# syntax=docker/dockerfile:1
#
# EDR internal chat web client. Unmodified upstream Element Web + our public,
# non-secret config (homeserver URL, branding) and the SSO handoff page.
# Pin the tag; never float on `latest`.
FROM ghcr.io/element-hq/element-web:v1.11.108

COPY config.json.tmpl /app/config.json.tmpl
COPY sso.html /app/sso.html
# Replaces the upstream manifest, which names the app "Element" and advertises
# the Play/App Store builds under related_applications. Those apps cannot log
# in here — this deployment has no password login and no SSO provider, only the
# JWT handoff from freight-api — so pointing staff at them is a dead end.
COPY manifest.json /app/manifest.json
COPY 40-element-config.sh /docker-entrypoint.d/40-element-config.sh

# The image runs as uid 101 (nginx) but ships /app root-owned, so the startup
# hook could not write the rendered config without this.
USER root
RUN chmod +x /docker-entrypoint.d/40-element-config.sh \
    && touch /app/config.json \
    && chown nginx:nginx /app/config.json
USER nginx