Update docker handling

DOCKER.md

@@ -251,3 +251,22 @@ docker compose up -d
 | CI / scripted teardown          | `make fresh FORCE=1` or `make nuke FORCE=1` to skip prompts           |
 | supervisorctl not connecting    | `make root-shell` then `supervisorctl status` to verify socket path   |
 
+## Nginx (GetPageSpeed + Brotli)
+
+The app container's nginx is installed from the [GetPageSpeed apt repo](https://extras.getpagespeed.com/ubuntu/)
+(stable branch) instead of the Ubuntu archive. This gives us a current nginx
+build with ABI-matched dynamic modules. The `nginx-module-brotli` package is
+installed and the brotli directives in `docker/8.5/nginx.conf` are enabled by
+default (gzip is kept as a fallback for clients without `br` support).
+
+The repo is apt-pinned at priority `1001` via
+`/etc/apt/preferences.d/getpagespeed-nginx.pref` so `nginx` and module
+packages always resolve from GetPageSpeed even if Ubuntu publishes a newer
+version. A `nginx -t` is run during `docker build` to fail fast on any config
+drift.
+
+To revert to stock Ubuntu nginx, remove the GetPageSpeed apt key, list, and
+preferences entries from `docker/8.5/Dockerfile`, drop `nginx-module-brotli`
+from the install line, re-comment the brotli block in `docker/8.5/nginx.conf`,
+and run `make rebuild`.
+

config/manticore.conf

@@ -37,7 +37,6 @@ searchd
 	listen			= 9312:sphinx
 	listen			= 9306:mysql
 	listen			= 9308:http
-	listen			= 9443:https
 
 	# data directory, where all tables and binlog files are stored
 	# https://manual.manticoresearch.com/Server_settings/Searchd#data_dir

docker/8.5/Dockerfile

@@ -26,6 +26,9 @@ RUN apt-get update \
     && echo "deb [signed-by=/etc/apt/keyrings/yarn.gpg] https://dl.yarnpkg.com/debian/ stable main" > /etc/apt/sources.list.d/yarn.list \
     && curl -sS https://www.postgresql.org/media/keys/ACCC4CF8.asc | gpg --dearmor | tee /etc/apt/keyrings/pgdg.gpg >/dev/null \
     && echo "deb [signed-by=/etc/apt/keyrings/pgdg.gpg] http://apt.postgresql.org/pub/repos/apt noble-pgdg main" > /etc/apt/sources.list.d/pgdg.list \
+    && curl -fsSL https://extras.getpagespeed.com/deb-archive-keyring.gpg -o /etc/apt/keyrings/getpagespeed.gpg \
+    && echo "deb [signed-by=/etc/apt/keyrings/getpagespeed.gpg] https://extras.getpagespeed.com/ubuntu noble main" > /etc/apt/sources.list.d/getpagespeed.list \
+    && printf 'Package: *\nPin: origin extras.getpagespeed.com\nPin-Priority: 1001\n' > /etc/apt/preferences.d/getpagespeed-nginx.pref \
     && apt-get update
 
 # Install core PHP packages
@@ -48,7 +51,12 @@ RUN apt-get install -y --no-install-recommends \
 RUN apt-get install -y \
     tmux iputils-ping net-tools ffmpeg \
     sudo jq htop fonts-powerline nano bash-completion time wget cron \
-    nginx jpegoptim webp optipng pngquant libavif-bin
+    jpegoptim webp optipng pngquant libavif-bin
+
+# Install nginx + brotli module from GetPageSpeed (apt-pinned, stable branch)
+RUN apt-get install -y nginx nginx-module-brotli \
+    && rm -f /etc/nginx/conf.d/default.conf \
+    && nginx -t
 
 # Install mediainfo
 RUN wget https://mediaarea.net/repo/deb/repo-mediaarea_1.0-25_all.deb \
@@ -90,7 +98,8 @@ COPY nginx.conf /etc/nginx/sites-available/default
 COPY supervisord.conf /etc/supervisor/supervisord.conf
 COPY php.ini /etc/php/8.5/cli/conf.d/99-sail.ini
 
-RUN chmod +x /usr/local/bin/start-container
+RUN chmod +x /usr/local/bin/start-container \
+    && nginx -t
 
 EXPOSE 80
 

docker/8.5/nginx.conf

@@ -12,16 +12,15 @@ server {
     gzip_proxied any;
     gzip_comp_level 6;
 
-    # Brotli compression (requires libnginx-mod-http-brotli-filter and libnginx-mod-http-brotli-static)
+    # Brotli compression (provided by GetPageSpeed nginx-module-brotli package)
-    # Uncomment these lines after installing the brotli module
+    brotli on;
-    #brotli on;
+    brotli_comp_level 6;
-    #brotli_comp_level 6;
+    brotli_static on;
-    #brotli_static on;
+    brotli_types application/atom+xml application/javascript application/json application/rss+xml
-    #brotli_types application/atom+xml application/javascript application/json application/rss+xml
+    application/vnd.ms-fontobject application/x-font-opentype application/x-font-truetype
-    #application/vnd.ms-fontobject application/x-font-opentype application/x-font-truetype
+    application/x-font-ttf application/x-javascript application/xhtml+xml application/xml
-    #application/x-font-ttf application/x-javascript application/xhtml+xml application/xml
+    font/eot font/opentype font/otf font/truetype image/svg+xml image/vnd.microsoft.icon
-    #font/eot font/opentype font/otf font/truetype image/svg+xml image/vnd.microsoft.icon
+    image/x-icon image/x-win-bitmap text/css text/javascript text/plain text/xml text/html;
-    #image/x-icon image/x-win-bitmap text/css text/javascript text/plain text/xml text/html;
 
     location / {
         try_files $uri $uri/ /index.php?$query_string;

docker/8.5/start-container

@@ -12,6 +12,21 @@ chmod -R ugo+rw /.composer
 addgroup supervisor > /dev/null 2>&1
 usermod -a -G supervisor sail > /dev/null 2>&1
 
+# Run PHP-FPM as `sail` so its uid/gid match files written via the bind mount
+# (host user = sail's primary group). Avoids "chmod(): Operation not permitted"
+# on storage/logs when files were created by the host user or other processes.
+# The FPM unix socket stays owned by www-data so nginx (running as www-data)
+# can connect to it.
+SAIL_GROUP="$(id -gn sail)"
+cat > /etc/php/8.5/fpm/pool.d/zz-sail.conf <<EOF
+[www]
+user = sail
+group = ${SAIL_GROUP}
+listen.owner = www-data
+listen.group = www-data
+listen.mode = 0660
+EOF
+
 # Set timezone
 ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone