name: Deploy Backend and Backoffice Dev

on:
  workflow_dispatch:
  push:
    branches: [dev]

env:
  REGISTRY: pipe.gohorsejobs.com
  IMAGE_NAMESPACE: bohessefm

jobs:
  build-and-push:
    runs-on: [self-hosted, linux-amd64]
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Docker Login
        run: |
          echo "${{ secrets.FORGEJO_TOKEN }}" | docker login ${{ env.REGISTRY }} \
            -u ${{ env.IMAGE_NAMESPACE }} --password-stdin

      - name: Build & Push Backend
        run: |
          docker build -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/gohorsejobs:${{ github.sha }} \
            -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/gohorsejobs:latest ./backend
          docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/gohorsejobs:${{ github.sha }}
          docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/gohorsejobs:latest

      - name: Build & Push Backoffice
        run: |
          docker build -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/backoffice:${{ github.sha }} \
            -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/backoffice:latest ./backoffice
          docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/backoffice:${{ github.sha }}
          docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/backoffice:latest

  deploy:
    needs: build-and-push
    runs-on: [self-hosted, linux-amd64]
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Install kubectl
        run: |
          apk add --no-cache curl
          curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
          chmod +x kubectl
          mv kubectl /usr/local/bin/

      - name: Configure Kubeconfig
        run: |
          mkdir -p ~/.kube
          echo "${{ secrets.KUBECONFIG }}" > ~/.kube/config
          chmod 600 ~/.kube/config

      - name: Sync Secrets and Vars
        run: |
          kubectl create namespace gohorsejobsdev --dry-run=client -o yaml | kubectl apply -f -

          kubectl get secret forgejo-registry-secret --namespace=forgejo -o yaml | \
          sed 's/namespace: forgejo/namespace: gohorsejobsdev/' | \
          kubectl apply -f - --force

          kubectl delete secret backend-secrets -n gohorsejobsdev --ignore-not-found

          # LIMPEZA CRÍTICA DA CHAVE
          RAW_KEY="${{ secrets.RSA_PRIVATE_KEY_BASE64 || vars.RSA_PRIVATE_KEY_BASE64 }}"
          CLEAN_KEY=$(echo "$RAW_KEY" | tr -d '[:space:]')

          # CONSTRUÇÃO DO SECRET (Misturando stringData para texto e data para a chave binária)
          cat <<EOF | kubectl apply -f -
          apiVersion: v1
          kind: Secret
          metadata:
            name: backend-secrets
            namespace: gohorsejobsdev
          type: Opaque
          stringData:
            MTU: "${{ vars.MTU }}"
            DATABASE_URL: "${{ vars.DATABASE_URL }}"
            AMQP_URL: "${{ vars.AMQP_URL }}"
            JWT_SECRET: "${{ vars.JWT_SECRET }}"
            JWT_EXPIRATION: "${{ vars.JWT_EXPIRATION }}"
            PASSWORD_PEPPER: "${{ vars.PASSWORD_PEPPER }}"
            COOKIE_SECRET: "${{ vars.COOKIE_SECRET }}"
            COOKIE_DOMAIN: "${{ vars.COOKIE_DOMAIN }}"
            BACKEND_PORT: "${{ vars.BACKEND_PORT }}"
            BACKEND_HOST: "${{ vars.BACKEND_HOST }}"
            ENV: "${{ vars.ENV }}"
            CORS_ORIGINS: "${{ vars.CORS_ORIGINS }}"
            S3_BUCKET: "${{ vars.S3_BUCKET }}"
            AWS_REGION: "${{ vars.AWS_REGION }}"
            AWS_ENDPOINT: "${{ vars.AWS_ENDPOINT }}"
            AWS_ACCESS_KEY_ID: "${{ vars.AWS_ACCESS_KEY_ID }}"
            AWS_SECRET_ACCESS_KEY: "${{ vars.AWS_SECRET_ACCESS_KEY }}"
          data:
            private_key.pem: "$CLEAN_KEY"
          EOF

      - name: Deploy to K3s
        run: |
          kubectl apply -f k8s/dev/ -n gohorsejobsdev
          
          kubectl -n gohorsejobsdev set image deployment/gohorse-backend-dev backend=${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/gohorsejobs:${{ github.sha }}
          kubectl -n gohorsejobsdev set image deployment/gohorse-backoffice-dev backoffice=${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/backoffice:${{ github.sha }}
          
          kubectl -n gohorsejobsdev rollout restart deployment/gohorse-backend-dev
          kubectl -n gohorsejobsdev rollout restart deployment/gohorse-backoffice-dev
          
          kubectl -n gohorsejobsdev rollout status deployment/gohorse-backend-dev --timeout=120s