ARG EDPM_BASE_IMAGE
FROM $EDPM_BASE_IMAGE

# edpm_bootstrap
ARG BOOTSTRAP_PACKAGES="\
    driverctl \
    lvm2 \
    crudini \
    jq \
    nftables \
    NetworkManager \
    openstack-selinux \
    python3-libselinux \
    python3-pyyaml \
    rsync \
    tmpwatch \
    sysstat \
    iproute-tc \
    ksmtuned \
    systemd-container \
    crypto-policies-scripts \
    grubby \
    openstack-network-scripts \
    sos \
    "

# dib/ceph packages
ARG CEPH_PACKAGES="\
    bind-utils \
    cephadm \
    "

# dib/edpm-base
ARG EDPM_BASE_PACKAGES="\
    device-mapper-multipath \
    iptables-services \
    numactl \
    "

# dib/ironic-agent-multipath
ARG IRONIC_AGENT_MULTIPATH_PACKAGES="\
    iscsi-initiator-utils \
    "

# edpm_logrotate_crond
ARG LOGROTATE_CROND_PACKAGES="\
    cronie \
    "
# edpm_network_config
ARG NETWORK_CONFIG_PACKAGES="\
    os-net-config \
    NetworkManager-ovs \
    "

# install_os
ARG OS_PACKAGES="\
    chrony \
    "

# edpm_ovs
ARG OVS_PACKAGES="\
    openvswitch \
    "

# edpm_podman
ARG PODMAN_PACKAGES="\
    buildah \
    podman \
    "

# edpm_reboot
ARG REBOOT_PACKAGES="\
    yum-utils \
    "

# edpm_sshd
ARG SSHD_PACKAGES="\
    openssh-server \
    "

# edpm_tuned
ARG TUNED_PACKAGES="\
    tuned \
    tuned-profiles-cpu-partitioning \
    "

ARG PACKAGES="\
    cloud-init \
    "
ARG ENABLE_UNITS="openvswitch"

ARG LIBVIRT_PACKAGES="\
    libvirt \
    libvirt-admin \
    libvirt-client \
    libvirt-daemon \
    qemu-kvm \
    qemu-img \
    libseccomp \
    swtpm \
    swtpm-tools \
    edk2-ovmf \
    ceph-common \
    cyrus-sasl-scram \
    "

ARG TELEMETRY_LOGGING_PACKAGES="\
    rsyslog-openssl \
    "

ARG NVMEOF_PACKAGES="\
    nvme-cli \
    "

ARG USER_PACKAGES=""

RUN --mount=type=secret,id=rhsm,dst=/var/tmp/rhsm-script.sh \
    if [ -f /var/tmp/rhsm-script.sh ]; then bash /var/tmp/rhsm-script.sh; fi && \
    dnf -y install \
        $BOOTSTRAP_PACKAGES \
        $CEPH_PACKAGES \
        $EDPM_BASE_PACKAGES \
        $IRONIC_AGENT_MULTIPATH_PACKAGES \
        $PACKAGES \
        $LIBVIRT_PACKAGES \
        $LOGROTATE_CROND_PACKAGES \
        $NETWORK_CONFIG_PACKAGES \
        $NVMEOF_PACKAGES \
        $OS_PACKAGES \
        $OVS_PACKAGES \
        $PODMAN_PACKAGES \
        $REBOOT_PACKAGES \
        $SSHD_PACKAGES \
        $TUNED_PACKAGES \
        $TELEMETRY_LOGGING_PACKAGES \
        $USER_PACKAGES \
        && \
    # edpm_bootstrap
    source /etc/os-release && if [ "${ID}" = "rhel" ]; then dnf -y install rhoso-release; fi && \
    # edpm_kernel
    dnf -y remove dracut-config-generic && \
    dnf clean all && \
    (subscription-manager remove --all || true) && \
    (subscription-manager unregister || true) && \
    systemctl enable $ENABLE_UNITS


# Configure FIPS
ARG FIPS=1
RUN if [ "${FIPS}" = "1" ] ; \
    then \
        # Enable the FIPS crypto policy
        update-crypto-policies --no-reload --set FIPS ; \
        touch /etc/system-fips ; \
        mkdir -p /usr/lib/bootc/kargs.d ; \
        echo -e "# Enable FIPS\nkargs = [\"fips=1\"]\n" > /usr/lib/bootc/kargs.d/01-fips.toml ; \
    fi

# Drop Ansible fact into place
COPY ansible-facts/bootc.fact /etc/ansible/facts.d/bootc.fact
RUN chmod +x /etc/ansible/facts.d/bootc.fact

# Disable automatic update check and reboot
RUN systemctl mask bootc-fetch-apply-updates.timer

# This should be the last command
# https://docs.fedoraproject.org/en-US/bootc/building-containers/#_linting
RUN bootc container lint
