ARG BASE_IMAGE=debian:trixie-slim
FROM ${BASE_IMAGE}

ARG DEBIAN_FRONTEND=noninteractive

# Keep the runtime image small: no recommends, docs, man pages or apt cache.
RUN printf '%s\n' \
      'path-exclude=/usr/share/doc/*' \
      'path-exclude=/usr/share/man/*' \
      'path-exclude=/usr/share/info/*' \
      'path-exclude=/usr/share/locale/*' \
      > /etc/dpkg/dpkg.cfg.d/01_nodoc \
    && apt-get update \
    && apt-get install -y --no-install-recommends \
       ca-certificates \
       iproute2 \
       python3 \
       suricata \
       suricata-update \
       tini \
    && suricata --build-info >/dev/null \
    && suricata-update -V \
    && apt-get clean \
    && rm -rf \
       /var/lib/apt/lists/* \
       /var/cache/apt/* \
       /usr/share/doc/* \
       /usr/share/man/* \
       /usr/share/info/* \
       /usr/share/locale/*

WORKDIR /opt/ids

COPY app /opt/ids/app
COPY scripts /opt/ids/scripts
COPY suricata/local.rules /opt/ids/suricata/local.rules

RUN chmod +x /opt/ids/scripts/*.sh \
    && mkdir -p /data /var/log/suricata /var/lib/suricata/rules /run/suricata

ENV PYTHONUNBUFFERED=1 \
    TZSP_BIND=0.0.0.0 \
    TZSP_PORT=37008 \
    TAP_NAME=suritap0 \
    TAP_MTU=9000 \
    WEB_BIND=0.0.0.0 \
    WEB_PORT=8080 \
    DB_PATH=/data/ids.db \
    EVE_PATH=/var/log/suricata/eve.json \
    AUTO_BLOCK=false \
    UPDATE_RULES_ON_START=false

EXPOSE 37008/udp 8080/tcp

ENTRYPOINT ["/usr/bin/tini", "--", "/opt/ids/scripts/entrypoint.sh"]