FROM ubuntu:22.04@sha256:b8b6ee6aa931ecd9d0d952abc34dc0e5f7c6a30c6bb71b079fe399fde0329c02

RUN apt-get update && apt-get install -y \
    iproute2 \
    iptables \
    iputils-ping \
    net-tools \
    dnsutils \
    procps \
    curl \
    ca-certificates \
    squid-openssl \
    openssl \
    && rm -rf /var/lib/apt/lists/*

# Trust Pebble's test CA (so curl from fw-ext trusts Caddy's ACME cert)
COPY config/pebble/pebble-ca.crt /usr/local/share/ca-certificates/pebble-ca.crt
RUN update-ca-certificates

# Squid CA certificate for SSL bumping. Squid runs as the proxy user;
# owner+mode must let proxy READ the key (cert generation needs it) but
# nobody else.
COPY config/proxy/squid-ca.pem /etc/squid/ssl/squid-ca.pem
RUN chown proxy:proxy /etc/squid/ssl/squid-ca.pem && chmod 600 /etc/squid/ssl/squid-ca.pem

# Initialize Squid SSL cert db and chown it to proxy. Squid's
# security_file_certgen helper needs to UPDATE index.txt as it issues
# on-the-fly leaves for HTTPS-bumped targets; without proxy ownership
# the cert helper silently fails ("Failed to open file
# /var/spool/squid/ssl_db/index.txt") and HTTPS bumps RST the
# connection, surfacing as "Connection refused" from inside targets.
# Confirmed bitten 2026-05-25: forgejo binary download from
# https://codeberg.org/ failed with "Network is unreachable" (IPv6
# fallthrough after IPv4 RST) because Squid was silently dropping the
# IPv4 connection.
RUN /usr/lib/squid/security_file_certgen -c -s /var/spool/squid/ssl_db -M 4MB && \
    chown -R proxy:proxy /var/spool/squid/ssl_db
COPY config/proxy/squid.conf /etc/squid/squid.conf
RUN mkdir -p /var/log/squid && chown proxy:proxy /var/log/squid
RUN squid -z -f /etc/squid/squid.conf 2>/dev/null; sleep 1; kill "$(cat /run/squid.pid 2>/dev/null)" 2>/dev/null; rm -f /run/squid.pid; true

COPY config/routing/fw-ext-routes.sh /startup.sh
RUN chmod +x /startup.sh

CMD ["/startup.sh"]