ARG REGISTRY_URL

FROM ${REGISTRY_URL}/almalinux:8

RUN --mount=type=bind,src=.,dst=/tmp/collect bash -e <<EOF

# Base dnf configuration
sed -i 's/best=True/best=False/g' /etc/dnf/dnf.conf
echo 'install_weak_deps=False' >> /etc/dnf/dnf.conf

dnf install -y dnf-plugins-core
dnf config-manager --set-enabled powertools
dnf install -y epel-release

dnf install --best -y \
    gcc \
    gcc-c++ \
    git \
    gnutls \
    iproute \
    libgcrypt \
    lua \
    mariadb-connector-c \
    mysql-server \
    mysql \
    openssh-server \
    openssl \
    python3.11 \
    python3-devel \
    python3.11-pip \
    perl-interpreter \
    procps-ng \
    psmisc \
    perl-HTTP-Daemon-SSL \
    perl-JSON \
    perl-Thread-Queue \
    rrdtool \
    sudo \
    tcpdump \
    zstd

dnf clean all

# Generate TLS certificates for MariaDB
echo "Generating TLS certificates for MariaDB"
mkdir -p /etc/mysql/ssl

# Generate CA certificate
openssl req -x509 -newkey rsa:4096 -days 3650 -nodes \
  -keyout /etc/mysql/ssl/ca-key.pem -out /etc/mysql/ssl/ca-cert.pem \
  -subj "/CN=Centreon-MariaDB-CA"

# Generate server certificate
openssl req -newkey rsa:4096 -days 3650 -nodes \
  -keyout /etc/mysql/ssl/server-key.pem -out /etc/mysql/ssl/server-req.pem \
  -subj "/CN=localhost"

# Sign server certificate with CA
openssl x509 -req -in /etc/mysql/ssl/server-req.pem -days 3650 \
  -CA /etc/mysql/ssl/ca-cert.pem -CAkey /etc/mysql/ssl/ca-key.pem -CAcreateserial \
  -out /etc/mysql/ssl/server-cert.pem -extensions v3_req -extfile <(cat <<'EOFSSL'
[v3_req]
subjectAltName = DNS:localhost,IP:127.0.0.1
EOFSSL
)

# Generate client certificate
openssl req -newkey rsa:4096 -days 3650 -nodes \
  -keyout /etc/mysql/ssl/client-key.pem -out /etc/mysql/ssl/client-req.pem \
  -subj "/CN=localhost"

# Sign client certificate with CA
openssl x509 -req -in /etc/mysql/ssl/client-req.pem -days 3650 \
  -CA /etc/mysql/ssl/ca-cert.pem -CAkey /etc/mysql/ssl/ca-key.pem -CAcreateserial \
  -out /etc/mysql/ssl/client-cert.pem -extensions v3_req -extfile <(cat <<'EOFSSL'
[v3_req]
subjectAltName = DNS:localhost,IP:127.0.0.1
EOFSSL
)

# Set proper permissions
chmod 644 /etc/mysql/ssl/ca-cert.pem /etc/mysql/ssl/server-cert.pem /etc/mysql/ssl/client-cert.pem
chmod 600 /etc/mysql/ssl/ca-key.pem /etc/mysql/ssl/server-key.pem /etc/mysql/ssl/client-key.pem

# Check if mysql user exists, if so set ownership
if id mysql > /dev/null 2>&1; then
    chown mysql:mysql /etc/mysql/ssl/ca-cert.pem /etc/mysql/ssl/server-cert.pem /etc/mysql/ssl/server-key.pem
fi

# Create MariaDB TLS configuration
cat > /etc/my.cnf.d/99-tls.cnf <<'EOL'
[mysqld]
ssl_ca=/etc/mysql/ssl/ca-cert.pem
ssl_cert=/etc/mysql/ssl/server-cert.pem
ssl_key=/etc/mysql/ssl/server-key.pem
require_secure_transport=OFF
EOL

echo "TLS certificates generated and MariaDB configured for TLS"


echo "install robot and dependencies"
pip3.11 install -U robotframework robotframework-databaselibrary robotframework-httpctrl robotframework-examples pymysql python-dateutil psutil
pip3.11 install grpcio grpcio_tools py-cpuinfo cython gitpython boto3 robotframework-requests cryptography PyJWT

cd /tmp/collect

.github/scripts/collect-prepare-test-robot.sh mysql

dnf remove -y gcc gcc-c++ python3-devel

dnf clean all

EOF

# Set TLS environment variables that persist in the container
ENV DB_SSL_ENABLED="true"
ENV DB_SSL_CA="/etc/mysql/ssl/ca-cert.pem"
ENV DB_SSL_CERT="/etc/mysql/ssl/client-cert.pem"
ENV DB_SSL_KEY="/etc/mysql/ssl/client-key.pem"
ENV DB_TLS_VERSION="TLSv1.3"

