FROM ubuntu:22.04

ENV DEBIAN_FRONTEND=noninteractive

RUN apt-get update \
    && apt-get install -y --no-install-recommends \
       bash iptables iproute2 iputils-ping python3 openssh-server sudo \
    && rm -rf /var/lib/apt/lists/*

RUN useradd -ms /bin/bash steve \
    && echo "steve:pass123" | chpasswd

WORKDIR /opt/router

COPY entrypoint.sh /opt/router/entrypoint.sh
COPY router_api.py /opt/router/router_api.py
COPY server_services.py /opt/router/server_services.py
COPY check_rule.py /opt/router/check_rule.py
COPY iptables-wrapper.sh /usr/local/bin/iptables

RUN chmod 755 \
    /opt/router/entrypoint.sh \
    /opt/router/router_api.py \
    /opt/router/server_services.py \
    /opt/router/check_rule.py \
    /usr/local/bin/iptables

RUN sed -ri 's/^#?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config \
    && sed -ri 's/^#?PasswordAuthentication.*/PasswordAuthentication yes/' /etc/ssh/sshd_config \
    && sed -ri 's|^#?PrintMotd.*|PrintMotd no|' /etc/ssh/sshd_config \
    && sed -ri 's|^#?UsePAM.*|UsePAM yes|' /etc/ssh/sshd_config \
    && sed -ri 's|^#?PrintLastLog.*|PrintLastLog no|' /etc/ssh/sshd_config || true \
    && printf '\nBanner /etc/issue.net\n' >> /etc/ssh/sshd_config \
    && sed -ri 's/^(session\s+optional\s+pam_motd\.so.*)$/# \1/' /etc/pam.d/sshd

RUN chmod -x /etc/update-motd.d/* 2>/dev/null || true
RUN mkdir -p /run/sshd

RUN update-alternatives --set iptables /usr/sbin/iptables-legacy \
    && update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy \
    && printf 'steve ALL=(root) NOPASSWD: /usr/sbin/iptables-legacy\n' > /etc/sudoers.d/network-11 \
    && chmod 440 /etc/sudoers.d/network-11

EXPOSE 22 8081

ENTRYPOINT ["/opt/router/entrypoint.sh"]
