#!/usr/bin/env bash
set -euo pipefail

: "${DEPLOYMENT_ENVIRONMENT:?DEPLOYMENT_ENVIRONMENT is required}"
: "${KUBE_NAMESPACE:?KUBE_NAMESPACE is required}"
: "${PUBLIC_API_ORIGIN:?PUBLIC_API_ORIGIN is required}"
: "${MONGODB_CONNECTION_STRING:?MONGODB_CONNECTION_STRING is required}"
: "${AUTH_JWT_KEY:?AUTH_JWT_KEY is required}"
: "${INTERNAL_PURGE_SECRET:?INTERNAL_PURGE_SECRET is required}"
: "${STRIPE_SECRET_KEY:?STRIPE_SECRET_KEY is required}"
: "${STRIPE_WEBHOOK_SECRET:?STRIPE_WEBHOOK_SECRET is required}"

NODES="${NODES:-192.168.86.72 192.168.86.73 192.168.86.74}"
BUILD_TAG="$(git rev-parse HEAD)"
API_IMAGE="step3-questions:${BUILD_TAG}"
WEB_IMAGE="step3-web:${BUILD_TAG}"
TEST_IMAGE="step3-tests:${BUILD_TAG}"
API_TAR="/tmp/step3-questions-${DEPLOYMENT_ENVIRONMENT}.tar"
WEB_TAR="/tmp/step3-web-${DEPLOYMENT_ENVIRONMENT}.tar"

cleanup() {
  rm -f "${API_TAR}" "${WEB_TAR}"
  docker image rm "${API_IMAGE}" "${WEB_IMAGE}" "${TEST_IMAGE}" 2>/dev/null || true
  docker image prune -f >/dev/null || true
}
trap cleanup EXIT

rm -f "${API_TAR}" "${WEB_TAR}"
docker container prune -f
docker image prune -f
docker image prune -af --filter "until=24h"
docker builder prune -af || true
docker system df
df -h

docker build -f api/QuestionsApi.Tests/Dockerfile -t "${TEST_IMAGE}" .
docker build --build-arg BUILD_REVISION="${BUILD_TAG}" -t "${API_IMAGE}" api/QuestionsApi
docker build \
  --build-arg BUILD_REVISION="${BUILD_TAG}" \
  --build-arg DEPLOYMENT_ENVIRONMENT="${DEPLOYMENT_ENVIRONMENT}" \
  --build-arg PUBLIC_API_ORIGIN="${PUBLIC_API_ORIGIN}" \
  -f web/Dockerfile -t "${WEB_IMAGE}" .

docker save "${API_IMAGE}" -o "${API_TAR}"
docker save "${WEB_IMAGE}" -o "${WEB_TAR}"
for node in ${NODES}; do
  scp -o StrictHostKeyChecking=no "${API_TAR}" hz@"${node}":/tmp/step3-questions.tar
  scp -o StrictHostKeyChecking=no "${WEB_TAR}" hz@"${node}":/tmp/step3-web.tar
  ssh -o StrictHostKeyChecking=no hz@"${node}" \
    "sudo ctr -n k8s.io images import /tmp/step3-questions.tar && sudo ctr -n k8s.io images import /tmp/step3-web.tar && rm -f /tmp/step3-questions.tar /tmp/step3-web.tar"
done

kubectl apply -f "k8s/overlays/${DEPLOYMENT_ENVIRONMENT}/namespace.yaml"
kubectl create secret generic step3-runtime-secrets \
  --from-literal=mongodb-connection-string="${MONGODB_CONNECTION_STRING}" \
  --from-literal=jwt-key="${AUTH_JWT_KEY}" \
  --from-literal=purge-secret="${INTERNAL_PURGE_SECRET}" \
  --from-literal=stripe-secret-key="${STRIPE_SECRET_KEY}" \
  --from-literal=stripe-webhook-secret="${STRIPE_WEBHOOK_SECRET}" \
  --from-literal=google-client-id="${GOOGLE_CLIENT_ID:-}" \
  --from-literal=google-client-secret="${GOOGLE_CLIENT_SECRET:-}" \
  --dry-run=client -o yaml | kubectl apply -n "${KUBE_NAMESPACE}" -f -

kubectl kustomize "k8s/overlays/${DEPLOYMENT_ENVIRONMENT}" \
  | sed "s|step3-questions:latest|${API_IMAGE}|g; s|step3-web:latest|${WEB_IMAGE}|g" \
  | kubectl apply -f -

# Secret and ConfigMap values are consumed as environment variables at pod startup.
# Force a rollout so rerunning an unchanged revision still applies rotated secrets.
kubectl rollout restart deployment/step3-api -n "${KUBE_NAMESPACE}"
kubectl rollout status deployment/step3-api -n "${KUBE_NAMESPACE}" --timeout=240s
kubectl get --raw "/api/v1/namespaces/${KUBE_NAMESPACE}/services/step3-api:http/proxy/readyz" >/dev/null
kubectl rollout status deployment/step3-web -n "${KUBE_NAMESPACE}" --timeout=240s
kubectl get --raw "/api/v1/namespaces/${KUBE_NAMESPACE}/services/step3-web:http/proxy/healthz" >/dev/null

echo "Deployed ${DEPLOYMENT_ENVIRONMENT} revision ${BUILD_TAG}."