# Kvitt cert-sync image (SPEC §10.3, §10.5.1): alpine with openssh-client, curl and sync.sh on a daily schedule.
# Versions resolved 2026-10-18: alpine 3.24.2 (Docker Hub official image, multi-arch index digest below); packages
# from Alpine v3.24 main/community: openssh-client-default 10.3_p1, curl 8.22.0, openssl 3.5.9 (PEM checks),
# supercronic 0.2.49, tzdata 2026e.
# The scheduler is supercronic, not busybox crond: the container runs as uid 1000 (SPEC §10.2, D-023) and busybox
# crond cannot run jobs as a non-root user (checked 2026-10-18 in alpine 3.24.2: no job ever ran). See D-104.
FROM docker.io/library/alpine:3.24.2@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6

RUN apk add --no-cache \
      "openssh-client-default~10.3" \
      "curl~8.22" \
      "openssl~3.5" \
      "supercronic~0.2" \
      tzdata \
 && adduser -D -u 1000 -g "Kvitt cert-sync" kvitt \
 && mkdir -p /certs \
 && chown 1000:1000 /certs

COPY sync.sh entrypoint.sh /usr/local/bin/
RUN chmod 0755 /usr/local/bin/sync.sh /usr/local/bin/entrypoint.sh \
 && echo '0 4 * * * /usr/local/bin/sync.sh' > /etc/kvitt-cert-sync.crontab

ENV TZ=Europe/Stockholm
USER 1000:1000
# sync.sh once at start, then daily at 04:00 Europe/Stockholm.
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]