name: CI and Deploy

on:
  push:
    branches:
    paths:
      - 'dhive/Projekt-KIQ-HP/**'
      - main
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  DEPLOY_HOST: projekt-kiq.d-hive.de
  DEPLOY_USER: github-deploy
  DEPLOY_PATH: /opt/projekt-kiq

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v5

      - name: Set up Node.js
        uses: actions/setup-node@v5
        with:
          node-version: 20
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Build frontend
        run: npm run build

      - name: Prepare SSH
        run: |
          install -d -m 700 ~/.ssh
          printf '%s\n' "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          ssh-keyscan -H "${DEPLOY_HOST}" > ~/.ssh/known_hosts
          chmod 600 ~/.ssh/known_hosts

      - name: Create directories
        run: |
          ssh -i ~/.ssh/deploy_key \
            -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes \
            "${DEPLOY_USER}@${DEPLOY_HOST}" \
            "install -d -m 755 ${DEPLOY_PATH}/site ${DEPLOY_PATH}/server/data"

      - name: Deploy frontend
        run: |
          rsync -az --delete \
            -e "ssh -i ~/.ssh/deploy_key -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes" \
            dist/ "${DEPLOY_USER}@${DEPLOY_HOST}:${DEPLOY_PATH}/site/"

      - name: Deploy backend + Docker files
        run: |
          rsync -az \
            -e "ssh -i ~/.ssh/deploy_key -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes" \
            server/ "${DEPLOY_USER}@${DEPLOY_HOST}:${DEPLOY_PATH}/server/"
          rsync -az \
            -e "ssh -i ~/.ssh/deploy_key -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes" \
            package.json package-lock.json Dockerfile docker-compose.yml \
            "${DEPLOY_USER}@${DEPLOY_HOST}:${DEPLOY_PATH}/"

      - name: Write .env
        run: |
          ssh -i ~/.ssh/deploy_key \
            -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes \
            "${DEPLOY_USER}@${DEPLOY_HOST}" \
            "printf '%s\n' \
              'PORT=3003' \
              'NODE_ENV=production' \
              'ADMIN_USER=${{ secrets.KIQ_ADMIN_USER }}' \
              'ADMIN_PASSWORD=${{ secrets.KIQ_ADMIN_PASSWORD }}' \
              'SESSION_SECRET=${{ secrets.KIQ_SESSION_SECRET }}' \
              'SMTP_HOST=${{ secrets.KIQ_SMTP_HOST }}' \
              'SMTP_PORT=${{ secrets.KIQ_SMTP_PORT }}' \
              'SMTP_USER=${{ secrets.KIQ_SMTP_USER }}' \
              'SMTP_PASS=${{ secrets.KIQ_SMTP_PASS }}' \
              'ALERT_EMAIL=${{ secrets.KIQ_ALERT_EMAIL }}' \
              > ${DEPLOY_PATH}/.env"

      - name: Deploy Caddyfile
        run: |
          rsync -az \
            -e "ssh -i ~/.ssh/deploy_key -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes" \
            Caddyfile "${DEPLOY_USER}@${DEPLOY_HOST}:${DEPLOY_PATH}/Caddyfile"
          ssh -i ~/.ssh/deploy_key \
            -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes \
            "${DEPLOY_USER}@${DEPLOY_HOST}" \
            "sudo -n /usr/bin/install -o root -g root -m 644 ${DEPLOY_PATH}/Caddyfile /etc/caddy/Caddyfile && \
             sudo -n /usr/bin/systemctl reload caddy"

      - name: Build and start Docker container
        run: |
          ssh -i ~/.ssh/deploy_key \
            -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes \
            "${DEPLOY_USER}@${DEPLOY_HOST}" \
            "cd ${DEPLOY_PATH} && sudo -n docker compose up -d --build"

      - name: Verify
        run: |
          sleep 5
          ssh -i ~/.ssh/deploy_key \
            -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes \
            "${DEPLOY_USER}@${DEPLOY_HOST}" \
            "curl -sf http://localhost:3003/api/health || sudo -n docker compose -f ${DEPLOY_PATH}/docker-compose.yml logs --tail 20"