# DMZ resolver for engagement (VPN) challenges.
#
# Serves one name — the challenge's seeded FQDN — to clients inside the
# tunnel, and forwards everything else upstream so a player who points
# their whole resolver here still reaches the internet.
#
# ⚠️ Generic on purpose. This was a per-challenge Dockerfile + entrypoint
# pair, identical everywhere except three strings, which is why moving a
# challenge onto the VPN used to mean writing files by hand. The platform
# now injects this image and passes those three as env vars, so a
# challenge converts by declaring `network_topology: engagement` and
# nothing else.
FROM alpine:3.20

RUN apk add --no-cache dnsmasq

COPY --chmod=0755 entrypoint.sh /entrypoint.sh

EXPOSE 53/udp 53/tcp

# Checks that dnsmasq is actually answering, not merely that the process
# exists — a config error leaves it up and refusing every query.
#
# ⚠️ Queries this container's own eth0, NOT 127.0.0.1. The entrypoint runs
# dnsmasq with `--bind-interfaces --interface=eth0`, which is load-bearing
# for correctness (see there) and means loopback is never bound — a
# healthcheck aimed at 127.0.0.1 times out forever and compose reports
# `dependency failed to start: edge-dns is unhealthy`, i.e. the resolver
# looks broken while it is answering every real query fine.
#
# `--start-period` covers the entrypoint's wait for docker's embedded DNS
# to publish the challenge's service name.
# ⚠️ `-type=a` is required, not tidiness. busybox's nslookup queries A and
# AAAA together and fails if *either* does. `address=/name/<ipv4>` defines
# only an A record, and `local=/zone/` makes this server authoritative for
# the zone — so the AAAA comes back NXDOMAIN and nslookup exits 1 while
# every real query is being answered correctly. That surfaced as
# `dependency failed to start: edge-dns is unhealthy`, i.e. as a broken
# resolver, on a resolver whose logs showed it resolving perfectly.
HEALTHCHECK --interval=5s --timeout=3s --retries=20 --start-period=10s \
    CMD nslookup -type=a "$CTFY_EDGE_FQDN" "$(hostname -i)" >/dev/null 2>&1 || exit 1

ENTRYPOINT ["/entrypoint.sh"]
