FROM golang:1.25-alpine AS builder

# ccarpinteri fork: uses PIA's central token API instead of regional
# /authv3/generateToken (CN-only certs fail on modern Go / new Server-* hosts).
RUN apk add --no-cache git ca-certificates \
    && go install github.com/ccarpinteri/pia-wg-config@v1.4.0

FROM docker:cli

RUN apk add --no-cache bash ca-certificates tzdata jq python3 py3-pip \
    && python3 -m venv /opt/venv \
    && /opt/venv/bin/pip install --no-cache-dir 'croniter==6.2.4' \
    && apk del py3-pip

ENV PATH="/opt/venv/bin:$PATH"

COPY --from=builder /go/bin/pia-wg-config /usr/local/bin/pia-wg-config
COPY rotate.sh entrypoint.py /usr/local/bin/

RUN chmod +x /usr/local/bin/rotate.sh /usr/local/bin/entrypoint.py

ENV TZ=Europe/Brussels
ENV WG_CONFIG_PATH=/config/wireguard/wg0.conf
ENV ROTATOR_STATE_PATH=/config/rotator-state.json
ENV GLUETUN_CONTAINER=m3u-filter-vpn
ENV ROTATE_CRON="0 3 * * *"

ENTRYPOINT ["/opt/venv/bin/python", "/usr/local/bin/entrypoint.py"]