# Real signal-cli, for verifying celilo's client against the actual JSON-RPC
# interface rather than against a simulator that encodes our assumptions.
#
# The account is never linked. That is deliberate and sufficient: signal-cli's
# HTTP interface is served locally and does not touch Signal's network, so the
# endpoint paths, envelope shapes, error shapes, SSE receive stream, and the
# Host/Content-Type guards are all verifiable without an account.
#
# What an unlinked daemon CANNOT verify is that a linked account delivers a
# message to a phone. That needs Signal's real network. DNS is ours in e2e and
# even the TLS trust store is a swappable classpath resource (`whisper.store`,
# password "whisper" — see StagingConfig.java), but CDSI/SVR2 use SGX remote
# attestation whose whole purpose is to make substitution impossible. That
# limit is real; everything short of it is not.
#
# Three facts learned by RUNNING this rather than reading about it:
#   - signal-cli 0.14.6 ships class-file version 69, so it needs a Java 25 JRE.
#     A 21 base dies at startup with UnsupportedClassVersionError.
#   - it needs the native libsignal-client (signal_jni), shipped x86_64 only —
#     as is the "Linux-native" build. Hence the amd64 pin.
#   - extracting the tarball inside the amd64 stage fails under qemu on an
#     arm64 host ("Cannot mkdir: Function not implemented"), so the fetch runs
#     on the builder's own architecture and only the files cross over.

ARG SIGNAL_CLI_VERSION=0.14.6

FROM --platform=$BUILDPLATFORM debian:bookworm-slim@sha256:3783cc01769c7b2b1b83a5c5ad96c815348e28ed7da68e2e3687004faa906251 AS fetch
ARG SIGNAL_CLI_VERSION
RUN apt-get update \
    && apt-get install -y --no-install-recommends curl ca-certificates \
    && rm -rf /var/lib/apt/lists/*
# Fetched at BUILD time — the e2e network is sealed at run time.
RUN curl -fsSL \
      "https://github.com/AsamK/signal-cli/releases/download/v${SIGNAL_CLI_VERSION}/signal-cli-${SIGNAL_CLI_VERSION}.tar.gz" \
      -o /tmp/signal-cli.tar.gz \
    && mkdir -p /out \
    && tar -xzf /tmp/signal-cli.tar.gz -C /out \
    && mv "/out/signal-cli-${SIGNAL_CLI_VERSION}" /out/signal-cli
# The published JSON schemas are the authoritative description of the JSON-RPC
# surface — a test can assert against them rather than against prose.
RUN curl -fsSL \
      "https://github.com/AsamK/signal-cli/releases/download/v${SIGNAL_CLI_VERSION}/signal-cli-${SIGNAL_CLI_VERSION}-json-schemas.tar.gz" \
      -o /tmp/schemas.tar.gz \
    && mkdir -p /out/schemas \
    && tar -xzf /tmp/schemas.tar.gz -C /out/schemas

FROM --platform=linux/amd64 eclipse-temurin:25-jre@sha256:bb036ed6cfdc57e3da7c22634d15f1b840d2caf76183861c80e81ca4b5104abb
COPY --from=fetch /out/signal-cli /opt/signal-cli
COPY --from=fetch /out/schemas /opt/signal-cli-schemas

ENV PATH="/opt/signal-cli/bin:${PATH}"
ENV SIGNAL_CLI_DATA=/var/lib/signal-cli
RUN mkdir -p "${SIGNAL_CLI_DATA}"

EXPOSE 8080

# Bound to 0.0.0.0 so the Host-header pin is skipped for in-network callers
# (HttpServerHandler.isHostAllowed). The container only ever sits on the sealed
# e2e network.
CMD ["signal-cli", "--config", "/var/lib/signal-cli", "daemon", "--http", "0.0.0.0:8080"]