Most novice Mautic users deploy Mautic using Apache and mod_php but higher performance and more scalable configurations do exist. Apache is a general-purpose web server that by default, runs in
mpm_prefork mode. MPM stands for Multi-Processing Module, describing the way that Apache handles incoming requests. In Prefork mode, Apache is process-driven and not event-driven. This means that each Apache process can only handle one connection at any given time.
- Even though it is the least scalable, the Prefork MPM is the default for Apache with many distributions as it is the most compatible with legacy apps. It supports “non-thread safe” processes such as mod_php, which is the default method of parsing PHP applications on an Apache server. Because mod_php runs PHP together with the Apache server process, it is impossible for multiple Apache processes to share memory, which is required for the Worker or Event MPM to function.
- The Worker MPM spawns a pool of threads under an Apache parent process and each thread (instead of process) can serve one connection. Worker is more performant than Prefork because a new process does not have to be started every time a connection is initiated, if there is an available thread.
- The Event MPM goes one step further by supporting
KeepAlivewhich means that a thread is left open for a connection unless it is idle for a longer period of time than the
KeepAliveTimeoutthreshold (by default 5 seconds but can be overridden in httpd.conf).
Starting with Apache 2.4,
mpm_event is the recommended MPM for Apache because it minimizes the frequency which an Apache thread has to be respawned to handle long-lived connections. It delivers even better performance than Worker, which provides an incremental improvement over Prefork.
Switching from mod_php to php-fpm as the execution mode makes PHP thread safe, opening up the possibility of using a different MPM than Prefork, or switching to different web server altogether such as NGINX. PHP-FPM runs an FPM pool separately from the web server to handle PHP requests, accepting connections through a TCP/IP port (default is 127.0.0.1:9000) or a Unix socket (e.g. /var/run/php/php7.3-fpm.sock).
PHP-FPM is a more modern way to deploy PHP applications because PHP can even reside in a separate container or virtual server from the web server. Unlike Apache, NGINX does not even support running PHP in the same process. Switching to PHP-FPM is a requirement to use NGINX as a web server for a PHP application, such as Mautic.
Based on the memory available on your server, the parameters for PHP-FPM can be tuned so that there are always a minimum number of child processes available to answer requests. This can be accomplished by either setting your PHP-FPM process management type to static, which always has a fixed number of child processes, or dynamic, and tuning the
pm.process_idle_timeout values for the PHP-FPM pool responding to Mautic requests. The optimal values are calculated based on the memory used by the Linux kernel and system services, each individual FPM child process, and the available physical RAM.
Carefully tuning these values will prevent either the underutilization or overutilization of RAM – both of which can cause serious performance issues. Underutilization causes the server to perform under its potential and respond to incoming requests slowly, or not at all when they timeout. Overutilization will cause the web server to crash and/or excessive paging to the swap file, resulting in the disk I/O thrashing.
What the advantage of hosting web applications such as Mautic using NGINX instead of Apache? NGINX uses an event-driven model to handle incoming HTTP requests which means it is much more efficient, especially at serving up static files such as HTML, CSS, JS, or images. This is a similar approach to Apache’s Event MPM with the additional performance benefits of NGINX as a lightweight web server that has a small memory footprint.
Sample NGINX Config for Hosting Mautic
Here a sample NGINX configuration file that can be used to host Mautic with NGINX. It redirects HTTP to HTTPS by default and assumes that your Mautic files reside at /var/www/html/ – the default webroot. Some distributions of NGINX, for example from the CentOS package manager may use a different, default webroot at /usr/share/nginx/html/.
It assumes you have obtained a Let’s Encrypt certificate for the Mautic hostname (i.e. subdomain) located at /etc/letsencrypt/live/mautic.example.com/ using Certbot. The configuration supports automatic certificate renewal as the /.well-known/ directory is set up to accept HTTP and HTTPS requests for the ACME challenge.
The SSL protocol versions and cipher suites follow the recommendations given by https://ssl-config.mozilla.org/ and result in an A+ (or A, if HSTS is disabled) at SSL Labs SSL Test as of the time of this writing.
You need to generate a Diffie-Hellman parameter file using the OpenSSL toolchain at /etc/nginx/dhparam.pem prior to loading the NGINX config.
openssl dhparam -out dhparams.pem 4096 > /etc/nginx/dhparam.pem
Also, if you want to be able to use TLS v1.3, the latest recommended version of TLS that is unbroken by exploits that affect older versions such as TLS v1.1, TLS v1.0, and SSL v3, you may need to install a newer version of NGINX (> 1.13.0) other than from your distribution’s default repositories.
- NGINX Stable for Ubuntu: https://launchpad.net/~ondrej/+archive/ubuntu/nginx
- NGINX Mainline for Ubuntu: https://launchpad.net/~ondrej/+archive/ubuntu/nginx-mainline
- NGINX Stable and Mainline for CentOS: http://nginx.org/en/linux_packages.html#RHEL-CentOS