fix: build and permissions

Dockerfile

@@ -1,4 +1,4 @@
-# ---------- 1) Build Composer deps (no scripts; avoids artisan during build) ----------
+# -------- 1) Composer deps (no scripts; avoids artisan during build) --------
   FROM composer:2 AS vendor
   ARG COMPOSER_NO_DEV=1
   WORKDIR /app
@@ -9,15 +9,15 @@
         composer install --prefer-dist --no-progress --no-interaction --no-scripts; \
       fi
   
-  # ---------- 2) Bring in app sources ----------
+  # -------- 2) App source --------
   FROM alpine:3.20 AS app_src
   WORKDIR /app
   COPY . ./
   
-  # ---------- 3) Final image: Nginx + PHP-FPM + PGSQL ----------
+  # -------- 3) Final: Nginx + PHP-FPM + PGSQL drivers --------
   FROM php:8.4-fpm-alpine
   
-  # System deps (build + runtime)
+  # Build + runtime deps (incl. oniguruma for mbstring, GD runtime libs)
   RUN set -eux; \
       apk add --no-cache --virtual .build-deps \
           $PHPIZE_DEPS icu-dev libzip-dev postgresql-dev \
@@ -26,14 +26,10 @@
       && apk add --no-cache \
           icu-libs libzip libpq tzdata bash git curl \
           nginx supervisor \
-          oniguruma \
+          oniguruma freetype libjpeg-turbo libpng \
-          freetype libjpeg-turbo libpng \
-      # PHP extensions
       && docker-php-ext-configure intl \
       && docker-php-ext-configure gd --with-freetype --with-jpeg \
-      && docker-php-ext-install -j"$(nproc)" \
+      && docker-php-ext-install -j"$(nproc)" intl opcache zip bcmath mbstring gd pdo pdo_pgsql pgsql \
-          intl opcache zip bcmath mbstring gd pdo pdo_pgsql pgsql \
-      # Cleanup
       && apk del .build-deps \
       && rm -rf /var/cache/apk/* /tmp/*
   
@@ -54,27 +50,39 @@
         echo "opcache.max_accelerated_files=20000"; \
       } > /usr/local/etc/php/conf.d/laravel.ini
   
-  # Prepare dirs
+  # Dirs
   RUN mkdir -p /run/php /run/nginx /var/log/supervisor /var/www/html /etc/nginx/http.d
   
-  # Copy app and vendor
+  # Copy app + vendor
   COPY --from=app_src /app /var/www/html
   COPY --from=vendor /app/vendor /var/www/html/vendor
   
-# Copy configs
+  # Nginx, PHP-FPM socket, Supervisor, entrypoint
-COPY deploy/nginx/default.conf        /etc/nginx/http.d/default.conf
+  COPY deploy/nginx/default.conf        /etc/nginx/http.d/default.conf
-COPY deploy/supervisord.conf          /etc/supervisord.conf
+  COPY deploy/php-fpm/zz-socket.conf    /usr/local/etc/php-fpm.d/zz-socket.conf
-COPY deploy/php-fpm/zz-socket.conf    /usr/local/etc/php-fpm.d/zz-socket.conf
+  COPY deploy/php-fpm/zz-logging.conf /usr/local/etc/php-fpm.d/zz-logging.conf
-COPY deploy/entrypoint.sh             /usr/local/bin/entrypoint.sh
+  COPY deploy/supervisord.conf          /etc/supervisord.conf
+  COPY deploy/entrypoint.sh             /usr/local/bin/entrypoint.sh
+  RUN chmod +x /usr/local/bin/entrypoint.sh
   
-# Ensure executable
+  WORKDIR /var/www/html
-RUN chmod +x /usr/local/bin/entrypoint.sh
   
-# Healthcheck and ports (unchanged)
+  # Never ship stale compiled caches
-EXPOSE 80
+  RUN rm -rf bootstrap/cache/*.php || true
-HEALTHCHECK --interval=30s --timeout=5s --retries=5 \
+  
+  # Laravel write perms
+  RUN set -eux; \
+      mkdir -p storage bootstrap/cache; \
+      chown -R www-data:www-data storage bootstrap/cache; \
+      find storage -type d -exec chmod 775 {} \; ; \
+      find storage -type f -exec chmod 664 {} \; ; \
+      chmod -R 775 bootstrap/cache
+  
+  EXPOSE 80
+  HEALTHCHECK --interval=30s --timeout=5s --retries=5 \
     CMD curl -fsS http://localhost/healthz || exit 1
   
-# Use the entrypoint to run artisan warmups, then exec supervisord
+  # Default: just start services; artisan is opt-in via env
-ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
+  ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
-CMD ["/usr/bin/supervisord", "-c", "/etc/supervisord.conf"]
+  CMD ["/usr/bin/supervisord", "-c", "/etc/supervisord.conf"]
+  

deploy/entrypoint.sh

@@ -1,31 +1,23 @@
 #!/usr/bin/env sh
 set -e
 
-# -------- Options (env flags) --------
+# Default: DO NOT run artisan on boot (avoid provider issues)
-: "${ARTISAN_BOOT:=1}"          # set to 0 to skip all artisan work
+: "${ARTISAN_BOOT:=0}"
-: "${ARTISAN_DB_WAIT:=0}"       # set to 1 to wait for DB before artisan
+: "${ARTISAN_DB_WAIT:=0}"
-: "${ARTISAN_MIGRATE:=0}"       # set to 1 to run php artisan migrate --force
+: "${ARTISAN_MIGRATE:=0}"
-: "${ARTISAN_HORIZON:=0}"       # set to 1 to start Horizon under supervisord (add program if you want)
+: "${ARTISAN_VERBOSE:=0}"
-: "${ARTISAN_VERBOSE:=0}"       # set to 1 for more logs
 
 log()  { [ "$ARTISAN_VERBOSE" = "1" ] && echo "[entrypoint] $*"; }
 warn() { echo "[entrypoint] $*" 1>&2; }
 
 cd /var/www/html || true
 
-if [ "$ARTISAN_BOOT" != "1" ]; then
+if [ "$ARTISAN_BOOT" != "1" ] || [ ! -f artisan ]; then
-  log "ARTISAN_BOOT=0 → skipping artisan boot steps."
+  [ ! -f artisan ] && warn "artisan not found; skipping artisan."
   exec /usr/bin/supervisord -c /etc/supervisord.conf
 fi
 
-if [ ! -f artisan ]; then
-  warn "artisan not found; skipping artisan steps."
-  exec /usr/bin/supervisord -c /etc/supervisord.conf
-fi
-
-# -------- Optional: wait for Postgres --------
 if [ "$ARTISAN_DB_WAIT" = "1" ] && [ -n "$DB_HOST" ] && [ -n "$DB_PORT" ]; then
-  # Use PHP + sockets to test TCP if pg_isready isn't available
   log "Waiting for DB ${DB_HOST}:${DB_PORT} ..."
   i=0
   until php -r '
@@ -33,26 +25,19 @@ if [ "$ARTISAN_DB_WAIT" = "1" ] && [ -n "$DB_HOST" ] && [ -n "$DB_PORT" ]; then
     $s=@fsockopen($h,$p,$errno,$errstr,1.0);
     if($s){fclose($s); exit(0);} exit(1);
   '; do
-    i=$((i+1))
+    i=$((i+1)); [ $i -gt 60 ] && warn "DB wait timed out after 60s" && break
-    if [ $i -gt 60 ]; then
-      warn "DB wait timed out after 60s — continuing anyway."
-      break
-    fi
     sleep 1
   done
 fi
 
-# -------- Safe, cache-warming steps --------
+if php artisan package:discover --ansi; then
-# Don’t fail the container if any step errors (env may be partial in some setups)
+  php artisan config:cache --ansi || warn "config:cache failed"
-php artisan package:discover --ansi || warn "package:discover failed"
+  php artisan route:cache  --ansi || warn "route:cache failed"
-php artisan config:cache       --ansi || warn "config:cache failed"
+  php artisan view:cache   --ansi || warn "view:cache failed"
-php artisan route:cache        --ansi || warn "route:cache failed"
+else
-php artisan view:cache         --ansi || warn "view:cache failed"
+  warn "package:discover failed — skipping caches."
-
-# -------- (Optional) database migrations --------
-if [ "$ARTISAN_MIGRATE" = "1" ]; then
-  php artisan migrate --force --no-interaction --ansi || warn "migrate failed"
 fi
 
-# -------- Hand off to supervisord --------
+[ "$ARTISAN_MIGRATE" = "1" ] && php artisan migrate --force --no-interaction --ansi || true
+
 exec /usr/bin/supervisord -c /etc/supervisord.conf

deploy/nginx/default.conf

@@ -5,10 +5,8 @@ server {
     root /var/www/html/public;
     index index.php;
 
-    # Health check (no PHP)
     location = /healthz { return 200 "ok\n"; add_header Content-Type text/plain; }
 
-    # Static assets
     location ~* \.(?:css|js|mjs|map|jpg|jpeg|png|gif|ico|svg|webp|avif|ttf|otf|woff|woff2)$ {
         access_log off; log_not_found off;
         expires 7d;
@@ -16,12 +14,10 @@ server {
         try_files $uri =404;
     }
 
-    # Laravel front controller
     location / {
         try_files $uri $uri/ /index.php?$query_string;
     }
 
-    # PHP via unix socket (shared with php-fpm)
     location ~ \.php$ {
         include        fastcgi_params;
         fastcgi_index  index.php;

deploy/php-fpm/zz-logging.conf

@@ -0,0 +1,2 @@
+[global]
+error_log = /dev/stderr

deploy/php-fpm/zz-socket.conf

@@ -1,24 +1,16 @@
-; Use a unix socket and ensure nginx can access it
-[global]
-; (keep global defaults)
-
 [www]
 listen = /run/php/php-fpm.sock
 listen.owner = www-data
 listen.group = nginx
 listen.mode  = 0660
-
-; Keep default user/group for PHP workers
 user  = www-data
 group = www-data
 
-; Sensible FPM settings
 pm = dynamic
 pm.max_children = 10
 pm.start_servers = 2
 pm.min_spare_servers = 2
 pm.max_spare_servers = 5
 
-; Clear env for security, but allow PATH
 clear_env = yes
 env[PATH] = /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

deploy/supervisord.conf

@@ -4,7 +4,7 @@ logfile=/var/log/supervisor/supervisord.log
 
 [program:php-fpm]
 command=/usr/local/sbin/php-fpm -F
-user=www-data
+; run as root (master); FPM will drop to www-data for workers
 autorestart=true
 priority=10
 stdout_logfile=/dev/stdout
@@ -14,7 +14,7 @@ stderr_logfile_maxbytes=0
 
 [program:nginx]
 command=/usr/sbin/nginx -g "daemon off;"
-user=nginx
+; run as root (master); nginx will use 'user nginx;' for workers
 autorestart=true
 priority=20
 stdout_logfile=/dev/stdout