# syntax=docker/dockerfile:1
#
# aptly-server — aptly built from source, cross-compiled, plus the tools its
# own entrypoint/reconcile scripts need (jq, yq, envsubst, gpg). Doubles as
# the CLI/debug image: `docker run --rm aptly-server aptly version`.
#
# Built from source rather than the upstream .deb or release zip because:
#   - the aptly release assets ship no checksums file, so a zip download can
#     only ever be "trust the network", never "verify the bytes";
#   - cross-compiling is native on an arm64 build host (the expensive part
#     needs no QEMU — only the tiny runtime stage below does), which matters
#     because there is no amd64 runner in this project's CI;
#   - it removes any dependency on repo.aptly.info having published a build
#     for this exact Debian release/arch combination in time for a rebuild.
#
# renovate: datasource=github-releases depName=aptly-dev/aptly
ARG APTLY_VERSION=1.6.3
ARG GO_IMAGE=golang:1.25-trixie
ARG RUNTIME_IMAGE=debian:trixie-slim

# renovate: datasource=github-releases depName=mikefarah/yq
ARG YQ_VERSION=4.53.3
ARG YQ_SHA256_AMD64=fa52a4e758c63d38299163fbdd1edfb4c4963247918bf9c1c5d31d84789eded4
ARG YQ_SHA256_ARM64=578648e463a11c1b6db6010cbf41eafed6bee79466fcffa1bb446672cf7945ea

FROM --platform=$BUILDPLATFORM ${GO_IMAGE} AS build
ARG APTLY_VERSION
ARG TARGETARCH
WORKDIR /src
RUN --mount=type=cache,target=/root/.cache/go-build \
    --mount=type=cache,target=/go/pkg/mod \
    git clone --depth 1 --branch "v${APTLY_VERSION}" https://github.com/aptly-dev/aptly . \
 && printf '%s' "${APTLY_VERSION}" > VERSION \
 && CGO_ENABLED=0 GOOS=linux GOARCH="${TARGETARCH}" \
    go build -trimpath -ldflags="-s -w" -o /out/aptly .

FROM --platform=$BUILDPLATFORM ${GO_IMAGE} AS build-tools
# Runs once for BUILDPLATFORM, not per target arch — cheap even on an
# emulated runtime stage below, since we just copy the right binary in.
ARG YQ_VERSION
ARG YQ_SHA256_AMD64
ARG YQ_SHA256_ARM64
WORKDIR /out
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
RUN set -eux; \
    curl -fsSL -o yq_linux_amd64 "https://github.com/mikefarah/yq/releases/download/v${YQ_VERSION}/yq_linux_amd64"; \
    curl -fsSL -o yq_linux_arm64 "https://github.com/mikefarah/yq/releases/download/v${YQ_VERSION}/yq_linux_arm64"; \
    echo "${YQ_SHA256_AMD64}  yq_linux_amd64" | sha256sum -c -; \
    echo "${YQ_SHA256_ARM64}  yq_linux_arm64" | sha256sum -c -; \
    chmod +x yq_linux_amd64 yq_linux_arm64

FROM ${RUNTIME_IMAGE}
ARG TARGETARCH
ARG APTLY_VERSION
ARG APTLY_REVISION=1

LABEL org.opencontainers.image.title="aptly-server" \
      org.opencontainers.image.description="aptly (Debian repository management tool), containerized: REST API + non-root runtime" \
      org.opencontainers.image.source="https://git.morlana.online/f.weber/aptly-containerized" \
      org.opencontainers.image.licenses="MIT" \
      org.opencontainers.image.version="${APTLY_VERSION}-${APTLY_REVISION}"

# hadolint ignore=DL3008
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt,sharing=locked \
    apt-get update && apt-get install -y --no-install-recommends \
      ca-certificates gnupg bzip2 xz-utils curl jq gettext-base openssl \
    && rm -rf /var/lib/apt/lists/* \
    && addgroup --system --gid 10001 aptly \
    && adduser --system --uid 10001 --ingroup aptly --home /var/lib/aptly --disabled-password aptly \
    && mkdir -p /var/lib/aptly/public /run/aptly /etc/aptly-src \
    && chown -R aptly:aptly /var/lib/aptly /run/aptly

COPY --from=build /out/aptly /usr/local/bin/aptly
COPY --from=build-tools /out/yq_linux_${TARGETARCH} /usr/local/bin/yq
COPY rootfs/ /

ENV APTLY_ROOT_DIR=/var/lib/aptly \
    APTLY_RUN_DIR=/run/aptly \
    APTLY_CONFIG=/run/aptly/aptly.yaml \
    APTLY_CONFIG_SRC=/etc/aptly-src/aptly.yaml \
    APTLY_CONFIG_DST=/run/aptly/aptly.yaml \
    APTLY_API_LISTEN=127.0.0.1:8080

USER 10001:10001
WORKDIR /var/lib/aptly

HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
  CMD ["curl", "-fsS", "http://127.0.0.1:8080/api/healthy"]

ENTRYPOINT ["/usr/local/bin/aptly-entrypoint"]