# PIA WireGuard peer regenerator for gluetun custom mode.
# Uses PIA's official CA-pinned curl flow (token + addKey) instead of the Go
# pia-wg-config binary, which modern-Go TLS breaks on PIA's legacy-CommonName
# (no-SAN) server certs. See regen-entrypoint.sh / memory pia-wg-regen-broken-go-legacy-cn.
FROM alpine:3.20
RUN apk add --no-cache bash curl jq wireguard-tools ca-certificates
COPY ca.rsa.4096.crt /etc/pia/ca.rsa.4096.crt
COPY regen-entrypoint.sh /usr/local/bin/regen-entrypoint.sh
RUN chmod +x /usr/local/bin/regen-entrypoint.sh
ENTRYPOINT ["/usr/local/bin/regen-entrypoint.sh"]