ARG nodeVersion=26
FROM node:$nodeVersion-alpine

RUN apk update && apk upgrade --no-cache

WORKDIR /
ENV OPENSSL_VALIDATED_VERSION=3.1.2
ENV OPENSSL_VERSION=3.5.5

RUN apk add --no-cache --virtual .build-deps make gcc libgcc musl-dev linux-headers perl vim \
    && wget https://www.openssl.org/source/openssl-${OPENSSL_VALIDATED_VERSION}.tar.gz \
    && tar -xf openssl-${OPENSSL_VALIDATED_VERSION}.tar.gz \
    && cd openssl-${OPENSSL_VALIDATED_VERSION} \
    && ./Configure --prefix=/usr/local shared enable-fips enable-ec_nistp_64_gcc_128 \
    && make -j8 > make.log \
    && cd .. \
    && wget https://www.openssl.org/source/openssl-${OPENSSL_VERSION}.tar.gz \
    && tar -xf openssl-${OPENSSL_VERSION}.tar.gz \
    && cd openssl-${OPENSSL_VERSION} \
    && ./Configure --prefix=/usr/local shared enable-fips enable-ec_nistp_64_gcc_128 \
    && make -j8 > make.log \
    && cp ../openssl-${OPENSSL_VALIDATED_VERSION}/providers/fips.so providers/. \
    && cp ../openssl-${OPENSSL_VALIDATED_VERSION}/providers/fipsmodule.cnf providers/. \
    && make install > makeinstall.log \
    && cd .. \
    && cd openssl-${OPENSSL_VERSION} \
    && ./util/wrap.pl -fips apps/openssl list -provider-path providers -provider fips -providers \
    && apk del .build-deps make gcc libgcc musl-dev linux-headers perl vim \
    && cd .. && rm -rf openssl-${OPENSSL_VERSION}.tar.gz openssl-${OPENSSL_VERSION} openssl-${OPENSSL_VALIDATED_VERSION}.tar.gz openssl-${OPENSSL_VALIDATED_VERSION}

RUN echo "nodejs_conf = nodejs_init" >> /etc/ssl/nodejs.cnf && \
echo ".include /usr/local/ssl/fipsmodule.cnf" >> /etc/ssl/nodejs.cnf && \
echo "[nodejs_init]" >> /etc/ssl/nodejs.cnf && \
echo "providers = provider_sect" >> /etc/ssl/nodejs.cnf && \
echo "[provider_sect]" >> /etc/ssl/nodejs.cnf && \
echo "default = default_sect" >> /etc/ssl/nodejs.cnf && \
echo "fips = fips_sect" >> /etc/ssl/nodejs.cnf && \
echo "[default_sect]" >> /etc/ssl/nodejs.cnf && \
echo "activate = 1" >> /etc/ssl/nodejs.cnf

ENV OPENSSL_FIPS=1
ENV OPENSSL_CONF=/etc/ssl/nodejs.cnf
# OPENSSL_MODULES path varies by architecture (lib64 on amd64, lib on arm64)
RUN OSSL_MOD=$(find /usr/local -name 'ossl-modules' -type d | head -1) && \
    ln -sfn "$OSSL_MOD" /usr/local/ossl-modules
ENV OPENSSL_MODULES=/usr/local/ossl-modules

RUN openssl version -d -a
RUN node --force-fips -e "console.log('Node.js is running with FIPS:', process.versions.openssl, process.versions.node);"

RUN npm upgrade --global --production --omit=dev

USER 1000:1000
WORKDIR /app
RUN chown 1000:1000 . -R
COPY --chown=1000:1000 package.json ./

RUN npm update && \
npm install --production --omit=dev && \
npm upgrade --production --omit=dev --save && \
(npm audit --production --omit=dev --fix || true) && \
chown 1000:1000 node_modules -R

COPY --chown=1000:1000 src src
COPY --chown=1000:1000 ca.crt cass.crt cass.key copyright.txt client.key client.crt ./

RUN mkdir /app/etc
RUN chown 1000:1000 /app/etc

ARG TEST=false
RUN if [ "$TEST" = "true" ] ; then export PORT=8082 && export CASS_LOOPBACK=http://localhost:8082/api/ && npm i && npm run mochaDev && npm ci --production --omit=dev ; fi
RUN if [ "$TEST" = "true" ] ; then export PORT=8082 && export CASS_LOOPBACK=https://localhost:8082/api/ && npm i && npm run mochaDevHttps && npm ci --production --omit=dev ; fi
RUN rm -f client.key client.crt

EXPOSE 80
ENTRYPOINT [ "node", "--force-fips", "./src/main/server.js" ]