# syntax=docker/dockerfile:1

# ============================================================
# Stage 1 — PHP dependencies (Composer)
# ============================================================
FROM composer:2 AS vendor
WORKDIR /app
COPY composer.json composer.lock symfony.lock ./
# --no-scripts: the Symfony kernel isn't fully copied yet; scripts run later in entrypoint.
RUN composer install \
        --no-dev --no-scripts --no-interaction \
        --prefer-dist --optimize-autoloader \
        --ignore-platform-reqs

# ============================================================
# Stage 2 — Frontend assets (Webpack Encore / React 19)
# ============================================================
FROM node:22-alpine AS assets
WORKDIR /app
# vendor is required: package.json references "@symfony/ux-react": "file:vendor/symfony/ux-react/assets"
COPY --from=vendor /app/vendor ./vendor
COPY package.json yarn.lock ./
RUN yarn install --frozen-lockfile
COPY webpack.config.js postcss.config.js tsconfig.json ./
COPY assets ./assets
COPY public ./public
RUN yarn build   # outputs to public/build

# ============================================================
# Stage 3 — Runtime (PHP-FPM + Nginx via Supervisor)
# ============================================================
FROM php:8.2-fpm-alpine AS runtime

# System deps + PHP extensions.
#   pdo_mysql -> MariaDB,  intl -> Symfony,  opcache -> perf,  redis -> Messenger/cache transport
#
# Extensions are installed via mlocati/install-php-extensions, which fetches
# PREBUILT binaries instead of compiling from source. The previous approach
# (pecl install redis + docker-php-ext-install) compiled redis/intl/pdo_mysql
# on every build — minutes of CPU that intermittently overran Coolify's build
# timeout (exit 255). The prebuilt path is seconds and needs no .build-deps.
RUN set -eu; \
    retry() { for i in 1 2 3 4 5; do "$@" && return 0; echo "retry $i: $*"; sleep 5; done; return 1; }; \
    retry apk add --no-cache nginx supervisor \
 && retry curl -sSLf https://github.com/mlocati/docker-php-extension-installer/releases/latest/download/install-php-extensions \
        -o /usr/local/bin/install-php-extensions \
 && chmod +x /usr/local/bin/install-php-extensions \
 && install-php-extensions pdo_mysql intl opcache redis \
 && rm -f /usr/local/bin/install-php-extensions

WORKDIR /app

# Application source.
COPY . .
# Built dependencies from earlier stages (overwrite anything from the source copy).
COPY --from=vendor /app/vendor ./vendor
COPY --from=assets /app/public/build ./public/build

# Container configuration.
COPY docker/php/php.ini /usr/local/etc/php/conf.d/zz-app.ini
COPY docker/php/zz-pool.conf /usr/local/etc/php-fpm.d/zz-pool.conf
COPY docker/nginx/default.conf /etc/nginx/http.d/default.conf
COPY docker/supervisord.conf /etc/supervisor/conf.d/supervisord.conf
COPY docker/entrypoint.sh /usr/local/bin/entrypoint.sh

RUN chmod +x /usr/local/bin/entrypoint.sh \
 && mkdir -p var/cache var/log var/uploads public/uploads config/jwt \
 # Source may be copied with restrictive (0600) host perms; ensure the runtime
 # user (www-data) can read all app files — opcache preload runs as www-data
 # and otherwise fails with "Permission denied" on /app/config/preload.php.
 && chmod -R a+rX /app \
 && chown -R www-data:www-data var public/uploads config/jwt

EXPOSE 80
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
CMD ["supervisord", "-c", "/etc/supervisor/conf.d/supervisord.conf"]