# eLabFTW Cloudron Package
#
# eLabFTW is an open-source electronic lab notebook (ELN) for research
# teams: experiments, inventory, scheduling, timestamps and PDF export,
# backed by MySQL. Packaged as an official-image wrapper around the
# upstream elabimg image (nginx + php-fpm + s6-overlay in one container).
#
# Upstream: https://github.com/elabftw/elabftw
#   - The elabimg build lives in-tree (containers/elabimg/) but compiles
#     nginx, OpenBabel and the whole yarn/composer asset pipeline from
#     source; the published image is the supported distribution channel.
#   - elabimg 5.6.12 with DISABLE_HTTPS=true serves plain HTTP on port
#     443 (Cloudron terminates TLS at the platform proxy).
#   - DB schema: AUTO_DB_INIT / AUTO_DB_UPDATE run `bin/init db:install`
#     / `bin/console db:update` from the image entrypoint; start.sh
#     gates them behind a MySQL wait loop.
#
# Authentication: NO OIDC upstream (v5.6 auth methods: local, SAML, LDAP).
# Verdict per AGENTS.md: native LDAP = acceptable with auth-risk flag.
# The manifest enables the `ldap` addon so CLOUDRON_LDAP_* credentials are
# available; the sysconfig admin wires them into Admin panel -> LDAP (see
# README). SAML is also available for an external IdP.
#
# Pattern: official-image wrapper. Image pinned by tag AND digest (amd64
# manifest digest of the 5.6.12 tag, from the Docker Hub registry API).
FROM elabftw/elabimg:5.6.12@sha256:e91fcc92f0c9a3190ac4f8db7fad03703f1662b33856a53baba9b5a06d71a51d

# start.sh waits for the mysql addon, persists the SECRET_KEY, maps the
# Cloudron env into elabimg's DB_*/SITE_URL/DISABLE_HTTPS variables,
# binds uploads + exports under /app/data and execs the s6 init.
# Made executable on the host, not at build time (Cloudron builds hit
# permission errors on RUN chmod). bash ships with elabimg.
COPY start.sh /app/start.sh

# elabimg HTTP mode (DISABLE_HTTPS=true) listens here; no other listener.
EXPOSE 443

# s6-overlay must run as root: the upstream entrypoint creates the
# unprivileged nginx/php user and drops privileges for the services.
ENTRYPOINT ["/bin/bash", "/app/start.sh"]