ARG BASE_VERSION=15
FROM ghcr.io/daemonless/base-exec:${BASE_VERSION}

ARG FREEBSD_ARCH=amd64
ARG UPSTREAM_URL="https://api.github.com/repos/juanfont/headscale/releases/latest"

LABEL org.opencontainers.image.title="Headscale" \
      org.opencontainers.image.description="An open source, self-hosted implementation of the Tailscale control server." \
      org.opencontainers.image.source="https://github.com/daemonless/headscale" \
      org.opencontainers.image.url="https://headscale.net/" \
      org.opencontainers.image.documentation="https://headscale.net/stable/" \
      org.opencontainers.image.licenses="BSD-3-Clause" \
      org.opencontainers.image.vendor="daemonless" \
      org.opencontainers.image.authors="daemonless" \
      io.daemonless.category="Networking" \
      io.daemonless.port="8080" \
      io.daemonless.volumes="/config" \
      io.daemonless.arch="${FREEBSD_ARCH}" \
      io.daemonless.upstream-url="${UPSTREAM_URL}" \
      io.daemonless.upstream-jq='.tag_name | sub("^v"; "")' \
      io.daemonless.healthcheck-url="http://localhost:8080/health" \
      io.daemonless.pkg-source="binary"

# Download the official FreeBSD release binary and retarget the example config
# (data/keys -> /config, listeners -> 0.0.0.0).
RUN --mount=type=secret,id=github_token \
    TOKEN=$(cat /run/secrets/github_token 2>/dev/null | tr -d '[:space:]' || true) && \
    mkdir -p /app /defaults && \
    HS_TAG=$(fetch -v -o /dev/null "https://github.com/juanfont/headscale/releases/latest" 2>&1 | sed -n 's|^.*redirect to .*/releases/tag/||p' | head -1) && \
    if [ -z "${HS_TAG}" ]; then \
        HS_TAG=$(HTTP_AUTH="${TOKEN:+basic:*:x-access-token:$TOKEN}" fetch -qo - "${UPSTREAM_URL}" | jq -r .tag_name); \
    fi && \
    if [ -z "${HS_TAG}" ] || [ "${HS_TAG}" = "null" ]; then \
        echo "ERROR: could not resolve Headscale version (github_token bytes: $(printf %s "$TOKEN" | wc -c | tr -d ' '))" >&2; exit 1; \
    fi && \
    HS_VER=${HS_TAG#v} && \
    fetch -qo /usr/local/bin/headscale \
      "https://github.com/juanfont/headscale/releases/download/${HS_TAG}/headscale_${HS_VER}_freebsd_${FREEBSD_ARCH}" && \
    chmod 0755 /usr/local/bin/headscale && \
    printf '%s' "${HS_VER}" > /app/version && \
    fetch -qo /defaults/config.yaml \
      "https://raw.githubusercontent.com/juanfont/headscale/${HS_TAG}/config-example.yaml" && \
    sed -i '' \
      -e 's|listen_addr: 127.0.0.1:8080|listen_addr: 0.0.0.0:8080|' \
      -e 's|metrics_listen_addr: 127.0.0.1:9090|metrics_listen_addr: 0.0.0.0:9090|' \
      -e 's|grpc_listen_addr: 127.0.0.1:50443|grpc_listen_addr: 0.0.0.0:50443|' \
      -e 's|/var/lib/headscale/|/config/|g' \
      -e 's|/var/db/headscale/|/config/|g' \
      -e '/controlplane\.tailscale\.com/d' \
      -e '/^derp:/,/^[a-z]/ s|enabled: false|enabled: true|' \
      /defaults/config.yaml

COPY root/ /
RUN chmod +x /daemonless/libexec/headscale /daemonless/init.d/*

CMD ["/daemonless/libexec/headscale"]

RUN chmod +x /healthz

EXPOSE 8080 9090 50443 3478/udp
VOLUME /config