FROM debian:bookworm-slim@sha256:3783cc01769c7b2b1b83a5c5ad96c815348e28ed7da68e2e3687004faa906251

# Caddy + tools needed by entrypoint.sh. iproute2 provides `ip` so the
# entrypoint can rewrite the default route through fw-ext (same pattern
# as Dockerfile.isitup); without it DNS for acme-v02.api.letsencrypt.org
# fails and Caddy never gets a cert.
RUN apt-get update && apt-get install -y \
    ca-certificates \
    curl \
    iproute2 \
    debian-keyring \
    debian-archive-keyring \
    apt-transport-https \
    gnupg \
    && curl -fsSL 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' \
       | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg \
    && curl -fsSL 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' \
       > /etc/apt/sources.list.d/caddy-stable.list \
    && apt-get update && apt-get install -y caddy \
    && rm -rf /var/lib/apt/lists/*

# Trust Pebble CA so Caddy's ACME client accepts the directory endpoint.
COPY config/pebble/pebble-ca.crt /usr/local/share/ca-certificates/pebble-ca.crt
RUN update-ca-certificates

# Static site contents — staged by `e2e-build` from
# `modules/celilo-website/site/dist/`. Includes install.sh, the docs, etc.
COPY .celilo-website-cache /usr/share/caddy/site

COPY simulators/celilo-website/Caddyfile /etc/caddy/Caddyfile
COPY simulators/celilo-website/entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

EXPOSE 80 443
CMD ["/entrypoint.sh"]