name: Deploy

on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: bare
    env:
      # The bare runner's own systemd service intentionally has a minimal
      # PATH/HOME (no rustup default toolchain in reach) - point it at the
      # shared toolchain install directly rather than assuming an ambient
      # dev shell environment.
      CARGO_HOME: /var/local/cargo
      RUSTUP_HOME: /var/local/rustup
      PATH: /var/local/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/bin
      # Shared with interactive dev builds (see ~/.config/fish/config.fish)
      # so a crate compiled once, by either a manual build or CI, is
      # cached for the other - real cache hits, not just a warm toolchain.
      SCCACHE_DIR: /var/local/sccache
      CARGO_TARGET_DIR: /var/local/cargo-target
    steps:
      - uses: actions/checkout@v4

      - name: Build
        run: cargo leptos build --release

      - name: Ship release
        run: |
          set -euo pipefail
          rel="/srv/app/uhhm-portal/releases/${{ github.sha }}"
          mkdir -p "$rel"
          cp "$CARGO_TARGET_DIR/release/portal" "$rel/uhhm-portal"
          cp -r "$CARGO_TARGET_DIR/site" "$rel/site"
          ln -sfn "$rel" /srv/app/uhhm-portal/current

      # Sourced from this repo's own Settings -> Actions Variables/Secrets,
      # not typed onto the host by hand - see the infrastructure repo's
      # deploy-runner plan for the exact names/values to configure once.
      - name: Write service env
        run: |
          cat > /etc/app/uhhm-portal.env <<EOF
          NATS_URL=${{ secrets.PORTAL_NATS_URL }}
          KANIDM_URL=${{ vars.PORTAL_KANIDM_URL }}
          OAUTH2_CLIENT_ID=${{ vars.PORTAL_OAUTH2_CLIENT_ID }}
          OAUTH2_CLIENT_SECRET=${{ secrets.PORTAL_OAUTH2_CLIENT_SECRET }}
          PUBLIC_URL=${{ vars.PORTAL_PUBLIC_URL }}
          COOKIE_SECURE=true
          CONTENT_REPO=https://project.uhhm.no/uhhm/questions
          CONTENT_BRANCH=main
          SITE_NAME=${{ vars.PORTAL_SITE_NAME }}
          LEPTOS_SITE_ADDR=0.0.0.0:3010
          EOF

      - name: Restart service
        run: sudo systemctl restart app@uhhm-portal.service

      - name: Update Caddy routing
        run: |
          cat > /etc/caddy/services.d/uhhm-portal.caddy <<'EOF'
          www.{$DOMAIN}, {$DOMAIN} {
          	reverse_proxy host.docker.internal:3010
          	log { output file /var/log/caddy/www.log }
          }
          EOF
          sudo docker exec caddy caddy reload --config /etc/caddy/Caddyfile --adapter caddyfile