# kukuri buildbot worker image - self-contained.
#
# HISTORY: this file used to be `FROM jenkins-kotlin:latest`, an image that was
# built interactively during the Jenkins era and whose Dockerfile was never
# committed. That image no longer exists anywhere (verified: not in this repo's
# history, not on the build host, not in the cgit repositories). Rather than
# resurrect a lost image, the toolchain it provided is reproduced explicitly
# here so the worker can be rebuilt from source on any host.
#
# What the pipeline in deploy/buildbot/master/master.cfg actually needs:
#   - JDK 21 (master comment) with a Java 17 target (modules set jvmTarget=17)
#   - Gradle wrapper 8.14.3 -> fetched by ./gradlew itself from services.gradle.org
#   - Android SDK: AGP 8.13.2 needs build-tools + a platform + platform-tools
#   - node/npm for wasmJsNodeTest (Kotlin/Wasm node target) and bundleWeb
#   - X11 + ALSA + PulseAudio for the webrtc-java native library (used by
#     services/signaling-server tests and the desktop bundle)
#   - python3 + buildbot-worker 4.x
#   - git/curl/unzip for checkout, artifact fetch and deploy
#
# The image still runs as user "jenkins" with HOME=/var/jenkins_home and
# GRADLE_USER_HOME=/var/jenkins_home/.gradle so that the existing run-worker.sh
# volume mount (`-v jenkins-data:/var/jenkins_home`) keeps working and the
# Gradle/Konan caches persist across container rebuilds.

FROM eclipse-temurin:21-jdk-jammy

ENV DEBIAN_FRONTEND=noninteractive

# --- base tooling the build and the worker agent need -----------------------
# APT::Cache-Start is raised because the default 24MB mmap cache is too small
# to parse the full Ubuntu jammy package lists (universe is ~17MB on its own),
# which fails with "Dynamic MMap ran out of room" on constrained hosts.
#
# NOTE on audio: only libasound2/libpulse0 (the client libraries webrtc-java
# links against) are installed, not the pulseaudio server package. The server
# package drags in systemd and its postinst HANGS when this image is built
# under a non-systemd runtime (observed building under FreeBSD's podman +
# Linuxulator: "systemd.postinst configure" blocked the build indefinitely).
# The worker has no need for an audio daemon - it never plays back media; the
# libraries exist so the desktop/signaling test binaries can load. If a build
# ever needs a live PulseAudio, run it as a sidecar rather than baking it in.
RUN echo 'APT::Cache-Start "268435456";' > /etc/apt/apt.conf.d/99cache-start \
 && echo 'APT::Cache-Grow "1073741824";' >> /etc/apt/apt.conf.d/99cache-start \
 && apt-get update && apt-get install -y --no-install-recommends \
      ca-certificates curl wget unzip zip xz-utils git openssh-client \
      python3 python3-pip python3-venv \
      libx11-6 libxcb1 libxext6 libxrender1 libxi6 libxtst6 \
      libasound2 libpulse0 \
      procps \
 && rm -rf /var/lib/apt/lists/*

# --- nodejs (Kotlin/Wasm node tests, web bundle) ---------------------------
RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
 && apt-get install -y --no-install-recommends nodejs \
 && rm -rf /var/lib/apt/lists/*

# --- buildbot worker ------------------------------------------------------
RUN pip3 install --no-cache-dir 'buildbot-worker==4.1.0' \
 || pip3 install --no-cache-dir buildbot-worker

# --- Android SDK (AGP 8.13.2) -----------------------------------------------
# compileSdk/targetSdk are 35 across apps/android and the kotlin modules
# (apps/android, modules/orgflow-domain, modules/orgflow-ui,
# modules/zero-bridge-android all say 35). Build-tools 35.0.0 comes with
# platform 35; 36 is installed as well so AGP can use it if it asks.
# The SDK dir is chowned to the build user: AGP writes into the SDK (it
# installs missing components and creates .knownPackages), so it must not be
# root-only, otherwise the build dies with "The SDK directory is not writable".
ENV ANDROID_SDK_ROOT=/opt/android-sdk
ENV ANDROID_HOME=/opt/android-sdk
ENV PATH=/opt/android-sdk/cmdline-tools/latest/bin:/opt/android-sdk/platform-tools:${PATH}
ARG ANDROID_CMDLINE_TOOLS=13114758
RUN mkdir -p /opt/android-sdk/cmdline-tools \
 && curl -fsSL -o /tmp/cmdline-tools.zip \
      "https://dl.google.com/android/repository/commandlinetools-linux-${ANDROID_CMDLINE_TOOLS}_latest.zip" \
 && unzip -q /tmp/cmdline-tools.zip -d /tmp/ct \
 && mv /tmp/ct/cmdline-tools /opt/android-sdk/cmdline-tools/latest \
 && rm -rf /tmp/cmdline-tools.zip /tmp/ct \
 && yes | sdkmanager --licenses > /dev/null \
 && sdkmanager --install \
      "platform-tools" \
      "platforms;android-35" \
      "build-tools;35.0.0" \
      "platforms;android-36" \
      "build-tools;36.0.0" \
 && rm -rf /opt/android-sdk/.temp /root/.android/cache

# --- the Jenkins-era user, kept so the existing volume/mount setup is valid --
# /opt/android-sdk is chowned too: AGP writes into the SDK tree at build time.
RUN useradd --create-home --home-dir /var/jenkins_home --shell /bin/bash jenkins \
 && mkdir -p /var/jenkins_home/.gradle /worker /run/secrets \
 && chown -R jenkins:jenkins /var/jenkins_home /worker /run/secrets /opt/android-sdk

COPY start-worker.sh /usr/local/bin/start-worker.sh
RUN chmod +x /usr/local/bin/start-worker.sh

ENV GRADLE_USER_HOME=/var/jenkins_home/.gradle
ENV BUILDWORKER_WORKDIR=/worker
ENV HOME=/var/jenkins_home

USER jenkins
WORKDIR /worker
ENTRYPOINT ["/usr/local/bin/start-worker.sh"]