#!/usr/bin/env bash
#
# Deploy drinktracker to the production LXC.
#
# The app runs natively under systemd - no Docker. Each deploy builds into
# releases/<sha> out-of-place and swaps a symlink, so the ~3 minute build happens
# while the old release keeps serving and downtime is only the restart.
#
# Usage:  ./deploy/deploy.sh [--yes] [--no-build] [--rollback]
#
set -euo pipefail

HOST="${DT_HOST:-drinkadmin@192.168.2.169}"
SSH_KEY="${DT_SSH_KEY:-$HOME/.ssh/drinktracker_ed25519}"
APP_DIR="${DT_APP_DIR:-/opt/drinktracker}"
SVC_USER="${DT_SVC_USER:-drinktracker}"
KEEP_RELEASES=5
HEALTH_URL="http://localhost:3000/"

ASSUME_YES=0; BUILD=1; ROLLBACK=0
for arg in "$@"; do
  case "$arg" in
    --yes|-y) ASSUME_YES=1 ;;
    --no-build) BUILD=0 ;;
    --rollback) ROLLBACK=1 ;;
    *) echo "unknown option: $arg" >&2; exit 2 ;;
  esac
done

SSH=(ssh -o BatchMode=yes -o ConnectTimeout=10 -i "$SSH_KEY" "$HOST")
say() { printf '\n\033[1;36m==> %s\033[0m\n' "$*"; }
die() { printf '\n\033[1;31mFAILED: %s\033[0m\n' "$*" >&2; exit 1; }

# Run a script (on stdin) as root on the LXC, with these vars exported.
# sudoers grants drinkadmin NOPASSWD only as root, so we sudo once and `su` down
# to the service user inside rather than using `sudo -u`.
remote_root() {
  "${SSH[@]}" "sudo -n env APP_DIR='$APP_DIR' SVC_USER='$SVC_USER' SHA='${SHA:-}' \
    SHORT='${SHORT:-}' KEEP='$KEEP_RELEASES' bash -s"
}

health_poll() {
  for i in $(seq 1 30); do
    code=$("${SSH[@]}" "curl -s -o /dev/null -w '%{http_code}' -m 5 $HEALTH_URL" || echo 000)
    # 307 is the unauthenticated redirect to /login - healthy.
    case "$code" in 200|302|307) echo "  healthy (HTTP $code) after $((i*2))s"; return 0 ;; esac
    sleep 2
  done
  return 1
}

# ─── Rollback: repoint the symlink, no rebuild ───────────────────────
if [ "$ROLLBACK" -eq 1 ]; then
  say "Rolling back"
  CURRENT=$("${SSH[@]}" "basename \$(readlink $APP_DIR/current)")
  PREV=$("${SSH[@]}" "ls -1t $APP_DIR/releases | grep -v '^$CURRENT\$' | head -1")
  [ -n "$PREV" ] || die "no other release to roll back to"
  echo "  current=$CURRENT  ->  $PREV"
  if [ "$ASSUME_YES" -ne 1 ]; then
    read -r -p "  proceed? [y/N] " r; [[ "$r" =~ ^[Yy]$ ]] || { echo aborted; exit 1; }
  fi
  SHORT="$PREV" remote_root <<'EOF'
set -e
su -s /bin/bash "$SVC_USER" -c "ln -sfn $APP_DIR/releases/$SHORT $APP_DIR/current.new && mv -Tf $APP_DIR/current.new $APP_DIR/current"
systemctl restart drinktracker
EOF
  health_poll || die "app unhealthy after rollback - journalctl -u drinktracker"
  say "Rolled back to $PREV"
  exit 0
fi

# ─── Preflight (local) ───────────────────────────────────────────────
say "Preflight"
cd "$(dirname "$0")/.."
[ -n "$(git status --porcelain)" ] && die "working tree is dirty - commit or stash first"
BRANCH=$(git rev-parse --abbrev-ref HEAD)
[ "$BRANCH" = "main" ] || die "on branch '$BRANCH', expected main"
npx tsc --noEmit || die "typecheck failed"
echo "  typecheck ok, tree clean, on main"

git -c credential.helper=store push origin main
SHA=$(git rev-parse HEAD); SHORT=${SHA:0:7}
echo "  pushed $SHORT"

# ─── Preflight (remote) ──────────────────────────────────────────────
say "Checking $HOST"
"${SSH[@]}" true || die "cannot reach $HOST with key $SSH_KEY"
for unit in postgresql@16-main minio drinktracker; do
  st=$("${SSH[@]}" "systemctl is-active $unit" || true)
  echo "  $unit: $st"
  [ "$st" = "active" ] || die "$unit is not active - fix before deploying"
done

if [ "$ASSUME_YES" -ne 1 ]; then
  CURRENT=$("${SSH[@]}" "basename \$(readlink $APP_DIR/current)")
  echo "  current release $CURRENT, deploying $SHORT"
  read -r -p "  proceed? [y/N] " r; [[ "$r" =~ ^[Yy]$ ]] || { echo aborted; exit 1; }
fi

# ─── Build and assemble (out-of-place; old release keeps serving) ────
say "Syncing, building and assembling $SHORT"
BUILD="$BUILD" remote_root <<'EOF'
set -e
su -s /bin/bash "$SVC_USER" <<INNER
set -e
git -C "$APP_DIR/repo" fetch --quiet origin main
git -C "$APP_DIR/repo" reset --hard "$SHA" --quiet
git -C "$APP_DIR/repo" log --oneline -1

cd "$APP_DIR/repo"
export npm_config_cache="$APP_DIR/.npm" NODE_OPTIONS=--max-old-space-size=3072
# Built WITHOUT the env file, deliberately - same as the Dockerfile. Every setting
# this app reads (NEXTAUTH_URL, MINIO_ENDPOINT, ...) is read at request time by a
# dynamic route, so nothing needs baking in and the bundle stays host-independent.
# Keep it that way: a build that depends on secrets stops being reproducible.
npm ci --prefer-offline --no-audit --fund=false
npx prisma generate
npm run build

# Mirrors Dockerfile:24-30 - standalone bundle plus static and public copied in.
REL="$APP_DIR/releases/$SHORT"
rm -rf "\$REL" && mkdir -p "\$REL/.next/cache"
cp -a "$APP_DIR/repo/.next/standalone/." "\$REL"/
cp -a "$APP_DIR/repo/.next/static" "\$REL/.next/static"
cp -a "$APP_DIR/repo/public" "\$REL/public"
du -sh "\$REL"
INNER
EOF
[ "${PIPESTATUS[0]:-0}" -eq 0 ] || die "build/assembly failed"

# ─── Schema ──────────────────────────────────────────────────────────
say "Backing up database, then applying schema"
remote_root <<'EOF'
set -e
install -d -m 0750 /var/backups/drinktracker
sudo -u postgres pg_dump drinkman | gzip -9 > "/var/backups/drinktracker/pre-$SHORT.sql.gz"
ls -lh "/var/backups/drinktracker/pre-$SHORT.sql.gz"

# db push, NOT migrate deploy: production has no _prisma_migrations table, so
# migrate deploy would try to apply the init migration against populated tables.
# --accept-data-loss means removing a field from schema.prisma DROPS the column.
su -s /bin/bash "$SVC_USER" -c "set -a; . /etc/drinktracker/drinktracker.env; set +a; cd $APP_DIR/repo && npx prisma db push --skip-generate --accept-data-loss"
EOF
[ "${PIPESTATUS[0]:-0}" -eq 0 ] || die "schema step failed"

# ─── Swap and restart ────────────────────────────────────────────────
say "Swapping to $SHORT and restarting"
remote_root <<'EOF'
set -e
su -s /bin/bash "$SVC_USER" -c "ln -sfn $APP_DIR/releases/$SHORT $APP_DIR/current.new && mv -Tf $APP_DIR/current.new $APP_DIR/current"
systemctl restart drinktracker
EOF
health_poll || die "app unhealthy - check: ${SSH[*]} 'sudo journalctl -u drinktracker -n 50'"

# ─── Verify and prune ────────────────────────────────────────────────
say "Verifying"
"${SSH[@]}" "curl -s -o /dev/null -w '  public=%{http_code}\n' -m 15 https://drinktracker.tenseconddelay.net/ || true"
remote_root <<'EOF'
journalctl -u drinktracker --since '3 min ago' | grep '\[switchboard\]' | tail -3 || echo "  (no AI calls in window)"
cd "$APP_DIR/releases" && ls -1t | tail -n +$((KEEP+1)) | xargs -r rm -rf
echo "  releases kept:"; ls -1t "$APP_DIR/releases" | sed 's/^/    /'
EOF

say "Deployed $SHORT"
echo "Roll back with:  ./deploy/deploy.sh --rollback"