# The signal-cli release host — the sim internet's stand-in for the GitHub
# releases the signal module downloads at deploy time.
#
# Same reason npm-registry-sim and apt-repo-sim exist: a module that fetches an
# artifact from the internet must still be deployable inside a sealed network,
# and the honest way to test that is to SERVE the artifact rather than to skip
# the download. The module points at this host through its `release_base_url`
# config, exactly as caddy points at pebble through the ACME directory URL.
#
# The tarball is fetched at BUILD time on the builder's own architecture (the
# e2e network is sealed at run time, and extracting under qemu on an arm64 host
# fails — see Dockerfile.signal-cli for the full account).

ARG SIGNAL_CLI_VERSION=0.14.6

FROM --platform=$BUILDPLATFORM debian:bookworm-slim@sha256:3783cc01769c7b2b1b83a5c5ad96c815348e28ed7da68e2e3687004faa906251 AS fetch
ARG SIGNAL_CLI_VERSION
RUN apt-get update \
    && apt-get install -y --no-install-recommends curl ca-certificates \
    && rm -rf /var/lib/apt/lists/*
# The portable JVM distribution, NOT the "-Linux-native" build: that one is a
# compiled x86_64 binary and cannot run on aarch64 at all. The JAR plus a JRE
# plus our own libsignal native works on both architectures.
#
# Served at the path BELOW the base URL, not GitHub's full path: the
# production default (`.../AsamK/signal-cli/releases/download`) already carries
# that prefix, so the module appends only `/v<version>/<file>`. Mirroring
# GitHub's full layout here would 404 for exactly that reason.
RUN mkdir -p "/out/v${SIGNAL_CLI_VERSION}" \
    && curl -fsSL \
      "https://github.com/AsamK/signal-cli/releases/download/v${SIGNAL_CLI_VERSION}/signal-cli-${SIGNAL_CLI_VERSION}.tar.gz" \
      -o "/out/v${SIGNAL_CLI_VERSION}/signal-cli-${SIGNAL_CLI_VERSION}.tar.gz"

FROM nginx:alpine@sha256:62ff2089abf5a9ed33bd232895bef5e22f7bb4b200675cec49a5ebc48e3d4ac8
COPY --from=fetch /out /usr/share/nginx/html

# Route the customer's public prefix via the ISP edge, like every other host on
# internet-external. See config/routing/public-sim-entrypoint.sh. (Alpine's
# busybox already provides `ip`, so nothing to install.)
COPY config/routing/public-sim-entrypoint.sh /usr/local/bin/public-sim-entrypoint.sh

EXPOSE 80
ENTRYPOINT ["/bin/sh", "/usr/local/bin/public-sim-entrypoint.sh"]
CMD ["nginx", "-g", "daemon off;"]