name: Deploy Caddyfile

on:
  workflow_call:
    inputs:
      vm_ip:
        description: Caddy VM IP
        required: false
        type: string
        default: "192.168.100.10"

      jump_host:
        type: string
        default: "212.3.125.242"

      jump_port:
        type: string
        default: "2222"

      jump_user:
        type: string
        default: "jump"

      vm_port:
        type: string
        default: "22"

      vm_user:
        type: string
        default: "debian"

      infisical_api_url:
        description: "Infisical API URL (for self-hosted instances)"
        type: string
        required: false
        default: "https://secrets.itlab-ffeks.dnu.edu.ua"

    secrets:
      infisical_cicd_token:
        description: "Infisical Service Token for CI/CD secrets"
        required: true


jobs:
  deploy:
    runs-on: ubuntu-latest

    steps:
      - name: Install Infisical CLI
        run: |
          curl -1sLf 'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.deb.sh' | sudo -E bash
          sudo apt-get update && sudo apt-get install -y infisical

      - name: Configure SSH
        run: |
          mkdir -p ~/.ssh
          chmod 700 ~/.ssh

          export INFISICAL_TOKEN="${{ secrets.infisical_cicd_token }}"
          export INFISICAL_API_URL="${{ inputs.infisical_api_url }}"
          export INFISICAL_DOMAIN="$INFISICAL_API_URL"
          export INFISICAL_DISABLE_UPDATE_CHECK=true

          echo "Fetching SSH keys from Infisical..."
          JUMP_KEY=$(infisical secrets get JUMP_SSH_KEY --plain)
          VM_KEY=$(infisical secrets get VM_SSH_KEY --plain)

          if [ -z "$JUMP_KEY" ] || [ -z "$VM_KEY" ]; then
            echo "Error: SSH keys retrieved from Infisical are empty!" >&2
            exit 1
          fi

          echo "$JUMP_KEY" > ~/.ssh/jump_key
          chmod 600 ~/.ssh/jump_key

          echo "$VM_KEY" > ~/.ssh/vm_key
          chmod 600 ~/.ssh/vm_key

          cat > ~/.ssh/config <<EOF
          Host jump
            HostName ${{ inputs.jump_host }}
            User ${{ inputs.jump_user }}
            Port ${{ inputs.jump_port }}
            IdentityFile ~/.ssh/jump_key
            StrictHostKeyChecking no

          Host caddy
            HostName ${{ inputs.vm_ip }}
            User ${{ inputs.vm_user }}
            Port ${{ inputs.vm_port }}
            IdentityFile ~/.ssh/vm_key
            ProxyJump jump
            StrictHostKeyChecking no
          EOF


      - name: Upload Caddyfile
        run: |
          scp Caddyfile caddy:/tmp/Caddyfile


      - name: Install Caddy configuration
        run: |
          ssh caddy <<EOF
            set -e

            sudo mv /tmp/Caddyfile \
              /etc/caddy/conf.d/${{ gitea.repository_owner }}.Caddyfile

            sudo chown root:root \
              /etc/caddy/conf.d/${{ gitea.repository_owner }}.Caddyfile

            sudo chmod 644 \
              /etc/caddy/conf.d/${{ gitea.repository_owner }}.Caddyfile

            sudo caddy validate \
              --config /etc/caddy/Caddyfile

            sudo systemctl reload caddy
          EOF