FROM archlinux:latest

# Network restriction — only allow git.processhub.work
RUN pacman -Syu --noconfirm && \
    pacman -S --noconfirm \
      nodejs \
      npm \
      git \
      iptables \
      openssh \
      opencode \
      curl \
    && pacman -Scc --noconfirm

RUN npx -y skills add JuliusBrussee/caveman -g -a opencode -s caveman -y


# Git safe directory system-wide config
RUN git config --system --add safe.directory /workspace
RUN git config --system --add safe.directory '*'

# Firewall script — blocks everything except your Gitea instance
COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

WORKDIR /workspace

ENTRYPOINT ["/entrypoint.sh"]