#!/usr/bin/env bash
set -euo pipefail

# Deploy la-huasca-ts to the plexnuke k3s cluster and expose it on lahuasca.com
#
# Usage:
#   ./deploy.sh
#   REGISTRY_USER=muken REGISTRY_PASS=... ./deploy.sh
#
# Prerequisites on the target machine (plexnuke):
#   - kubectl configured for the k3s cluster
#   - docker or buildah/push capability (we build locally and push)
#   - registry secret exists or REGISTRY_USER/REGISTRY_PASS are exported

NAMESPACE="lahuasca"
IMAGE="gitea.ajavasoft.com/muken/la-huasca-ts"
TAG="${TAG:-$(git rev-parse --short HEAD)}"
HOSTS=("lahuasca.com" "www.lahuasca.com")

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
cd "$SCRIPT_DIR"

chmod +x "$SCRIPT_DIR/deploy.sh" 2>/dev/null || true

# Ensure the namespace exists
kubectl create namespace "$NAMESPACE" 2>/dev/null || true

# Build Next.js standalone output and Docker image
echo "==> Building Docker image $IMAGE:$TAG ..."
DOCKER_BUILDKIT=1 docker build -t "$IMAGE:$TAG" -t "$IMAGE:latest" .

# Push to registry
echo "==> Pushing image ..."
docker push "$IMAGE:$TAG"
docker push "$IMAGE:latest"

# Generate JWT secret if not present
if ! kubectl get secret la-huasca-app-secrets -n "$NAMESPACE" >/dev/null 2>&1; then
  JWT_SECRET="$(openssl rand -base64 48 | tr -dc 'a-zA-Z0-9' | head -c 64)"
  kubectl create secret generic la-huasca-app-secrets \
    --namespace "$NAMESPACE" \
    --from-literal=JWT_SECRET="$JWT_SECRET"
  echo "==> Created la-huasca-app-secrets with JWT_SECRET"
fi

# Create database secret if missing (run deploy-db.sh first to populate it)
if ! kubectl get secret la-huasca-db-secrets -n "$NAMESPACE" >/dev/null 2>&1; then
  echo "WARNING: la-huasca-db-secrets not found. Run ./deploy-db.sh first."
  exit 1
fi

# Build registry pull secret if credentials are provided
if [ -n "${REGISTRY_USER:-}" ] && [ -n "${REGISTRY_PASS:-}" ]; then
  REGISTRY_AUTH="$(printf '%s:%s' "$REGISTRY_USER" "$REGISTRY_PASS" | base64 -w 0)"
  export REGISTRY_USER REGISTRY_PASS REGISTRY_AUTH
  echo "==> Updating registry pull secret ..."
  envsubst < "./k8s/registry-secret.yaml" | kubectl apply -f -
fi

# Update image tag in manifest and apply
export TAG
export NAMESPACE
envsubst < "./k8s/app.yaml" | kubectl apply -f -

# Wait for rollout
echo "==> Waiting for rollout ..."
kubectl rollout status deployment/la-huasca-nextjs -n "$NAMESPACE" --timeout=180s

# Print summary
IP="$(kubectl get service traefik -n kube-system -o jsonpath='{.status.loadBalancer.ingress[0].ip}' 2>/dev/null || echo 'node IP')"

echo ""
echo "Deploy complete."
echo "  Image:  $IMAGE:$TAG"
echo "  Hosts:  ${HOSTS[*]}"
echo "  LB IP:  $IP"
echo ""
echo "To seed the database, run:"
echo "  kubectl exec -n $NAMESPACE deploy/la-huasca-nextjs -- curl -s -X POST http://localhost:3000/api/db/init"
echo ""
echo "To bootstrap mmendoza admin user:"
echo "  kubectl exec -n $NAMESPACE deploy/la-huasca-nextjs -- curl -s -X POST http://localhost:3000/api/bootstrap-user"