name: Deploy
on:
  push:
    branches:
      - main
  workflow_dispatch:
env:
  WEB_IMAGE: ${{ secrets.DOCKERHUB_USERNAME }}/fiscalos-web
  API_IMAGE: ${{ secrets.DOCKERHUB_USERNAME }}/fiscalos-api
jobs:
  build-and-push:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
      - name: Log in to Docker Hub
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Build and push web image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: docker/Dockerfile.web
          push: true
          tags: |
            ${{ env.WEB_IMAGE }}:latest
            ${{ env.WEB_IMAGE }}:${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
      - name: Build and push API image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: docker/Dockerfile.api
          push: true
          tags: |
            ${{ env.API_IMAGE }}:latest
            ${{ env.API_IMAGE }}:${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
  deploy:
    runs-on: ubuntu-latest
    needs: build-and-push
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Copy compose file to server
        uses: appleboy/scp-action@v1.0.0
        with:
          host: ${{ secrets.DEPLOY_HOST }}
          username: ${{ secrets.DEPLOY_USER }}
          key: ${{ secrets.DEPLOY_SSH_KEY }}
          source: docker/docker-compose.prod.yml
          target: ${{ secrets.DEPLOY_PATH }}
          strip_components: 1
      - name: Deploy on server
        uses: appleboy/ssh-action@v1
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          IMAGE_TAG: ${{ github.sha }}
          JWT_AUDIENCE: ${{ secrets.JWT_AUDIENCE }}
          JWT_ISSUER: ${{ secrets.JWT_ISSUER }}
          JWT_SECRET: ${{ secrets.JWT_SECRET }}
          JWT_EXPIRY_IN_MINUTES: ${{ secrets.JWT_EXPIRY_IN_MINUTES }}
          FILE_KEY_RING_PRIMARY_KEY_ID: ${{ secrets.FILE_KEY_RING_PRIMARY_KEY_ID }}
          PLAID_CLIENT_ID: ${{ secrets.PLAID_CLIENT_ID }}
          PLAID_SECRET: ${{ secrets.PLAID_SECRET }}
          PLAID_WEBHOOK: ${{ secrets.PLAID_WEBHOOK }}
          SEQ_SERVER_URL: ${{ secrets.SEQ_SERVER_URL }}
          SEQ_API_KEY_HEADER: ${{ secrets.SEQ_API_KEY_HEADER }}
          SEQ_API_KEY: ${{ secrets.SEQ_API_KEY }}
        with:
          host: ${{ secrets.DEPLOY_HOST }}
          username: ${{ secrets.DEPLOY_USER }}
          key: ${{ secrets.DEPLOY_SSH_KEY }}
          envs: DOCKERHUB_USERNAME,IMAGE_TAG,JWT_AUDIENCE,JWT_ISSUER,JWT_SECRET,JWT_EXPIRY_IN_MINUTES,FILE_KEY_RING_PRIMARY_KEY_ID,PLAID_CLIENT_ID,PLAID_SECRET,PLAID_WEBHOOK,SEQ_SERVER_URL,SEQ_API_KEY_HEADER,SEQ_API_KEY
          script: |
            cd ${{ secrets.DEPLOY_PATH }}
            cat > .env << EOF
            DOCKERHUB_USERNAME=${DOCKERHUB_USERNAME}
            IMAGE_TAG=${IMAGE_TAG}
            JWT_AUDIENCE=${JWT_AUDIENCE}
            JWT_ISSUER=${JWT_ISSUER}
            JWT_SECRET=${JWT_SECRET}
            JWT_EXPIRY_IN_MINUTES=${JWT_EXPIRY_IN_MINUTES}
            FILE_KEY_RING_PRIMARY_KEY_ID=${FILE_KEY_RING_PRIMARY_KEY_ID}
            PLAID_CLIENT_ID=${PLAID_CLIENT_ID}
            PLAID_SECRET=${PLAID_SECRET}
            PLAID_WEBHOOK=${PLAID_WEBHOOK}
            SEQ_SERVER_URL=${SEQ_SERVER_URL}
            SEQ_API_KEY_HEADER=${SEQ_API_KEY_HEADER}
            SEQ_API_KEY=${SEQ_API_KEY}
            EOF
            docker compose -f docker-compose.prod.yml pull
            docker compose -f docker-compose.prod.yml up -d --remove-orphans
            docker image prune -f