# Shared runtime image for ALL 12 Yii2 backend microservices.
#
# Under Docker Compose the app code is bind-mounted at /app. On ECS it is NOT — each
# service's own Dockerfile is FROM this image and COPYs its code in, then installs its
# composer dependencies in a build stage. This image supplies only the runtime:
# php-fpm, nginx and supervisor.
#
# PHP 8.2 matches the XAMPP 8.2.4 the codebase runs on today. Only nibe_datamanager
# declares php >=8.2 in composer.json; the rest declare >=5.6 or >=7.4, which are lower
# bounds and resolve cleanly here. The one exception is b2g_filemst, which locks three
# packages whose constraints exclude 8.2 — see the note in b2g_filemst/Dockerfile.
#
# Pinned to a patch release, not the floating 8.2 tag: CD only rebuilds this base when
# docker/php-nginx/ changes, so a floating tag left ECR's :8.2 on whatever patch was
# current at the last rebuild. 8.2.35 fixes CVE-2026-109618/109619 (CERT-EU SA 2026-018).
# Bump the patch here to pick up future PHP security releases.
FROM php:8.2.35-fpm-alpine

# PHP extensions required across the Yii2 services (mlocati installer
# resolves build deps and cleans them up in the same layer).
ADD https://github.com/mlocati/docker-php-extension-installer/releases/latest/download/install-php-extensions /usr/local/bin/
RUN chmod +x /usr/local/bin/install-php-extensions && \
    install-php-extensions pdo_mysql mysqli mbstring gd intl bcmath opcache zip exif imagick
# NOTE: memcached ext omitted — pecl.php.net no longer serves it and no service
# requires it at boot (filemst's MemcacheMaintain is unused by config). If needed
# later: install-php-extensions memcached-3.1.5

# ghostscript provides the `gs` binary ImageMagick's PDF delegate shells out to.
# Imagick alone can create/write PDFs but CANNOT rasterize (readImage) one to
# JPEG/PNG without it — that's exactly what b2g_usermgmt's pledge-certificate
# PDF->JPEG conversion (UmController::generatePledgeCertificate) does, and it was
# silently falling back to uploading the raw PDF on every prod request before this.
RUN apk add --no-cache nginx supervisor ghostscript && \
    mkdir -p /run/nginx /var/log/supervisor && \
    # Alpine's imagemagick package ships policy.xml with PDF/PS/EPS read blocked by
    # default (hardening against Ghostscript CVEs) — without this, Imagick::readImage()
    # on a PDF throws "not authorized" instead of ever reaching `gs`.
    for f in /etc/ImageMagick-7/policy.xml /etc/ImageMagick-6/policy.xml; do \
        [ -f "$f" ] && sed -i -E 's/rights="none"([^>]*pattern="(PDF|PS|EPS|XPS)")/rights="read"\1/' "$f" || true; \
    done

COPY nginx.conf /etc/nginx/nginx.conf
COPY php.ini /usr/local/etc/php/conf.d/zz-b2g.ini
COPY php-fpm-pool.conf /usr/local/etc/php-fpm.d/zz-b2g.conf
COPY supervisord.conf /etc/supervisord.conf

WORKDIR /app
EXPOSE 80 81 82 83 84

CMD ["supervisord", "-c", "/etc/supervisord.conf"]