FROM bitnami/haproxy

# The base is Photon OS, and its openssl.cnf reads this variable directly:
#
#     [alg_sect]
#     default_properties = ?fips=$ENV::OPENSSL_FIPS
#
# The base image ships "yes", so every algorithm fetch prefers the FIPS
# provider — and that provider cannot produce an X25519MLKEM768 key:
# ssl_generate_pkey_group fails. HAProxy offers the group regardless, because
# OpenSSL 3.5 lists it first and haproxy.cfg sets no `ssl-default-bind-curves`,
# so it picks a group it then cannot use and answers a fatal illegal_parameter.
# Every client that offers post-quantum key exchange — curl, browsers, anything
# on OpenSSL 3.5 — is refused; only a client asking for a classical group gets
# in. That is how this image closed the public door on 2026-09-02 with no commit
# behind it: `FROM bitnami/haproxy` is untagged and the daily scheduled build
# picks up whatever the base is that morning.
#
# Nothing here needs FIPS. Flipping the variable the base image itself provides
# restores the door and the post-quantum exchange both; the FIPS provider stays
# loaded, only the preference is dropped.
ENV OPENSSL_FIPS=no

# Copy config
COPY ./docker/haproxy.cfg /bitnami/haproxy/conf/haproxy.cfg

# Directory for the runtime API socket. HAProxy runs as uid 1001 here and binds
# a unix socket by creating `<path>.<pid>.tmp` and renaming it over the target,
# so it needs write permission on the *directory*, not just the file — which is
# also why a stale socket left by a previous run is harmless.
#
# /var/lib is owned by root, hence the explicit USER switch. Docker copies this
# ownership onto an empty named volume when it initialises one here, so the
# volume shared with certbot comes up writable by HAProxy without a chown at
# runtime.
USER root
RUN mkdir -p /var/lib/haproxy && chown 1001:1001 /var/lib/haproxy
USER 1001

# The base image's entrypoint is the haproxy binary itself, with no shell in
# between, so this wrapper is the whole chain: it fills in XFF_HMAC_KEY when
# nothing else did (see the script for why that is better than requiring it) and
# execs the same binary with the same arguments. CMD is restated rather than
# left to inheritance — it would be inherited, but a changed ENTRYPOINT is
# exactly where that stops being obvious to the next reader.
COPY --chmod=0755 ./docker/entrypoint.sh /entrypoint.sh
ENTRYPOINT ["/entrypoint.sh"]
CMD ["-f", "/bitnami/haproxy/conf/haproxy.cfg"]