#!/usr/bin/env bash
# Builds knotless on a host from this checkout and (re)starts it there.
#
#   deploy/deploy.sh <ssh destination> <domain>
#   KNOTLESS_HOST=root@host KNOTLESS_DOMAIN=git.example.com deploy/deploy.sh
#
# or with those in deploy/local.env (see local.env.example).
#
# The image is built by the host's own docker, over SSH, so nothing is
# cross-compiled here and no registry is involved. The build caches stay on
# the host, so a second deploy rebuilds only what changed.
#
# Optional: KNOTLESS_PROXY_NETWORK (knotless), the docker network the
# reverse proxy reaches knotless-serve on; KNOTLESS_DATA (/var/lib/knotless),
# its state on the host; KNOTLESS_JETSTREAM, the Jetstream it follows.

set -euo pipefail
cd "$(dirname "$0")/.."
# Settings for one's own host, kept out of the repository.
[ -f deploy/local.env ] && { set -a; . deploy/local.env; set +a; }

DEST="${1:-${KNOTLESS_HOST:-}}"
DOMAIN="${2:-${KNOTLESS_DOMAIN:-}}"
[ -n "$DEST" ] && [ -n "$DOMAIN" ] || { sed -n '4,5p' "$0" >&2; exit 2; }
NETWORK="${KNOTLESS_PROXY_NETWORK:-knotless}"
DATA="${KNOTLESS_DATA:-/var/lib/knotless}"
SSH="ssh -o StrictHostKeyChecking=accept-new $DEST"

echo "→ building knotless:current on $DEST"
DOCKER_HOST="ssh://$DEST" docker build -t knotless:current .

echo "→ preparing $DEST"
$SSH "
  set -e
  mkdir -p /etc/knotless '$DATA'
  chown 1000:1000 '$DATA'
  # Made once and kept: the operator password for the moderation service.
  if [ ! -f /etc/knotless/secrets.env ]; then
    umask 077
    echo \"KNOTLESS_ADMIN_PASSWORD=\$(openssl rand -hex 24)\" > /etc/knotless/secrets.env
  fi
  docker network inspect '$NETWORK' >/dev/null 2>&1 || docker network create '$NETWORK'
"
{
  echo "KNOTLESS_DOMAIN=$DOMAIN"
  echo "KNOTLESS_PROXY_NETWORK=$NETWORK"
  echo "KNOTLESS_DATA=$DATA"
  [ -z "${KNOTLESS_JETSTREAM:-}" ] || echo "KNOTLESS_JETSTREAM=$KNOTLESS_JETSTREAM"
} | $SSH 'cat > /etc/knotless/.env'
scp -q -o StrictHostKeyChecking=accept-new deploy/docker-compose.yml "$DEST:/etc/knotless/docker-compose.yml"

echo "→ starting"
$SSH '
  set -e
  cd /etc/knotless
  docker compose config --quiet
  docker compose up -d --remove-orphans
  docker compose ps
'

echo "→ done: https://$DOMAIN, once the proxy on $NETWORK serves it"