# koopa-nym — nym-node (nym.com mixnet / NymVPN network)
# Fetch binary on host first (see scripts/nym/build.sh), then:
#   podman build -t localhost/koopa-nym:latest -f Containerfile .
#
# Process runs as uid/gid 1000 (not root). With rootless podman use
# userns=keep-id so host ./data owned by hernani stays writable (see compose.yml).
FROM docker.io/library/debian:bookworm-slim

ENV DEBIAN_FRONTEND=noninteractive \
    NYM_HOME=/var/lib/nym \
    PATH=/usr/local/bin:$PATH \
    HOME=/var/lib/nym

RUN apt-get update \
 && apt-get install -y --no-install-recommends \
      ca-certificates libssl3 \
 && rm -rf /var/lib/apt/lists/* \
 && groupadd --gid 1000 nym \
 && useradd --uid 1000 --gid 1000 --home-dir /var/lib/nym --shell /usr/sbin/nologin nym \
 && mkdir -p /var/lib/nym /usr/local/bin \
 && chown -R nym:nym /var/lib/nym

# Pre-downloaded on host into build context as ./nym-node
COPY nym-node /usr/local/bin/nym-node
RUN chmod 755 /usr/local/bin/nym-node \
 && /usr/local/bin/nym-node --version || true

COPY entrypoint.sh /usr/local/bin/nym-entrypoint
RUN chmod 755 /usr/local/bin/nym-entrypoint

EXPOSE 1789/udp 1789/tcp 1790 8080 9000 51822/udp
WORKDIR /var/lib/nym
USER nym:nym
ENTRYPOINT ["/usr/local/bin/nym-entrypoint"]