ARG MARIADB_VERSION=13.0.2
FROM mariadb:${MARIADB_VERSION} AS base

FROM base AS pam-build

RUN apt-get update \
    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
      build-essential ca-certificates curl libcrypt-dev libldap-dev libpam0g-dev libsasl2-dev perl \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /build/pam_ldap
RUN curl --fail --show-error --silent --location --proto '=https' --tlsv1.2 \
      https://codeload.github.com/PADL/pam_ldap/tar.gz/656448f091cbeb9efb3ece08e6868e40b8e7b6f8 \
      --output /tmp/pam_ldap.tar.gz \
    && printf '%s  %s\n' \
      1aa622e85621b9018025e3483956d854566a5bc0636a4e8d9d005093f02dd16b \
      /tmp/pam_ldap.tar.gz | sha256sum -c - \
    && tar -xzf /tmp/pam_ldap.tar.gz --strip-components=1 \
    && CFLAGS='-O2 -fPIC -std=gnu89' ./configure \
      --prefix=/usr/local \
      --with-ldap-lib=openldap \
      --with-ldap-conf-file=/etc/pam_ldap.conf \
      --enable-ssl \
    && PERL5LIB=/build/pam_ldap make -j2 \
    && nm -D pam_ldap.so | grep -E ' T pam_sm_authenticate(@|$)' \
    && nm -D pam_ldap.so | grep -E ' T pam_sm_acct_mgmt(@|$)' \
    && grep -F '#define HAVE_LDAP_INITIALIZE 1' config.h \
    && grep -F '#define HAVE_LDAP_START_TLS_S 1' config.h

FROM base

RUN apt-get update \
    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
      ca-certificates libcrypt1 libldap2 libpam0g util-linux \
    && command -v setpriv \
    && update-ca-certificates \
    && rm -rf /var/lib/apt/lists/*

COPY --from=pam-build --chmod=0755 /build/pam_ldap/pam_ldap.so /usr/local/lib/security/pam_ldap_direct.so
COPY --from=pam-build /build/pam_ldap/COPYING /build/pam_ldap/COPYING.LIB /usr/share/doc/pam-ldap-direct/

RUN set -eu; \
    module=/usr/local/lib/security/pam_ldap_direct.so; \
    ldd "$module" > /tmp/pam-ldap-dependencies; \
    if grep -q 'not found' /tmp/pam-ldap-dependencies; then \
      cat /tmp/pam-ldap-dependencies >&2; \
      exit 1; \
    fi; \
    grep -F 'libldap' /tmp/pam-ldap-dependencies; \
    rm /tmp/pam-ldap-dependencies; \
    plugin=/usr/lib/mysql/plugin/auth_pam.so; \
    helper_dir=/usr/lib/mysql/plugin/auth_pam_tool_dir; \
    helper="$helper_dir/auth_pam_tool"; \
    test -f "$plugin" || { echo "Missing MariaDB auth_pam plugin: $plugin" >&2; exit 1; }; \
    test -f "$helper" || { echo "Missing MariaDB PAM helper: $helper" >&2; exit 1; }; \
    chown root:mysql "$helper_dir" "$helper"; \
    chmod 0750 "$helper_dir"; \
    chmod 4750 "$helper"; \
    gosu mysql test -x "$helper"

RUN mkdir -p /etc/mysql/image.conf.d /etc/mysql/site.conf.d \
    && printf '%s\n' \
      '!includedir /etc/mysql/image.conf.d/' \
      '!includedir /etc/mysql/site.conf.d/' >> /etc/mysql/mariadb.cnf

COPY conf.d/ /etc/mysql/image.conf.d/
COPY --chmod=0644 pam.d/mariadb /etc/pam.d/mariadb
COPY --chmod=0755 docker-entrypoint.sh /usr/local/bin/ldap-entrypoint.sh

HEALTHCHECK --interval=10s --timeout=5s --retries=5 --start-period=15s \
  CMD healthcheck.sh --connect --innodb_initialized || exit 1

ENTRYPOINT ["ldap-entrypoint.sh"]
CMD ["mariadbd"]