# ctfy/openvpn-base — VPN-delivery entry point for engagement-mode challenges.
#
# Engagement-mode challenges (those declaring
# `network_topology: engagement` in metadata.yaml) ship their
# own services/openvpn/Dockerfile that does FROM this base.
# The base owns:
#
#   * EasyRSA PKI bootstrap on first boot (CA + server cert + 1
#     client cert; persistent across container restarts).
#   * OpenVPN server config — generated from CTFY_* env vars
#     supplied by the challenge's compose file. As of v1.1 the DMZ
#     topology + edge-dns IP are AUTO-DISCOVERED at bootstrap (the
#     container's own interface for net/mask/subnet, docker DNS for
#     edge-dns), so the four env vars below are now OPTIONAL — the
#     hardcoded values that used to be required forced one
#     instance per docker daemon (subnet collision). Setting any
#     of them explicitly still wins over auto-discovery.
#       CTFY_DMZ_NET       optional (default: from interface)
#       CTFY_DMZ_NETMASK   optional (default: from interface)
#       CTFY_DMZ_SUBNET    optional (default: from interface)
#       CTFY_EDGE_DNS_IP   optional (default: getent hosts edge-dns)
#       CTFY_VPN_PUBLIC_HOST  external host the .ovpn points at
#       CTFY_VPN_PUBLIC_PORT  external port (the host port the
#                             platform maps to 1194/udp)
#       CTFY_TUNNEL_NET    /24 for VPN clients
#                          (default 192.168.255.0)
#       CTFY_VPN_DNS_DOMAIN  domain to scope split-DNS to (e.g.
#                          initech.io). When set, the server pushes
#                          DOMAIN-ROUTE + DOMAIN dhcp-option so
#                          split-DNS-aware clients only send
#                          ``*.<domain>`` lookups through the
#                          tunnel and keep their existing DNS for
#                          everything else. Pair with a forwarding
#                          resolver on the challenge side so
#                          non-aware clients (which send ALL DNS
#                          through the tunnel) can still resolve
#                          public names.
#   * Hard isolation: iptables FORWARD policy DROP, allow ONLY
#     tun0 ⇄ eth0 traffic toward CTFY_DMZ_SUBNET. Drops the
#     docker host gateway, all other RFC1918, cloud-metadata
#     (169.254.169.254), link-local, and the public internet.
#     Challenge authors cannot disable this — it's part of the
#     base image's ENTRYPOINT and audited via NET003.
#
# All challenges using engagement-mode MUST `FROM
# ctfy/openvpn-base:<version>` — the audit rule
# `network_topology: engagement` enforces this.
FROM kylemanna/openvpn:2.4

LABEL org.ctfy.component="openvpn-base"
LABEL org.ctfy.version="1.2"

# iptables is already present in kylemanna/openvpn:2.4 because
# the upstream image runs MASQUERADE on tun0; we only override
# the FORWARD policy.

COPY --chmod=0755 ctfy-openvpn-bootstrap.sh /usr/local/bin/ctfy-openvpn-bootstrap.sh
COPY --chmod=0755 ctfy-openvpn-isolation.sh /usr/local/bin/ctfy-openvpn-isolation.sh

# The base image's entrypoint owns PKI bootstrap + isolation
# rules and then exec's the upstream server. Challenges cannot
# override this — they only supply env vars via compose.
ENTRYPOINT ["/usr/local/bin/ctfy-openvpn-bootstrap.sh"]
