# Push to main -> Waters Boards is rebuilt on the AWS Lightsail box.
#
# Runs on the "aws-deploy" act_runner: a container on Chronicles-AB (the Gitea NAS) in
# /volume2/docker/gitea-runner-boards, registered for this repo only. It lives inside the
# church network because the Gitea server isn't reachable from outside, so AWS can't pull
# from it; the runner pushes to AWS instead. It syntax-checks the code, rsyncs server/ and
# deploy/aws/ to /opt/waters-boards on the box over SSH, rebuilds in place and waits for the
# healthcheck. All of that is deploy/aws/deploy.sh, the same script you run from a laptop.
# The checklist app's "nas" runner on Chronicles-NA is not involved.
#
# That runner and its job containers use Docker host networking: containers on bridge
# networks on Chronicles-AB have no outbound NAT (no DNS, no internet), which made the first
# run fail while fetching actions/checkout.
#
# ONE-TIME SETUP before the first run (see README.md › Deploy to AWS):
#   1. Make a deploy-only SSH key (e.g. ssh-keygen -t ed25519 -N '' -f deploy_key) and add the
#      public half to /home/ubuntu/.ssh/authorized_keys on the box.
#   2. Add repository secrets (Settings ▸ Actions ▸ Secrets):
#        DEPLOY_SSH_KEY      the private key from step 1
#        DEPLOY_KNOWN_HOSTS  the output of: ssh-keyscan -t ed25519 <static IP>
#   3. Add repository variables (Settings ▸ Actions ▸ Variables):
#        DEPLOY_HOST         the box's static IP
#        DEPLOY_ENABLED      true
#      Until DEPLOY_ENABLED is true this job is skipped, so pushes made before the box is
#      ready don't show as failures.
#   4. The runner: on Chronicles-AB, /volume2/docker/gitea-runner-boards/start-runner.sh
#      (re)creates it. Its runner.env holds a registration token scoped to this repo, minted
#      with: docker exec -u git gitea gitea actions generate-runner-token --scope christian/waters-boards
# /opt/waters-boards/.env must already exist on the box. The deploy never creates or
# overwrites it, and never touches data/.

name: Deploy Waters Boards to AWS

on:
  push:
    branches: [main]
    paths:
      - 'server/**'
      - 'deploy/aws/**'
      - '.gitea/workflows/deploy.yml'
  workflow_dispatch:

jobs:
  deploy:
    if: ${{ vars.DEPLOY_ENABLED == 'true' }}
    runs-on: aws-deploy
    container:
      image: node:22-alpine

    steps:
      - name: Install tools
        # deploy.sh is a bash script and needs node (already in the image) for its syntax check.
        run: apk add --no-cache bash openssh-client rsync curl

      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up the SSH key
        # Secrets go in through env, not pasted into the script text.
        env:
          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
          DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
        run: |
          set -eu
          mkdir -p ~/.ssh
          chmod 700 ~/.ssh
          printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > ~/.ssh/known_hosts
          chmod 644 ~/.ssh/known_hosts

      - name: Deploy
        run: BOARDS_HOST="ubuntu@${{ vars.DEPLOY_HOST }}" bash deploy/aws/deploy.sh