FROM redhat/ubi9:9.8@sha256:5426a8f45e80a07168a30ea24d84f266094b3756624a5508cc53927e6ee39e09 AS builder

ENV OS=rhel
ENV NGINX_VERSION=1.30.4

# Copy rocky repo
COPY src/linux/rocky-9.repo /etc/yum.repos.d/rocky.repo
RUN sed -i "s/%ARCH%/$(uname -m)/g" /etc/yum.repos.d/rocky.repo

# Copy RPM-GPG-KEY-Rocky-9
COPY src/linux/RPM-GPG-KEY-Rocky-9 /etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-9

# Import RPM-GPG-KEY-Rocky-9
RUN rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-9

# Install Nginx, fpm and dependencies
RUN dnf install -y wget make yum-utils && \
  dnf install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm && \
  rpm -e --nodeps openssl-fips-provider-so && \
  dnf install -y --skip-broken --setopt=install_weak_deps=False openssl-libs openssl-devel readline-devel python3.11 python3.11-devel python3.11-setuptools brotli brotli-devel gperftools-devel perl libxslt-devel libxml2 yajl libxslt bash gd gd-devel gcc-c++ znc-modtcl gawk libtool pcre2-devel automake autoconf gcc make git zlib-devel libxml2-devel pkgconf libcurl-devel libmaxminddb lmdb-devel ssdeep-devel cargo patch && \
  dnf install -y https://nginx.org/packages/rhel/9/$(uname -m)/RPMS/nginx-${NGINX_VERSION}-1.el9.ngx.$(uname -m).rpm

WORKDIR /tmp/bunkerweb/deps

# Copy dependencies sources folder
COPY src/deps/misc misc
COPY src/deps/src src
COPY src/deps/deps.json deps.json
COPY --chmod=644 src/deps/install.sh install.sh

# Compile and install dependencies
RUN bash install.sh

# Copy dependencies sources folder
COPY src/deps/requirements.txt /tmp/requirements-deps.txt
COPY src/scheduler/requirements.txt /tmp/req/requirements-scheduler.txt
COPY src/ui/requirements.txt /tmp/req/requirements-ui.txt
COPY src/api/requirements.txt /tmp/req/requirements-api.txt
COPY src/common/gen/requirements.txt /tmp/req/requirements-gen.txt
COPY src/common/db/requirements.txt /tmp/req/requirements-db.txt

WORKDIR /usr/share/bunkerweb

# Compile and install dependencies
RUN export MAKEFLAGS="-j$(nproc)" && \
  mkdir -p deps/python && \
  python3.11 -m ensurepip && \
  python3.11 -m pip install --no-cache-dir --require-hashes --ignore-installed -r /tmp/requirements-deps.txt && \
  python3.11 -m pip install --no-cache-dir --require-hashes --force-reinstall --target deps/python $(for file in $(ls /tmp/req/requirements*.txt) ; do echo "-r ${file}" ; done | xargs)

# Apply BunkerWeb patches to vendored Python deps before they are tarballed (DNS alias / CNAME delegation for certbot).
COPY src/deps/misc/certbot-dns-alias.patch /tmp/certbot-dns-alias.patch
RUN patch -p1 -F0 --dry-run -d /usr/share/bunkerweb/deps/python < /tmp/certbot-dns-alias.patch && \
  patch -p1 -F0 --no-backup-if-mismatch -d /usr/share/bunkerweb/deps/python < /tmp/certbot-dns-alias.patch && \
  grep -q '_load_domain_aliases' /usr/share/bunkerweb/deps/python/certbot/plugins/dns_common.py && \
  rm -f /tmp/certbot-dns-alias.patch

RUN dnf install -y pigz && \
  tar --use-compress-program="pigz -1 -p$(nproc)" -cf deps.tar.gz deps && \
  rm -rf deps

# Copy files
# can't exclude deps from . so we are copying everything by hand
COPY src/bw/loading loading
COPY src/bw/lua lua
COPY src/bw/misc misc
COPY src/common/api api
COPY src/common/cli cli
COPY src/common/confs confs
COPY src/common/core core
COPY src/common/db db
COPY src/common/gen gen
COPY src/common/helpers helpers
COPY src/common/settings.json settings.json
COPY src/common/utils utils
COPY src/scheduler scheduler
COPY src/VERSION VERSION
COPY src/ui ui
COPY src/api api

WORKDIR /tmp

COPY src/deps/package.json package.json
COPY src/deps/package-lock.json package-lock.json

ARG NODE_VERSION=24.11.1
ENV PATH="/opt/node/bin:${PATH}"

ARG SKIP_MINIFY=no
ARG SKIP_MINIFY_JS=no
ARG SKIP_MINIFY_CSS=no
ARG SKIP_MINIFY_HTML=no
RUN if [ "$SKIP_MINIFY" != "yes" ] && { [ "$SKIP_MINIFY_JS" != "yes" ] || [ "$SKIP_MINIFY_CSS" != "yes" ] || [ "$SKIP_MINIFY_HTML" != "yes" ]; }; then \
  dnf install -y xz parallel && \
  arch="$(uname -m)" && \
  case "$arch" in \
  x86_64) node_arch="x64" ;; \
  aarch64) node_arch="arm64" ;; \
  *) echo "Unsupported architecture: $arch" >&2; exit 1 ;; \
  esac && \
  wget -qO node.tar.xz "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${node_arch}.tar.xz" && \
  mkdir -p /opt/node && \
  tar -xJf node.tar.xz -C /opt/node --strip-components=1 && \
  rm -f node.tar.xz && \
  cd /tmp && \
  npm ci --ignore-scripts; \
  fi

# Minify JS files
ARG SKIP_MINIFY=no
ARG SKIP_MINIFY_JS=no
RUN if [ "$SKIP_MINIFY" != "yes" ] && [ "$SKIP_MINIFY_JS" != "yes" ]; then \
  find /usr/share/bunkerweb/ui/app/static -type f -name "*.js" ! -name "*.min.js" -print0 \
  | parallel -0 --no-run-if-empty 'npx uglify-js {} --compress --mangle --output {}'; \
  else \
  echo "Skipping JS minification"; \
  fi

# Minify CSS files
ARG SKIP_MINIFY_CSS=no
RUN if [ "$SKIP_MINIFY" != "yes" ] && [ "$SKIP_MINIFY_CSS" != "yes" ]; then \
  find /usr/share/bunkerweb/ui/app/static -type f -name "*.css" ! -name "*.min.css" -print0 \
  | parallel -0 --no-run-if-empty 'npx postcss {} --use cssnano --no-map -o {}'; \
  else \
  echo "Skipping CSS minification"; \
  fi

# Minify HTML files
ARG SKIP_MINIFY_HTML=no
RUN if [ "$SKIP_MINIFY" != "yes" ] && [ "$SKIP_MINIFY_HTML" != "yes" ]; then \
  find /usr/share/bunkerweb/loading /usr/share/bunkerweb/core/antibot/files /usr/share/bunkerweb/core/errors/files /usr/share/bunkerweb/core/misc/files -type f -name "*.html" | \
  parallel 'npx html-minifier-terser \
  --collapse-whitespace \
  --remove-comments \
  --remove-optional-tags \
  --remove-redundant-attributes \
  --remove-script-type-attributes \
  --remove-style-link-type-attributes \
  --minify-css true \
  --minify-js true \
  --output {} {}'; \
  else \
  echo "Skipping HTML minification"; \
  fi

FROM redhat/ubi9:9.8@sha256:5426a8f45e80a07168a30ea24d84f266094b3756624a5508cc53927e6ee39e09

# Set default umask to prevent huge recursive chmod increasing the final image size
RUN umask 027

# Install fpm
RUN dnf install -y wget redhat-rpm-config rpm-build yum-utils gcc make && \
  wget https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm && \
  rpm -Uvh epel-release*rpm && \
  dnf module -y reset ruby && dnf module -y enable ruby:3.1 && dnf module -y install ruby:3.1/common && \
  dnf install -y ruby-devel && \
  gem install fpm && \
  dnf -y --setopt=install_weak_deps=False autoremove && \
  dnf clean all && \
  rm -rf /var/cache/dnf

# Copy dependencies
COPY --from=builder --chown=0:101 /etc/nginx /etc/nginx
COPY --from=builder --chown=0:101 /usr/share/bunkerweb /usr/share/bunkerweb

WORKDIR /usr/share/bunkerweb

# Setup BunkerWeb
RUN install -m 755 helpers/bwcli /usr/bin/bwcli && \
  echo "Linux" > INTEGRATION && \
  mkdir -p /etc/bunkerweb/configs /etc/bunkerweb/plugins /var/cache/bunkerweb /var/tmp/bunkerweb /var/run/bunkerweb /var/log/bunkerweb /var/lib/bunkerweb /var/www/html && \
  for dir in $(echo "plugins pro/plugins configs/http configs/stream configs/server-http configs/server-stream configs/default-server-http configs/modsec configs/modsec-crs configs/crs-plugins-before configs/crs-plugins-after") ; do mkdir -p "/etc/bunkerweb/${dir}" ; done && \
  touch /var/log/bunkerweb/error.log /var/log/bunkerweb/access.log /var/log/bunkerweb/modsec_audit.log

COPY --chmod=660 src/bw/misc/asn.mmdb /var/tmp/bunkerweb/asn.mmdb
COPY --chmod=660 src/bw/misc/country.mmdb /var/tmp/bunkerweb/country.mmdb

# Copy Linux files
COPY --chmod=740 src/linux/scripts scripts
COPY --chmod=740 src/linux/fpm.sh /usr/share/fpm.sh
COPY src/linux/fpm-rhel-9 /usr/share/.fpm
COPY --chmod=644 src/linux/*.service /lib/systemd/system/
COPY --chmod=644 src/linux/bunkerweb.logrotate /etc/logrotate.d/bunkerweb

# Generate RPM at startup
VOLUME /data
WORKDIR /usr/share/
ENTRYPOINT [ "./fpm.sh", "rpm" ]
