# Push to main -> Waters Boards is rebuilt on the AWS Lightsail box.
#
# Runs on the "nas" act_runner, which lives inside the church network and can reach the
# internet. (The Gitea server isn't reachable from outside, so AWS can't pull from it; the
# runner pushes to AWS instead.) It syntax-checks the code, rsyncs server/ and deploy/aws/ to
# /opt/waters-boards on the box over SSH, rebuilds in place and waits for the healthcheck.
# All of that is deploy/aws/deploy.sh, the same script you run from a laptop.
#
# ONE-TIME SETUP before the first run (see README.md › Deploy to AWS):
#   1. Make a deploy-only SSH key (e.g. ssh-keygen -t ed25519 -N '' -f deploy_key) and add the
#      public half to /home/ubuntu/.ssh/authorized_keys on the box.
#   2. Add repository secrets (Settings ▸ Actions ▸ Secrets):
#        DEPLOY_SSH_KEY      the private key from step 1
#        DEPLOY_KNOWN_HOSTS  the output of: ssh-keyscan -t ed25519 <static IP>
#   3. Add repository variables (Settings ▸ Actions ▸ Variables):
#        DEPLOY_HOST         the box's static IP
#        DEPLOY_ENABLED      true
#      Until DEPLOY_ENABLED is true this job is skipped, so pushes made before the box is
#      ready don't show as failures.
#   4. The "nas" runner must be registered where it can see this repo (user- or instance-level,
#      not only on the checklist repo).
# /opt/waters-boards/.env must already exist on the box. The deploy never creates or
# overwrites it, and never touches data/.

name: Deploy Waters Boards to AWS

on:
  push:
    branches: [main]
    paths:
      - 'server/**'
      - 'deploy/aws/**'
      - '.gitea/workflows/deploy.yml'
  workflow_dispatch:

jobs:
  deploy:
    if: ${{ vars.DEPLOY_ENABLED == 'true' }}
    runs-on: nas
    container:
      image: node:22-alpine

    steps:
      - name: Install tools
        # deploy.sh is a bash script and needs node (already in the image) for its syntax check.
        run: apk add --no-cache bash openssh-client rsync

      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up the SSH key
        # Secrets go in through env, not pasted into the script text.
        env:
          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
          DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
        run: |
          set -eu
          mkdir -p ~/.ssh
          chmod 700 ~/.ssh
          printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > ~/.ssh/known_hosts
          chmod 644 ~/.ssh/known_hosts

      - name: Deploy
        run: BOARDS_HOST="ubuntu@${{ vars.DEPLOY_HOST }}" bash deploy/aws/deploy.sh