# Runtime image for the custom FreeRADIUS build.
# Installs the pre-built .deb packages from the Gitea Debian registry and bakes
# the shared configs. Build context MUST be the repo root:
#   docker build -f packaging/image/Dockerfile -t <ref> .
#
# Version is pinned via PKG_VERSION (CI derives it from /VERSION, e.g. 3.2.8+git).
FROM ubuntu:24.04
WORKDIR /tmp
ARG out_dir=/etc/freeradius
ARG PKG_VERSION=3.2.8+git

# Gitea Debian package registry (override for a different instance/owner).
ARG DEB_REGISTRY=https://git.ahax86.ru/api/packages/pub/debian
ARG DEB_DISTRIBUTION=noble
ARG DEB_COMPONENT=main

COPY packaging/image/local-noble.list /etc/apt/sources.list.d/ubuntu.sources
RUN apt-get update && apt-get install -y apt-transport-https ca-certificates curl gpg

# Register the Gitea Debian registry (public read assumed for owner "pub").
RUN install -d /etc/apt/keyrings && \
    curl -fsSL "${DEB_REGISTRY}/repository.key" -o /etc/apt/keyrings/gitea-pub.asc && \
    echo "deb [signed-by=/etc/apt/keyrings/gitea-pub.asc] ${DEB_REGISTRY} ${DEB_DISTRIBUTION} ${DEB_COMPONENT}" \
      > /etc/apt/sources.list.d/gitea-freeradius.list

RUN apt-get update && apt-get install -y \
      libfreeradius3=${PKG_VERSION} freeradius-common=${PKG_VERSION} \
      freeradius-postgresql=${PKG_VERSION} freeradius-rest=${PKG_VERSION} \
      freeradius-utils=${PKG_VERSION} freeradius=${PKG_VERSION} && \
    apt autoremove --purge -y && apt-get clean && \
    rm -f /etc/apt/sources.list.d/gitea-freeradius.list

# Bake the shared configs (kept under packaging/hosted/config).
COPY packaging/hosted/config /tmp/config
RUN cp /tmp/config/radiusd.conf $out_dir/radiusd.conf && \
    cp /tmp/config/dictionary $out_dir/dictionary && \
    cp /tmp/config/clients.conf $out_dir/clients.conf && \
    cp /tmp/config/mods-enabled/raw $out_dir/mods-enabled/raw && \
    cp /tmp/config/sites-enabled/dynamic-clients $out_dir/sites-enabled/dynamic-clients && \
    rm -f $out_dir/sites-enabled/inner-tunnel && \
    rm -f $out_dir/mods-enabled/eap && \
    rm -f $out_dir/mods-enabled/proxy_rate_limit

# Enable delay_reject.
RUN rm -f $out_dir/mods-enabled/delay && \
    ln -s $out_dir/mods-available/delay $out_dir/mods-enabled/delay

ADD packaging/image/entrypoint.sh /usr/bin/entrypoint.sh
RUN chmod a+x /usr/bin/entrypoint.sh && chmod -R 750 $out_dir && chown -R freerad:root $out_dir && \
    mv /etc/freeradius/certs /tmp && \
    rm -rf /tmp/config

WORKDIR /etc/freeradius
ENTRYPOINT ["/usr/bin/entrypoint.sh"]
CMD ["freeradius", "-f"]