# The installation wizard. It does NOT run the cluster — it installs a toolchain
# onto the host and gets out of the way.
#
# This exists to kill a bootstrap paradox: a plain bash installer needs curl, jq
# and sha256sum to already be present, and a minimal Debian has none of them.
# The wizard carries its own toolchain, so the only host prerequisite is Docker.
#
# Two variants from one file:
#   docker build -f ctrl/Dockerfile.wizard --target wizard      -t <slug>-wizard        .
#   docker build -f ctrl/Dockerfile.wizard --target wizard-full -t <slug>-wizard:full   .
#
# wizard-full bakes every pinned binary in at build time. `docker save` it and
# you have the whole installer as one file to carry into an air-gapped network.

FROM debian:trixie-slim AS wizard

# ca-certificates + curl: fetch and verify. graphviz + python3: render diagrams
# and validate the arch model, so the host never needs an apt package.
#
# docker-cli, NOT docker.io: we only ever talk to the host's daemon through the
# mounted socket, and under --no-install-recommends the docker.io package ships
# docker-init without the actual `docker` binary.
RUN apt-get update && apt-get install -y --no-install-recommends \
        ca-certificates curl jq graphviz python3 docker-cli \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /work
COPY ctrl/versions.env /work/ctrl/versions.env
COPY ctrl/wizard.sh    /work/ctrl/wizard.sh
RUN chmod +x /work/ctrl/wizard.sh

# Defaults; every one is overridable with -e at run time.
ENV DEPS_SOURCE=upstream \
    OUT_BIN=/out/bin \
    HOST_ROOT=/host

ENTRYPOINT ["/work/ctrl/wizard.sh"]
CMD ["install"]


# ---------------------------------------------------------------------------
# wizard-full — same wizard, binaries baked in, works with no network at all.
FROM wizard AS wizard-full
RUN /work/ctrl/wizard.sh fetch --to /opt/rig/bin
ENV DEPS_SOURCE=baked \
    BAKED_BIN=/opt/rig/bin