; PreAuth php.ini overrides — merged on top of the FrankenPHP base image
; defaults.
;
; The base image ships no php.ini (only the php.ini-production template), so
; the production switches that matter are stated explicitly here rather than
; inherited — verified against a real boot: without them the response carries
; `X-Powered-By: PHP/8.5.10` and errors would render into the body.
;
; PreAuth keeps its session state in APCu plus a filesystem cache pool, so the
; settings that matter most are the cache ones.

; Never advertise the interpreter, never print errors to the client. This is
; an authentication gateway: a stack trace in a 500 body is an information
; leak. Errors go to stderr for the log collector.
expose_php = Off
display_errors = Off
log_errors = On
error_log = /proc/self/fd/2

memory_limit = 256M
upload_max_filesize = 2M
post_max_size = 8M

; OPcache for the FrankenPHP worker: the image is immutable, so timestamps
; never need revalidating. The CLI console also runs the app, hence
; enable_cli = 1.
opcache.enable = 1
opcache.enable_cli = 1
opcache.validate_timestamps = 0
opcache.memory_consumption = 128
opcache.interned_strings_buffer = 16
opcache.max_accelerated_files = 20000

; APCu — nonce cache, rate limiter and session cache all live in it, and the
; console needs it too (`bin/console` commands manage cache state).
apc.enabled = 1
apc.enable_cli = 1
apc.shm_size = 64M
apc.ttl = 0

date.timezone = UTC