# gateway:v2 - GMSSL Gateway (Nginx 1.26.2 + Tongsuo 8.4.0)
# Builds TongsuoSSL (static) and links Nginx against it to provide SM2/SM3/SM4 GMSSL support.
FROM ubuntu:24.04 AS build

ENV DEBIAN_FRONTEND=noninteractive

RUN apt-get update && apt-get install -y --no-install-recommends \
    build-essential \
    libpcre2-dev \
    zlib1g-dev \
    libcrypt-dev \
    perl \
    ca-certificates \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /build

# ---- TongsuoSSL 8.4.0 ----
COPY 8.4.0.tar.gz /build/
RUN tar -xzf 8.4.0.tar.gz
WORKDIR /build/Tongsuo-8.4.0
RUN ./config --prefix=/opt/tongsuo-8.4.0 --libdir=lib64 no-shared no-zlib no-threads enable-ntls \
    && make -j$(nproc) \
    && make install_sw

# ---- Nginx 1.26.2 (linked against Tongsuo) ----
WORKDIR /build
COPY nginx-1.26.2.tar.gz /build/
COPY no-server-header.patch /build/
RUN tar -xzf nginx-1.26.2.tar.gz \
    && patch -p1 -d nginx-1.26.2 < no-server-header.patch
WORKDIR /build/nginx-1.26.2
RUN ./configure \
      --prefix=/usr/local/nginx \
      --with-http_ssl_module \
      --with-stream \
      --with-stream_ssl_module \
      --with-http_v2_module \
      --with-http_realip_module \
      --with-cc-opt="-I/opt/tongsuo-8.4.0/include" \
      --with-ld-opt="-L/opt/tongsuo-8.4.0/lib64 -lssl -lcrypto -ldl -lpthread" \
    && make -j$(nproc) \
    && make install

# ---- Runtime ----
FROM ubuntu:24.04
ENV DEBIAN_FRONTEND=noninteractive

RUN apt-get update && apt-get install -y --no-install-recommends \
    libpcre2-8-0 \
    zlib1g \
    libcrypt1 \
    ca-certificates \
    curl \
    && rm -rf /var/lib/apt/lists/* \
    && mkdir -p /usr/local/nginx/conf/man/http \
                /usr/local/nginx/conf/man/stream \
                /usr/local/nginx/logs \
                /app

COPY --from=build /usr/local/nginx /usr/local/nginx

# Rename the executable to "gateway"
RUN mv /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/gateway

# Built-in main nginx config (project root nginx.conf)
COPY nginx.conf /usr/local/nginx/conf/nginx.conf

# The config directory is mounted by the test startup script to /usr/local/nginx/conf/man.
# Pre-create a placeholder http include so the server starts when nothing is mounted.
RUN printf '# empty\n' > /usr/local/nginx/conf/man/http/.keep \
    && printf '# empty\n' > /usr/local/nginx/conf/man/stream/.keep

EXPOSE 80 443 8443

CMD ["/usr/local/nginx/sbin/gateway", "-g", "daemon off;"]