# ==========================================
# STAGE 1: Build Environment (Debian-based)
# ==========================================
FROM debian:bookworm-slim AS builder
ARG TARGETOS
ARG TARGETARCH

# Install build dependencies including Clang and Jemalloc development files
RUN apt-get update && apt-get install -y --no-install-recommends \
    curl git clang llvm make autoconf automake libtool pkg-config \
    libevent-dev libssl-dev libzstd-dev liblzma-dev zlib1g-dev \
    libjemalloc-dev unzip bash ca-certificates \
    && rm -rf /var/lib/apt/lists/*
    
RUN mkdir -p /tmp/kitchen
WORKDIR /tmp/kitchen

# 1. Install latest Go and compile Snowflake Client
RUN ARCH=$(echo ${TARGETARCH} | sed -r 's/^arm$/armv6l/g') && \
    curl -fsSL "https://go.dev/dl/$(curl -s 'https://go.dev/VERSION?m=text' | head -1).${TARGETOS}-${ARCH}.tar.gz" -o go.tar.gz && \
    tar -xzf go.tar.gz && \
    rm go.tar.gz && \
    git clone https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake.git && \
    cd /tmp/kitchen/snowflake/client && \
    /tmp/kitchen/go/bin/go build -ldflags="-s -w" -o /usr/local/bin/snowflake-client

# 2. Compile Tor using Clang, optimized for Orange Pi 5 (RK3588 Cortex-A76) with Jemalloc
WORKDIR /tmp/kitchen
RUN git clone https://gitlab.torproject.org/tpo/core/tor.git && \
    cd /tmp/kitchen/tor && \
    ./autogen.sh && \
    CC=clang \
    AR=llvm-ar \
    RANLIB=llvm-ranlib \
    CFLAGS="-O3 -march=armv8.2-a+fp16+rcpc+dotprod+crypto -mcpu=cortex-a76+crypto -flto=thin -fdata-sections -ffunction-sections -fomit-frame-pointer" \
    LDFLAGS="-flto=thin -Wl,--gc-sections -Wl,-O1 -Wl,--as-needed" \
    ./configure \
        --enable-lzma \
        --enable-zstd \
        --with-malloc=jemalloc \
        --disable-gcc-hardening \
        --disable-linker-hardening \
        --disable-manpage \
        --disable-html-manual \
        --disable-asciidoc \
        --disable-unittests && \
    make -j8 && \
    cp /tmp/kitchen/tor/src/app/tor /usr/local/bin/

# ==========================================
# STAGE 2: Final Runtime Environment (Debian)
# ==========================================
FROM debian:bookworm-slim
LABEL maintainer="Wizardry and Steamworks <wizardry.steamworks@outlook.com>"

# Install runtime dependencies for Tor and Snowflake
# NOTE: 'gcompat' is removed because Debian natively uses glibc, making CheckCircuit fully compatible.
RUN apt-get update && apt-get install -y --no-install-recommends \
    tini \
    expect \
    coreutils \
    bash \
    supervisor \
    netcat-openbsd \
    libevent-2.1-7 \
    libssl3 \
    libzstd1 \
    liblzma5 \
    zlib1g \
    libstdc++6 \
    libjemalloc2 \
    ca-certificates \
    expect \
    && rm -rf /var/lib/apt/lists/*

# Copy binaries built from the builder stage
COPY --from=builder /usr/local/bin/snowflake-client /usr/local/bin/snowflake-client
COPY --from=builder /usr/local/bin/tor /usr/local/bin/tor

# Copy application configuration files
COPY rootfs /

# Define the Docker Healthcheck
RUN chmod +x /usr/local/bin/healthcheck
HEALTHCHECK --interval=30s --timeout=10s --start-period=15s --retries=3 \
  CMD /usr/local/bin/healthcheck

# Configure open ports
EXPOSE 9050 9053

# Bootstrap execution via tini
RUN chmod +x /usr/local/bin/run
ENTRYPOINT [ "/usr/bin/tini", "--" ]
CMD [ "/usr/local/bin/run" ]