# ci/test-env/Dockerfile — All-in-one CI test environment
# Bundles PostgreSQL, Mosquitto (TLS), and warecached with pre-generated certs.

ARG WARECACHE_TAG=nightly

# ── Stage 1: Generate self-signed TLS certificates ───────────
FROM debian:stable-slim AS cert-gen

RUN apt-get update -yqq && \
    apt-get install -yqq --no-install-recommends openssl && \
    rm -rf /var/lib/apt/lists/*

WORKDIR /certs
COPY localhost.ext .

# CA key + self-signed CA cert
RUN openssl req -x509 -sha256 -nodes \
      -subj "/C=US/ST=NY/CN=warecache" \
      -days 3650 -newkey rsa:4096 \
      -keyout ca.key -out ca.crt

# Server key + CSR, then sign with CA
RUN openssl req -newkey rsa:4096 -nodes \
      -subj "/C=US/ST=NY/CN=warecache-mqtt" \
      -keyout server.key -out server.csr && \
    openssl x509 -req -in server.csr \
      -CA ca.crt -CAkey ca.key -CAcreateserial \
      -out server.crt -days 3650 -extfile localhost.ext

# Client key + CSR, then sign with CA
RUN openssl req -newkey rsa:4096 -nodes \
      -subj "/C=US/ST=NY/CN=warecache-server" \
      -keyout client.key -out client.csr && \
    openssl x509 -req -in client.csr \
      -CA ca.crt -CAkey ca.key -CAcreateserial \
      -out client.crt -days 3650 -extfile localhost.ext

# ── Stage 2: Pull warecached binary from project registry ────
FROM gitlab.slant.tech:5050/products/warecache/software/server-rust/warecache:${WARECACHE_TAG} AS warecache-src

# ── Stage 3: Runtime ─────────────────────────────────────────
FROM debian:stable-slim

RUN apt-get update -yqq && \
    apt-get install -yqq --no-install-recommends \
        postgresql \
        mosquitto \
        libpq-dev && \
    rm -rf /var/lib/apt/lists/*

WORKDIR /app

# Copy warecached binary from the server image
COPY --from=warecache-src /app/warecached /app/warecached

# Mosquitto certs (paths must match mosquitto.conf)
COPY --from=cert-gen /certs/ca.crt     /mosquitto/config/ca.crt
COPY --from=cert-gen /certs/server.key /mosquitto/config/server.key
COPY --from=cert-gen /certs/server.crt /mosquitto/config/server.crt

# Debian's mosquitto drops privileges to the mosquitto user
RUN chown -R mosquitto:mosquitto /mosquitto/

# warecached certs (paths must match wcd_config.toml [mqtt] section)
COPY --from=cert-gen /certs/ca.crt     /tmp/mqtt-ca.pem
COPY --from=cert-gen /certs/ca.key     /tmp/mqtt-cakey.pem
COPY --from=cert-gen /certs/client.crt /tmp/mqtt-cert.pem
COPY --from=cert-gen /certs/client.key /tmp/mqtt-key.pem

# Config files
COPY mosquitto.conf  /mosquitto/config/mosquitto.conf
COPY wcd_config.toml /app/wcd_config.toml
COPY entrypoint.sh   /app/entrypoint.sh

RUN chmod +x /app/entrypoint.sh

EXPOSE 8118 1883 8883

ENTRYPOINT ["/app/entrypoint.sh"]
