major changes

using mucl-dev instead of libc-dev, making it non root and adding set cap so adding capability to bind to standard ports, added some conf.d copying so i have my infra as code thing going on and it act as reverse proxy right from the startup and added some other modules statically so i could reverse proxy a lot of things yay

Dockerfile

@@ -1,16 +1,20 @@
-# --- Stage 1: build nginx ---
+# --- Stage 1: Build Nginx ---
 FROM alpine:3.22 AS builder
 
 ENV NGINX_VERSION=1.29.3
 
+# Build dependencies
 RUN apk add --no-cache \
-        gcc make libc-dev pcre2-dev zlib-dev openssl-dev linux-headers curl gnupg tar
+        build-base pcre2-dev zlib-dev openssl-dev linux-headers curl gnupg tar
 
 WORKDIR /tmp
+# Download and extract Nginx
 RUN curl -fSL https://nginx.org/download/nginx-$NGINX_VERSION.tar.gz -o nginx.tar.gz \
- && tar -zxf nginx.tar.gz \
- && cd nginx-$NGINX_VERSION \
- && ./configure \
+ && tar -zxf nginx.tar.gz
+
+WORKDIR /tmp/nginx-$NGINX_VERSION
+# Configure Nginx with all required modules
+RUN ./configure \
       --prefix=/etc/nginx \
       --sbin-path=/usr/sbin/nginx \
       --modules-path=/usr/lib/nginx/modules \
@@ -22,22 +26,47 @@ RUN curl -fSL https://nginx.org/download/nginx-$NGINX_VERSION.tar.gz -o nginx.ta
       --with-http_ssl_module \
       --with-http_v2_module \
       --with-http_gzip_static_module \
- && make && make install
+      --with-stream \
+      --with-stream_ssl_module \
+      --with-mail \
+      --with-mail_ssl_module
+RUN make -j$(nproc)
+RUN make install
 
-# --- Stage 2: runtime ---
+# --- Stage 2: Runtime ---
 FROM alpine:3.22
 
-RUN apk add --no-cache pcre2 zlib openssl ca-certificates wget \
- && adduser -D -g 'nginx' nginx \
- && mkdir -p /var/cache/nginx /etc/nginx/conf.d /usr/share/nginx/html \
- && chown -R nginx:nginx /var/cache/nginx /var/run /etc/nginx /usr/share/nginx/html
+# Runtime dependencies
+RUN apk add --no-cache pcre2 zlib openssl ca-certificates libcap curl
+RUN adduser -D -g 'nginx' nginx
+RUN mkdir -p /var/cache/nginx /etc/nginx/conf.d /etc/nginx/stream_conf.d /usr/share/nginx/html /var/run
+RUN chown -R nginx:nginx /var/cache/nginx /var/run /etc/nginx /usr/share/nginx/html
 
+# Copy Nginx from builder
 COPY --from=builder /usr/sbin/nginx /usr/sbin/nginx
+COPY --from=builder /usr/lib/nginx/modules /usr/lib/nginx/modules
 COPY --from=builder /etc/nginx /etc/nginx
-COPY nginx.conf /etc/nginx/nginx.conf
 
+# Default configuration
+COPY nginx.conf /etc/nginx/nginx.conf
+COPY conf.d/web.conf /etc/nginx/conf.d/web.conf
+COPY conf.d/git.conf /etc/nginx/conf.d/git.conf
+COPY conf.d/mail.conf /etc/nginx/conf.d/mail.conf
+COPY conf.d/media.conf /etc/nginx/conf.d/media.conf
+COPY conf.d/network.conf /etc/nginx/conf.d/network.conf
+COPY conf.d/utils.conf /etc/nginx/conf.d/utils.conf
+COPY conf.d/game.conf /etc/nginx/conf.d/game.conf
+
+# Ports for HTTP/HTTPS + optional mail/TCP/UDP (25 110 143 465 587 993 995) + optional minecraft java/bedrock (25565 19132)
 EXPOSE 80 443
+
+# Non-root execution
+RUN setcap 'cap_net_bind_service=+ep' /usr/sbin/nginx
+USER nginx
+
 STOPSIGNAL SIGTERM
+
 CMD ["nginx", "-g", "daemon off;"]
 
-HEALTHCHECK --interval=30s --timeout=3s --retries=3 CMD wget -qO- http://127.0.0.1:80/ || exit 1
+# Healthcheck
+HEALTHCHECK --interval=30s --timeout=3s --retries=3 CMD curl -f http://127.0.0.1:80/ || exit 1