Dockerfile

FROM php:8.5-apache

# Build and install latest SQLite from source
RUN apt-get update && apt-get install -y gcc make unzip && rm -rf /var/lib/apt/lists/*

RUN curl -fsSL https://www.sqlite.org/2026/sqlite-autoconf-3510300.tar.gz -o /tmp/sqlite.tar.gz \
    && tar -xzf /tmp/sqlite.tar.gz -C /tmp \
    && cd /tmp/sqlite-autoconf-3510300 \
    && CFLAGS="-DSQLITE_ENABLE_COLUMN_METADATA=1" ./configure --prefix=/usr/local \
    && make -j$(nproc) \
    && make install \
    && ldconfig \
    && rm -rf /tmp/sqlite*

# Build pdo_sqlite against the newly installed SQLite
RUN docker-php-ext-configure pdo_sqlite --with-pdo-sqlite=/usr/local \
    && docker-php-ext-install pdo pdo_sqlite

# Enable .htaccess overrides and mod_rewrite
RUN sed -i 's/AllowOverride None/AllowOverride All/g' /etc/apache2/apache2.conf \
    && a2enmod rewrite headers

# Log the visitor, not the proxy. Every request reaches Apache from Nginx Proxy
# Manager (or, on dev, from the host's Docker bridge), so the access log's %h and
# PHP's REMOTE_ADDR both read the proxy's address and a visit cannot be traced
# without the proxy's own log. mod_remoteip swaps in the X-Real-IP the proxy sets
# (the same header get_client_ip() in db.php already trusts), but only when the
# connection itself comes from a Docker bridge network (172.16.0.0/12): the
# container has no published ports on live, so anything arriving with such a
# source is another container on the host, never the internet. A client that
# reaches Apache any other way has its header ignored. InternalProxy, not
# TrustedProxy, so a LAN address in the header (dev) is kept rather than dropped.
RUN printf 'RemoteIPHeader X-Real-IP\nRemoteIPInternalProxy 172.16.0.0/12\n' \
       > /etc/apache2/conf-available/remoteip.conf \
    && a2enmod remoteip \
    && a2enconf remoteip

# Tune prefork MPM for a small-RAM host. Default MaxRequestWorkers=150 would
# OOM the VPS at peak load. Twelve workers: a worker runs at 15 to 40 MB and
# PHP may use up to memory_limit (128 MB) during one large upload, so twelve
# fit the 384 MB the container is allowed in docker-compose.yml (the two
# numbers are sized together; change one, change the other). Beyond twelve
# concurrent requests Apache queues, which is a slow page rather than the
# kernel killing a worker mid-request (a 502).
RUN printf '<IfModule mpm_prefork_module>\n    StartServers            2\n    MinSpareServers         2\n    MaxSpareServers         6\n    MaxRequestWorkers       12\n    MaxConnectionsPerChild  500\n</IfModule>\n' > /etc/apache2/conf-available/mpm-tuning.conf \
    && a2enconf mpm-tuning

# Raise PHP upload limits
RUN echo "upload_max_filesize=20M\npost_max_size=22M" > /usr/local/etc/php/conf.d/uploads.ini

COPY www/ /var/www/html/

# Create the DB directory owned by www-data so SQLite can write at runtime
RUN mkdir -p /var/db && chown www-data:www-data /var/db

# Entrypoint downloads vendor libs on first start (written to mounted ./www/vendor/)
COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
RUN chmod +x /usr/local/bin/docker-entrypoint.sh

EXPOSE 80
ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]