FROM alpine:latest

RUN apk add --no-cache curl unzip bash git jq

# Terraform
ARG TERRAFORM_VERSION=1.5.7
RUN curl -fsSL https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip -o terraform.zip && \
    unzip terraform.zip -d /usr/local/bin/ && \
    chmod +x /usr/local/bin/terraform && \
    rm -f terraform.zip

# Terragrunt
ARG TERRAGRUNT_VERSION=0.93.11
RUN curl -fsSL https://github.com/gruntwork-io/terragrunt/releases/download/v${TERRAGRUNT_VERSION}/terragrunt_linux_amd64 -o /usr/local/bin/terragrunt && \
    chmod +x /usr/local/bin/terragrunt

# SOPS (расшифровка secret-values через age; ключ передаётся в CI через SOPS_AGE_KEY)
ARG SOPS_VERSION=3.9.0
RUN curl -fsSL https://github.com/getsops/sops/releases/download/v${SOPS_VERSION}/sops-v${SOPS_VERSION}.linux.amd64 -o /usr/local/bin/sops && \
    chmod +x /usr/local/bin/sops

# Plugin cache и mirror для Yandex Cloud
RUN mkdir -p /root/.terraform.d/plugin-cache && \
    mkdir -p /root/.terraform.d && \
    echo 'provider_installation {' > /root/.terraformrc && \
    echo '  network_mirror {' >> /root/.terraformrc && \
    echo '    url = "https://terraform-mirror.yandexcloud.net/"' >> /root/.terraformrc && \
    echo '    include = ["registry.terraform.io/*/*"]' >> /root/.terraformrc && \
    echo '  }' >> /root/.terraformrc && \
    echo '  direct {' >> /root/.terraformrc && \
    echo '    exclude = ["registry.terraform.io/*/*"]' >> /root/.terraformrc && \
    echo '  }' >> /root/.terraformrc && \
    echo '}' >> /root/.terraformrc

# Environment variables
ENV TF_PLUGIN_CACHE_DIR=/root/.terraform.d/plugin-cache
ENV TG_TF_PATH=/usr/local/bin/terraform
ENV AWS_EC2_METADATA_DISABLED=true
ENV TF_CLI_ARGS="-no-color"

WORKDIR /workspace