# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
FROM amazonlinux:2023 AS builder

ARG WAZUH_VERSION
ARG TARGETARCH
ARG wazuh_indexer_x86_64_rpm
ARG wazuh_indexer_aarch64_rpm
ARG wazuh_certs_tool
ARG wazuh_config_yml
ARG WAZUH_UID=101
ARG WAZUH_GID=101

ENV USER="wazuh-indexer" \
    GROUP="wazuh-indexer" \
    NAME="wazuh-indexer" \
    INSTALL_DIR="/usr/share/wazuh-indexer" 

COPY config/config.sh .

RUN yum install curl-minimal shadow-utils findutils hostname -y && \
    yum clean all && \
    getent group $GROUP || groupadd -r -g ${WAZUH_GID} $GROUP && \
    useradd --system \
            --uid ${WAZUH_UID} \
            --no-create-home \
            --home-dir $INSTALL_DIR \
            --gid ${WAZUH_GID} \
            --shell /sbin/nologin \
            --comment "$USER user" \
            $USER && \
    RPM_ARCH="x86_64" && \
    if [ "${TARGETARCH}" = "arm64" ]; then RPM_ARCH="aarch64"; fi && \
    URL_VAR="wazuh_indexer_${RPM_ARCH}_rpm" && \
    indexer_url="${!URL_VAR}" && \
    dnf install curl-minimal openssl xz tar findutils shadow-utils -y &&\
    curl -o /wazuh-indexer.rpm "${indexer_url}" && \
    dnf install /wazuh-indexer.rpm -y && \
    rm -rf /wazuh-indexer.rpm && \
    dnf clean all && \
    bash config.sh

################################################################################
# Build stage 1 (the actual Wazuh indexer image):
#
# Copy wazuh-indexer from stage 0
# Add entrypoint
################################################################################
FROM amazonlinux:2023

ARG WAZUH_UID=101
ARG WAZUH_GID=101

ENV USER="wazuh-indexer" \
    GROUP="wazuh-indexer" \
    NAME="wazuh-indexer" \
    INSTALL_DIR="/usr/share/wazuh-indexer" 
ENV ENGINE_DIR="$INSTALL_DIR/engine"


COPY config/entrypoint.sh /
COPY config/securityadmin.sh /

RUN yum install curl-minimal shadow-utils findutils hostname -y && \
    yum clean all && \
    getent group $GROUP || groupadd -r -g ${WAZUH_GID} $GROUP && \
    useradd --system \
            --uid ${WAZUH_UID} \
            --no-create-home \
            --home-dir $INSTALL_DIR \
            --gid ${WAZUH_GID} \
            --shell /sbin/nologin \
            --comment "$USER user" \
            $USER && \
    chmod 700 /entrypoint.sh && chmod 700 /securityadmin.sh && \
    mkdir -p $INSTALL_DIR && \
    chown ${WAZUH_UID}:${WAZUH_GID} $INSTALL_DIR && \
    chown ${WAZUH_UID}:${WAZUH_GID} /*.sh && \
    mkdir -p /var/lib/wazuh-indexer && chown ${WAZUH_UID}:${WAZUH_GID} /var/lib/wazuh-indexer && \
    mkdir -p $INSTALL_DIR/logs && chown ${WAZUH_UID}:${WAZUH_GID} $INSTALL_DIR/logs && \
    mkdir -p /run/wazuh-indexer && chown ${WAZUH_UID}:${WAZUH_GID} /run/wazuh-indexer && \
    mkdir -p /var/log/wazuh-indexer && chown ${WAZUH_UID}:${WAZUH_GID} /var/log/wazuh-indexer

COPY --from=builder $INSTALL_DIR $INSTALL_DIR

RUN chmod 700 $INSTALL_DIR && \
    chmod 700 $INSTALL_DIR/config && \
    chmod 600 $INSTALL_DIR/config/jvm.options && \
    chmod 600 $INSTALL_DIR/config/opensearch.yml && \
    if [ -d "$ENGINE_DIR" ]; then \
    find "$ENGINE_DIR" -type d -exec chmod 750 {} + && \
    find "$ENGINE_DIR" -type f -exec chmod 640 {} + && \
    { [ -f "$ENGINE_DIR/run_engine.sh" ] && chmod 750 "$ENGINE_DIR/run_engine.sh" || true; } && \
    { [ -f "$ENGINE_DIR/bin/wazuh-engine" ] && chmod 750 "$ENGINE_DIR/bin/wazuh-engine" || true; } && \
    { [ -d "$ENGINE_DIR/sockets" ] && chmod 777 "$ENGINE_DIR/sockets" || true; }; \
    fi

USER wazuh-indexer
WORKDIR $INSTALL_DIR

# Services ports
EXPOSE 9200

ENTRYPOINT ["/entrypoint.sh"]
# Dummy overridable parameter parsed by entrypoint
CMD ["opensearch"]