# Dockerfile for directory-mode test: Tor + FIPS co-located in one container.
#
# Tor manages the onion service via HiddenServiceDir. FIPS reads the
# .onion hostname from /var/lib/tor/fips_onion_service/hostname at startup.
# This requires Tor to bootstrap and create the hostname file before FIPS
# starts, so the entrypoint script waits for it.

FROM debian:bookworm-slim

ARG TORRC=torrc

RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        tor iproute2 iputils-ping dnsutils \
        dnsmasq python3 && \
    rm -rf /var/lib/apt/lists/*

# dnsmasq: forward .fips to FIPS daemon, everything else to Docker DNS
RUN printf '%s\n' \
    'port=53' \
    'listen-address=127.0.0.1' \
    'bind-interfaces' \
    'server=/fips/127.0.0.1#5354' \
    'server=127.0.0.11' \
    'no-resolv' \
    >> /etc/dnsmasq.conf

COPY fips fipsctl /usr/local/bin/
RUN chmod +x /usr/local/bin/fips /usr/local/bin/fipsctl

COPY ${TORRC} /etc/tor/torrc
COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

COPY resolv.conf /etc/resolv.conf

ENTRYPOINT ["/entrypoint.sh"]