# koopa-cryptpad — CryptPad on CachyOS base + Node from pacman
# Build on koopa (x86_64):
#   bash ~/koopa-admin-log/scripts/cryptpad/build.sh
#   → localhost/koopa-cryptpad:cachyos
#
# App tree from upstream release tarball (not the official Debian-ish image).

ARG CACHYOS_IMAGE=docker.io/cachyos/cachyos:latest
FROM ${CACHYOS_IMAGE}

ARG CRYPTPAD_VERSION=2025.9.0
ARG CRYPTPAD_URL=https://github.com/cryptpad/cryptpad/archive/refs/tags/${CRYPTPAD_VERSION}.tar.gz

ENV TZ=Europe/Zurich \
    PATH=/usr/local/bin:$PATH \
    CRYPTPAD_HOME=/cryptpad

RUN pacman -Syu --noconfirm --needed \
      bash curl ca-certificates catatonit tar git \
      nodejs npm \
 && pacman -Scc --noconfirm \
 && rm -rf /var/cache/pacman/pkg/* /tmp/*

# npm may block git deps (EALLOWGIT); rewrite git+ssh → https and allow git installs.
RUN curl -fsSL "$CRYPTPAD_URL" -o /tmp/cryptpad.tgz \
 && mkdir -p /cryptpad \
 && tar -xzf /tmp/cryptpad.tgz -C /cryptpad --strip-components=1 \
 && rm -f /tmp/cryptpad.tgz \
 && cd /cryptpad \
 && git config --global url."https://github.com/".insteadOf "ssh://git@github.com/" \
 && git config --global url."https://github.com/".insteadOf "git@github.com:" \
 && git config --global url."https://".insteadOf "git://" \
 && printf 'allow-git=all\nallow-remote=all\n' > /root/.npmrc \
 && (npm ci --omit=dev --allow-git=all --allow-remote=all \
     || npm install --omit=dev --allow-git=all --allow-remote=all) \
 && (npm run install:components || true) \
 && rm -rf /root/.npm /tmp/* /var/cache/pacman/pkg/*

COPY entrypoint.sh /docker-entrypoint.sh
RUN mkdir -p /cryptpad/config /cryptpad/data /cryptpad/datastore /cryptpad/block /cryptpad/blob \
             /cryptpad/blobstage /cryptpad/data/logs
COPY config.example.js /cryptpad/config/config.js
RUN chmod 755 /docker-entrypoint.sh

EXPOSE 3000
WORKDIR /cryptpad
ENTRYPOINT ["/usr/bin/catatonit", "--", "/docker-entrypoint.sh"]