{ pkgs, ... }:
let
  rsshfsEntrypoint = pkgs.writeShellScriptBin "entrypoint" ''
    if [ ! -f /tmp/ssh_host_ed25519_key ]; then
      /bin/ssh-keygen -t ed25519 -f /tmp/ssh_host_ed25519_key -N ""
    fi

    echo "Launching OpenSSH Server (Unauthenticated Access Mode)..."
    /bin/sshd -f /etc/ssh/sshd_config
    
    sleep 1
    eval "exec $@"
  '';
  sshdConfig = pkgs.writeTextDir "etc/ssh/sshd_config" ''
    Port 2222
    ListenAddress 0.0.0.0
    PidFile /tmp/sshd.pid

    # Turn off auth
    PermitEmptyPasswords yes
    PasswordAuthentication yes
    AuthenticationMethods none

    # Turn off backup auth
    UsePAM no
    KbdInteractiveAuthentication no
    PubkeyAuthentication no

    # Only allow dev account
    PermitRootLogin no
    AllowUsers dev

    AllowTcpForwarding yes
    X11Forwarding no

    HostKey /tmp/ssh_host_ed25519_key
  '';
in
pkgs.dockerTools.buildLayeredImage {
  name = "rsshfs-server";
  tag = "latest";
  contents = [
    pkgs.bashInteractive
    pkgs.coreutils
    (pkgs.symlinkJoin {
      name = "openssh-with-custom-config";
      paths = [ sshdConfig pkgs.openssh ];
    })
    pkgs.tmux
    pkgs.sshfs
    rsshfsEntrypoint
  ];
  fakeRootCommands = ''
    mkdir -p ./etc
    mkdir -p ./tmp
    chmod 777 ./tmp

    cat <<EOF > ./etc/passwd
    root:x:0:0:root:/root:/bin/sh
    dev:x:1000:1000:dev:/home/dev:/bin/bash
    EOF

    cat <<EOF > ./etc/group
    root:x:0:
    dev:x:1000:
    EOF

    cat <<EOF > ./etc/shadow
    root:*:19000:0:99999:7:::
    dev::19000:0:99999:7:::
    EOF

    mkdir -p ./var/run/sshd
    chmod 755 ./var/run/sshd
    
    mkdir -p ./home/dev/.ssh
    chown -R 1000:1000 ./home/dev

    mkdir -p ./containers
    chown -R 1000:1000 ./containers
  '';
  config = {
    Entrypoint = [ "/bin/entrypoint" ];
    Cmd = [ "tail" "-f" "/dev/null" ];
    ExposedPorts = { "2222/tcp" = {}; };
    Env = [
      "PATH=/bin"
    ];
  };
}