name: Deploy Caddy Config

on:
  push:
    branches: [main]
    paths:
      - 'infra/caddy/**'
      - 'infra/firewall/**'
      - 'infra/systemd/**'
  workflow_dispatch:

concurrency:
  group: caddy-deploy
  cancel-in-progress: false

permissions:
  contents: read

env:
  VPS_HOST: ${{ secrets.VPS_HOST }}
  VPS_USER: ${{ secrets.VPS_USER }}

jobs:
  deploy-caddy:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v7

      - name: Validate Caddyfile syntax
        run: |
          # Real Caddy parser (better than naive brace counting)
          curl -fsSL https://caddyserver.com/api/download?os=linux\&arch=amd64 -o /tmp/caddy
          chmod +x /tmp/caddy
          /tmp/caddy validate --config infra/caddy/Caddyfile.prod --adapter caddyfile 2>&1 | tail -5
          echo "✅ Caddyfile valid"

      - name: Setup SSH key
        env:
          SSH_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
        run: |
          mkdir -p ~/.ssh
          echo "$SSH_KEY" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          sed -i 's/\r$//' ~/.ssh/id_ed25519
          ssh-keygen -y -f ~/.ssh/id_ed25519 >/dev/null 2>&1 || { echo "SSH key invalid"; exit 1; }
          ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts 2>/dev/null

      - name: Sync Caddyfile to VPS
        run: |
          set -e
          # Backup current config, then push the new one
          ssh "$VPS_USER@$VPS_HOST" "sudo cp /etc/caddy/Caddyfile /etc/caddy/Caddyfile.bak-previous"
          scp -q infra/caddy/Caddyfile.prod "$VPS_USER@$VPS_HOST":/tmp/Caddyfile.new
          ssh "$VPS_USER@$VPS_HOST" "sudo cp /tmp/Caddyfile.new /etc/caddy/Caddyfile && sudo rm -f /tmp/Caddyfile.new"
          echo "✅ Caddyfile synced"

      - name: Reload Caddy
        run: |
          ssh "$VPS_USER@$VPS_HOST" "sudo systemctl reload caddy || sudo systemctl restart caddy"
          sleep 3
          ssh "$VPS_USER@$VPS_HOST" "systemctl is-active caddy"

      - name: Verify routes
        run: |
          set -e
          for u in hub.asepharyana.my.id scraper.asepharyana.my.id tools.asepharyana.my.id wiki.asepharyana.my.id upload.asepharyana.my.id ai.asepharyana.my.id; do
            code=$(curl -s -o /dev/null -w '%{http_code}' --max-time 10 "https://$u/" || true)
            echo "$u -> $code"
            case "$code" in
              000|502|503|504) echo "::error::$u bad status $code"; exit 1 ;;
            esac
          done
          echo "✅ All routes reachable"