i copied the nginx image and made it build the php instead and added some ai recommended conf and ini files which i have to change later

.gitea/workflows/build.yml

@@ -0,0 +1,58 @@
+name: Build and Publish Docker Image
+
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - 'v*'
+
+env:
+  REGISTRY: git.home.db123.ir
+  NAMESPACE: db1234719
+  IMAGE_NAME: nginx-alpine
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-24.04
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: Determine version
+        id: version
+        shell: bash
+        run: |
+          if [[ "${GITHUB_REF}" =~ ^refs/tags/v(.+) ]]; then
+            VERSION="${BASH_REMATCH[1]}"
+          else
+            VERSION="latest"
+          fi
+          echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ env.NAMESPACE }}
+          password: ${{ secrets.CICD_PASSWORD }}
+
+      - name: Build & push Docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./Dockerfile
+          push: true
+          platforms: linux/amd64
+          tags: |
+            ${{ env.REGISTRY }}/${{ env.NAMESPACE }}/${{ env.IMAGE_NAME }}:latest
+            ${{ env.REGISTRY }}/${{ env.NAMESPACE }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}
+          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.NAMESPACE }}/${{ env.IMAGE_NAME }}:cache
+          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ env.NAMESPACE }}/${{ env.IMAGE_NAME }}:cache,mode=max

Dockerfile

@@ -0,0 +1,82 @@
+# --- Stage 1: Build PHP ---
+FROM alpine:3.22 AS builder
+
+ENV PHP_VERSION=8.5.0
+
+# Build dependencies
+RUN apk add \
+    build-base autoconf bison re2c \
+    curl tar \
+    libxml2-dev openssl-dev sqlite-dev zlib-dev pcre2-dev libzip-dev oniguruma-dev \
+    postgresql-dev \
+    freetype-dev libpng-dev libjpeg-turbo-dev webp-dev \
+    imap-dev krb5-dev
+
+WORKDIR /tmp
+
+# Download + extract
+RUN curl -fSL https://www.php.net/distributions/php-$PHP_VERSION.tar.gz -o php.tar.gz \
+    && tar -zxf php.tar.gz
+
+WORKDIR /tmp/php-$PHP_VERSION
+
+# Configure static PHP build
+RUN ./configure \
+    --prefix=/usr/local/php \
+    --with-config-file-path=/usr/local/php \
+    --with-config-file-scan-dir=/usr/local/php/conf.d \
+    --enable-fpm \
+    --with-fpm-user=php \
+    --with-fpm-group=php \
+    --enable-mbstring \
+    --enable-opcache \
+    --with-pcre2 \
+    --with-zlib \
+    --with-openssl \
+    --with-curl \
+    --with-zip \
+    --with-xml \
+    --with-sqlite3 \
+    --with-pdo-sqlite \
+    --with-pdo-pgsql \
+    --with-pgsql \
+    --with-gd \
+    --with-jpeg \
+    --with-webp \
+    --with-freetype \
+    --with-imap \
+    --with-imap-ssl
+
+RUN make -j$(nproc) && make install
+
+# PHP production config
+RUN cp php.ini-production /usr/local/php/php.ini
+
+# Cleanup
+RUN rm -rf /tmp/* /var/cache/apk/*
+
+# --- Stage 2: Runtime ---
+FROM alpine:3.22
+
+# Runtime libraries only
+RUN apk add \
+    libxml2 openssl sqlite-libs zlib libzip pcre2 oniguruma \
+    postgresql-libs \
+    freetype libpng libjpeg-turbo libwebp \
+    imap krb5-libs
+
+RUN addgroup -S php && adduser -S -D -H -G php php
+RUN mkdir -p /usr/local/php/conf.d /var/run/php
+
+# Copy compiled PHP
+COPY --from=builder /usr/local/php /usr/local/php
+
+EXPOSE 9000
+
+USER php
+
+CMD ["/usr/local/php/sbin/php-fpm", "--nodaemonize"]
+
+# Healthcheck
+HEALTHCHECK --interval=30s --timeout=3s --retries=3 CMD /usr/local/php/bin/php-fpm -t >/dev/null 2>&1 || exit 1
+

LICENSE

@@ -0,0 +1 @@
+Copyright (c) 22025 db1234719. All rights reserved.

README.md

@@ -0,0 +1,4 @@
+# nginx-alpine
+
+this image will be used in production and configs are all tailored to the needs of db123 team.
+it's based on alpine 3.22 and builds the nginx from source with necessary modules.

conf.d/security.ini

@@ -0,0 +1,50 @@
+; disable exposure
+expose_php = Off
+
+; disable dangerous functions (minimal safe set)
+disable_functions = exec,passthru,shell_exec,proc_open,popen,system,show_source,phpinfo
+
+; logging
+display_errors = Off
+display_startup_errors = Off
+log_errors = On
+error_reporting = E_ALL
+
+; file limits
+upload_max_filesize = 8M
+post_max_size = 8M
+
+max_execution_time = 30
+max_input_time = 60
+
+memory_limit = 256M
+
+; force strict session settings
+session.use_strict_mode = 1
+session.cookie_httponly = 1
+session.cookie_secure = 1
+session.use_only_cookies = 1
+
+; opcache
+opcache.enable = 1
+opcache.enable_cli = 0
+opcache.validate_timestamps = 0
+opcache.memory_consumption = 128
+opcache.interned_strings_buffer = 16
+opcache.max_accelerated_files = 12000
+opcache.save_comments = 1
+opcache.jit = 0
+
+; timezone (override manually)
+date.timezone = UTC
+
+; forbid URL file wrappers unless needed
+allow_url_fopen = Off
+allow_url_include = Off
+
+; security hardening
+cgi.fix_pathinfo = 0
+
+; hard unbreakable srcurity
+session.cookie_samesite = Strict
+opcache.restrict_api = /usr/local/php/opcache

php-fpm.conf

@@ -0,0 +1,9 @@
+[global]
+pid = /var/run/php/php-fpm.pid
+error_log = /var/log/php/fpm-error.log
+
+daemonize = no
+
+log_level = notice
+
+include=/usr/local/php/php-fpm.d/*.conf

php-fpm.d/www.conf

@@ -0,0 +1,33 @@
+[www]
+
+user = php
+group = php
+
+listen = /var/run/php/php-fpm.sock
+listen.mode = 0660
+
+pm = dynamic
+pm.max_children = 20
+pm.start_servers = 4
+pm.min_spare_servers = 2
+pm.max_spare_servers = 6
+
+pm.max_requests = 500
+
+request_terminate_timeout = 30s
+request_slowlog_timeout = 5s
+slowlog = /var/log/php/slow.log
+
+catch_workers_output = yes
+
+php_admin_value[expose_php] = Off
+php_admin_value[display_errors] = Off
+php_admin_value[log_errors] = On
+php_admin_value[memory_limit] = 256M
+php_admin_value[upload_max_filesize] = 8M
+php_admin_value[post_max_size] = 8M
+php_admin_value[max_execution_time] = 30
+
+clear_env = yes
+
+security.limit_extensions = .php