FROM debian:bookworm-slim AS builder

ARG VPN_URL
ENV VPN_URL=${VPN_URL}

# Build stage: try to build from source if available (fake-getlogin, fake-hwaddr are simple C programs in this repo)
RUN set -eux; \
    apt-get update; \
    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
      build-essential ca-certificates wget curl git xz-utils; \
    rm -rf /var/lib/apt/lists/*

# Build small helper utilities from source if present
COPY ./fake-getlogin ./fake-getlogin
COPY ./fake-hwaddr ./fake-hwaddr
WORKDIR /fake-getlogin
RUN if [ -f Makefile ]; then make; fi
WORKDIR /fake-hwaddr
RUN if [ -f Makefile ]; then make; fi

# Collect built artifacts for the runtime image
RUN mkdir -p /results/fake-getlogin /results/fake-hwaddr
RUN if [ -f fake-getlogin/fake-getlogin ]; then cp fake-getlogin/fake-getlogin /results/fake-getlogin/; fi
RUN if [ -f fake-hwaddr/fake-hwaddr ]; then cp fake-hwaddr/fake-hwaddr /results/fake-hwaddr/; fi

FROM debian:bookworm-slim

ARG VPN_URL
ENV VPN_URL=${VPN_URL}

# Runtime dependencies
RUN set -eux; \
    apt-get update; \
    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
      libx11-xcb1 libnss3 libasound2 iptables xclip libxtst6 \
      dante-server tigervnc-standalone-server tigervnc-tools psmisc flwm x11-utils \
      busybox ca-certificates fonts-wqy-microhei socat wget iproute2 tinyproxy-bin libxss1 \
      && rm -rf /var/lib/apt/lists/*

# Copy built artifacts and runtime assets
COPY --from=builder /results /results
COPY ./docker-root /docker-root

WORKDIR /root

VOLUME /root/ /usr/share/sangfor/EasyConnect/resources/logs/

# Execute start script via absolute path for reliability
CMD ["/docker-root/usr/local/bin/start.sh"]