# ChirpStack Cloudron Package
#
# ChirpStack is an open-source LoRaWAN network-server: web UI + gRPC/REST
# API on a single port, PostgreSQL for storage, Redis for sessions /
# deduplication / OIDC state, and an external MQTT broker for gateway
# connectivity and integrations (configured per region, not embedded).
#
# Upstream: https://github.com/chirpstack/chirpstack
#   - Official Docker image chirpstack/chirpstack:4.19.1 (alpine, single
#     static musl binary /usr/bin/chirpstack, upstream runs it as
#     nobody:nogroup with ENTRYPOINT /usr/bin/chirpstack)
#   - Takes a config DIRECTORY via `chirpstack --config <dir>`; every *.toml
#     in it is concatenated (tables must not collide across files) and
#     ${ENV_VAR} placeholders are substituted
#   - DB schema migrations (diesel, embedded) run automatically at startup
#     and seed an internal `admin` user
#
# Authentication: NATIVE OIDC (preferred). start.sh regenerates
# /app/data/config/10-cloudron.toml on every start, wiring the Cloudron
# platform OIDC provider (CLOUDRON_OIDC_ISSUER / CLIENT_ID / CLIENT_SECRET)
# into [user_authentication.openid_connect]. CHIRPSTACK_AUTH_MODE=internal
# is kept as an operator escape hatch for admin bootstrap only (see README).
#
# Pattern: official-image wrapper. Building the Rust workspace + pnpm UI
# from source is a multi-GB compile; the upstream image is the supported
# distribution channel. Image pinned by tag AND digest (amd64 manifest
# digest of the 4.19.1 tag, verified via docker manifest inspect).
FROM chirpstack/chirpstack:4.19.1@sha256:c749015e640b8cf33338c08b12922896b17636feb06e421abdd3cc80f1cdc6b9

# bash is the only addition: start.sh uses it for the addon wait loops
# (bash /dev/tcp) and TOML generation. Kept as root only for apk; the
# runtime user stays the upstream nobody:nogroup.
USER root
RUN apk add --no-cache bash

# start.sh waits for the postgresql + redis addons, seeds the persistent
# config fragments under /app/data/config/ and execs chirpstack.
# Made executable on the host, not at build time (Cloudron builds hit
# permission errors on RUN chmod).
COPY start.sh /app/start.sh

WORKDIR /app/data

# Cloudron exposes the web UI / REST / gRPC on this port (api.bind in the
# generated config). No other TCP listener is enabled by default: gateway
# connectivity is outbound MQTT to an external broker.
EXPOSE 8080

USER nobody:nogroup

ENTRYPOINT ["/bin/bash", "/app/start.sh"]