FROM php:8.4-apache-bookworm

# Install PHP extensions and local OCR used by the recipe site.
# GD is used for resizing/normalizing images before OCR and owner-uploaded icons.
# curl is used by the unstructured recipe importer to fetch public recipe URLs
# after the application validates and pins the resolved public IP address.
# Tesseract stays local to the server; English recipe images are OCR'd and then
# passed through the same shared recipe parser as text/document imports.
RUN apt-get update \
    && apt-get install -y --no-install-recommends \
        curl \
        antiword \
        poppler-utils \
        tesseract-ocr \
        tesseract-ocr-eng \
        libonig-dev \
        libzip-dev \
        libjpeg62-turbo-dev \
        libpng-dev \
        libwebp-dev \
    && docker-php-ext-configure gd --with-jpeg --with-webp \
    && docker-php-ext-install pdo pdo_mysql mysqli zip gd mbstring \
    && rm -rf /var/lib/apt/lists/*

# Enable Apache modules commonly needed for cleaner routing/security headers.
RUN a2enmod rewrite headers

# Keep public content routes in a tracked Apache config so fresh installs and
# upgrades use the same /recipe/{slug} and /category/{slug} behavior.
COPY apache/recipe-site-routing.conf /etc/apache2/conf-available/recipe-site-routing.conf
RUN a2enconf recipe-site-routing

# Harden Apache a bit, route standard errors to the standalone themed error page,
# and block accidental access to backup/config/source files.
RUN printf '%s\n' \
    'ServerTokens Prod' \
    'ServerSignature Off' \
    '' \
    'ErrorDocument 403 /error.php' \
    'ErrorDocument 404 /error.php' \
    'ErrorDocument 500 /error.php' \
    'ErrorDocument 503 /error.php' \
    '' \
    '<FilesMatch "\.(bak|sav|sql|env|ini|log|sh|md|json|lock|dist|example)$">' \
    '    Require all denied' \
    '</FilesMatch>' \
    '' \
    '<FilesMatch "(^\.|~$)">' \
    '    Require all denied' \
    '</FilesMatch>' \
    '' \
    '<Directory "/var/www/html/includes">' \
    '    Require all denied' \
    '</Directory>' \
    '' \
    '<LocationMatch "^/admin/.*-row\\.php$">' \
    '    Require all denied' \
    '</LocationMatch>' \
    > /etc/apache2/conf-available/recipe-site-security.conf \
    && a2enconf recipe-site-security

# Safer PHP production-ish defaults. The automatic recipe router accepts native
# packages up to 150 MB, so PHP must allow the request to reach application-level
# validation instead of silently dropping $_POST/$_FILES first.
RUN printf '%s\n' \
    'expose_php = Off' \
    'display_errors = Off' \
    'log_errors = On' \
    'upload_max_filesize = 150M' \
    'post_max_size = 160M' \
    'memory_limit = 256M' \
    'max_execution_time = 60' \
    > /usr/local/etc/php/conf.d/recipe-site.ini
