name: MT5 Helm GitOps Deploy

on:
  push:
    branches: [ "main" ]
    tags: [ "*" ]
  workflow_dispatch:

env:
  # Gleicher Registry-Prefix wie im boday_tf-Projekt
  REGISTRY: localhost:3005
  # Host-Header für Traefik-Ingress des Web-UI (leer = kein Ingress, kein Health-Check per HTTP)
  INGRESS_HOST: mt5.local

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    container: catthehacker/ubuntu:act-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      # HINWEIS: Terraform-Binary kommt wie bei boday_tf über das globale Runner-Volume (:ro)

      - name: Trust Local Nginx Certificate Inside Container
        run: |
          mkdir -p /usr/local/share/ca-certificates/
          cp nginx_ssl/nginx.crt /usr/local/share/ca-certificates/nginx-sandbox.crt 2>/dev/null || echo "Nutze Workspace-Zertifikat"
          update-ca-certificates

      # Docker verlangt Image-Namen in Kleinbuchstaben – "MetaTrader5-Docker-Image" würde sonst scheitern
      - name: Compute Image Name
        run: |
          IMAGE="${REGISTRY}/$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')"
          echo "IMAGE=${IMAGE}" >> "$GITHUB_ENV"
          echo "Image: ${IMAGE}"

      - name: Log in to Local Registry
        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login ${REGISTRY} -u ${{ github.actor }} --password-stdin

      # Ein Build, zwei Tags (das Image ist ~4 GB – doppelt bauen kostet unnötig Zeit)
      - name: Build MT5 Image
        run: |
          docker build --platform linux/amd64 \
            -t ${IMAGE}:${{ github.sha }} \
            -t ${IMAGE}:latest \
            .

      - name: Push MT5 Image
        run: |
          docker push ${IMAGE}:${{ github.sha }}
          docker push ${IMAGE}:latest

      - name: Prepare Kubernetes Access
        run: |
          echo "${{ secrets.KUBECONFIG_DATA }}" > ./kind_kubeconfig
          chmod 600 ./kind_kubeconfig

      # Erster Rollout kann bis 15 Min dauern (Wine + MT5 Installation nach /config)
      - name: Terraform Deploy
        env:
          TF_VAR_vnc_password: ${{ secrets.MT5_VNC_PASSWORD }}
        run: |
          terraform --version
          terraform init
          terraform apply -auto-approve \
            -var="image_repository=${IMAGE}" \
            -var="app_version=${{ github.sha }}" \
            -var="vnc_user=${{ secrets.MT5_VNC_USER || 'trader' }}" \
            -var="ingress_host=${INGRESS_HOST}"

      # KasmVNC antwortet ohne Login mit 401 – daher mit Basic Auth prüfen und auf den Erststart warten
      - name: Verify App Health
        if: env.INGRESS_HOST != ''
        env:
          VNC_USER: ${{ secrets.MT5_VNC_USER || 'trader' }}
          VNC_PASS: ${{ secrets.MT5_VNC_PASSWORD }}
        run: |
          for i in $(seq 1 40); do
            CODE=$(curl -s -o /dev/null -w '%{http_code}' --connect-timeout 5 \
              -u "${VNC_USER}:${VNC_PASS}" -H "Host: ${INGRESS_HOST}" \
              http://local-k3s-platform:80/ || true)
            echo "Versuch ${i}: HTTP ${CODE}"
            if [ "${CODE}" = "200" ]; then
              echo "Erfolg: MetaTrader 5 Web-UI läuft via Helm im GitOps-Standard!"
              exit 0
            fi
            sleep 15
          done
          echo "MT5 Web-UI nach 10 Minuten nicht erreichbar"
          exit 1

      # Sensible Werte (VNC-Passwort) vor dem Upload aus dem State-JSON entfernen
      - name: Publish Map to cloudmon Dashboard
        run: |
          terraform show -json \
            | jq 'del(.. | .set_sensitive?) | del(.. | .metadata? | select(type == "array") | .[]?.values?)' \
            > plan.json

          if grep -q "${{ secrets.MT5_VNC_PASSWORD }}" plan.json; then
            echo "Abbruch: Passwort ist noch im JSON enthalten"
            exit 1
          fi

          curl --fail -X POST \
            -H "Authorization: Bearer ${{ secrets.CLOUDMON_TOKEN }}" \
            -H "Content-Type: application/json" \
            -H "Host: cloudmon.local" \
            --data-binary @plan.json \
            "http://local-k3s-platform:80/api/v1/push/?repo=${{ github.repository }}"

          echo "Infrastruktur-Map erfolgreich an cloudmon übermittelt!"

      - name: Cleanup Kubeconfig
        if: always()
        run: rm -f ./kind_kubeconfig plan.json