# syntax=docker/dockerfile:1
FROM ich777/novnc-baseimage

ENV DISPLAY_NUM=99
ENV GAMES_HOME=/opt/games
ENV SCRIPTS_HOME=/opt/scripts
ENV PATH=${PATH}:${SCRIPTS_HOME}

# unzip/smbclient/python3 are needed at runtime: the games are no longer baked into the
# image, setup_server.py serves an HTML install UI (backed by smbget+unzip) that the user
# drives on ${SETUP_PORT} instead of anything being auto-downloaded at container start.
# pulseaudio/pulseaudio-utils/libasound2-plugins carry game audio out to the browser (see
# scripts/pcm_ws_bridge.py) - VNC/noVNC only ever streams video, never audio.
RUN apt-get update && \
    apt-get -y install --no-install-recommends dosbox scummvm alsa-utils unzip smbclient python3 \
    pulseaudio pulseaudio-utils libasound2-plugins && \
    rm -rf /var/lib/apt/lists/*

# Route ALSA's default device through PulseAudio, so dosbox/scummvm need no special config -
# every game's audio ends up mixed into Pulse's one default sink, captured by pcm_ws_bridge.py.
RUN printf 'pcm.!default pulse\nctl.!default pulse\n' > /etc/asound.conf

# CN/SAN set to localhost/127.0.0.1: some browsers (Firefox) validate the WebSocket-Secure
# connection's certificate against the hostname independently of the page load, and reject a
# CN mismatch there even after you've clicked through the warning for the HTML page itself.
# basicConstraints/keyUsage/extendedKeyUsage must be set explicitly to mark this as a leaf
# (end-entity) server cert - without them, openssl req -x509 defaults to CA:TRUE, which
# Firefox refuses outright (not a clickable warning, a hard block) for a TLS server cert.
RUN openssl req -x509 -nodes -newkey rsa:2048 -keyout /tmp/novnc.key -out /tmp/novnc.pem -days 3650 \
    -subj "/C=US/ST=NY/L=NY/O=NY/OU=NY/CN=localhost" \
    -addext "subjectAltName=DNS:localhost,IP:127.0.0.1" \
    -addext "basicConstraints=critical,CA:FALSE" \
    -addext "keyUsage=critical,digitalSignature,keyEncipherment" \
    -addext "extendedKeyUsage=serverAuth"
RUN touch /root/.Xauthority

RUN mkdir -p ${GAMES_HOME}
VOLUME ${GAMES_HOME}

ADD scripts ${SCRIPTS_HOME}
WORKDIR /

EXPOSE 60${DISPLAY_NUM}
EXPOSE 70${DISPLAY_NUM}
EXPOSE 71${DISPLAY_NUM}
EXPOSE 8090-8099
EXPOSE 5900

ENTRYPOINT ["/opt/scripts/server_start.sh", "/opt/scripts/server.sh"]

# see also
# https://github.com/ich777/docker-krusader
