FROM php:7.4.33-fpm-bullseye

ARG APP_ENV=production
ARG WWWGROUP=1000
ARG WWWUSER=1000

ENV APP_ENV=${APP_ENV} \
    COMPOSER_ALLOW_SUPERUSER=1 \
    COMPOSER_HOME=/composer \
    COMPOSER_MEMORY_LIMIT=-1

# PHP extensions
RUN apt-get update && apt-get install -y --no-install-recommends \
    curl \
    unzip \
    git \
    libpq-dev \
    libpng-dev \
    libjpeg62-turbo-dev \
    libfreetype6-dev \
    libmagickwand-dev \
    imagemagick \
    libxml2-dev \
    libzip-dev \
    libicu-dev \
    libcurl4-openssl-dev \
    libssl-dev \
    zlib1g-dev \
    libonig-dev \
    apache2 \
    apache2-utils \
    supervisor \
    libcap2-bin \
    && rm -rf /var/lib/apt/lists/*

RUN docker-php-ext-configure gd \
        --with-freetype \
        --with-jpeg \
    && docker-php-ext-configure intl \
    && docker-php-ext-install -j$(nproc) \
        pdo \
        pdo_pgsql \
        pgsql \
        gd \
        xml \
        mbstring \
        intl \
        curl \
        zip \
        opcache \
        bcmath

RUN pecl install imagick-3.7.0 \
    && docker-php-ext-enable imagick \
    && pecl install redis-5.3.7 \
    && docker-php-ext-enable redis \
    && pecl clear-cache

# ─── Composer (antes do allow_url_fopen=Off) ───
RUN curl -sS https://getcomposer.org/installer | php -- \
        --install-dir=/usr/local/bin \
        --filename=composer \
        --version=2.2.21 \
    && composer --version

# PHP config
RUN { \
    echo 'allow_url_fopen = Off'; \
    echo 'allow_url_include = Off'; \
    echo 'display_errors = Off'; \
    echo 'enable_dl = Off'; \
    echo 'error_log = /var/log/php/error.log'; \
    echo 'file_uploads = On'; \
    echo 'log_errors = On'; \
    echo 'max_execution_time = 300'; \
    echo 'max_file_uploads = 50'; \
    echo 'max_input_time = 300'; \
    echo 'max_input_vars = 5000'; \
    echo 'memory_limit = 256M'; \
    echo 'post_max_size = 105M'; \
    echo 'session.gc_maxlifetime = 2880'; \
    echo 'upload_max_filesize = 100M'; \
    echo ''; \
    echo 'opcache.enable = 0'; \
    echo 'opcache.enable_cli = 0'; \
    echo 'opcache.memory_consumption = 128'; \
    echo 'opcache.interned_strings_buffer = 16'; \
    echo 'opcache.max_accelerated_files = 16229'; \
    echo 'opcache.revalidate_freq = 2'; \
    echo 'opcache.fast_shutdown = 1'; \
    echo 'opcache.validate_timestamps = 1'; \
    echo ''; \
    echo 'expose_php = Off'; \
    echo 'zlib.output_compression = Off'; \
    echo 'realpath_cache_size = 4096K'; \
    echo 'realpath_cache_ttl = 600'; \
    echo 'date.timezone = "America/Sao_Paulo"'; \
} > /usr/local/etc/php/conf.d/sucesu-recomends.ini

# Log de erros PHP FORA do docroot (gravável pelo www-data do FPM)
RUN mkdir -p /var/log/php && chown -R www-data:www-data /var/log/php

# ─── Apache: mpm_event + mod_http2 + mod_cache + mod_proxy_fcgi ───
RUN a2dismod mpm_prefork \
    && a2enmod mpm_event \
    && a2enmod http2 ssl proxy proxy_fcgi rewrite headers expires \
    && sed -i 's/^ServerTokens.*/ServerTokens Prod/' /etc/apache2/conf-available/security.conf \
    && sed -i 's/^ServerSignature.*/ServerSignature Off/' /etc/apache2/conf-available/security.conf

# DocumentRoot para Laravel
RUN sed -i 's|DocumentRoot /var/www/html|DocumentRoot /var/www/html/public|' /etc/apache2/sites-available/000-default.conf

# Config de diretório do Laravel
RUN echo '<Directory /var/www/html/public>' > /etc/apache2/conf-available/laravel.conf \
    && echo '    Options Indexes FollowSymLinks' >> /etc/apache2/conf-available/laravel.conf \
    && echo '    AllowOverride All' >> /etc/apache2/conf-available/laravel.conf \
    && echo '    Require all granted' >> /etc/apache2/conf-available/laravel.conf \
    && echo '</Directory>' >> /etc/apache2/conf-available/laravel.conf \
    && a2enconf laravel

# Proxy FCGI: envia .php para PHP-FPM
RUN echo '<IfModule mod_proxy_fcgi.c>' > /etc/apache2/conf-available/php-fpm.conf \
    && echo '    <FilesMatch \.php$>' >> /etc/apache2/conf-available/php-fpm.conf \
    && echo '        SetHandler "proxy:fcgi://127.0.0.1:9000"' >> /etc/apache2/conf-available/php-fpm.conf \
    && echo '    </FilesMatch>' >> /etc/apache2/conf-available/php-fpm.conf \
    && echo '</IfModule>' >> /etc/apache2/conf-available/php-fpm.conf \
    && a2enconf php-fpm

# ─── PHP-FPM: escuta em 127.0.0.1:9000 ───
RUN sed -i 's|listen =.*|listen = 127.0.0.1:9000|' /usr/local/etc/php-fpm.d/www.conf \
    && sed -i 's|^user =.*|user = www-data|' /usr/local/etc/php-fpm.d/www.conf \
    && sed -i 's|^group =.*|group = www-data|' /usr/local/etc/php-fpm.d/www.conf

# ─── SSL vhost + certificado auto-assinado (build time) ───
COPY docker/apache/ssl.conf /etc/apache2/sites-available/ssl.conf
RUN mkdir -p /etc/apache2/ssl \
    && openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
        -keyout /etc/apache2/ssl/server.key \
        -out /etc/apache2/ssl/server.crt \
        -subj "/C=BR/ST=DF/L=Brasilia/O=SUCESU/CN=localhost" \
    && chown -R www-data:www-data /etc/apache2/ssl \
    && chmod 600 /etc/apache2/ssl/server.key \
    && a2ensite ssl.conf

# ─── Apache rootless ───
# Permite binding nas portas 80/443 sem root
RUN setcap 'cap_net_bind_service=+ep' /usr/sbin/apache2
# Ajusta APACHE_PID_FILE e APACHE_RUN_DIR para diretórios graváveis por www-data
RUN sed -i 's|^export APACHE_PID_FILE=.*|export APACHE_PID_FILE=/tmp/apache2/apache2.pid|' /etc/apache2/envvars \
    && sed -i 's|^export APACHE_RUN_DIR=.*|export APACHE_RUN_DIR=/tmp/apache2|' /etc/apache2/envvars \
    && sed -i 's|^export APACHE_LOCK_DIR=.*|export APACHE_LOCK_DIR=/tmp/apache2/lock|' /etc/apache2/envvars

# ─── Usuário ───
RUN usermod -u ${WWWUSER} www-data && groupmod -g ${WWWGROUP} www-data

# Re-aplica ownership do SSL (usermod muda o UID, então a chave fica órfã)
RUN chown -R www-data:www-data /etc/apache2/ssl

# ─── Supervisord ───
COPY docker/apache/supervisord.conf /etc/supervisor/conf.d/supervisord.conf
RUN mkdir -p /var/log/supervisor /var/log/apache2 \
    && chown -R www-data:www-data /var/log/supervisor /var/log/apache2 \
    && chmod 755 /var/log/apache2

# ─── Diretórios da aplicação ───
RUN mkdir -p /var/www/html/storage/logs \
              /var/www/html/storage/framework/cache \
              /var/www/html/storage/framework/sessions \
              /var/www/html/storage/framework/views \
              /var/www/html/storage/app/public/gallery/sobrenos \
              /var/www/html/storage/app/public/gallery/sle \
              /var/www/html/storage/app/public/content \
              /var/www/html/storage/app/public/assets \
              /var/www/html/bootstrap/cache \
              /var/www/html/public/storage \
              /composer/cache \
    && chown -R www-data:www-data /var/www/html /composer

COPY docker/apache/entrypoint.sh /usr/local/bin/entrypoint.sh
RUN chmod +x /usr/local/bin/entrypoint.sh

WORKDIR /var/www/html

USER www-data

EXPOSE 80 443

ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
CMD ["supervisord", "-c", "/etc/supervisor/conf.d/supervisord.conf"]