ARG REGISTRY_URL

FROM ${REGISTRY_URL}/debian:bookworm

RUN --mount=type=bind,src=.,dst=/tmp/collect bash -e <<EOF

apt-get update

apt-get -y install \
    curl \
    dsniff \
    g++ \
    gcc \
    gdb \
    git \
    libhttp-daemon-ssl-perl \
    libjson-perl \
    liblua5.3 \
    libmariadb3 \
    locales \
    mariadb-server \
    openssh-server \
    openssl \
    perl-base \
    psmisc \
    python3 \
    python3-dev \
    python3-pip \
    rrdcached \
    rrdtool \
    strace \
    tcpdump \
    sudo \
    zstd

apt-get clean

# Generate TLS certificates for MariaDB
echo "Generating TLS certificates for MariaDB"
mkdir -p /etc/mysql/ssl
mkdir -p /etc/mysql/mariadb.conf.d

# Generate CA certificate
openssl req -x509 -newkey rsa:4096 -days 3650 -nodes \
  -keyout /etc/mysql/ssl/ca-key.pem -out /etc/mysql/ssl/ca-cert.pem \
  -subj "/CN=Centreon-MariaDB-CA"

# Generate server certificate
openssl req -newkey rsa:4096 -days 3650 -nodes \
  -keyout /etc/mysql/ssl/server-key.pem -out /etc/mysql/ssl/server-req.pem \
  -subj "/CN=localhost"

# Sign server certificate with CA
openssl x509 -req -in /etc/mysql/ssl/server-req.pem -days 3650 \
  -CA /etc/mysql/ssl/ca-cert.pem -CAkey /etc/mysql/ssl/ca-key.pem -CAcreateserial \
  -out /etc/mysql/ssl/server-cert.pem -extensions v3_req -extfile <(cat <<'EOFSSL'
[v3_req]
subjectAltName = DNS:localhost,IP:127.0.0.1
EOFSSL
)

# Generate client certificate
openssl req -newkey rsa:4096 -days 3650 -nodes \
  -keyout /etc/mysql/ssl/client-key.pem -out /etc/mysql/ssl/client-req.pem \
  -subj "/CN=localhost"

# Sign client certificate with CA
openssl x509 -req -in /etc/mysql/ssl/client-req.pem -days 3650 \
  -CA /etc/mysql/ssl/ca-cert.pem -CAkey /etc/mysql/ssl/ca-key.pem -CAcreateserial \
  -out /etc/mysql/ssl/client-cert.pem -extensions v3_req -extfile <(cat <<'EOFSSL'
[v3_req]
subjectAltName = DNS:localhost,IP:127.0.0.1
EOFSSL
)

# Set proper permissions
chmod 644 /etc/mysql/ssl/ca-cert.pem /etc/mysql/ssl/server-cert.pem /etc/mysql/ssl/client-cert.pem
chmod 600 /etc/mysql/ssl/ca-key.pem /etc/mysql/ssl/server-key.pem /etc/mysql/ssl/client-key.pem

# Check if mysql user exists, if so set ownership
if id mysql > /dev/null 2>&1; then
    chown mysql:mysql /etc/mysql/ssl/ca-cert.pem /etc/mysql/ssl/server-cert.pem /etc/mysql/ssl/server-key.pem
fi

# Create MariaDB TLS configuration
cat > /etc/mysql/mariadb.conf.d/99-tls.cnf <<'EOL'
[mysqld]
ssl_ca=/etc/mysql/ssl/ca-cert.pem
ssl_cert=/etc/mysql/ssl/server-cert.pem
ssl_key=/etc/mysql/ssl/server-key.pem
require_secure_transport=OFF
EOL

echo "TLS certificates generated and MariaDB configured for TLS"

localedef -i en_US -c -f UTF-8 -A /usr/share/locale/locale.alias en_US.UTF-8

echo "install python virtual env"
apt-get install -y python3-venv
python3 -m venv /.venv
source /.venv/bin/activate

echo "install robot and dependencies"
/.venv/bin/pip3 install -U robotframework robotframework-databaselibrary robotframework-httpctrl robotframework-examples pymysql python-dateutil psutil
/.venv/bin/pip3 install grpcio grpcio_tools py-cpuinfo cython gitpython boto3 robotframework-requests PyJWT

cd /tmp/collect

.github/scripts/collect-prepare-test-robot.sh mariadb

apt-get remove -y gcc g++ python3-dev
apt-get autoremove -y

apt-get clean

EOF

# Set TLS environment variables that persist in the container
ENV DB_SSL_ENABLED="true"
ENV DB_SSL_CA="/etc/mysql/ssl/ca-cert.pem"
ENV DB_SSL_CERT="/etc/mysql/ssl/client-cert.pem"
ENV DB_SSL_KEY="/etc/mysql/ssl/client-key.pem"
ENV DB_TLS_VERSION="TLSv1.3"

