FROM debian:bookworm-slim

ARG DEBIAN_FRONTEND=noninteractive

RUN apt-get update \
  && apt-get install -y --no-install-recommends \
    bash \
    ca-certificates \
    curl \
    iproute2 \
    iptables \
    jq \
    procps \
    wireguard-tools \
  && rm -rf /var/lib/apt/lists/*

COPY ca.rsa.4096.crt /opt/pia/ca.rsa.4096.crt
COPY pia.sh /usr/local/lib/pia.sh
COPY entrypoint.sh /usr/local/bin/entrypoint.sh

RUN chmod 0644 /opt/pia/ca.rsa.4096.crt \
  && chmod 0755 /usr/local/lib/pia.sh /usr/local/bin/entrypoint.sh

ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]