FROM debian:stable-slim

LABEL maintainer="12ww1160@confdroid.com"
ENV PGBOUNCER_VERSION=1.22.1

# Ensure tzdata is installed without prompts
ENV DEBIAN_FRONTEND=noninteractive
RUN apt-get update && \
    echo "tzdata tzdata/Areas select Etc" | debconf-set-selections && \
    echo "tzdata tzdata/Zones/Etc select UTC" | debconf-set-selections && \
    apt-get install -y --no-install-recommends \
        pgbouncer \
        ca-certificates \
        tzdata \
        netcat-openbsd \
    && rm -rf /var/lib/apt/lists/*

# Create non-root user
RUN groupadd -r pgbouncer && \
    useradd -r -g pgbouncer -d /etc/pgbouncer -s /usr/sbin/nologin pgbouncer

# Directories
RUN mkdir -p /etc/pgbouncer /etc/pgbouncer/tls

RUN chown -R pgbouncer:pgbouncer /etc/pgbouncer && \
    chmod 700 /etc/pgbouncer && \
    chmod 700 /etc/pgbouncer/tls

# Drop privileges
USER pgbouncer

EXPOSE 6432

# Healthcheck
HEALTHCHECK --interval=10s --timeout=3s --retries=3 CMD \
    pg_isready -h 127.0.0.1 -p 6432 || exit 1

ENTRYPOINT ["/usr/bin/dumb-init", "--"]
CMD ["pgbouncer", "/etc/pgbouncer/pgbouncer.ini"]