feat: add entrypoint

deploy/entrypoint.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env sh
+set -e
+
+# -------- Options (env flags) --------
+: "${ARTISAN_BOOT:=1}"          # set to 0 to skip all artisan work
+: "${ARTISAN_DB_WAIT:=0}"       # set to 1 to wait for DB before artisan
+: "${ARTISAN_MIGRATE:=0}"       # set to 1 to run php artisan migrate --force
+: "${ARTISAN_HORIZON:=0}"       # set to 1 to start Horizon under supervisord (add program if you want)
+: "${ARTISAN_VERBOSE:=0}"       # set to 1 for more logs
+
+log()  { [ "$ARTISAN_VERBOSE" = "1" ] && echo "[entrypoint] $*"; }
+warn() { echo "[entrypoint] $*" 1>&2; }
+
+cd /var/www/html || true
+
+if [ "$ARTISAN_BOOT" != "1" ]; then
+  log "ARTISAN_BOOT=0 → skipping artisan boot steps."
+  exec /usr/bin/supervisord -c /etc/supervisord.conf
+fi
+
+if [ ! -f artisan ]; then
+  warn "artisan not found; skipping artisan steps."
+  exec /usr/bin/supervisord -c /etc/supervisord.conf
+fi
+
+# -------- Optional: wait for Postgres --------
+if [ "$ARTISAN_DB_WAIT" = "1" ] && [ -n "$DB_HOST" ] && [ -n "$DB_PORT" ]; then
+  # Use PHP + sockets to test TCP if pg_isready isn't available
+  log "Waiting for DB ${DB_HOST}:${DB_PORT} ..."
+  i=0
+  until php -r '
+    $h=getenv("DB_HOST"); $p=(int)getenv("DB_PORT")?:5432;
+    $s=@fsockopen($h,$p,$errno,$errstr,1.0);
+    if($s){fclose($s); exit(0);} exit(1);
+  '; do
+    i=$((i+1))
+    if [ $i -gt 60 ]; then
+      warn "DB wait timed out after 60s — continuing anyway."
+      break
+    fi
+    sleep 1
+  done
+fi
+
+# -------- Safe, cache-warming steps --------
+# Don’t fail the container if any step errors (env may be partial in some setups)
+php artisan package:discover --ansi || warn "package:discover failed"
+php artisan config:cache       --ansi || warn "config:cache failed"
+php artisan route:cache        --ansi || warn "route:cache failed"
+php artisan view:cache         --ansi || warn "view:cache failed"
+
+# -------- (Optional) database migrations --------
+if [ "$ARTISAN_MIGRATE" = "1" ]; then
+  php artisan migrate --force --no-interaction --ansi || warn "migrate failed"
+fi
+
+# -------- Hand off to supervisord --------
+exec /usr/bin/supervisord -c /etc/supervisord.conf

deploy/nginx/default.conf

@@ -5,10 +5,10 @@ server {
     root /var/www/html/public;
     index index.php;
 
-    # Healthcheck
+    # Health check (no PHP)
     location = /healthz { return 200 "ok\n"; add_header Content-Type text/plain; }
 
-    # Static
+    # Static assets
     location ~* \.(?:css|js|mjs|map|jpg|jpeg|png|gif|ico|svg|webp|avif|ttf|otf|woff|woff2)$ {
         access_log off; log_not_found off;
         expires 7d;
@@ -16,16 +16,16 @@ server {
         try_files $uri =404;
     }
 
-    # Front controller
+    # Laravel front controller
     location / {
         try_files $uri $uri/ /index.php?$query_string;
     }
 
-    # PHP via unix socket
+    # PHP via unix socket (shared with php-fpm)
     location ~ \.php$ {
         include        fastcgi_params;
         fastcgi_index  index.php;
-        fastcgi_pass   unix:/run/php-fpm.sock;
+        fastcgi_pass   unix:/run/php/php-fpm.sock;
         fastcgi_param  SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
         fastcgi_param  DOCUMENT_ROOT $realpath_root;
         fastcgi_read_timeout 60s;

deploy/php-fpm/zz-socket.conf

@@ -0,0 +1,24 @@
+; Use a unix socket and ensure nginx can access it
+[global]
+; (keep global defaults)
+
+[www]
+listen = /run/php/php-fpm.sock
+listen.owner = www-data
+listen.group = nginx
+listen.mode  = 0660
+
+; Keep default user/group for PHP workers
+user  = www-data
+group = www-data
+
+; Sensible FPM settings
+pm = dynamic
+pm.max_children = 10
+pm.start_servers = 2
+pm.min_spare_servers = 2
+pm.max_spare_servers = 5
+
+; Clear env for security, but allow PATH
+clear_env = yes
+env[PATH] = /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

deploy/supervisord.conf

@@ -4,6 +4,7 @@ logfile=/var/log/supervisor/supervisord.log
 
 [program:php-fpm]
 command=/usr/local/sbin/php-fpm -F
+user=www-data
 autorestart=true
 priority=10
 stdout_logfile=/dev/stdout
@@ -13,6 +14,7 @@ stderr_logfile_maxbytes=0
 
 [program:nginx]
 command=/usr/sbin/nginx -g "daemon off;"
+user=nginx
 autorestart=true
 priority=20
 stdout_logfile=/dev/stdout