5402: Align nginx image env-var contract

CHANGELOG.md

@@ -41,6 +41,8 @@ All notable changes to this project will be documented in this file.
 - Annotated `.env` so it serves as the canonical, self-documenting Symfony
   env example, with a CI check that enforces it stays in sync with `config/`.
 - Switched image build pipeline to GHCR with multi-arch layer caching.
+- Aligned the nginx image env-var contract: split `NGINX_FPM_SERVICE` and
+  `NGINX_FPM_PORT`, raised upload cap and trusted-proxy CIDR defaults.
 
 ### NB! Prior to 3.x the project was split into separate repositories
 

docker-compose.override.yml

@@ -41,7 +41,8 @@ services:
     networks:
       - app
     depends_on:
-      - nginx
+      nginx:
+        condition: service_healthy
     volumes:
       - .:/app
       - /tmp/.X11-unix:/tmp/.X11-unix

docker-compose.server.yml

@@ -33,11 +33,25 @@ services:
       - ./infrastructure/nginx/etc/nginx.conf:/etc/nginx/nginx.conf:ro
       - .:/app
     environment:
-      NGINX_FPM_SERVICE: ${COMPOSE_PROJECT_NAME}-phpfpm-1:9000
+      NGINX_FPM_SERVICE: ${COMPOSE_PROJECT_NAME}-phpfpm-1
+      NGINX_FPM_PORT: 9000
       NGINX_WEB_ROOT: /app/public
       NGINX_PORT: 8080
       NGINX_MAX_BODY_SIZE: 5M
       NGINX_SET_REAL_IP_FROM: 172.16.0.0/12
+    healthcheck:
+      # $$NGINX_PORT escapes compose-time interpolation; the variable is
+      # expanded by the shell inside the container against the service's
+      # environment.
+      test:
+        [
+          "CMD-SHELL",
+          'wget --quiet --tries=1 --spider "http://localhost:$$NGINX_PORT/health"',
+        ]
+      interval: 5s
+      timeout: 3s
+      retries: 6
+      start_period: 5s
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network=frontend"

docker-compose.yml

@@ -61,11 +61,25 @@ services:
       - ./infrastructure/nginx/etc/nginx.conf:/etc/nginx/nginx.conf:ro
       - .:/app
     environment:
-      NGINX_FPM_SERVICE: ${COMPOSE_PROJECT_NAME}-phpfpm-1:9000
+      NGINX_FPM_SERVICE: ${COMPOSE_PROJECT_NAME}-phpfpm-1
+      NGINX_FPM_PORT: 9000
       NGINX_WEB_ROOT: /app/public
       NGINX_PORT: 8080
       NGINX_MAX_BODY_SIZE: 5M
       NGINX_SET_REAL_IP_FROM: 172.16.0.0/12
+    healthcheck:
+      # $$NGINX_PORT escapes compose-time interpolation; the variable is
+      # expanded by the shell inside the container against the service's
+      # environment.
+      test:
+        [
+          "CMD-SHELL",
+          'wget --quiet --tries=1 --spider "http://localhost:$$NGINX_PORT/health"',
+        ]
+      interval: 5s
+      timeout: 3s
+      retries: 6
+      start_period: 5s
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network=frontend"

infrastructure/nginx/Dockerfile

@@ -71,8 +71,10 @@ ARG GID=101
 ENV APP_CLIENT_PATH=/app \
     APP_API_PATH=/var/www/html \
     NGINX_PORT=8080 \
-    NGINX_SET_REAL_IP_FROM=172.17.0.0/16 \
-    NGINX_MAX_BODY_SIZE=10m \
+    NGINX_FPM_SERVICE=os2display \
+    NGINX_FPM_PORT=9000 \
+    NGINX_MAX_BODY_SIZE=140m \
+    NGINX_SET_REAL_IP_FROM=172.16.0.0/12 \
     NGINX_WEB_ROOT=/var/www/html/public
 
 WORKDIR ${APP_API_PATH}

infrastructure/nginx/etc/templates/default.conf.template

@@ -1,5 +1,5 @@
 upstream api_backend {
-    server ${NGINX_FPM_SERVICE};
+    server ${NGINX_FPM_SERVICE}:${NGINX_FPM_PORT};
     keepalive 16;
 }