{ pkgs, ... }:
let
  rsshfsEntrypoint = pkgs.writeShellScriptBin "entrypoint" ''
    if [ ! -f /tmp/ssh_host_ed25519_key ]; then
      /bin/ssh-keygen -t ed25519 -f /tmp/ssh_host_ed25519_key -N ""
    fi

    echo "Launching OpenSSH Server (Unauthenticated Access Mode)..."
    /bin/sshd -f /etc/ssh/sshd_config
    
    sleep 1
    eval "exec $@"
  '';
  sshdConfig = pkgs.writeTextDir "etc/ssh/sshd_config" ''
    Port 22
    ListenAddress 0.0.0.0
    PidFile /tmp/sshd.pid

    # Turn off auth
    PermitEmptyPasswords yes
    AuthenticationMethods none

    # Turn off backup auth
    UsePAM no
    KbdInteractiveAuthentication no
    PasswordAuthentication no
    PubkeyAuthentication no

    # Only allow dev account
    PermitRootLogin no
    AllowUsers dev

    AllowTcpForwarding yes
    X11Forwarding no

    HostKey /tmp/ssh_host_ed25519_key
  '';
in
pkgs.dockerTools.buildLayeredImage {
  name = "rsshfs-client";
  tag = "latest";
  copyToRoot = pkgs.buildEnv {
    name = "root";
    pathsToLink = [ "/bin" "/etc" "/libexec" ];
    paths = [
      pkgs.bashInteractive
      pkgs.coreutils
      pkgs.openssh
      pkgs.tmux
      pkgs.sshfs
      sshdConfig
      rsshfsEntrypoint
    ];
  };
  fakeRootCommands = ''
    mkdir -p ./etc

    cat <<EOF > /etc/passwd
    root:x:0:0:root:/root:/bin/sh
    dev:x:1000:1000:dev:/home/dev:/bin/bash
    EOF

    cat <<EOF > /etc/group
    root:x:0:
    dev:x:1000:
    EOF

    cat <<EOF > /etc/shadow
    root:*:19000:0:99999:7:::
    dev::19000:0:99999:7:::
    EOF

    mkdir -p /var/run/sshd
    chmod 755 /var/run/sshd
    
    mkdir -p /home/dev/.ssh
    chown -R 1000:1000 /home/dev

    mkdir -p /containers
    chown -R 1000:1000 /containers
  '';
  Env = [
    "PATH=/bin"
  ];
  config = {
    Entrypoint = [ "/bin/entrypoint" ];
    Cmd = [ "tail" "-f" "/dev/null" ];
    ExposedPorts = { "2222/tcp" = {}; };
  };
}