Merge pull request #83896 from etu/slim-down-default-php-v3

PHP: Make the default package more sane [v3]

17 files changed, 1281 insertions, 926 deletions

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 635395257929..c9abac5851b5 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -178,6 +178,7 @@
 /nixos/tests/prometheus-exporters.nix                        @WilliButz
 
 # PHP
-/pkgs/development/interpreters/php  @etu
-/pkgs/top-level/php-packages.nix    @etu
-/pkgs/build-support/build-pecl.nix  @etu
+/doc/languages-frameworks/php.section.md @etu
+/pkgs/development/interpreters/php       @etu
+/pkgs/top-level/php-packages.nix         @etu
+/pkgs/build-support/build-pecl.nix       @etu
diff --git a/doc/languages-frameworks/php.section.md b/doc/languages-frameworks/php.section.md
new file mode 100644
index 000000000000..a302a9a7f87d
--- /dev/null
+++ b/doc/languages-frameworks/php.section.md
@@ -0,0 +1,112 @@
+# PHP
+
+## User Guide
+
+### Using PHP
+
+#### Overview
+
+Several versions of PHP are available on Nix, each of which having a
+wide variety of extensions and libraries available.
+
+The attribute `php` refers to the version of PHP considered most
+stable and thoroughly tested in nixpkgs for any given release of
+NixOS. Note that while this version of PHP may not be the latest major
+release from upstream, any version of PHP supported in nixpkgs may be
+utilized by specifying the desired attribute by version, such as
+`php74`.
+
+Only versions of PHP that are supported by upstream for the entirety
+of a given NixOS release will be included in that release of
+NixOS. See [PHP Supported
+Versions](https://www.php.net/supported-versions.php).
+
+Interactive tools built on PHP are put in `php.packages`; composer is
+for example available at `php.packages.composer`.
+
+Most extensions that come with PHP, as well as some popular
+third-party ones, are available in `php.extensions`; for example, the
+opcache extension shipped with PHP is available at
+`php.extensions.opcache` and the third-party ImageMagick extension at
+`php.extensions.imagick`.
+
+The different versions of PHP that nixpkgs provides is located under
+attributes named based on major and minor version number; e.g.,
+`php74` is PHP 7.4 with commonly used extensions installed,
+`php74base` is the same PHP runtime without extensions.
+
+#### Installing PHP with packages
+
+A PHP package with specific extensions enabled can be built using
+`php.withExtensions`. This is a function which accepts an anonymous
+function as its only argument; the function should take one argument,
+the set of all extensions, and return a list of wanted extensions. For
+example, a PHP package with the opcache and ImageMagick extensions
+enabled:
+
+```nix
+php.withExtensions (e: with e; [ imagick opcache ])
+```
+
+Note that this will give you a package with _only_ opcache and
+ImageMagick, none of the other extensions which are enabled by default
+in the `php` package will be available.
+
+To enable building on a previous PHP package, the currently enabled
+extensions are made available in its `enabledExtensions`
+attribute. For example, to generate a package with all default
+extensions enabled, except opcache, but with ImageMagick:
+
+```nix
+php.withExtensions (e:
+  (lib.filter (e: e != php.extensions.opcache) php.enabledExtensions)
+  ++ [ e.imagick ])
+```
+
+If you want a PHP build with extra configuration in the `php.ini`
+file, you can use `php.buildEnv`. This function takes two named and
+optional parameters: `extensions` and `extraConfig`. `extensions`
+takes an extension specification equivalent to that of
+`php.withExtensions`, `extraConfig` a string of additional `php.ini`
+configuration parameters. For example, a PHP package with the opcache
+and ImageMagick extensions enabled, and `memory_limit` set to `256M`:
+
+```nix
+php.buildEnv {
+  extensions = e: with e; [ imagick opcache ];
+  extraConfig = "memory_limit=256M";
+}
+```
+
+##### Example setup for `phpfpm`
+
+You can use the previous examples in a `phpfpm` pool called `foo` as
+follows:
+
+```nix
+let
+  myPhp = php.withExtensions (e: with e; [ imagick opcache ]);
+in {
+  services.phpfpm.pools."foo".phpPackage = myPhp;
+};
+```
+
+```nix
+let
+  myPhp = php.buildEnv {
+    extensions = e: with e; [ imagick opcache ];
+    extraConfig = "memory_limit=256M";
+  };
+in {
+  services.phpfpm.pools."foo".phpPackage = myPhp;
+};
+```
+
+##### Example usage with `nix-shell`
+
+This brings up a temporary environment that contains a PHP interpreter
+with the extensions `imagick` and `opcache` enabled.
+
+```sh
+nix-shell -p 'php.buildEnv { extensions = e: with e; [ imagick opcache ]; }'
+```
diff --git a/nixos/doc/manual/release-notes/rl-2009.xml b/nixos/doc/manual/release-notes/rl-2009.xml
index 998b116d69c2..280389fe69c8 100644
--- a/nixos/doc/manual/release-notes/rl-2009.xml
+++ b/nixos/doc/manual/release-notes/rl-2009.xml
@@ -128,6 +128,73 @@
      documentation for instructions.
     </para>
    </listitem>
+   <listitem>
+     <para>
+       Since this release there's an easy way to customize your PHP install to get a much smaller
+       base PHP with only wanted extensions enabled. See the following snippet installing a smaller PHP
+       with the extensions <literal>imagick</literal>, <literal>opcache</literal> and
+       <literal>pdo_mysql</literal> loaded:
+
+       <programlisting>
+environment.systemPackages = [
+(pkgs.php.buildEnv { extensions = pp: with pp; [
+    imagick
+    opcache
+    pdo_mysql
+  ]; })
+];</programlisting>
+
+       The default <literal>php</literal> attribute hasn't lost any extensions -
+       the <literal>opcache</literal> extension was added there.
+
+       All upstream PHP extensions are available under <package><![CDATA[php.extensions.<name?>]]></package>.
+     </para>
+     <para>
+       The updated <literal>php</literal> attribute is now easily customizable to your liking
+       by using extensions instead of writing config files or changing configure flags.
+
+       Therefore we have removed the following configure flags:
+
+       <itemizedlist>
+         <title>PHP <literal>config</literal> flags that we don't read anymore:</title>
+         <listitem><para><literal>config.php.argon2</literal></para></listitem>
+         <listitem><para><literal>config.php.bcmath</literal></para></listitem>
+         <listitem><para><literal>config.php.bz2</literal></para></listitem>
+         <listitem><para><literal>config.php.calendar</literal></para></listitem>
+         <listitem><para><literal>config.php.curl</literal></para></listitem>
+         <listitem><para><literal>config.php.exif</literal></para></listitem>
+         <listitem><para><literal>config.php.ftp</literal></para></listitem>
+         <listitem><para><literal>config.php.gd</literal></para></listitem>
+         <listitem><para><literal>config.php.gettext</literal></para></listitem>
+         <listitem><para><literal>config.php.gmp</literal></para></listitem>
+         <listitem><para><literal>config.php.imap</literal></para></listitem>
+         <listitem><para><literal>config.php.intl</literal></para></listitem>
+         <listitem><para><literal>config.php.ldap</literal></para></listitem>
+         <listitem><para><literal>config.php.libxml2</literal></para></listitem>
+         <listitem><para><literal>config.php.libzip</literal></para></listitem>
+         <listitem><para><literal>config.php.mbstring</literal></para></listitem>
+         <listitem><para><literal>config.php.mysqli</literal></para></listitem>
+         <listitem><para><literal>config.php.mysqlnd</literal></para></listitem>
+         <listitem><para><literal>config.php.openssl</literal></para></listitem>
+         <listitem><para><literal>config.php.pcntl</literal></para></listitem>
+         <listitem><para><literal>config.php.pdo_mysql</literal></para></listitem>
+         <listitem><para><literal>config.php.pdo_odbc</literal></para></listitem>
+         <listitem><para><literal>config.php.pdo_pgsql</literal></para></listitem>
+         <listitem><para><literal>config.php.phpdbg</literal></para></listitem>
+         <listitem><para><literal>config.php.postgresql</literal></para></listitem>
+         <listitem><para><literal>config.php.readline</literal></para></listitem>
+         <listitem><para><literal>config.php.soap</literal></para></listitem>
+         <listitem><para><literal>config.php.sockets</literal></para></listitem>
+         <listitem><para><literal>config.php.sodium</literal></para></listitem>
+         <listitem><para><literal>config.php.sqlite</literal></para></listitem>
+         <listitem><para><literal>config.php.tidy</literal></para></listitem>
+         <listitem><para><literal>config.php.xmlrpc</literal></para></listitem>
+         <listitem><para><literal>config.php.xsl</literal></para></listitem>
+         <listitem><para><literal>config.php.zip</literal></para></listitem>
+         <listitem><para><literal>config.php.zlib</literal></para></listitem>
+       </itemizedlist>
+     </para>
+   </listitem>
   </itemizedlist>
  </section>
 
diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
index 1069b71f74ce..7e7366480e18 100644
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -6,27 +6,28 @@ let
   cfg = config.services.nextcloud;
   fpm = config.services.phpfpm.pools.nextcloud;
 
-  phpPackage = pkgs.php73;
-  phpPackages = pkgs.php73Packages;
+  phpPackage =
+    let
+      base = pkgs.php74;
+    in
+      base.buildEnv {
+        extensions = e: with e;
+          base.enabledExtensions ++ [
+            apcu redis memcached imagick
+          ];
+        extraConfig = phpOptionsStr;
+      };
 
   toKeyValue = generators.toKeyValue {
     mkKeyValue = generators.mkKeyValueDefault {} " = ";
   };
 
-  phpOptionsExtensions = ''
-    ${optionalString cfg.caching.apcu "extension=${phpPackages.apcu}/lib/php/extensions/apcu.so"}
-    ${optionalString cfg.caching.redis "extension=${phpPackages.redis}/lib/php/extensions/redis.so"}
-    ${optionalString cfg.caching.memcached "extension=${phpPackages.memcached}/lib/php/extensions/memcached.so"}
-    extension=${phpPackages.imagick}/lib/php/extensions/imagick.so
-    zend_extension = opcache.so
-    opcache.enable = 1
-  '';
   phpOptions = {
     upload_max_filesize = cfg.maxUploadSize;
     post_max_size = cfg.maxUploadSize;
     memory_limit = cfg.maxUploadSize;
   } // cfg.phpOptions;
-  phpOptionsStr = phpOptionsExtensions + (toKeyValue phpOptions);
+  phpOptionsStr = toKeyValue phpOptions;
 
   occ = pkgs.writeScriptBin "nextcloud-occ" ''
     #! ${pkgs.stdenv.shell}
@@ -38,7 +39,6 @@ let
     export NEXTCLOUD_CONFIG_DIR="${cfg.home}/config"
     $sudo \
       ${phpPackage}/bin/php \
-      -c ${pkgs.writeText "php.ini" phpOptionsStr}\
       occ $*
   '';
 
diff --git a/nixos/release-combined.nix b/nixos/release-combined.nix
index 9377a931a75e..b23c17a1b696 100644
--- a/nixos/release-combined.nix
+++ b/nixos/release-combined.nix
@@ -112,7 +112,7 @@ in rec {
       "nixos.tests.nfs4.simple.x86_64-linux"
       "nixos.tests.openssh.x86_64-linux"
       "nixos.tests.pantheon.x86_64-linux"
-      "nixos.tests.php-pcre.x86_64-linux"
+      "nixos.tests.php.x86_64-linux"
       "nixos.tests.plasma5.x86_64-linux"
       "nixos.tests.predictable-interface-names.predictableNetworkd.x86_64-linux"
       "nixos.tests.predictable-interface-names.predictable.x86_64-linux"
diff --git a/nixos/release-small.nix b/nixos/release-small.nix
index 2a15073b6698..d78788d05315 100644
--- a/nixos/release-small.nix
+++ b/nixos/release-small.nix
@@ -40,7 +40,7 @@ in rec {
         nat
         nfs3
         openssh
-        php-pcre
+        php
         predictable-interface-names
         proxy
         simple;
@@ -108,7 +108,7 @@ in rec {
         "nixos.tests.nat.standalone.x86_64-linux"
         "nixos.tests.nfs3.simple.x86_64-linux"
         "nixos.tests.openssh.x86_64-linux"
-        "nixos.tests.php-pcre.x86_64-linux"
+        "nixos.tests.php.x86_64-linux"
         "nixos.tests.predictable-interface-names.predictable.x86_64-linux"
         "nixos.tests.predictable-interface-names.predictableNetworkd.x86_64-linux"
         "nixos.tests.predictable-interface-names.unpredictable.x86_64-linux"
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 2bdced6a3cc1..76ca49416170 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -241,7 +241,7 @@ in
   peerflix = handleTest ./peerflix.nix {};
   pgjwt = handleTest ./pgjwt.nix {};
   pgmanage = handleTest ./pgmanage.nix {};
-  php-pcre = handleTest ./php-pcre.nix {};
+  php = handleTest ./php {};
   plasma5 = handleTest ./plasma5.nix {};
   plotinus = handleTest ./plotinus.nix {};
   postgis = handleTest ./postgis.nix {};
diff --git a/nixos/tests/php/default.nix b/nixos/tests/php/default.nix
new file mode 100644
index 000000000000..9ab14f722d08
--- /dev/null
+++ b/nixos/tests/php/default.nix
@@ -0,0 +1,7 @@
+{ system ? builtins.currentSystem,
+  config ? {},
+  pkgs ? import ../../.. { inherit system config; }
+}: {
+  fpm = import ./fpm.nix { inherit system pkgs; };
+  pcre = import ./pcre.nix { inherit system pkgs; };
+}
diff --git a/nixos/tests/php/fpm.nix b/nixos/tests/php/fpm.nix
new file mode 100644
index 000000000000..e93a31834185
--- /dev/null
+++ b/nixos/tests/php/fpm.nix
@@ -0,0 +1,55 @@
+import ../make-test-python.nix ({pkgs, ...}: {
+  name = "php-fpm-nginx-test";
+  meta.maintainers = with pkgs.stdenv.lib.maintainers; [ etu ];
+
+  machine = { config, lib, pkgs, ... }: {
+    services.nginx = {
+      enable = true;
+
+      virtualHosts."phpfpm" = let
+        testdir = pkgs.writeTextDir "web/index.php" "<?php phpinfo();";
+      in {
+        root = "${testdir}/web";
+        locations."~ \.php$".extraConfig = ''
+          fastcgi_pass unix:${config.services.phpfpm.pools.foobar.socket};
+          fastcgi_index index.php;
+          include ${pkgs.nginx}/conf/fastcgi_params;
+          include ${pkgs.nginx}/conf/fastcgi.conf;
+        '';
+        locations."/" = {
+          tryFiles = "$uri $uri/ index.php";
+          index = "index.php index.html index.htm";
+        };
+      };
+    };
+
+    services.phpfpm.pools."foobar" = {
+      user = "nginx";
+      settings = {
+        "listen.group" = "nginx";
+        "listen.mode" = "0600";
+        "listen.owner" = "nginx";
+        "pm" = "dynamic";
+        "pm.max_children" = 5;
+        "pm.max_requests" = 500;
+        "pm.max_spare_servers" = 3;
+        "pm.min_spare_servers" = 1;
+        "pm.start_servers" = 2;
+      };
+    };
+  };
+  testScript = { ... }: ''
+    machine.wait_for_unit("nginx.service")
+    machine.wait_for_unit("phpfpm-foobar.service")
+
+    # Check so we get an evaluated PHP back
+    assert "PHP Version ${pkgs.php.version}" in machine.succeed("curl -vvv -s http://127.0.0.1:80/")
+
+    # Check so we have database and some other extensions loaded
+    assert "json" in machine.succeed("curl -vvv -s http://127.0.0.1:80/")
+    assert "opcache" in machine.succeed("curl -vvv -s http://127.0.0.1:80/")
+    assert "pdo_mysql" in machine.succeed("curl -vvv -s http://127.0.0.1:80/")
+    assert "pdo_pgsql" in machine.succeed("curl -vvv -s http://127.0.0.1:80/")
+    assert "pdo_sqlite" in machine.succeed("curl -vvv -s http://127.0.0.1:80/")
+  '';
+})
diff --git a/nixos/tests/php-pcre.nix b/nixos/tests/php/pcre.nix
index d5c22e0582a0..56a87778579f 100644
--- a/nixos/tests/php-pcre.nix
+++ b/nixos/tests/php/pcre.nix
@@ -1,7 +1,6 @@
-
-let testString = "can-use-subgroups"; in
-
-import ./make-test-python.nix ({ ...}: {
+let
+  testString = "can-use-subgroups";
+in import ../make-test-python.nix ({ ...}: {
   name = "php-httpd-pcre-jit-test";
   machine = { lib, pkgs, ... }: {
     time.timeZone = "UTC";
@@ -10,15 +9,13 @@ import ./make-test-python.nix ({ ...}: {
       adminAddr = "please@dont.contact";
       enablePHP = true;
       phpOptions = "pcre.jit = true";
-      extraConfig =
-      let
+      extraConfig = let
         testRoot = pkgs.writeText "index.php"
-        ''
-          <?php
+          ''
+            <?php
             preg_match('/(${testString})/', '${testString}', $result);
             var_dump($result);
-          ?>
-        '';
+          '';
       in
         ''
           Alias / ${testRoot}/
@@ -30,11 +27,11 @@ import ./make-test-python.nix ({ ...}: {
     };
   };
   testScript = { ... }:
-  ''
-    machine.wait_for_unit("httpd.service")
-    # Ensure php evaluation by matching on the var_dump syntax
-    assert 'string(${toString (builtins.stringLength testString)}) "${testString}"' in machine.succeed(
-        "curl -vvv -s http://127.0.0.1:80/index.php"
-    )
-  '';
+    ''
+      machine.wait_for_unit("httpd.service")
+      # Ensure php evaluation by matching on the var_dump syntax
+      assert 'string(${toString (builtins.stringLength testString)}) "${testString}"' in machine.succeed(
+          "curl -vvv -s http://127.0.0.1:80/index.php"
+      )
+    '';
 })
diff --git a/pkgs/build-support/build-pecl.nix b/pkgs/build-support/build-pecl.nix
index a1030e3b34fa..f43205f24c5c 100644
--- a/pkgs/build-support/build-pecl.nix
+++ b/pkgs/build-support/build-pecl.nix
@@ -1,9 +1,11 @@
-{ stdenv, php, autoreconfHook, fetchurl, re2c }:
+{ stdenv, lib, php, autoreconfHook, fetchurl, re2c }:
 
 { pname
 , version
+, internalDeps ? []
 , buildInputs ? []
 , nativeBuildInputs ? []
+, postPhpize ? ""
 , makeFlags ? []
 , src ? fetchurl {
     url = "http://pecl.php.net/get/${pname}-${version}.tgz";
@@ -22,5 +24,11 @@ stdenv.mkDerivation (args // {
 
   makeFlags = [ "EXTENSION_DIR=$(out)/lib/php/extensions" ] ++ makeFlags;
 
-  autoreconfPhase = "phpize";
+  autoreconfPhase = ''
+    phpize
+    ${postPhpize}
+    ${lib.concatMapStringsSep "\n"
+      (dep: "mkdir -p ext; ln -s ${dep.dev}/include ext/${dep.extensionName}")
+      internalDeps}
+  '';
 })
diff --git a/pkgs/development/interpreters/php/default.nix b/pkgs/development/interpreters/php/default.nix
index 497a1d87f557..d260a90e8ea6 100644
--- a/pkgs/development/interpreters/php/default.nix
+++ b/pkgs/development/interpreters/php/default.nix
@@ -1,13 +1,9 @@
-# pcre functionality is tested in nixos/tests/php-pcre.nix
-{ config, lib, stdenv, fetchurl
-, autoconf, automake, bison, file, flex, libtool, pkgconfig, re2c
-, libxml2, readline, zlib, curl, postgresql, gettext
-, openssl, pcre, pcre2, sqlite
-, libxslt, bzip2, icu, openldap, cyrus_sasl, unixODBC
-, uwimap, pam, gmp, apacheHttpd, libiconv, systemd, libsodium, html-tidy, libargon2
-, gd, freetype, libXpm, libjpeg, libpng, libwebp
-, libzip, valgrind, oniguruma, symlinkJoin, writeText
-, makeWrapper, callPackage
+# We have tests for PCRE and PHP-FPM in nixos/tests/php/ or
+# both in the same attribute named nixosTests.php
+
+{ callPackage, config, fetchurl, lib, makeWrapper, stdenv, symlinkJoin
+, writeText , autoconf, automake, bison, flex, libtool, pkgconfig, re2c
+, apacheHttpd, libargon2, libxml2, pcre, pcre2 , systemd, valgrind
 }:
 
 let
@@ -15,182 +11,83 @@ let
   { version
   , sha256
   , extraPatches ? []
-  , withSystemd ? config.php.systemd or stdenv.isLinux
-  , imapSupport ? config.php.imap or (!stdenv.isDarwin)
-  , ldapSupport ? config.php.ldap or true
-  , mysqlndSupport ? config.php.mysqlnd or true
-  , mysqliSupport ? (config.php.mysqli or true) && (mysqlndSupport)
-  , pdo_mysqlSupport ? (config.php.pdo_mysql or true) && (mysqlndSupport)
-  , libxml2Support ? config.php.libxml2 or true
-  , apxs2Support ? config.php.apxs2 or (!stdenv.isDarwin)
-  , embedSupport ? config.php.embed or false
-  , bcmathSupport ? config.php.bcmath or true
-  , socketsSupport ? config.php.sockets or true
-  , curlSupport ? config.php.curl or true
-  , gettextSupport ? config.php.gettext or true
-  , pcntlSupport ? config.php.pcntl or true
-  , pdo_odbcSupport ? config.php.pdo_odbc or true
-  , postgresqlSupport ? config.php.postgresql or true
-  , pdo_pgsqlSupport ? config.php.pdo_pgsql or true
-  , readlineSupport ? config.php.readline or true
-  , sqliteSupport ? config.php.sqlite or true
-  , soapSupport ? (config.php.soap or true) && (libxml2Support)
-  , zlibSupport ? config.php.zlib or true
-  , opensslSupport ? config.php.openssl or true
-  , mbstringSupport ? config.php.mbstring or true
-  , gdSupport ? config.php.gd or true
-  , intlSupport ? config.php.intl or true
-  , exifSupport ? config.php.exif or true
-  , xslSupport ? config.php.xsl or false
-  , bz2Support ? config.php.bz2 or false
-  , zipSupport ? config.php.zip or true
-  , ftpSupport ? config.php.ftp or true
-  , fpmSupport ? config.php.fpm or true
-  , gmpSupport ? config.php.gmp or true
-  , ztsSupport ? (config.php.zts or false) || (apxs2Support)
-  , calendarSupport ? config.php.calendar or true
-  , sodiumSupport ? (config.php.sodium or true) && (lib.versionAtLeast version "7.2")
-  , tidySupport ? (config.php.tidy or false)
-  , argon2Support ? (config.php.argon2 or true) && (lib.versionAtLeast version "7.2")
-  , libzipSupport ? (config.php.libzip or true) && (lib.versionAtLeast version "7.2")
-  , phpdbgSupport ? config.php.phpdbg or true
+
+  # Sapi flags
   , cgiSupport ? config.php.cgi or true
   , cliSupport ? config.php.cli or true
+  , fpmSupport ? config.php.fpm or true
+  , pearSupport ? config.php.pear or true
   , pharSupport ? config.php.phar or true
-  , xmlrpcSupport ? (config.php.xmlrpc or false) && (libxml2Support)
+  , phpdbgSupport ? config.php.phpdbg or true
+
+
+  # Misc flags
+  , apxs2Support ? config.php.apxs2 or (!stdenv.isDarwin)
+  , argon2Support ? config.php.argon2 or true
   , cgotoSupport ? config.php.cgoto or false
-  , valgrindSupport ? (config.php.valgrind or true) && (lib.versionAtLeast version "7.2")
+  , embedSupport ? config.php.embed or false
   , ipv6Support ? config.php.ipv6 or true
-  , pearSupport ? (config.php.pear or true) && (libxml2Support)
-  }: stdenv.mkDerivation {
+  , systemdSupport ? config.php.systemd or stdenv.isLinux
+  , valgrindSupport ? config.php.valgrind or true
+  , ztsSupport ? (config.php.zts or false) || (apxs2Support)
+  }: let
+    pcre' = if (lib.versionAtLeast version "7.3") then pcre2 else pcre;
+  in stdenv.mkDerivation {
     pname = "php";
 
     inherit version;
 
     enableParallelBuilding = true;
 
-    nativeBuildInputs = [ autoconf automake bison file flex libtool pkgconfig re2c ];
-
-    buildInputs = [ ]
-      ++ lib.optional (lib.versionOlder version "7.3") pcre
-      ++ lib.optional (lib.versionAtLeast version "7.3") pcre2
-      ++ lib.optional (lib.versionAtLeast version "7.4") oniguruma
-      ++ lib.optional withSystemd systemd
-      ++ lib.optionals imapSupport [ uwimap openssl pam ]
-      ++ lib.optionals curlSupport [ curl openssl ]
-      ++ lib.optionals ldapSupport [ openldap openssl ]
-      ++ lib.optionals gdSupport [ gd freetype libXpm libjpeg libpng libwebp ]
-      ++ lib.optionals opensslSupport [ openssl openssl.dev ]
+    nativeBuildInputs = [ autoconf automake bison flex libtool pkgconfig re2c ];
+
+    buildInputs =
+      # PCRE extension
+      [ pcre' ]
+
+      # Enable sapis
+      ++ lib.optional pearSupport [ libxml2.dev ]
+
+      # Misc deps
       ++ lib.optional apxs2Support apacheHttpd
-      ++ lib.optional (ldapSupport && stdenv.isLinux) cyrus_sasl
-      ++ lib.optional zlibSupport zlib
-      ++ lib.optional libxml2Support libxml2
-      ++ lib.optional readlineSupport readline
-      ++ lib.optional sqliteSupport sqlite
-      ++ lib.optional postgresqlSupport postgresql
-      ++ lib.optional pdo_odbcSupport unixODBC
-      ++ lib.optional pdo_pgsqlSupport postgresql
-      ++ lib.optional gmpSupport gmp
-      ++ lib.optional gettextSupport gettext
-      ++ lib.optional intlSupport icu
-      ++ lib.optional xslSupport libxslt
-      ++ lib.optional bz2Support bzip2
-      ++ lib.optional sodiumSupport libsodium
-      ++ lib.optional tidySupport html-tidy
       ++ lib.optional argon2Support libargon2
-      ++ lib.optional libzipSupport libzip
-      ++ lib.optional valgrindSupport valgrind;
+      ++ lib.optional systemdSupport systemd
+      ++ lib.optional valgrindSupport valgrind
+    ;
 
     CXXFLAGS = lib.optionalString stdenv.cc.isClang "-std=c++11";
 
-    configureFlags = [ "--with-config-file-scan-dir=/etc/php.d" ]
-      ++ lib.optionals (lib.versionOlder version "7.3") [ "--with-pcre-regex=${pcre.dev}" "PCRE_LIBDIR=${pcre}" ]
-      ++ lib.optionals (lib.versions.majorMinor version == "7.3") [ "--with-pcre-regex=${pcre2.dev}" "PCRE_LIBDIR=${pcre2}" ]
-      ++ lib.optionals (lib.versionAtLeast version "7.4") [ "--with-external-pcre=${pcre2.dev}" "PCRE_LIBDIR=${pcre2}" ]
-      ++ lib.optional stdenv.isDarwin "--with-iconv=${libiconv}"
-      ++ lib.optional withSystemd "--with-fpm-systemd"
-      ++ lib.optionals imapSupport [
-        "--with-imap=${uwimap}"
-        "--with-imap-ssl"
-      ]
-      ++ lib.optionals ldapSupport [
-        "--with-ldap=/invalid/path"
-        "LDAP_DIR=${openldap.dev}"
-        "LDAP_INCDIR=${openldap.dev}/include"
-        "LDAP_LIBDIR=${openldap.out}/lib"
-      ]
-      ++ lib.optional (ldapSupport && stdenv.isLinux) "--with-ldap-sasl=${cyrus_sasl.dev}"
-      ++ lib.optional apxs2Support "--with-apxs2=${apacheHttpd.dev}/bin/apxs"
-      ++ lib.optional embedSupport "--enable-embed"
-      ++ lib.optional curlSupport "--with-curl=${curl.dev}"
-      ++ lib.optional zlibSupport "--with-zlib=${zlib.dev}"
-      ++ lib.optional (libxml2Support && (lib.versionOlder version "7.4")) "--with-libxml-dir=${libxml2.dev}"
-      ++ lib.optional (!libxml2Support) [
-        "--disable-dom"
-        (if (lib.versionOlder version "7.4") then "--disable-libxml" else "--without-libxml")
-        "--disable-simplexml"
-        "--disable-xml"
-        "--disable-xmlreader"
-        "--disable-xmlwriter"
-        "--without-pear"
-      ]
-      ++ lib.optional pcntlSupport "--enable-pcntl"
-      ++ lib.optional readlineSupport "--with-readline=${readline.dev}"
-      ++ lib.optional sqliteSupport "--with-pdo-sqlite=${sqlite.dev}"
-      ++ lib.optional postgresqlSupport "--with-pgsql=${postgresql}"
-      ++ lib.optional pdo_odbcSupport "--with-pdo-odbc=unixODBC,${unixODBC}"
-      ++ lib.optional pdo_pgsqlSupport "--with-pdo-pgsql=${postgresql}"
-      ++ lib.optional (pdo_mysqlSupport && mysqlndSupport) "--with-pdo-mysql=mysqlnd"
-      ++ lib.optional (mysqliSupport && mysqlndSupport) "--with-mysqli=mysqlnd"
-      ++ lib.optional (pdo_mysqlSupport || mysqliSupport) "--with-mysql-sock=/run/mysqld/mysqld.sock"
-      ++ lib.optional bcmathSupport "--enable-bcmath"
-      ++ lib.optionals (gdSupport && lib.versionAtLeast version "7.4") [
-        "--enable-gd"
-        "--with-external-gd=${gd.dev}"
-        "--with-webp=${libwebp}"
-        "--with-jpeg=${libjpeg.dev}"
-        "--with-xpm=${libXpm.dev}"
-        "--with-freetype=${freetype.dev}"
-        "--enable-gd-jis-conv"
-      ] ++ lib.optionals (gdSupport && lib.versionOlder version "7.4") [
-        "--with-gd=${gd.dev}"
-        "--with-webp-dir=${libwebp}"
-        "--with-jpeg-dir=${libjpeg.dev}"
-        "--with-png-dir=${libpng.dev}"
-        "--with-freetype-dir=${freetype.dev}"
-        "--with-xpm-dir=${libXpm.dev}"
-        "--enable-gd-jis-conv"
-      ]
-      ++ lib.optional gmpSupport "--with-gmp=${gmp.dev}"
-      ++ lib.optional soapSupport "--enable-soap"
-      ++ lib.optional socketsSupport "--enable-sockets"
-      ++ lib.optional opensslSupport "--with-openssl"
-      ++ lib.optional mbstringSupport "--enable-mbstring"
-      ++ lib.optional gettextSupport "--with-gettext=${gettext}"
-      ++ lib.optional intlSupport "--enable-intl"
-      ++ lib.optional exifSupport "--enable-exif"
-      ++ lib.optional xslSupport "--with-xsl=${libxslt.dev}"
-      ++ lib.optional bz2Support "--with-bz2=${bzip2.dev}"
-      ++ lib.optional (zipSupport && (lib.versionOlder version "7.4")) "--enable-zip"
-      ++ lib.optional (zipSupport && (lib.versionAtLeast version "7.4")) "--with-zip"
-      ++ lib.optional ftpSupport "--enable-ftp"
-      ++ lib.optional fpmSupport "--enable-fpm"
-      ++ lib.optional ztsSupport "--enable-maintainer-zts"
-      ++ lib.optional calendarSupport "--enable-calendar"
-      ++ lib.optional sodiumSupport "--with-sodium=${libsodium.dev}"
-      ++ lib.optional tidySupport "--with-tidy=${html-tidy}"
-      ++ lib.optional argon2Support "--with-password-argon2=${libargon2}"
-      ++ lib.optional (libzipSupport && (lib.versionOlder version "7.4")) "--with-libzip=${libzip.dev}"
-      ++ lib.optional phpdbgSupport "--enable-phpdbg"
-      ++ lib.optional (!phpdbgSupport) "--disable-phpdbg"
+    configureFlags =
+      # Disable all extensions
+      [ "--disable-all" ]
+
+      # PCRE
+      ++ lib.optionals (lib.versionAtLeast version "7.4") [ "--with-external-pcre=${pcre'.dev}" ]
+      ++ lib.optionals (lib.versions.majorMinor version == "7.3") [ "--with-pcre-regex=${pcre'.dev}" ]
+      ++ lib.optionals (lib.versionOlder version "7.3") [ "--with-pcre-regex=${pcre'.dev}" ]
+      ++ [ "PCRE_LIBDIR=${pcre'}" ]
+
+
+      # Enable sapis
       ++ lib.optional (!cgiSupport) "--disable-cgi"
       ++ lib.optional (!cliSupport) "--disable-cli"
-      ++ lib.optional (!pharSupport) "--disable-phar"
-      ++ lib.optional xmlrpcSupport "--with-xmlrpc"
+      ++ lib.optional fpmSupport    "--enable-fpm"
+      ++ lib.optional pearSupport [ "--with-pear=$(out)/lib/php/pear" "--enable-xml" "--with-libxml" ]
+      ++ lib.optional (pearSupport && (lib.versionOlder version "7.4")) "--enable-libxml"
+      ++ lib.optional pharSupport   "--enable-phar"
+      ++ lib.optional phpdbgSupport "--enable-phpdbg"
+
+
+      # Misc flags
+      ++ li