# XAMXAM test server — simulates a FRESH Debian machine with nothing preinstalled.
#
# This image intentionally installs ONLY the bare minimum needed to SSH in and
# run systemd services (nginx/php-fpm are brought up later by the provisioning
# step, so the apt-installs in scripts genuinely mirror a greenfield server).
#
#   Name of image   : debian trixie (ships PHP 8.4 — required by the project).
#   systemd         : enabled so `systemctl start nginx` / php-fpm work.
#   sshd            : a throwaway test keypair is baked in so the `cli` service
#                     can reach us as the `xamxam` SSH alias.
#
# Build:  podman build -t xamxam-test-server ./server

FROM debian:trixie-slim

# Systemd needs the container to run as PID 1 with a cgroup namespace.
ENV container=docker

# 1. Base: systemd, an SSH server, sudo, and proc/ps for systemctl helpers.
RUN apt-get update \
 && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
      systemd \
      systemd-sysv \
      systemd-container \
      openssh-server \
      sudo \
      ca-certificates \
      curl \
      rsync \
      procps \
      iproute2 \
      sed \
      grep \
      coreutils \
 && apt-get clean \
 && rm -rf /var/lib/apt/lists/*

# 2. Prevent systemd from starting extra junk / writing to read-only paths.
RUN rm -f /etc/systemd/system/*.target.wants/* \
 && rm -f /etc/systemd/system/multi-user.target.wants/* \
 && rm -f /etc/systemd/system/getty@.service \
 && rm -rf /lib/systemd/system/sysinit.target.wants \
 && rm -rf /lib/systemd/system/local-fs.target.wants \
 && rm -rf /lib/systemd/system/slices.target.wants \
 && ln -s /lib/systemd/system/systemd-timedated.service /etc/systemd/system/dbus-org.freedesktop.timedate1.service 2>/dev/null || true

# 3. SSH: allow root login for initial provisioning convenience, drop in a
#    throwaway host key + authorized key (regenerated per-run by the entrypoint).
RUN mkdir -p /root/.ssh /run/sshd \
 && touch /root/.ssh/authorized_keys \
 && chmod 700 /root/.ssh \
 && chmod 600 /root/.ssh/authorized_keys \
 && echo 'PermitRootLogin prohibit-password' >> /etc/ssh/sshd_config \
 && echo 'PubkeyAuthentication yes' > /etc/ssh/sshd_config.d/test.conf \
 && echo 'PasswordAuthentication no' >> /etc/ssh/sshd_config.d/test.conf

# The provisioning work expects a non-root deploy user; /root is used only to
# bootstrap, then `scripts/setup-server.sh` creates the real accounts.

EXPOSE 22

# Bootstrap helper: `podman compose run --rm server add-key "<pub>"` and a few
# tiny admin commands. Installed as /usr/local/bin/helper.
COPY scripts/server-helper.sh /usr/local/bin/helper
RUN chmod +x /usr/local/bin/helper

# Boot systemd as PID 1. The entrypoint regenerates the ssh host keys so each
# container start is fresh (and the `cli` hops with StrictHostKeyChecking=no).
ENTRYPOINT ["/lib/systemd/systemd"]