# SOCKS5 proxy that bridges the host into a per-test simulated network.
#
# Used by NetworkHandle.socksProxy()/browser() so a host browser (manual
# or Playwright-driven) can reach the deployed app exactly as a user
# inside the simulation would. The container needs more than just a
# SOCKS daemon — depending on the vantage it joins, it has to:
#   - replace docker's IPAM-default gateway (which has no listener)
#     with the simulated zone's actual router
#   - bypass docker's embedded DNS resolver and talk to the in-network
#     resolver directly, so DNS responses reflect the simulated
#     internet (split-horizon, namecheap publication, etc.)
# The startup script handles both based on the VANTAGE env var passed
# at `docker run` time.
FROM ubuntu:22.04@sha256:b8b6ee6aa931ecd9d0d952abc34dc0e5f7c6a30c6bb71b079fe399fde0329c02

RUN apt-get update && apt-get install -y \
    dante-server \
    iproute2 \
    iputils-ping \
    dnsutils \
    # curl: the proxy is not only a SOCKS daemon, it is a VANTAGE. Tests reach
    # the deployed app "as a user inside the simulation" by running a client
    # INSIDE this container (SocksProxyHandle.exec is `docker exec <proxy> bash
    # -c ...`, socks-proxy.ts:234), so whatever the test runs has to exist here.
    # Without curl, `proxy.exec("curl ... -w '%{http_code}'")` produced an EMPTY
    # string, and an assertion reading only stdout cannot tell "the server
    # returned nothing" from "I could not run the client". celilo#1426's stage 6
    # failed that way and had never once passed.
    curl \
    # wireguard-tools: the control-plane-vpn vantage. A browser that reaches
    # celilo-web-console (secure-mgmt, VPN-only per D7) must enter as a real
    # VPN peer — the proxy brings up a wg tunnel, it does not attach directly
    # to the zone. Needs /dev/net/tun at `docker run` time (socks-proxy.ts).
    wireguard-tools \
    && rm -rf /var/lib/apt/lists/*

COPY config/socks/danted.conf /etc/danted.conf
COPY config/socks/startup.sh /startup.sh
RUN chmod +x /startup.sh

EXPOSE 1080
CMD ["/startup.sh"]