Dockerfile

#░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░
#░░
#░░     ▒█▀▄▀█ █▀▀█ ░░░▒█ 　 ▀█▀ █▀▀▄ ▀▀█▀▀ █▀▀█ █▀▀█ █▀▀▄ █▀▀ ▀▀█▀▀
#░░     ▒█▒█▒█ █░░█ ░▄░▒█ 　 ▒█░ █░░█ ░░█░░ █▄▄▀ █▄▄█ █░░█ █▀▀ ░░█░░
#░░     ▒█░░▒█ ▀▀▀▀ ▒█▄▄█ 　 ▄█▄ ▀░░▀ ░░▀░░ ▀░▀▀ ▀░░▀ ▀░░▀ ▀▀▀ ░░▀░░
#░░
#░░     ▀█▀ █▀▄▀█ █▀▀█ █▀▀▀ █▀▀ 　 ▒█▀▀█ █▀▀█ █▀▀▄ █▀▀ ░▀░ █▀▀▀
#░░     ▒█░ █░▀░█ █▄▄█ █░▀█ █▀▀ 　 ▒█░░░ █░░█ █░░█ █▀▀ ▀█▀ █░▀█
#░░     ▄█▄ ▀░░░▀ ▀░░▀ ▀▀▀▀ ▀▀▀ 　 ▒█▄▄█ ▀▀▀▀ ▀░░▀ ▀░░ ▀▀▀ ▀▀▀▀
#░░
#░░    (¯`v´¯)
#░░     `.¸.[Code]
#░░
#░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░

ARG version_nginx=1.26.1
ARG version_node=22
ARG version_cron_alpine=3.19.1

#    ▄▄  ▄▄     █▀▀  █▀█  █▀▄▀█     ▄▄  ▄▄    #
#    ░░  ░░     █▀░  █▀▀  █░▀░█     ░░  ░░    #

FROM ministryofjustice/wordpress-base-fpm:latest AS base-fpm

RUN apk update && \
    apk add strace

# Temporarily install phpredis here. With potential to move to wordpress-base-image.
# See https://github.com/phpredis/phpredis
RUN apk add --no-cache pcre-dev $PHPIZE_DEPS \
    && pecl install redis \
    && docker-php-ext-enable redis.so

RUN apk del pcre-dev $PHPIZE_DEPS

# Make the Nginx user available in this container
RUN addgroup -g 101 -S nginx; adduser -u 101 -S -D -G nginx nginx

RUN mkdir /sock && \
    chown nginx:nginx /sock

# Copy our init. script(s) and set them to executable
COPY deploy/config/init/fpm-*.sh /usr/local/bin/docker-entrypoint.d/

RUN chmod +x /usr/local/bin/docker-entrypoint.d/*

# Copy our healthcheck scripts and set them to executable
COPY bin/fpm-*.sh /usr/local/bin/fpm-health/

RUN chmod +x /usr/local/bin/fpm-health/*

## Change directory
WORKDIR /usr/local/etc/php-fpm.d

## Clean PHP pools; leave docker.conf in situe
RUN rm zz-docker.conf && \
    rm www.conf.default && \
    rm www.conf

## Set our pool configuration
COPY deploy/config/php-pool.conf pool.conf

# Configure Relay - See https://relay.so/docs/1.x/configuration
RUN RELAY_CONFIG_FILE=/usr/local/etc/php/conf.d/docker-php-ext-relay.ini && \
    # Set log level to error
    sed -i 's/^;\? \?relay.loglevel =.*/relay.loglevel = error/' $RELAY_CONFIG_FILE && \
    # Set log file to stderr
    sed -i 's/^;\? \?relay.logfile =.*/relay.logfile = \/dev\/stderr/' $RELAY_CONFIG_FILE && \
    # Settings related to the in-memory cache (not Redis).
    ## Set maxmemory to 16M - this is the max. w/o a license.
    sed -i 's/^;\? \?relay.maxmemory =.*/relay.maxmemory = 16M/' $RELAY_CONFIG_FILE && \
    ## Eviction policy: lru. Evicts the least recently used keys out of all keys when relay.maxmemory_pct is reached
    sed -i 's/^;\? \?relay.eviction_policy =.*/relay.eviction_policy = lru/' $RELAY_CONFIG_FILE && \
    ## Start evicting keys when 90% of the memory is used.
    sed -i 's/^;\? \?relay.maxmemory_pct =.*/relay.maxmemory_pct = 75/' $RELAY_CONFIG_FILE && \
    ## Set the session compression to lz4
    sed -i 's/^;\? \?relay.session.compression =.*/relay.session.compression = lz4/' $RELAY_CONFIG_FILE && \
    ## Set the session compression level to 1
    sed -i 's/^;\? \?relay.session.compression_level =.*/relay.session.compression_level = 3/' $RELAY_CONFIG_FILE
    

# Don't log every request.
RUN perl -pi -e 's#^(?=access\.log\b)#;#' /usr/local/etc/php-fpm.d/docker.conf

WORKDIR /var/www/html


#    ▄▄  ▄▄     █▄░█  █▀▀  █  █▄░█  ▀▄▀     ▄▄  ▄▄    #
#    ░░  ░░     █░▀█  █▄█  █  █░▀█  █░█     ░░  ░░    #

FROM nginx:${version_nginx}-alpine AS nginx-module-builder

SHELL ["/bin/ash", "-exo", "pipefail", "-c"]

RUN apk update && \
    apk add linux-headers openssl-dev pcre2-dev zlib-dev openssl abuild \
        musl-dev libxslt libxml2-utils make mercurial gcc unzip git \
        xz g++ coreutils

RUN printf "#!/bin/sh\\nSETFATTR=true /usr/bin/abuild -F \"\$@\"\\n" > /usr/local/bin/abuild && \
    chmod +x /usr/local/bin/abuild && \
    hg clone -r ${NGINX_VERSION}-${PKG_RELEASE} https://hg.nginx.org/pkg-oss/ && \
    mkdir -p /tmp/packages && \
    cd pkg-oss && \
    /pkg-oss/build_module.sh -v $NGINX_VERSION -f -y -o /tmp/packages -n cachepurge https://github.com/nginx-modules/ngx_cache_purge/archive/2.5.3.tar.gz; \
    BUILT_MODULES="$BUILT_MODULES $(echo cachepurge | tr '[A-Z]' '[a-z]' | tr -d '[/_\-\.\t ]')"; \
    cd /tmp && ls -l; \
    echo "BUILT_MODULES=\"$BUILT_MODULES\"" > /tmp/packages/modules.env; \
    cd packages && ls -l

FROM nginxinc/nginx-unprivileged:${version_nginx}-alpine AS base-nginx

USER root

RUN --mount=type=bind,target=/tmp/packages/,source=/tmp/packages/,from=nginx-module-builder \
    . /tmp/packages/modules.env \
    &&  apk add --no-cache --allow-untrusted /tmp/packages/nginx-module-cachepurge-${NGINX_VERSION}*.apk;

RUN mkdir /var/run/nginx-cache && \
    chown nginx:nginx /var/run/nginx-cache

# contains gzip and module include
COPY --chown=nginx:nginx deploy/config/nginx.conf /etc/nginx/nginx.conf

COPY deploy/config/init/nginx-* /docker-entrypoint.d/

RUN chmod +x /docker-entrypoint.d/*; \
    echo "# This file is configured at runtime." > /etc/nginx/real_ip.conf

USER 101




#
#   ▒█▀▀▄ █▀▀ ▀█░█▀ █▀▀ █░░ █▀▀█ █▀▀█ █▀▄▀█ █▀▀ █▀▀▄ ▀▀█▀▀
#   ▒█░▒█ █▀▀ ░█▄█░ █▀▀ █░░ █░░█ █░░█ █░▀░█ █▀▀ █░░█ ░░█░░
#   ▒█▄▄▀ ▀▀▀ ░░▀░░ ▀▀▀ ▀▀▀ ▀▀▀▀ █▀▀▀ ▀░░░▀ ▀▀▀ ▀░░▀ ░░▀░░
#
#   ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░

#   █▀▀  █▀█  █▀▄▀█
#   █▀░  █▀▀  █░▀░█

FROM base-fpm AS fpm-dev

RUN apk add zip

WORKDIR /var/www/html

COPY --from=composer:2 /usr/bin/composer /usr/bin/composer

VOLUME ["/sock"]
# nginx
USER 101


#  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░

#  █▄░█  █▀▀  █  █▄░█  ▀▄▀
#  █░▀█  █▄█  █  █░▀█  █░█

FROM base-nginx AS nginx-dev

RUN echo "# This is a placeholder because the file is included in php-fpm.conf." > /etc/nginx/server_name.conf


#  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░

#  ▀█▀  █▀▀  █▀  ▀█▀
#  ░█░  ██▄  ▄█  ░█░

FROM build-fpm AS test
RUN make test




#
#   ▒█▀▀█ █▀▀█ █▀▀█ █▀▀▄ █░░█ █▀▀ ▀▀█▀▀ ░▀░ █▀▀█ █▀▀▄
#   ▒█▄▄█ █▄▄▀ █░░█ █░░█ █░░█ █░░ ░░█░░ ▀█▀ █░░█ █░░█
#   ▒█░░░ ▀░▀▀ ▀▀▀▀ ▀▀▀░ ░▀▀▀ ▀▀▀ ░░▀░░ ▀▀▀ ▀▀▀▀ ▀░░▀
#
#   ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░

#   █▀▀  █▀█  █▀▄▀█  █▀█  █▀█  █▀  █▀▀  █▀█
#   █▄▄  █▄█  █░▀░█  █▀▀  █▄█  ▄█  ██▄  █▀▄


FROM base-fpm AS build-fpm-composer

WORKDIR /var/www/html

ARG COMPOSER_USER
ARG COMPOSER_PASS
ARG ACF_PRO_LICENSE
ARG ACF_PRO_PASS
ARG AS3CF_PRO_USER
ARG AS3CF_PRO_PASS

COPY --from=composer:2 /usr/bin/composer /usr/bin/composer

COPY ./bin/composer-auth.sh ./bin/composer-post-install.sh ./bin/

RUN chmod +x ./bin/composer-auth.sh && \
    ./bin/composer-auth.sh
RUN chmod +x ./bin/composer-post-install.sh

USER 101

COPY composer.json composer.lock /var/www/html/
RUN composer install --no-dev
RUN composer dump-autoload -o

ARG regex_files='\(htm\|html\|js\|css\|png\|jpg\|jpeg\|gif\|ico\|svg\|webmanifest\)'
ARG regex_path='\(app\/mu\-plugins\|app\/plugins\|wp\)'
RUN mkdir -p ./vendor-assets && \
    find public/ -regex "public\/${regex_path}.*\.${regex_files}" -exec cp --parent "{}" vendor-assets/  \;


#  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░

#  ▄▀█  █▀  █▀  █▀▀  ▀█▀  █▀
#  █▀█  ▄█  ▄█  ██▄  ░█░  ▄█


FROM node:${version_node}-alpine AS assets-build

WORKDIR /node
COPY ./public/app/themes/clarity /node/

RUN npm ci
RUN npm run production
RUN rm -rf node_modules


#  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░

#  █▀▀  █▀█  █▀▄▀█
#  █▀░  █▀▀  █░▀░█


FROM base-fpm AS build-fpm

WORKDIR /var/www/html
COPY --chown=nginx:nginx ./config ./config
COPY --chown=nginx:nginx ./public ./public
COPY --chown=nginx:nginx wp-cli.yml wp-cli.yml

# Replace paths with dependanies from build-fpm-composer
ARG path="/var/www/html"
COPY --from=build-fpm-composer ${path}/public/app/mu-plugins public/app/mu-plugins
COPY --from=build-fpm-composer ${path}/public/app/plugins public/app/plugins
COPY --from=build-fpm-composer ${path}/public/app/languages public/app/languages
COPY --from=build-fpm-composer ${path}/public/wp public/wp
COPY --from=build-fpm-composer ${path}/vendor vendor

# non-root
USER 101

# Set IMAGE_TAG at build time, we don't want this container to be run with an incorrect IMAGE_TAG.
# Set towards the end of the Dockerfile to benefit from caching.
ARG IMAGE_TAG
ENV IMAGE_TAG=$IMAGE_TAG


#  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░

#  █▄░█  █▀▀  █  █▄░█  ▀▄▀
#  █░▀█  █▄█  █  █░▀█  █░█


FROM base-nginx AS build-nginx

# Grab server configurations
COPY deploy/config/php-fpm.conf      /etc/nginx/php-fpm.conf
COPY deploy/config/php-fpm-auth.conf /etc/nginx/php-fpm-auth.conf
COPY deploy/config/auth-request.conf /etc/nginx/auth-request.conf
COPY deploy/config/server.conf       /etc/nginx/conf.d/default.conf

WORKDIR /var/www/html

# Get bootstraper for WordPress
COPY public/index.php public/index.php

# Only take what Nginx needs (cached configuration)
COPY --from=build-fpm-composer /var/www/html/public/wp/wp-admin/index.php public/wp/wp-admin/index.php
COPY --from=build-fpm-composer /var/www/html/vendor-assets ./

# Grab assets for Nginx
COPY --from=assets-build --chown=nginx:nginx /node/dist public/app/themes/clarity/dist/
COPY --from=assets-build --chown=nginx:nginx /node/error-pages public/app/themes/clarity/error-pages/
COPY --from=assets-build --chown=nginx:nginx /node/style.css public/app/themes/clarity/style.css


#  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░

#  █▀▀  █▀█  █▀█  █▄░█
#  █▄▄  █▀▄  █▄█  █░▀█


FROM alpine:${version_cron_alpine} AS build-cron

#  ▒█▀▀█ █▀▀█ █▀▀█ █▀▀█ █▀▀▄ █▀▀ █▀▀█ 　 █
#  ▒█░░░ █▄▄▀ █░░█ █░░█ █░░█ █▀▀ █▄▄▀ 　 ▀
#  ▒█▄▄█ ▀░▀▀ ▀▀▀▀ ▀▀▀▀ ▀░░▀ ▀▀▀ ▀░▀▀ 　 ▄
#  𝕋𝕙𝕖 𝕊𝕞𝕠𝕠𝕥𝕙 ℕ𝕠𝕟-ℝ𝕠𝕠𝕥 𝕌𝕤𝕖𝕣

ARG user=crooner
RUN addgroup --gid 3001 ${user} && adduser -D -G ${user} -g "${user} user" -u 3001 ${user}

RUN apk add dpkg tzdata && \
    ln -s /usr/share/zoneinfo/Europe/London /etc/localtime

## cron-schedule directory
RUN mkdir -p /schedule && chown ${user}:${user} /schedule

COPY deploy/config/cron/wp-cron /schedule/wp-cron

# Change directory for the rest
WORKDIR /usr/bin

COPY deploy/config/cron/wp-cron-exec.sh ./execute-wp-cron
COPY deploy/config/init/cron-install.sh ./cron-install
COPY deploy/config/init/cron-start.sh ./cron-start

RUN chmod +x execute-wp-cron cron-install cron-start && \
    cron-install &&  \
    rm ./cron-install

RUN apk del dpkg

USER 3001

# Go home...
WORKDIR /home/crooner

ENTRYPOINT ["/bin/sh", "-c", "cron-start"]

#  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░  ░░

# S3 Pusher

# Use the same verion as the cron (to benefit from caching).
FROM alpine:${version_cron_alpine} AS build-s3-push

ARG user=s3pusher
RUN addgroup --gid 3001 ${user} && adduser -D -G ${user} -g "${user} user" -u 3001 ${user}

RUN apk add --no-cache aws-cli jq

WORKDIR /usr/bin

COPY deploy/config/init/s3-push-start.sh ./s3-push-start
RUN chmod +x s3-push-start

USER 3001

# Go home...
WORKDIR /home/s3pusher
# Grab assets for pushing to s3
COPY --from=build-fpm-composer  /var/www/html/vendor-assets ./
COPY --from=assets-build        /node/dist                  public/app/themes/clarity/dist/

# Set IMAGE_TAG at build time, we don't want this container to be run with an incorrect IMAGE_TAG.
# Set towards the end of the Dockerfile to benefit from caching.
ARG IMAGE_TAG
ENV IMAGE_TAG=$IMAGE_TAG

ENTRYPOINT ["/bin/sh", "-c", "s3-push-start"]