# koopa-tor-relay — Tor non-exit relay on CachyOS (Arch extra/tor)
# Same pattern as koopa-meet-web:cachyos. Rootless: tor user -> uid/gid 1000.
# Recreate: --user 1000:1000 --userns=keep-id  (see README / tor.sh)
ARG CACHYOS_IMAGE=docker.io/cachyos/cachyos:latest
FROM ${CACHYOS_IMAGE}
ENV TZ=Europe/Zurich
RUN pacman -Syu --noconfirm --needed tor nyx ca-certificates \
 && pacman -Scc --noconfirm \
 && rm -rf /var/cache/pacman/pkg/* /tmp/* \
 && mkdir -p /var/lib/tor /var/log/tor \
 && if id tor >/dev/null 2>&1; then \
      groupmod -g 1000 tor 2>/dev/null || true; \
      usermod -u 1000 -g 1000 tor 2>/dev/null || true; \
    elif id debian-tor >/dev/null 2>&1; then \
      groupmod -g 1000 debian-tor; usermod -u 1000 -g 1000 debian-tor; \
    else \
      groupadd -g 1000 tor; useradd -u 1000 -g 1000 -d /var/lib/tor -s /usr/bin/nologin tor; \
    fi \
 && chown -R 1000:1000 /var/lib/tor /var/log/tor \
 && chmod 700 /var/lib/tor
EXPOSE 8080 9051
USER 1000:1000
ENTRYPOINT ["/usr/bin/tor"]
CMD ["-f", "/etc/tor/torrc", "--runasdaemon", "0"]