name: Deploy Production Data Services

# Manual deploy for Postgres and Redis. A backend release does not run this.
on:
  workflow_dispatch:

jobs:
  deploy:
    runs-on: mykopkb-production

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Deploy data services over SSH
        env:
          PROD_HOST: ${{ secrets.PROD_HOST }}
          PROD_USER: ${{ secrets.PROD_USER }}
          PROD_SSH_KEY: ${{ secrets.PROD_SSH_KEY }}
          PROD_DEPLOY_DIR: ${{ secrets.PROD_DEPLOY_DIR }}
        run: |
          set -euo pipefail

          if [ ! -f .env.production ]; then
            echo "ERROR: .env.production is missing from the repository checkout"
            exit 1
          fi

          if ! command -v ssh >/dev/null 2>&1; then
            apt-get update && apt-get install -y openssh-client
          fi

          mkdir -p ~/.ssh
          umask 077
          if printf '%s' "$PROD_SSH_KEY" | grep -q -- '-----BEGIN'; then
            printf '%b\n' "$PROD_SSH_KEY" | tr -d '\r' > ~/.ssh/id_ed25519
          else
            printf '%s' "$PROD_SSH_KEY" | tr -d '[:space:]' | base64 -d > ~/.ssh/id_ed25519
          fi
          chmod 600 ~/.ssh/id_ed25519
          if ! ssh-keygen -y -f ~/.ssh/id_ed25519 >/dev/null; then
            echo "ERROR: PROD_SSH_KEY is not a readable private key."
            exit 1
          fi
          ssh-keyscan -H "$PROD_HOST" >> ~/.ssh/known_hosts

          SSH=(ssh -i ~/.ssh/id_ed25519 -o IdentitiesOnly=yes "${PROD_USER}@${PROD_HOST}")

          "${SSH[@]}" "bash -s" << EOF
          set -euo pipefail
          for name in mykopkb-postgres-production mykopkb-redis-production; do
            if docker inspect "\$name" >/dev/null 2>&1; then
              project=\$(docker inspect -f '{{index .Config.Labels "com.docker.compose.project"}}' "\$name" 2>/dev/null || true)
              if [ "\$project" != "mykopkb-data" ]; then
                echo "ERROR: \$name is already running under compose project '\${project:-unknown}'."
                echo "This workflow does not replace the existing database or Redis containers."
                exit 1
              fi
            fi
          done
          EOF

          "${SSH[@]}" "mkdir -p '${PROD_DEPLOY_DIR}/redis-config' '${PROD_DEPLOY_DIR}/docker/postgres/conf.d'"
          scp -i ~/.ssh/id_ed25519 -o IdentitiesOnly=yes \
            docker/production/docker-compose.data.yml \
            "${PROD_USER}@${PROD_HOST}:${PROD_DEPLOY_DIR}/docker-compose.data.yml"
          scp -i ~/.ssh/id_ed25519 -o IdentitiesOnly=yes \
            .env.production \
            "${PROD_USER}@${PROD_HOST}:${PROD_DEPLOY_DIR}/.env"
          scp -i ~/.ssh/id_ed25519 -o IdentitiesOnly=yes \
            docker/production/redis/redis.conf \
            "${PROD_USER}@${PROD_HOST}:${PROD_DEPLOY_DIR}/redis-config/redis.conf"

          "${SSH[@]}" "bash -s" << EOF
          set -euo pipefail
          chmod 600 "${PROD_DEPLOY_DIR}/.env"

          docker network inspect mykopkb-production-network >/dev/null 2>&1 \
            || docker network create mykopkb-production-network

          cd "${PROD_DEPLOY_DIR}"
          docker compose -p mykopkb-data -f docker-compose.data.yml up -d
          docker compose -p mykopkb-data -f docker-compose.data.yml ps
          EOF