# An OFF-FLEET web host: a third-party cPanel/SSH shared account that celilo
# publishes to but does NOT govern. It is a PUBLIC PEER on `internet-external`
# alongside namecheap-dns and pebble — NOT behind the customer firewall — so
# public DNS resolving its domain to its own address bends no RFC1918 rule.
#
# Faithful to what we verified against the live A2/CloudLinux account:
#   - sshd on 7822, an unprivileged account (no root, no systemd control)
#   - Apache + mod_rewrite serving the stock WordPress .htaccess, so a real
#     directory under the docroot is served BEFORE the CMS front controller
#   - the domain's TLS certificate pre-installed (as AutoSSL would leave it),
#     not obtained via ACME — external_web never owns TLS
#   - ~/.cpanel/userdata/<domain> carrying the authoritative documentroot
#
# No systemd: sshd + apache are all this host runs, so a two-process entrypoint
# is enough and boots in a fraction of the time.
FROM ubuntu:22.04@sha256:b8b6ee6aa931ecd9d0d952abc34dc0e5f7c6a30c6bb71b079fe399fde0329c02

ENV DEBIAN_FRONTEND=noninteractive

COPY config/apt/99retries.conf /etc/apt/apt.conf.d/99retries.conf

RUN apt-get update && apt-get install -y \
    openssh-server \
    apache2 \
    ca-certificates \
    iproute2 \
    iputils-ping \
    curl \
    && rm -rf /var/lib/apt/lists/*

RUN a2enmod rewrite ssl && a2dissite 000-default

# sshd on 7822 with password auth ON — the bootstrap's whole job is to log in
# with the account password once and install celilo's key, so the account must
# accept a password until that happens (as a real shared host does).
RUN mkdir -p /run/sshd && \
    sed -i 's/^#\?Port .*/Port 7822/' /etc/ssh/sshd_config && \
    sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication yes/' /etc/ssh/sshd_config && \
    sed -i 's/^#\?PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config && \
    sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config

# The account. Unprivileged and NOT in sudo — celilo cannot run a daemon, bind
# a port, or touch the firewall here. That inability is what "off-fleet" means.
RUN useradd -m -s /bin/bash theglo18 && \
    echo 'theglo18:tango-e2e-password' | chpasswd

# The host's own site, in the account's home the way cPanel lays an addon
# domain out, plus the userdata file external_web reads the docroot from.
COPY config/cpanel-host/docroot/ /home/theglo18/tangohost.com/
RUN mkdir -p /home/theglo18/.cpanel/userdata && \
    printf 'documentroot: /home/theglo18/tangohost.com\nservername: tangohost.com\nuser: theglo18\n' \
      > /home/theglo18/.cpanel/userdata/tangohost.com && \
    chown -R theglo18:theglo18 /home/theglo18

# Apache runs as www-data but must read/serve files the account writes.
RUN usermod -aG theglo18 www-data && chmod 755 /home/theglo18

# Pre-installed TLS for the domain (a committed sim CA + leaf, so the cert is
# deterministic). mgmt trusts this CA — see Dockerfile.management.
COPY config/cpanel-host/site-tls.crt config/cpanel-host/site-tls.key /etc/ssl/cpanel-sim/
COPY config/cpanel-host/site.conf /etc/apache2/sites-available/tangohost.conf
RUN a2ensite tangohost && chmod 600 /etc/ssl/cpanel-sim/site-tls.key

EXPOSE 7822 80 443

# apache2 is PID 1; sshd runs beside it. If either dies the container exits,
# which is what we want from a fixture host. The runtime/lock dirs live under
# /var/run, which the container wipes at start, so recreate them before apache
# reads DefaultRuntimeDir.
# Route the customer's public prefix via the ISP edge, like every other host
# on internet-external. See config/routing/public-sim-entrypoint.sh.
COPY config/routing/public-sim-entrypoint.sh /usr/local/bin/public-sim-entrypoint.sh

ENTRYPOINT ["/bin/sh", "/usr/local/bin/public-sim-entrypoint.sh"]
CMD ["/bin/sh", "-c", "mkdir -p /var/run/apache2 /var/lock/apache2 /run/sshd && /usr/sbin/sshd && . /etc/apache2/envvars && exec apache2 -D FOREGROUND"]