic servers are more useful when Foswiki access load on the server is low and/or it's used for something in addition to Foswiki. Under high loads, static servers can deliver better performance.

Known Issues

FastCGI specification defines an authorizer role besides the common used responder. Foswiki, by default, doesn't check access to attachments, unless you use viewfile? script. The problem with that script is that it's slow and resource-hungry. In future releases, this contrib will provide a way to add access checks to attachments with very little overhead, using the authorizer role.

Info

Author(s)	Gilmar Santos Jr
Copyright	© 2008-2014 Gilmar Santos Jr and Foswiki Contributors
License:	GPL (Gnu General Public License)
Release:	0.95
Version:	0.95
Change History:
20 Feb 2014	(0.96) Foswikitask:Item12755 - fixed socket not being closed properly on a reExec; work around error in FCGI.pm; added quiet parameter to suppress normal messages; fixed tainted pid filename;
08 Sep 2011	(0.95) Foswikitask:Item9957 - remove uninitialised value log message
26 Oct 2010	(0.94) Foswikitask:Item9902 - Adding more resources about how to get and install CPAN lib and mod_fcgid or mod_fastcgi. Also includes temporary fix from Foswikitask:Item1515: added maxRequests to ease memory leaks and fix for Foswikitask:Item9456: Taint error with foswiki.fcgi
17 Sep 2010	(0.93) Foswikitask:Item9701 - Documentation update, suggest mod_fcgid preferred over mod_fastcgi
03 Sep 2010	Foswikitask:Item9456 - Taint error, Foswikitask:Item9390 - LocalSite.cfg error handling, Foswikitask:Item8765 - Perl coding issue, Foswikitask:Item1315 - Support information
21 Dec 2009	Foswiki:Main.ItaloValcy: fix Foswikitask:Item8238
24 Jan 2009	Documentation enhancements and some fixes (Foswikitask:Item853)
25 Dec 2008	Initial Release
Dependencies:	Name Version Description FCGI >0.67 FastCGI perl library File::Spec >0 This module is shipped as part of standard perl Cwd >0 This module is shipped as part of standard perl POSIX >0 This module is shipped as part of standard perl Getopt::Long >2.37 Extended processing of command line options Pod::Usage >1.35 print a usage message from embedded pod documentation
Home page:	http://foswiki.org/Extensions/FastCGIEngineContrib
Support:	http://foswiki.org/Support/FastCGIEngineContrib