FROM debian:10 AS build

ARG PCRE_VERSION="8.44"
ARG PCRE_CHECKSUM="aecafd4af3bd0f3935721af77b889d9024b2e01d96b58471bd91a3063fb47728"

ARG ZLIB_VERSION="1.2.11"
ARG ZLIB_CHECKSUM="c3e5e9fdd5004dcb542feda5ee4f0ff0744628baf8ed2dd5d66f8ca1197cb1a1"

ARG OPENSSL_VERSION="1.1.1g"
ARG OPENSSL_CHECKSUM="ddb04774f1e32f0c49751e21b67216ac87852ceb056b75209af2443400636d46"

ARG VERSION="1.17.10"
ARG CHECKSUM="a9aa73f19c352a6b166d78e2a664bb3ef1295bbe6d3cc5aa7404bd4664ab4b83"
ARG CONFIG="\
    --with-cc-opt='-fstack-protector-all' \
    --with-ld-opt='-Wl,-z,relro,-z,now' \
    --sbin-path=/nginx \
    --conf-path=/etc/nginx/nginx.conf \
    --pid-path=/tmp/nginx.pid \
    --http-log-path=/dev/stdout \
    --error-log-path=/dev/stderr \
    --http-client-body-temp-path=/tmp/client_temp \
    --http-proxy-temp-path=/tmp/proxy_temp \
    --http-fastcgi-temp-path=/tmp/fastcgi_temp \
    --http-uwsgi-temp-path=/tmp/uwsgi_temp \
    --http-scgi-temp-path=/tmp/scgi_temp \
    --with-pcre=/tmp/pcre-$PCRE_VERSION \
    --with-openssl=/tmp/openssl-$OPENSSL_VERSION \
    --with-zlib=/tmp/zlib-$ZLIB_VERSION \
    --with-file-aio \
    --with-http_v2_module \
    --with-http_ssl_module \
    --with-http_stub_status_module \
    --with-stream \
    --with-stream_ssl_module \
    --with-threads"

ADD https://ftp.pcre.org/pub/pcre/pcre-$PCRE_VERSION.tar.gz /tmp/pcre.tar.gz
ADD https://www.openssl.org/source/openssl-$OPENSSL_VERSION.tar.gz /tmp/openssl.tar.gz
ADD https://zlib.net/zlib-$ZLIB_VERSION.tar.gz /tmp/zlib.tar.gz
ADD https://nginx.org/download/nginx-$VERSION.tar.gz /tmp/nginx.tar.gz

RUN [ "$PCRE_CHECKSUM" = "$(sha256sum /tmp/pcre.tar.gz | awk '{print $1}')" ] && \
    [ "$ZLIB_CHECKSUM" = "$(sha256sum /tmp/zlib.tar.gz | awk '{print $1}')" ] && \
    [ "$OPENSSL_CHECKSUM" = "$(sha256sum /tmp/openssl.tar.gz | awk '{print $1}')" ] && \
    [ "$CHECKSUM" = "$(sha256sum /tmp/nginx.tar.gz | awk '{print $1}')" ] && \
    tar -C /tmp -xf /tmp/pcre.tar.gz && \
    tar -C /tmp -xf /tmp/zlib.tar.gz && \
    tar -C /tmp -xf /tmp/openssl.tar.gz && \
    tar -C /tmp -xf /tmp/nginx.tar.gz && \
    apt update && \
    apt install -y gcc g++ perl make ca-certificates && \
    cd /tmp/nginx-$VERSION && \
      ./configure $CONFIG && \
      make

RUN mkdir -p /rootfs/etc/ssl/certs /rootfs/lib/x86_64-linux-gnu /rootfs/lib64 /rootfs/tmp && \
    cp /tmp/nginx-$VERSION/objs/nginx /rootfs/ && \
    cp \
      /lib/x86_64-linux-gnu/libc.so.6 \
      /lib/x86_64-linux-gnu/libcrypt.so.1 \
      /lib/x86_64-linux-gnu/libdl.so.2 \
      /lib/x86_64-linux-gnu/libnss_files.so.2 \
      /lib/x86_64-linux-gnu/libnss_dns.so.2 \
      /lib/x86_64-linux-gnu/libpthread.so.0 \
      /lib/x86_64-linux-gnu/libresolv.so.2 \
      /rootfs/lib/x86_64-linux-gnu/ && \
    cp /lib64/ld-linux-x86-64.so.2 /rootfs/lib64/ && \
    echo "nogroup:*:100:nobody" > /rootfs/etc/group && \
    echo "nobody:*:100:100:::" > /rootfs/etc/passwd && \
    cp /etc/ssl/certs/ca-certificates.crt /rootfs/etc/ssl/certs/


FROM scratch

COPY --from=build --chown=100:100 /rootfs /

USER 100:100
ENTRYPOINT ["/nginx"]
CMD ["-g", "daemon off;"]