ARG PENPOT_VERSION
FROM penpotapp/frontend:${PENPOT_VERSION}
ARG COCKPIT_HOST
COPY nginx-security-headers.conf /etc/nginx/nginx-security-headers.conf
COPY gate/http.conf /etc/nginx/overrides/http.d/apex-gate.conf
COPY gate/server.conf /etc/nginx/overrides/server.d/apex-gate.conf
COPY gate/assets.conf /etc/nginx/overrides/assets.d/apex-gate.conf
COPY gate/login-guard.js /tmp/apex-login-guard.js
# config.js loads before the app and the entrypoint only edits lines in place, so the guard survives startup.
RUN cat /tmp/apex-login-guard.js >> /var/www/app/js/config.js
# The gate talks to one cockpit; its host is an install fact, baked at build time.
RUN test -n "${COCKPIT_HOST}" \
 && sed -i "s#__APEX_COCKPIT_HOST__#${COCKPIT_HOST}#g" /etc/nginx/nginx-security-headers.conf /etc/nginx/overrides/server.d/apex-gate.conf \
 && ! grep -r "__APEX_COCKPIT_HOST__" /etc/nginx
