removed a little part of timezone comment in security.ini because it was extra

.gitea/workflows/build.yml

@@ -5,12 +5,12 @@ on:
     branches:
       - main
     tags:
-      - 'v*'
+      - "v*"
 
 env:
   REGISTRY: git.home.db123.ir
   NAMESPACE: db1234719
-  IMAGE_NAME: nginx-alpine
+  IMAGE_NAME: php-alpine
 
 jobs:
   build-and-push:
@@ -20,7 +20,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
         with:
-          fetch-depth: 0
+          fetch-depth: 1
           fetch-tags: true
 
       - name: Determine version
@@ -45,6 +45,7 @@ jobs:
           password: ${{ secrets.CICD_PASSWORD }}
 
       - name: Build & push Docker image
+        id: build
         uses: docker/build-push-action@v6
         with:
           context: .
@@ -56,3 +57,16 @@ jobs:
             ${{ env.REGISTRY }}/${{ env.NAMESPACE }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}
           cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.NAMESPACE }}/${{ env.IMAGE_NAME }}:cache
           cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ env.NAMESPACE }}/${{ env.IMAGE_NAME }}:cache,mode=max
+
+      - name: Notify build result
+        if: always()
+        run: |
+          if [ "${{ steps.build.outcome }}" = "success" ]; then
+            curl -s -S -u "server:VKbpgw75KB0biM" \
+                -d "build & push succeeded ✅" \
+                https://ntfy.home.db123.ir/build
+          else
+            curl -s -S -u "server:VKbpgw75KB0biM" \
+                -d "build & push FAILED ❌" \
+                https://ntfy.home.db123.ir/build
+          fi

Dockerfile

@@ -4,13 +4,13 @@ FROM alpine:3.22 AS builder
 ENV PHP_VERSION=8.5.0
 
 # Build dependencies
-RUN apk add \
+RUN apk add --no-cache \
     build-base autoconf bison re2c \
+    postgresql-dev \
     curl tar \
     libxml2-dev openssl-dev sqlite-dev zlib-dev pcre2-dev libzip-dev oniguruma-dev \
-    postgresql-dev \
     freetype-dev libpng-dev libjpeg-turbo-dev libwebp-dev \
-    imap-dev krb5-dev
+    curl-dev
 
 WORKDIR /tmp
 
@@ -39,13 +39,10 @@ RUN ./configure \
     --with-sqlite3 \
     --with-pdo-sqlite \
     --with-pdo-pgsql \
-    --with-pgsql \
     --with-gd \
     --with-jpeg \
     --with-webp \
-    --with-freetype \
+    --with-freetype
-    --with-imap \
-    --with-imap-ssl
 
 RUN make -j$(nproc) && make install
 
@@ -54,16 +51,23 @@ RUN cp php.ini-production /usr/local/php/php.ini
 
 # Cleanup
 RUN rm -rf /tmp/* /var/cache/apk/*
+RUN rm -rf /usr/local/php/lib/php/build
+RUN rm -rf /usr/local/php/include
+RUN rm -rf /usr/local/php/php/man
+
+# Strip
+RUN strip --strip-all /usr/local/php/bin/php || true
+RUN strip --strip-all /usr/local/php/sbin/php-fpm || true
+RUN find /usr/local/php -name "*.so" -exec strip --strip-unneeded {} \; || true
 
 # --- Stage 2: Runtime ---
 FROM alpine:3.22
 
 # Runtime libraries only
-RUN apk add \
+RUN apk add --no-cache \
-    libxml2 openssl sqlite-libs zlib libzip pcre2 oniguruma \
+    libxml2 openssl zlib libzip pcre2 oniguruma \
-    postgresql-libs \
     freetype libpng libjpeg-turbo libwebp \
-    imap krb5-libs
+    postgresql-libs
 
 RUN addgroup -S php && adduser -S -D -H -G php php
 RUN mkdir -p /usr/local/php/conf.d /var/run/php
@@ -71,6 +75,11 @@ RUN mkdir -p /usr/local/php/conf.d /var/run/php
 # Copy compiled PHP
 COPY --from=builder /usr/local/php /usr/local/php
 
+# Copy hardened configs on top
+COPY php-fpm.conf /usr/local/php/php-fpm.conf
+COPY php-fpm.d/www.conf /usr/local/php/php-fpm.d/www.conf
+COPY conf.d/security.ini /usr/local/php/conf.d/security.ini
+
 EXPOSE 9000
 
 USER php

conf.d/security.ini

@@ -35,8 +35,8 @@ opcache.max_accelerated_files = 12000
 opcache.save_comments = 1
 opcache.jit = 0
 
-; timezone (override manually)
+; timezone
-date.timezone = UTC
+date.timezone = Asia/Tehran
 
 ; forbid URL file wrappers unless needed
 allow_url_fopen = Off