# syntax=docker/dockerfile:1

# ---- vendor stage: install PHP dependencies from the locked manifest ----
# Uses the official Composer image so the build does not depend on Composer
# being present in the base image. Installs strictly from composer.lock for a
# reproducible, audited dependency tree (see docs/07-phase-2-dependencies.md).
FROM composer:2.10.3 AS vendor
WORKDIR /app
COPY composer.json composer.lock ./
RUN composer install \
        --no-dev \
        --no-scripts \
        --no-interaction \
        --prefer-dist \
        --optimize-autoloader

# ---- runtime stage ----
FROM 489176460030.dkr.ecr.ca-central-1.amazonaws.com/tbi-php-85:8.5.12

# Application source.
COPY . /data/websites/

# Dependencies resolved in the vendor stage (overwrites any vendor/ from COPY .).
COPY --from=vendor /app/vendor /data/websites/vendor

# PHP 8.5 runtime + OPcache/JIT tuning for this service.
# The tbi-php-85 base is built on the official php:8.5-apache image, whose
# php.ini overrides live in /usr/local/etc/php/conf.d/. The zz- prefix ensures
# these load after the base image's own extension ini files.
COPY docker/php.ini      /usr/local/etc/php/conf.d/zz-helix-app.ini
COPY docker/opcache.ini  /usr/local/etc/php/conf.d/zz-helix-opcache.ini

USER root

RUN chown -R www-data:www-data /data/websites