# Minimal flat-format APT repository serving one hand-built .deb package over
# TLS, used by tox-docker to exercise the `apt` module integration test
# (tests/configs/Apt.yaml.j2, tests/dockerfiles/Apt.Dockerfile). Its
# InRelease file is genuinely signed with the dedicated key pair
# apt-signing-key.key.asc / apt-signing-key.pub.asc, whose public half is
# what tests/configs/Apt.yaml.j2 embeds as the configured source's
# `signed-by`: the `apt` module dearmors it into a keyring, and APT itself
# verifies the InRelease signature against that keyring on `apt-get update`
# - no `Trusted: yes` bypass involved.
#
# Built by tox-docker, whose build context is this directory (not the repo
# root) - every COPY source below must live under tests/dockerfiles/repos/.
FROM debian:trixie-slim AS packagebuild
RUN apt-get update \
    && apt-get install -y --no-install-recommends dpkg-dev apt-utils gnupg \
    && rm -rf /var/lib/apt/lists/*
RUN set -eux; \
    pkg=idconfiguratortestpkg; \
    root=/build/$pkg; \
    mkdir -p "$root/DEBIAN" "$root/usr/share/doc/$pkg"; \
    printf 'test-only package served by the id-configurator integration tests\n' > "$root/usr/share/doc/$pkg/marker"; \
    printf 'Package: %s\nVersion: 0.0.1\nArchitecture: all\nMaintainer: InterDiode <contact@mail.interdiode.fr>\nDescription: Test-only package served by the id-configurator integration tests\n' "$pkg" > "$root/DEBIAN/control"; \
    dpkg-deb --root-owner-group --build "$root" "/srv/${pkg}_0.0.1_all.deb"
WORKDIR /srv
RUN dpkg-scanpackages --multiversion . > Packages \
    && gzip -9c Packages > Packages.gz
COPY apt-signing-key.key.asc /tmp/apt-signing-key.key.asc
RUN gnupg_home="$(mktemp -d)" \
    && gpg --homedir "$gnupg_home" --batch --import /tmp/apt-signing-key.key.asc \
    && key_id="$(gpg --homedir "$gnupg_home" --list-secret-keys --with-colons | awk -F: '/^sec/{print $5; exit}')" \
    && apt-ftparchive release . > Release \
    && gpg --homedir "$gnupg_home" --batch --yes --pinentry-mode loopback --default-key "$key_id" --clearsign -o InRelease Release \
    && rm -rf "$gnupg_home" /tmp/apt-signing-key.key.asc

FROM nginx:alpine
COPY --from=packagebuild /srv /srv
COPY repo-server.crt.pem /etc/nginx/certs/repo-server.crt.pem
COPY repo-server.key.pem /etc/nginx/certs/repo-server.key.pem
COPY apt-repo.nginx.conf /etc/nginx/conf.d/default.conf
EXPOSE 8443