FROM oven/bun:1@sha256:9114c058aeae42162ee16dd5084b95fe9473970bb6bcb5b232ab1630f0546895

WORKDIR /app

# The Docker CLI is the whole point of this image: creating an LXC means
# starting a real container on the host daemon, via the socket mounted at run
# time (D2).
#
# `docker-cli`, NOT `docker.io`: the latter Depends on containerd, runc and
# iptables — a whole daemon this image never runs — while the CLI binary itself
# arrives only as a RECOMMENDS, so `docker.io --no-install-recommends` installs
# the daemon's dependencies and not the one program we need. That failed at the
# worst possible moment: the image built clean, started clean, served the API
# clean, and only when Terraform actually created a container did the provisioner
# die with `Executable not found in $PATH: "docker"`.
RUN apt-get update && apt-get install -y --no-install-recommends \
    docker-cli \
    openssl \
    ca-certificates \
    && rm -rf /var/lib/apt/lists/*

# The fake comes from THIS checkout, bundled next to us at build-infra time
# (src/registry-bundle.ts), not from npm.
#
# Installing `@celilo/terraform-fake` here instead would mean the simulator runs
# whatever npm last published, so a PR that changes the fake would be tested
# against code it does not touch — the "modules run their bundled copy" trap
# (celilo#173) in a new place, and silent. Before the first release it cannot
# work at all: `bun install` resolved `@celilo/terraform-fake@*` against
# registry.npmjs.org and got a 404.
# Placed AS the package name, so the entrypoint's import specifier is the same
# one that resolves against the workspace at typecheck time. A relative path
# into the bundle would work at runtime and drag a dependency-less copy into
# `tsc`, which then cannot resolve msw.
COPY terraform-fake/package.json ./node_modules/@celilo/terraform-fake/package.json
COPY terraform-fake/src ./node_modules/@celilo/terraform-fake/src

# Only the fake's own third-party deps (msw, express, @mswjs/http-middleware),
# which are ordinary public packages.
RUN cd node_modules/@celilo/terraform-fake && bun install --production

# The rig's half: the provisioner and the zone plan it resolves against.
COPY src/proxmox-provisioner.ts ./src/proxmox-provisioner.ts
COPY src/types.ts ./src/types.ts
COPY simulators/proxmox/entrypoint.ts ./simulators/proxmox/entrypoint.ts

# Proxmox is HTTPS-only on 8006 and every consumer skips verification
# (`pm_tls_insecure`), so a self-signed pair generated at build time is exactly
# as good as a real one here and needs no fixture to keep in sync.
RUN mkdir -p /certs && openssl req -x509 -newkey rsa:2048 \
    -keyout /certs/proxmox-sim.key -out /certs/proxmox-sim.crt \
    -days 3650 -nodes -subj "/CN=proxmox.sim" 2>/dev/null

EXPOSE 8006

ENTRYPOINT ["bun", "run", "simulators/proxmox/entrypoint.ts"]