How to use redis for session storage

zcourts

I've posted this on Stackoverflow already but posting here directly in case. We're deploying flarum in Kubernetes and want to use redis for session storage so we can have multiple replicas.
Redis extensions is loaded, session_handler is set and phpinfo shows this but flarum doesn't seem to use it.
If I add a test script that puts stuff into PHP's session it ends up in redis. So is flarum not using PHP's session, if so, is there some way to get it to use redis?

Original post content from Stackoverflow:

I've installed the php7-redis extension in an alpine container running in k8s.
Added a conf ini file that enables redis and sets the host.
This shows up in phpinfo's output but the app being deployed (flarum) doesn't seem to be saving its sessions to redis.
Basically needed because we want to run multiple replicas of flarum.

phpinfo output

session
Session Support	enabled
Registered save handlers	files user redis rediscluster
Registered serializer handlers	php_serialize php php_binary
Directive	Local Value	Master Value
session.auto_start	Off	Off
session.cache_expire	180	180
session.cache_limiter	nocache	nocache
session.cookie_domain	no value	no value
session.cookie_httponly	no value	no value
session.cookie_lifetime	0	0
session.cookie_path	/	/
session.cookie_samesite	no value	no value
session.cookie_secure	0	0
session.gc_divisor	1000	1000
session.gc_maxlifetime	1440	1440
session.gc_probability	1	1
session.lazy_write	On	On
session.name	PHPSESSID	PHPSESSID
session.referer_check	no value	no value
session.save_handler	redis	redis
session.save_path	tcp://flarum-redis-master:6379?auth=<redis-password>
session.serialize_handler	php	php
session.sid_bits_per_character	5	5
session.sid_length	26	26
session.upload_progress.cleanup	On	On
session.upload_progress.enabled	On	On
session.upload_progress.freq	1%	1%
session.upload_progress.min_freq	1	1
session.upload_progress.name	PHP_SESSION_UPLOAD_PROGRESS	PHP_SESSION_UPLOAD_PROGRESS
session.upload_progress.prefix	upload_progress_	upload_progress_
session.use_cookies	1	1
session.use_only_cookies	1	1
session.use_strict_mode	0	0
session.use_trans_sid	0	0

Can I deregister files user rediscluster leaving only redis or some other way force it to be used?
Can't see what option I've missed or why no sessions are being saved to redis.

I've tested it should be working by using this script

 <?php
session_start();
$count = isset($_SESSION['count']) ? $_SESSION['count'] : 1;
echo $count;
$_SESSION['count'] = ++$count;

After refreshing this test.php file session data shows up in redis. Is there something in flarum preventing its use?

FYI php-fpm in use with nginx

luceos

zcourts the snippet where you set anything in the session is outside of Flarum. So any session handler registered inside Flarum won't be used. How did you register redis with flarum?

Please look at Bokt/flarum-redis for an example with cache and queue.

zcourts

luceos

the snippet where you set anything in the session is outside of Flarum.

Do you mean this code snippet?

<?php
session_start();
$count = isset($_SESSION['count']) ? $_SESSION['count'] : 1;

If so, I know - I was only doing this to test if session entries show up in redis.

How did you register redis with flarum?

I haven't explicitly done so. I didn't know I had to. I assumed that doing:

session.save_handler = redis
session.save_path = "<REDIS_HOST>"

would cause it to use it automatically. My assumption here being flarum uses $_SESSION.

Please look at Bokt/flarum-redis for an example with cache and queue.

Thanks, I'll take a look at this. Likely use it too - my next task was looking into how to cache with Redis so this outta do the job.

luceos

zcourts Do you mean this code snippet?

Yeah, so executing that snippet using commandline might end up in redis if the change to session.save_handler was also made in the cli php.ini.

zcourts I haven't explicitly done so. I didn't know I had to.

Flarum binds the session handler to its service container (ioc), you are able to override that session handler by extending that binding as well. That way you might be able to re-use the native session handling mechanism, if a Laravel compatible driver for it exists (which is very likely).

zcourts

luceos right yup.
I executed that snippet in the browser. Didn't try from the command line.
Bare with me whilst I clarify my understanding. Our team is a Java/Rust/Python heavy one, this is the first time I've looked at PHP in about 8 years. If we have to build it we'll likely hire someone but if its simple enough I'll throw something together.

Thanks for the clarification on this. I found this in core https://github.com/flarum/core/blob/0a6c5217c11e625aab5deec05bf6a6caf31bfa0d/src/User/SessionServiceProvider.php#L31

   $this->app->alias('session.handler', SessionHandlerInterface::class);

Is that what you mean about binding session handler to its service container?
That is the SessionHandlerInterface from PHP itself correct? I see the use but no import so must be this?

A manual implementation would look like this give or take some tweaks. But as you've pointed out, Laravel actually has built in support.

It is mentioned in their docs here.
What I don't see is config/session.php that they mention. I checked flarum/flarum and flarum/core.

Are we able to use this by configuring laravel's session.php? If so, where in flarum is this file or an equivalent if such athing exists?

luceos

Based on your answer I am unsure how to proceed. There's a lot of knowledge in the area of Flarum that you miss. Flarum uses components from the Laravel framework, but not the entire skeleton; configuration files therefor aren't available.

If you want to see how to extend bindings from ioc you can look at bokt/flarum-redis. I think that extension could also use a redis based session override. A pull request or commissioned PR by someone here would be appreciated.

zcourts

I see. Okay, we'll look at that extension.
If we decide it'll be better to commission someone for this, what's the best approach to reaching interested parties from the Flarum ecosystem?

ctml

Glad to see someone else using flarum on kubernetes 🙂 If you make any headway on redis implementation please share. I do also run a multi-replica instance of flarum on kubernetes without redis, using sessionAffinity on the service to keep clients routing through the same pods (until and if they fail/reschedule) but a redis implementation would probably be ideal for other reasons as well.

For paid services you can create a request under /t/services

zcourts

I'll let you know about Redis. Didn't get to take a look at that extension yesterday. Will be Monday now before I do.

Thanks for the link to services. Will use it depending on Monday's assessment.

zcourts

I found a way out without an extension 😀.

Since we're in Kubernetes I found flarum stores session files in /flarum/app/storage/sessions so I mounted a shared volume there that all replicas can use. Testing so far has shown this works well.

We'll look at the redis extension in the coming weeks but this gives us a way to move to production without rushing development of a new redis extension.