when:
  - event: push
    branch: main

steps:
  - name: version
    image: alpine:latest
    commands:
      - apk add --no-cache git
      - GIT_REV="$(git rev-parse --short HEAD)"
      - BUILD_BRANCH="$(git rev-parse --abbrev-ref HEAD)"
      - APP_V="$(cat version)"
      - printf "GIT_REV=%s\nBUILD_BRANCH=%s\nAPP_V=%s\n" "$GIT_REV" "$BUILD_BRANCH" "$APP_V" | tee .env.version

  - name: secrets
    image: alpine:latest
    depends_on: [ version ]
    environment:
      VAULT_ADDR: https://vault.sendico.io
      VAULT_ROLE_ID:     { from_secret: VAULT_APP_ROLE }
      VAULT_SECRET_ID:   { from_secret: VAULT_SECRET_ID }
    commands:
      - apk add --no-cache curl bash coreutils sed python3 openssh-keygen
      - mkdir -p secrets
      # fetch SSH private key for deploy (base64-encoded) and decode
      - ./ci/vlt kv_to_file kv ops/deploy/ssh_key private_b64 secrets/SSH_KEY.b64 600
      - base64 -d secrets/SSH_KEY.b64 > secrets/SSH_KEY
      - chmod 600 secrets/SSH_KEY
      - ssh-keygen -y -f secrets/SSH_KEY >/dev/null

  - name: deploy
    image: alpine:latest
    depends_on: [ secrets ]
    commands:
      - set -euo pipefail
      - apk add --no-cache bash openssh-client rsync coreutils
      - set -a
      - . ./ci/prod/.env.runtime
      - . ./.env.version
      - set +a
      - ': "${REMOTE_BASE:?missing REMOTE_BASE}"'
      - ': "${DB_DIR:?missing DB_DIR}"'
      - ': "${SSH_USER:?missing SSH_USER}"'
      - ': "${SSH_HOST:?missing SSH_HOST}"'
      - SSH_OPTS='-i /root/.ssh/id_rsa -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -vv'
      - REMOTE_DIR="${REMOTE_BASE%/}/${DB_DIR}"
      - REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
      - ssh $SSH_OPTS "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
      - rsync -avz --delete -e "ssh $SSH_OPTS" ci/prod/compose/  "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
      - rsync -avz             -e "ssh $SSH_OPTS" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
      - |
        ssh $SSH_OPTS "$REMOTE_TARGET" REMOTE_DIR="$REMOTE_DIR" bash -s <<'EOSSH'
        set -Eeuxo pipefail
        cd "${REMOTE_DIR}/compose"
        ...
        EOSSH