FROM docker.io/library/php:apache

RUN docker-php-ext-install mysqli bcmath

# Use PHP's production defaults (no error output to clients) and hide the PHP version.
RUN cp "$PHP_INI_DIR/php.ini-production" "$PHP_INI_DIR/php.ini" \
 && printf 'expose_php = Off\n' > "$PHP_INI_DIR/conf.d/zz-hardening.ini"

# Disable directory listings and reduce the server signature.
RUN sed -i 's/^\(\s*Options\) Indexes FollowSymLinks/\1 FollowSymLinks/' /etc/apache2/apache2.conf \
 && sed -i -e 's/^ServerTokens .*/ServerTokens Prod/' -e 's/^ServerSignature .*/ServerSignature Off/' /etc/apache2/conf-available/security.conf

COPY ./www/* /var/www/html

# The web server must not be able to create or modify files in the document root.
RUN chown -R root:root /var/www/html \
 && chmod -R u=rwX,go=rX /var/www/html