# The e2e mirror of AWS S3 (and any S3-compatible backup target).
#
# ⚠️ The service, hostname (`minio.lab`) and this file's name are unchanged, but
# the SERVER IS NO LONGER MinIO. MinIO withdrew public anonymous distribution of
# its container images: Docker Hub delisted `minio/mc` and `minio/minio`
# (celilo#1389), the fix moved them to quay.io, and four days later quay.io
# answered 401 for both the floating tag AND the pinned digest. There was no
# third registry to move to, so this now runs s3proxy, which implements the S3
# API over a filesystem backend and is pullable anonymously. The names are kept
# because renaming the simulator touches the compose generator, simulator-ips,
# the resolver config and every suite that resolves `minio.lab`; that rename is
# worth doing and is not worth coupling to an outage fix.
#
# Celilo's backup storage provider (apps/celilo/src/services/storage-providers/
# s3.ts) talks plain S3 with forcePathStyle + a custom endpoint, so it drives
# this unchanged. This sim is the destination for `celilo backup --storage`
# (push) and the source for `celilo backup pull` (download) in the migration
# restore e2e (P5, openspec/specs/management-server-backup/spec.md).
#
# Placement: internet-external (100.64.0.0/24) like the other public services —
# the management box reaches it OUTBOUND over its internet egress, exactly the
# way it would reach real s3.amazonaws.com. Serves the S3 API on :80 (the same
# proven egress path as apt-repo-sim: traffic to 100.64.0.0/24 on dport 80
# bypasses fw-ext's Squid, so no TLS bump / cert / nonstandard-port filtering).
#
# The `celilo-backups` bucket is pre-created at startup (celilo's S3 provider
# does NOT create buckets — its initialize() only probes with ListObjectsV2).
# Under the filesystem backend a bucket IS a directory, so that is now a plain
# `mkdir` — no S3 round trip, and no client binary to pull. Root creds are the
# well-known minioadmin/minioadmin, kept verbatim because
# e2e/tests/migration-restore.test.ts:40-41 passes them to
# `celilo storage add s3 --access-key-id ... --secret-access-key ...`.

# Static busybox purely for its `ip` applet: the s3proxy image has no iproute2
# and no package manager worth invoking, but it still needs the ISP route
# every host on internet-external carries (see minio-startup.sh).
FROM busybox:stable-musl@sha256:3c6ae8008e2c2eedd141725c30b20d9c36b026eb796688f88205845ef17aa213 AS busybox

FROM andrewgaul/s3proxy@sha256:87662b2a5afcdfa5f478a1c61650bae4c87bbd15f6ff2823236bcfd66ef7fe04

COPY --from=busybox /bin/busybox /usr/local/bin/busybox

COPY config/routing/minio-startup.sh /usr/local/bin/minio-startup.sh

# aws-v2-or-v4 because celilo's SDK signs v4 while older tooling may sign v2;
# accepting both costs nothing and the alternative is a signature-version
# mismatch that surfaces as an opaque 403.
ENV S3PROXY_AUTHORIZATION=aws-v2-or-v4 \
    S3PROXY_IDENTITY=minioadmin \
    S3PROXY_CREDENTIAL=minioadmin \
    S3PROXY_ENDPOINT=http://0.0.0.0:80 \
    JCLOUDS_PROVIDER=filesystem \
    JCLOUDS_FILESYSTEM_BASEDIR=/data \
    MINIO_BUCKET=celilo-backups

EXPOSE 80

# dumb-init stays the entrypoint so signals reach the server; the startup script
# takes CMD and execs s3proxy's own launcher at the end.
ENTRYPOINT ["/usr/bin/dumb-init", "--"]
CMD ["/bin/sh", "/usr/local/bin/minio-startup.sh"]