# Builds mod_authn_totp with the project's CMake build in a build stage, then
# copies the produced DSO into the final httpd runtime image with a sample user
# config and a protected test site. The user secret below MUST match
# generate_totp.pl.
FROM httpd:2.4.67 AS build

# build deps for the CMake build: cmake + apache2-dev (apxs, APR/APR-util dev,
# httpd headers; empties the apt lists to keep the stage lean).
RUN apt-get update && apt-get install -y --no-install-recommends \
        cmake \
        apache2-dev \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /src

# full project tree (module + core + test harness); CMake builds from source
COPY . .

# configure + build the module DSO only (no testsuite needed at runtime)
RUN cmake -S . -B build -DCMAKE_BUILD_TYPE=Release \
    && cmake --build build --target mod_authn_totp

# runtime image
FROM httpd:2.4.67

# test-only sample TOTP user config: secret base32 TVANQ4XMI2TH4ISBFJXZMD67BU
# (test fixture secret — publicly known, do NOT deploy; runtime user file: test/docker/totp/users/testuser)
RUN mkdir -p /etc/totp-auth-tokens /etc/totp-auth-state && \
    chown -R www-data:www-data /etc/totp-auth-tokens /etc/totp-auth-state && \
    chmod 755 /etc/totp-auth-tokens

# copy the module DSO built by CMake in the build stage (PREFIX "" -> the
# artifact is build/mod_authn_totp.so, not libmod_authn_totp.so)
COPY --from=build /src/build/mod_authn_totp.so \
     /usr/local/apache2/modules/mod_authn_totp.so

# sample Google-Authenticator-style user config ("testuser") bound to the secret
# (base32 secret, unused here; scratch code follows the user format)
COPY test/docker/totp/users/testuser /etc/totp-auth-tokens/testuser
RUN chown root:www-data /etc/totp-auth-tokens/testuser && chmod 640 /etc/totp-auth-tokens/testuser

# site config: enable module, protect a directory with totp Basic auth
COPY test/docker/totp/site.conf /usr/local/apache2/conf/extra/totp-site.conf
RUN echo 'Include conf/extra/totp-site.conf' >> /usr/local/apache2/conf/httpd.conf

# "It works!" page
COPY test/docker/totp/htdocs/protected/index.html /usr/local/apache2/htdocs/protected/index.html

EXPOSE 80
