#!/bin/sh
# Build the OpenWrt base image with LuCI packages installed.
# Docker buildkit cannot build openwrt/rootfs directly because buildkit's
# seccomp profile blocks uclient-fetch (wget) syscalls used by apk 3.0.
# We use 'docker run --security-opt seccomp=unconfined' instead.
set -eu

CONTAINER_NAME="zt-gateway-luci-build-tmp"
BASE_IMAGE="zt-gateway-luci:base"

docker rm -f "$CONTAINER_NAME" 2>/dev/null || true

docker run -d --name "$CONTAINER_NAME" \
  --security-opt seccomp=unconfined \
  openwrt/rootfs:latest sleep infinity

# Setup repos and install packages
docker exec "$CONTAINER_NAME" mkdir -p /etc/apk/repositories.d /var/lock /var/run

docker exec "$CONTAINER_NAME" sh -c '
printf "https://downloads.openwrt.org/releases/25.12.4/targets/x86/64/packages/packages.adb\nhttps://downloads.openwrt.org/releases/25.12.4/packages/x86_64/base/packages.adb\nhttps://downloads.openwrt.org/releases/25.12.4/packages/x86_64/luci/packages.adb\nhttps://downloads.openwrt.org/releases/25.12.4/packages/x86_64/packages/packages.adb\nhttps://downloads.openwrt.org/releases/25.12.4/packages/x86_64/routing/packages.adb\n" > /etc/apk/repositories.d/distfeeds.list
apk add --no-cache --allow-untrusted \
  luci-base luci-mod-admin-full luci-proto-ppp \
  uhttpd uhttpd-mod-ubus ucode-mod-lua \
  ca-certificates curl
'

docker commit "$CONTAINER_NAME" "$BASE_IMAGE"
docker rm -f "$CONTAINER_NAME"

echo "Built $BASE_IMAGE"