feat: add ability to inject a htpasswod file

deploy/docker-entrypoint.sh

@@ -1,15 +1,22 @@
 #!/bin/sh
-set -eu
-
-SERVER_NAME="${SERVER_NAME:-$(hostname -f 2>/dev/null || hostname)}"
-export SERVER_NAME
-
-# Ensure dirs
-mkdir -p /etc/nginx/http.d /etc/nginx/conf.d /run/nginx /run/php
+set -e
 
 # Render vhost ONLY into http.d so it's inside http{} context
 if [ -f /etc/nginx/templates/default.conf.template ]; then
+  if [ "$ENABLE_BASIC_AUTH" = "true" ]; then
+    echo "[entrypoint] Enabling basic authentication..."
+    if [ -f /etc/nginx/htpasswd ]; then
+      envsubst '$SERVER_NAME' < /etc/nginx/templates/default.conf.template | \
+      sed '/location \/ {/a \\t\tauth_basic "Restricted Content";\n\t\tauth_basic_user_file /etc/nginx/htpasswd;' \
+      > /etc/nginx/http.d/default.conf
+    else
+      echo "[entrypoint] ERROR: htpasswd file not found at /etc/nginx/htpasswd" >&2
+      exit 1
+    fi
+  else
+    echo "[entrypoint] Basic authentication is disabled."
     envsubst '$SERVER_NAME' < /etc/nginx/templates/default.conf.template > /etc/nginx/http.d/default.conf
+  fi
 else
   echo "[entrypoint] ERROR: missing /etc/nginx/templates/default.conf.template" >&2
   exit 1
@@ -21,7 +28,4 @@ nginx -t || { echo "[entrypoint] nginx config test failed" >&2; cat /var/log/ngi
 php artisan config:clear
 php artisan cache:clear
 
-envsubst '$SERVER_NAME' < /etc/nginx/templates/default.conf.template > /etc/nginx/http.d/default.conf
-
 exec /usr/bin/supervisord -n -c /etc/supervisor/supervisord.conf
- 

deploy/nginx/nginx.default.conf.template

@@ -34,6 +34,7 @@ server {
     # -------------------------------------------------
     location / {
         try_files $uri $uri/ /index.php?$query_string;
+        ${BASIC_AUTH_DIRECTIVES}
     }
 
     # -------------------------------------------------

docker/healthcheck.sh

@@ -1,12 +0,0 @@
-#!/bin/sh
-set -eu
-
-PORT="${APP_PORT:-8080}"
-
-# 1) App Health
-curl -fsS "http://127.0.0.1:${PORT}/healthz" >/dev/null
-
-# 2) PHP-FPM Ping via Nginx
-curl -fsS "http://127.0.0.1:${PORT}/fpm-ping" >/dev/null
-
-exit 0

docker/nginx.conf

@@ -1,29 +0,0 @@
-# keine 'user' Direktive im non-root Betrieb
-worker_processes auto;
-error_log  /dev/stderr warn;
-pid        /tmp/nginx.pid;
-
-events { worker_connections 1024; }
-
-http {
-  include       /etc/nginx/mime.types;
-  default_type  application/octet-stream;
-
-  log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
-                    '$status $body_bytes_sent "$http_referer" '
-                    '"$http_user_agent" "$http_x_forwarded_for"';
-  access_log  /dev/stdout  main;
-
-  sendfile on;
-  keepalive_timeout 65;
-  server_tokens off;
-
-  # Temp/Cache-Pfade, die 'nginx' gehören
-  client_body_temp_path /var/lib/nginx/tmp/client_body 1 2;
-  proxy_temp_path       /var/lib/nginx/tmp/proxy 1 2;
-  fastcgi_temp_path     /var/lib/nginx/tmp/fastcgi 1 2;
-  scgi_temp_path        /var/lib/nginx/tmp/scgi 1 2;
-  uwsgi_temp_path       /var/lib/nginx/tmp/uwsgi 1 2;
-
-  include /etc/nginx/conf.d/*.conf;
-}

docker/site.conf

@@ -1,60 +0,0 @@
-server {
-    listen 8080;
-    server_name localhost;
-
-    root /var/www/html/public;
-    index index.php index.html;
-
-    # Health checks
-    location = /healthz {
-        access_log off;
-        return 200 "ok\n";
-    }
-
-    # FPM ping/status (optional, secure in prod)
-    location = /fpm-ping {
-        access_log off;
-        include fastcgi_params;
-        fastcgi_pass 127.0.0.1:9000;
-        fastcgi_param SCRIPT_FILENAME $document_root/index.php;
-        fastcgi_param SCRIPT_NAME /ping;
-        fastcgi_param PATH_INFO /ping;
-    }
-
-    location = /fpm-status {
-        access_log off;
-        include fastcgi_params;
-        fastcgi_pass 127.0.0.1:9000;
-        fastcgi_param SCRIPT_FILENAME $document_root/index.php;
-        fastcgi_param SCRIPT_NAME /status;
-        fastcgi_param PATH_INFO /status;
-    }
-
-    # Main app
-    location / {
-        try_files $uri $uri/ /index.php?$query_string;
-    }
-
-    # PHP handling
-    location ~ \.php$ {
-        include fastcgi_params;
-        fastcgi_pass 127.0.0.1:9000;
-        fastcgi_index index.php;
-        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-        fastcgi_read_timeout 60s;
-        fastcgi_buffers 16 16k;
-    }
-
-    # Deny hidden files
-    location ~ /\.ht {
-        deny all;
-    }
-
-    # Cache static assets
-    location ~* \.(?:css|js|jpg|jpeg|gif|png|svg|ico|webp|woff2?)$ {
-        access_log off;
-        expires 7d;
-        add_header Cache-Control "public";
-        try_files $uri =404;
-    }
-}