FROM docker.io/debian:bookworm-slim@sha256:f80c45482c8d147da87613cb6878a7238b8642bcc24fc11bad78c7bec726f340
ARG VERSION=1.25 # renovate: datasource=github-tags depName=nginx/nginx extractVersion=^release-(?<version>.*)$

RUN apt-get update -y && apt-get install -y --no-install-recommends ca-certificates
ADD --chown=_apt https://nginx.org/keys/nginx_signing.key /etc/apt/trusted.gpg.d/nginx.asc

RUN echo "deb https://nginx.org/packages/mainline/debian bookworm nginx" > /etc/apt/sources.list.d/nginx.list && \
    apt-get update && apt-get install -y --no-install-recommends curl nginx="${VERSION}*" && \
    rm -Rf /etc/nginx

RUN addgroup --system --gid 10000 nginx-shared
RUN gpasswd --add nginx nginx-shared

COPY container/config /etc/nginx
COPY container/run-nginx /run-nginx

RUN nginx -t

EXPOSE 80 443
STOPSIGNAL SIGQUIT

ENTRYPOINT ["/run-nginx"]