FROM dhi.io/alpine-base:3.23-dev AS base

USER root

RUN apk upgrade --no-cache \
 && apk add --no-cache \
    openssh-server \
    proxychains-ng \
    sudo \
 && addgroup -g 74 sshd \
 && adduser -D -H -u 74 -G sshd -s /sbin/nologin -g "sshd privilege separation" sshd \
 && mkdir -p /var/empty \
 && chmod 755 /var/empty \
 && mkdir -p /tmp \
 && chmod 1777 /tmp

COPY --from=docker.io/tailscale/tailscale:stable /usr/local/bin/tailscaled /usr/local/bin/tailscale /var/runtime/
RUN mkdir -p /var/run && ln -s /tmp/tailscale /var/run/tailscale && \
    mkdir -p /var/cache && ln -s /tmp/tailscale /var/cache/tailscale && \
    mkdir -p /var/lib && ln -s /tmp/tailscale /var/lib/tailscale && \
    mkdir -p /var/task && ln -s /tmp/tailscale /var/task/tailscale

ARG SSH_USER_UID=1000
ARG SSH_USER_GID=1000
RUN addgroup -g ${SSH_USER_GID} ssh-user \
 && adduser -D -s /sbin/nologin -u ${SSH_USER_UID} -G ssh-user ssh-user \
 && passwd -u ssh-user \
 && mkdir -p /home/ssh-user/.ssh \
 && touch /home/ssh-user/.ssh/authorized_keys \
 && chown -R ssh-user:ssh-user /home/ssh-user/.ssh \
 && chmod 600 /home/ssh-user/.ssh/authorized_keys

RUN adduser -D -s /bin/ash ssh-admin \
 && passwd -u ssh-admin \
 && echo "ssh-admin ALL=(ALL) NOPASSWD: /add-public-key.sh,/remove-public-key.sh" >> /etc/sudoers.d/ssh-admin

COPY add-public-key.sh remove-public-key.sh run-jumphost.sh /
COPY sshd_config /etc/ssh/sshd_config.d/jumphost.conf
RUN sed -i -E 's/^socks4.+/socks5 127.0.0.1 1055/' /etc/proxychains/proxychains.conf
EXPOSE 22

CMD ["/run-jumphost.sh"]
