fix: build and permissions

deploy/entrypoint.sh

@@ -1,31 +1,23 @@
 #!/usr/bin/env sh
 set -e
 
-# -------- Options (env flags) --------
-: "${ARTISAN_BOOT:=1}"          # set to 0 to skip all artisan work
-: "${ARTISAN_DB_WAIT:=0}"       # set to 1 to wait for DB before artisan
-: "${ARTISAN_MIGRATE:=0}"       # set to 1 to run php artisan migrate --force
-: "${ARTISAN_HORIZON:=0}"       # set to 1 to start Horizon under supervisord (add program if you want)
-: "${ARTISAN_VERBOSE:=0}"       # set to 1 for more logs
+# Default: DO NOT run artisan on boot (avoid provider issues)
+: "${ARTISAN_BOOT:=0}"
+: "${ARTISAN_DB_WAIT:=0}"
+: "${ARTISAN_MIGRATE:=0}"
+: "${ARTISAN_VERBOSE:=0}"
 
 log()  { [ "$ARTISAN_VERBOSE" = "1" ] && echo "[entrypoint] $*"; }
 warn() { echo "[entrypoint] $*" 1>&2; }
 
 cd /var/www/html || true
 
-if [ "$ARTISAN_BOOT" != "1" ]; then
-  log "ARTISAN_BOOT=0 → skipping artisan boot steps."
+if [ "$ARTISAN_BOOT" != "1" ] || [ ! -f artisan ]; then
+  [ ! -f artisan ] && warn "artisan not found; skipping artisan."
   exec /usr/bin/supervisord -c /etc/supervisord.conf
 fi
 
-if [ ! -f artisan ]; then
-  warn "artisan not found; skipping artisan steps."
-  exec /usr/bin/supervisord -c /etc/supervisord.conf
-fi
-
-# -------- Optional: wait for Postgres --------
 if [ "$ARTISAN_DB_WAIT" = "1" ] && [ -n "$DB_HOST" ] && [ -n "$DB_PORT" ]; then
-  # Use PHP + sockets to test TCP if pg_isready isn't available
   log "Waiting for DB ${DB_HOST}:${DB_PORT} ..."
   i=0
   until php -r '
@@ -33,26 +25,19 @@ if [ "$ARTISAN_DB_WAIT" = "1" ] && [ -n "$DB_HOST" ] && [ -n "$DB_PORT" ]; then
     $s=@fsockopen($h,$p,$errno,$errstr,1.0);
     if($s){fclose($s); exit(0);} exit(1);
   '; do
-    i=$((i+1))
-    if [ $i -gt 60 ]; then
-      warn "DB wait timed out after 60s — continuing anyway."
-      break
-    fi
+    i=$((i+1)); [ $i -gt 60 ] && warn "DB wait timed out after 60s" && break
     sleep 1
   done
 fi
 
-# -------- Safe, cache-warming steps --------
-# Don’t fail the container if any step errors (env may be partial in some setups)
-php artisan package:discover --ansi || warn "package:discover failed"
-php artisan config:cache       --ansi || warn "config:cache failed"
-php artisan route:cache        --ansi || warn "route:cache failed"
-php artisan view:cache         --ansi || warn "view:cache failed"
-
-# -------- (Optional) database migrations --------
-if [ "$ARTISAN_MIGRATE" = "1" ]; then
-  php artisan migrate --force --no-interaction --ansi || warn "migrate failed"
+if php artisan package:discover --ansi; then
+  php artisan config:cache --ansi || warn "config:cache failed"
+  php artisan route:cache  --ansi || warn "route:cache failed"
+  php artisan view:cache   --ansi || warn "view:cache failed"
+else
+  warn "package:discover failed — skipping caches."
 fi
 
-# -------- Hand off to supervisord --------
+[ "$ARTISAN_MIGRATE" = "1" ] && php artisan migrate --force --no-interaction --ansi || true
+
 exec /usr/bin/supervisord -c /etc/supervisord.conf

deploy/nginx/default.conf

@@ -5,10 +5,8 @@ server {
     root /var/www/html/public;
     index index.php;
 
-    # Health check (no PHP)
     location = /healthz { return 200 "ok\n"; add_header Content-Type text/plain; }
 
-    # Static assets
     location ~* \.(?:css|js|mjs|map|jpg|jpeg|png|gif|ico|svg|webp|avif|ttf|otf|woff|woff2)$ {
         access_log off; log_not_found off;
         expires 7d;
@@ -16,12 +14,10 @@ server {
         try_files $uri =404;
     }
 
-    # Laravel front controller
     location / {
         try_files $uri $uri/ /index.php?$query_string;
     }
 
-    # PHP via unix socket (shared with php-fpm)
     location ~ \.php$ {
         include        fastcgi_params;
         fastcgi_index  index.php;

deploy/php-fpm/zz-logging.conf

@@ -0,0 +1,2 @@
+[global]
+error_log = /dev/stderr

deploy/php-fpm/zz-socket.conf

@@ -1,24 +1,16 @@
-; Use a unix socket and ensure nginx can access it
-[global]
-; (keep global defaults)
-
 [www]
 listen = /run/php/php-fpm.sock
 listen.owner = www-data
 listen.group = nginx
 listen.mode  = 0660
-
-; Keep default user/group for PHP workers
 user  = www-data
 group = www-data
 
-; Sensible FPM settings
 pm = dynamic
 pm.max_children = 10
 pm.start_servers = 2
 pm.min_spare_servers = 2
 pm.max_spare_servers = 5
 
-; Clear env for security, but allow PATH
 clear_env = yes
 env[PATH] = /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

deploy/supervisord.conf

@@ -4,7 +4,7 @@ logfile=/var/log/supervisor/supervisord.log
 
 [program:php-fpm]
 command=/usr/local/sbin/php-fpm -F
-user=www-data
+; run as root (master); FPM will drop to www-data for workers
 autorestart=true
 priority=10
 stdout_logfile=/dev/stdout
@@ -14,7 +14,7 @@ stderr_logfile_maxbytes=0
 
 [program:nginx]
 command=/usr/sbin/nginx -g "daemon off;"
-user=nginx
+; run as root (master); nginx will use 'user nginx;' for workers
 autorestart=true
 priority=20
 stdout_logfile=/dev/stdout