# This is a 2-stage Docker build.  In the first stage, we build a
# Zulip development environment image and use
# tools/build-release-tarball to generate a production release tarball
# from the provided Git ref.
FROM ubuntu:24.04 AS base

# Set up working locales and upgrade the base image
ENV LANG="C.UTF-8"

ARG UBUNTU_MIRROR

# hadolint ignore=DL3005,DL3008,DL3009
RUN apt-get -q update && \
    apt-get -q dist-upgrade -y && \
    DEBIAN_FRONTEND=noninteractive \
    apt-get -q install --no-install-recommends -y ca-certificates git locales python3 sudo tzdata && \
    touch /var/mail/ubuntu && chown ubuntu /var/mail/ubuntu && userdel -r ubuntu && \
    useradd -d /home/zulip -m zulip -u 1000

FROM base AS build

RUN echo 'zulip ALL=(ALL:ALL) NOPASSWD:ALL' >> /etc/sudoers

USER zulip
WORKDIR /home/zulip

# You can specify these in docker-compose.yml or with
#   docker build --build-arg "ZULIP_GIT_REF=git_branch_name" .
ARG ZULIP_GIT_URL=https://github.com/zulip/zulip.git
ARG ZULIP_GIT_REF=12.2

LABEL org.opencontainers.image.source="https://github.com/zulip/docker-zulip"
LABEL org.opencontainers.image.licenses="Apache-2.0"
LABEL org.opencontainers.image.title="Zulip Server"
LABEL org.opencontainers.image.version="$ZULIP_GIT_REF"
LABEL org.opencontainers.image.documentation="https://zulip.readthedocs.io/projects/docker/en/latest/"

RUN git clone "$ZULIP_GIT_URL" zulip

WORKDIR /home/zulip/zulip

RUN git checkout "$ZULIP_GIT_REF"

# Finally, we provision the development environment and build a release tarball
RUN SKIP_VENV_SHELL_WARNING=1 ./tools/provision --build-release-tarball-only && \
    uv run --no-sync ./tools/build-release-tarball docker && \
    mv /tmp/tmp.*/zulip-server-docker.tar.gz /tmp/zulip-server-docker.tar.gz


# In the second stage, we build the production image from the release tarball
FROM base

ENV DATA_DIR="/data"

# Then, with a second image, we install the production release tarball.
COPY --from=build /tmp/zulip-server-docker.tar.gz /root/
COPY custom_zulip_files/ /root/custom_zulip

WORKDIR /root
RUN \
    # Make sure Nginx is started by Supervisor.
    dpkg-divert --add --rename /etc/init.d/nginx && \
    ln -s /bin/true /etc/init.d/nginx && \
    mkdir -p "$DATA_DIR" && \
    tar -xf zulip-server-docker.tar.gz && \
    rm -f zulip-server-docker.tar.gz && \
    mv zulip-server-docker zulip && \
    cp -rf /root/custom_zulip/* /root/zulip && \
    rm -rf /root/custom_zulip && \
    /root/zulip/scripts/setup/install --hostname="docker-zulip.local" --email="docker-zulip" \
      --puppet-classes="zulip::profile::docker" --postgresql-version=14 && \
    rm -f /etc/zulip/zulip-secrets.conf /etc/zulip/settings.py && \
    # Zulip checks for /.dockerenv (as RUNNING_IN_DOCKER) to tailor
    # error messages to this image's SETTING_* environment variables.
    # The Docker engine creates that marker at runtime, but Kubernetes
    # container runtimes (containerd, CRI-O) do not; bake it into the
    # image so detection does not depend on the container runtime.
    touch /.dockerenv && \
    apt-get -qq autoremove --purge -y && \
    apt-get -qq clean && \
    rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*

COPY entrypoint.sh /sbin/entrypoint.sh
COPY zulip-certbot-setup /usr/local/sbin/zulip-certbot-setup

VOLUME ["$DATA_DIR"]
EXPOSE 25 80 443

HEALTHCHECK --interval=10s --timeout=5s --retries=3 --start-period=300s \
    CMD ["curl", "-isfL", "--insecure", "http://localhost/health"]

ENTRYPOINT ["/sbin/entrypoint.sh"]
CMD ["app:run"]
