CentOS - Sep 2017 - CentOS, PHP & OwnCloud/Nextcloud: the version dilemma

Hi,

I'm currently experimenting with OwnCloud and Nextcloud on a sandbox
CentOS 7 server. I've been using OwnCloud for the last two years for my
own purposes on a Slackware server, and I'm quite happy with it.

In my humble opinion, every admin who wants to host OwnCloud or
Nextcloud on a RHEL/CentOS server is confronted with a version dilemma.

1. CentOS 7 sports PHP 5.4, which has been officially EOL for quite some
time, but Red Hat will provide security update backports until 2024.
Which is fine.

2. Currently supported versions of Nextcloud (namely the 11.x and 12.x
branch) require a minimum of PHP 5.6. Which seems reasonable. But if I
pull in PHP 5.6 from Webtatic, for example, I only get the "official"
PHP support, which will end in 2018 for the 5.6 branch. And no security
backports.

3. The solution would be to go with Nextcloud 10, which only requires
PHP 5.4, and which is also provided in package form by EPEL. 'yum info
nextcloud' shows that the current EPEL version is 10.0.4... but a peek
on the Nextcloud homepage shows me that this version is officially
unsupported. Uh oh.

4. Some of the stuff I'm hosting on my CentOS 7 server (like CMSMS) is
not compatible with PHP 7.x versions.

So right now I don't see a solution for this. As far as I can see, the
"least evil" solution would be to pull in PHP 5.6 from Webtatic and go
for Nextcloud 11.x, and have an EOL for both around next summer.

I'd be curious if some of you are familiar with this sort of dilemma (I
guess so) and how you manage it.

Cheers,

Niki Kovacs
-- 
Microlinux - Solutions informatiques durables
7, place de l'?glise - 30730 Montpezat
Web  : http://www.microlinux.fr
Mail : info at microlinux.fr
T?l. : 04 66 63 10 32

-----Original Message-----
From: CentOS [mailto:centos-bounces at centos.org] On Behalf Of Nicolas Kovacs
Sent: den 19 september 2017 09:37
To: CentOS mailing list <centos at centos.org>
Subject: [CentOS] CentOS, PHP & OwnCloud/Nextcloud: the version dilemma

Hi,

I'm currently experimenting with OwnCloud and Nextcloud on a sandbox
CentOS 7 server. I've been using OwnCloud for the last two years for my
own purposes on a Slackware server, and I'm quite happy with it.

In my humble opinion, every admin who wants to host OwnCloud or
Nextcloud on a RHEL/CentOS server is confronted with a version dilemma.

1. CentOS 7 sports PHP 5.4, which has been officially EOL for quite some
time, but Red Hat will provide security update backports until 2024.
Which is fine.

2. Currently supported versions of Nextcloud (namely the 11.x and 12.x
branch) require a minimum of PHP 5.6. Which seems reasonable. But if I
pull in PHP 5.6 from Webtatic, for example, I only get the "official"
PHP support, which will end in 2018 for the 5.6 branch. And no security
backports.

3. The solution would be to go with Nextcloud 10, which only requires
PHP 5.4, and which is also provided in package form by EPEL. 'yum info
nextcloud' shows that the current EPEL version is 10.0.4... but a peek
on the Nextcloud homepage shows me that this version is officially
unsupported. Uh oh.

4. Some of the stuff I'm hosting on my CentOS 7 server (like CMSMS) is
not compatible with PHP 7.x versions.

So right now I don't see a solution for this. As far as I can see, the
"least evil" solution would be to pull in PHP 5.6 from Webtatic and go
for Nextcloud 11.x, and have an EOL for both around next summer.

I'd be curious if some of you are familiar with this sort of dilemma (I
guess so) and how you manage it.






Been there, still doing that.

At work we have an OC-server v9 running off of CentOS 7.3 on which I installed 
PHP 5.6. I don't dare installing PHP 7 in case something breaks.

On my own private OC at home, I have OC v10 running with PHP 7.0.
The only other service I have on that service is Piwigo which runs just fine 
with that php-version.

I agree however, everytime I want to mess with OC I get to do the php-dance...
Irritating, but I guess that's the deal if you want the stability and 
compatibility CentOS is offering.
--
//Sorin

Le 19/09/2017 ? 09:48, Sorin Srbu a ?crit?:
> I agree however, everytime I want to mess with OC I get to do the
php-dance...
> Irritating, but I guess that's the deal if you want the stability and 
> compatibility CentOS is offering.
This may be a very far-fetched idea, but here goes. I don't know much
about Docker, just fiddled around with it a couple hours in a VM. Since
I have to host various PHP applications with different requirements
(some require 5.4, some 5.6, some 7.0), I wonder if it would be a
solution in theory to host several PHP versions (e. g. several different
LAMP servers) on the same physical machine using Docker.

Any suggestions?

Niki

-- 
Microlinux - Solutions informatiques durables
7, place de l'?glise - 30730 Montpezat
Web  : http://www.microlinux.fr
Mail : info at microlinux.fr
T?l. : 04 66 63 10 32

Am 19.09.2017 um 09:36 schrieb Nicolas Kovacs <info at
microlinux.fr>:
> 
> I'm currently experimenting with OwnCloud and Nextcloud on a sandbox
> CentOS 7 server. I've been using OwnCloud for the last two years for my
> own purposes on a Slackware server, and I'm quite happy with it.
> 
> In my humble opinion, every admin who wants to host OwnCloud or
> Nextcloud on a RHEL/CentOS server is confronted with a version dilemma.
> 
> 1. CentOS 7 sports PHP 5.4, which has been officially EOL for quite some
> time, but Red Hat will provide security update backports until 2024.
> Which is fine.
> 
> 2. Currently supported versions of Nextcloud (namely the 11.x and 12.x
> branch) require a minimum of PHP 5.6. Which seems reasonable. But if I
> pull in PHP 5.6 from Webtatic, for example, I only get the
"official"
> PHP support, which will end in 2018 for the 5.6 branch. And no security
> backports.
Try to ask upstream (bugzilla) to evaluate an officially upgrade 
from 5.4 to 5.6, that would give you support until EOL of EL7.

--
LF

Le 19/09/2017 ? 13:41, Leon Fauster a ?crit?:
> Try to ask upstream (bugzilla) to evaluate an officially upgrade 
> from 5.4 to 5.6, that would give you support until EOL of EL7.
Unfortunately I don't have a Red Hat account, so I can't submit any bug
reports.

Niki

-- 
Microlinux - Solutions informatiques durables
7, place de l'?glise - 30730 Montpezat
Web  : http://www.microlinux.fr
Mail : info at microlinux.fr
T?l. : 04 66 63 10 32

On 09/19/2017 06:41 AM, Leon Fauster wrote:
> Am 19.09.2017 um 09:36 schrieb Nicolas Kovacs <info at
microlinux.fr>:
>>
>> I'm currently experimenting with OwnCloud and Nextcloud on a
sandbox
>> CentOS 7 server. I've been using OwnCloud for the last two years
for my
>> own purposes on a Slackware server, and I'm quite happy with it.
>>
>> In my humble opinion, every admin who wants to host OwnCloud or
>> Nextcloud on a RHEL/CentOS server is confronted with a version dilemma.
>>
>> 1. CentOS 7 sports PHP 5.4, which has been officially EOL for quite
some
>> time, but Red Hat will provide security update backports until 2024.
>> Which is fine.
>>
>> 2. Currently supported versions of Nextcloud (namely the 11.x and 12.x
>> branch) require a minimum of PHP 5.6. Which seems reasonable. But if I
>> pull in PHP 5.6 from Webtatic, for example, I only get the
"official"
>> PHP support, which will end in 2018 for the 5.6 branch. And no security
>> backports.
> 
> Try to ask upstream (bugzilla) to evaluate an officially upgrade 
> from 5.4 to 5.6, that would give you support until EOL of EL7.
Or, how about you just use SCLs .. that is what they are for:

http://mirror.centos.org/centos/7/sclo/x86_64/rh/rh-php56/

Or even

http://mirror.centos.org/centos/7/sclo/x86_64/rh/rh-php70/

See:

https://wiki.centos.org/SpecialInterestGroup/SCLo


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: OpenPGP digital signature
URL:
<http://lists.centos.org/pipermail/centos/attachments/20170919/99e71d90/attachment-0001.sig>

Am 2017-09-19 09:36, schrieb Nicolas Kovacs:
> Hi,
> 
> I'm currently experimenting with OwnCloud and Nextcloud on a sandbox
> CentOS 7 server. I've been using OwnCloud for the last two years for my
> own purposes on a Slackware server, and I'm quite happy with it.
> 
> In my humble opinion, every admin who wants to host OwnCloud or
> Nextcloud on a RHEL/CentOS server is confronted with a version dilemma.
> 
> 1. CentOS 7 sports PHP 5.4, which has been officially EOL for quite 
> some
> time, but Red Hat will provide security update backports until 2024.
> Which is fine.
> 
> 2. Currently supported versions of Nextcloud (namely the 11.x and 12.x
> branch) require a minimum of PHP 5.6. Which seems reasonable. But if I
> pull in PHP 5.6 from Webtatic, for example, I only get the
"official"
> PHP support, which will end in 2018 for the 5.6 branch. And no security
> backports.
> 
> 3. The solution would be to go with Nextcloud 10, which only requires
> PHP 5.4, and which is also provided in package form by EPEL. 'yum info
> nextcloud' shows that the current EPEL version is 10.0.4... but a peek
> on the Nextcloud homepage shows me that this version is officially
> unsupported. Uh oh.
> 
> 4. Some of the stuff I'm hosting on my CentOS 7 server (like CMSMS) is
> not compatible with PHP 7.x versions.
> 
> So right now I don't see a solution for this. As far as I can see, the
> "least evil" solution would be to pull in PHP 5.6 from Webtatic
and go
> for Nextcloud 11.x, and have an EOL for both around next summer.
> 
> I'd be curious if some of you are familiar with this sort of dilemma (I
> guess so) and how you manage it.

I'm not familiar with running PHP on CentOS at all.

IMO, the default PHP-RPMs are not designed to be used for anything as 
dynamic as Own or NextCloud (or just about any other PHP project that 
isn't already dead).

PHP has a completely different release-model than RHEL.

As such, the version of PHP that comes with RHEL will almost always be 
outdated.


RedHat knows this and it seems it's available via SCL (Software 
Collections).


There's this KB article about it:

https://access.redhat.com/solutions/2146821


The gist of this is:

"Resolution
PHP v7.0 is available , however PHP v7.1 is still not available. We are 
already tracking this in a Feature Request to include rh-php-71 under 
Bug 1435193.
PHP v7.0 was first made available for RHEL 6 & RHEL 7 via Red Hat 
Software Collections (RHSCL) v2.3 as the rh-php70 collection
RHEA-2016:2730 - Product Enhancement Advisory"


https://www.softwarecollections.org/en/scls/rhscl/rh-php70/


With PHP, I try to stay as close to upstream as possible.
If upstream EOLs a version, it's time to upgrade.

If you want something stable, don't run PHP.

On Tue, Sep 19, 2017 at 07:59:00PM +0200, rainer at ultra-secure.de
wrote:
> With PHP, I try to stay as close to upstream as possible.
> If upstream EOLs a version, it's time to upgrade.
> 
> If you want something stable, don't run PHP.
Unfortunately, with that philosophy but not much systems management
experience, you end up with custom-compiled and local installs of PHP
that get no security updates, particularly as you get version lock-in
by the web application developers, or when you have a sysadmin move on
to a new position or company.

I think the statement "If you want something stable, don't run
PHP" is
a very wise statement though.

-- 
Jonathan Billings <billings at negate.org>