# Compile cgit
FROM alpine:3.23.3 AS build

RUN set -x \
 && apk add --no-cache gcc g++ cmake make curl linux-headers musl-dev zlib-dev \
   libressl-dev libintl musl-libintl

# Compile cgit
RUN set -x \
 && wget 'https://git.zx2c4.com/cgit/snapshot/cgit-1.3.tar.xz' \
 && tar -xvf cgit-1.3.tar.xz \
 && make -C /cgit-1.3 get-git \
 && DESTDIR=/pkg NO_REGEX=NeedsStartEnd make -C /cgit-1.3 install

# Compile cmark-gfm
RUN set -x \
  && wget https://github.com/github/cmark-gfm/archive/refs/tags/0.29.0.gfm.13.tar.gz \
  && tar -xvf 0.29.0.gfm.13.tar.gz \
  && cmake -S /cmark-gfm-0.29.0.gfm.13 -B /cmark-gfm-0.29.0.gfm.13/build \
    -DCMAKE_POLICY_VERSION_MINIMUM=4.0 -DCMAKE_INSTALL_PREFIX=pkg \
  && cmake --build /cmark-gfm-0.29.0.gfm.13/build \
  && cmake --install /cmark-gfm-0.29.0.gfm.13/build

RUN set -x \
  && tar -czvf deps.tar.gz -C pkg .

# Configure nginx & cgit + fcgiwrap
FROM alpine:3.23.3
COPY --from=build /deps.tar.gz /deps.tar.gz

ARG DOMAIN=localhost

RUN set -x \
 && apk add --no-cache \
   curl cmark fail2ban fcgiwrap gcc gitolite libintl libressl-dev linux-headers \
   make musl-dev musl-libintl nginx openrc openssh py3-pygments zlib-dev \
 && tar -xvf /deps.tar.gz

RUN apk update \
 && apk upgrade --no-cache \
 && sed -i '/getty/d' /etc/inittab

COPY cgit/40-fcgiwrap.sh /docker-entrypoint.d/
RUN chmod +x /docker-entrypoint.d/40-fcgiwrap.sh

COPY cgit/nginx.conf /
RUN sed "s/\$DOMAIN/$DOMAIN/g" /nginx.conf > /etc/nginx/http.d/default.conf \
  && rm /nginx.conf

RUN addgroup nginx www-data

COPY cgit/about.html  /var/www/htdocs/cgit/
COPY cgit/cgit.png    /var/www/htdocs/cgit/logo.png
COPY cgit/favicon.ico /var/www/htdocs/cgit/

COPY cgit/css_variable_colors.sh /
COPY cgit/update_syntax_style.py /
COPY cgit/everforest.css /var/www/htdocs/cgit/
RUN sh css_variable_colors.sh \
 && python update_syntax_style.py zenburn > /var/www/htdocs/cgit/syntax.css \
 && sed -i -Ee '/^sys\.stdout\.write.*style.*/d' /usr/local/lib/cgit/filters/syntax-highlighting.py

COPY cgit/about-formatting.sh /usr/local/lib/cgit/filters/about-formatting.sh
RUN chmod 755 /usr/local/lib/cgit/filters/about-formatting.sh

# Lastly copy cgitrc, better to have it later so we don't invalidate the whole
# build cache when iterating...
COPY cgit/cgitrc /etc/

# Volume used to store SSH host keys, generated on first run
VOLUME /etc/ssh/keys

RUN rc-update add fail2ban \
 && rc-update add fcgiwrap \
 && rc-update add nginx \
 && rc-update add sshd

# www-data may not be necessary
RUN addgroup fcgiwrap git \
 && git config --system advice.defaultBranchName false

# Volume used to store all Gitolite data (keys, config and repositories), initialized on first run
VOLUME /var/lib/git
RUN chmod 750 /var/lib/git

# Disable unwanted authentications and Disable sftp subsystem
RUN perl -i -pe 's/^#?((?!Kerberos|GSSAPI|Password)\w*Authentication)\s.*/\1 no/;s/^(PubkeyAuthentication) no/\1 yes/' /etc/ssh/sshd_config \
 && perl -i -pe 's/^#?(PermitRootLogin)\s.*/\1 no/' /etc/ssh/sshd_config \
 && perl -i -pe 's/^(Subsystem\ssftp\s)/#\1/' /etc/ssh/sshd_config


# Permissions are fixed in docker-entrypoint.sh
RUN mkdir -p /var/lib/git/local/hooks/common
COPY post-receive /var/lib/git/local/hooks/common/
RUN chmod +x /var/lib/git/local/hooks/common/post-receive

# Configure nginx & cgit + fcgiwrap
#RUN addgroup -g 101 -S nginx \
# && adduser -S -D -H -u 101 -h /var/cache/nginx -s /sbin/nologin -G nginx -g nginx nginx

# Entrypoint responsible for SSH host keys generation, and Gitolite data initialization
COPY docker-entrypoint.sh /
RUN chmod +x /docker-entrypoint.sh
ENTRYPOINT ["/docker-entrypoint.sh"]

# Expose port 22 to access SSH
EXPOSE 22

# Default command is to run the SSH server
#CMD ["sshd"]
#CMD ["/sbin/init"]
CMD ["/sbin/init"]