# Stage 1: build usher and usher-lark from upstream (pinned commit + local patches).
FROM golang:1.25.0-bookworm AS builder

ARG USHER_REPO=https://github.com/nexustar/usher.git
ARG USHER_REF=802aebb8139daae1279a5c5c8ae41973cd85162c

RUN git init /src/usher && \
    cd /src/usher && \
    git remote add origin ${USHER_REPO} && \
    git fetch --depth 1 origin ${USHER_REF} && \
    git checkout FETCH_HEAD

COPY infra/images/resilience-agents-platform/patches/ /tmp/patches/
RUN cd /src/usher && \
    if ls /tmp/patches/*.patch 1>/dev/null 2>&1; then \
      git apply /tmp/patches/*.patch; \
    fi

WORKDIR /src/usher
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
    go build -o /out/usher -ldflags "-s -w" ./cmd/usher

WORKDIR /src/usher/plugins/lark
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
    go build -o /out/usher-lark -ldflags "-s -w" .

# alert-triage-adapter, built from this repo. It is a standalone module with no
# external dependencies, so copying just its directory is enough.
COPY services/resilience-agents-platform/alert-triage-adapter /src/adapter
WORKDIR /src/adapter
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
    go build -o /out/alert-triage-adapter -ldflags "-s -w" ./cmd/alert-triage-adapter

# Stage 2: runtime — usher + usher-lark + code-server in one image.
FROM debian:13

# ARG rather than ENV so it does not leak into the running container; tzdata
# otherwise stops the build to ask for a geographic area.
ARG DEBIAN_FRONTEND=noninteractive

# Basic tools (ref: devops/images/jump-pod)
RUN apt-get update && apt-get install -y \
    less \
    ca-certificates \
    curl \
    wget \
    unzip \
    procps \
    nano \
    vim \
    jq \
    zsh \
    fish \
    git \
    openssh-client \
    tmux \
    bind9-dnsutils \
    ripgrep \
    fd-find \
    build-essential \
    pkg-config \
    libssl-dev \
    python3 \
    python3-venv \
    golang \
    nginx \
    htop \
    mycli \
    tzdata \
    locales \
    bubblewrap \
    podman \
    uidmap \
    fuse-overlayfs \
    passt \
    slirp4netns \
    && rm -rf /var/lib/apt/lists/*

# Timezone and locale. glibc honours $TZ at runtime, but plenty of tools stat
# /etc/localtime instead, so bake a default in and let deployments override
# both with env vars. en_US is the default LANG; zh_CN is generated so users
# can switch without a rebuild.
ARG TZ=UTC
RUN ln -sf /usr/share/zoneinfo/${TZ} /etc/localtime && \
    echo "${TZ}" > /etc/timezone && \
    sed -i -e 's/^# *\(en_US\.UTF-8 \)/\1/' \
           -e 's/^# *\(zh_CN\.UTF-8 \)/\1/' /etc/locale.gen && \
    locale-gen

# Node.js. Deliberately not Debian's nodejs package: trixie ships 20.19, which
# went EOL 2026-04-30. Installed into /usr/local rather than managed by
# nvm/fnm because usher is started by s6 with no login shell, and resolves the
# agent CLIs with exec.LookPath — a shell-hook version manager would be
# invisible to exactly the process that matters.
ARG NODE_VERSION=24.19.0
ARG NODE_SHA256=14b342e71204f811bde6153be8e04b62aef63c236fef92b55f9c83154b409647
RUN curl -fsSLo /tmp/node.tar.xz \
      "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz" && \
    echo "${NODE_SHA256}  /tmp/node.tar.xz" | sha256sum -c - && \
    tar -xJf /tmp/node.tar.xz -C /usr/local --strip-components=1 \
      --exclude=CHANGELOG.md --exclude=LICENSE --exclude=README.md && \
    rm /tmp/node.tar.xz && \
    corepack enable

# GitHub CLI
RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
      -o /usr/share/keyrings/githubcli-archive-keyring.gpg && \
    echo "deb [signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
      > /etc/apt/sources.list.d/github-cli.list && \
    apt-get update && apt-get install -y gh && rm -rf /var/lib/apt/lists/*

# uv (Python package manager)
RUN curl -LsSf https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local sh

# code-server
RUN curl -fsSL https://code-server.dev/install.sh | sh

# usher binaries
COPY --from=builder /out/usher /usr/local/bin/usher
COPY --from=builder /out/usher-lark /usr/local/bin/usher-lark

# alert-triage-adapter and its prompt (re-read per dispatch; override the path
# with -prompt to tune it off the PVC without a rebuild).
COPY --from=builder /out/alert-triage-adapter /usr/local/bin/alert-triage-adapter
COPY services/resilience-agents-platform/alert-triage-adapter/prompt.md /opt/rap/prompt.md

# s6-overlay — process supervisor for multi-service containers
ARG S6_OVERLAY_VERSION=3.2.0.2
ADD https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-noarch.tar.xz /tmp
RUN tar -C / -Jxpf /tmp/s6-overlay-noarch.tar.xz && rm /tmp/s6-overlay-noarch.tar.xz
ADD https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-x86_64.tar.xz /tmp
RUN tar -C / -Jxpf /tmp/s6-overlay-x86_64.tar.xz && rm /tmp/s6-overlay-x86_64.tar.xz

# Non-root user — $HOME is a PVC mount, so dotfiles go to /etc/skel
# for first-boot seeding by the init-home oneshot.
RUN useradd -m -s /bin/bash -u 1000 dev && \
    cp /home/dev/.bashrc /etc/skel/.bashrc.example && \
    cp /home/dev/.profile /etc/skel/.profile.example && \
    apt-get update && apt-get install -y sudo && rm -rf /var/lib/apt/lists/* && \
    echo "dev ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/dev && \
    echo "dev:100000:65536" > /etc/subuid && \
    echo "dev:100000:65536" > /etc/subgid

COPY infra/images/resilience-agents-platform/rootfs/ /

WORKDIR /home/dev
ENV HOME=/home/dev \
    GOPATH=/home/dev/go \
    PATH="/home/dev/go/bin:/home/dev/.local/bin:${PATH}" \
    TZ=${TZ} \
    LANG=en_US.UTF-8 \
    LANGUAGE=en_US:en \
    S6_KEEP_ENV=1 \
    S6_BEHAVIOUR_IF_STAGE2_FAILS=2

EXPOSE 3000

ENTRYPOINT ["/init"]