feat: ci/cd

docker/Dockerfile.prod

@@ -0,0 +1,84 @@
+# ============================================================
+# Dockerfile — Production (FrankenPHP)
+# FrankenPHP = serveur web + PHP runtime tout-en-un
+# Remplace PHP-FPM + Nginx en un seul container
+# ============================================================
+
+FROM dunglas/frankenphp:php8.3-alpine AS base
+
+# Extensions PHP nécessaires pour Laravel
+RUN apk add --no-cache \
+    postgresql-dev \
+    libpng-dev \
+    libjpeg-turbo-dev \
+    freetype-dev \
+    libzip-dev \
+    oniguruma-dev \
+    icu-dev \
+    curl \
+    unzip \
+    git \
+    && docker-php-ext-configure gd --with-freetype --with-jpeg \
+    && docker-php-ext-install \
+        pdo \
+        pdo_pgsql \
+        pgsql \
+        mbstring \
+        zip \
+        gd \
+        bcmath \
+        intl \
+        opcache \
+        pcntl
+
+# Composer
+COPY --from=composer:2 /usr/bin/composer /usr/bin/composer
+
+# ── Stage Build (Node pour compiler les assets Vite) ────────
+FROM base AS builder
+
+WORKDIR /app
+
+# Dépendances PHP (sans dev)
+COPY composer.json composer.lock ./
+RUN composer install \
+    --no-interaction \
+    --no-dev \
+    --prefer-dist \
+    --optimize-autoloader \
+    --no-scripts
+
+# Dépendances Node + build assets
+COPY package.json package-lock.json* ./
+RUN apk add --no-cache nodejs npm \
+    && npm ci --ignore-scripts
+
+COPY . .
+
+# Génère les assets Vite
+RUN npm run build
+
+# Post-scripts Composer
+RUN composer run-script post-autoload-dump || true
+
+# ── Stage Final ──────────────────────────────────────────────
+FROM base AS production
+
+WORKDIR /app
+
+# Copie tout depuis le builder
+COPY --from=builder /app /app
+
+# Config PHP optimisée prod
+COPY docker/php.prod.ini /usr/local/etc/php/conf.d/99-prod.ini
+
+# Permissions sur storage et bootstrap/cache
+RUN mkdir -p storage/logs storage/framework/cache storage/framework/sessions storage/framework/views bootstrap/cache \
+    && chown -R www-data:www-data storage bootstrap/cache \
+    && chmod -R 775 storage bootstrap/cache
+
+# FrankenPHP écoute sur le port 80
+EXPOSE 80
+
+# FrankenPHP sert le dossier public/ de Laravel
+CMD ["frankenphp", "php-server", "--root", "/app/public"]

docker/nginx.prod.conf

@@ -0,0 +1,48 @@
+server {
+    listen 80;
+    server_name _;
+    root /var/www/html/public;
+    index index.php;
+
+    # Sécurité — masque la version Nginx
+    server_tokens off;
+
+    # Taille max des uploads
+    client_max_body_size 50M;
+
+    # Logs
+    access_log /var/log/nginx/access.log;
+    error_log  /var/log/nginx/error.log warn;
+
+    # Gzip
+    gzip on;
+    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
+    gzip_min_length 256;
+
+    # Assets statiques — cache long terme
+    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot|webp)$ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+        try_files $uri =404;
+    }
+
+    # Route principale Laravel
+    location / {
+        try_files $uri $uri/ /index.php?$query_string;
+    }
+
+    # PHP-FPM
+    location ~ \.php$ {
+        fastcgi_pass app:9000;
+        fastcgi_index index.php;
+        fastcgi_buffers 16 16k;
+        fastcgi_buffer_size 32k;
+        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
+        include fastcgi_params;
+    }
+
+    # Bloque l'accès aux fichiers cachés
+    location ~ /\. {
+        deny all;
+    }
+}

docker/php.prod.ini

@@ -0,0 +1,27 @@
+; Configuration PHP optimisée pour la production
+
+[PHP]
+; Sécurité
+expose_php = Off
+display_errors = Off
+display_startup_errors = Off
+log_errors = On
+error_log = /var/www/html/storage/logs/php-errors.log
+
+; Performance
+memory_limit = 256M
+max_execution_time = 60
+max_input_time = 60
+post_max_size = 50M
+upload_max_filesize = 50M
+
+; OPcache
+opcache.enable = 1
+opcache.enable_cli = 0
+opcache.memory_consumption = 128
+opcache.interned_strings_buffer = 16
+opcache.max_accelerated_files = 10000
+opcache.revalidate_freq = 0
+opcache.validate_timestamps = 0
+opcache.save_comments = 1
+opcache.fast_shutdown = 1