Enabling PHP 7.4 on CentOS 7 with Puppet

The PHP version comes in default CentOS 7 repositories is rather horribly outdated. This is problematic when running WordPress, which has to be upgraded constantly, and really old PHP versions may not be accepted, security-patched or not. The solution is to get updated PHP from the remi yum repositories. There are two sets of PHP packages as described here:

• Install updated packages that replace the old PHP 5 packages (i.e. names are the same)
• Install PHP 7.4 alongside old PHP 5 packages

The former is what we're interested here, as it in requires less modifications in Puppet code.

Manual installation of the remi repository is pretty straightforward. But when you're managing WordPress and PHP with Puppet, things get a bit more tricky. Here's an example from our WordPress profile on how to enable PHP 7.4:

# The remi repository release package contains tons of repository
# configurations and converting all of those to Puppet code would be tedious,
# require managing GPG keys manually and offer little benefit. So, we install
# the package, get rid of the repositories we don't want and customize the
# repositories we do want with the yumrepo resource.
#
package { 'remi-release':
  ensure   => 'present',
  name     => 'remi-release',
  provider => 'rpm',
  source   => 'https://rpms.remirepo.net/enterprise/remi-release-7.rpm',
}

# We need this to ensure that remi PHP 7.4 packages are preferred over the
# old PHP 5.x packages available in other repositories. The default priority
# is 99, and we set remi packages to priority 50. The lower priority wins.
package { 'yum-plugin-priorities':
  ensure => 'present',
}

$yumrepo_defaults = {
  'ensure'   => 'present',
  'enabled'  => true,
  'gpgcheck' => true,
  'priority' => 50,
  'require'  => [ Package['remi-release'], Package['yum-plugin-priorities'] ],
}

yumrepo { 'remi-safe':
  descr      => 'Safe Remi RPM repository for Enterprise Linux 7',
  mirrorlist => 'http://cdn.remirepo.net/enterprise/7/safe/mirror',
  *          => $yumrepo_defaults,
}

yumrepo { 'remi-php74':
  descr      => 'Remi PHP 7.4 RPM repository for Enterprise Linux 7',
  mirrorlist => 'http://cdn.remirepo.net/enterprise/7/php74/mirror',
  *          => $yumrepo_defaults,
}

# Disable unwanted remi repos
['glpi91','glpi92','glpi93','glpi94','modular','php54','php70','php71','php72','php73'].each |$repo| {
  file { "/etc/yum.repos.d/remi-${repo}.repo":
    ensure  => 'absent',
    require => Package['remi-release'],
  }
} 

If you use puppetlabs-apache to manage Apache modules you need to modify the class parameters for ::apache::mod:php as well:

class { '::apache::mod::php':
  php_version => '7',
}

This ensures that the PHP 7 module is enabled instead of the PHP 5 version: the latter won't be installed at all and trying to start httpd will fail.