DockerfileNIX2

# vim: set ft=dockerfile:
FROM nixos/nix:latest AS nix

FROM busybox:latest

RUN mkdir -p /etc/ssl/certs
COPY --from=nix /nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt /etc/ssl/certs/ca-certificates.crt

WORKDIR /app
RUN --mount=type=bind,source=context.tar,target=context.tar \
  tar xf context.tar && \
  mkdir -p /nix && mv nixstore /nix/store && \
  mkdir -p /usr/local/bin && mv result/bin/* /usr/local/bin/ && rm -rf result && \
  mv tf.zst /app/tf.zst

RUN adduser --disabled-password --home="/app" --uid 1717 nonroot
COPY --chown=nonroot ./terraform ./terraform
COPY --chown=nonroot ./infrastructure-templates ./infrastructure-templates
ENV TF_PLUGIN_CACHE_DIR="/app/.terraform.d/plugin-cache"
ENV DECOMPRESS_CMD="zstd --decompress tf.zst --stdout | tar xf -"
ENV TEMPLATES_DIR="/app/infrastructure-templates"