name: Deploy Backend and Backoffice Dev

on:
  workflow_dispatch:
  push:
    branches: [dev]

env:
  REGISTRY: pipe.gohorsejobs.com
  IMAGE_NAMESPACE: bohessefm
  NAMESPACE: gohorsejobsdev

jobs:
  build-and-push:
    runs-on: [self-hosted, linux-amd64]
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Docker Login
        run: |
          echo "${{ secrets.FORGEJO_TOKEN }}" | docker login ${{ env.REGISTRY }} \
            -u ${{ env.IMAGE_NAMESPACE }} --password-stdin

      - name: Build & Push Backend
        run: |
          docker build -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/gohorsejobs:${{ github.sha }} \
            -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/gohorsejobs:latest ./backend
          docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/gohorsejobs:${{ github.sha }}
          docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/gohorsejobs:latest

      - name: Build & Push Backoffice
        run: |
          docker build -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/backoffice:${{ github.sha }} \
            -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/backoffice:latest ./backoffice
          docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/backoffice:${{ github.sha }}
          docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/backoffice:latest

  deploy:
    needs: build-and-push
    runs-on: [self-hosted, linux-amd64]
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Install kubectl
        run: |
          apk add --no-cache curl
          curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
          chmod +x kubectl
          mv kubectl /usr/local/bin/

      - name: Configure Kubeconfig
        run: |
          mkdir -p ~/.kube
          echo "${{ secrets.KUBECONFIG }}" > ~/.kube/config
          chmod 600 ~/.kube/config

      - name: Sync Secrets and Vars
        run: |
          # 1. Namespace
          kubectl create namespace ${{ env.NAMESPACE }} --dry-run=client -o yaml | kubectl apply -f -

          # 2. Sync Registry Secret com limpeza profunda de metadata
          kubectl get secret forgejo-registry-secret --namespace=forgejo -o yaml | \
          grep -vE "resourceVersion|uid|creationTimestamp|namespace" | \
          kubectl apply --namespace=${{ env.NAMESPACE }} -f -

          # 3. Geração do arquivo .env (SOMENTE VARIÁVEIS CURTAS)
          # O uso de 'EOF' evita que o shell interprete caracteres especiais das vars
          cat <<'EOF' > .env.backend
MTU=${{ vars.MTU }}
DATABASE_URL=${{ vars.DATABASE_URL }}
AMQP_URL=${{ vars.AMQP_URL }}
JWT_SECRET=${{ vars.JWT_SECRET }}
JWT_EXPIRATION=${{ vars.JWT_EXPIRATION }}
PASSWORD_PEPPER=${{ vars.PASSWORD_PEPPER }}
COOKIE_SECRET=${{ vars.COOKIE_SECRET }}
COOKIE_DOMAIN=${{ vars.COOKIE_DOMAIN }}
BACKEND_PORT=${{ vars.BACKEND_PORT }}
BACKEND_HOST=${{ vars.BACKEND_HOST }}
ENV=${{ vars.ENV }}
CORS_ORIGINS=${{ vars.CORS_ORIGINS }}
S3_BUCKET=${{ vars.S3_BUCKET }}
AWS_REGION=${{ vars.AWS_REGION }}
AWS_ENDPOINT=${{ vars.AWS_ENDPOINT }}
AWS_ACCESS_KEY_ID=${{ vars.AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY=${{ vars.AWS_SECRET_ACCESS_KEY }}
EOF

          # 4. Aplica as variáveis de ambiente
          kubectl create secret generic backend-secrets -n ${{ env.NAMESPACE }} \
            --from-env-file=.env.backend \
            --dry-run=client -o yaml | kubectl apply -f -

          # 5. TRATAMENTO DA CHAVE RSA (O culpado do erro UTF-8)
          # Extraímos a var, limpamos quebras de linha e injetamos como ARQUIVO
          RSA_RAW="${{ vars.RSA_PRIVATE_KEY_BASE64 }}"
          if [ -n "$RSA_RAW" ]; then
            echo "$RSA_RAW" | tr -d '\r\n ' > /tmp/rsa.base64
            # Tenta decodificar. Se falhar, usa o b64 puro (o app decide como ler)
            if base64 -d /tmp/rsa.base64 > /tmp/key.pem 2>/dev/null; then
              echo "RSA decodificada com sucesso."
            else
              cp /tmp/rsa.base64 /tmp/key.pem
              echo "RSA mantida em formato string limpa."
            fi
            
            # Injeta o arquivo na secret existente (o apply faz o merge)
            kubectl create secret generic backend-secrets -n ${{ env.NAMESPACE }} \
              --from-file=private_key.pem=/tmp/key.pem \
              --dry-run=client -o yaml | kubectl apply -f -
          fi

      - name: Deploy to K3s
        run: |
          kubectl apply -f k8s/dev/ -n ${{ env.NAMESPACE }}
          
          # Garante que os deployments usem a imagem com o SHA atual
          kubectl -n ${{ env.NAMESPACE }} set image deployment/gohorse-backend-dev backend=${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/gohorsejobs:${{ github.sha }}
          kubectl -n ${{ env.NAMESPACE }} set image deployment/gohorse-backoffice-dev backoffice=${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/backoffice:${{ github.sha }}
          
          # Força o restart para ler a Secret atualizada
          kubectl -n ${{ env.NAMESPACE }} rollout restart deployment/gohorse-backend-dev
          kubectl -n ${{ env.NAMESPACE }} rollout restart deployment/gohorse-backoffice-dev
          
          # Aguarda estabilização
          kubectl -n ${{ env.NAMESPACE }} rollout status deployment/gohorse-backend-dev --timeout=120s