# syntax=docker/dockerfile:1
# Test host: sshd + fail2ban (dummy actions, no firewall changes).
# The agent is installed at start with agent/install.sh – exactly like on a real host.
# Build context: repository root (see ../docker-compose.yaml)
FROM debian:trixie-slim
RUN apt-get update \
 && apt-get install -y --no-install-recommends openssh-server openssh-client fail2ban python3 sudo iproute2 \
 && rm -rf /var/lib/apt/lists/* /etc/fail2ban/jail.d/* /etc/ssh/ssh_host_* \
 && mkdir -p /run/sshd && touch /var/log/empty.log

COPY <<'JAIL' /etc/fail2ban/jail.local
[DEFAULT]
banaction = dummy
banaction_allports = dummy
backend = polling

[sshd]
enabled = true
logpath = /var/log/empty.log
JAIL

COPY agent/ /opt/fail2ban-webui-agent/

COPY <<'ENTRY' /entrypoint.sh
#!/bin/sh
set -e
ssh-keygen -A >/dev/null
until [ -s /keys/ssh/id_ed25519.pub ]; do echo "waiting for /keys/ssh/id_ed25519.pub"; sleep 2; done
fail2ban-client -x start >/dev/null
# INSTALL_ARGS: options for install.sh, set per agent in docker-compose.yaml
bash /opt/fail2ban-webui-agent/install.sh --yes --key-file /keys/ssh/id_ed25519.pub $INSTALL_ARGS
for ip in $SAMPLE_BANS; do fail2ban-client set sshd banip "$ip" >/dev/null; done
exec /usr/sbin/sshd -D -e
ENTRY
RUN chmod 0755 /entrypoint.sh
ENTRYPOINT ["/entrypoint.sh"]