name: Build and Deploy to Production

on:
  push:
    branches:
      - main

jobs:
  build:
    runs-on: arch-latest
    container:
      image: gcr.io/kaniko-project/executor:debug
    outputs:
      image_tag: ${{ steps.build_image.outputs.image_tag }}
    steps:
      - name: Build and push Docker Image using Kaniko
        id: build_image
        run: |
          # Tags
          SHORT_SHA=${GITHUB_SHA::8}
          IMAGE_BASE=${{ secrets.FORGEJO_REGISTRY }}/${{ secrets.FORGEJO_USER }}/asxpio
          IMAGE_TAG=${IMAGE_BASE}:${SHORT_SHA}
          IMAGE_LATEST=${IMAGE_BASE}:latest

          # Auth Conf
          mkdir -p /kaniko/.docker
          echo "{\"auths\":{\"${{ secrets.FORGEJO_REGISTRY }}\":{\"auth\":\"$(echo -n ${{ secrets.FORGEJO_USER }}:${{ secrets.FORGEJO_TOKEN }} | base64)\"}}}" > /kaniko/.docker/config.json

          # Build & push
          /kaniko/executor \
            --context=git://${{ secrets.FORGEJO_REGISTRY }}/${{ github.repository }}.git \
            --git=branch=${{ github.ref_name }} \
            --destination=$IMAGE_TAG \
            --destination=$IMAGE_LATEST

          # Output the specific tag for deployment
          echo "image_tag=${IMAGE_TAG}" >> $GITHUB_OUTPUT

  deploy:
    runs-on: arch-latest
    needs: build
    steps:
      - name: Install dependencies
        run: |
          pacman -Syu --noconfirm nodejs openssh rsync

      - name: Checkout code
        uses: actions/checkout@v4

      - name: Deploy docker-compose.yml
        uses: easingthemes/ssh-deploy@v5.1.0
        with:
          SSH_PRIVATE_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
          REMOTE_HOST: ${{ secrets.DEPLOY_IP }}
          REMOTE_USER: ${{ secrets.DEPLOY_USER }}
          SOURCE: "docker-compose.yml"
          TARGET: "/opt/asxpio/"

      - name: Deploy .env from secrets
        uses: appleboy/ssh-action@v1.2.3
        env:
          SESSION_SECRET: ${{ secrets.SESSION_SECRET }}
          SMTP_PASSWORD: ${{ secrets.SMTP_PASSWORD }}
          ADMIN_USER: ${{ secrets.ADMIN_USER }}
          ADMIN_PASSWORD: ${{ secrets.ADMIN_PASSWORD }}
          ASXPIO_DB_PASSWORD: ${{ secrets.ASXPIO_DB_PASSWORD }}
          ASXPIO_S3_ACCESS_KEY: ${{ secrets.ASXPIO_S3_ACCESS_KEY }}
          ASXPIO_S3_SECRET_KEY: ${{ secrets.ASXPIO_S3_SECRET_KEY }}
        with:
          host: ${{ secrets.DEPLOY_IP }}
          username: ${{ secrets.DEPLOY_USER }}
          key: ${{ secrets.DEPLOY_SSH_KEY }}
          envs: SESSION_SECRET,SMTP_PASSWORD,ADMIN_USER,ADMIN_PASSWORD,ASXPIO_DB_PASSWORD,ASXPIO_S3_ACCESS_KEY,ASXPIO_S3_SECRET_KEY
          script_stop: true
          script: |
            umask 077
            mkdir -p /opt/asxpio
            cat > /opt/asxpio/.env <<EOF
            RACK_ENV=production
            SESSION_SECRET=${SESSION_SECRET}
            SMTP_ADDR=smtp.fastmail.com
            SMTP_PORT=587
            SMTP_USER=me@asxp.io
            SMTP_PASSWORD=${SMTP_PASSWORD}
            MAIL_FROM=IE Sergei Poljanski Contact Form <me@asxp.io>
            MAIL_TO=ie@asxp.io
            ADMIN_USER=${ADMIN_USER}
            ADMIN_PASSWORD=${ADMIN_PASSWORD}
            DATABASE_URL=postgres://asxpio:${ASXPIO_DB_PASSWORD}@postgres:5432/asxpio
            S3_ENDPOINT=http://minio:9000
            S3_PUBLIC_ENDPOINT=https://s3.asxp.io
            S3_REGION=us-east-1
            S3_BUCKET=asxpio-invoices
            S3_ACCESS_KEY=${ASXPIO_S3_ACCESS_KEY}
            S3_SECRET_KEY=${ASXPIO_S3_SECRET_KEY}
            EOF
            chmod 600 /opt/asxpio/.env

      - name: Deploy and update container
        uses: appleboy/ssh-action@v1.2.3
        env:
          NEW_IMAGE: ${{ needs.build.outputs.image_tag }}
        with:
          host: ${{ secrets.DEPLOY_IP }}
          username: ${{ secrets.DEPLOY_USER }}
          key: ${{ secrets.DEPLOY_SSH_KEY }}
          envs: NEW_IMAGE
          script: |
            cd /opt/asxpio

            sed -i "s|image:.*|image: $NEW_IMAGE|" docker-compose.yml

            docker pull $NEW_IMAGE
            docker compose up -d

            sleep 5
            docker ps | grep asxpio || exit 1

            echo "Deployment successful!"