FROM debian:stable-slim

RUN apt-get update && \
    apt-get install -y --no-install-recommends wireguard iproute2 iptables bash ca-certificates && \
    rm -rf /var/lib/apt/lists/*

# WireGuard config will be mounted at runtime
RUN mkdir -p /etc/wireguard

COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

ENTRYPOINT ["/entrypoint.sh"]