# Target machine with Technitium DNS Server pre-installed.
# Based on target-machine; Technitium is installed at image build time so the
# Ansible role finds it already present and skips the download step.

FROM ubuntu:22.04@sha256:b8b6ee6aa931ecd9d0d952abc34dc0e5f7c6a30c6bb71b079fe399fde0329c02

ENV DEBIAN_FRONTEND=noninteractive

# Make apt resilient to flaky upstream (no apt-cacher-ng masking transient errors)
COPY config/apt/99retries.conf /etc/apt/apt.conf.d/99retries.conf

RUN apt-get update && apt-get install -y \
    systemd \
    systemd-sysv \
    openssh-server \
    iproute2 \
    iputils-ping \
    net-tools \
    dnsutils \
    procps \
    python3 \
    python3-apt \
    sqlite3 \
    jq \
    sudo \
    curl \
    ca-certificates \
    && rm -rf /var/lib/apt/lists/*

# Trust the E2E forward proxy CA (for transparent HTTPS interception)
COPY config/proxy/squid-ca.crt /usr/local/share/ca-certificates/e2e-proxy-ca.crt
# Trust Pebble's test CA (so Caddy/ACME clients trust the simulated Let's Encrypt)
COPY config/pebble/pebble-ca.crt /usr/local/share/ca-certificates/pebble-ca.crt
RUN update-ca-certificates

# Node/npm ignore the OS trust store; point them at the bundle that now includes
# the e2e CAs (mirrors Dockerfile.management), in both the image env and
# /etc/environment so Ansible's SSH-invoked npm picks it up via pam_env.
# (openspec/specs/event-driven-hook-subscriptions/spec.md L6.)
ENV NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt
RUN echo 'NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt' >> /etc/environment

RUN mkdir -p /run/sshd && \
    sed -i 's/#PermitRootLogin.*/PermitRootLogin yes/' /etc/ssh/sshd_config && \
    sed -i 's/#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config

# Enable SSH service
RUN systemctl enable ssh

# E2E network setup service (runs at boot to configure routing, DNS, SSH keys)
COPY config/routing/target-setup.sh /usr/local/bin/target-setup.sh
RUN chmod +x /usr/local/bin/target-setup.sh

COPY config/routing/target-setup.service /etc/systemd/system/target-setup.service
RUN systemctl enable target-setup

# Clean up unnecessary systemd services that slow down boot
RUN (cd /lib/systemd/system/sysinit.target.wants/ && \
    ls | grep -v systemd-tmpfiles-setup | xargs rm -f 2>/dev/null); \
    rm -f /lib/systemd/system/multi-user.target.wants/*; \
    rm -f /etc/systemd/system/*.wants/*; \
    rm -f /lib/systemd/system/local-fs.target.wants/*; \
    rm -f /lib/systemd/system/sockets.target.wants/*udev*; \
    rm -f /lib/systemd/system/sockets.target.wants/*initctl*; \
    rm -f /lib/systemd/system/basic.target.wants/*; \
    true

# Re-enable the services we actually need
RUN systemctl enable ssh target-setup

# --- Technitium pre-installation (manual — installer requires running systemd) ---
# The official install.sh checks for systemd at runtime and fails during docker build.
# Instead: install ASP.NET Core runtime, download binaries, write the service file.
# Ansible tasks check for /opt/technitium/dns/DnsServerApp.dll and skip the download.

# ASP.NET Core 8.0 runtime via Microsoft package feed
RUN curl -sSL https://packages.microsoft.com/config/ubuntu/22.04/packages-microsoft-prod.deb \
    -o /tmp/ms-prod.deb && \
    dpkg -i /tmp/ms-prod.deb && \
    rm /tmp/ms-prod.deb && \
    apt-get update && \
    apt-get install -y aspnetcore-runtime-8.0 && \
    rm -rf /var/lib/apt/lists/*

# Download and extract Technitium portable package
RUN mkdir -p /opt/technitium/dns && \
    curl -sSL https://download.technitium.com/dns/DnsServerPortable.tar.gz \
    -o /tmp/technitium.tar.gz && \
    tar -xzf /tmp/technitium.tar.gz -C /opt/technitium/dns && \
    rm -f /tmp/technitium.tar.gz

# Register systemd service (same unit the installer creates)
RUN printf '[Unit]\nDescription=Technitium DNS Server\nAfter=network.target\n\n[Service]\nExecStart=/usr/bin/dotnet /opt/technitium/dns/DnsServerApp.dll\nRestart=on-failure\nRestartSec=10\n\n[Install]\nWantedBy=multi-user.target\n' \
    > /etc/systemd/system/dns.service && \
    systemctl enable dns

# Bake complete apt indexes into the image. target-setup used to run
# `apt-get update` at boot for this, which put a third party's latency inside
# the 60s readiness budget (#560). Doing it here gives Ansible the same
# guarantee — populated lists on first connect — off the readiness path.
RUN apt-get update

STOPSIGNAL SIGRTMIN+3
ENTRYPOINT ["/sbin/init"]