# Reproducible dev toolbox for the home-network-k3s platform (Phase 1+).
# Bakes the NON-Python prereqs (OpenTofu, age, sops, flux) plus ansible + kube tooling
# and the libvirt client libraries into a pinned baseline image. Run it with the host
# libvirt socket mounted (see dev.sh) so OpenTofu (dmacvicar/libvirt provider) and
# Ansible can drive the local KVM cluster. Fedora base matches the host libvirt major
# version (host is fc44 / libvirt 12) for client<->daemon compatibility.
ARG FEDORA_VERSION=44
FROM registry.fedoraproject.org/fedora:${FEDORA_VERSION}

ARG OPENTOFU_VERSION
ARG AGE_VERSION
ARG SOPS_VERSION
ARG FLUX_VERSION
ARG KUBECTL_VERSION
ARG HELM_VERSION
ARG TARGETARCH=amd64

# Distro packages: libvirt client libs (required by the tofu libvirt provider + virsh),
# ansible, ssh, disk-image + cloud-init seed tooling, and common utilities.
RUN dnf -y install --setopt=install_weak_deps=False \
      libvirt-client qemu-img cloud-utils genisoimage openssh-clients \
      ansible-core python3-libvirt git make jq unzip tar gzip xz which ca-certificates curl \
 && dnf clean all

# Pinned Go binaries from official releases.
RUN set -eux; \
    curl -fsSL "https://github.com/opentofu/opentofu/releases/download/v${OPENTOFU_VERSION}/tofu_${OPENTOFU_VERSION}_linux_${TARGETARCH}.zip" -o /tmp/tofu.zip; \
      unzip -d /usr/local/bin /tmp/tofu.zip tofu; chmod +x /usr/local/bin/tofu; \
    curl -fsSL "https://github.com/FiloSottile/age/releases/download/v${AGE_VERSION}/age-v${AGE_VERSION}-linux-${TARGETARCH}.tar.gz" | tar -xz -C /tmp; \
      install -m0755 /tmp/age/age /tmp/age/age-keygen /usr/local/bin/; \
    curl -fsSL "https://github.com/getsops/sops/releases/download/v${SOPS_VERSION}/sops-v${SOPS_VERSION}.linux.${TARGETARCH}" -o /usr/local/bin/sops; chmod +x /usr/local/bin/sops; \
    curl -fsSL "https://github.com/fluxcd/flux2/releases/download/v${FLUX_VERSION}/flux_${FLUX_VERSION}_linux_${TARGETARCH}.tar.gz" | tar -xz -C /usr/local/bin flux; \
    curl -fsSL "https://dl.k8s.io/release/v${KUBECTL_VERSION}/bin/linux/${TARGETARCH}/kubectl" -o /usr/local/bin/kubectl; chmod +x /usr/local/bin/kubectl; \
    curl -fsSL "https://get.helm.sh/helm-v${HELM_VERSION}-linux-${TARGETARCH}.tar.gz" | tar -xz -C /tmp; \
      install -m0755 "/tmp/linux-${TARGETARCH}/helm" /usr/local/bin/helm; \
    rm -rf /tmp/*

# Record the baked toolchain for provenance.
RUN { echo "opentofu=${OPENTOFU_VERSION}"; echo "age=${AGE_VERSION}"; echo "sops=${SOPS_VERSION}"; \
      echo "flux=${FLUX_VERSION}"; echo "kubectl=${KUBECTL_VERSION}"; echo "helm=${HELM_VERSION}"; \
    } > /etc/dev-toolchain-versions

ENV LIBVIRT_DEFAULT_URI=qemu:///system
WORKDIR /work
CMD ["/bin/bash"]