FROM php:8.5.8-fpm-trixie

ARG PHP_REDIS_VERSION=6.3.0

WORKDIR /data

# Install Apache + build deps for the PHP extensions we need
RUN apt-get update \
    && apt-get install -y --no-install-recommends \
        ca-certificates \
        logrotate \
        ssl-cert \
        apache2 \
        libzip-dev \
        libonig-dev \
        pkg-config \
        $PHPIZE_DEPS \
    && echo "ServerName localhost" >> /etc/apache2/apache2.conf \
    \
    # PHP extensions (mysqli/pdo_mysql, mbstring, zip, redis)
    # xml + curl are already built into the base image
    && docker-php-ext-install mysqli pdo_mysql mbstring zip \
    && pecl install redis-${PHP_REDIS_VERSION} \
    && docker-php-ext-enable redis \
    \
    # Keep the runtime shared libs the compiled extensions link against;
    # only the -dev/headers packages and build toolchain get dropped below
    && apt-mark manual libzip5 libonig5 \
    \
    # Drop the build-only toolchain and headers now that the extensions are built
    && apt-get purge -y --auto-remove \
        $PHPIZE_DEPS \
        libzip-dev \
        libonig-dev \
    && rm -rf /var/lib/apt/lists/* /tmp/*

# Apache + PHP-FPM configuration + performance tuning
RUN \
    # Enable modules
    a2enmod proxy_fcgi setenvif expires headers rewrite remoteip socache_shmcb ssl deflate \
    \
    # Switch to MPM event
    && a2dismod mpm_prefork \
    && a2enmod mpm_event \
    \
    # Remote IP config
    && echo 'RemoteIPHeader X-Forwarded-For' > /etc/apache2/conf-available/remoteip.conf \
    && echo 'RemoteIPTrustedProxy 127.0.0.1' >> /etc/apache2/conf-available/remoteip.conf \
    && a2enconf remoteip \
    && sed -ri 's/([[:space:]]*LogFormat[[:space:]]+"[^"]*)%h([^"]*")/\1%a\2/g' /etc/apache2/*.conf \
    \
    # Security headers
    && echo 'Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"' >> /etc/apache2/conf-available/security.conf \
    && echo 'Header always set X-Content-Type-Options "nosniff"' >> /etc/apache2/conf-available/security.conf \
    && echo 'Header always set X-Frame-Options "SAMEORIGIN"' >> /etc/apache2/conf-available/security.conf \
    \
    # Compression
    && echo 'AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css application/javascript application/json' > /etc/apache2/conf-available/compression.conf \
    && a2enconf compression \
    \
    # KeepAlive tuning
    && printf '%s\n' \
        'KeepAlive On' \
        'MaxKeepAliveRequests 100' \
        'KeepAliveTimeout 2' \
        > /etc/apache2/conf-available/keepalive.conf \
    && a2enconf keepalive \
    \
    # MPM Event tuning
    && printf '%s\n' \
        '<IfModule mpm_event_module>' \
        '    StartServers             2' \
        '    MinSpareThreads         25' \
        '    MaxSpareThreads         75' \
        '    ThreadLimit             64' \
        '    ThreadsPerChild         25' \
        '    MaxRequestWorkers      150' \
        '    MaxConnectionsPerChild 1000' \
        '</IfModule>' \
        > /etc/apache2/conf-available/mpm-event-tuning.conf \
    && a2enconf mpm-event-tuning \
    \
    # Logrotate
    && printf '%s\n' \
        '/var/log/apache2/*.log {' \
        '    weekly' \
        '    missingok' \
        '    rotate 4' \
        '    compress' \
        '    delaycompress' \
        '    notifempty' \
        '    create 640 root adm' \
        '}' \
        > /etc/logrotate.d/apache2 \
    \
    # PHP-FPM tuning (unix socket, to match the Apache vhost's proxy_fcgi handler)
    && mkdir -p /run/php \
    && sed -i \
        -e 's|^;*listen = .*|listen = /run/php/php-fpm.sock|' \
        -e 's/^;*listen.owner = .*/listen.owner = www-data/' \
        -e 's/^;*listen.group = .*/listen.group = www-data/' \
        -e 's/^;*listen.mode = .*/listen.mode = 0660/' \
        -e 's/^pm = .*/pm = dynamic/' \
        -e 's/^pm.max_children = .*/pm.max_children = 20/' \
        -e 's/^pm.start_servers = .*/pm.start_servers = 2/' \
        -e 's/^pm.min_spare_servers = .*/pm.min_spare_servers = 2/' \
        -e 's/^pm.max_spare_servers = .*/pm.max_spare_servers = 5/' \
        /usr/local/etc/php-fpm.d/www.conf

# PHP custom config — /php is layered in front of the image's default conf.d
ENV PHP_INI_SCAN_DIR="/php:${PHP_INI_DIR}/conf.d"

COPY php.ini /php/php.ini
COPY 000-default.conf /etc/apache2/sites-available/000-default.conf
COPY --chmod=755 start.sh /start.sh

RUN a2ensite 000-default

EXPOSE 80

CMD ["/start.sh"]