# Duo publishes no official image; build from their source tarball.
# Install flags match Duo's documented non-interactive install.
#
# Slimming option: switch BOTH stages to debian:bookworm-slim (~80MB less,
# and the base layer is shared with the openvpn image). Both must move
# together — the proxy links against the builder's glibc. Alpine/musl
# will not work.
#FROM debian:bookworm-slim AS build

FROM ubuntu:24.04 AS build

ARG DUO_VERSION=latest
RUN apt-get update \
 && apt-get install -y --no-install-recommends \
      build-essential libssl-dev libffi-dev perl zlib1g-dev wget ca-certificates \
 && rm -rf /var/lib/apt/lists/*

RUN wget -q "https://dl.duosecurity.com/duoauthproxy-${DUO_VERSION}-src.tgz" -O /tmp/duo-src.tgz \
 && mkdir /tmp/duo \
 && tar xzf /tmp/duo-src.tgz -C /tmp/duo --strip-components=1

RUN groupadd -r -g 35505 duo \
 && useradd -r -u 35505 -g duo -d /opt/duoauthproxy -s /usr/sbin/nologin duo \
 && cd /tmp/duo && make \
 && cd duoauthproxy-build \
 && ./install --install-dir /opt/duoauthproxy --service-user duo \
      --log-group duo --create-init-script no --enable-selinux no

# Slim variant (must match the build stage base — see note above):
#FROM debian:bookworm-slim
FROM ubuntu:24.04

# gettext-base = envsubst for rendering authproxy.cfg from env vars
RUN apt-get update \
 && apt-get install -y --no-install-recommends ca-certificates gettext-base \
 && rm -rf /var/lib/apt/lists/* \
 && groupadd -r -g 35505 duo \
 && useradd -r -u 35505 -g duo -d /opt/duoauthproxy -s /usr/sbin/nologin duo

COPY --from=build --chown=duo:duo /opt/duoauthproxy /opt/duoauthproxy
COPY --chown=duo:duo authproxy.cfg.template /opt/duoauthproxy/conf/authproxy.cfg.template
COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

USER duo
ENTRYPOINT ["/entrypoint.sh"]
