content: # syntax=docker.io/docker/dockerfile:1.7-labs
  ARG SERVICE_NAME=grpc
  
  FROM rust:alpine
  
  ARG SERVICE_NAME
  
  # Install the required dependencies
  RUN apk add --no-cache protobuf musl-dev musl-nscd-dev linux-pam-dev ccache
  
  WORKDIR /home/build
  
  COPY Cargo.toml Cargo.lock ./
  COPY example/Cargo.toml ./example/
  COPY pam_rs/Cargo.toml ./pam_rs/
  COPY grpc_ssh_authorizedkeys/Cargo.toml ./grpc_ssh_authorizedkeys/
  COPY nss_grpc/Cargo.toml ./nss_grpc/
  COPY pam_grpc/Cargo.toml ./pam_grpc/
  COPY proto/Cargo.toml ./proto/
  COPY unix_auth_grpc/Cargo.toml ./unix_auth_grpc/
  
  RUN --mount=type=cache,target=/home/build/target/ \
      --mount=type=cache,target=/usr/local/cargo/git/db \
      --mount=type=cache,target=/usr/local/cargo/registry/ \
      --mount=type=cache,target=/usr/local/cargo/ccache \
      cargo fetch
  
  COPY --exclude=target . .
  
  # Build shared libraries
  # On Alpine this is required
  # See https://github.com/rust-lang/rust/issues/44991
  RUN --mount=type=cache,target=/home/build/target/ \
      --mount=type=cache,target=/usr/local/cargo/git/db \
      --mount=type=cache,target=/usr/local/cargo/registry/ \
      --mount=type=cache,target=/usr/local/cargo/ccache \
      CC="ccache gcc" CXX="ccache g++" RUSTFLAGS="-C target-feature=-crt-static"  \
      SERVICE_NAME=${SERVICE_NAME} cargo build --release --lib && \
      mkdir -p out && \
      cp target/release/libnss_grpc.so target/release/libpam_grpc.so out/
  
  # Build the example
  RUN --mount=type=cache,target=/home/build/target/ \
      --mount=type=cache,target=/usr/local/cargo/git/db \
      --mount=type=cache,target=/usr/local/cargo/registry/ \
      SERVICE_NAME=${SERVICE_NAME} cargo build --release --bin example --bin grpc_ssh_authorizedkeys && \
      mkdir -p out && \
      cp target/release/example target/release/grpc_ssh_authorizedkeys out/
  
  FROM alpine
  
  ARG SERVICE_NAME
  ENV SERVICE_NAME=${SERVICE_NAME}
  
  # TODO(adphi): find a way to remove the need for libgcc
  RUN apk add --no-cache musl-nscd linux-pam shadow shadow-login libgcc sudo && \
      addgroup sudo && \
      mkdir /var/run/nscd && \
      mkdir /etc/skel
  
  COPY --from=0 /home/build/out/libnss_grpc.so /lib/libnss_${SERVICE_NAME}.so
  COPY --from=0 /home/build/out/libpam_grpc.so /usr/lib/security/pam_${SERVICE_NAME}.so
  COPY --from=0 /home/build/out/example /usr/bin/${SERVICE_NAME}-example
  COPY --from=0 /home/build/out/grpc_ssh_authorizedkeys /usr/bin/${SERVICE_NAME}_ssh_authorizedkeys
  
  COPY setup-nsswitch /tmp/
  
  ARG PAM_DIR=/usr/lib/pam.d
  
  RUN echo "passwd: ${SERVICE_NAME}" >> /etc/nsswitch.conf && \
      echo "group: ${SERVICE_NAME}" >> /etc/nsswitch.conf && \
      sed -i "s|auth required pam_unix.so nullok|auth sufficient pam_unix.so nullok\nauth sufficient pam_${SERVICE_NAME}.so|" ${PAM_DIR}/base-auth && \
      echo "session optional pam_mkhomedir.so" >> ${PAM_DIR}/base-session-noninteractive && \
      sed -i "s|#%sudo|%sudo|" /etc/sudoers && \
      echo '%linux-admins ALL=(ALL:ALL) NOPASSWD: ALL' > /etc/sudoers.d/${SERVICE_NAME} && \
      /tmp/setup-nsswitch install ${SERVICE_NAME} && \
      rm /tmp/setup-nsswitch
  
  
  CMD ["sh", "-c", "nscd -d && syslogd && ${SERVICE_NAME}-example"]
  