# syntax=docker/dockerfile:1

#############################################
# Stage 1: Extract files from .deb packages
#############################################
FROM debian:13-slim AS extractor

ARG TARGETARCH

RUN apt-get update && apt-get install -y --no-install-recommends \
    dpkg \
    && rm -rf /var/lib/apt/lists/*

# Extract .deb packages (mounted via --mount during build)
# Engine installs all except broker-cbd (line 90 of original Dockerfile)
RUN --mount=type=bind,source=packages-centreon,target=/packages \
    mkdir -p /extracted && \
    cd /packages/${TARGETARCH} && \
    for deb in centreon*.deb; do \
        # Skip broker-cbd package (not needed for engine)
        if [[ "$deb" == *"broker-cbd"* ]]; then \
            echo "Skipping $deb (not needed for engine)"; \
            continue; \
        fi; \
        echo "Extracting $deb..."; \
        dpkg-deb -x "$deb" /extracted/; \
    done && \
    echo "=== Extracted binaries ===" && \
    ls -lah /extracted/usr/sbin/ || true && \
    echo "=== Extracted libraries ===" && \
    ls -lah /extracted/usr/lib*/ || true && \
    echo "=== Extracted engine modules ===" && \
    ls -lah /extracted/usr/lib*/centreon-engine/ || true && \
    echo "=== Extracted broker module ===" && \
    ls -lah /extracted/usr/lib*/cbmod.so || true && \
    echo "=== Extracted configs ===" && \
    ls -lah /extracted/etc/centreon-engine/ || true && \
    ls -lah /extracted/etc/centreon-broker/ || true

#############################################
# Stage 2: Runtime - Minimal final image
#############################################
FROM debian:13-slim

ARG VERSION
ARG IS_CLOUD
ARG STABILITY

ENV DEBIAN_FRONTEND=noninteractive \
    GORGONE_UID= \
    NAME= \
    GORGONE_TOKEN= \
    CENTRAL_HOST= \
    APP_SECRET= \
    SALT= \
    SMTP_HOST= \
    SMTP_PORT=25 \
    SMTP_FROM=centreon-engine@localhost \
    SMTP_TLS=off \
    MSMTPRC=/var/lib/centreon-engine/.msmtprc

# Create users and groups (must match current setup for compatibility)
RUN bash -e <<EOF
groupadd -g 33 www-data 2>/dev/null || true
groupadd -g 900 centreon
useradd -u 900 -g centreon -m -r -d /var/spool/centreon -c "Centreon" -s /bin/bash centreon
groupadd -g 901 centreon-engine
useradd -u 901 -g centreon-engine -m -r -d /var/lib/centreon-engine -c "Centreon Engine" -s /bin/bash centreon-engine
groupadd -g 902 centreon-broker
useradd -u 902 -g centreon-broker -m -r -d /var/lib/centreon-broker -c "Centreon Broker" -s /bin/bash centreon-broker
groupadd -g 903 centreon-gorgone
useradd -u 903 -g centreon-gorgone -m -r -d /var/lib/centreon-gorgone -c "Centreon Gorgone" -s /bin/bash centreon-gorgone
usermod -aG centreon-broker centreon-engine
usermod -aG centreon-engine centreon-broker
usermod -aG centreon-gorgone centreon-engine
usermod -aG centreon centreon-engine
usermod -aG www-data centreon-engine
usermod -aG sudo centreon-engine
EOF

# Configure APT for optimal container usage
COPY <<EOF /etc/apt/apt.conf.d/99custom
Acquire::Retries "10";
Acquire::https::Timeout "300";
Acquire::http::Timeout "300";
APT::Install-Recommends "false";
APT::Install-Suggests "false";
EOF

RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt/lists,sharing=locked \
    bash -e <<EOF
apt-get update
apt-get install -y --no-install-recommends gnupg wget ca-certificates
wget -O- https://apt-key.centreon.com | gpg --dearmor \
    | tee /etc/apt/trusted.gpg.d/centreon.gpg > /dev/null 2>&1
echo "deb [arch=amd64,arm64] https://packages.centreon.com/apt-plugins-stable/ trixie main" \
    > /etc/apt/sources.list.d/centreon-plugins.list
EOF

# apt-plugins-stable now publishes arm64 .deb packages for libnet-curl-perl,
# libcrypt-openssl-aes-perl and libssh-session-perl, so the CPAN compilation
# fallback (and the build-essential/dev headers it required) is no longer needed.
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt/lists,sharing=locked \
    bash -e <<'EOF'
apt-get update
apt-get install -y --no-install-recommends \
    libnet-curl-perl \
    libcrypt-openssl-aes-perl \
    libssh-session-perl \
    python3 \
    libmariadb3 \
    libgnutls30t64 \
    libssl3 \
    zlib1g \
    monitoring-plugins-basic \
    libzmq-constants-perl \
    libcap2-bin \
    inotify-tools \
    sudo \
    ca-certificates \
    wget \
    gnupg \
    mailutils \
    msmtp \
    msmtp-mta \
    centreon-plugin-applications-monitoring-centreon-poller \
    centreon-plugin-notification-email
setcap cap_net_raw+ep /usr/lib/nagios/plugins/check_icmp
apt-get remove -y --purge libcap2-bin
apt-get autoremove -y
rm -rf /tmp/* /var/tmp/* /usr/share/doc/* /usr/share/man/*
EOF

# Create directory structure
RUN bash -e <<EOF
mkdir -p /etc/centreon-engine \
         /etc/centreon-engine/conf.d \
         /etc/centreon-broker \
         /var/lib/centreon-engine \
         /var/lib/centreon-engine/rw \
         /var/log/centreon-engine \
         /var/log/centreon-engine/archives \
         /var/lib/centreon/centplugins \
         /usr/share/centreon/lib/centreon-broker \
         /usr/lib64/centreon-engine \
         /usr/lib/nagios/plugins \
         /usr/lib/nagios/plugins/custom \
         /usr/lib64/nagios
ln -s /usr/lib/nagios/plugins /usr/lib64/nagios/plugins
chown -R centreon-engine:centreon-engine \
         /etc/centreon-engine \
         /var/lib/centreon-engine \
         /var/log/centreon-engine \
         /var/lib/centreon/centplugins \
         /usr/lib/nagios/plugins/custom
chown -R centreon-broker:centreon-broker \
          /etc/centreon-broker
chmod 775 /etc/centreon-engine \
          /etc/centreon-broker \
          /etc/centreon-engine/conf.d \
          /var/lib/centreon-engine \
          /var/lib/centreon-engine/rw
chmod 755 /var/log/centreon-engine \
          /var/log/centreon-engine/archives \
          /usr/share/centreon/lib/centreon-broker
chmod 0755 /var/spool/centreon
chmod 0755 /var/lib/centreon-broker
chmod 0755 /var/lib/centreon-gorgone
EOF

COPY --chown=centreon-engine:centreon-engine <<EOF /etc/centreon-engine/engine-context.json
{"app_secret":"","salt":""}
EOF

# Copy ONLY runtime files from extractor

# Binaries
COPY --from=extractor --link --chmod=755 /extracted/usr/sbin/centengine /usr/sbin/centengine

# Core library
COPY --from=extractor --link --chmod=755 /extracted/usr/lib*/libcentreon_clib.so /usr/lib/libcentreon_clib.so

# Protobuf shared libraries (centreon-protobuf-lib package)
COPY --from=extractor --link --chmod=755 /extracted/usr/lib*/libcentreon_engine_conf.so /usr/lib/libcentreon_engine_conf.so
COPY --from=extractor --link --chmod=755 /extracted/usr/lib*/libcentreon_pb_bbdo.so /usr/lib/libcentreon_pb_bbdo.so

# Broker module (cbmod.so) - engine loads this
COPY --from=extractor --link --chmod=755 /extracted/usr/lib*/cbmod.so /usr/lib/cbmod.so

# Broker modules (cbmod.so needs these!)
COPY --from=extractor --link --chmod=755 /extracted/usr/share/centreon/lib/centreon-broker/*.so /usr/share/centreon/lib/centreon-broker/

# Engine modules (directory already created above)
COPY --from=extractor --link --chmod=755 /extracted/usr/lib64/centreon-engine/*.so /usr/lib64/centreon-engine/

# Connector binaries
COPY --from=extractor --link --chmod=755 /extracted/usr/lib64/centreon-connector/ /usr/lib64/centreon-connector/

# Configuration files (--chown prevents --link)
COPY --from=extractor --chown=centreon-engine:centreon-engine --chmod=664 \
     /extracted/etc/centreon-engine/ /etc/centreon-engine/

# Copy entrypoint and sudoers (from source repo, not from .deb packages)
COPY --chmod=755 --chown=centreon-engine:centreon-engine \
     ./.github/docker/centreon-engine/trixie/entrypoint /var/lib/centreon-engine

COPY --chmod=600 ./.github/docker/centreon-engine/sudoersCentreon /etc/sudoers.d/centreon

# Verify all critical files exist
RUN echo "=== Verification ===" && \
    ls -lah /usr/sbin/centengine && \
    ls -lah /usr/lib/libcentreon_clib.so && \
    ls -lah /usr/lib/libcentreon_engine_conf.so && \
    ls -lah /usr/lib/libcentreon_pb_bbdo.so && \
    ls -lah /usr/lib/cbmod.so && \
    ls -lah /usr/lib64/centreon-engine/*.so && \
    ls -lah /usr/lib64/centreon-connector/ && \
    ls -lah /etc/centreon-engine/*.cfg && \
    echo "=== Files verified ===" && \
    echo "Note: Binary version check skipped during build (will work at runtime)"

# gRPC engine management API (inter-container, no host mapping needed)
EXPOSE 50155

WORKDIR /var/lib/centreon-engine

USER centreon-engine

# /tmp/docker.ready is touched by 99-logs.sh once every container.d/*.sh
# entrypoint script has run, right before centengine itself is exec'd.
HEALTHCHECK --interval=10s --timeout=5s --start-period=30s --retries=3 \
    CMD test -f /tmp/docker.ready

ENTRYPOINT ["/var/lib/centreon-engine/container.sh"]

CMD ["/usr/sbin/centengine", "/etc/centreon-engine/centengine.cfg"]
