name: Deploy

# Один VPS, без сборки образов (postgres/vaultwarden — публичные образы, не наши).
# Все значения — только из GitHub Actions secrets, .env на сервере пересобирается
# с нуля на каждом деплое (ничего не хранится в репозитории).
on:
  push:
    branches: [main]
  workflow_dispatch:

jobs:
  deploy:
    name: Deploy to Data VPS
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4

      - name: Sync compose file to VPS
        uses: appleboy/scp-action@v0.1.7
        with:
          host: ${{ secrets.DATA_VPS_IP }}
          username: root
          key: ${{ secrets.DATA_SSH_PRIVATE_KEY }}
          source: "docker-compose.yml"
          target: "/root/netrunner-data"
          strip_components: 0

      - name: Write .env and deploy via SSH
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.DATA_VPS_IP }}
          username: root
          key: ${{ secrets.DATA_SSH_PRIVATE_KEY }}
          envs: "DB_USER,DB_PASSWORD,DB_NAME,VAULTWARDEN_DOMAIN,VAULTWARDEN_SIGNUPS_ALLOWED,VAULTWARDEN_ADMIN_TOKEN,VAULTWARDEN_LOG_LEVEL,SMTP_HOST,SMTP_FROM,SMTP_PORT,SMTP_SECURITY,SMTP_USERNAME,SMTP_PASSWORD"
          script: |
            set -e
            cd /root/netrunner-data
            mkdir -p data

            cat > .env <<EOF
            DB_USER=${DB_USER}
            DB_PASSWORD=${DB_PASSWORD}
            DB_NAME=${DB_NAME}
            VAULTWARDEN_DOMAIN=${VAULTWARDEN_DOMAIN}
            VAULTWARDEN_SIGNUPS_ALLOWED=${VAULTWARDEN_SIGNUPS_ALLOWED}
            VAULTWARDEN_ADMIN_TOKEN=${VAULTWARDEN_ADMIN_TOKEN}
            VAULTWARDEN_LOG_LEVEL=${VAULTWARDEN_LOG_LEVEL}
            SMTP_HOST=${SMTP_HOST}
            SMTP_FROM=${SMTP_FROM}
            SMTP_PORT=${SMTP_PORT}
            SMTP_SECURITY=${SMTP_SECURITY}
            SMTP_USERNAME=${SMTP_USERNAME}
            SMTP_PASSWORD=${SMTP_PASSWORD}
            EOF
            chmod 600 .env

            docker compose pull
            docker compose up -d --remove-orphans
            docker image prune -f

            echo "✅ netrunner-data synchronized."
        env:
          DB_USER: ${{ secrets.DATA_DB_USER }}
          DB_PASSWORD: ${{ secrets.DATA_DB_PASSWORD }}
          DB_NAME: ${{ secrets.DATA_DB_NAME }}
          VAULTWARDEN_DOMAIN: ${{ secrets.VAULTWARDEN_DOMAIN }}
          VAULTWARDEN_SIGNUPS_ALLOWED: ${{ secrets.VAULTWARDEN_SIGNUPS_ALLOWED }}
          VAULTWARDEN_ADMIN_TOKEN: ${{ secrets.VAULTWARDEN_ADMIN_TOKEN }}
          VAULTWARDEN_LOG_LEVEL: ${{ secrets.VAULTWARDEN_LOG_LEVEL }}
          SMTP_HOST: ${{ secrets.VAULTWARDEN_SMTP_HOST }}
          SMTP_FROM: ${{ secrets.VAULTWARDEN_SMTP_FROM }}
          SMTP_PORT: ${{ secrets.VAULTWARDEN_SMTP_PORT }}
          SMTP_SECURITY: ${{ secrets.VAULTWARDEN_SMTP_SECURITY }}
          SMTP_USERNAME: ${{ secrets.VAULTWARDEN_SMTP_USERNAME }}
          SMTP_PASSWORD: ${{ secrets.VAULTWARDEN_SMTP_PASSWORD }}