# syntax=docker/dockerfile:1.28
FROM scratch AS nginx-files

ADD --link --chown=101:0 https://cs.nginx.com/static/files/plus-10.repo nginx-plus-10.repo
ADD --link --chown=101:0 https://cs.nginx.com/static/files/app-protect-10.repo app-protect-10.repo
ADD --link --chown=101:0 https://cs.nginx.com/static/files/app-protect-dos-10.repo app-protect-dos-10.repo
ADD --link --chown=101:0 https://cs.nginx.com/static/files/dependencies.repo dependencies.repo

FROM redhat/ubi10@sha256:a75ad754aa048d808dd3260243452f8c9a665831d0493b4c9d92f0c88fe2f8c3 AS rpm-build
RUN --mount=type=bind,from=nginx-files,src=nginx-plus-10.repo,target=/tmp/nginx-plus.repo \
    --mount=type=bind,from=nginx-files,src=app-protect-10.repo,target=/tmp/app-protect-10.repo \
    --mount=type=bind,from=nginx-files,src=app-protect-dos-10.repo,target=/tmp/app-protect-dos-10.repo \
    --mount=type=bind,from=nginx-files,src=dependencies.repo,target=/tmp/dependencies.repo \
    --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644,required=false \
    --mount=type=secret,id=nginx-repo.key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644,required=false \
    --mount=type=secret,id=rhel_license,dst=/tmp/rhel_license,mode=0644,required=false \
    mkdir -p /rpms/ \
    && dnf install -y subscription-manager \
    && source /tmp/rhel_license \
    && subscription-manager register --org=${RHEL_ORGANIZATION} --activationkey=${RHEL_ACTIVATION_KEY} \
    && dnf install -y --enablerepo=codeready-builder-for-rhel-10-$(uname -m)-rpms createrepo_c \
    && dnf download --resolve --destdir=/rpms c-ares \
    && rm -rf /rpms/*devel* \
    && if [ "$(arch)" = "x86_64" ]; then \
        cp /tmp/*.repo /etc/yum.repos.d/ \
        && rpm -ivh https://dl.fedoraproject.org/pub/epel/epel-release-latest-10.noarch.rpm \
        && dnf download --resolve --destdir=/rpms \
            --enablerepo=codeready-builder-for-rhel-10-x86_64-rpms \
            app-protect \
            app-protect-dos \
            app-protect-ip-intelligence \
        && find /rpms -maxdepth 1 -type f \( -name '*app-protect*' -o -name '*nginx*' \) -exec rm -f {} +; \
    fi \
    && createrepo_c /rpms/ \
    && subscription-manager unregister

FROM scratch AS final
COPY --link --from=rpm-build /rpms /