name: Reusable OpenTofu Deploy Template
on:
  workflow_call:
    inputs:
      proxmox_endpoint:
        description: "The URL endpoint for the Proxmox API"
        type: string
        default: "https://212.3.125.242:8006/"
    secrets:
      PROXMOX_VE_API_TOKEN:
        description: "The API token for Proxmox authentication"
        required: true
      GITEA_TOKEN:
        description: "Gitea Auth Token"
        required: true

jobs:
  deploy-to-proxmox:
    runs-on: ubuntu-latest
    env:
      # Proxmox Auth (Endpoint from inputs, Token from explicit secrets)
      PROXMOX_VE_ENDPOINT: ${{ inputs.proxmox_endpoint }}
      PROXMOX_VE_API_TOKEN: ${{ secrets.PROXMOX_VE_API_TOKEN }}
      PROXMOX_VE_INSECURE: "true" 
      
      # Gitea Remote State Backend (Dynamic per-repository package)
      TF_HTTP_ADDRESS: "${{ gitea.server_url }}/api/packages/${{ gitea.repository_owner }}/terraform/state/${{ gitea.event.repository.name }}"
      TF_HTTP_LOCK_ADDRESS: "${{ gitea.server_url }}/api/packages/${{ gitea.repository_owner }}/terraform/state/${{ gitea.event.repository.name }}/lock"
      TF_HTTP_UNLOCK_ADDRESS: "${{ gitea.server_url }}/api/packages/${{ gitea.repository_owner }}/terraform/state/${{ gitea.event.repository.name }}/lock"
      TF_HTTP_LOCK_METHOD: "POST"
      TF_HTTP_UNLOCK_METHOD: "DELETE"
      TF_HTTP_USERNAME: ${{ gitea.actor }}
      TF_HTTP_PASSWORD: ${{ secrets.GITEA_TOKEN }}

    steps:
      - name: Checkout Code
        uses: actions/checkout@v4
        
      - name: Setup OpenTofu
        uses: opentofu/setup-opentofu@v1
        
      - name: OpenTofu Init & Apply
        run: |
          tofu init
          tofu apply -auto-approve