# ===========================================================================
# OSM taxiway bastion — self-contained OSM export box (broker mode)
# ===========================================================================
# A whitelisted SSH box for an OSM taxiway export pipeline. A client may run ONLY
# the three taxiway commands (allowed-commands.list), validated whole-line and
# exec'd shell-free by bastion-broker — the same broker the base docker-bastion
# image uses.
#
# WHY UBUNTU 22.04 (not the Alpine base image): the export needs `osmium`
# (osmium-tool), which Alpine does not package (only header-only libosmium). And
# GDAL matters: newer ogr2ogr (Debian trixie's GDAL 3.10) SEGFAULTS on the
# OSM→GeoJSON step, while Ubuntu 22.04's GDAL 3.4.1 + osmium 1.14 is exactly the
# known-good toolchain that produced the existing exports. So this flavor is a
# small standalone image that vendors the broker + a broker-only sshd entrypoint.
#
#   taxiways-list          → ls the "<ICAO>-taxiways.geojson" exports present
#   taxiways-export <ICAO> → run export-icao-geojson.sh <ICAO> (osmium/ogr2ogr/jq)
#   taxiways-cat <ICAO>    → base64 the export so it tunnels over ssh cleanly
# ===========================================================================
FROM ubuntu:22.04

RUN apt-get update && apt-get install -y --no-install-recommends \
        openssh-server \
        osmium-tool \
        gdal-bin \
        jq \
        bash \
        coreutils \
        tini \
        ca-certificates \
    && rm -rf /var/lib/apt/lists/* \
    && mkdir -p /run/sshd /etc/bastion \
    && useradd -m -u 1000 -s /bin/sh agent \
    # Unlock the account (useradd leaves the password '!'-locked). Debian's
    # glibc openssh with UsePAM no refuses a locked account even for pubkey;
    # '*' = valid-but-passwordless, so pubkey login works (password auth is
    # off anyway). Alpine's musl build doesn't need this, hence the base image.
    && usermod -p '*' agent

# The broker (allowlist gate, verbatim from docker-bastion/scripts) + the three
# wrappers it may exec + the broker-only entrypoint.
COPY bastion-broker /usr/local/bin/bastion-broker
COPY bin/taxiways-list bin/taxiways-export bin/taxiways-cat /usr/local/bin/
COPY entrypoint /usr/local/bin/entrypoint
RUN chmod 0755 /usr/local/bin/bastion-broker /usr/local/bin/taxiways-list \
        /usr/local/bin/taxiways-export /usr/local/bin/taxiways-cat /usr/local/bin/entrypoint

EXPOSE 22
ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/entrypoint"]