# Start off with a bootstrap container just so that we can pin down the dependencies of the current version of nscli
FROM docker.io/python:3.7.2-alpine3.7 as bootstrap
ADD . .
RUN pip install toml
RUN python scripts/generate_requirements.py dev build > /tmp/requirements.txt
RUN python scripts/generate_constraints.py > /tmp/constraints.txt

FROM docker.io/debian:11 as builder

LABEL name="NSCLI Jenkins Testing Image" \
      maintainer="Network Security Infrastructure <nsi@rackspace.com>" \
      author="Micah Culpepper <micah.culpepper@rackspace.com>" \
      repo="https://github.rackspace.com/NSI/nscli"

ENV DEBIAN_FRONTEND=noninteractive
ENV DEBEMAIL="nsi@rackspace.com"
ENV DEBFULLNAME="GTS NetSec Automation Engineering"
ENV PS1='[\u@\h \W]\$ '
ENV LC_ALL=C.UTF-8

# Moving to Jeninksfile via --add-host command
# Disable logging and metrics. We don't want unit tests to count as legit usage of nscli.
#RUN printf '%b' '127.0.0.1\tappstats.rackspace.com\n' >> /etc/hosts && \
#    printf '%b' '127.0.0.1\tgatekeeper.nsi.rackspace.com\n' >> /etc/hosts && \
#    printf '%b' '127.0.0.1\tsentry.nsi.rackspace.com\n' >> /etc/hosts

# Use the rax mirror as our preferred source for debian files
RUN apt-get -y update && apt-get -y install apt-transport-https ca-certificates && apt-get -y clean && \
    mv /etc/apt/sources.list /etc/apt/sources.list.old && \
    printf '%b' 'deb https://mirror.rackspace.com/debian/ bullseye main\n' > /etc/apt/sources.list && \
    cat /etc/apt/sources.list.old >> /etc/apt/sources.list

# Install Rackspace CA certs.
COPY ["docker/ca_certs/*.crt", "/usr/local/share/ca-certificates/"]
RUN update-ca-certificates

# Install required packages
# bash: required by Jenkins, see https://issues.jenkins-ci.org/browse/JENKINS-41374
# build-base: Make
# coreutils: gnu version of date for tarball building
# curl: nscli install script
# git: Some nscli Makefile recipes need git
# libffi-dev: needed to compile cffi, from cryptography from secretstorage from keyring
# ssh: core nscli functionality
# openssl: nscli https interactions; RAX CA cert installation
# openssl-dev: needed to compile openssl, from cryptography from secretstorage from keyring
# python3, python3-dev, python3-pip, python3-setuptools, python3-venv: nscli dependencies
# libkrb5-dev: dependency of kerberos python library, which is a dependency of atlassian-python-api
RUN apt-get -y update && \
    apt-get -y upgrade && \
    apt-get -y install \
        bash \
        build-essential \
        coreutils \
        debhelper \
        devscripts \
        dh-virtualenv \
        equivs \
        gcc \
        git \
        gnupg2 \
        libffi-dev \
        libgmp3-dev \
        libkrb5-dev \
        man \
        openssl \
        python3 \
        python3-dev \
        python3-pip \
        python3-setuptools \
        python3-venv \
        ssh \
        sudo && \
    apt-get -y clean

# Add our artifactory repo as a trusted source
RUN echo 'deb https://artifacts.rackspace.net/artifactory/nscli-debian-local bullseye main' >> /etc/apt/sources.list && \
    curl -fsSL https://artifacts.rackspace.net/artifactory/api/gpg/key/public | apt-key add -

# Set up Jenkins user and group
RUN addgroup --gid 989 jenkins && \
    adduser --disabled-password --uid 992 --home /var/lib/jenkins --shell /bin/bash --ingroup jenkins jenkins && \
    echo "jenkins ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers && \
    mkdir -p /var/lib/jenkins && \
    chown -R jenkins:jenkins /var/lib/jenkins && \
    mkdir -p /var/pip/cache /var/pip/download /var/pip/wheel && \
    chown -R jenkins:jenkins /var/pip
VOLUME /srv/jenkins/workspace
WORKDIR /var/lib/jenkins
USER jenkins

# Give Jenkins a bash profile that will help simulate a user's environment
COPY --chown=jenkins:jenkins ["docker/profile", ".bash_profile"]

# Pre-generate a known_hosts file since the container is non-interactive (ignoring commented lines)
COPY --chown=jenkins:jenkins ["docker/ssh-keyscan", ".ssh/ssh-keyscan"]
RUN grep -v '^#' ~/.ssh/ssh-keyscan | while read i ; do ssh-keyscan -H $i >> ~/.ssh/known_hosts ; done

# Copy over a pre-configured NSCLI settings file
COPY --chown=jenkins:jenkins ["docker/settings.ini", ".config/nscli/"]

# Add global pip config
COPY ["docker/pip.conf", "/etc/pip.conf"]

# Set up virtual env + Cache Python packages for faster re-builds
COPY --chown=jenkins:jenkins --from=bootstrap ["/tmp/requirements.txt", "."]
COPY --chown=jenkins:jenkins --from=bootstrap ["/tmp/constraints.txt", "."]
RUN sudo pip3 install -U pip && sudo pip3 install --force-reinstall 'setuptools<71' && sudo pip3 install -U wheel
RUN python3 -m venv .venv && \
    .venv/bin/pip3 install -U pip && \
    .venv/bin/pip3 install --force-reinstall 'setuptools<71' && \
    .venv/bin/pip3 install -U wheel && \
    pip3 wheel -r requirements.txt -c constraints.txt


# Copy the current working tree into the container and set up a dev environment
ONBUILD ADD --chown=jenkins:jenkins . .
ONBUILD ADD --chown=root:root debian /dpkg-build
ONBUILD USER jenkins
# We re-try the `make db` bit because it likes to fail due to network issues that we haven't figured out yet.
# I do appreciate the irony.
ONBUILD RUN cd /var/lib/jenkins && . /var/lib/jenkins/.bash_profile && . .venv/bin/activate && \
    pip install -e '.[dev]' -c constraints.txt && \
    make site_link && \
    scripts/load_credentials.py --credpath docker/credentials.json && \
    rm -f docker/credentials.json && \
    make nscli/data/config.db || make nscli/data/config.db || make nscli/data/config.db

#ARG VERSION
#WORKDIR /dpkg-build
#RUN dch --create --distribution unstable --package "nscli" --newversion "$VERSION" "release notes are published at https://pages.github.rackspace.com/nsi/nscli/Changelog.html"
#RUN dpkg-buildpackage -us -uc -b && mkdir -p /dpkg && cp -pl /nscli[-_]* /dpkg