workspaces/build-workspace.sh

#!/bin/bash

set -euo pipefail

IMG_NAME="analytics-backend-workspace"
DEV_USER=devuser
DEV_UID=1001
DEV_GID=1001
DEV_HOME=/home/$DEV_USER

ctr=$(buildah from archlinux)

buildah run "$ctr" -- bash -c "\
  pacman -Sy --noconfirm && pacman -S --noconfirm --needed base-devel neovim git fish tmux \
  nodejs python podman fzf fd ripgrep jdk-openjdk fisher yazi less buildah \
  lazygit luarocks python-pynvim npm bash-completion tree-sitter-cli kitty-terminfo \
  lua51 openssh && pacman -Scc --noconfirm && groupadd secproc && groupadd -g $DEV_GID $DEV_USER && \
  useradd -ms /bin/fish -G secproc -u $DEV_UID -g $DEV_GID $DEV_USER
"

buildah add "$ctr" home.tar.gz $DEV_HOME

# configure lazyvim
# shellcheck disable=SC2016
buildah run --user "$DEV_USER" "$ctr" -- fish -c '
  set -gx HOME '"$DEV_HOME"';
  ssh-keyscan -p 2222 10.88.0.1 >> $HOME/.ssh/known_hosts;
  ssh-keyscan -p 22 github.com >> $HOME/.ssh/known_hosts;
'

# lock the files
buildah run "$ctr" -- bash -c "\
  chmod 750 $DEV_HOME/start.sh \
  $DEV_HOME/.config/lazygit/config.yml \
  $DEV_HOME/.config/nvim/lua/config/lazy.lua \
  $DEV_HOME/.config/nvim/init.lua \
  $DEV_HOME/.config/nvim/README.md \
  $DEV_HOME/.config/nvim/LICENSE \
  $DEV_HOME/.config/tmux/tmux.conf && \
  chown root:secproc $DEV_HOME/start.sh \
  $DEV_HOME/.config/lazygit/config.yml \
  $DEV_HOME/.config/nvim/lua/config/lazy.lua \
  $DEV_HOME/.config/nvim/init.lua \
  $DEV_HOME/.config/nvim/README.md \
  $DEV_HOME/.config/nvim/LICENSE \
  $DEV_HOME/.config/tmux/tmux.conf
"

buildah config \
  --user $DEV_USER \
  --workingdir /app \
  --env CONTAINER_HOST=unix:///run/podman/podman.sock \
  --cmd "[\"$DEV_HOME/start.sh\"]" \
  "$ctr"

buildah commit "$ctr" $IMG_NAME

echo "✅ $IMG_NAME built."