#!/bin/bash
#
# Executa deploy.sh em um host remoto via SSH.
#
#   ./deploy-over-ssh.sh <ambiente> <tag>
#
# O script e o arquivo <ambiente>.env do checkout sao copiados somente para um
# diretorio temporario no host remoto. A configuracao sensivel da aplicacao
# continua no CONFIG_DIR daquele host; ela nunca passa pelo job nem pelo SSH.

set -euo pipefail

AMBIENTE="${1:-}"
TAG="${2:-}"
SSH_HOST="${SSH_HOST:-}"
SSH_PORT="${SSH_PORT:-22}"
SSH_USER="${SSH_USER:-}"
SSH_PRIVATE_KEY="${SSH_PRIVATE_KEY:-}"
SSH_KNOWN_HOSTS="${SSH_KNOWN_HOSTS:-}"
REGISTRY="${REGISTRY:-192.168.0.41:3001}"
REGISTRY_TOKEN="${REGISTRY_TOKEN:-}"
REGISTRY_USER="${REGISTRY_USER:-${ACTOR:-}}"

AQUI="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
ENV_FILE="${AQUI}/${AMBIENTE}.env"

log()  { echo "[deploy-ssh] $*"; }
fail() { echo "[deploy-ssh][ERRO] $*" >&2; exit 1; }

[ -n "${AMBIENTE}" ] || fail "uso: $0 <ambiente> <tag>"
[ -n "${TAG}" ] || fail "uso: $0 <ambiente> <tag>"
[ -f "${ENV_FILE}" ] || fail "ambiente desconhecido: ${AMBIENTE} (esperado ${ENV_FILE})"
[ -n "${SSH_HOST}" ] || fail "SSH_HOST nao definido"
[ -n "${SSH_USER}" ] || fail "SSH_USER nao definido"
[ -n "${SSH_PRIVATE_KEY}" ] || fail "SSH_PRIVATE_KEY nao definido"
[ -n "${SSH_KNOWN_HOSTS}" ] || fail "SSH_KNOWN_HOSTS nao definido"
[ -n "${REGISTRY_TOKEN}" ] || fail "REGISTRY_TOKEN nao definido"
[ -n "${REGISTRY_USER}" ] || fail "REGISTRY_USER/ACTOR nao definido"

command -v ssh >/dev/null || fail "cliente ssh nao encontrado no job"
command -v scp >/dev/null || fail "cliente scp nao encontrado no job"

TMP_LOCAL="$(mktemp -d)"
KEY_FILE="${TMP_LOCAL}/id_ed25519"
KNOWN_HOSTS_FILE="${TMP_LOCAL}/known_hosts"
REMOTE_DIR=""

cleanup() {
    local status=$?
    trap - EXIT
    if [ -n "${REMOTE_DIR}" ]; then
        ssh "${SSH_OPTS[@]}" "${SSH_USER}@${SSH_HOST}" \
            "docker logout '${REGISTRY}' >/dev/null 2>&1 || true; rm -rf -- '${REMOTE_DIR}'" \
            >/dev/null 2>&1 || true
    fi
    rm -rf -- "${TMP_LOCAL}"
    exit "${status}"
}
trap cleanup EXIT

printf '%s\n' "${SSH_PRIVATE_KEY}" > "${KEY_FILE}"
printf '%s\n' "${SSH_KNOWN_HOSTS}" > "${KNOWN_HOSTS_FILE}"
chmod 600 "${KEY_FILE}" "${KNOWN_HOSTS_FILE}"

SSH_OPTS=(
    -i "${KEY_FILE}"
    -p "${SSH_PORT}"
    -o IdentitiesOnly=yes
    -o StrictHostKeyChecking=yes
    -o UserKnownHostsFile="${KNOWN_HOSTS_FILE}"
)
SCP_OPTS=(
    -i "${KEY_FILE}"
    -P "${SSH_PORT}"
    -o IdentitiesOnly=yes
    -o StrictHostKeyChecking=yes
    -o UserKnownHostsFile="${KNOWN_HOSTS_FILE}"
)

log "conectando em ${SSH_USER}@${SSH_HOST}:${SSH_PORT}"
REMOTE_DIR="$(ssh "${SSH_OPTS[@]}" "${SSH_USER}@${SSH_HOST}" 'umask 077; mktemp -d /tmp/conectasus-deploy.XXXXXX')"
case "${REMOTE_DIR}" in
    /tmp/conectasus-deploy.*) ;;
    *) fail "diretorio temporario remoto inesperado: ${REMOTE_DIR}" ;;
esac

log "enviando script de deploy temporariamente"
scp "${SCP_OPTS[@]}" \
    "${AQUI}/deploy.sh" \
    "${ENV_FILE}" \
    "${SSH_USER}@${SSH_HOST}:${REMOTE_DIR}/"

# O login e feito no host remoto porque o docker pull sera executado por ele.
# A senha trafega pelo stdin e nao aparece na linha de comando nem nos logs.
printf '%s' "${REGISTRY_TOKEN}" | \
    ssh "${SSH_OPTS[@]}" "${SSH_USER}@${SSH_HOST}" \
      "docker login '${REGISTRY}' -u '${REGISTRY_USER}' --password-stdin" >/dev/null

log "executando deploy remoto de ${AMBIENTE}:${TAG}"
ssh "${SSH_OPTS[@]}" "${SSH_USER}@${SSH_HOST}" \
    "chmod 700 '${REMOTE_DIR}/deploy.sh' && '${REMOTE_DIR}/deploy.sh' '${AMBIENTE}' '${TAG}'"

log "deploy remoto concluido"