# syntax=docker/dockerfile:1.7
#==============================================================================
# CUSTOM NGINX / ANGIE BINARY BUILDER
#
# Stage 1 (compile) : full toolchain, compiles the web server from source with
#                     third-party modules, emits a single ELF executable.
# Stage 2 (export)  : throw-away runtime whose only job is to drop the artifact
#                     onto the shared bind mount. No compilers, no sources.
#
# The export stage is what docker-compose runs. It writes to /out, which is the
# SAME host folder NginxUI mounts read-only.
#==============================================================================

#------------------------------------------------------------------------------
# BUILDER_BASE must be ABI-compatible with the Nginx UI runtime image (same
# glibc + same libssl soname), because the binary links dynamically against
# libraries provided by the *Nginx UI* container at runtime.
#
#   debian:trixie             -> gcc 14.2 / glibc 2.41 / OpenSSL 3.5.x  (default)
#   uozi/nginx-ui:latest      -> guaranteed exact match, but needs apt available
#------------------------------------------------------------------------------
ARG BUILDER_BASE=debian:trixie
ARG EXPORT_BASE=debian:trixie-slim


#==============================================================================
# STAGE 1 - COMPILE
#==============================================================================
FROM ${BUILDER_BASE} AS compile

ARG DEBIAN_FRONTEND=noninteractive

# nginx >= 1.25 links PCRE2, not the legacy libpcre3.
#
# libmaxminddb-dev is here only so the geoip2 module in modules.txt CAN be
# built; it is commented out there because the matching runtime library is
# absent from the Nginx UI image and its absence crash-loops nginx. Installing
# a -dev package here is never sufficient on its own -- the .so must exist in
# the RUNTIME container too.
RUN apt-get update \
 && apt-get install -y --no-install-recommends \
      build-essential \
      ca-certificates \
      curl \
      git \
      libmaxminddb-dev \
      libpcre2-dev \
      libssl-dev \
      libxslt1-dev \
      patch \
      perl \
      tar \
      xz-utils \
      zlib1g-dev \
 && rm -rf /var/lib/apt/lists/*

# nginx | angie
ARG FLAVOR=nginx
# Must match `nginx -V` inside the running Nginx UI container.
ARG SRC_VERSION=1.31.3
# Leave empty to use the flavor defaults baked into build.sh.
ARG CONFIGURE_ARGS=""
# Filename the artifact is written as (defaults to FLAVOR).
ARG ARTIFACT_NAME=""
# Set to 1 to strip debug symbols from the resulting binary.
ARG STRIP=0

# Values MUST stay quoted: CONFIGURE_ARGS contains spaces, and unquoted
# `ENV K=${V}` would parse everything after the first space as further vars.
ENV FLAVOR="${FLAVOR}" \
    SRC_VERSION="${SRC_VERSION}" \
    CONFIGURE_ARGS="${CONFIGURE_ARGS}" \
    ARTIFACT_NAME="${ARTIFACT_NAME}" \
    STRIP="${STRIP}"

WORKDIR /build
COPY modules.txt ./modules.txt
COPY patches/ ./patches/
COPY compile.sh ./compile.sh
RUN chmod +x ./compile.sh && ./compile.sh


#==============================================================================
# STAGE 2 - EXPORT
# Carries ONLY the compiled artifact + its provenance files. Everything else
# (sources, object files, compilers) is discarded with stage 1.
#==============================================================================
FROM ${EXPORT_BASE} AS export

LABEL org.opencontainers.image.title="nginx-custom-binary-exporter" \
      org.opencontainers.image.description="Installs a custom-compiled nginx/angie binary onto a shared bind mount for Nginx UI."

COPY --from=compile /artifacts/ /artifacts/
COPY install.sh /usr/local/bin/install-artifacts

RUN chmod +x /usr/local/bin/install-artifacts

# Overridden by compose; /out is the shared bind mount (rw for this container).
ENV OUT_DIR=/out

ENTRYPOINT ["/usr/local/bin/install-artifacts"]
