# Minimal Alpine (apk) repository with a signed index, serving one hand-built
# .apk package over TLS, using the same Test CA as the pypi-repo/apt-repo/
# yum-repo fixtures, used by tox-docker to exercise the `apk` module
# integration test (tests/configs/Apk.yaml.j2,
# tests/dockerfiles/Apk.Dockerfile). The package is signed with the static
# key pair 040d0af5f97a0a44.rsa / 040d0af5f97a0a44.rsa.pub, whose public
# half is what the `apk` module configuration is expected to install into
# /etc/apk/keys.
#
# The key's filename matters, not just its content: apk embeds the public
# key's *filename* (not just a verifiable signature) into the index it
# signs, and only accepts it if a key file with that exact name is present
# in /etc/apk/keys - trying other installed keys does not help. The name
# 040d0af5f97a0a44 is the id_configurator.modules.apk._key_filename() hash
# of this specific public key's content (see tests/configs/Apk.yaml.tmpl),
# i.e. the name the `apk` module will actually use when it installs this key
# from the configuration. Regenerating the key pair requires recomputing
# that hash and renaming both files (and updating this comment) to match.
#
# Built by tox-docker, whose build context is this directory (not the repo
# root) - every COPY source below must live under tests/dockerfiles/repos/.
FROM alpine:3.20 AS packagebuild
RUN apk add --no-cache abuild build-base
RUN adduser -D builder && addgroup builder abuild
COPY 040d0af5f97a0a44.rsa 040d0af5f97a0a44.rsa.pub /home/builder/.abuild/
COPY 040d0af5f97a0a44.rsa.pub /etc/apk/keys/040d0af5f97a0a44.rsa.pub
RUN printf 'PACKAGER_PRIVKEY="/home/builder/.abuild/040d0af5f97a0a44.rsa"\n' > /home/builder/.abuild/abuild.conf \
    && chown -R builder:builder /home/builder
COPY --chown=builder:builder APKBUILD /home/builder/pkg/APKBUILD
RUN su builder -c 'cd /home/builder/pkg && abuild checksum && abuild -r'
# apk always appends the *client's* architecture to the repository URL, so
# the built index/package land in a directory named after whatever
# architecture this image was actually built for (native to the Docker host
# unless emulated). A flat copy of the index at the repo root lets the
# healthcheck probe it without knowing that architecture name in advance.
RUN arch_dir=$(ls /home/builder/packages/builder) \
    && mkdir -p /srv \
    && cp -r "/home/builder/packages/builder/$arch_dir" "/srv/$arch_dir" \
    && cp "/home/builder/packages/builder/$arch_dir/APKINDEX.tar.gz" /srv/APKINDEX.tar.gz

FROM nginx:alpine
COPY --from=packagebuild /srv /srv
COPY repo-server.crt.pem /etc/nginx/certs/repo-server.crt.pem
COPY repo-server.key.pem /etc/nginx/certs/repo-server.key.pem
COPY apk-repo.nginx.conf /etc/nginx/conf.d/default.conf
EXPOSE 8443