# --- Stage 1: Build PHP ---
FROM alpine:3.22 AS builder

ENV PHP_VERSION=8.5.0

# Build dependencies
RUN apk add --no-cache \
    build-base autoconf bison re2c \
    postgresql-dev \
    curl tar \
    libxml2-dev openssl-dev sqlite-dev zlib-dev pcre2-dev libzip-dev oniguruma-dev \
    freetype-dev libpng-dev libjpeg-turbo-dev libwebp-dev \
    curl-dev

WORKDIR /tmp

# Download + extract
RUN curl -fSL https://www.php.net/distributions/php-$PHP_VERSION.tar.gz -o php.tar.gz \
    && tar -zxf php.tar.gz

WORKDIR /tmp/php-$PHP_VERSION

# Configure static PHP build
RUN ./configure \
    --prefix=/usr/local/php \
    --with-config-file-path=/usr/local/php \
    --with-config-file-scan-dir=/usr/local/php/conf.d \
    --enable-fpm \
    --with-fpm-user=php \
    --with-fpm-group=php \
    --enable-mbstring \
    --enable-opcache \
    --with-pcre2 \
    --with-zlib \
    --with-openssl \
    --with-curl \
    --with-zip \
    --with-xml \
    --with-sqlite3 \
    --with-pdo-sqlite \
    --with-pdo-pgsql \
    --with-gd \
    --with-jpeg \
    --with-webp \
    --with-freetype

RUN make -j$(nproc) && make install

# PHP production config
RUN cp php.ini-production /usr/local/php/php.ini

# Cleanup
RUN rm -rf /tmp/* /var/cache/apk/*
RUN rm -rf /usr/local/php/lib/php/build
RUN rm -rf /usr/local/php/include
RUN rm -rf /usr/local/php/php/man

# Strip
RUN strip --strip-all /usr/local/php/bin/php || true
RUN strip --strip-all /usr/local/php/sbin/php-fpm || true
RUN find /usr/local/php -name "*.so" -exec strip --strip-unneeded {} \; || true

# --- Stage 2: Runtime ---
FROM alpine:3.22

# Runtime libraries only
RUN apk add --no-cache \
    libxml2 openssl zlib libzip pcre2 oniguruma \
    freetype libpng libjpeg-turbo libwebp \
    postgresql-libs

RUN addgroup -S php && adduser -S -D -H -G php php
RUN mkdir -p /usr/local/php/conf.d /var/run/php

# Copy compiled PHP
COPY --from=builder /usr/local/php /usr/local/php

# Copy hardened configs on top
COPY php-fpm.conf /usr/local/php/php-fpm.conf
COPY php-fpm.d/www.conf /usr/local/php/php-fpm.d/www.conf
COPY conf.d/security.ini /usr/local/php/conf.d/security.ini

EXPOSE 9000

USER php

CMD ["/usr/local/php/sbin/php-fpm", "--nodaemonize"]

# Healthcheck
HEALTHCHECK --interval=30s --timeout=3s --retries=3 CMD /usr/local/php/bin/php-fpm -t >/dev/null 2>&1 || exit 1

