# =============================================================================
# PDEGO — mcp-proxy (nginx)
# =============================================================================
# Public front door for the PDEGO MCP: OAuth 2.1 facade bridging MCP clients to
# Auth0 (PRM + AS metadata, /authorize, /token, static /register) and streaming
# reverse proxy for /mcp to the VPC-internal apollo-mcp. Pure nginx config —
# the rules live in nginx/templates/default.conf.template. The Orchard debian13
# parent doesn't ship the official nginx image's envsubst-on-templates
# entrypoint, so entrypoint.sh reimplements that one piece before exec'ing nginx.
#
# Day-to-day workflow goes through the Makefile (docker compose under the hood):
# Build:               make build       (docker compose build)
# Run (QA posture):    make run         (docker compose up — deployed env defaults)
# Run (local):         make run-local   (compose + local overrides: docker DNS, localhost origin)
# Config check:        make check       (nginx -t, templates substituted first)
#
# The ECS task def's container health check is `CMD-SHELL curl -f
# http://localhost:8080/health` (terraform-fargate default), hence the curl install.

FROM 086679231553.dkr.ecr.us-east-1.amazonaws.com/docker-parent-images:debian13 AS deploy

LABEL org.opencontainers.image.title="PDEGO MCP Proxy"
LABEL org.opencontainers.image.description="nginx front door for the PDEGO MCP: OAuth facade to Auth0 + streaming reverse proxy to apollo-mcp"
LABEL org.opencontainers.image.source="https://github.com/theorchard/mcp-proxy"

# The parent runs as the non-root `worker` user; become root to install nginx,
# then drop back. gettext-base provides envsubst for entrypoint.sh. The
# sites-enabled default vhost and empty conf.d/default.conf ship with the apt
# package and aren't ours — remove them so only our template-generated config
# is live. worker needs write access to conf.d (entrypoint.sh's output),
# nginx's log dir, and its runtime state dir. The official nginx image
# symlinks its logs to stdout/stderr so `docker logs` works; Debian's package
# doesn't, so we do it ourselves.
USER root
RUN apt-get -y update \
    && apt-get -y install --no-install-recommends nginx gettext-base curl ca-certificates \
    && apt-get -y clean \
    && rm -rf /var/lib/apt/lists/* \
    && rm -f /etc/nginx/sites-enabled/default /etc/nginx/conf.d/default.conf \
    && sed -i '/^user /d' /etc/nginx/nginx.conf \
    && chown -R worker:worker /etc/nginx/conf.d /var/log/nginx /var/lib/nginx /run \
    && ln -sf /dev/stdout /var/log/nginx/access.log \
    && ln -sf /dev/stderr /var/log/nginx/error.log

# No env defaults baked in here — docker-compose.yaml supplies QA-posture
# values for local runs (make run / make run-local), and the ECS task
# definition supplies real values in every deployed environment.
COPY nginx/templates/ /etc/nginx/templates/
COPY entrypoint.sh /entrypoint.sh

# Standard Jenkins global-libraries build arg (deployment version tracking).
ARG VERSION
ENV VERSION=$VERSION

EXPOSE 8080

# Back to the parent's non-root user for runtime.
USER worker

ENTRYPOINT ["/entrypoint.sh"]
CMD ["nginx", "-g", "daemon off;"]