ARG IPTABLES_MODE=nft

#install iptables
FROM ubuntu:noble AS apt
RUN --mount=type=cache,target=/var/lib/apt/lists,sharing=locked --mount=type=cache,target=/var/cache/apt,sharing=locked <<EOF
apt update
apt upgrade -y
apt install iptables jq -y
EOF

#set alternative to use iptables-legacy
FROM apt AS iptables-legacy
RUN update-alternatives --set iptables /usr/sbin/iptables-legacy
RUN update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy

#set alternative to use iptables-nft
FROM apt AS iptables-nft
RUN update-alternatives --set iptables /usr/sbin/iptables-nft
RUN update-alternatives --set ip6tables /usr/sbin/ip6tables-nft

#build crowdsec-custom-bouncer
FROM golang:1.24 AS build-stage
WORKDIR /app
RUN git clone --depth 1 https://github.com/crowdsecurity/cs-custom-bouncer.git
WORKDIR /app/cs-custom-bouncer
RUN CGO_ENABLED=0 GOOS=linux make release

#build the final image
FROM iptables-${IPTABLES_MODE} AS crowdsec-custom-bouncer
ARG IPTABLES_MODE=nft
RUN mkdir -p /etc/crowdsec/bouncers
COPY --from=build-stage /app/cs-custom-bouncer/crowdsec-custom-bouncer \
    /usr/bin/crowdsec-custom-bouncer
COPY --from=build-stage /app/cs-custom-bouncer/config/crowdsec-custom-bouncer.yaml \
    /crowdsec-custom-bouncer.yaml
RUN sed -i "s/total_retries: .*/total_retries: 1/g" /crowdsec-custom-bouncer.yaml
ADD --chmod=770 bouncer.sh /bouncer.sh
ENV BINARY_PATH=/bouncer.sh
LABEL me.ar2000.gitea.buildargs.iptablesmode="${IPTABLES_MODE}"
CMD ["/usr/bin/crowdsec-custom-bouncer", "-c", "/crowdsec-custom-bouncer.yaml"]