FROM debian:bookworm-slim

LABEL description="dante SOCKS5 + purevpn-cli exit node"

# ── System dependencies (all in one layer so apt cache is fresh for installer) ─
RUN apt-get update && apt-get install -y --no-install-recommends \
        dante-server \
        curl wget ca-certificates \
        iproute2 iptables iputils-ping \
        netcat-openbsd procps dnsutils \
        expect \
        openvpn wireguard wireguard-tools \
        net-tools openresolv \
    && rm -rf /var/lib/apt/lists/*

# ── Stub openvpn-systemd-resolved ────────────────────────────────────────────
# This package is not in Debian repos. Its absence is what triggers purevpn-cli
# to call `sudo --install-missing-components`. A no-op stub satisfies the check.
RUN mkdir -p /usr/lib/openvpn \
    && printf '#!/bin/sh\nexit 0\n' \
        | tee /usr/local/bin/openvpn-systemd-resolved \
              /usr/lib/openvpn/openvpn-systemd-resolved > /dev/null \
    && chmod +x /usr/local/bin/openvpn-systemd-resolved \
                /usr/lib/openvpn/openvpn-systemd-resolved

# ── Install purevpn-cli ───────────────────────────────────────────────────────
RUN curl -fsSL https://apps.purevpn-tools.com/cross-platform/linux-cli/production/cli-install.sh \
        -o /tmp/cli-install.sh \
    && bash /tmp/cli-install.sh \
    && rm -f /tmp/cli-install.sh

# ── Inspect binary (visible in build log, remove once confirmed working) ──────
RUN echo "=== binary type ===" \
    && file /opt/purevpn-cli/bin/purevpn-cli /opt/purevpn-cli/purevpn-cli 2>/dev/null || true \
    && echo "=== bin/purevpn-cli header ===" \
    && head -3 /opt/purevpn-cli/bin/purevpn-cli 2>/dev/null || true

# ── Fake sudo wrapper ────────────────────────────────────────────────────────
# The purevpn-cli pkg bootstrap uses argv[1] as the main module path when
# --install-missing-components is present (causing "Cannot find module '/--connect'").
# Fix: move --install-missing-components to argv[1] so the bootstrap handles
# it as its own flag rather than trying to load '--connect' as a script.
# Clean env (env -i) prevents parent env vars from interfering with pkg startup.
COPY sudo-wrapper.sh /usr/local/bin/sudo
RUN chmod +x /usr/local/bin/sudo

# ── PATH ──────────────────────────────────────────────────────────────────────
ENV PATH=/opt/purevpn-cli/bin:/opt/purevpn-cli:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

# ── Location list ─────────────────────────────────────────────────────────────
COPY servers.txt /etc/vpndock/servers.txt

# ── Entrypoint ────────────────────────────────────────────────────────────────
COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

EXPOSE 1080

ENTRYPOINT ["/entrypoint.sh"]