name: Deploy

on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: bare
    env:
      # The bare runner's own systemd service intentionally has a minimal
      # PATH/HOME (no rustup default toolchain in reach) - point it at the
      # shared toolchain install directly rather than assuming an ambient
      # dev shell environment.
      CARGO_HOME: /var/local/cargo
      RUSTUP_HOME: /var/local/rustup
      PATH: /var/local/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/bin
    steps:
      - uses: actions/checkout@v4

      - name: Build
        run: cargo leptos build --release

      - name: Ship release
        run: |
          set -euo pipefail
          rel="/srv/app/uhhm-portal/releases/${{ github.sha }}"
          mkdir -p "$rel"
          cp target/release/portal "$rel/uhhm-portal"
          cp -r target/site "$rel/site"
          ln -sfn "$rel" /srv/app/uhhm-portal/current

      # Sourced from this repo's own Settings -> Actions Variables/Secrets,
      # not typed onto the host by hand - see the infrastructure repo's
      # deploy-runner plan for the exact names/values to configure once.
      - name: Write service env
        run: |
          cat > /etc/app/uhhm-portal.env <<EOF
          NATS_URL=${{ secrets.PORTAL_NATS_URL }}
          KANIDM_URL=${{ vars.PORTAL_KANIDM_URL }}
          OAUTH2_CLIENT_ID=${{ vars.PORTAL_OAUTH2_CLIENT_ID }}
          OAUTH2_CLIENT_SECRET=${{ secrets.PORTAL_OAUTH2_CLIENT_SECRET }}
          PUBLIC_URL=${{ vars.PORTAL_PUBLIC_URL }}
          COOKIE_SECURE=true
          CONTENT_REPO=https://project.uhhm.no/uhhm/questions
          CONTENT_BRANCH=main
          SITE_NAME=${{ vars.PORTAL_SITE_NAME }}
          LEPTOS_SITE_ADDR=0.0.0.0:3010
          EOF

      - name: Restart service
        run: sudo systemctl restart app@uhhm-portal.service

      - name: Update Caddy routing
        run: |
          cat > /etc/caddy/services.d/uhhm-portal.caddy <<'EOF'
          www.{$DOMAIN}, {$DOMAIN} {
          	reverse_proxy host.docker.internal:3010
          	log { output file /var/log/caddy/www.log }
          }
          EOF
          sudo docker exec caddy caddy reload --config /etc/caddy/Caddyfile --adapter caddyfile