# The OxygenFlow OpenTofu image (oxygenflow#56): OpenTofu and the providers
# the deploy pipelines use, mirrored inside, so `tofu init` needs no
# registry. A job reaches a cloud's API only through allow-listed egress
# (#55); formatting and validation need no network at all.

# Download and check OpenTofu, and mirror the providers, with the tools
# only this stage needs.
FROM debian:bookworm-slim AS fetch
ARG TOFU_VERSION
ARG TOFU_SHA256
RUN apt-get update \
 && apt-get install -y --no-install-recommends ca-certificates curl unzip \
 && rm -rf /var/lib/apt/lists/*
RUN curl -fsSL -o /tmp/tofu.zip \
      "https://github.com/opentofu/opentofu/releases/download/v${TOFU_VERSION}/tofu_${TOFU_VERSION}_linux_amd64.zip" \
 && echo "${TOFU_SHA256}  /tmp/tofu.zip" | sha256sum -c - \
 && unzip -q /tmp/tofu.zip tofu -d /usr/local/bin \
 && rm /tmp/tofu.zip
# The exact provider versions of the pipelines' lock files; `tofu
# providers mirror` checks each package against the registry's signed
# checksums as it downloads it.
COPY mirror.tf /tmp/mirror/
RUN cd /tmp/mirror && tofu providers mirror -platform=linux_amd64 /opt/tofu/mirror

FROM debian:bookworm-slim
RUN apt-get update \
 && apt-get install -y --no-install-recommends ca-certificates \
 && rm -rf /var/lib/apt/lists/*
COPY --from=fetch /usr/local/bin/tofu /usr/local/bin/tofu
COPY --from=fetch /opt/tofu/mirror /opt/tofu/mirror
# Providers come only from the mirror: a job never reaches a registry.
COPY cli.tfrc /etc/tofu/cli.tfrc
ENV TF_CLI_CONFIG_FILE=/etc/tofu/cli.tfrc