# APISIX Cloudron Package
#
# Apache APISIX API gateway, traditional deployment mode with an embedded
# single-node etcd. Cloudron has no etcd addon, so the etcd server ships
# inside this image (copied from the upstream release image) and stores its
# state under /app/data/etcd - that keeps the Admin API + dynamic routes
# available without any platform dependency.
#
# Upstream: https://github.com/apache/apisix
#   - Official image apache/apisix:3.18.0-debian, runs as non-root apisix
#     (uid 636), ENTRYPOINT /docker-entrypoint.sh CMD docker-start which
#     does `apisix init` + `apisix init_etcd` then execs openresty with
#     `daemon off`.
#
# Authentication: APISIX is a gateway (no user concept). The Admin API
# listens on 127.0.0.1:9180 ONLY (never exposed) and is protected by a
# persisted random admin key in /app/data/.admin_key. Operators reach it
# via `cloudron exec` into the app. Data-plane auth (key-auth, OIDC
# relay, etc.) is route-level and configured per API by the operator.
#
# Pattern: official-image wrapper. Image pinned by tag AND digest.
FROM apache/apisix:3.18.0-debian@sha256:84e6b5e787e9f889ebff88161cb9a16599bafcffa236c6b54c7f779a0655940d

# etcd + etcdctl from the upstream release image (multi-arch manifest
# digest; build resolves the amd64 binary). etcdctl is kept as an ops tool
# for `cloudron exec` debugging of the config store.
COPY --from=quay.io/coreos/etcd@sha256:d367cba7801b29d2f7481bb56802894658ec8a647834509118c81f77f721381b /usr/local/bin/etcd /usr/local/bin/etcd
COPY --from=quay.io/coreos/etcd@sha256:d367cba7801b29d2f7481bb56802894658ec8a647834509118c81f77f721381b /usr/local/bin/etcdctl /usr/local/bin/etcdctl

# start.sh waits for etcd, regenerates config.yaml from the Cloudron env
# contract and execs openresty in the foreground. Made executable on the
# host, not at build time (Cloudron builds hit permission errors on RUN chmod).
COPY start.sh /app/start.sh

# Cloudron proxies HTTPS -> this port (manifest httpPort / healthCheckPath "/").
EXPOSE 9080

# Cloudron does not chown /app/data to arbitrary non-root image users, so the
# container runs as root (the Cloudron app convention) and start.sh keeps the
# Admin API loopback-only + key-protected.
USER root

ENTRYPOINT ["/bin/bash", "/app/start.sh"]