FROM docker.m.daocloud.io/jenkins/jenkins:2.555.3-jdk21

ENV TZ=Asia/Shanghai
ENV LANG=en_US.UTF-8
ENV LC_ALL=en_US.UTF-8

USER root

RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        wget \
        curl \
        ca-certificates \
        ssh-client \
        git \
        python3-pip \
        python3-cryptography \
        tzdata \
        && rm -rf /var/lib/apt/lists/*

RUN pip3 install --break-system-packages cryptography requests pycryptodome pymysql

RUN mkdir -p /var/jenkins_home && \
    chown -R jenkins:jenkins /var/jenkins_home && \
    mkdir -p /var/log/jenkins && \
    chown -R jenkins:jenkins /var/log/jenkins && \
    mkdir -p /var/jenkins/maven-repo && \
    chown -R jenkins:jenkins /var/jenkins/maven-repo && \
    mkdir -p /var/jenkins/backup && \
    chown -R jenkins:jenkins /var/jenkins/backup

RUN MAVEN_VERSION="3.9.8" && \
    MAVEN_SHA256="067672629075b740e3d0a928e21021dd615a53287af36d4ccca44e87e081d102" && \
    wget -q "https://archive.apache.org/dist/maven/maven-3/${MAVEN_VERSION}/binaries/apache-maven-${MAVEN_VERSION}-bin.tar.gz" && \
    echo "${MAVEN_SHA256}  apache-maven-${MAVEN_VERSION}-bin.tar.gz" | sha256sum -c - && \
    tar -xzf "apache-maven-${MAVEN_VERSION}-bin.tar.gz" -C /opt/ && \
    ln -s "/opt/apache-maven-${MAVEN_VERSION}" /opt/maven && \
    rm -f "apache-maven-${MAVEN_VERSION}-bin.tar.gz"

RUN sed -i 's/^PermitRootLogin yes$/PermitRootLogin no/' /etc/ssh/sshd_config 2>/dev/null || true

RUN rm -f /etc/localtime && \
    ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime && \
    dpkg-reconfigure -f noninteractive tzdata

COPY jenkins-wrapper.sh /usr/local/bin/jenkins-wrapper.sh
RUN chmod +x /usr/local/bin/jenkins-wrapper.sh

COPY backup_jenkins.sh /usr/local/bin/backup_jenkins.sh
RUN chmod +x /usr/local/bin/backup_jenkins.sh

COPY settings.xml /opt/maven/conf/settings.xml

COPY init.groovy.d /usr/share/jenkins/ref/init.groovy.d/
COPY plugins.txt /usr/share/jenkins/ref/plugins.txt
RUN jenkins-plugin-cli -f /usr/share/jenkins/ref/plugins.txt

RUN chown -R jenkins:jenkins /usr/share/jenkins/ref

RUN mkdir -p /etc/sudoers.d && \
    echo "jenkins ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers.d/jenkins && \
    chmod 0440 /etc/sudoers.d/jenkins

USER jenkins

ENV JENKINS_HOME=/var/jenkins_home
ENV MAVEN_HOME=/opt/maven
ENV PATH=/opt/maven/bin:$PATH
ENV MAVEN_OPTS="-Xms512m -Xmx1024m -XX:+UseG1GC -Dmaven.repo.local=/var/jenkins/maven-repo"
ENV JAVA_OPTS="-Xms1024m -Xmx2048m -XX:MaxMetaspaceSize=512m -XX:+UseG1GC -XX:+ParallelRefProcEnabled -XX:+UseStringDeduplication -Djava.awt.headless=true -Djenkins.install.runSetupWizard=false"
ENV JENKINS_OPTS="--httpPort=8080 --prefix=/jenkins --sessionTimeout=86400"

HEALTHCHECK --interval=60s --timeout=10s --retries=3 --start-period=180s \
    CMD curl -f http://localhost:8080/jenkins/api/json?tree=version || exit 1

ENTRYPOINT ["/usr/local/bin/jenkins-wrapper.sh"]