name: Django Helm GitOps Deploy

on:
  push:
    branches: [ "main" ]
  workflow_dispatch:
    inputs:
      deploy_prod:
        description: "Nach erfolgreichem Test auch auf Produktion (Talos) deployen?"
        type: boolean
        default: true

jobs:
  # ---------------------------------------------------------------------------
  # 1. Build + Test (k3s) – wie bisher
  # ---------------------------------------------------------------------------
  build-and-test:
    runs-on: ubuntu-latest
    container: catthehacker/ubuntu:act-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      # HINWEIS: Das Terraform-Binary wird über das globale Runner-Volume (:ro)
      # vollautomatisch und manipulationssicher nach /usr/local/bin/terraform injiziert.

      - name: Trust Local Nginx Certificate Inside Container
        run: |
          mkdir -p /usr/local/share/ca-certificates/
          cp nginx_ssl/nginx.crt /usr/local/share/ca-certificates/nginx-sandbox.crt 2>/dev/null || echo "Nutze Workspace-Zertifikat"
          update-ca-certificates

      - name: Log in to Local Registry
        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login localhost:3005 -u ${{ github.actor }} --password-stdin

      # Ein Build, zwei Tags
      - name: Build Django Image
        run: |
          docker build \
            -t localhost:3005/${{ github.repository }}:${{ github.sha }} \
            -t localhost:3005/${{ github.repository }}:latest .

      - name: Push Django Image
        run: |
          docker push localhost:3005/${{ github.repository }}:${{ github.sha }}
          docker push localhost:3005/${{ github.repository }}:latest

      - name: Prepare Kubernetes Access (k3s)
        run: |
          echo "${{ secrets.KUBECONFIG_DATA }}" > ./kind_kubeconfig
          chmod 600 ./kind_kubeconfig

      - name: Terraform Deploy (test / k3s)
        run: |
          terraform --version
          terraform init -reconfigure -backend-config=envs/test.backend.hcl
          terraform apply -auto-approve \
            -var-file=envs/test.tfvars \
            -var="app_version=${{ github.sha }}"

      - name: Verify App Health (test)
        run: |
          sleep 15
          curl --fail -L --connect-timeout 5 -H "Host: boday-it.ch" http://local-k3s-platform:80/ || exit 1
          echo "Test (k3s) OK"

      - name: Publish Map to cloudmon Dashboard (test)
        run: |
          terraform show -json > plan.json
          curl -X POST \
            -H "Authorization: Bearer ${{ secrets.CLOUDMON_TOKEN }}" \
            -H "Content-Type: application/json" \
            -H "Host: cloudmon.local" \
            --data-binary @plan.json \
            "http://local-k3s-platform:80/api/v1/push/?repo=${{ github.repository }}&env=test"

  # ---------------------------------------------------------------------------
  # 2. Produktion (Talos) – nur wenn Test grün ist; gleiches Image (Git-SHA)
  # ---------------------------------------------------------------------------
  deploy-prod:
    needs: build-and-test
    if: github.event_name == 'push' || inputs.deploy_prod
    runs-on: ubuntu-latest
    container: catthehacker/ubuntu:act-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Prepare Kubernetes Access (Talos)
        run: |
          echo "${{ secrets.KUBECONFIG_TALOS }}" > ./talos_kubeconfig
          chmod 600 ./talos_kubeconfig

      - name: Terraform Deploy (prod / Talos)
        env:
          TF_VAR_django_secret_key: ${{ secrets.PROD_DJANGO_SECRET_KEY }}
          TF_VAR_postgres_password: ${{ secrets.PROD_POSTGRES_PASSWORD }}
        run: |
          terraform init -reconfigure -backend-config=envs/prod.backend.hcl
          terraform apply -auto-approve \
            -var-file=envs/prod.tfvars \
            -var="app_version=${{ github.sha }}"

      # Erster Lauf: Longhorn-Volume + initdb dauern länger -> mit Retries
      - name: Verify App Health (prod)
        run: |
          for i in $(seq 1 12); do
            if curl --fail -sL --connect-timeout 5 -o /dev/null -H "Host: boday-it.ch" http://${{ vars.TALOS_INGRESS_IP }}/; then
              echo "Prod (Talos) OK"; exit 0
            fi
            echo "Noch nicht erreichbar, Versuch $i/12"; sleep 10
          done
          exit 1

      - name: Publish Map to cloudmon Dashboard (prod)
        run: |
          # show -json enthält sensitive Werte im Klartext -> Prod-Secrets vor dem Versand entfernen
          terraform show -json | jq 'del(.. | .set_sensitive?)' > plan.json
          ! grep -qF "${{ secrets.PROD_POSTGRES_PASSWORD }}" plan.json || { echo "Secret im JSON gefunden, Abbruch"; exit 1; }
          curl -X POST \
            -H "Authorization: Bearer ${{ secrets.CLOUDMON_TOKEN }}" \
            -H "Content-Type: application/json" \
            -H "Host: cloudmon.local" \
            --data-binary @plan.json \
            "http://local-k3s-platform:80/api/v1/push/?repo=${{ github.repository }}&env=prod"