# Deploy-only: bring up the two unom-1 pieces that live in THIS repo but whose normal
# deploys are coupled to heavy build workflows — docs to docker.yml's 5-image matrix,
# the flatpak server to flatpak.yml's full flatpak-builder run. This workflow does
# NEITHER build: it just (re)places the compose files and pulls the already-published
# images, so unom/infra's deploy-all can bring a fresh unom-1 fully up in a single
# dispatch without triggering those rebuilds.
#
#   docs     -> pulls git.unom.io/unom/punktfunk-docs:latest (built by docker.yml) and
#               brings it up on :3220.
#   flatpak  -> brings up the caddy:2-alpine static server on :3230. The OSTree repo
#               CONTENT (./site) is NOT shipped here — it is regenerated by flatpak.yml
#               on the next client build, or restored from the unom-1 backup
#               (unom/infra scripts/restore-unom-1.sh, `files` tag). A fresh box serves
#               an empty repo until then; that is expected.
#
# Dispatched by unom/infra scripts/deploy-all.sh: `dispatch-and-wait.sh punktfunk
# deploy-services.yml`. Uses the same secret set docker.yml/flatpak.yml already rely on:
# DEPLOY_HOST/USER/PORT/SSH_KEY (the unom-ci-deploy key) + REGISTRY_TOKEN (docs pull).
name: deploy-services
run-name: ${{ gitea.actor }} deploy docs + flatpak server

on:
  workflow_dispatch:

jobs:
  docs:
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4

      - name: Sync compose file
        # SHA-pinned (receives DEPLOY_SSH_KEY): a moved tag would mean credential
        # exfiltration. v0.1.7 = 917f8b8. Bump the SHA + trailing version together.
        uses: appleboy/scp-action@917f8b81dfc1ccd331fef9e2d61bdc6c8be94634 # v0.1.7
        with:
          host: ${{ secrets.DEPLOY_HOST }}
          username: ${{ secrets.DEPLOY_USER }}
          port: ${{ secrets.DEPLOY_PORT }}
          key: ${{ secrets.DEPLOY_SSH_KEY }}
          source: "compose.production.yml"
          target: "~/punktfunk-docs"
          overwrite: true

      - name: Pull and start docs
        # SHA-pinned: receives DEPLOY_SSH_KEY + REGISTRY_TOKEN. v1.2.5 = 0ff4204.
        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
        env:
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        with:
          host: ${{ secrets.DEPLOY_HOST }}
          username: ${{ secrets.DEPLOY_USER }}
          port: ${{ secrets.DEPLOY_PORT }}
          key: ${{ secrets.DEPLOY_SSH_KEY }}
          # Token enters via env, never the script text (keeps it out of run logs).
          envs: REGISTRY_TOKEN
          script: |
            set -euo pipefail
            printf '%s' "$REGISTRY_TOKEN" | docker login git.unom.io -u enricobuehler --password-stdin
            cd ~/punktfunk-docs
            docker compose -f compose.production.yml pull docs
            docker compose -f compose.production.yml up -d --no-build docs

  flatpak:
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4

      - name: Sync flatpak server compose + Caddyfile
        uses: appleboy/scp-action@917f8b81dfc1ccd331fef9e2d61bdc6c8be94634 # v0.1.7
        with:
          host: ${{ secrets.DEPLOY_HOST }}
          username: ${{ secrets.DEPLOY_USER }}
          port: ${{ secrets.DEPLOY_PORT }}
          key: ${{ secrets.DEPLOY_SSH_KEY }}
          # Land both files flat in ~/unom-flatpak/ (drop the packaging/flatpak/server/ prefix).
          source: "packaging/flatpak/server/compose.production.yml,packaging/flatpak/server/Caddyfile"
          target: "~/unom-flatpak"
          strip_components: 3
          overwrite: true

      - name: Start flatpak static server
        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
        with:
          host: ${{ secrets.DEPLOY_HOST }}
          username: ${{ secrets.DEPLOY_USER }}
          port: ${{ secrets.DEPLOY_PORT }}
          key: ${{ secrets.DEPLOY_SSH_KEY }}
          script: |
            set -euo pipefail
            # ./site (the OSTree repo) is NOT shipped by this workflow. Ensure the
            # bind-mount source exists so caddy starts; content is restored from the
            # unom-1 backup or regenerated by flatpak.yml's next publish.
            mkdir -p ~/unom-flatpak/site/repo
            cd ~/unom-flatpak
            docker compose -f compose.production.yml up -d