.env.example

@@ -1,4 +1,4 @@
-DOCKER_NGINX_PORT=8080
+DOCKER_WEB_PORT=8080
 DOCKER_WEBSOCKET_PORT=8081
 DOCKER_DB_PORT=3306
 MYSQL_ROOT_PASSWORD=root_pass

app/docker/Dockerfile

@@ -1,25 +1,6 @@
-FROM docker.io/php:8.3-zts-alpine3.18 AS UNIT_BUILDER
+FROM docker.io/php:8.5-fpm-alpine3.23 AS php
 
-ARG UNIT_VERSION=1.31.1
-
-RUN apk --no-cache add pcre2-dev gcc git musl-dev make && \
-    mkdir -p /usr/lib/unit/modules && \
-    git clone https://github.com/nginx/unit.git && \
-    cd unit && \
-    git checkout $UNIT_VERSION && \
-    ./configure --prefix=/var --statedir=/var/lib/unit --runstatedir=/var/run --control=unix:/run/unit/control.unit.sock --log=/var/log/unit.log --user=www-data --group=www-data --tmpdir=/tmp --modulesdir=/var/lib/unit/modules && \
-    ./configure php && \
-    make && \
-    make install
-
-FROM docker.io/php:8.3-zts-alpine3.18 as BUILD
-
-COPY --from=UNIT_BUILDER /var/sbin/unitd /usr/sbin/unitd
-COPY --from=UNIT_BUILDER /var/lib/unit/ /var/lib/unit/
-
-COPY docker/unit-config.json /docker-entrypoint.d/config.json
-
-RUN apk --no-cache add pcre2 libbz2 libpng libwebp libjpeg-turbo icu-libs freetype oniguruma libzip \
+RUN apk --no-cache add pcre2 libbz2 libpng libwebp libjpeg-turbo icu-libs freetype oniguruma libzip jq \
     && apk add --no-cache --virtual .phpize-deps icu-dev libpng-dev bzip2-dev libwebp-dev libjpeg-turbo-dev freetype-dev oniguruma-dev libzip-dev pcre2-dev ${PHPIZE_DEPS} \
     && docker-php-ext-configure intl --enable-intl && \
     docker-php-ext-configure bcmath --enable-bcmath && \
@@ -30,7 +11,7 @@ RUN apk --no-cache add pcre2 libbz2 libpng libwebp libjpeg-turbo icu-libs freety
         mysqli pdo_mysql \
         intl mbstring \
         zip pcntl \
-        exif opcache bz2 \
+        exif bz2 \
         calendar \
     && pear update-channels && pecl update-channels \
     && pecl install redis && docker-php-ext-enable redis \
@@ -44,77 +25,105 @@ RUN apk --no-cache add pcre2 libbz2 libpng libwebp libjpeg-turbo icu-libs freety
     && mkdir -p /tmp/php/upload \
     && mkdir -p /tmp/php/sys \
     && mkdir -p /tmp/php/session \
-    && chown -R www-data:www-data /tmp/php \
-    && ln -sf /dev/stdout /var/log/unit.log \
-    && addgroup -S unit && adduser -S unit -G unit
+    && chown -R www-data:www-data /tmp/php
 
-FROM BUILD as APP_BUILD_FOR_PRODUCTION
+COPY docker/php/conf/app-fpm.conf /usr/local/etc/php-fpm.d/app-fpm.conf
+
+FROM docker.io/nginx:1.31-alpine AS nginx
+
+COPY docker/web/conf/default.conf.template /etc/nginx/templates/default.conf.template
+COPY docker/web/conf/fastcgi_params /etc/nginx/fastcgi_params
+COPY docker/web/start.sh /usr/local/bin/start
+
+RUN chmod 755 /usr/local/bin/start
+
+FROM nginx AS web_build_for_production
+
+WORKDIR /home/app
+COPY application /home/app
+
+RUN apk --no-cache add git nodejs npm \
+    && npm install && npm run build \
+    && rm -rf /home/app/node_modules
+
+FROM php AS app_build_for_production
 WORKDIR /home/app
 
 COPY application /home/app
 
-RUN apk --no-cache add git nodejs npm \
+RUN apk --no-cache add git \
     && curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer \
     && composer install --optimize-autoloader --no-dev \
-    && npm install && npm run build \
-    && rm -rf /home/app/node_modules /home/app/.env
+    && rm -f /home/app/.env
 
+FROM php AS app_production
 
-FROM BUILD AS PRODUCTION
-
-COPY --from=APP_BUILD_FOR_PRODUCTION /home/app /var/www/html
-COPY docker/docker-entrypoint_prod.sh /home/unit/docker-entrypoint.sh
+COPY --from=app_build_for_production /home/app /var/www/html
+COPY --from=web_build_for_production /home/app/public/build/ /var/www/html/public/build
+COPY docker/php/start.sh /usr/local/bin/start
 
 WORKDIR /var/www/html
 
-RUN chmod 755 /home/unit/docker-entrypoint.sh
+RUN chown -R www-data:www-data /var/www/html \
+    && chmod 755 /usr/local/bin/start
 
 STOPSIGNAL SIGTERM
 
-ENTRYPOINT ["/home/unit/docker-entrypoint.sh"]
+USER www-data
+
 EXPOSE 9000
-COPY docker/start_prod.sh /usr/local/bin/start
 CMD ["/usr/local/bin/start"]
 
+FROM nginx AS web_production
 
-FROM BUILD AS DEVELOP
+COPY --from=web_build_for_production /home/app/public /usr/share/nginx/html
+RUN rm -f /usr/share/nginx/html/50x.html /usr/share/nginx/html/index.php /usr/share/nginx/html/.htaccess
+
+WORKDIR /usr/share/nginx/html
+
+EXPOSE 80
+CMD ["/usr/local/bin/start"]
+
+# develop
+FROM php AS app_develop
 
 WORKDIR /var/www/html
 
-COPY docker/docker-entrypoint_dev.sh /home/unit/docker-entrypoint.sh
+COPY docker/php/start.sh /usr/local/bin/start
 
 STOPSIGNAL SIGTERM
 
-RUN chmod 755 /home/unit/docker-entrypoint.sh \
+RUN chmod 755 /usr/local/bin/start \
     && apk --no-cache add git nodejs npm \
     && curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer
 
-ENTRYPOINT ["/home/unit/docker-entrypoint.sh"]
+USER www-data
 
 EXPOSE 9000
-
-COPY docker/start_dev.sh /usr/local/bin/start
 CMD ["/usr/local/bin/start"]
 
-FROM BUILD AS ARTISAN
+FROM php AS artisan
 WORKDIR /var/www/html
 STOPSIGNAL SIGTERM
 ENTRYPOINT ["php", "/var/www/html/artisan"]
 
-
-FROM BUILD AS COMPOSER
+FROM php AS composer
 WORKDIR /var/www/html
 STOPSIGNAL SIGTERM
 RUN apk --no-cache add git \
-    && curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer \
-    && mkdir /.composer && chmod 0777 /.composer
+    && curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer
+RUN mkdir "/.composer" && chmod -R 0777 "/.composer"
 ENTRYPOINT ["composer"]
 
-
-
-FROM BUILD AS NPM
+FROM php AS npm
 RUN mkdir "/.npm" && chmod -R 0777 "/.npm"
 WORKDIR /var/www/html
 STOPSIGNAL SIGTERM
 RUN apk --no-cache add nodejs npm
 ENTRYPOINT ["npm"]
+
+FROM nginx AS web_develop
+WORKDIR /usr/share/nginx/html
+
+EXPOSE 80
+CMD ["/usr/local/bin/start"]

app/docker/docker-entrypoint_dev.sh

@@ -1,104 +0,0 @@
-#!/bin/sh
-
-set -euo pipefail
-
-WAITLOOPS=5
-SLEEPSEC=1
-unitd="unitd"
-role=${CONTAINER_ROLE:-app}
-
-curl_put()
-{
-    RET=$(/usr/bin/curl -s -w '%{http_code}' -X PUT --data-binary @$1 --unix-socket /var/run/control.unit.sock http://localhost/$2)
-    RET_BODY=$(echo $RET | /bin/sed '$ s/...$//')
-    RET_STATUS=$(echo $RET | /usr/bin/tail -c 4)
-    if [ "$RET_STATUS" -ne "200" ]; then
-        echo "$0: Error: HTTP response status code is '$RET_STATUS'"
-        echo "$RET_BODY"
-        return 1
-    else
-        echo "$0: OK: HTTP response status code is '$RET_STATUS'"
-        echo "$RET_BODY"
-    fi
-    return 0
-}
-
-if [ "$role" = "app" ]; then
-      echo "$0: Launching Unit daemon to perform initial configuration..."
-      /usr/sbin/$unitd --control unix:/var/run/control.unit.sock
-      for i in $(/usr/bin/seq $WAITLOOPS); do
-          if [ ! -S /var/run/control.unit.sock ]; then
-              echo "$0: Waiting for control socket to be created..."
-              /bin/sleep $SLEEPSEC
-          else
-              break
-          fi
-      done
-
-      # even when the control socket exists, it does not mean unit has finished initialisation
-      # this curl call will get a reply once unit is fully launched
-      /usr/bin/curl -s -X GET --unix-socket /var/run/control.unit.sock http://localhost/
-
-      if /usr/bin/find "/docker-entrypoint.d/" -mindepth 1 -print -quit 2>/dev/null | /bin/grep -q .; then
-          echo "$0: /docker-entrypoint.d/ is not empty, applying initial configuration..."
-
-          echo "$0: Looking for certificate bundles in /docker-entrypoint.d/..."
-          for f in $(/usr/bin/find /docker-entrypoint.d/ -type f -name "*.pem"); do
-              echo "$0: Uploading certificates bundle: $f"
-              curl_put $f "certificates/$(basename $f .pem)"
-          done
-
-          echo "$0: Looking for JavaScript modules in /docker-entrypoint.d/..."
-          for f in $(/usr/bin/find /docker-entrypoint.d/ -type f -name "*.js"); do
-              echo "$0: Uploading JavaScript module: $f"
-              curl_put $f "js_modules/$(basename $f .js)"
-          done
-
-          echo "$0: Looking for configuration snippets in /docker-entrypoint.d/..."
-          for f in $(/usr/bin/find /docker-entrypoint.d/ -type f -name "*.json"); do
-              echo "$0: Applying configuration $f";
-              curl_put $f "config"
-          done
-
-          if [ ! -z ${UNIT_SOURCE+x} ]
-          then
-              echo $UNIT_SOURCE > /docker-entrypoint.d/unit_source.json
-              curl_put "/docker-entrypoint.d/unit_source.json" "config/listeners/*:9000/forwarded/source"
-          fi
-
-          echo "$0: Looking for shell scripts in /docker-entrypoint.d/..."
-          for f in $(/usr/bin/find /docker-entrypoint.d/ -type f -name "*.sh"); do
-              echo "$0: Launching $f";
-              "$f"
-          done
-
-          # warn on filetypes we don't know what to do with
-          for f in $(/usr/bin/find /docker-entrypoint.d/ -type f -not -name "*.sh" -not -name "*.json" -not -name "*.pem" -not -name "*.js"); do
-              echo "$0: Ignoring $f";
-          done
-      fi
-
-      echo "$0: Stopping Unit daemon after initial configuration..."
-      kill -TERM $(/bin/cat /var/run/unit.pid)
-
-      for i in $(/usr/bin/seq $WAITLOOPS); do
-          if [ -S /var/run/control.unit.sock ]; then
-              echo "$0: Waiting for control socket to be removed..."
-              /bin/sleep $SLEEPSEC
-          else
-              break
-          fi
-      done
-      if [ -S /var/run/control.unit.sock ]; then
-          kill -KILL $(/bin/cat /var/run/unit.pid)
-          rm -f /var/run/control.unit.sock
-      fi
-
-      echo
-      echo "$0: Unit initial configuration complete; ready for start up..."
-      echo
-fi
-
-chmod -R 777 /var/www/html/storage /var/www/html/bootstrap/cache
-
-exec "$@"

app/docker/docker-entrypoint_prod.sh

@@ -1,115 +0,0 @@
-#!/bin/sh
-
-set -euo pipefail
-
-WAITLOOPS=5
-SLEEPSEC=1
-unitd="unitd"
-role=${CONTAINER_ROLE:-app}
-
-curl_put()
-{
-    RET=$(/usr/bin/curl -s -w '%{http_code}' -X PUT --data-binary @$1 --unix-socket /var/run/control.unit.sock http://localhost/$2)
-    RET_BODY=$(echo $RET | /bin/sed '$ s/...$//')
-    RET_STATUS=$(echo $RET | /usr/bin/tail -c 4)
-    if [ "$RET_STATUS" -ne "200" ]; then
-        echo "$0: Error: HTTP response status code is '$RET_STATUS'"
-        echo "$RET_BODY"
-        return 1
-    else
-        echo "$0: OK: HTTP response status code is '$RET_STATUS'"
-        echo "$RET_BODY"
-    fi
-    return 0
-}
-
-if [ "$role" = "app" ]; then
-      echo "$0: Launching Unit daemon to perform initial configuration..."
-      /usr/sbin/$unitd --control unix:/var/run/control.unit.sock
-      for i in $(/usr/bin/seq $WAITLOOPS); do
-          if [ ! -S /var/run/control.unit.sock ]; then
-              echo "$0: Waiting for control socket to be created..."
-              /bin/sleep $SLEEPSEC
-          else
-              break
-          fi
-      done
-
-      # even when the control socket exists, it does not mean unit has finished initialisation
-      # this curl call will get a reply once unit is fully launched
-      /usr/bin/curl -s -X GET --unix-socket /var/run/control.unit.sock http://localhost/
-
-      if /usr/bin/find "/docker-entrypoint.d/" -mindepth 1 -print -quit 2>/dev/null | /bin/grep -q .; then
-          echo "$0: /docker-entrypoint.d/ is not empty, applying initial configuration..."
-
-          echo "$0: Looking for certificate bundles in /docker-entrypoint.d/..."
-          for f in $(/usr/bin/find /docker-entrypoint.d/ -type f -name "*.pem"); do
-              echo "$0: Uploading certificates bundle: $f"
-              curl_put $f "certificates/$(basename $f .pem)"
-          done
-
-          echo "$0: Looking for JavaScript modules in /docker-entrypoint.d/..."
-          for f in $(/usr/bin/find /docker-entrypoint.d/ -type f -name "*.js"); do
-              echo "$0: Uploading JavaScript module: $f"
-              curl_put $f "js_modules/$(basename $f .js)"
-          done
-
-          echo "$0: Looking for configuration snippets in /docker-entrypoint.d/..."
-          for f in $(/usr/bin/find /docker-entrypoint.d/ -type f -name "*.json"); do
-              echo "$0: Applying configuration $f";
-              curl_put $f "config"
-          done
-
-          if [ ! -z ${UNIT_SOURCE+x} ]
-          then
-              echo $UNIT_SOURCE > /docker-entrypoint.d/unit_source.json
-              curl_put "/docker-entrypoint.d/unit_source.json" "config/listeners/*:9000/forwarded/source"
-          fi
-
-          echo "$0: Looking for shell scripts in /docker-entrypoint.d/..."
-          for f in $(/usr/bin/find /docker-entrypoint.d/ -type f -name "*.sh"); do
-              echo "$0: Launching $f";
-              "$f"
-          done
-
-          # warn on filetypes we don't know what to do with
-          for f in $(/usr/bin/find /docker-entrypoint.d/ -type f -not -name "*.sh" -not -name "*.json" -not -name "*.pem" -not -name "*.js"); do
-              echo "$0: Ignoring $f";
-          done
-      fi
-
-      echo "$0: Stopping Unit daemon after initial configuration..."
-      kill -TERM $(/bin/cat /var/run/unit.pid)
-
-      for i in $(/usr/bin/seq $WAITLOOPS); do
-          if [ -S /var/run/control.unit.sock ]; then
-              echo "$0: Waiting for control socket to be removed..."
-              /bin/sleep $SLEEPSEC
-          else
-              break
-          fi
-      done
-      if [ -S /var/run/control.unit.sock ]; then
-          kill -KILL $(/bin/cat /var/run/unit.pid)
-          rm -f /var/run/control.unit.sock
-      fi
-
-      echo
-      echo "$0: Unit initial configuration complete; ready for start up..."
-      echo
-fi
-
-php artisan config:cache
-php artisan event:cache
-php artisan route:cache
-php artisan view:cache
-php artisan storage:link
-if [ "$role" = "app" ]; then
-  php artisan migrate --force
-fi
-
-chown -R unit:unit /var/www/html
-chown -R www-data:www-data /var/www/html/storage /var/www/html/bootstrap/cache
-chmod -R 777 /var/www/html/storage /var/www/html/bootstrap/cache
-
-exec "$@"

app/docker/php/conf/app-fpm.conf

@@ -0,0 +1,28 @@
+[www]
+php_admin_value[upload_tmp_dir] = "/tmp/php/upload"
+php_admin_value[sys_temp_dir] = "/tmp/php/sys"
+php_admin_value[session.save_path] = "/tmp/php/session"
+php_admin_value[open_basedir] = "/var/www/html:/tmp/php:."
+php_admin_value[expose_php] = 0
+php_admin_value[memory_limit] = ${PHP_FPM_MEMORY_LIMIT}
+php_admin_value[upload_max_filesize] = ${PHP_FPM_UPLOAD_MAX_FILESIZE}
+php_admin_value[post_max_size] = ${PHP_FPM_POST_MAX_SIZE}
+php_admin_value[display_errors] = ${PHP_FPM_DISPLAY_ERRORS}
+php_admin_value[opcache.enable] = ${PHP_FPM_OPCACHE_ENABLE}
+php_admin_value[opcache.validate_timestamps] = ${PHP_FPM_OPCACHE_VALIDATE_TIMESTAMPS}
+php_admin_value[session.upload_progress.enabled] = ${PHP_FPM_SESSION_UPLOAD_PROGRESS_ENABLED}
+php_admin_value[fatal_error_backtraces] = ${PHP_FPM_FATAL_ERROR_BACKTRACES}
+
+pm = dynamic
+pm.max_children = ${PHP_FPM_PM_MAX_CHILDREN}
+pm.start_servers = ${PHP_FPM_PM_START_SERVERS}
+pm.min_spare_servers = ${PHP_FPM_PM_MIN_SPARE_SERVERS}
+pm.max_spare_servers = ${PHP_FPM_PM_MAX_SPARE_SERVERS}
+pm.max_requests = ${PHP_FPM_PM_MAX_REQUESTS}
+
+
+listen = 127.0.0.1:9000
+listen.mode = 0660
+listen.owner = www-data
+listen.group = www-data
+security.limit_extensions = .php

app/docker/php/start.sh

@@ -0,0 +1,65 @@
+#!/usr/bin/env sh
+set -e
+role=${CONTAINER_ROLE:-app}
+
+if [ "$APP_ENV" = "production" ]; then
+    php artisan config:cache
+    php artisan event:cache
+    php artisan route:cache
+    php artisan view:cache
+    php artisan storage:link
+fi
+
+if [ "$role" = "app" ]; then
+
+  export PHP_FPM_MEMORY_LIMIT="${PHP_FPM_MEMORY_LIMIT:-256m}"
+  export PHP_FPM_UPLOAD_MAX_FILESIZE="${PHP_FPM_UPLOAD_MAX_FILESIZE:-20m}"
+  export PHP_FPM_POST_MAX_SIZE="${PHP_FPM_POST_MAX_SIZE:-20m}"
+
+  export PHP_FPM_PM_MAX_CHILDREN="${PHP_FPM_PM_MAX_CHILDREN:-50}"
+  export PHP_FPM_PM_START_SERVERS="${PHP_FPM_PM_START_SERVERS:-10}"
+  export PHP_FPM_PM_MIN_SPARE_SERVERS="${PHP_FPM_PM_MIN_SPARE_SERVERS:-5}"
+  export PHP_FPM_PM_MAX_SPARE_SERVERS="${PHP_FPM_PM_MAX_SPARE_SERVERS:-20}"
+  export PHP_FPM_PM_MAX_REQUESTS="${PHP_FPM_PM_MAX_REQUESTS:-500}"
+
+  export PHP_FPM_FATAL_ERROR_BACKTRACES="${PHP_FPM_FATAL_ERROR_BACKTRACES:-0}"
+  export PHP_FPM_SESSION_UPLOAD_PROGRESS_ENABLED="${PHP_FPM_SESSION_UPLOAD_PROGRESS_ENABLED:-0}"
+
+  if [ "$APP_ENV" = "production" ]; then
+    export PHP_FPM_DISPLAY_ERRORS="${PHP_FPM_DISPLAY_ERRORS:-0}"
+    export PHP_FPM_OPCACHE_ENABLE="${PHP_FPM_OPCACHE_ENABLE:-1}"
+    export PHP_FPM_OPCACHE_VALIDATE_TIMESTAMPS="${PHP_FPM_OPCACHE_VALIDATE_TIMESTAMPS:-0}"
+
+    php artisan migrate --force
+  else
+    export PHP_FPM_DISPLAY_ERRORS="${PHP_FPM_DISPLAY_ERRORS:-1}"
+    export PHP_FPM_OPCACHE_ENABLE="${PHP_FPM_OPCACHE_ENABLE:-0}"
+    export PHP_FPM_OPCACHE_VALIDATE_TIMESTAMPS="${PHP_FPM_OPCACHE_VALIDATE_TIMESTAMPS:-1}"
+  fi
+
+  if [ ! -w /var/www/html/storage ]; then
+    echo "ERROR: /var/www/html/storage must be writable."
+    echo "Fix permissions on host/volume for the www-data user."
+    exit 1
+  fi
+
+  exec php-fpm
+elif [ "$role" = "queue" ]; then
+    echo "Running the queue..."
+    while [ true ]
+    do
+      php /var/www/html/artisan queue:work --verbose --sleep=5 --tries=100 --backoff=10 --max-time=3600 --queue=high,normal,low,default
+    done
+elif [ "$role" = "scheduler" ]; then
+    while [ true ]
+    do
+      php /var/www/html/artisan schedule:run --verbose --no-interaction &
+      sleep 60
+    done
+elif [ "$role" = "websockets" ]; then
+    echo "Running the websockets..."
+    php /var/www/html/artisan reverb:start --port=9000
+else
+    echo "Could not match the container role \"$role\""
+    exit 1
+fi

app/docker/start_dev.sh

@@ -1,24 +0,0 @@
-#!/usr/bin/env sh
-set -e
-role=${CONTAINER_ROLE:-app}
-if [ "$role" = "app" ]; then
-    exec unitd --no-daemon --control unix:/var/run/control.unit.sock --user unit --group unit
-elif [ "$role" = "queue" ]; then
-    echo "Running the queue..."
-    while [ true ]
-    do
-      php /var/www/html/artisan queue:work --verbose --sleep=5 --tries=10 --max-time=3600
-    done
-elif [ "$role" = "websockets" ]; then
-    echo "Running the websockets..."
-    php /var/www/html/artisan reverb:start --port=9000
-elif [ "$role" = "scheduler" ]; then
-    while [ true ]
-    do
-      php /var/www/html/artisan schedule:run --verbose --no-interaction &
-      sleep 60
-    done
-else
-    echo "Could not match the container role \"$role\""
-    exit 1
-fi

app/docker/start_prod.sh

@@ -1,24 +0,0 @@
-#!/usr/bin/env sh
-set -e
-role=${CONTAINER_ROLE:-app}
-if [ "$role" = "app" ]; then
-    exec unitd --no-daemon --control unix:/var/run/control.unit.sock --user unit --group unit
-elif [ "$role" = "queue" ]; then
-    echo "Running the queue..."
-    while [ true ]
-    do
-      php /var/www/html/artisan queue:work --verbose --sleep=5 --tries=10 --max-time=3600
-    done
-elif [ "$role" = "websockets" ]; then
-    echo "Running the websockets..."
-    php /var/www/html/artisan reverb:start --port=9000
-elif [ "$role" = "scheduler" ]; then
-    while [ true ]
-    do
-      php /var/www/html/artisan schedule:run --verbose --no-interaction &
-      sleep 60
-    done
-else
-    echo "Could not match the container role \"$role\""
-    exit 1
-fi

app/docker/unit-config.json

@@ -1,69 +0,0 @@
-{
-    "listeners": {
-        "*:9000": {
-            "pass": "routes",
-            "forwarded": {
-                "client_ip": "X-Forwarded-For",
-                "recursive": false,
-                "source": [
-
-                ]
-            }
-        }
-    },
-
-    "routes": [
-        {
-            "match": {
-                "uri": [
-                    "/index.php/",
-                    "~^/index\\.php/.*",
-                    "~\\.php$"
-                ]
-            },
-            "action": {
-                "return": 404
-            }
-        },
-        {
-            "action": {
-                "share": "/var/www/html/public$uri",
-                "fallback": {
-                    "pass": "applications/laravel"
-                }
-            }
-        }
-    ],
-
-    "applications": {
-        "laravel": {
-            "type": "php",
-            "root": "/var/www/html/public",
-            "working_directory": "/var/www/html",
-            "user": "www-data",
-            "group": "www-data",
-            "script": "index.php",
-            "processes": {
-                "max": 10,
-                "spare": 5,
-                "idle_timeout": 20
-            },
-            "options": {
-                "file": "/usr/local/etc/php/php.ini",
-                "admin": {
-                    "upload_tmp_dir": "/tmp/php/upload",
-                    "sys_temp_dir": "/tmp/php/sys",
-                    "session.save_path": "/tmp/php/session",
-                    "open_basedir": "/var/www/html:/tmp/php:.",
-                    "memory_limit": "256M",
-                    "upload_max_filesize": "20M",
-                    "post_max_size": "20M",
-                    "expose_php": "0"
-                },
-                "user": {
-                    "display_errors": "0"
-                }
-            }
-        }
-    }
-}

app/docker/web/Dockerfile.dockerignore

@@ -0,0 +1,3 @@
+application/public/*.php
+application/public/**/*.php
+application/public/.htaccess

app/docker/web/conf/default.conf.template

@@ -0,0 +1,45 @@
+map $FRONTEND_PORT $host_with_port {
+    ""      $host;
+    default "$host:$FRONTEND_PORT";
+}
+
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+
+    client_max_body_size ${NGINX_CLIENT_MAX_BODY_SIZE};
+
+    disable_symlinks if_not_owner from=/usr/share/nginx/html;
+
+    index index.html;
+    root /usr/share/nginx/html;
+
+    ${GZIP_BLOCK}
+    ${REAL_IP_BLOCK}
+
+    location / {
+        location / {
+            try_files $uri @fallback;
+        }
+        ${API_DOCS_BLOCK}
+        location ~ \.php$ {
+            return 404;
+        }
+        location ~ /\. {
+            return 404;
+        }
+        location ~ /\.(ht|svn|git) {
+            return 404;
+        }
+    }
+
+    location @fallback {
+        fastcgi_pass ${BACKEND_HOST}:${BACKEND_PORT};
+        fastcgi_index index.php;
+        fastcgi_param REDIRECT_STATUS 200;
+        fastcgi_param SCRIPT_FILENAME /var/www/html/public/index.php;
+        fastcgi_param SCRIPT_NAME /index.php;
+        fastcgi_param HTTP_HOST $host_with_port;
+        include /etc/nginx/fastcgi_params;
+    }
+}

app/docker/web/conf/fastcgi_params

@@ -0,0 +1,22 @@
+fastcgi_param  QUERY_STRING       $query_string;
+fastcgi_param  REQUEST_METHOD     $request_method;
+fastcgi_param  CONTENT_TYPE       $content_type;
+fastcgi_param  CONTENT_LENGTH     $content_length;
+
+fastcgi_param  REQUEST_URI        $request_uri;
+fastcgi_param  DOCUMENT_URI       $document_uri;
+fastcgi_param  DOCUMENT_ROOT      $document_root;
+fastcgi_param  SERVER_PROTOCOL    $server_protocol;
+fastcgi_param  HTTPS              $https if_not_empty;
+
+fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;
+fastcgi_param  SERVER_SOFTWARE    nginx;
+
+fastcgi_param  REMOTE_ADDR        $remote_addr;
+fastcgi_param  REMOTE_PORT        $remote_port;
+fastcgi_param  SERVER_ADDR        $server_addr;
+fastcgi_param  SERVER_PORT        $server_port;
+fastcgi_param  SERVER_NAME        $server_name;
+
+fastcgi_param  HTTP_X_FORWARDED_FOR   $proxy_add_x_forwarded_for;
+fastcgi_param  HTTP_X_REAL_IP		  $remote_addr;

app/docker/web/start.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env sh
+
+if [ "$IS_GZIP" = "1" ]; then
+  GZIP_BLOCK='gzip on;
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_comp_level 6;
+    gzip_buffers 16 8k;
+    gzip_http_version 1.1;
+    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
+    gzip_min_length 1024;'
+else
+  GZIP_BLOCK=''
+fi
+export GZIP_BLOCK
+
+if [ -n "$TRUSTED_PROXY_CIDR" ]; then
+  REAL_IP_BLOCK="set_real_ip_from $TRUSTED_PROXY_CIDR;
+    real_ip_header X-Forwarded-For;
+    real_ip_recursive on;"
+else
+  REAL_IP_BLOCK=""
+fi
+export REAL_IP_BLOCK
+
+export SWAGGER_HOST="${SWAGGER_HOST:-swagger}"
+export SWAGGER_PORT="${SWAGGER_PORT:-8080}"
+
+export BACKEND_HOST="${BACKEND_HOST:-app}"
+export BACKEND_PORT="${BACKEND_PORT:-9000}"
+
+export FRONTEND_PORT="${FRONTEND_PORT:-''}"
+export NGINX_CLIENT_MAX_BODY_SIZE="${NGINX_CLIENT_MAX_BODY_SIZE:-'20m'}"
+
+if [ "$ENABLE_API_DOCS" = "1" ]; then
+  API_DOCS_BLOCK="location /api-docs {
+        proxy_pass http://${SWAGGER_HOST}:${SWAGGER_PORT};
+        proxy_set_header HTTP_HOST \$host_with_port;
+        proxy_set_header Host \$host_with_port;
+        proxy_set_header X-Forwarded-Host \$http_host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+
+        proxy_redirect off;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade \$http_upgrade;
+    }"
+else
+  API_DOCS_BLOCK=""
+fi
+export API_DOCS_BLOCK
+
+envsubst '$BACKEND_HOST $BACKEND_PORT $GZIP_BLOCK $REAL_IP_BLOCK $FRONTEND_PORT $NGINX_CLIENT_MAX_BODY_SIZE $API_DOCS_BLOCK' \
+  < /etc/nginx/templates/default.conf.template \
+  > /etc/nginx/conf.d/default.conf
+
+exec nginx -g 'daemon off;'

nginx/Dockerfile

@@ -1,3 +0,0 @@
-FROM nginx:alpine3.18-slim
-
-COPY nginx.conf /etc/nginx/conf.d/default.conf

nginx/nginx.conf

@@ -1,36 +0,0 @@
-server {
-    listen 80 default_server;
-    listen [::]:80 default_server;
-    server_name captcha;
-
-    client_max_body_size 1024M;
-
-    root /var/www/html/public;
-
-    location / {
-        location /api-docs {
-            proxy_pass http://swagger:8080;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Forwarded-Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
-
-            proxy_redirect off;
-            proxy_http_version 1.1;
-            proxy_set_header Upgrade $http_upgrade;
-        }
-        location / {
-            proxy_pass http://app:9000;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Forwarded-Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
-
-            proxy_redirect off;
-            proxy_http_version 1.1;
-            proxy_set_header Upgrade $http_upgrade;
-        }
-    }
-}