# Rathole Cloudron Package
#
# Rathole is a secure, stable and high-performance reverse proxy for NAT
# traversal (frp/ngrok class, written in Rust). This package runs the
# SERVER side: the Cloudron box is the public-IP endpoint, rathole clients
# behind NAT dial the control port (2333) and expose their local services
# through token-authenticated tunnels on the 5200+ port range.
#
# Upstream: https://github.com/rathole-org/rathole (v0.5.0)
#   - Ships a prebuilt x86_64-unknown-linux-gnu release binary (musl
#     release builds were dropped upstream in v0.5.0)
#   - No database, no user accounts; per-service tokens are mandatory
#
# Authentication: Rathole has NO user concept (tunnels are authorized by
# per-service tokens, optionally Noise/TLS encrypted at the transport
# layer). The status page on the HTTP port is gated by Cloudron's
# authentication proxy (httpAuth.type = proxy).
#
# Base image: cloudron/base:4.0.0 (Ubuntu 22.04). The upstream gnu binary
# is built on ubuntu-latest, so the runtime needs glibc >= 2.35 —
# cloudron/base:3.2.0 (20.04) is too old for it.
FROM cloudron/base:4.0.0

ARG RATHOLE_VERSION=0.5.0
ARG RATHOLE_SHA256=3e7d0d0f365120cd3cd351d147d1a12ee960c8068b464d4dd533a3821873b80e

# Pre-compiled-binaries pattern (see JOURNAL.md): download the pinned
# upstream release, verify the sha256 gate, install the binary.
RUN curl -fsSL -o /tmp/rathole.zip \
      "https://github.com/rathole-org/rathole/releases/download/v${RATHOLE_VERSION}/rathole-x86_64-unknown-linux-gnu.zip" \
 && echo "${RATHOLE_SHA256}  /tmp/rathole.zip" | sha256sum -c - \
 && unzip -o /tmp/rathole.zip -d /usr/local/bin \
 && chmod +x /usr/local/bin/rathole \
 && rm -f /tmp/rathole.zip \
 && /usr/local/bin/rathole --version

# Static status page served on the Cloudron HTTP port (platform health
# check + auth-proxied landing page). start.sh seeds /app/data/server.toml
# on first run and execs rathole in server mode. start.sh is made
# executable on the host, not at build time (Cloudron gotcha).
COPY status.html /app/code/status/index.html
COPY start.sh /app/start.sh

WORKDIR /app/data

EXPOSE 8000 2333 5200-5299

CMD ["/bin/bash", "/app/start.sh"]