# syntax=docker/dockerfile:1.7
#
# Egress proxy — tinyproxy with a strict allowlist of destination hosts.
#
# Used by docker-compose.prod.yml to give the app a narrow, audited path
# out of the internal Docker network. Every other destination is denied
# (FilterDefaultDeny Yes + Filter on regex of allowed hostnames).
#
# The default tinyproxy image (vimagick/tinyproxy) is intentionally NOT
# used here: we build from alpine so the config is fully reproducible
# and pinned to the alpine package version.

FROM alpine:3.20

RUN apk add --no-cache tinyproxy ca-certificates \
 && addgroup -g 1001 -S tinyproxy 2>/dev/null || true \
 && adduser  -S -u 1001 -G tinyproxy tinyproxy 2>/dev/null || true \
 && mkdir -p /etc/tinyproxy /var/log/tinyproxy /var/run/tinyproxy \
 && chown -R tinyproxy:tinyproxy /var/log/tinyproxy /var/run/tinyproxy

COPY --chown=tinyproxy:tinyproxy tinyproxy.conf /etc/tinyproxy/tinyproxy.conf
COPY --chown=tinyproxy:tinyproxy filter           /etc/tinyproxy/filter

USER tinyproxy

EXPOSE 3128

HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
  CMD wget --spider --quiet -e use_proxy=yes -e http_proxy=http://127.0.0.1:3128 https://elevaseo.com/ || exit 1

# `-d` keeps tinyproxy in foreground so container logs work normally.
CMD ["tinyproxy", "-d", "-c", "/etc/tinyproxy/tinyproxy.conf"]