Toolvana: production-ready media tools platform (CodeIgniter 4)

- 134-tool registry with programmatic SEO (unique titles/H1/descriptions,
  JSON-LD graphs, sitemap index, canonical 301 enforcement via required filter)
- DB-backed job queue (SKIP LOCKED) with drivers: Ffmpeg, Images (GD),
  Pdf (qpdf/gs/poppler), Youtube (thumbnails), Qr (server-side PNG)
- Security: SSRF guard, MIME validation, rate limits, API-key auth,
  bcrypt admin login, security headers
- Admin panel: dashboard, tools/categories/guides CRUD, SEO audit,
  analytics, job inspector with retry, system health, feature flags
- Docker deployment (nginx + web/api FPM pools + scalable workers),
  PHPUnit suite (19 tests / 1139 assertions), PWA manifest + service worker

docker/Dockerfile

@@ -0,0 +1,44 @@
+# ---------------------------------------------------------------------------
+# Toolvana web/api image: PHP-FPM 8.2 with all media processing binaries.
+# The same image serves the web tier and runs workers/scheduler — services
+# differ only by command, keeping builds small and versions identical.
+# ---------------------------------------------------------------------------
+
+FROM php:8.2-fpm-alpine AS base
+
+RUN apk add --no-cache bash icu-libs libzip oniguruma libpng jpegoptim
+
+# --- PHP extensions required by CodeIgniter 4 + app ------------------------
+RUN apk add --no-cache --virtual .build-deps $PHPIZE_DEPS icu-dev libzip-dev oniguruma-dev libpng-dev \
+    && docker-php-ext-install intl mbstring zip pdo_mysql mysqli opcache pcntl exif \
+    && pecl install redis \
+    && docker-php-ext-enable redis \
+    && apk del .build-deps
+
+# --- Media processing stack -------------------------------------------------
+RUN apk add --no-cache ffmpeg imagemagick poppler-utils qpdf ghostscript zip unzip curl \
+    && wget -q https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp -O /usr/local/bin/yt-dlp \
+    && chmod 755 /usr/local/bin/yt-dlp || true
+
+# --- Composer deps -----------------------------------------------------------
+COPY --from=composer:2 /usr/bin/composer /usr/bin/composer
+WORKDIR /app
+COPY composer.json composer.lock ./
+RUN composer install --no-dev --no-scripts --no-autoloader --prefer-dist --no-interaction
+
+COPY . .
+RUN composer dump-autoload -o \
+    && chown -R www-data:www-data writable \
+    && chmod -R ug+rwX writable
+
+# --- PHP production defaults --------------------------------------------------
+RUN cp /usr/local/etc/php/php.ini-production /usr/local/etc/php/php.ini \
+    && { echo "opcache.enable=1"; \
+         echo "opcache.validate_timestamps=0"; \
+         echo "opcache.memory_consumption=192"; \
+         echo "realpath_cache_size=4096K"; \
+         echo "memory_limit=512M"; } > /usr/local/etc/php/conf.d/toolvana.ini
+
+EXPOSE 9000
+
+CMD ["php-fpm"]

docker/nginx/default.conf

@@ -0,0 +1,41 @@
+# Toolvana — nginx reverse proxy + static asset server.
+
+server {
+    listen 80;
+    server_name _;
+    root /app/public;
+    index index.php;
+
+    # security headers (TLS terminates here in production; enable HSTS after cert)
+    add_header X-Content-Type-Options nosniff always;
+    add_header X-Frame-Options SAMEORIGIN always;
+    add_header Referrer-Policy strict-origin-when-cross-origin always;
+
+    gzip on;
+    gzip_comp_level 5;
+    gzip_types text/plain text/css application/javascript application/json application/xml image/svg+xml;
+    # brotli: enable with the ngx_brotli module where available
+    # brotli on; brotli_types text/plain text/css application/javascript application/json image/svg+xml;
+
+    # --- static assets: immutable caching ------------------------------------
+    location ~* \.(css|js|svg|png|jpg|webp|woff2?|ico)$ {
+        expires 30d;
+        add_header Cache-Control "public, immutable";
+        try_files $uri =404;
+    }
+
+    location / {
+        try_files $uri $uri/ /index.php$is_args$args;
+    }
+
+    # --- PHP-FPM to the web/api upstreams --------------------------------------
+    location ~ \.php$ {
+        try_files $uri =404;
+        include fastcgi_params;
+        fastcgi_pass web:9000;
+        fastcgi_read_timeout 120s;
+        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+    }
+}
+
+# HTTP/3 note: run behind Cloudflare or a QUIC-enabled edge for h3.