name: Deploy to VPS

on:
  push:
    branches:
      - master
  workflow_dispatch:

permissions:
  contents: read
  packages: write

env:
  REGISTRY: ghcr.io
  OWNER: mytheclipse


jobs:
  build-and-push:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        service: [frontend, backend, discord-gateway]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push ${{ matrix.service }}
        uses: docker/build-push-action@v6
        with:
          context: .
          file: infra/docker/Dockerfile.${{ matrix.service }}
          push: true
          tags: |
            ${{ env.REGISTRY }}/${{ env.OWNER }}/bete-${{ matrix.service }}:latest
            ${{ env.REGISTRY }}/${{ env.OWNER }}/bete-${{ matrix.service }}:${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          build-args: |
            VITE_BE_API_URL=https://imphnen.asepharyana.my.id
            VITE_BE_WS_URL=wss://imphnen.asepharyana.my.id

  deploy:
    needs: build-and-push
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Deploy to VPS
        uses: appleboy/ssh-action@v1.2.5
        env:
          GHCR_USERNAME: ${{ github.actor }}
          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          ENV_FILE: ${{ secrets.ENV_FILE }}
        with:
          host: ${{ secrets.VPS_HOST }}
          username: ${{ secrets.VPS_USERNAME }}
          key: ${{ secrets.VPS_SSH_KEY }}
          envs: GHCR_USERNAME,GHCR_TOKEN,ENV_FILE
          script: |
            set -eu

            APP_DIR=/opt/imphenbot
            mkdir -p "$APP_DIR"
            cd "$APP_DIR"

            printf '%s\n' "$ENV_FILE" > .env

            cat > docker-compose.yml <<'COMPOSE_EOF'
            services:
              backend:
                image: ghcr.io/${OWNER:-mytheclipse}/bete-backend:latest
                container_name: imphenbot-backend
                restart: unless-stopped
                env_file:
                  - .env
                environment:
                  NODE_ENV: production
                  WEBSERVER_PORT: 3000
                labels:
                  - "traefik.enable=true"
                  - "traefik.http.routers.imphenbot-backend.rule=Host(`imphnen.asepharyana.my.id`) && PathPrefix(`/api`, `/ws`)"
                  - "traefik.http.routers.imphenbot-backend.entrypoints=websecure"
                  - "traefik.http.routers.imphenbot-backend.tls=true"
                  - "traefik.http.services.imphenbot-backend.loadbalancer.server.port=3000"
                depends_on:
                  - discord-gateway
                networks:
                  - app-shared-net

              discord-gateway:
                image: ghcr.io/${OWNER:-mytheclipse}/bete-discord-gateway:latest
                container_name: imphenbot-discord-gateway
                restart: unless-stopped
                env_file:
                  - .env
                environment:
                  NODE_ENV: production
                volumes:
                  - ./recordings:/app/recordings
                networks:
                  - app-shared-net

              frontend:
                image: ghcr.io/${OWNER:-mytheclipse}/bete-frontend:latest
                container_name: imphenbot-frontend
                restart: unless-stopped
                labels:
                  - "traefik.enable=true"
                  - "traefik.http.routers.imphenbot-frontend.rule=Host(`imphnen.asepharyana.my.id`)"
                  - "traefik.http.routers.imphenbot-frontend.entrypoints=websecure"
                  - "traefik.http.routers.imphenbot-frontend.tls=true"
                  - "traefik.http.services.imphenbot-frontend.loadbalancer.server.port=3000"
                depends_on:
                  - backend
                networks:
                  - app-shared-net

            networks:
              app-shared-net:
                name: app-shared-net
                external: true
            COMPOSE_EOF

            mkdir -p recordings

            echo "$GHCR_TOKEN" | docker login ghcr.io -u "$GHCR_USERNAME" --password-stdin

            docker compose pull
            docker compose down --remove-orphans || true
            docker compose up -d --remove-orphans
            docker image prune -f