# Tunnel gateway: a Pangolin machine client plus the Tracecat gateway proxy.
# Executors send tunneled HTTP(S) traffic to the proxy, which only forwards
# to the tunnel's allowlisted targets over the Pangolin tunnel.
FROM python:3.12-slim-bookworm
COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /uvx /usr/local/bin/

ARG TARGETARCH
ARG PANGOLIN_CLI_VERSION=0.18.1
ARG PANGOLIN_CLI_SHA256_AMD64=07ae60ba0da7f3d25da6b78b76f0f2f40069605c2c52340f2f364e3cef72053f
ARG PANGOLIN_CLI_SHA256_ARM64=27a0ce04bb23bff83ed51638902034577ae71f460fe9a01ae0d0de035eb10118

RUN apt-get update \
    && apt-get install -y --no-install-recommends ca-certificates curl iproute2 tini \
    && rm -rf /var/lib/apt/lists/*

RUN set -eux; \
    case "${TARGETARCH}" in \
      amd64) sha="${PANGOLIN_CLI_SHA256_AMD64}" ;; \
      arm64) sha="${PANGOLIN_CLI_SHA256_ARM64}" ;; \
      *) echo "unsupported arch: ${TARGETARCH}" >&2; exit 1 ;; \
    esac; \
    curl -fsSL -o /usr/local/bin/pangolin \
      "https://github.com/fosrl/cli/releases/download/${PANGOLIN_CLI_VERSION}/pangolin-cli_linux_${TARGETARCH}"; \
    echo "${sha}  /usr/local/bin/pangolin" | sha256sum -c -; \
    chmod 0755 /usr/local/bin/pangolin

WORKDIR /app
ENV UV_COMPILE_BYTECODE=1 UV_LINK_MODE=copy

RUN --mount=type=cache,target=/root/.cache/uv \
    --mount=type=bind,source=uv.lock,target=uv.lock \
    --mount=type=bind,source=pyproject.toml,target=pyproject.toml \
    uv sync --frozen --no-install-workspace --no-dev --no-editable

COPY pyproject.toml uv.lock README.md LICENSE /app/
COPY tracecat /app/tracecat
COPY packages /app/packages
RUN --mount=type=cache,target=/root/.cache/uv uv sync --locked --no-dev --no-editable

COPY --chmod=0755 scripts/tunnel-gateway-entrypoint.sh /usr/local/bin/tunnel-gateway-entrypoint

# Pangolin writes its config under $HOME; /tmp is the only writable path.
ENV PATH="/app/.venv/bin:$PATH" HOME=/tmp PYTHONDONTWRITEBYTECODE=1

EXPOSE 8080
ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/tunnel-gateway-entrypoint"]