# Duo publishes no official image; build from their source tarball.
# Install flags match Duo's documented non-interactive install.

FROM ubuntu:24.04 AS build

ARG DUO_VERSION=latest
RUN apt-get update \
 && apt-get install -y --no-install-recommends \
      build-essential libssl-dev libffi-dev perl zlib1g-dev wget ca-certificates \
 && rm -rf /var/lib/apt/lists/*

RUN wget -q "https://dl.duosecurity.com/duoauthproxy-${DUO_VERSION}-src.tgz" -O /tmp/duo-src.tgz \
 && mkdir /tmp/duo \
 && tar xzf /tmp/duo-src.tgz -C /tmp/duo --strip-components=1

RUN groupadd -r -g 35505 duo \
 && useradd -r -u 35505 -g duo -d /opt/duoauthproxy -s /usr/sbin/nologin duo \
 && cd /tmp/duo && make \
 && cd duoauthproxy-build \
 && ./install --install-dir /opt/duoauthproxy --service-user duo \
      --log-group duo --create-init-script no --enable-selinux no

FROM ubuntu:24.04

# gettext-base = envsubst for rendering authproxy.cfg from env vars
RUN apt-get update \
 && apt-get install -y --no-install-recommends ca-certificates gettext-base \
 && rm -rf /var/lib/apt/lists/* \
 && groupadd -r -g 35505 duo \
 && useradd -r -u 35505 -g duo -d /opt/duoauthproxy -s /usr/sbin/nologin duo

COPY --from=build --chown=duo:duo /opt/duoauthproxy /opt/duoauthproxy
COPY --chown=duo:duo authproxy.cfg.template /opt/duoauthproxy/conf/authproxy.cfg.template
COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

USER duo
ENTRYPOINT ["/entrypoint.sh"]