FROM archlinux:latest

# Network restriction — only allow git.processhub.work
RUN pacman -Syu --noconfirm && \
    pacman -S --noconfirm \
      nodejs \
      npm \
      git \
      iptables \
      openssh \
      opencode \
    && pacman -Scc --noconfirm

# Git safe directory system-wide config
RUN git config --system --add safe.directory /workspace
RUN git config --system --add safe.directory '*'

# Firewall script — blocks everything except your Gitea instance
COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

WORKDIR /workspace

ENTRYPOINT ["/entrypoint.sh"]