ARG NODE_IMAGE=node:22-trixie-slim
FROM ${NODE_IMAGE} AS webssh2-builder

ENV DEBIAN_FRONTEND=noninteractive

# renovate: datasource=github-releases depName=billchurch/webssh2
ARG WEBSSH2_VERSION=5.0.1

RUN apt-get update \
    && apt-get install -y --no-install-recommends ca-certificates curl \
    && rm -rf /var/lib/apt/lists/* \
    && mkdir -p /opt/webssh2 \
    && curl -fsSLo "/tmp/webssh2-${WEBSSH2_VERSION}.tar.gz" "https://github.com/billchurch/webssh2/releases/download/webssh2-server-v${WEBSSH2_VERSION}/webssh2-${WEBSSH2_VERSION}.tar.gz" \
    && curl -fsSLo "/tmp/webssh2-${WEBSSH2_VERSION}.tar.gz.sha256" "https://github.com/billchurch/webssh2/releases/download/webssh2-server-v${WEBSSH2_VERSION}/webssh2-${WEBSSH2_VERSION}.tar.gz.sha256" \
    && cd /tmp \
    && sha256sum -c "webssh2-${WEBSSH2_VERSION}.tar.gz.sha256" \
    && tar -xzf "/tmp/webssh2-${WEBSSH2_VERSION}.tar.gz" -C /opt/webssh2 \
    && cd /opt/webssh2 \
    && npm ci --omit=dev \
    && rm -f "/tmp/webssh2-${WEBSSH2_VERSION}.tar.gz" "/tmp/webssh2-${WEBSSH2_VERSION}.tar.gz.sha256" \
    && npm cache clean --force

FROM debian:trixie-slim

# renovate: datasource=github-releases depName=janosmiko/lfk
ARG LFK_VERSION=0.14.15
# renovate: datasource=github-releases depName=kubernetes/kubernetes
ARG KUBECTL_VERSION=1.36.2
# renovate: datasource=github-releases depName=helm/helm
ARG HELM_VERSION=3.21.2
# renovate: datasource=github-releases depName=derailed/k9s
ARG K9S_VERSION=0.51.0
# renovate: datasource=github-releases depName=int128/kubelogin
ARG OIDC_LOGIN_VERSION=1.34.0


ENV DEBIAN_FRONTEND=noninteractive \
    WEB_SSH_PORT=3000 \
    WEBSSH2_LISTEN_PORT=3001 \
    WEBSSH2_SSH_HOST=127.0.0.1 \
    WEBSSH2_SSH_PORT=2222 \
    SSH_PORT=2222 \
    WEBSSH2_HEADER_TEXT=k8s-mgmt-pod \
    WEBSSH2_SSH_HOSTKEY_ENABLED=false

COPY --from=webssh2-builder /usr/local /usr/local
COPY --from=webssh2-builder /opt/webssh2 /opt/webssh2

RUN apt-get update \
    && apt-get install -y --no-install-recommends \
        bash-completion \
        ca-certificates \
        curl \
        unzip \
        tar \
        nginx-light \
        netcat-openbsd \
        openssh-client \
        openssh-server \
        openssl \
        sudo \
        tini \
    && rm -rf /var/lib/apt/lists/* \
    && mkdir -p /var/run/sshd /var/lib/k8s-mgmt-pod /etc/ssh/sshd_config.d \
    && useradd --create-home --shell /bin/bash admin \
    && useradd --create-home --shell /bin/bash user \
    && printf 'admin ALL=(ALL) NOPASSWD:ALL\n' > /etc/sudoers.d/90-admin-nopasswd \
    && chmod 0440 /etc/sudoers.d/90-admin-nopasswd \
    && curl -fsSLo "/tmp/lfk_${LFK_VERSION}_linux_amd64.deb" "https://github.com/janosmiko/lfk/releases/download/v${LFK_VERSION}/lfk_${LFK_VERSION}_linux_amd64.deb" \
    && curl -fsSLo /tmp/lfk.checksums "https://github.com/janosmiko/lfk/releases/download/v${LFK_VERSION}/checksums.txt" \
    && cd /tmp \
    && grep " lfk_${LFK_VERSION}_linux_amd64.deb$" /tmp/lfk.checksums | sha256sum -c - \
    && dpkg -i "/tmp/lfk_${LFK_VERSION}_linux_amd64.deb" \
    && rm -f "/tmp/lfk_${LFK_VERSION}_linux_amd64.deb" /tmp/lfk.checksums \
    && curl -fsSLo /usr/local/bin/kubectl "https://dl.k8s.io/release/v${KUBECTL_VERSION}/bin/linux/amd64/kubectl" \
    && curl -fsSLo /tmp/kubectl.sha256 "https://dl.k8s.io/release/v${KUBECTL_VERSION}/bin/linux/amd64/kubectl.sha256" \
    && echo "$(cat /tmp/kubectl.sha256)  /usr/local/bin/kubectl" | sha256sum -c - \
    && chmod 0755 /usr/local/bin/kubectl \
    && curl -fsSLo "/tmp/helm-v${HELM_VERSION}-linux-amd64.tar.gz" "https://get.helm.sh/helm-v${HELM_VERSION}-linux-amd64.tar.gz" \
    && curl -fsSLo "/tmp/helm-v${HELM_VERSION}-linux-amd64.tar.gz.sha256sum" "https://get.helm.sh/helm-v${HELM_VERSION}-linux-amd64.tar.gz.sha256sum" \
    && echo "$(awk '{print $1}' /tmp/helm-v${HELM_VERSION}-linux-amd64.tar.gz.sha256sum)  /tmp/helm-v${HELM_VERSION}-linux-amd64.tar.gz" | sha256sum -c - \
    && tar -xzf "/tmp/helm-v${HELM_VERSION}-linux-amd64.tar.gz" -C /tmp \
    && install -m 0755 /tmp/linux-amd64/helm /usr/local/bin/helm \
    && curl -fsSLo "/tmp/k9s_Linux_amd64.tar.gz" "https://github.com/derailed/k9s/releases/download/v${K9S_VERSION}/k9s_Linux_amd64.tar.gz" \
    && tar -xzf "/tmp/k9s_Linux_amd64.tar.gz" -C /tmp \
    && install -m 0755 /tmp/k9s /usr/local/bin/k9s \
    && curl -fsSLo "/tmp/kubelogin_linux_amd64.zip" "https://github.com/int128/kubelogin/releases/download/v${OIDC_LOGIN_VERSION}/kubelogin_linux_amd64.zip" \
    && curl -fsSLo "/tmp/kubelogin_linux_amd64.zip.sha256" "https://github.com/int128/kubelogin/releases/download/v${OIDC_LOGIN_VERSION}/kubelogin_linux_amd64.zip.sha256" \
    && sed 's#\*kubelogin_linux_amd64.zip$#*/tmp/kubelogin_linux_amd64.zip#' /tmp/kubelogin_linux_amd64.zip.sha256 | sha256sum -c - \
    && unzip -p /tmp/kubelogin_linux_amd64.zip kubelogin > /usr/local/bin/kubectl-oidc_login \
    && chmod 0755 /usr/local/bin/kubectl-oidc_login \
    && mkdir -p /etc/bash_completion.d \
    && kubectl completion bash > /etc/bash_completion.d/kubectl \
    && helm completion bash > /etc/bash_completion.d/helm \
    && chmod 0644 /etc/bash_completion.d/kubectl /etc/bash_completion.d/helm \
    && rm -f /tmp/kubectl.sha256 \
    && rm -rf /tmp/linux-amd64 \
    && rm -f \
        "/tmp/helm-v${HELM_VERSION}-linux-amd64.tar.gz" \
        "/tmp/helm-v${HELM_VERSION}-linux-amd64.tar.gz.sha256sum" \
        /tmp/k9s \
        /tmp/README.md \
        /tmp/LICENSE \
        /tmp/kubelogin_linux_amd64.zip \
        /tmp/kubelogin_linux_amd64.zip.sha256 \
        /tmp/k9s_Linux_amd64.tar.gz \
    && rm -f /etc/ssh/ssh_host_* \
    && apt-get clean


COPY docker/sshd/10-lfk-base.conf /etc/ssh/sshd_config.d/10-lfk-base.conf
COPY docker/nginx/webssh.conf /etc/nginx/conf.d/webssh.conf
COPY docker/profile/20-k8s-tools-completion.sh /etc/profile.d/20-k8s-tools-completion.sh
COPY docker/motd /etc/motd
COPY entrypoint.sh /usr/local/bin/entrypoint.sh

RUN chmod 0755 /usr/local/bin/entrypoint.sh \
    && chmod 0644 /etc/profile.d/20-k8s-tools-completion.sh

EXPOSE 2222 3000

HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
    CMD nc -z 127.0.0.1 "${SSH_PORT:-2222}" || exit 1

ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/entrypoint.sh"]