FROM golang:1.25-alpine AS builder

# ccarpinteri fork: uses PIA's central token API instead of regional
# /authv3/generateToken (CN-only certs fail on modern Go / new Server-* hosts).
RUN apk add --no-cache git ca-certificates \
    && go install github.com/ccarpinteri/pia-wg-config@v1.4.0

FROM docker:cli

RUN apk add --no-cache bash ca-certificates tzdata python3 py3-pip \
    && python3 -m venv /opt/venv \
    && /opt/venv/bin/pip install --no-cache-dir 'croniter==6.2.4' \
    && apk del py3-pip

ENV PATH="/opt/venv/bin:$PATH"

COPY --from=builder /go/bin/pia-wg-config /usr/local/bin/pia-wg-config
COPY rotate.py entrypoint.py entrypoint.sh /usr/local/bin/

RUN chmod +x /usr/local/bin/rotate.py /usr/local/bin/entrypoint.py /usr/local/bin/entrypoint.sh

ENV TZ=Europe/Brussels
ENV WG_CONFIG_PATH=/config/wireguard/wg0.conf
ENV ROTATOR_STATE_PATH=/config/rotator-state.json
ENV GLUETUN_CONTAINER=m3u-filter-vpn
ENV ROTATE_CRON="0 3 * * *"
ENV REGION_SELECT=fastest
ENV SERVERLIST_CACHE_PATH=/config/cache/pia-serverlist.json
ENV SERVERLIST_CACHE_TTL=24h
ENV SERVERLIST_CACHE_MAX_AGE=168h
ENV WG_CONFIG_MAX_AGE=7d
ENV LATENCY_SWITCH_MARGIN_MS=15

ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]