Dockerfile

FROM mysql:8.4.11@sha256:b3b90af2a6552ae30c266fdb7d5dd55f3afb72404bb78d37fe8a23eb857fd3fb AS legacy-mysql-dump-client

FROM php:8.5.10-fpm-trixie@sha256:70076c1cae0cd0ba6761832417e3a1df3e5560f0544eb0fe40357373e54420fe AS app-base

WORKDIR /var/www/html

ARG PHP_REDIS_VERSION=6.3.0
ARG SYSTEM_PACKAGES_REFRESH=manual

# Install system dependencies needed for the PHP runtime and extension builds.
# LEGACY_DATABASE_DUMP_SUPPORT:
# Required for the admin-only /database dump page while legacy MySQL 5.6/5.7 exports exist.
# Remove this package when legacy database exports are retired.
RUN echo "System package refresh: ${SYSTEM_PACKAGES_REFRESH}" \
    && apt-get update \
    && apt-get upgrade -y \
    && apt-get install -y \
    libnghttp2-14 \
    git \
    curl \
    libpng-dev \
    libonig-dev \
    libxml2-dev \
    zip \
    unzip \
    libzip-dev \
    libsodium-dev \
    libxslt1-dev \
    libicu-dev \
    g++ \
    netcat-traditional \
    default-mysql-client \
    ca-certificates \
    libssl3t64 \
    openssl \
    openssl-provider-legacy \
    gnupg \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/*

# MariaDB 11.x's dump client is incompatible with the legacy MySQL 5.6 IGSN
# server. Keep this separate Oracle client only while that export is required.
COPY --from=legacy-mysql-dump-client /usr/bin/mysqldump /usr/local/bin/mysql-legacy-mysqldump
RUN /usr/local/bin/mysql-legacy-mysqldump --version

RUN docker-php-ext-install pdo_mysql mbstring exif pcntl bcmath gd zip sodium xsl intl sockets

# Install Redis extension from the official phpredis source tag.
RUN set -eux; \
    curl -fsSL "https://github.com/phpredis/phpredis/archive/refs/tags/${PHP_REDIS_VERSION}.tar.gz" -o /tmp/phpredis.tar.gz; \
    mkdir -p /usr/src/php/ext/redis; \
    tar -xzf /tmp/phpredis.tar.gz -C /usr/src/php/ext/redis --strip-components=1; \
    docker-php-ext-install redis; \
    rm -rf /tmp/phpredis.tar.gz /usr/src/php/ext/redis

COPY --from=composer:2.10.3@sha256:4d045ea9f71d5d111a95e608400da61d187e487adf9eaf2dfe068998a8d4f584 /usr/bin/composer /usr/bin/composer

COPY docker-entrypoint.sh /usr/local/bin/
RUN chmod +x /usr/local/bin/docker-entrypoint.sh

COPY docker/php/local.ini /usr/local/etc/php/conf.d/local.ini
COPY docker/php/opcache-production.ini /usr/local/etc/php/conf.d/opcache-production.ini
RUN php --ri "Zend OPcache"

# PHP-FPM pool configuration for optimized worker management
# This prevents 502 errors on pages with large Inertia payloads
COPY docker/php/www.conf /usr/local/etc/php-fpm.d/www.conf

COPY docker/certs/sumariopmd-ca.crt /usr/local/share/ca-certificates/sumariopmd-ca.crt
RUN update-ca-certificates

FROM app-base AS app-build

ARG NPM_VERSION=12.0.2
ARG NODE_CHECKSUM_ARM64=23c1b4d19e2f12a7d06fe8aa3d6e0e4923cf77a47e13c5ccdf32fadaa33960f2
ARG NODE_CHECKSUM_X64=3e301118d7df53d563b7e96c1617545f26e2f76f9724be668d6cab65c15dda5d

# Install Node.js only in the build stage so the runtime image contains no Node package manifests.
# Download the exact stable release from nodejs.org and verify it for supported architectures.
COPY .node-version /tmp/.node-version
RUN set -eux; \
    NODE_VERSION="$(tr -d '\r\n' < /tmp/.node-version)"; \
    NODE_VERSION="${NODE_VERSION#v}"; \
    case "$(dpkg --print-architecture)" in \
        amd64) NODE_ARCH='x64'; NODE_CHECKSUM="${NODE_CHECKSUM_X64}" ;; \
        arm64) NODE_ARCH='arm64'; NODE_CHECKSUM="${NODE_CHECKSUM_ARM64}" ;; \
        *) echo "Unsupported Node.js build architecture: $(dpkg --print-architecture)" >&2; exit 1 ;; \
    esac; \
    NODE_ARCHIVE="node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz"; \
    apt-get update; \
    apt-get install -y --no-install-recommends xz-utils; \
    curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/${NODE_ARCHIVE}" -o "/tmp/${NODE_ARCHIVE}"; \
    echo "${NODE_CHECKSUM}  /tmp/${NODE_ARCHIVE}" | sha256sum -c -; \
    tar -xJf "/tmp/${NODE_ARCHIVE}" -C /usr/local --strip-components=1 --no-same-owner; \
    rm -f "/tmp/${NODE_ARCHIVE}"; \
    npm install --global "npm@${NPM_VERSION}"; \
    node --version; \
    npm --version; \
    apt-get clean; \
    rm -rf /var/lib/apt/lists/*

# Copy dependency files FIRST (this layer is cached unless dependencies change)
COPY composer.json composer.lock ./
RUN composer install --no-interaction --no-plugins --no-scripts \
    && composer dump-autoload --optimize --no-scripts

# Copy package files and install node dependencies (cached unless package.json changes)
COPY package.json package-lock.json .npmrc ./
RUN npm ci

# NOW copy the rest of the application (this changes frequently)
COPY . /var/www/html

# Copy environment file for build
COPY .env.production /var/www/html/.env

# Clear any cached config files that might reference old packages
RUN rm -rf bootstrap/cache/*.php bootstrap/cache/packages.php bootstrap/cache/services.php \
    && mkdir -p bootstrap/cache \
    && chmod -R 775 bootstrap/cache

# Wayfinder boots Laravel while Vite builds the frontend. Keep that build step
# independent of runtime services; the copied production environment remains
# unchanged for the resulting application image.
RUN APP_ENV=production \
    DB_CONNECTION=sqlite \
    DB_DATABASE=:memory: \
    CACHE_STORE=array \
    SESSION_DRIVER=array \
    QUEUE_CONNECTION=sync \
    QUEUE_FAILED_DRIVER=null \
    BROADCAST_CONNECTION=log \
    BROADCAST_DRIVER=log \
    NODE_ENV=production \
    npm run build \
    && rm -f public/hot \
    && rm -rf node_modules /root/.npm /root/.cache \
    && rm -f package.json package-lock.json .npmrc

FROM app-base AS app

COPY --from=app-build /var/www/html /var/www/html

EXPOSE 9000

ENTRYPOINT ["docker-entrypoint.sh"]
CMD ["php-fpm"]

FROM nginx:1.31.5-alpine@sha256:72ba65eb42c10344912a84ff42408db7d34f2feb642204570ab8fc5ffd29f1d3 AS nginx

WORKDIR /var/www/html

COPY docker/nginx/conf.d/default.conf /etc/nginx/conf.d/default.conf
COPY --from=app /var/www/html/public /var/www/html/public
COPY --from=app /var/www/html/storage /var/www/html/storage
RUN mkdir -p /var/www/html/public \
    && rm -rf /var/www/html/public/storage \
    && ln -s ../storage/app/public /var/www/html/public/storage