# Official PHP + Apache image for running novaconium in production.

# Build: docker build --no-cache -t novaconium:latest .

# Fixed: full official image tag (was missing "php:")
FROM php:8.5.8-apache-trixie

# Pin to a specific tag (not a floating "php:apache") so a rebuild months
# from now installs the same PHP/Apache/Debian base instead of whatever
# happens to be current that day. Bump the tag above deliberately (e.g. to
# pick up a PHP security release), not as a side effect of an unrelated
# rebuild.

RUN apt-get update \
    && apt-get install -y --no-install-recommends libsqlite3-dev curl ca-certificates \
    && rm -rf /var/lib/apt/lists/* \
    && docker-php-ext-install pdo_sqlite pdo_mysql \
    && a2enmod rewrite

# Dart Sass standalone. It's a *runtime* dependency: the /main.css route
# (a "typed text page" — see /admin/docs/text-pages and /admin/docs/styling)
# has App\SassExtension shell out to `sass` on a cache miss to compile
# App/pages/main.css/main.sass, then the result is cached like any other
# page. Debian trixie has no usable dart-sass package, so pull the pinned
# upstream release tarball. Bump DART_SASS_VERSION deliberately, like the
# PHP base tag above.
ENV DART_SASS_VERSION=1.83.4
RUN set -eux; \
    arch="$(dpkg --print-architecture)"; \
    case "$arch" in \
      amd64) sass_arch='x64' ;; \
      arm64) sass_arch='arm64' ;; \
      *) echo "unsupported arch: $arch" >&2; exit 1 ;; \
    esac; \
    curl -fsSL -o /tmp/dart-sass.tar.gz \
      "https://github.com/sass/dart-sass/releases/download/${DART_SASS_VERSION}/dart-sass-${DART_SASS_VERSION}-linux-${sass_arch}.tar.gz"; \
    tar -xzf /tmp/dart-sass.tar.gz -C /opt; \
    rm /tmp/dart-sass.tar.gz; \
    ln -s /opt/dart-sass/sass /usr/local/bin/sass; \
    sass --version

# Point DocumentRoot at public/ and allow .htaccess overrides there.
RUN sed -ri -e 's#/var/www/html#/var/www/html/public#g' \
      /etc/apache2/sites-available/*.conf \
    && sed -ri -e '/<Directory \/var\/www\/>/,/<\/Directory>/ s/AllowOverride None/AllowOverride All/' \
      /etc/apache2/apache2.conf

WORKDIR /var/www/html

# Copy application files
COPY novaconium/ ./novaconium/
COPY public/ ./public/
COPY App/ ./App/

# Pristine copy of the starter App/, kept outside /var/www/html so
# docker-entrypoint.sh can reseed a bind-mounted (but empty/missing) App/ on
# first start — see docker-entrypoint.sh and /admin/docs/docker.
RUN cp -a App/ /opt/novaconium-app-default/

# Runtime-writable paths — cache/uploads/App/data are bind-mounted from the
# host by docker-compose.yml, so docker-entrypoint.sh re-chowns them at
# every container start (a build-time chown only survives on the image
# layer, not on a host bind mount). This chown still covers a fresh
# container with no bind mounts configured at all.
RUN mkdir -p public/cache public/uploads data \
    && touch novaconium/contact-log.txt \
    && chown -R www-data:www-data public/cache public/uploads data App novaconium/contact-log.txt

COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
RUN chmod +x /usr/local/bin/docker-entrypoint.sh

EXPOSE 80

ENTRYPOINT ["docker-entrypoint.sh"]
CMD ["apache2-foreground"]