name: Deploy to droplet

on:
  push:
    branches: [main]
    paths:
      - 'apps/api/**'
      - 'docker-compose.yml'
      - 'pnpm-lock.yaml'
      - 'pnpm-workspace.yaml'
  workflow_dispatch: {}

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      # nodejs-api only accepts SSH over its WireGuard tunnel (public :22 was
      # removed). This peer is scoped to AllowedIPs 10.100.1.3/32 on the
      # droplet side, so it can only ever reach 10.100.1.1 — nothing else.
      - name: Bring up WireGuard tunnel
        run: |
          sudo apt-get update -y
          sudo apt-get install -y wireguard-tools
          umask 077
          sudo mkdir -p /etc/wireguard
          cat <<EOF | sudo tee /etc/wireguard/wg0.conf > /dev/null
          [Interface]
          PrivateKey = ${{ secrets.CI_WG_PRIVATE_KEY }}
          Address = 10.100.1.3/32

          [Peer]
          PublicKey = ${{ secrets.NODEJS_API_WG_PUBLIC_KEY }}
          Endpoint = 68.183.239.171:51820
          AllowedIPs = 10.100.1.1/32
          PersistentKeepalive = 25
          EOF
          sudo wg-quick up wg0

      # The key below is restricted server-side to only run
      # /opt/new_starr/deploy.sh (see authorized_keys forced-command on the
      # droplet) — it can't run arbitrary commands even if this secret leaks.
      - name: Deploy via SSH
        uses: appleboy/ssh-action@v1
        with:
          host: 10.100.1.1
          username: deploy
          key: ${{ secrets.DEPLOY_SSH_KEY }}
          script: deploy