FROM oven/bun:latest@sha256:9114c058aeae42162ee16dd5084b95fe9473970bb6bcb5b232ab1630f0546895

# Caddy (for ACME/TLS termination) + tools needed by entrypoint.sh.
# iproute2 provides `ip` so the entrypoint can rewrite the default route
# through fw-ext (same pattern as Dockerfile.pebble); without it DNS for
# simulated public hostnames fails.
RUN apt-get update && apt-get install -y \
    ca-certificates \
    curl \
    iproute2 \
    debian-keyring \
    debian-archive-keyring \
    apt-transport-https \
    gnupg \
    && curl -fsSL 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' \
       | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg \
    && curl -fsSL 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' \
       > /etc/apt/sources.list.d/caddy-stable.list \
    && apt-get update && apt-get install -y caddy \
    && rm -rf /var/lib/apt/lists/*

# Trust Pebble CA so Caddy's ACME client accepts the directory endpoint
COPY config/pebble/pebble-ca.crt /usr/local/share/ca-certificates/pebble-ca.crt
RUN update-ca-certificates

# Simulator app
COPY simulators/isitup/server.ts /simulator/server.ts

# Caddy config
COPY simulators/isitup/Caddyfile /etc/caddy/Caddyfile

# Entrypoint
COPY simulators/isitup/entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

EXPOSE 80 443
CMD ["/entrypoint.sh"]