memory_limit = 256M
upload_max_filesize = 64M
post_max_size = 64M
max_execution_time = 300
expose_php = Off
date.timezone = Asia/Muscat

; CVE-2026-109619 mitigation (CERT-EU SA 2026-018): upload-progress tracking writes
; attacker-controlled data into native sessions (filemst, subpayment). Nothing polls
; it. Only effective here or in the FPM pool, not via ini_set()/.user.ini.
session.upload_progress.enabled = 0

; Match the XAMPP/dev error policy: legacy code paths raise PHP 8 warnings and
; deprecations (undefined array keys, null args); without this the app's
; web/index.php non-dev branch leaves error_reporting at E_ALL and Yii turns
; every warning into a 500. Errors still go to the log, never to the response.
error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT & ~E_NOTICE & ~E_WARNING
display_errors = Off
log_errors = On

opcache.enable = 1
opcache.memory_consumption = 64
opcache.max_accelerated_files = 8000
; Code is bind-mounted and edited on the host — revalidate, but not on every
; request: each stat crosses the Windows->WSL2 file bridge and a Yii request
; touches hundreds of files. 2s keeps edits near-instant without the stat storm.
opcache.validate_timestamps = 1
opcache.revalidate_freq = 2