# --- Stage 1: Build Nginx ---
FROM alpine:3.22 AS builder

ENV NGINX_VERSION=1.29.3

# Build dependencies (the --no-cache has been removed for development reasons add it later after apk add part)
RUN apk add \
    build-base pcre2-dev zlib-dev openssl-dev linux-headers curl gnupg tar

WORKDIR /tmp
# Download and extract Nginx
RUN curl -fSL https://nginx.org/download/nginx-$NGINX_VERSION.tar.gz -o nginx.tar.gz \
    && tar -zxf nginx.tar.gz

WORKDIR /tmp/nginx-$NGINX_VERSION
# Configure Nginx with all required modules
RUN ./configure \
    --prefix=/etc/nginx \
    --sbin-path=/usr/sbin/nginx \
    --modules-path=/usr/lib/nginx/modules \
    --conf-path=/etc/nginx/nginx.conf \
    --error-log-path=/var/log/nginx/error.log \
    --http-log-path=/var/log/nginx/access.log \
    --pid-path=/var/run/nginx.pid \
    --lock-path=/var/run/nginx.lock \
    --with-http_ssl_module \
    --with-http_realip_module \
    --with-http_addition_module \
    --with-http_sub_module \
    --with-http_dav_module \
    --with-http_flv_module \
    --with-http_mp4_module \
    --with-http_gunzip_module \
    --with-http_gzip_static_module \
    --with-http_random_index_module \
    --with-http_secure_link_module \
    --with-http_stub_status_module \
    --with-http_auth_request_module \
    --with-mail \
    --with-mail_ssl_module \
    --with-file-aio \
    --with-threads \
    --with-stream \
    --with-stream_ssl_module \
    --with-stream_realip_module \
    --with-http_slice_module \
    --with-http_v2_module
RUN make -j$(nproc) && make install
RUN rm -rf /tmp/* && rm -rf /var/cache/apk/*

# --- Stage 2: Runtime ---
FROM alpine:3.22

# Runtime dependencies
RUN apk add \
    pcre2 zlib openssl ca-certificates tzdata libcap git
RUN addgroup -S nginx && adduser -D -S -h /var/cache/nginx -s /sbin/nologin -G nginx nginx
RUN mkdir -p /var/cache/nginx /etc/nginx/conf.d /etc/nginx/stream_conf.d /usr/share/nginx/html /var/run
RUN chown -R nginx:nginx /var/cache/nginx /var/run /etc/nginx /usr/share/nginx/html

# Copy dummy html
COPY index.html /var/www/html/index.html

# Copy Nginx from builder
COPY --from=builder /usr/sbin/nginx /usr/sbin/nginx
COPY --from=builder /etc/nginx /etc/nginx
#COPY --from=builder /usr/lib/nginx/modules /usr/lib/nginx/modules

# Default configuration
COPY nginx.conf /etc/nginx/nginx.conf
COPY conf.d/security.conf /etc/nginx/conf.d/security.conf
COPY conf.d/proxy-common.conf /etc/nginx/conf.d/proxy-common.conf
#COPY conf.d/web.conf /etc/nginx/conf.d/web.conf
#COPY conf.d/git.conf /etc/nginx/conf.d/git.conf
#COPY conf.d/mail.conf /etc/nginx/conf.d/mail.conf
#COPY conf.d/media.conf /etc/nginx/conf.d/media.conf
#COPY conf.d/network.conf /etc/nginx/conf.d/network.conf
#COPY conf.d/utils.conf /etc/nginx/conf.d/utils.conf
#COPY conf.d/game.conf /etc/nginx/conf.d/game.conf

# Ports for HTTP/HTTPS + optional mail/TCP/UDP (25 110 143 465 587 993 995) + optional minecraft java/bedrock (25565 19132)
EXPOSE 80 443

# Non-root execution
RUN setcap 'cap_net_bind_service=+ep' /usr/sbin/nginx
USER nginx

STOPSIGNAL SIGTERM

CMD ["nginx", "-g", "daemon off;"]

# Healthcheck
HEALTHCHECK --interval=30s --timeout=3s --retries=3 CMD busybox wget --spider -q http://127.0.0.1:80/ || exit 1