FROM golang:1.25-alpine AS builder

# ccarpinteri fork: uses PIA's central token API instead of regional
# /authv3/generateToken (CN-only certs fail on modern Go / new Server-* hosts).
RUN apk add --no-cache git ca-certificates \
    && go install github.com/ccarpinteri/pia-wg-config@v1.4.0

FROM docker:cli

RUN apk add --no-cache bash ca-certificates tzdata jq

COPY --from=builder /go/bin/pia-wg-config /usr/local/bin/pia-wg-config
COPY rotate.sh entrypoint.sh /usr/local/bin/

RUN chmod +x /usr/local/bin/rotate.sh /usr/local/bin/entrypoint.sh

ENV TZ=Europe/Brussels
ENV WG_CONFIG_PATH=/config/wireguard/wg0.conf
ENV ROTATOR_STATE_PATH=/config/rotator-state.json
ENV GLUETUN_CONTAINER=m3u-filter-vpn
ENV ROTATE_AT=03:00

ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
