added ai files

Rebuild on the official PHP image instead of Sury's repo on bare Debian.
Fixes surfaced along the way: missing pkg-config/libonig-dev broke the
zip/mbstring extension builds, purging libzip-dev also auto-removed the
libzip5 runtime lib the compiled zip.so needs, phpredis needed bumping to
6.3.0 for PHP 8.5 header compatibility, and the php-fpm.conf listen
directive sed didn't match the commented-out default line so FPM never
created its unix socket, causing 503s from Apache's proxy_fcgi handler.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

000-default.conf

@@ -1,16 +1,23 @@
-# Global log redirection to stdout and stderr
-ErrorLog "|/usr/bin/tee -a /var/log/apache2/error.log"
-CustomLog "|/usr/bin/tee -a /var/log/apache2/access.log" combined
-
 <VirtualHost *:80>
+    ServerName localhost
+
     DocumentRoot /data/public
+
     <Directory /data/public>
-        Options Indexes FollowSymLinks
+        Options FollowSymLinks
         AllowOverride All
         Require all granted
     </Directory>
 
-    # Remote IP configuration
-    RemoteIPHeader X-Forwarded-For
-    RemoteIPTrustedProxy 127.0.0.1
+    DirectoryIndex index.php index.html
+
+    # PHP-FPM handler
+    <FilesMatch \.php$>
+        SetHandler "proxy:unix:/run/php/php-fpm.sock|fcgi://localhost/"
+    </FilesMatch>
+
+    # Docker-friendly logging
+    ErrorLog /proc/self/fd/2
+    CustomLog /proc/self/fd/1 combined
+
 </VirtualHost>

AGENTS.md

@@ -0,0 +1,53 @@
+# AGENTS.md
+
+This file provides guidance to AI coding agents (e.g. opencode, DeepSeek-based agents) when working with code in this repository.
+
+## What this is
+
+CORXN is a Docker image definition (not an application) — a single `Dockerfile` built `FROM php:8.5.8-fpm-trixie` (official PHP image, Debian Trixie base) with Apache + Redis extension layered on top, intended as the base runtime for the [Novaconium PHP Framework](https://git.4lt.ca/4lt/novaconium). There is no application code here; the repo's output is the built Docker image `4lights/corxn`.
+
+## Key files
+
+- `Dockerfile` — builds the image: installs Apache via `apt`, builds PHP extensions (`mysqli`, `pdo_mysql`, `mbstring`, `zip` via `docker-php-ext-install`; `redis` via `pecl`) against the base image's pinned PHP 8.5.8 (`xml` and `curl` are already built into the base image, so they aren't reinstalled), enables `mpm_event` + PHP-FPM via `proxy_fcgi`, sets security headers, compression, keepalive, and MPM tuning, and configures logrotate. PHP custom config is loaded from `/php`, layered in front of the base image's default `conf.d` via `PHP_INI_SCAN_DIR`.
+- `000-default.conf` — Apache vhost, copied into the image. `DocumentRoot` is `/data/public`; PHP requests are proxied to the PHP-FPM unix socket at `/run/php/php-fpm.sock`. Logs go to stdout/stderr (`/proc/self/fd/1` and `2`) for Docker-friendly logging.
+- `php.ini` — custom PHP settings copied into the image at `/php/php.ini` (uploads, timezone `America/Vancouver`, OPcache tuned for production with `validate_timestamps=0`, sessions backed by Redis at `tcp://redis:6379`). Can be overridden at runtime by bind-mounting a different file to the same path.
+- `start.sh` — container entrypoint: starts `php-fpm` (daemonized) then runs `apachectl` in the foreground.
+- `docker-compose.yml` — sample compose stack showing the intended usage: `corxn` container + `redis` + `mariadb`, with `./test` (or an app checkout) mounted to `/data` so the app's `public/` dir is served.
+- `test/public` — a minimal PHP app used to sanity-check the built image (see Testing below).
+
+## Building and testing
+
+Build the image:
+```bash
+docker buildx build --no-cache -t 4lights/corxn:latest --load .
+```
+
+To bump the PHP version, change the base image tag in the `FROM` line (e.g. `php:8.5.9-fpm-trixie`) — the official image is versioned exactly, no separate pin mechanism needed.
+
+Test the build:
+```bash
+mkdir -p data/uploads && sudo chown -R 33:33 data/uploads && chmod 775 data/uploads
+docker compose up -d
+# Visit: http://localhost:8000/test.php
+# Verify: file upload works and green checkmarks appear
+```
+(UID 33 is `www-data` inside the container.)
+
+View logs: `docker logs corxn`
+
+## Publishing (requires explicit user confirmation before pushing)
+
+```bash
+sudo su
+docker buildx build --no-cache -t 4lights/corxn:8.5.8 -t 4lights/corxn:latest --load .
+docker login -u <username>
+docker push 4lights/corxn:8.5.8
+docker push 4lights/corxn:latest
+```
+
+## Architecture notes for changes
+
+- Any consuming app is expected to be mounted at `/data`, with its web-servable code under `/data/public` (matches `DocumentRoot` in `000-default.conf`).
+- PHP config changes belong in `php.ini` (image default) — downstream users override it by bind-mounting their own file over `/php/php.ini`, so avoid assuming values in `php.ini` are final.
+- Because `opcache.validate_timestamps=0`, PHP file changes require a container restart/FPM reload to take effect — relevant when iterating on `test/public` during image testing.
+- Sessions and app-level caching are expected to go through the `redis` service (session handler already wired to `tcp://redis:6379`); MariaDB is the expected DB backend (see `docker-compose.yml` env vars).

CLAUDE.md

@@ -0,0 +1,53 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## What this is
+
+CORXN is a Docker image definition (not an application) — a single `Dockerfile` built `FROM php:8.5.8-fpm-trixie` (official PHP image, Debian Trixie base) with Apache + Redis extension layered on top, intended as the base runtime for the [Novaconium PHP Framework](https://git.4lt.ca/4lt/novaconium). There is no application code here; the repo's output is the built Docker image `4lights/corxn`.
+
+## Key files
+
+- `Dockerfile` — builds the image: installs Apache via `apt`, builds PHP extensions (`mysqli`, `pdo_mysql`, `mbstring`, `zip` via `docker-php-ext-install`; `redis` via `pecl`) against the base image's pinned PHP 8.5.8 (`xml` and `curl` are already built into the base image, so they aren't reinstalled), enables `mpm_event` + PHP-FPM via `proxy_fcgi`, sets security headers, compression, keepalive, and MPM tuning, and configures logrotate. PHP custom config is loaded from `/php`, layered in front of the base image's default `conf.d` via `PHP_INI_SCAN_DIR`.
+- `000-default.conf` — Apache vhost, copied into the image. `DocumentRoot` is `/data/public`; PHP requests are proxied to the PHP-FPM unix socket at `/run/php/php-fpm.sock`. Logs go to stdout/stderr (`/proc/self/fd/1` and `2`) for Docker-friendly logging.
+- `php.ini` — custom PHP settings copied into the image at `/php/php.ini` (uploads, timezone `America/Vancouver`, OPcache tuned for production with `validate_timestamps=0`, sessions backed by Redis at `tcp://redis:6379`). Can be overridden at runtime by bind-mounting a different file to the same path.
+- `start.sh` — container entrypoint: starts `php-fpm` (daemonized) then runs `apachectl` in the foreground.
+- `docker-compose.yml` — sample compose stack showing the intended usage: `corxn` container + `redis` + `mariadb`, with `./test` (or an app checkout) mounted to `/data` so the app's `public/` dir is served.
+- `test/public` — a minimal PHP app used to sanity-check the built image (see Testing below).
+
+## Building and testing
+
+Build the image:
+```bash
+docker buildx build --no-cache -t 4lights/corxn:latest --load .
+```
+
+To bump the PHP version, change the base image tag in the `FROM` line (e.g. `php:8.5.9-fpm-trixie`) — the official image is versioned exactly, no separate pin mechanism needed.
+
+Test the build:
+```bash
+mkdir -p data/uploads && sudo chown -R 33:33 data/uploads && chmod 775 data/uploads
+docker compose up -d
+# Visit: http://localhost:8000/test.php
+# Verify: file upload works and green checkmarks appear
+```
+(UID 33 is `www-data` inside the container.)
+
+View logs: `docker logs corxn`
+
+## Publishing (requires explicit user confirmation before pushing)
+
+```bash
+sudo su
+docker buildx build --no-cache -t 4lights/corxn:8.5.8 -t 4lights/corxn:latest --load .
+docker login -u <username>
+docker push 4lights/corxn:8.5.8
+docker push 4lights/corxn:latest
+```
+
+## Architecture notes for changes
+
+- Any consuming app is expected to be mounted at `/data`, with its web-servable code under `/data/public` (matches `DocumentRoot` in `000-default.conf`).
+- PHP config changes belong in `php.ini` (image default) — downstream users override it by bind-mounting their own file over `/php/php.ini`, so avoid assuming values in `php.ini` are final.
+- Because `opcache.validate_timestamps=0`, PHP file changes require a container restart/FPM reload to take effect — relevant when iterating on `test/public` during image testing.
+- Sessions and app-level caching are expected to go through the `redis` service (session handler already wired to `tcp://redis:6379`); MariaDB is the expected DB backend (see `docker-compose.yml` env vars).

Dockerfile

@@ -1,53 +1,121 @@
-FROM debian:bookworm-20250224
+FROM php:8.5.8-fpm-trixie
+
+ARG PHP_REDIS_VERSION=6.3.0
 
 WORKDIR /data
 
-# Install necessary packages and configure PHP repository
-RUN apt-get update && apt-get install -y \
-    lsb-release ca-certificates curl apt-transport-https logrotate ssl-cert apache2 && \
-    echo "ServerName localhost" >> /etc/apache2/apache2.conf && \
-    curl -sSLo /tmp/debsuryorg-archive-keyring.deb https://packages.sury.org/debsuryorg-archive-keyring.deb && \
-    dpkg -i /tmp/debsuryorg-archive-keyring.deb && \
-    sh -c 'echo "deb [signed-by=/usr/share/keyrings/deb.sury.org-php.gpg] https://packages.sury.org/php/ $(lsb_release -sc) main" > /etc/apt/sources.list.d/php.list' && \
-    apt-get update && \
-    apt-get install -y \
-    php8.4 php8.4-cli php8.4-fpm php8.4-mysql php8.4-xml php8.4-mbstring php8.4-curl php8.4-zip php8.4-redis libapache2-mod-php8.4 && \
-    apt-get autoremove -y && \
-    apt-get clean && \
-    rm -rf /var/lib/apt/lists/* /tmp/*
+# Install Apache + build deps for the PHP extensions we need
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+        ca-certificates \
+        logrotate \
+        ssl-cert \
+        apache2 \
+        libzip-dev \
+        libonig-dev \
+        pkg-config \
+        $PHPIZE_DEPS \
+    && echo "ServerName localhost" >> /etc/apache2/apache2.conf \
+    \
+    # PHP extensions (mysqli/pdo_mysql, mbstring, zip, redis)
+    # xml + curl are already built into the base image
+    && docker-php-ext-install mysqli pdo_mysql mbstring zip \
+    && pecl install redis-${PHP_REDIS_VERSION} \
+    && docker-php-ext-enable redis \
+    \
+    # Keep the runtime shared libs the compiled extensions link against;
+    # only the -dev/headers packages and build toolchain get dropped below
+    && apt-mark manual libzip5 libonig5 \
+    \
+    # Drop the build-only toolchain and headers now that the extensions are built
+    && apt-get purge -y --auto-remove \
+        $PHPIZE_DEPS \
+        libzip-dev \
+        libonig-dev \
+    && rm -rf /var/lib/apt/lists/* /tmp/*
 
-# log management
-RUN cat <<EOF > /etc/logrotate.d/apache2
-/var/log/apache2/*.log {
-    weekly
-    missingok
-    rotate 4
-    compress
-    delaycompress
-    notifempty
-    create 640 root adm
-}
-EOF
+# Apache + PHP-FPM configuration + performance tuning
+RUN \
+    # Enable modules
+    a2enmod proxy_fcgi setenvif expires headers rewrite remoteip socache_shmcb ssl deflate \
+    \
+    # Switch to MPM event
+    && a2dismod mpm_prefork \
+    && a2enmod mpm_event \
+    \
+    # Remote IP config
+    && echo 'RemoteIPHeader X-Forwarded-For' > /etc/apache2/conf-available/remoteip.conf \
+    && echo 'RemoteIPTrustedProxy 127.0.0.1' >> /etc/apache2/conf-available/remoteip.conf \
+    && a2enconf remoteip \
+    && sed -ri 's/([[:space:]]*LogFormat[[:space:]]+"[^"]*)%h([^"]*")/\1%a\2/g' /etc/apache2/*.conf \
+    \
+    # Security headers
+    && echo 'Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"' >> /etc/apache2/conf-available/security.conf \
+    && echo 'Header always set X-Content-Type-Options "nosniff"' >> /etc/apache2/conf-available/security.conf \
+    && echo 'Header always set X-Frame-Options "SAMEORIGIN"' >> /etc/apache2/conf-available/security.conf \
+    \
+    # Compression
+    && echo 'AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css application/javascript application/json' > /etc/apache2/conf-available/compression.conf \
+    && a2enconf compression \
+    \
+    # KeepAlive tuning
+    && printf '%s\n' \
+        'KeepAlive On' \
+        'MaxKeepAliveRequests 100' \
+        'KeepAliveTimeout 2' \
+        > /etc/apache2/conf-available/keepalive.conf \
+    && a2enconf keepalive \
+    \
+    # MPM Event tuning
+    && printf '%s\n' \
+        '<IfModule mpm_event_module>' \
+        '    StartServers             2' \
+        '    MinSpareThreads         25' \
+        '    MaxSpareThreads         75' \
+        '    ThreadLimit             64' \
+        '    ThreadsPerChild         25' \
+        '    MaxRequestWorkers      150' \
+        '    MaxConnectionsPerChild 1000' \
+        '</IfModule>' \
+        > /etc/apache2/conf-available/mpm-event-tuning.conf \
+    && a2enconf mpm-event-tuning \
+    \
+    # Logrotate
+    && printf '%s\n' \
+        '/var/log/apache2/*.log {' \
+        '    weekly' \
+        '    missingok' \
+        '    rotate 4' \
+        '    compress' \
+        '    delaycompress' \
+        '    notifempty' \
+        '    create 640 root adm' \
+        '}' \
+        > /etc/logrotate.d/apache2 \
+    \
+    # PHP-FPM tuning (unix socket, to match the Apache vhost's proxy_fcgi handler)
+    && mkdir -p /run/php \
+    && sed -i \
+        -e 's|^;*listen = .*|listen = /run/php/php-fpm.sock|' \
+        -e 's/^;*listen.owner = .*/listen.owner = www-data/' \
+        -e 's/^;*listen.group = .*/listen.group = www-data/' \
+        -e 's/^;*listen.mode = .*/listen.mode = 0660/' \
+        -e 's/^pm = .*/pm = dynamic/' \
+        -e 's/^pm.max_children = .*/pm.max_children = 20/' \
+        -e 's/^pm.start_servers = .*/pm.start_servers = 2/' \
+        -e 's/^pm.min_spare_servers = .*/pm.min_spare_servers = 2/' \
+        -e 's/^pm.max_spare_servers = .*/pm.max_spare_servers = 5/' \
+        /usr/local/etc/php-fpm.d/www.conf
 
-RUN echo 'RemoteIPHeader X-Forwarded-For' > /etc/apache2/conf-available/remoteip.conf && \
-    echo 'RemoteIPTrustedProxy 127.0.0.1' >> /etc/apache2/conf-available/remoteip.conf && \
-    a2enconf remoteip && \
-    sed -ri 's/([[:space:]]*LogFormat[[:space:]]+"[^"]*)%h([^"]*")/\1%a\2/g' /etc/apache2/*.conf
+# PHP custom config — /php is layered in front of the image's default conf.d
+ENV PHP_INI_SCAN_DIR="/php:${PHP_INI_DIR}/conf.d"
 
-RUN mkdir -p /php && echo "PHP_INI_SCAN_DIR=/php" > /etc/environment
 COPY php.ini /php/php.ini
 COPY 000-default.conf /etc/apache2/sites-available/000-default.conf
+COPY --chmod=755 start.sh /start.sh
 
-# Security headers for Apache
-RUN echo 'Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"' >> /etc/apache2/conf-available/security.conf && \
-    echo 'Header always set X-Content-Type-Options "nosniff"' >> /etc/apache2/conf-available/security.conf && \
-    echo 'Header always set X-XSS-Protection "1; mode=block"' >> /etc/apache2/conf-available/security.conf && \
-    echo 'Header always set X-Frame-Options "SAMEORIGIN"' >> /etc/apache2/conf-available/security.conf
-
-RUN a2enmod expires headers rewrite remoteip socache_shmcb ssl
+RUN a2ensite 000-default
 
 EXPOSE 80
-CMD ["apachectl", "-D", "FOREGROUND"]
 
-HEALTHCHECK --interval=30s --timeout=10s --retries=3 \
-    CMD curl --silent --fail localhost:80 || exit 1
+CMD ["/start.sh"]

README.md

@@ -2,15 +2,15 @@
 
 # CORXN - The Core Foundation of Novaconium
 
-Dockerhub: https://hub.docker.com/r/4lights/phpcontainer
-Git Repo: https://git.4lt.ca/4lt/phpcontainer
+Links: [Dockerhub](https://hub.docker.com/r/4lights/corxn), [Git Repo](https://git.4lt.ca/4lt/CORXN)
 
 CORXN (core-ex-en) is a lightweight yet powerful Docker-based environment designed as the core foundation for the [Novaconium PHP Framework](https://git.4lt.ca/4lt/novaconium). 
 It provides a streamlined stack featuring Apache, the latest PHP version, Redis, and MariaDB, optimized for high performance.
 
 ## Features
 
-- **PHP Version**: 8.4.5
+- **Base**: official `php:8.5.8-fpm-trixie` image (Debian Trixie)
+- **PHP Version**: 8.5.8 (pinned)
 - **Apache Web Server**: Configured to run PHP applications
 - **Support for**:
   - `remoteip` (reverse proxy)
@@ -34,12 +34,21 @@ cd corxn
 
 ```bash
 sudo su
-docker buildx build --no-cache -t 4lights/corxn:6.0.0 -t 4lights/corxn:latest --load .
-docker login
-docker push 4lights/corxn:6.0.0
+docker buildx build --no-cache -t 4lights/corxn:8.5.8 -t 4lights/corxn:latest --load .
+docker login -u <username>
+docker push 4lights/corxn:8.5.8
 docker push 4lights/corxn:latest
 ```
+# Testing
 
-# References And Notes
+Here is how to text the build:
+```bash
+mkdir -p data/uploads && sudo chown -R 33:33 data/uploads && chmod 775 data/uploads
+docker compose up -d
+# Visit: http://localhost:8000/test.php
+# Test: file upload and that green checkmarks exist
+```
 
-Test using test.php
+# Logs
+
+```docker logs corxn```

docker-compose.yml

@@ -1,31 +1,31 @@
 # Sample Docker Compose
 services:
-  php-apache:
-    image: 4lights/phpcontainer:6.0.0
+  corxn:
+    image: 4lights/corxn:8.5.8
     ports:
       - "8000:80"
     volumes:
-      - ./:/data # looks for /data/public
-      - ./php.ini:/php/php.ini  # Optional override php.ini
-      - ./data/logs:/var/log/apache2  # Optional Logs
+      - ./test:/data # looks for /data/public
+      - ./php.ini:/php/php.ini:ro # Optional override php.ini
+      - ./data/uploads:/data/public/uploads
     restart: unless-stopped
     networks:
       - proxy
       - internal
 
   redis:
-    image: redis:latest
+    image: redis:7
     networks:
       - internal
     restart: unless-stopped
 
   mariadb:
-    image: mariadb:latest
+    image: mariadb:11
     environment:
-      MYSQL_ROOT_PASSWORD: rootpassword
-      MYSQL_DATABASE: dbname
-      MYSQL_USER: user
-      MYSQL_PASSWORD: password
+      - MYSQL_ROOT_PASSWORD=rootpassword
+      - MYSQL_DATABASE=dbname
+      - MYSQL_USER=user
+      - MYSQL_PASSWORD=password
     volumes:
       - ./data/db:/var/lib/mysql
     networks:

docs/phpmyadmin.md

@@ -0,0 +1,5 @@
+# PHPMYADMIN
+
+You may want to use PHPmyAdmin for testing.
+
+Checkout [Docker Cookbooks](https://github.com/nickyeoman/docker-compose-cookbooks/blob/master/phpmyadmin/docker-compose.yml) for an example.

php.ini

@@ -1,55 +1,53 @@
 [PHP]
-; Basic PHP settings
+; Performance
 max_execution_time = 30
-memory_limit = 500M
+max_input_time = 60
+memory_limit = 512M
+
+; Uploads
 upload_max_filesize = 100M
 post_max_size = 100M
-max_input_time = 60
+
+; Timezone
 date.timezone = America/Vancouver
 
-; Error handling
-display_errors = On
-display_startup_errors = On
+; Errors (production-safe)
+display_errors = Off
+display_startup_errors = Off
 log_errors = On
-error_log = /var/log/php_errors.log
+error_log = /proc/self/fd/2
 
-; Session settings
+; Sessions
 session.save_path = "/var/lib/php/sessions"
 session.gc_maxlifetime = 1440
 session.cookie_lifetime = 0
 session.use_strict_mode = 1
 
+; File handling
+file_uploads = On
+allow_url_fopen = On
+
 ; Realpath cache
 realpath_cache_size = 4096k
 realpath_cache_ttl = 120
 
-; File upload settings
-file_uploads = On
-allow_url_fopen = On
-
-; Redis settings (ensure Redis extension is loaded)
-extension=redis.so
-
-; mbstring settings (useful for multi-byte encoding handling)
-mbstring.language = Japanese
-mbstring.internal_encoding = UTF-8
-mbstring.http_input = auto
-mbstring.http_output = UTF-8
-mbstring.detect_order = auto
-mbstring.substitute_character = none
-
-; cURL settings
+; cURL
 curl.cainfo = "/etc/ssl/certs/ca-certificates.crt"
 
-; SMTP settings (for sending mail, if needed)
+; Mail (optional)
 SMTP = localhost
 sendmail_path = /usr/sbin/sendmail -t -i
 
-; Extension loading
-extension=curl
-extension=mbstring
-extension=redis
-extension=xml
-extension=mysqli
-extension=pdo_mysql
-extension=zip
+; OPcache (IMPORTANT)
+opcache.enable=1
+opcache.enable_cli=1
+opcache.memory_consumption=192
+opcache.interned_strings_buffer=16
+opcache.max_accelerated_files=20000
+opcache.validate_timestamps=0
+opcache.revalidate_freq=0
+opcache.fast_shutdown=1
+
+; Redis
+session.save_handler = redis
+session.save_path = "tcp://redis:6379"

start.sh

@@ -0,0 +1,6 @@
+#!/bin/bash
+set -e
+
+php-fpm -D
+
+exec apachectl -D FOREGROUND

test/public/test.php

@@ -74,7 +74,7 @@
 
 <div class="container">
     <h1>PHP Container Test Script</h1>
-    <p><a href="https://git.4lt.ca/4lt/phpcontainer">Four Lights PHP Container</a></p>
+    <p><a href="https://git.4lt.ca/4lt/CORXN">Four Lights PHP Container: CORXN</a></p>
 
     
     <h2>Server Information</h2>
@@ -129,11 +129,7 @@
     <?php
     if ($_SERVER['REQUEST_METHOD'] == 'POST' && isset($_FILES['testfile'])) {
         if ($_FILES['testfile']['error'] === UPLOAD_ERR_OK) {
-            $uploadDir = '/data/public/uploads/';
-
-            if (!is_dir($uploadDir)) {
-                mkdir($uploadDir, 0777, true);
-            }
+            $uploadDir = __DIR__ . '/uploads/';
 
             $destination = $uploadDir . basename($_FILES['testfile']['name']);