PHP¶

Manage system PHP versions and per-version settings.

All endpoints below are mounted under /api. Authentication: Authorization: Bearer <token> unless noted as public.

Endpoint count: 10

Endpoints¶

Method	Path	Handler	Guards
`GET`	`/api/php/:version/config`	`getPHPConfig`	RequirePermission(db, "administrative_operations")
`POST`	`/api/php/:version/config`	`setPHPConfig`	RequirePermission(db, "administrative_operations")
`GET`	`/api/php/:version/ioncube`	`getIonCubeStatus`	RequirePermission(db, "administrative_operations")
`POST`	`/api/php/:version/ioncube/install`	`installIonCube`	RequirePermission(db, "administrative_operations")
`POST`	`/api/php/:version/ioncube/remove`	`removeIonCube`	RequirePermission(db, "administrative_operations")
`GET`	`/api/php/:version/modules`	`getPHPModules`	RequirePermission(db, "administrative_operations")
`POST`	`/api/php/:version/modules/install`	`installPHPModule`	RequirePermission(db, "administrative_operations")
`POST`	`/api/php/:version/modules/remove`	`removePHPModule`	RequirePermission(db, "administrative_operations")
`POST`	`/api/php/:version/restart`	`restartPHPFPM`	RequirePermission(db, "administrative_operations")
`GET`	`/api/php/:version/websites`	`getPHPWebsites`	RequirePermission(db, "administrative_operations")

Source¶

Handlers for this section live in api/routes/handlers_*.go in the StarkOne source. Each handler binds its request body with gin.ShouldBindJSON(&req) and responds with the standard envelope:

{ "data": { ... } }

On error:

{ "error": { "code": "string", "message": "string" } }

Note: the PHP handlers in this section return flat (non-enveloped) JSON bodies - they do not wrap their success payloads in the { "data": {...} } envelope. Each block below shows the actual shape returned by the source.

Reference¶

`GET /api/php/:version/config`¶

Returns the StarkOne-managed PHP settings for a version by parsing /etc/php/:version/fpm/conf.d/99-starkone.ini.

Guards: RequirePermission(db, "administrative_operations")

Path parameters

Name	Type	Description
`version`	string	PHP version, e.g. `8.2`. Used to locate `/etc/php/<version>/fpm/conf.d/99-starkone.ini`.

Response - 200 OK

Flat map of setting keys to string values. Keys come from the INI file with dots replaced by underscores (e.g. date.timezone becomes date_timezone). A custom key (string "true"/"false") indicates whether a StarkOne-managed INI file exists. If the file is absent, only custom is returned.

{
  "memory_limit": "256M",
  "upload_max_filesize": "64M",
  "date_timezone": "UTC",
  "custom": "true"
}

Example

curl https://panel.example.com:2087/api/php/8.2/config \
  -H "Authorization: Bearer $TOKEN"

`POST /api/php/:version/config`¶

Writes a StarkOne-managed INI file (99-starkone.ini) for both the FPM and CLI SAPIs of a PHP version from the supplied settings.

Guards: RequirePermission(db, "administrative_operations")

Path parameters

Name	Type	Description
`version`	string	PHP version, e.g. `8.2`.

Request body

A free-form JSON object. Only the recognized keys below are written to the INI file; each is optional and is emitted only when present and non-empty. Unrecognized keys are ignored.

{
  "memory_limit": "256M",
  "upload_max_filesize": "64M",
  "post_max_size": "64M",
  "max_execution_time": "120",
  "max_input_time": "120",
  "max_input_vars": "5000",
  "display_errors": "Off",
  "error_reporting": "E_ALL",
  "log_errors": "On",
  "date_timezone": "UTC",
  "session_gc_maxlifetime": "1440",
  "opcache_enable": "1",
  "opcache_memory_consumption": "128",
  "realpath_cache_size": "4096k",
  "allow_url_fopen": "On"
}

Field	Type	Required	Description
`memory_limit`	string	no	Maps to `memory_limit`.
`upload_max_filesize`	string	no	Maps to `upload_max_filesize`.
`post_max_size`	string	no	Maps to `post_max_size`.
`max_execution_time`	string	no	Maps to `max_execution_time`.
`max_input_time`	string	no	Maps to `max_input_time`.
`max_input_vars`	string	no	Maps to `max_input_vars`.
`display_errors`	string	no	Maps to `display_errors`.
`error_reporting`	string	no	Maps to `error_reporting`.
`log_errors`	string	no	Maps to `log_errors`.
`date_timezone`	string	no	Maps to `date.timezone`.
`session_gc_maxlifetime`	string	no	Maps to `session.gc_maxlifetime`.
`opcache_enable`	string	no	Maps to `opcache.enable`.
`opcache_memory_consumption`	string	no	Maps to `opcache.memory_consumption`.
`realpath_cache_size`	string	no	Maps to `realpath_cache_size`.
`allow_url_fopen`	string	no	Maps to `allow_url_fopen`.

Response - 200 OK

{ "success": true, "message": "PHP 8.2 configuration saved" }

Errors

Status	Code	Meaning
`400`	`bad_request`	Request body could not be parsed as JSON.
`500`	`write_error`	Failed to write the FPM INI file.

Side effects

Creates /etc/php/:version/fpm/conf.d and /etc/php/:version/cli/conf.d if missing.
Writes 99-starkone.ini (mode 0644) into both the FPM and CLI conf.d directories. The CLI write failure is ignored.

Example

curl -X POST https://panel.example.com:2087/api/php/8.2/config \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"memory_limit": "256M", "upload_max_filesize": "64M"}'

`GET /api/php/:version/ioncube`¶

Reports whether the ionCube loader is installed for a PHP version and, if so, its loader version.

Guards: RequirePermission(db, "administrative_operations")

Path parameters

Name	Type	Description
`version`	string	PHP version, e.g. `8.2`.

Response - 200 OK

installed is determined by the presence of the ionCube INI file (Debian: /etc/php/:version/mods-available/ioncube.ini; RHEL: /etc/opt/remi/php<verNoDot>/php.d/00-ioncube.ini). When installed, version is the output of ioncube_loader_version() run via the version's PHP binary (empty string if that call fails).

{ "installed": true, "version": "13.0" }

Side effects

When installed, executes the PHP CLI binary with -r "echo ioncube_loader_version();" to read the loader version.

Example

curl https://panel.example.com:2087/api/php/8.2/ioncube \
  -H "Authorization: Bearer $TOKEN"

`POST /api/php/:version/ioncube/install`¶

Installs the ionCube loader for a PHP version: downloads the loader bundle if needed, copies the matching .so into the extension directory, writes the enabling INI, and restarts PHP-FPM.

Guards: RequirePermission(db, "administrative_operations")

Path parameters

Name	Type	Description
`version`	string	PHP version, e.g. `8.2`. Selects the loader file `ioncube_loader_lin_<version>.so`.

Request body

None.

Response - 200 OK

{ "success": true, "message": "ionCube installed for PHP 8.2" }

Errors

Status	Code	Meaning
`400`	`version_not_supported`	No ionCube loader `.so` is available for the requested PHP version.
`500`	`download_failed`	Downloading/extracting the ionCube loader bundle failed.
`500`	`copy_failed`	Copying the loader `.so` into the extension directory failed.
`500`	`ini_failed`	Writing the enabling INI file failed.

Side effects

If /opt/ioncube is missing, downloads ioncube_loaders_lin_x86-64.tar.gz from downloads.ioncube.com into /tmp/ioncube_download, extracts it, and moves it to /opt/ioncube.
Copies the loader .so into the PHP extension directory (resolved from php<version> -i on Debian, or /opt/remi/php<verNoDot>/root/usr/lib64/php/modules on RHEL).
Writes ioncube.ini (Debian: under mods-available, then symlinks 00-ioncube.ini into the FPM and CLI conf.d dirs; RHEL: writes /etc/opt/remi/php<verNoDot>/php.d/00-ioncube.ini).
Restarts the version's PHP-FPM service via systemctl restart.

Example

curl -X POST https://panel.example.com:2087/api/php/8.2/ioncube/install \
  -H "Authorization: Bearer $TOKEN"

`POST /api/php/:version/ioncube/remove`¶

Removes the ionCube loader configuration for a PHP version and restarts PHP-FPM.

Guards: RequirePermission(db, "administrative_operations")

Path parameters

Name	Type	Description
`version`	string	PHP version, e.g. `8.2`.

Request body

None.

Response - 200 OK

{ "success": true, "message": "ionCube removed from PHP 8.2" }

Side effects

Debian: removes the FPM and CLI 00-ioncube.ini symlinks and the mods-available/ioncube.ini file.
RHEL: removes /etc/opt/remi/php<verNoDot>/php.d/00-ioncube.ini.
Restarts the version's PHP-FPM service via systemctl restart. File removals and the restart errors are not surfaced; this handler always returns 200.

Example

curl -X POST https://panel.example.com:2087/api/php/8.2/ioncube/remove \
  -H "Authorization: Bearer $TOKEN"

`GET /api/php/:version/modules`¶

Lists the installed and available (not-yet-installed) PHP extension modules for a version, using the OS package manager.

Guards: RequirePermission(db, "administrative_operations")

Path parameters

Name	Type	Description
`version`	string	PHP version, e.g. `8.2`.

Response - 200 OK

installed and available are arrays of short module names (e.g. mysql), derived by stripping the php<version>- / php<verNoDot>-php- package prefix. The pseudo-modules fpm, cli, and common are excluded.

{
  "installed": ["mysql", "gd", "curl"],
  "available": ["redis", "imagick"]
}

Side effects

Read-only package queries: dpkg -l and apt-cache search on Debian; rpm -qa and dnf search on RHEL.

Example

curl https://panel.example.com:2087/api/php/8.2/modules \
  -H "Authorization: Bearer $TOKEN"

`POST /api/php/:version/modules/install`¶

Installs a single PHP extension module via the OS package manager.

Guards: RequirePermission(db, "administrative_operations")

Path parameters

Name	Type	Description
`version`	string	PHP version, e.g. `8.2`.

Request body

{ "module": "string (required)" }

Field	Type	Required	Description
`module`	string	yes	Short module name, e.g. `redis`. Combined with the version into a package name (Debian: `php<version>-<module>`; RHEL: `php<verNoDot>-php-<module>`).

Response - 200 OK

{ "success": true, "message": "Module redis installed" }

Errors

Status	Code	Meaning
`400`	`bad_request`	Body missing/invalid, or `module` not provided.
`500`	`install_failed`	The package-manager install command failed; the combined command output is returned in `message`.

Side effects

Runs apt-get install -y <pkg> (Debian) or dnf install -y <pkg> (RHEL).

Example

curl -X POST https://panel.example.com:2087/api/php/8.2/modules/install \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"module": "redis"}'

`POST /api/php/:version/modules/remove`¶

Removes a single PHP extension module via the OS package manager.

Guards: RequirePermission(db, "administrative_operations")

Path parameters

Name	Type	Description
`version`	string	PHP version, e.g. `8.2`.

Request body

{ "module": "string (required)" }

Field	Type	Required	Description
`module`	string	yes	Short module name, e.g. `redis`. Combined with the version into a package name (Debian: `php<version>-<module>`; RHEL: `php<verNoDot>-php-<module>`).

Response - 200 OK

{ "success": true, "message": "Module redis removed" }

Errors

Status	Code	Meaning
`400`	`bad_request`	Body missing/invalid, or `module` not provided.
`500`	`remove_failed`	The package-manager remove command failed; the combined command output is returned in `message`.

Side effects

Runs apt-get remove -y <pkg> (Debian) or dnf remove -y <pkg> (RHEL).

Example

curl -X POST https://panel.example.com:2087/api/php/8.2/modules/remove \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"module": "redis"}'

`POST /api/php/:version/restart`¶

Restarts the PHP-FPM service for a PHP version.

Guards: RequirePermission(db, "administrative_operations")

Path parameters

Name	Type	Description
`version`	string	PHP version, e.g. `8.2`. Maps to service `php<version>-fpm` (Debian) or `php<verNoDot>-php-fpm` (RHEL).

Request body

None.

Response - 200 OK

{ "success": true, "message": "PHP 8.2 FPM restarted" }

Errors

Status	Code	Meaning
`500`	`restart_failed`	The `systemctl restart` command failed; the combined command output is returned in `message`.

Side effects

Runs systemctl restart <service> for the version's PHP-FPM service.

Example

curl -X POST https://panel.example.com:2087/api/php/8.2/restart \
  -H "Authorization: Bearer $TOKEN"

`GET /api/php/:version/websites`¶

Lists the websites (web apps) configured to use a given PHP version, read from the webapps database table.

Guards: RequirePermission(db, "administrative_operations")

Path parameters

Name	Type	Description
`version`	string	PHP version, e.g. `8.2`. Matched against the `php_ver` column of the `webapps` table.

Response - 200 OK

websites is an array of objects with id (int), domain (string), and username (string).

{
  "websites": [
    { "id": 1, "domain": "example.com", "username": "user1" }
  ]
}

Errors

Status	Code	Meaning
`500`	`db_error`	The database query against `webapps` failed.

Example

curl https://panel.example.com:2087/api/php/8.2/websites \
  -H "Authorization: Bearer $TOKEN"

PHP¶

Endpoints¶

Source¶

Reference¶

GET /api/php/:version/config¶

POST /api/php/:version/config¶

GET /api/php/:version/ioncube¶

POST /api/php/:version/ioncube/install¶

POST /api/php/:version/ioncube/remove¶

GET /api/php/:version/modules¶

POST /api/php/:version/modules/install¶

POST /api/php/:version/modules/remove¶

POST /api/php/:version/restart¶

GET /api/php/:version/websites¶

`GET /api/php/:version/config`¶

`POST /api/php/:version/config`¶

`GET /api/php/:version/ioncube`¶

`POST /api/php/:version/ioncube/install`¶

`POST /api/php/:version/ioncube/remove`¶

`GET /api/php/:version/modules`¶

`POST /api/php/:version/modules/install`¶

`POST /api/php/:version/modules/remove`¶

`POST /api/php/:version/restart`¶

`GET /api/php/:version/websites`¶