# Base image. CI passes BASE_IMAGE=almalinux/10-base@sha256:<digest>, resolved
# DIRECTLY from Docker Hub in the same run (.gitea/scripts/resolve-base-image.sh),
# so the pkg-cache registry mirror can only serve content-addressed blobs.
# Local builds use the tag. docs/pkg-cache.md "Base-image digest pinning".
ARG BASE_IMAGE=almalinux/10-base
FROM ${BASE_IMAGE}

# OPTIONAL internal package cache, e.g. --build-arg PKG_CACHE=https://192.168.1.40
# (CT130 pkg-cache, https only). Unset = upstream repositories. Release RPMs are
# GPG-verified against keys/pkg-cache/ either way. Repo files
# are restored at the end of every RUN, so no layer keeps the cache address.
# See scripts/pkg-cache-repos.sh.
ARG PKG_CACHE=
COPY ./scripts/pkg-cache-repos.sh /usr/local/sbin/pkg-cache-repos.sh
COPY ./keys/pkg-cache/ /usr/local/share/pkg-cache/

# Install Apache and minimal dependencies (no PHP at all)
RUN /usr/local/sbin/pkg-cache-repos.sh rpm && \
    /usr/local/sbin/pkg-cache-repos.sh release-install epel && \
    /usr/local/sbin/pkg-cache-repos.sh rpm && \
    dnf update -y && \
    dnf install -y httpd mod_ssl openssl iproute cronie procps curl && \
    /usr/local/sbin/pkg-cache-repos.sh restore && \
    dnf clean all && \
    rm -rf /var/cache/dnf /usr/share/doc /usr/share/man /usr/share/locale/*

# Copy scripts and set permissions
COPY ./scripts/detect-memory.sh /scripts/detect-memory.sh
COPY ./scripts/create-apache-mpm-config.sh /scripts/create-apache-mpm-config.sh
COPY ./scripts/log-rotate.sh /scripts/log-rotate.sh
COPY ./scripts/entrypoint-shared-httpd.sh /scripts/entrypoint-shared-httpd.sh
COPY ./scripts/stop-services.sh /scripts/stop-services.sh
COPY ./scripts/tune-mpm.sh /scripts/tune-mpm.sh
RUN chmod +x /scripts/*

# Generate self-signed SSL cert (same as main CAC image)
RUN openssl req -newkey rsa:2048 -nodes \
      -keyout /etc/pki/tls/private/localhost.key \
      -x509 -days 3650 -subj "/CN=localhost" \
      -out /etc/pki/tls/certs/localhost.crt

# Copy Apache configs
COPY ./configs/remote_ip.conf /etc/httpd/conf.d/
COPY ./configs/default-index.conf /etc/httpd/conf.d/

# Create vhosts directory (will be volume-mounted from host)
RUN mkdir -p /etc/httpd/conf.d/vhosts

# Set up cron job for log rotation
RUN echo "15 */12 * * * root /scripts/log-rotate.sh" >> /etc/crontab

EXPOSE 80 443

HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
  CMD curl -sfk https://localhost/ping || exit 1

ENTRYPOINT [ "/scripts/entrypoint-shared-httpd.sh" ]