name: Upload Infrastructure

on:
  workflow_call:
    inputs:
      host:
        description: "IP address or hostname of the remote destination server"
        required: true
        type: string
      user:
        description: "SSH username for the remote destination server"
        required: true
        type: string
      port:
        description: "SSH port for the remote destination server"
        required: false
        type: string
        default: "22"
      jump_host:
        description: "IP address or hostname of the SSH jump (bastion) server"
        required: true
        type: string
      jump_user:
        description: "SSH username for the SSH jump (bastion) server"
        required: true
        type: string
      jump_port:
        description: "SSH port for the SSH jump (bastion) server"
        required: false
        type: string
        default: "22"
      infrastructure_path:
        description: "Target directory path to run deployment commands inside"
        required: false
        type: string
        default: "infrastructure"
    secrets:
      ssh_key:
        description: "SSH private key for the remote destination server"
        required: true
      jump_ssh_key:
        description: "SSH private key for the SSH jump (bastion) server"
        required: true

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Deploy via SSH Jump Host
        env:
          SSH_KEY: ${{ secrets.ssh_key }}
          JUMP_SSH_KEY: ${{ secrets.jump_ssh_key }}
        run: |
          # Create ssh directory and restrict access
          mkdir -p ~/.ssh
          chmod 700 ~/.ssh
          
          # Write SSH private keys to files
          echo "$SSH_KEY" > ~/.ssh/id_rsa
          echo "$JUMP_SSH_KEY" > ~/.ssh/id_jump
          chmod 600 ~/.ssh/id_rsa ~/.ssh/id_jump
          
          # Create SSH config to handle jump routing, keys, and security bypasses
          cat << EOF > ~/.ssh/config
          Host jump
            HostName ${{ inputs.jump_host }}
            User ${{ inputs.jump_user }}
            Port ${{ inputs.jump_port }}
            IdentityFile ~/.ssh/id_jump
            StrictHostKeyChecking no
            UserKnownHostsFile /dev/null
          
          Host target
            HostName ${{ inputs.host }}
            User ${{ inputs.user }}
            Port ${{ inputs.port }}
            IdentityFile ~/.ssh/id_rsa
            ProxyJump jump
            StrictHostKeyChecking no
            UserKnownHostsFile /dev/null
          EOF
          chmod 600 ~/.ssh/config
          
          # Execute deployment commands cleanly
          ssh target "cd ${{ inputs.infrastructure_path }} && git pull && docker compose down && docker compose up -d"