# The OxygenFlow OpenTofu image (oxygenflow#56): OpenTofu and the providers

# the deploy pipelines use, mirrored inside, so `tofu init` needs no

# registry. A job reaches a cloud's API only through allow-listed egress

# (#55); formatting and validation need no network at all.

# Download and check OpenTofu, and mirror the providers, with the tools

# only this stage needs.

FROM debian:bookworm-slim AS fetch

ARG TOFU_VERSION

ARG TOFU_SHA256

RUN apt-get update \

 && apt-get install -y --no-install-recommends ca-certificates curl unzip \

 && rm -rf /var/lib/apt/lists/*

RUN curl -fsSL -o /tmp/tofu.zip \

      "https://github.com/opentofu/opentofu/releases/download/v${TOFU_VERSION}/tofu_${TOFU_VERSION}_linux_amd64.zip" \

 && echo "${TOFU_SHA256}  /tmp/tofu.zip" | sha256sum -c - \

 && unzip -q /tmp/tofu.zip tofu -d /usr/local/bin \

 && rm /tmp/tofu.zip

# The exact provider versions of the pipelines' lock files; `tofu

# providers mirror` checks each package against the registry's signed

# checksums as it downloads it.

COPY mirror.tf /tmp/mirror/

RUN cd /tmp/mirror && tofu providers mirror -platform=linux_amd64 /opt/tofu/mirror

FROM debian:bookworm-slim

RUN apt-get update \

 && apt-get install -y --no-install-recommends ca-certificates \

 && rm -rf /var/lib/apt/lists/*

COPY --from=fetch /usr/local/bin/tofu /usr/local/bin/tofu

COPY --from=fetch /opt/tofu/mirror /opt/tofu/mirror

# Providers come only from the mirror: a job never reaches a registry.

COPY cli.tfrc /etc/tofu/cli.tfrc

ENV TF_CLI_CONFIG_FILE=/etc/tofu/cli.tfrc