# ─────────────────────────────────────────────────────────────────────────────
# AEGIS — All-tools Docker image
#
# Base: Kali rolling (ships 600+ pentest tools via apt; we add the rest)
# Layers are ordered so the most stable parts are cached longest.
#
# Build:  docker build -t aegis-pentest:latest .
# Run:    docker run --rm -it -e ANTHROPIC_API_KEY=$ANTHROPIC_API_KEY \
#           -v $(pwd)/engagements:/engagements aegis-pentest:latest
# ─────────────────────────────────────────────────────────────────────────────
FROM kalilinux/kali-rolling:latest

LABEL maintainer="Majd Bnat <hey@majdb.com>"
LABEL description="AEGIS — Adaptive Engagement & Generic Inspection Scanner with full toolchain"
LABEL version="0.9.1"

# ── Environment ───────────────────────────────────────────────────────────────
ENV DEBIAN_FRONTEND=noninteractive \
    GOPATH=/root/go \
    GOROOT=/usr/local/go \
    PATH="/root/go/bin:/root/.local/bin:/usr/local/go/bin:$PATH" \
    GONOSUMDB="*" \
    GOFLAGS="-mod=mod" \
    PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1 \
    PIP_BREAK_SYSTEM_PACKAGES=1

# ── 1. System packages & Kali pentest meta-packages ──────────────────────────
# Step 1a: Essential build/runtime tools — must succeed
RUN apt-get update -qq && apt-get install -y --no-install-recommends \
    curl wget git zip unzip tar ca-certificates gnupg lsb-release \
    build-essential gcc g++ make cmake pkg-config libssl-dev zlib1g-dev \
    python3 python3-pip python3-venv python3-dev \
    ruby ruby-dev \
    perl libwww-perl \
    nodejs npm \
    cargo rustc \
    nmap dnsutils whois netcat-openbsd tcpdump iputils-ping net-tools \
    && apt-get clean && rm -rf /var/lib/apt/lists/*

# Step 1b: pipx (may have a different package name across distros)
RUN pip3 install pipx --break-system-packages 2>/dev/null || apt-get install -y pipx || true

# Step 1c: Kali pentest packages — optional, skip failures gracefully
RUN apt-get update -qq && \
    apt-get install -y --no-install-recommends \
        masscan hydra sqlmap nikto whatweb sslscan feroxbuster wfuzz \
        gobuster dirb naabu wafw00f \
        smbmap enum4linux snmpcheck wpscan sslyze && \
    apt-get install -y --no-install-recommends \
        nuclei katana gospider hakrawler \
        dalfox crlfuzz commix theharvester \
        dnsrecon dnstwist fierce recon-ng semgrep 2>/dev/null || true && \
    apt-get clean && rm -rf /var/lib/apt/lists/*

# ── 2. Go toolchain ───────────────────────────────────────────────────────────
RUN GO_VERSION=1.22.4 && \
    curl -fsSL "https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz" \
    | tar -xz -C /usr/local && \
    go version

# ── 3. Go-based tools — each on its own layer so failures are isolated ────────
RUN go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest || true
RUN go install github.com/projectdiscovery/httpx/cmd/httpx@latest || true
RUN go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest || true
RUN go install github.com/projectdiscovery/naabu/v2/cmd/naabu@latest || true
RUN go install github.com/projectdiscovery/dnsx/cmd/dnsx@latest || true
RUN go install github.com/projectdiscovery/katana/cmd/katana@latest || true
RUN go install github.com/projectdiscovery/alterx/cmd/alterx@latest || true
RUN go install github.com/projectdiscovery/shuffledns/cmd/shuffledns@latest || true
RUN go install github.com/projectdiscovery/cdncheck/cmd/cdncheck@latest || true
RUN go install github.com/projectdiscovery/tlsx/cmd/tlsx@latest || true
RUN go install github.com/projectdiscovery/asnmap/cmd/asnmap@latest || true
RUN go install github.com/projectdiscovery/uncover/cmd/uncover@latest || true
RUN go install github.com/ffuf/ffuf/v2@latest || true
RUN go install github.com/OJ/gobuster/v3@latest || true
RUN go install github.com/tomnomnom/assetfinder@latest || true
RUN go install github.com/tomnomnom/waybackurls@latest || true
RUN go install github.com/tomnomnom/httprobe@latest || true
RUN go install github.com/tomnomnom/meg@latest || true
RUN go install github.com/lc/gau/v2/cmd/gau@latest || true
RUN go install github.com/hakluke/hakrawler@latest || true
RUN go install github.com/jaeles-project/gospider@latest || true
RUN go install github.com/003random/getJS@latest || true
RUN go install github.com/hahwul/dalfox/v2@latest || true
RUN go install github.com/Emoe/kxss@latest || true
RUN go install github.com/dwisiswant0/crlfuzz/cmd/crlfuzz@latest || true
RUN go install github.com/haccer/subjack@latest || true
RUN go install github.com/PentestPad/subzy@latest || true
RUN go install github.com/d3mondev/puredns/v2@latest || true
RUN go install github.com/sensepost/gowitness@latest || true
RUN go install github.com/BishopFox/cloudfox@latest || true
RUN go install github.com/sa7mon/s3scanner@latest || true

# kiterunner (non-standard module path — binary named kiterunner)
RUN git clone --depth=1 https://github.com/assetnote/kiterunner.git /tmp/kr && \
    cd /tmp/kr && \
    (go build -o /root/go/bin/kiterunner ./cmd/kiterunner/... 2>/dev/null || \
     go build -o /root/go/bin/kiterunner ./cmd/... 2>/dev/null || \
     go build -o /root/go/bin/kiterunner . 2>/dev/null || true) && \
    rm -rf /tmp/kr

# ── 4. Binary releases (trivy, grype, syft, findomain, massdns) ──────────────
RUN curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh \
      | sh -s -- -b /usr/local/bin && \
    curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh \
      | sh -s -- -b /usr/local/bin && \
    curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh \
      | sh -s -- -b /usr/local/bin && \
    curl -sL https://github.com/Findomain/Findomain/releases/latest/download/findomain-linux.zip \
      -o /tmp/findomain.zip && unzip -o /tmp/findomain.zip -d /usr/local/bin/ && \
    chmod +x /usr/local/bin/findomain && rm /tmp/findomain.zip

# massdns (build from source — most reliable)
RUN git clone --depth=1 https://github.com/blechschmidt/massdns.git /tmp/massdns && \
    make -C /tmp/massdns && cp /tmp/massdns/bin/massdns /usr/local/bin/ && \
    rm -rf /tmp/massdns

# ── 5. Python tools via pipx ──────────────────────────────────────────────────
RUN pipx ensurepath && \
    pipx install arjun && \
    pipx install wafw00f && \
    pipx install sslyze && \
    pipx install dnstwist && \
    pipx install dnsrecon && \
    pipx install xsstrike && \
    pipx install dirsearch && \
    pipx install bbot && \
    pipx install droopescan && \
    pipx install smbmap && \
    pipx install semgrep && \
    pipx install trufflehog && \
    pipx install wapiti3 && \
    pipx install shodan && \
    pipx install paramspider \
        --pip-args="git+https://github.com/devanshbatham/ParamSpider.git" \
        2>/dev/null || pipx install git+https://github.com/devanshbatham/ParamSpider.git || true && \
    pipx install commix \
        --pip-args="git+https://github.com/commixproject/commix.git" \
        2>/dev/null || pipx install git+https://github.com/commixproject/commix.git || true

# ── 6. Git-cloned tools (no clean PyPI/go package) ───────────────────────────
RUN mkdir -p /opt/aegis-tools

# sstimap
RUN git clone --depth=1 https://github.com/vladko312/SSTImap.git /opt/aegis-tools/SSTImap && \
    python3 -m venv /opt/aegis-tools/SSTImap/.venv && \
    /opt/aegis-tools/SSTImap/.venv/bin/pip install -r /opt/aegis-tools/SSTImap/requirements.txt -q && \
    printf '#!/bin/bash\n/opt/aegis-tools/SSTImap/.venv/bin/python /opt/aegis-tools/SSTImap/sstimap.py "$@"\n' \
      > /usr/local/bin/sstimap && chmod +x /usr/local/bin/sstimap

# NoSQLMap
RUN git clone --depth=1 https://github.com/codingo/NoSQLMap.git /opt/aegis-tools/NoSQLMap && \
    printf '#!/bin/bash\npython3 /opt/aegis-tools/NoSQLMap/nosqlmap.py "$@"\n' \
      > /usr/local/bin/nosqlmap && chmod +x /usr/local/bin/nosqlmap

# CMSeeK
RUN git clone --depth=1 https://github.com/Tuhinshubhra/CMSeeK.git /opt/aegis-tools/CMSeeK && \
    printf '#!/bin/bash\npython3 /opt/aegis-tools/CMSeeK/cmseek.py "$@"\n' \
      > /usr/local/bin/cmseek && chmod +x /usr/local/bin/cmseek

# Corsy
RUN git clone --depth=1 https://github.com/s0md3v/Corsy.git /opt/aegis-tools/Corsy && \
    pip3 install requests tld -q && \
    printf '#!/bin/bash\npython3 /opt/aegis-tools/Corsy/corsy.py "$@"\n' \
      > /usr/local/bin/corsy && chmod +x /usr/local/bin/corsy

# LinkFinder
RUN git clone --depth=1 https://github.com/GerbenJavado/LinkFinder.git /opt/aegis-tools/LinkFinder && \
    pip3 install jsbeautifier argparse -q && \
    printf '#!/bin/bash\npython3 /opt/aegis-tools/LinkFinder/linkfinder.py "$@"\n' \
      > /usr/local/bin/linkfinder && chmod +x /usr/local/bin/linkfinder

# SecretFinder
RUN git clone --depth=1 https://github.com/m4ll0k/SecretFinder.git /opt/aegis-tools/SecretFinder && \
    printf '#!/bin/bash\npython3 /opt/aegis-tools/SecretFinder/SecretFinder.py "$@"\n' \
      > /usr/local/bin/secretfinder && chmod +x /usr/local/bin/secretfinder

# jwt_tool
RUN git clone --depth=1 https://github.com/ticarpi/jwt_tool.git /opt/aegis-tools/jwt_tool && \
    pip3 install termcolor cprint pycryptodomex requests -q && \
    printf '#!/bin/bash\npython3 /opt/aegis-tools/jwt_tool/jwt_tool.py "$@"\n' \
      > /usr/local/bin/jwt_tool && chmod +x /usr/local/bin/jwt_tool

# smuggler
RUN git clone --depth=1 https://github.com/defparam/smuggler.git /opt/aegis-tools/smuggler && \
    printf '#!/bin/bash\npython3 /opt/aegis-tools/smuggler/smuggler.py "$@"\n' \
      > /usr/local/bin/smuggler && chmod +x /usr/local/bin/smuggler

# h2csmuggler
RUN git clone --depth=1 https://github.com/BishopFox/h2csmuggler.git /opt/aegis-tools/h2csmuggler && \
    pip3 install h2 -q && \
    printf '#!/bin/bash\npython3 /opt/aegis-tools/h2csmuggler/h2csmuggler.py "$@"\n' \
      > /usr/local/bin/h2csmuggler && chmod +x /usr/local/bin/h2csmuggler

# theHarvester
RUN git clone --depth=1 https://github.com/laramies/theHarvester.git /opt/aegis-tools/theHarvester && \
    python3 -m venv /opt/aegis-tools/theHarvester/.venv && \
    /opt/aegis-tools/theHarvester/.venv/bin/pip install -e /opt/aegis-tools/theHarvester -q && \
    printf '#!/bin/bash\n/opt/aegis-tools/theHarvester/.venv/bin/theHarvester "$@"\n' \
      > /usr/local/bin/theharvester && chmod +x /usr/local/bin/theharvester

# graphify (AEGIS source-code intel)
RUN pip3 install graphifyy -q 2>/dev/null || true

# graphql-cop
RUN git clone --depth=1 https://github.com/dolevf/graphql-cop.git /opt/aegis-tools/graphql-cop && \
    python3 -m venv /opt/aegis-tools/graphql-cop/.venv && \
    /opt/aegis-tools/graphql-cop/.venv/bin/pip install -r /opt/aegis-tools/graphql-cop/requirements.txt -q && \
    printf '#!/bin/bash\n/opt/aegis-tools/graphql-cop/.venv/bin/python3 /opt/aegis-tools/graphql-cop/graphql-cop.py "$@"\n' \
      > /usr/local/bin/graphql-cop && chmod +x /usr/local/bin/graphql-cop

# websocat (cargo)
RUN cargo install websocat 2>/dev/null || true

# ── 7. npm tools ──────────────────────────────────────────────────────────────
RUN npm install -g retire 2>/dev/null || true
# Claude Code CLI — enables claude-code backend inside the container
RUN npm install -g @anthropic-ai/claude-code 2>/dev/null || true

# ── 8. Nuclei templates ───────────────────────────────────────────────────────
RUN nuclei -update-templates 2>/dev/null || true

# ── 9. Python runtime + AEGIS itself ─────────────────────────────────────────
WORKDIR /opt/aegis
COPY . .

# Install AEGIS and all Python deps
RUN pip3 install -e . -q

# ── 10. Final verification ────────────────────────────────────────────────────
RUN /bin/bash -c ' \
    echo "=== AEGIS Tool Inventory ===" && \
    for t in nmap nuclei httpx subfinder ffuf gobuster feroxbuster nikto sqlmap \
             katana gospider hakrawler dalfox crlfuzz xsstrike sstimap commix \
             trivy grype syft massdns dnsx alterx shuffledns puredns \
             hydra masscan wfuzz theharvester bbot semgrep trufflehog \
             wafw00f sslyze dnstwist dnsrecon subzy subjack smbmap; do \
        which $t 2>/dev/null && echo "  ✓ $t" || echo "  ✗ $t (missing)"; \
    done && echo "=== Done ==="'

# ── Runtime ───────────────────────────────────────────────────────────────────
RUN mkdir -p /engagements /root/.config/aegis

# Default config
RUN cat > /root/.config/aegis/config.toml << 'TOML'
[api]
anthropic_api_key_env = "ANTHROPIC_API_KEY"

[models]
nano = "claude-haiku-4-5-20251001"
main = "claude-sonnet-4-6"
deep = "claude-opus-4-7"

[budgets]
tokens_per_phase       = 30000
tokens_per_engagement  = 200000
usd_per_engagement     = 5.00
wall_time_per_phase_sec = 1800

[tooling]
docker_isolate         = false
default_rate_limit_rps = 10

[reporting]
default_format   = "html"
include_audit_log = true
TOML

VOLUME ["/engagements"]
WORKDIR /engagements

ENTRYPOINT ["aegis"]
CMD ["--help"]
