FROM debian:trixie-slim

RUN apt-get update && apt-get install -y --no-install-recommends \
        ostree \
        flatpak \
        git \
        openssh-client \
        curl \
        ca-certificates \
        gnupg \
    && rm -rf /var/lib/apt/lists/*

# yq (mikefarah, Go-Binary) zum Parsen von flatpaks.yaml
RUN curl -sSL -o /usr/local/bin/yq \
        https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 \
    && chmod +x /usr/local/bin/yq

# Gemeinsamer Signing-Key: entrypoint.sh kopiert ihn beim Start aus dem
# read-only gemounteten /run/secrets/gpg hierher.
ENV GNUPGHOME=/etc/mirror-gpg

WORKDIR /app
COPY gpg-import.sh /usr/local/lib/gpg-import.sh
COPY entrypoint.sh /app/entrypoint.sh
COPY sync.sh /app/sync.sh
RUN chmod +x /app/entrypoint.sh /app/sync.sh

ENTRYPOINT ["/app/entrypoint.sh"]