docker: enable opcache, production php.ini, and tuned FPM pool

The image previously ran with no opcache (the official php images do not
enable it), no php.ini (defaults), and the stock FPM pool capped at
pm.max_children = 5. Every request recompiled the full framework and the
panel could serve at most five concurrent PHP requests.

- install and enable opcache in the base image, with timestamp validation
  kept on so runtime plugin installs still take effect
- use php.ini-production as the baseline and raise memory_limit to 256M
- tune the www pool (max_children 15, max_requests 500)
- cache Blade views at container start; config/route/event caches are
  deliberately skipped because settings live in .env and plugins register
  providers/routes at runtime

Dockerfile

@@ -84,6 +84,9 @@ RUN mkdir -p /pelican-data/storage /var/run/supervisord \
     && chown -R www-data: /pelican-data .env ./storage ./bootstrap/cache /var/run/supervisord /var/www/html/public/storage \
     && chmod -R 770 /pelican-data ./storage ./bootstrap/cache /var/run/supervisord \
     && chown -R www-data: /usr/local/etc/php/ /usr/local/etc/php-fpm.d/ /var/www/html/composer.json /var/www/html/composer.lock
+# Configure PHP and PHP-FPM
+COPY docker/php/pelican.ini /usr/local/etc/php/conf.d/zz-pelican.ini
+COPY docker/php/pelican-pool.conf /usr/local/etc/php-fpm.d/zz-pelican.conf
 # Configure Supervisor
 COPY docker/supervisord.conf /etc/supervisord.conf
 COPY docker/Caddyfile /etc/caddy/Caddyfile

Dockerfile.base

@@ -5,6 +5,9 @@ FROM --platform=$TARGETOS/$TARGETARCH php:8.5-fpm-alpine
 
 ADD --chmod=0755 https://github.com/mlocati/docker-php-extension-installer/releases/latest/download/install-php-extensions /usr/local/bin/
 
-RUN install-php-extensions bcmath gd intl zip pcntl pdo_mysql pdo_pgsql bz2
+RUN install-php-extensions bcmath gd intl zip opcache pcntl pdo_mysql pdo_pgsql bz2
 
 RUN rm /usr/local/bin/install-php-extensions
+
+# Use the production php.ini shipped with the image as the baseline
+RUN mv "$PHP_INI_DIR/php.ini-production" "$PHP_INI_DIR/php.ini"

Dockerfile.dev

@@ -5,10 +5,13 @@ FROM --platform=$TARGETOS/$TARGETARCH php:8.5-fpm-alpine AS base
 
 ADD --chmod=0755 https://github.com/mlocati/docker-php-extension-installer/releases/latest/download/install-php-extensions /usr/local/bin/
 
-RUN install-php-extensions bcmath gd intl zip pcntl pdo_mysql pdo_pgsql bz2
+RUN install-php-extensions bcmath gd intl zip opcache pcntl pdo_mysql pdo_pgsql bz2
 
 RUN rm /usr/local/bin/install-php-extensions
 
+# Use the production php.ini shipped with the image as the baseline
+RUN mv "$PHP_INI_DIR/php.ini-production" "$PHP_INI_DIR/php.ini"
+
 # ================================
 # Stage 1-1: Composer Install
 # ================================
@@ -90,6 +93,9 @@ RUN mkdir -p /pelican-data/storage /var/run/supervisord \
     && chmod -R 770 /pelican-data ./storage ./bootstrap/cache /var/run/supervisord \
     && chown -R www-data: /usr/local/etc/php/ /usr/local/etc/php-fpm.d/ /var/www/html/composer.json /var/www/html/composer.lock
 
+# Configure PHP and PHP-FPM
+COPY docker/php/pelican.ini /usr/local/etc/php/conf.d/zz-pelican.ini
+COPY docker/php/pelican-pool.conf /usr/local/etc/php-fpm.d/zz-pelican.conf
 # Configure Supervisor
 COPY docker/supervisord.conf /etc/supervisord.conf
 COPY docker/Caddyfile /etc/caddy/Caddyfile

database/migrations/2026_01_16_081858_create_backup_hosts_table.php

@@ -13,92 +13,57 @@ return new class extends Migration
      */
     public function up(): void
     {
-        if (!Schema::hasTable('backup_hosts')) {
-            Schema::create('backup_hosts', function (Blueprint $table) {
-                $table->increments('id');
-                $table->string('name');
-                $table->string('schema');
-                $table->json('configuration')->nullable();
-                $table->timestamps();
-            });
-        }
-
-        if (!Schema::hasTable('backup_host_node')) {
-            Schema::create('backup_host_node', function (Blueprint $table) {
-                $table->unsignedInteger('node_id');
-                $table->foreign('node_id')->references('id')->on('nodes')->cascadeOnDelete();
-
-                $table->unsignedInteger('backup_host_id');
-                $table->foreign('backup_host_id')->references('id')->on('backup_hosts')->cascadeOnDelete();
-
-                $table->timestamps();
-
-                $table->unique(['node_id']);
-            });
-        }
-
-        $backupHost = BackupHost::first();
-        if (!$backupHost) {
-            $oldDriver = env('APP_BACKUP_DRIVER', 'wings');
-
-            $oldConfiguration = null;
-            if ($oldDriver === 's3') {
-                $oldConfiguration = [
-                    'region' => env('AWS_DEFAULT_REGION'),
-                    'key' => env('AWS_ACCESS_KEY_ID'),
-                    'secret' => env('AWS_SECRET_ACCESS_KEY'),
-                    'bucket' => env('AWS_BACKUPS_BUCKET'),
-                    'prefix' => env('AWS_BACKUPS_BUCKET', ''),
-                    'endpoint' => env('AWS_ENDPOINT'),
-                    'use_path_style_endpoint' => env('AWS_USE_PATH_STYLE_ENDPOINT', false),
-                    'use_accelerate_endpoint' => env('AWS_BACKUPS_USE_ACCELERATE', false),
-                    'storage_class' => env('AWS_BACKUPS_STORAGE_CLASS'),
-                ];
-            }
-
-            $backupHost = BackupHost::create([
-                'name' => $oldDriver === 's3' ? 'Remote' : 'Local',
-                'schema' => $oldDriver,
-                'configuration' => $oldConfiguration,
-            ]);
-        }
-
-        // The column must start out nullable: adding it NOT NULL would give existing
-        // rows a value of 0, which the foreign key below would reject.
-        if (!Schema::hasColumn('backups', 'backup_host_id')) {
-            $hasDiskColumn = Schema::hasColumn('backups', 'disk');
-
-            Schema::table('backups', function (Blueprint $table) use ($hasDiskColumn) {
-                $column = $table->unsignedInteger('backup_host_id')->nullable();
-
-                // The disk column may already be gone on installs that were repaired by hand.
-                if ($hasDiskColumn) {
-                    $column->after('disk');
-                }
-            });
-        }
-
-        DB::table('backups')
-            ->whereNull('backup_host_id')
-            ->orWhere('backup_host_id', 0)
-            ->update(['backup_host_id' => $backupHost->id]);
-
-        Schema::table('backups', function (Blueprint $table) {
-            $table->unsignedInteger('backup_host_id')->nullable(false)->change();
+        Schema::create('backup_hosts', function (Blueprint $table) {
+            $table->increments('id');
+            $table->string('name');
+            $table->string('schema');
+            $table->json('configuration')->nullable();
+            $table->timestamps();
         });
 
-        $foreignKeys = array_column(Schema::getForeignKeys('backups'), 'name');
-        if (!in_array('backups_backup_host_id_foreign', $foreignKeys)) {
-            Schema::table('backups', function (Blueprint $table) {
-                $table->foreign('backup_host_id')->references('id')->on('backup_hosts');
-            });
+        Schema::create('backup_host_node', function (Blueprint $table) {
+            $table->unsignedInteger('node_id');
+            $table->foreign('node_id')->references('id')->on('nodes')->cascadeOnDelete();
+
+            $table->unsignedInteger('backup_host_id');
+            $table->foreign('backup_host_id')->references('id')->on('backup_hosts')->cascadeOnDelete();
+
+            $table->timestamps();
+
+            $table->unique(['node_id']);
+        });
+
+        Schema::table('backups', function (Blueprint $table) {
+            $table->unsignedInteger('backup_host_id')->after('disk');
+            $table->foreign('backup_host_id')->references('id')->on('backup_hosts');
+
+            $table->dropColumn('disk');
+        });
+
+        $oldDriver = env('APP_BACKUP_DRIVER', 'wings');
+
+        $oldConfiguration = null;
+        if ($oldDriver === 's3') {
+            $oldConfiguration = [
+                'region' => env('AWS_DEFAULT_REGION'),
+                'key' => env('AWS_ACCESS_KEY_ID'),
+                'secret' => env('AWS_SECRET_ACCESS_KEY'),
+                'bucket' => env('AWS_BACKUPS_BUCKET'),
+                'prefix' => env('AWS_BACKUPS_BUCKET', ''),
+                'endpoint' => env('AWS_ENDPOINT'),
+                'use_path_style_endpoint' => env('AWS_USE_PATH_STYLE_ENDPOINT', false),
+                'use_accelerate_endpoint' => env('AWS_BACKUPS_USE_ACCELERATE', false),
+                'storage_class' => env('AWS_BACKUPS_STORAGE_CLASS'),
+            ];
         }
 
-        if (Schema::hasColumn('backups', 'disk')) {
-            Schema::table('backups', function (Blueprint $table) {
-                $table->dropColumn('disk');
-            });
-        }
+        $backupHost = BackupHost::create([
+            'name' => $oldDriver === 's3' ? 'Remote' : 'Local',
+            'schema' => $oldDriver,
+            'configuration' => $oldConfiguration,
+        ]);
+
+        DB::table('backups')->update(['backup_host_id' => $backupHost->id]);
     }
 
     /**
@@ -113,8 +78,8 @@ return new class extends Migration
             $table->dropColumn('backup_host_id');
         });
 
-        Schema::dropIfExists('backup_host_node');
-
         Schema::dropIfExists('backup_hosts');
+
+        Schema::dropIfExists('backup_host_node');
     }
 };

docker/entrypoint.sh

@@ -66,6 +66,12 @@ fi
 echo "Optimizing Filament"
 php artisan filament:optimize
 
+# Note: config/route/event caches are intentionally NOT built here. Settings
+# live in .env and are edited at runtime, and plugins register providers (and
+# routes) at runtime - those caches would freeze them until the next restart.
+echo "Caching Blade views"
+php artisan view:cache
+
 # default to caddy not starting
 export SUPERVISORD_CADDY=false
 export CADDY_APP_URL="${APP_URL}"

docker/php/pelican-pool.conf

@@ -0,0 +1,12 @@
+; Pelican overrides for the default www pool.
+; The image default of pm.max_children = 5 caps the panel at five concurrent
+; PHP requests. Sizing assumes roughly 64-128MB per worker; lower
+; pm.max_children on very small hosts.
+[www]
+pm = dynamic
+pm.max_children = 15
+pm.start_servers = 4
+pm.min_spare_servers = 2
+pm.max_spare_servers = 8
+; recycle workers periodically to guard against memory leaks
+pm.max_requests = 500

docker/php/pelican.ini

@@ -0,0 +1,14 @@
+; Pelican overrides, layered on top of php.ini-production
+
+; Filament recommends at least 256M
+memory_limit = 256M
+
+[opcache]
+opcache.enable = 1
+opcache.memory_consumption = 192
+opcache.interned_strings_buffer = 32
+opcache.max_accelerated_files = 30000
+; keep timestamp validation enabled so runtime plugin installs pick up
+; new and changed files without a container restart
+opcache.validate_timestamps = 1
+opcache.revalidate_freq = 2