# SoulShop — CyberSoul SecurITy's public merch store.  LAB USE ONLY.
#
# The EXTERNAL entry point of the course spine  shop -> cloud -> soulsearch.
# A deliberately vulnerable LAMP storefront: a real, on-brand frontend (the
# CyberSoul navy/gold theme) over a MySQL backend, so SoulEyez's SQLMap /
# Dalfox / recon presets all behave ACCURATELY (unlike an SQLite SPA).
#
# Headline chain: SQLi on /search.php?q= -> dump `users` -> crack the MD5 ->
# admin/admin123, the SAME credential that reuses into the cloud portal.
# Also: reflected XSS (search), stored XSS (product reviews), a login with a
# SQLi auth-bypass, and a config.php.bak credential leak.
#
# Multi-arch Debian slim: builds native on amd64 + arm64 (no qemu). Runs on the
# souleyez-dmz bridge as shop.cybersoulsecurity.com — never expose it.

FROM debian:12-slim
ENV DEBIAN_FRONTEND=noninteractive

RUN apt-get update \
    && apt-get install -y --no-install-recommends \
        apache2 libapache2-mod-php php-mysqli php-cli \
        mariadb-server mariadb-client \
        ca-certificates wget \
    && rm -rf /var/lib/apt/lists/* \
    # MariaDB stays localhost-only (this is a web-only box; no network-DB door —
    # that surface belongs to the internal soulsearch box, not the public shop).
    && sed -ri 's/^bind-address\s*=.*/bind-address = 127.0.0.1/' \
        /etc/mysql/mariadb.conf.d/50-server.cnf 2>/dev/null || true

# Bundle the brand fonts (Playfair Display headings + Karla body) locally so
# they render offline at scan time (the lab box has no internet at runtime).
# Non-fatal: if the fetch fails during build, the CSS font-stack fallbacks
# (Georgia / system-ui) approximate the look.
RUN mkdir -p /var/www/html/assets/fonts \
    && cd /var/www/html/assets/fonts \
    && ( for fam in "Playfair+Display:wght@500;600;700" "Karla:wght@400;600;700"; do \
             wget -q -U "Mozilla/5.0 (X11; Linux x86_64)" -O - \
               "https://fonts.googleapis.com/css2?family=${fam}&display=swap"; \
           done > fonts.css \
         && grep -oE "https://fonts.gstatic.com/[^)]+\.woff2" fonts.css | sort -u \
            | while read -r u; do wget -q "$u"; done \
         && sed -i 's#https://fonts.gstatic.com/[^)]*/##g' fonts.css ) \
       || echo "NOTE: brand fonts not bundled (offline build); using CSS fallbacks"

# Web app + DB seed.
COPY web/ /var/www/html/
COPY seed.sql /opt/soulshop/seed.sql
RUN rm -f /var/www/html/index.html \
    && chown -R www-data:www-data /var/www/html

COPY entrypoint.sh /usr/local/bin/entrypoint.sh
RUN chmod +x /usr/local/bin/entrypoint.sh

EXPOSE 80
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
