v0.29.5

docs/PHP_FPM.md

@@ -123,7 +123,7 @@ post_max_size = 64M
 max_execution_time = 30
 ```
 
-RustProxy validates the lines and combines them with newline separators into the FastCGI `PHP_VALUE` parameter. PHP-FPM/PHP still decides whether a directive is changeable at this scope. `PHP_ADMIN_VALUE` is intentionally not exposed. Control characters/newlines inside names or values are rejected.
+RustProxy validates the lines and combines them with newline separators into the FastCGI `PHP_VALUE` parameter. PHP-FPM/PHP still decides whether a directive is changeable at this scope. `PHP_ADMIN_VALUE` is available separately through the validated administrator INI overrides for trusted PHP-FPM endpoints. Control characters/newlines inside names or values are rejected.
 
 These custom parameters are stored as normal Web Service configuration. Do not put secrets there unless normal configuration storage is an acceptable location for them.
 
@@ -139,6 +139,35 @@ $uri/
 
 Existing static files/directories are used first. The final path becomes the fallback and can therefore reach `index.php`. This resolution remains inside the already-selected Web Service and does not introduce a second vhost router.
 
+## Roundcube 1.7 static.php / PATH_INFO (0.29.5)
+
+Roundcube serves CSS, JavaScript and images through URLs such as
+`/static.php/skins/elastic/styles/styles.min.css?s=123`. These paths are
+**PHP-FPM requests to the existing** `public_html/static.php` **script**, not
+static filesystem lookups. Configure the selected Web Service (or attached
+shared PHP-FPM profile) with `php.enabled: true`, `php.path_info: true`, and
+`php.extensions: ["php"]`. Point its root to the Roundcube `public_html` tree.
+
+You can keep the normal Web Service `try_files` (`$uri`, `$uri/`,
+`/index.php?$query_string`). RustProxy 0.29.5 resolves a valid PHP script plus
+PATH_INFO after security checks and rewrites, **before** falling back through
+`try_files`. No regex rewrite or extra Web Service is required for these URLs
+when the main vhost selects this Web Service.
+
+For `/static.php/skins/elastic/images/favicon.ico?s=123`, FastCGI receives:
+
+```text
+SCRIPT_NAME=/static.php
+SCRIPT_FILENAME=<document_root>/static.php
+PATH_INFO=/skins/elastic/images/favicon.ico
+REQUEST_URI=/static.php/skins/elastic/images/favicon.ico?s=123
+QUERY_STRING=s=123
+```
+
+PHP-FPM still needs filesystem access to `static.php` and the Roundcube
+installation outside `public_html` that script reads. The PHP `PATH_INFO`
+option is explicit and remains off by default for unrelated services.
+
 ## Bounded execution
 
 Each compiled Web Service owns a bounded PHP concurrency semaphore. `max_concurrent_requests` limits simultaneous FastCGI requests. RustProxy does not create an unbounded wait queue: if no execution slot is immediately available it returns `503 Service Unavailable` with `Retry-After`.