FROM node:21-slim AS node

RUN echo "deb http://mirrors.tuna.tsinghua.edu.cn/debian/ bookworm main contrib non-free non-free-fi" > /etc/apt/sources.list \
  && echo "deb http://mirrors.tuna.tsinghua.edu.cn/debian/ bookworm-updates main contrib non-free non-free-firmware" >> /etc/apt/sources.list \
  && echo "deb http://mirrors.tuna.tsinghua.edu.cn/debian/ bookworm-backports main contrib non-free non-free-firmware" >> /etc/apt/sources.list \
  && echo "deb http://security.debian.org/debian-security bookworm-security main contrib non-free non-free-firmware" >> /etc/apt/sources.list

RUN set -eux; \
  apt-get update; \
  apt-get install -y --no-install-recommends \
  gettext-base curl procps ca-certificates p11-kit \
  libgomp1

ENV NGINX_VERSION   1.25.3
ENV NJS_VERSION     0.8.2
ENV PKG_RELEASE     1~bookworm

COPY nginx/nginx.gpg /usr/share/keyrings

RUN set -x \
  # create nginx user/group first, to be consistent throughout docker variants
  && groupadd --system --gid 101 nginx \
  && useradd --system --gid nginx --no-create-home --home /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \
  && nginxPackages=" \
  nginx=${NGINX_VERSION}-${PKG_RELEASE} \
  nginx-module-xslt=${NGINX_VERSION}-${PKG_RELEASE} \
  nginx-module-geoip=${NGINX_VERSION}-${PKG_RELEASE} \
  nginx-module-image-filter=${NGINX_VERSION}-${PKG_RELEASE} \
  nginx-module-njs=${NGINX_VERSION}+${NJS_VERSION}-${PKG_RELEASE} \
  " \
  && echo "deb [signed-by=/usr/share/keyrings/nginx.gpg] https://nginx.org/packages/mainline/debian/ bookworm nginx" >> /etc/apt/sources.list.d/nginx.list \
  && apt-get update \
  && apt-get install --no-install-recommends --no-install-suggests -y $nginxPackages \
  # forward request and error logs to docker log collector
  && ln -sf /dev/stdout /var/log/nginx/access.log \
  && ln -sf /dev/stderr /var/log/nginx/error.log \
  # create a docker-entrypoint.d directory
  && mkdir /docker-entrypoint.d

# nginx -g daemon off
COPY nginx/*sh /docker-entrypoint.d
EXPOSE 80

ENV JAVA_HOME /usr/local/openjdk-8
RUN { echo '#/bin/sh'; echo 'echo "$JAVA_HOME"'; } > /usr/local/bin/docker-java-home && chmod +x /usr/local/bin/docker-java-home && [ "$JAVA_HOME" = "$(docker-java-home)" ] # backwards compatibility
ENV PATH $JAVA_HOME/bin:$PATH

ENV LANG C.UTF-8
ENV JAVA_VERSION 8u342

COPY gm.tar.gz /
COPY openjdk8.tar.gz /

RUN set -eux; \
  savedAptMark="$(apt-mark showmanual)"; \
  \
  tar zxf gm.tar.gz && rm gm.tar.gz; \
  mkdir -p "$JAVA_HOME"; \
  tar --extract \
  --file openjdk8.tar.gz \
  --directory "$JAVA_HOME" \
  --strip-components 1 \
  --no-same-owner \
  ; \
  rm openjdk8.tar.gz; \
  \
  apt-mark auto '.*' > /dev/null; \
  [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
  \
  # update "cacerts" bundle to use Debian's CA certificates (and make sure it stays up-to-date with changes to Debian's store)
  # see https://github.com/docker-library/openjdk/issues/327
  #     http://rabexc.org/posts/certificates-not-working-java#comment-4099504075
  #     https://salsa.debian.org/java-team/ca-certificates-java/blob/3e51a84e9104823319abeb31f880580e46f45a98/debian/jks-keystore.hook.in
  #     https://git.alpinelinux.org/aports/tree/community/java-cacerts/APKBUILD?id=761af65f38b4570093461e6546dcf6b179d2b624#n29
  { \
  echo '#!/usr/bin/env bash'; \
  echo 'set -Eeuo pipefail'; \
  echo 'trust extract --overwrite --format=java-cacerts --filter=ca-anchors --purpose=server-auth "$JAVA_HOME/jre/lib/security/cacerts"'; \
  } > /etc/ca-certificates/update.d/docker-openjdk; \
  chmod +x /etc/ca-certificates/update.d/docker-openjdk; \
  /etc/ca-certificates/update.d/docker-openjdk; \
  \
  # https://github.com/docker-library/openjdk/issues/331#issuecomment-498834472
  find "$JAVA_HOME/lib" -name '*.so' -exec dirname '{}' ';' | sort -u > /etc/ld.so.conf.d/docker-openjdk.conf; \
  ldconfig

RUN set -eux; \
  apt-get remove --purge --auto-remove -y; \
  apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
  apt-get remove --purge --auto-remove -y && rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/nginx.list; \
  gm version && java -version