# apt-repo-sim — the e2e mirror of apt.celilo.computer.
#
# Serves the celilo + celilo-bootstrap .debs as a plain (unsigned) apt
# repository. A box does:
#
#   deb [trusted=yes] http://apt.celilo.lab/ stable main
#
# `[trusted=yes]` skips GPG verification — the real apt.celilo.computer is
# reprepro-signed, but the GPG-trust path is orthogonal to what the
# bootstrap-apt test validates (deb install → postinst → celilo-mgmt
# self-deploy as the celilo user via the sudo grant). Keeping the sim
# unsigned avoids shipping a private key into the image.
#
# The .debs are staged into .apt-repo-cache/pool/ by stage-apt-repo.ts at
# `cele2e build-infra` time (versions match apps/celilo/package.json and the
# @celilo/cli tarball in npm-registry-sim). The Packages index + Release are
# generated HERE, at docker-build time, because dpkg-scanpackages /
# apt-ftparchive aren't available on the macOS build host.

FROM debian:trixie-slim@sha256:a99cfc517144bc59b1978475ec53b46ecabec7e43635402ee5b77cc54cd1b20a

RUN apt-get update \
 && apt-get install -y --no-install-recommends dpkg-dev apt-utils python3 \
 && rm -rf /var/lib/apt/lists/*

WORKDIR /repo

# Staged debs (one per arch for celilo, plus the arch-all bootstrap deb).
COPY .apt-repo-cache/pool /repo/pool

# Build a minimal flat-ish repo: one Packages index per architecture (the
# arch-all bootstrap deb is listed in every arch index so it resolves
# regardless of the box's dpkg architecture), plus an apt-ftparchive Release
# carrying the index checksums apt validates even under [trusted=yes].
RUN set -eux; \
    for arch in amd64 arm64; do \
      mkdir -p "dists/stable/main/binary-${arch}"; \
      dpkg-scanpackages --multiversion --arch "${arch}" pool /dev/null \
        > "dists/stable/main/binary-${arch}/Packages"; \
      gzip -9c "dists/stable/main/binary-${arch}/Packages" \
        > "dists/stable/main/binary-${arch}/Packages.gz"; \
    done; \
    apt-ftparchive \
      -o APT::FTPArchive::Release::Origin=celilo \
      -o APT::FTPArchive::Release::Label=celilo \
      -o APT::FTPArchive::Release::Suite=stable \
      -o APT::FTPArchive::Release::Codename=stable \
      -o APT::FTPArchive::Release::Components=main \
      -o APT::FTPArchive::Release::Architectures="amd64 arm64" \
      release dists/stable > dists/stable/Release

# Route the customer's public prefix via the ISP edge, like every other host
# on internet-external. See config/routing/public-sim-entrypoint.sh.
RUN apt-get update \
 && apt-get install -y --no-install-recommends iproute2 \
 && rm -rf /var/lib/apt/lists/*
COPY config/routing/public-sim-entrypoint.sh /usr/local/bin/public-sim-entrypoint.sh

EXPOSE 80

# python3's http.server is enough for apt (GET + range requests over static
# files). No special MIME/headers needed.
ENTRYPOINT ["/bin/sh", "/usr/local/bin/public-sim-entrypoint.sh"]
CMD ["python3", "-m", "http.server", "80", "--directory", "/repo"]