FROM harbor.cta-observatory.org/proxy_cache/almalinux:9

ARG CTADIRAC_VERSION="3.2.0"
ARG RUCIO_VERSION="41.2.0"
ARG RUCIO_POLICY_VERSION="0.5.0"
ARG USERID=1000
ARG GROUPID=1000

ENV DIRAC_DIR=/home/dirac

RUN \
  dnf install -y epel-release https://cvmrepo.s3.cern.ch/cvmrepo/yum/cvmfs-release-latest.noarch.rpm \
  && dnf install -y nodejs apptainer cvmfs inotify-tools openssh-clients openssh-server bzip2 git \
  && dnf clean all -y \
  && cvmfs_config setup \
  && cd /etc/ssh && ssh-keygen -A

COPY default.local /etc/cvmfs/default.local
COPY sw.ctao.dpps.test.conf containers.ctao.dpps.test.conf /etc/cvmfs/config.d/
COPY --chmod=600 --chown=root:root 100-sshd_only_public_key_auth.conf /etc/ssh/sshd_config.d/100-sshd_only_public_key_auth.conf

RUN mkdir -p /etc/grid-security/certificates /etc/grid-security/vomsdir/ctao.dpps.test /etc/grid-security/vomses \
  && touch /etc/grid-security/vomses/ctao.dpps.test \
  && if getent group ${GROUPID}; then \
    groupmod --new-name dirac $(getent group ${GROUPID} | cut -d: -f1); \
  else \
    groupadd --gid ${GROUPID} dirac;\
  fi \
  && adduser --uid ${USERID} --gid dirac -s /bin/bash -d /home/dirac dirac \
  && mkdir -p /home/dirac/.ssh /home/dirac/data /ctadirac && chown -R dirac:dirac /home/dirac /ctadirac \
  && curl --proto "=https" -sSfL https://micro.mamba.pm/api/micromamba/$(uname)-$(uname -m)/latest | tar -xvj -C "/usr/local/bin" --strip-components=1 bin/micromamba

# install as dirac user
USER dirac

# Install DIRAC client
# only diracgrid provides mysqlclient 2.0.3 for python >=3.12
RUN \
  DIRACOS="/ctadirac/${CTADIRAC_VERSION}/$(uname -s)-$(uname -m)" \
  && micromamba create -y \
    -p "$DIRACOS" \
    -c conda-forge -c diracgrid \
    python=3.12 \
    dirac-grid 'diracx-api<0.2.0' 'diracx-core<0.2.0' \
    'mysqlclient >=2.0.3,<2.1' \
    "rucio-clients=${RUCIO_VERSION}" \
  && ${DIRACOS}/bin/pip install --no-cache-dir CTADIRAC[pilot]==${CTADIRAC_VERSION} \
  && ${DIRACOS}/bin/pip install --no-cache-dir ctao-bdms-rucio-policy==${RUCIO_POLICY_VERSION} \
  # creating diracosrc
  && { \
  echo "export DIRACOS=$DIRACOS"; \
  echo "export MAMBA_ROOT_PREFIX=$DIRACOS"; \
  echo "eval $(micromamba shell hook --shell bash)"; \
  echo "micromamba activate $DIRACOS"; \
  echo "export X509_CERT_DIR=/etc/grid-security/certificates"; \
  echo "export X509_VOMSES=/etc/grid-security/vomses"; \
  echo "export X509_VOMS_DIR=/etc/grid-security/vomsdir"; \
  } > ${DIRACOS}/diracosrc \
  && chmod 755 ${DIRACOS}/diracosrc \
  && ln -s ${DIRACOS} /ctadirac/pro

USER root

COPY Entrypoint.sh /Entrypoint.sh
CMD ["/Entrypoint.sh"]
