Right way to implement schedule / cron

Question

I need to add bulk objects creation in Pimcore. First I tried with web, but due to big size of set, Request taken long time and approach discarded in practical terms.

Then I chosen cron for schedule the jobs for later period, But I get other issue. Like some other RAD application pimcore generate some of code automatically in some folders like /website/var/versions. So these folder automatically get permission of web user ( in my case apache user ).

But My cron script run by normal user which execute Pimcore API calls for object/data creation but unable to write in folders due to insufficient permissions. Now I can have one of two options.

1. Run cron through apache user, which is big no for security reasons.
2. Give writable permissions ( chmod 777 like or add my user to apache group by using chown ). But pimcore create new folders time by time when managed from browser. So these new folders do not have permissions to write by cron script ( permission is max 755, I get for new folders which is not enough for group write ).

I searched previously on google and found command setfacl for setup default user / permissions for a folder. Which I used like this.

    `sudo setfacl -Rm u:apache:rwx,d:u:apache:rwx website/var/versions/object` 

But it regular failed and I need to give manually permission again and again.

Now if any practical approach for fixing this ?

Note : I am currently using Amazon Linux AMI. But it can be later change to redhat or ubuntu, So Its better is a universal linux solution is available.

Answer 1

Pimcore already requires that its maintenance jobs (cron) are run under apache user, so not running your job under apache user might not improve things much.

But you might want to go with the approach that is used for the integrated newsletter sending.

See /pimcore/modules/reports/controllers/NewsletterController.php:194 :

$cmd = Tool\Console::getPhpCli() . " " . realpath(PIMCORE_PATH . DIRECTORY_SEPARATOR . "cli" . DIRECTORY_SEPARATOR . "send-newsletter.php"). " " . escapeshellarg($letter->getName()) . " " . escapeshellarg(Tool::getHostUrl());
            Tool\Console::execInBackground($cmd, PIMCORE_LOG_DIRECTORY . "/newsletter--" . $letter->getName() . ".log");

Above code runs the CLI script /pimcore/cli/send-newsletter.php

With this approach the cron is not needed and since the job is run as CLI it won't timeout (if you didn't explicitly set the timeout for PHP CLI).