Dockerfile

FROM openresty/openresty:latest

# Install utilities
RUN apt-get update -qq && \
    apt-get install -y -qq curl procps > /dev/null 2>&1 && \
    rm -rf /var/lib/apt/lists/*

# Copy nginx config and lua code
COPY dist/conf/ /usr/local/openresty/nginx/conf/
COPY dist/lua/  /usr/local/openresty/nginx/lua/

# Copy seed data into the core directory
COPY seed/routes.json          /usr/local/openresty/nginx/lua/psp_handlers/core/routes.json
COPY seed/cloud_routes.json    /usr/local/openresty/nginx/lua/psp_handlers/core/cloud_routes.json
COPY seed/psp_rules.json       /usr/local/openresty/nginx/lua/psp_handlers/core/psp_rules.json
COPY seed/settings.json        /usr/local/openresty/nginx/lua/psp_handlers/core/settings.json
COPY seed/admin_credentials.json /usr/local/openresty/nginx/lua/psp_handlers/core/admin_credentials.json

# Copy log seed script and inject init_worker block into nginx.conf
COPY seed/seed_logs.lua /usr/local/openresty/nginx/lua/psp_handlers/seed_logs.lua
RUN sed -i '/^    include conf.d/i \    init_worker_by_lua_file lua/psp_handlers/seed_logs.lua;' \
    /usr/local/openresty/nginx/conf/nginx.conf

# The shipped config binds 127.0.0.1:8081 so the admin port is not exposed on a
# real server. Inside a container that would make `docker run -p` unreachable,
# so bind all interfaces here — the container boundary is the isolation.
RUN sed -i 's/^\( *\)listen 127\.0\.0\.1:8081;/\1listen 8081;/' \
    /usr/local/openresty/nginx/conf/conf.d/psp-router.conf

# Run workers as root in the demo only. On a real server deploy.sh installs a
# sudoers rule so the unprivileged worker can reload OpenResty; there is no sudo
# in this image, so without this the admin UI's Reload button silently fails and
# settings changes never take effect.
RUN sed -i 's/^#user  nobody;/user root;/' /usr/local/openresty/nginx/conf/nginx.conf

# Write resolver.conf
RUN echo 'resolver 8.8.8.8 valid=10s;' > /usr/local/openresty/nginx/conf/resolver.conf && \
    echo 'resolver_timeout 5s;' >> /usr/local/openresty/nginx/conf/resolver.conf

# Set permissions so admin UI can edit data files at runtime
RUN chmod 666 /usr/local/openresty/nginx/lua/psp_handlers/core/routes.json \
              /usr/local/openresty/nginx/lua/psp_handlers/core/cloud_routes.json \
              /usr/local/openresty/nginx/lua/psp_handlers/core/psp_rules.json \
              /usr/local/openresty/nginx/lua/psp_handlers/core/settings.json && \
    chmod 644 /usr/local/openresty/nginx/lua/psp_handlers/core/admin_credentials.json && \
    chmod 666 /usr/local/openresty/nginx/conf/resolver.conf

# Copy entrypoint (populates /etc/hosts with demo entries at runtime)
COPY docker-entrypoint.sh /docker-entrypoint.sh
RUN chmod +x /docker-entrypoint.sh

EXPOSE 8081

ENTRYPOINT ["/docker-entrypoint.sh"]