# ───────────────────────────────────────────────────────────
# Ansible Control Node — Docker Image
#
# Purpose: Runs IEC 62443-3-3 compliance tests against
# Windows, Cisco, VMware, MSSQL, and Linux targets.
#
# Deployment targets:
#   • Kubernetes / Docker Swarm (native)
#   • Alpine Docker Host on QEMU (docker run on Windows VMs)
#   • Any Linux with Docker
#
# Integrations:
#   • Windows       — pywinrm + kerberos → WinRM
#   • Cisco ASA     — cisco.asa + paramiko → SSH/CLI
#   • Cisco Catalyst— cisco.ios + netmiko → SSH/CLI
#   • Cisco NX-OS   — cisco.nxos + ncclient → SSH/NX-API
#   • VMware        — pyvmomi → vCenter/ESXi SOAP API
#   • MSSQL         — pymssql → SQL Server TDS
#   • Linux         — native SSH (built-in ansible)
#
# Usage:
#   docker build -t ansible-node -f Dockerfile.ansible .
#   docker run --rm -v $(pwd)/playbooks:/ansible/playbooks \
#       -v $(pwd)/inventory.ini:/ansible/inventory.ini \
#       ansible-node site.yml
# ───────────────────────────────────────────────────────────

FROM alpine:3.20

LABEL org.opencontainers.image.title="Ansible Control Node"
LABEL org.opencontainers.image.description="Ansible with collections for Windows, Cisco, VMware, MSSQL, and Linux targets"

# ── Runtime + build dependencies ───────────────────────────
RUN apk add --no-cache \
    ansible \
    sshpass \
    openssh-client \
    py3-pip \
    python3 \
    python3-dev \
    gcc \
    musl-dev \
    openssl-dev \
    krb5 \
    krb5-dev \
    libffi-dev \
    freetds \
    freetds-dev \
    bash \
    curl \
    ca-certificates \
    git

# ── Python packages for target integrations ──────────────
RUN pip3 install --no-cache-dir --break-system-packages \
    'pywinrm[kerberos]>=0.4' \
    requests-kerberos \
    requests-ntlm \
    paramiko>=2.7 \
    ncclient>=0.6 \
    netmiko>=4.0 \
    scp \
    pyvmomi>=8.0 \
    requests \
    pymssql>=2.2 \
    jmespath>=1.0 \
    xmltodict>=0.13 \
    pyyaml>=6.0 \
    cryptography>=41.0 \
    packaging \
    fpdf2>=2.7

# ── Ansible collections ──────────────────────────────────
RUN ansible-galaxy collection install \
    ansible.windows \
    ansible.netcommon \
    ansible.utils \
    cisco.asa \
    cisco.ios \
    cisco.nxos \
    community.vmware \
    community.general \
    community.crypto \
    microsoft.sql

# ── Purge build-only dependencies ─────────────────────────
# apk del cascades to shared deps like util-linux (mount/umount).
# Re-add it with network access (not --no-network here).
RUN apk del --no-network \
    gcc \
    musl-dev \
    python3-dev \
    openssl-dev \
    krb5-dev \
    libffi-dev \
    freetds-dev \
    && apk add --no-cache util-linux

# ── Ansible config ────────────────────────────────────────
RUN mkdir -p /etc/ansible && \
    printf '[defaults]\n\
host_key_checking = False\n\
stdout_callback = yaml\n\
callback_whitelist = profile_tasks\n\
retry_files_enabled = False\n\
inventory = /ansible/inventory/inventory.ini\n\
\n\
[ssh_connection]\n\
pipelining = True\n\
control_path = /tmp/ansible-%%h-%%p-%%r' \
    > /etc/ansible/ansible.cfg

# ── Working directory ─────────────────────────────────────
RUN mkdir -p /ansible/playbooks /ansible/inventory
WORKDIR /ansible

# ── Container web UI (JSON / Markdown / PDF export) ──────
COPY webui/container-app.py /usr/local/bin/container-webui.py
COPY reports/render_report.py /ansible/reports/render_report.py
RUN chmod +x /usr/local/bin/container-webui.py

# ── Default inventory (placeholder) ───────────────────────
RUN printf '[windows]\n\
[cisco_asa]\n\
[cisco_ios]\n\
[cisco_nxos]\n\
[vmware]\n\
[mssql]\n\
[linux]\n\
\n\
[all:vars]\n\
ansible_user=ansible\n' \
    > /ansible/inventory/inventory.ini

# ── Entrypoint: web UI by default, ansible-playbook if args ─
#   docker run -p 8080:8080 ansible-node          → web UI
#   docker run ansible-node site.yml -i hosts      → ansible-playbook
COPY scripts/entrypoint.sh /usr/local/bin/entrypoint.sh
RUN chmod +x /usr/local/bin/entrypoint.sh
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
CMD []