FROM debian:trixie-slim AS target
FROM interdiode/id-configurator:latest AS configuration
ARG CONFIG_REPO_PORT
ARG CONFIG_URL_CACERT_CONTENT
COPY --from=target / /src/
RUN id-configurator apply \
    --config-url "https://host.docker.internal:${CONFIG_REPO_PORT}/config.yaml" \
    --config-url-cacert-content "$CONFIG_URL_CACERT_CONTENT" \
    --src /src --dst /dst
FROM target AS runtime
ARG CONFIG_REPO_PORT
RUN apt-get update && apt-get install -y --no-install-recommends curl
COPY --from=configuration /dst/ /
# Proves the root CA the downloaded configuration installed is actually
# trusted system-wide: no --insecure/--no-check-certificate here, unlike the
# --config-url-cacert-content fetch above (which trusts only that one CA to
# validate the download itself, before anything has been installed yet).
RUN curl -fsS "https://host.docker.internal:${CONFIG_REPO_PORT}/config.yaml" \
    | grep -q 'organisation: InterDiode'