# Build the site image and push it to this Gitea instance's container
# registry. Registry host and owner come from the instance itself, so the
# same file works on the home Gitea and the VPS Gitea without edits.
#
# Needs one repo secret: REGISTRY_TOKEN, a personal access token for the
# repo owner with package read/write scope.

name: Build image

on:
  push:
    branches: [main]
  workflow_dispatch:

jobs:
  build:
    runs-on: debian
    env:
      SERVER_URL: ${{ gitea.server_url }}
      OWNER: ${{ gitea.repository_owner }}
      REPO: ${{ gitea.repository }}
      SHA: ${{ gitea.sha }}
    steps:
      # Trust the home CA when one is configured: instance variable HOME_CA
      # holds the root cert as PEM. Leave it unset on hosts with a public
      # cert (the VPS) and this step is skipped.
      - name: Trust home CA
        if: ${{ vars.HOME_CA != '' }}
        env:
          HOME_CA: ${{ vars.HOME_CA }}
        run: |
          printf '%s\n' "$HOME_CA" > /usr/local/share/ca-certificates/home-ca.crt
          update-ca-certificates

      - uses: actions/checkout@v4
        env:
          NODE_EXTRA_CA_CERTS: /etc/ssl/certs/ca-certificates.crt

      # node:24-trixie (Debian 13) has git and node but no Docker CLI. Install
      # the CLI and buildx from Docker's apt repo; the daemon is the runner's.
      - name: Install Docker CLI
        run: |
          install -m 0755 -d /etc/apt/keyrings
          curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
          chmod a+r /etc/apt/keyrings/docker.asc
          cat > /etc/apt/sources.list.d/docker.sources <<SRC
          Types: deb
          URIs: https://download.docker.com/linux/debian
          Suites: $(. /etc/os-release && echo "$VERSION_CODENAME")
          Components: stable
          Signed-By: /etc/apt/keyrings/docker.asc
          SRC
          apt-get update
          apt-get install -y --no-install-recommends docker-ce-cli docker-buildx-plugin

      - name: Log in to registry
        run: |
          REGISTRY="${SERVER_URL#https://}"
          echo "REGISTRY=$REGISTRY" >> "$GITHUB_ENV"
          echo "IMAGE=$REGISTRY/${REPO,,}" >> "$GITHUB_ENV"
          echo "${{ secrets.REGISTRY_TOKEN }}" | docker login "$REGISTRY" -u "$OWNER" --password-stdin

      - name: Build
        run: docker build -t "$IMAGE:latest" -t "$IMAGE:${SHA::12}" .

      - name: Push
        run: docker push --all-tags "$IMAGE"

      # Redeploy on the Docker host. The key's forced command on the host
      # only accepts allowlisted site names, so this can't run anything else.
      # Skipped when DEPLOY_HOST isn't set.
      - name: Deploy
        if: ${{ vars.DEPLOY_HOST != '' }}
        env:
          DEPLOY_HOST: ${{ vars.DEPLOY_HOST }}
          DEPLOY_KNOWN_HOSTS: ${{ vars.DEPLOY_KNOWN_HOSTS }}
          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
        run: |
          install -m 700 -d ~/.ssh
          printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > ~/.ssh/known_hosts
          ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=yes "root@$DEPLOY_HOST" theoldfitz