name: Deploy to production droplet

on:
  push:
    branches: [main]
  workflow_dispatch: {}

concurrency:
  group: production-deployment
  cancel-in-progress: true

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Check out source
        uses: actions/checkout@v4

      - name: Install WireGuard
        run: |
          sudo apt-get update -y
          sudo apt-get install -y wireguard-tools

      # The CI peer must be configured on the droplet's wg0 interface:
      #   PublicKey = <public key matching CI_WG_PRIVATE_KEY>
      #   AllowedIPs = 10.100.2.11/32
      - name: Bring up production WireGuard tunnel
        env:
          CI_WG_PRIVATE_KEY: ${{ secrets.CI_WG_PRIVATE_KEY }}
          DROPLET_WG_PUBLIC_KEY: ${{ secrets.DROPLET_WG_PUBLIC_KEY }}
        run: |
          set -Eeuo pipefail
          umask 077
          sudo mkdir -p /etc/wireguard
          cat <<EOF | sudo tee /etc/wireguard/new-starr-ci.conf > /dev/null
          [Interface]
          PrivateKey = ${CI_WG_PRIVATE_KEY}
          Address = 10.100.2.11/32

          [Peer]
          PublicKey = ${DROPLET_WG_PUBLIC_KEY}
          Endpoint = 161.35.103.214:51820
          AllowedIPs = 10.100.2.1/32
          PersistentKeepalive = 25
          EOF
          sudo wg-quick up /etc/wireguard/new-starr-ci.conf

      - name: Configure SSH
        env:
          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
        run: |
          set -Eeuo pipefail
          install -d -m 700 "$HOME/.ssh"
          printf '%s\n' "$DEPLOY_SSH_KEY" > "$HOME/.ssh/new-starr-deploy"
          chmod 600 "$HOME/.ssh/new-starr-deploy"
          ssh-keyscan -H 10.100.2.1 >> "$HOME/.ssh/known_hosts"

      - name: Build frontend bundle
        run: |
          set -Eeuo pipefail
          scp -i "$HOME/.ssh/new-starr-deploy" \
            -o IdentitiesOnly=yes \
            starr-deploy@10.100.2.1:/home/starr-deploy/new_starr/apps/web/.env \
            apps/web/.env
          corepack enable
          corepack prepare pnpm@11.3.0 --activate
          pnpm install --no-frozen-lockfile
          pnpm --filter web build

      - name: Upload source
        run: |
          set -Eeuo pipefail
          tar \
            --exclude=.git \
            --exclude=node_modules \
            --exclude='apps/api/.env' \
            --exclude='apps/web/.env' \
            -czf - . |
            ssh -i "$HOME/.ssh/new-starr-deploy" \
              -o IdentitiesOnly=yes \
              starr-deploy@10.100.2.1 \
              'rm -rf "$HOME/new_starr-release" && mkdir -p "$HOME/new_starr-release" && tar -xzf - -C "$HOME/new_starr-release"'

      - name: Build and restart production stack
        run: |
          set -Eeuo pipefail
          ssh -i "$HOME/.ssh/new-starr-deploy" \
            -o IdentitiesOnly=yes \
            starr-deploy@10.100.2.1 <<'REMOTE'
          set -Eeuo pipefail
          cd "$HOME/new_starr-release"
          test -f "$HOME/new_starr/apps/api/.env"
          test -f "$HOME/new_starr/apps/web/.env"
          test -f "$HOME/new_starr/.env"
          cp "$HOME/new_starr/apps/api/.env" apps/api/.env
          cp "$HOME/new_starr/apps/web/.env" apps/web/.env
          cp "$HOME/new_starr/.env" .env
          docker compose up -d --build
          docker compose ps
          REMOTE