# syntax=docker/dockerfile:1

ARG GO_VERSION=1.26.5

FROM debian:bookworm AS mtproxy-builder

ARG MTPROXY_COMMIT=f36d8af769ffaeac36978d38c2c0f6d1104c2137
ARG MTPROXY_SHA256=919795c416b870670841a21d1930ad97a24c7b84b9eb8c6f9e3de32f2fdf4655

RUN apt-get update \
    && apt-get install -y --no-install-recommends \
      build-essential ca-certificates curl libssl-dev zlib1g-dev \
    && rm -rf /var/lib/apt/lists/*

RUN curl --fail --silent --show-error --location \
      --proto '=https' --proto-redir '=https' --tlsv1.2 \
      --output /tmp/mtproxy.tar.gz \
      "https://github.com/TelegramMessenger/MTProxy/archive/${MTPROXY_COMMIT}.tar.gz" \
    && echo "${MTPROXY_SHA256}  /tmp/mtproxy.tar.gz" | sha256sum -c - \
    && mkdir -p /src/mtproxy \
    && tar -C /src/mtproxy --strip-components=1 -xzf /tmp/mtproxy.tar.gz \
    && make -C /src/mtproxy -j"$(nproc)" \
    && test -x /src/mtproxy/objs/bin/mtproto-proxy

FROM golang:${GO_VERSION}-bookworm AS relay-builder

ARG TPROXY_COMMIT=c8adb8b7c6b7fc46c12ae3acb68be9070c26a8e8
ARG TPROXY_SHA256=a78b48f536180143dd7005785ca397310c36ee0b132e19949a45d64f586ab549

RUN apt-get update \
    && apt-get install -y --no-install-recommends ca-certificates curl \
    && rm -rf /var/lib/apt/lists/*

RUN curl --fail --silent --show-error --location \
      --proto '=https' --proto-redir '=https' --tlsv1.2 \
      --output /tmp/tproxy.tar.gz \
      "https://github.com/telegramdesktop/tproxy-server/archive/${TPROXY_COMMIT}.tar.gz" \
    && echo "${TPROXY_SHA256}  /tmp/tproxy.tar.gz" | sha256sum -c - \
    && mkdir -p /src/tproxy \
    && tar -C /src/tproxy --strip-components=1 -xzf /tmp/tproxy.tar.gz

WORKDIR /src/tproxy
RUN go test ./... \
    && CGO_ENABLED=0 go build -trimpath -ldflags='-s -w' \
      -o /out/tproxy-server ./cmd/tproxy-server

WORKDIR /src/ingress
COPY ingress/ingress.go ./ingress.go
RUN CGO_ENABLED=0 go build -trimpath -ldflags='-s -w' \
      -o /out/ingress ./ingress.go

FROM debian:bookworm-slim AS runtime

RUN apt-get update \
    && apt-get install -y --no-install-recommends \
      ca-certificates curl hostname libssl3 openssl util-linux zlib1g \
    && rm -rf /var/lib/apt/lists/* \
    && useradd --system --uid 10001 --home-dir /nonexistent \
      --shell /usr/sbin/nologin mtproxy \
    && useradd --system --uid 10002 --home-dir /nonexistent \
      --shell /usr/sbin/nologin tproxy

COPY --from=mtproxy-builder /src/mtproxy/objs/bin/mtproto-proxy /usr/local/bin/mtproto-proxy
COPY --from=relay-builder /out/tproxy-server /usr/local/bin/tproxy-server
COPY --from=relay-builder /out/ingress /usr/local/bin/tproxy-ingress
COPY docker/entrypoint.sh /usr/local/bin/tproxy-entrypoint
COPY site/ /srv/tproxy-site/

RUN chown root:root \
      /usr/local/bin/mtproto-proxy \
      /usr/local/bin/tproxy-server \
      /usr/local/bin/tproxy-ingress \
      /usr/local/bin/tproxy-entrypoint \
    && chmod 0755 \
      /usr/local/bin/mtproto-proxy \
      /usr/local/bin/tproxy-server \
      /usr/local/bin/tproxy-ingress \
      /usr/local/bin/tproxy-entrypoint \
    && find /srv/tproxy-site -type d -exec chmod 0755 {} + \
    && find /srv/tproxy-site -type f -exec chmod 0644 {} +

VOLUME ["/data"]
EXPOSE 8088

ENTRYPOINT ["/usr/local/bin/tproxy-entrypoint"]