FROM ubuntu:22.04@sha256:b8b6ee6aa931ecd9d0d952abc34dc0e5f7c6a30c6bb71b079fe399fde0329c02

# Make apt resilient to flaky upstream (no apt-cacher-ng masking transient errors)
COPY config/apt/99retries.conf /etc/apt/apt.conf.d/99retries.conf

RUN apt-get update && apt-get install -y \
    openssh-server \
    iptables \
    iproute2 \
    iputils-ping \
    net-tools \
    dnsutils \
    procps \
    python3 \
    wireguard-go \
    && rm -rf /var/lib/apt/lists/*

# `wireguard-tools` is DELIBERATELY not installed here. The wireguard module's
# job includes putting it on the host, and baking it in meant the rig proved the
# tunnel worked on the one kind of host that could never exercise that: the
# module only ever ran `wg --version`, found it, and moved on. On a real firewall
# the deploy failed and told the operator to install wireguard by hand — over the
# access the VPN was being deployed to provide.
#
# `wireguard-go` stays, and is a different kind of thing. A container cannot load
# a kernel module, so wg-quick needs a userspace implementation to fall back to;
# that is the simulator standing in for hardware it does not have, not a step
# celilo is supposed to perform.

# Containers have no wireguard kernel module to load, and a test must not depend
# on whether the Docker host happens to have one. wg-quick falls back to this
# userspace implementation when `ip link add type wireguard` fails, so the tunnel
# behaves the same on any host — it just needs /dev/net/tun + NET_ADMIN.
# NOTE the value: Ubuntu's `wireguard-go` package installs its binary as
# /usr/bin/wireguard, NOT `wireguard-go`. Naming the binary wrong here fails
# only on a host WITHOUT the kernel module — i.e. it passes locally and
# breaks in CI, which is the worst possible way for this to be wrong.
ENV WG_QUICK_USERSPACE_IMPLEMENTATION=wireguard

RUN mkdir -p /run/sshd && \
    sed -i 's/#PermitRootLogin.*/PermitRootLogin yes/' /etc/ssh/sshd_config && \
    sed -i 's/#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config

# Trust the E2E forward proxy CA (for transparent HTTPS interception)
COPY config/proxy/squid-ca.crt /usr/local/share/ca-certificates/e2e-proxy-ca.crt
RUN update-ca-certificates

COPY config/routing/fw-main-routes.sh /startup.sh
RUN chmod +x /startup.sh

CMD ["/startup.sh"]