name: Deploy

# Builds the static frontend and the Go share-service, ships both to the
# Caddy host, and restarts the service.
#
# Required repo secret:
#   DEPLOY_SSH_KEY  - base64-encoded private SSH key authorized for
#                     ${DEPLOY_USER}@${DEPLOY_HOST}. Generate with:
#                       base64 -w0 < deploy_key      # Linux
#                       base64 -i deploy_key | tr -d '\n'   # macOS
#
# Override host/user/paths via repo variables (Settings > Actions > Variables)
# if they ever change; the defaults below match the Justfile.

on:
  push:
    branches: [master]
  workflow_dispatch:

env:
  DEPLOY_HOST: ${{ vars.DEPLOY_HOST || 'goldfish.malzahn.lan' }}
  DEPLOY_USER: ${{ vars.DEPLOY_USER || 'root' }}
  WWW_ROOT: ${{ vars.WWW_ROOT || '/usr/share/caddy/public_html/fabula' }}
  GO_ARCH: ${{ vars.GO_ARCH || 'amd64' }}

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # --- Build frontend ---
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm
      - run: npm ci
      - run: npm run build # -> dist/

      # --- Build backend (static, no cgo) ---
      - uses: actions/setup-go@v5
        with:
          go-version-file: server/go.mod
          cache-dependency-path: server/go.sum
      - name: Build share-svc
        working-directory: server
        run: CGO_ENABLED=0 GOOS=linux GOARCH="$GO_ARCH" go build -o share-svc .

      # --- Deploy ---
      - name: Configure SSH
        run: |
          command -v rsync >/dev/null || { apt-get update && apt-get install -y rsync; }
          mkdir -p ~/.ssh && chmod 700 ~/.ssh
          # DEPLOY_SSH_KEY is stored base64-encoded so the PEM survives the
          # secret round-trip intact (no CRLF/whitespace/newline mangling).
          echo "${{ secrets.DEPLOY_SSH_KEY }}" | base64 -d > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          ssh-keyscan -H "$DEPLOY_HOST" >> ~/.ssh/known_hosts 2>/dev/null

      - name: Copy frontend
        run: |
          rsync -az --delete -e "ssh -i ~/.ssh/deploy_key" \
            dist/ "$DEPLOY_USER@$DEPLOY_HOST:$WWW_ROOT/"

      - name: Copy backend binary + unit file
        run: |
          scp -i ~/.ssh/deploy_key server/share-svc \
            "$DEPLOY_USER@$DEPLOY_HOST:/usr/local/bin/share-svc"
          scp -i ~/.ssh/deploy_key server/share-svc.service \
            "$DEPLOY_USER@$DEPLOY_HOST:/etc/systemd/system/share-svc.service"

      - name: Restart services
        run: |
          ssh -i ~/.ssh/deploy_key "$DEPLOY_USER@$DEPLOY_HOST" '
            systemctl daemon-reload &&
            systemctl enable --now share-svc &&
            systemctl restart share-svc &&
            systemctl reload caddy
          '