when:
  - event: push
    branch: main

steps:
  validate:
    image: alpine:latest
    commands:
      - apk add --no-cache docker-cli docker-cli-compose
      - |
        YAML_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n' | grep '\.yaml$' || true)
        [ -z "$YAML_FILES" ] && echo "No yaml files changed" && exit 0
        for f in $YAML_FILES; do
          [ -f "$f" ] || continue
          docker compose -f "$f" --no-interpolate config -q \
            && echo "  OK $f" || { echo "  FAIL $f"; exit 1; }
        done

  provision-secrets:
    image: alpine:latest
    environment:
      SSH_KEY:
        from_secret: ssh_key
      SWARM_MANAGER_IP:
        from_secret: swarm_manager_ip
      3DPRINT_DB_PASSWORD:
        from_secret: 3dprint_db_password
      GAMMA_AUTH_TOKEN:
        from_secret: gamma_auth_token
      GIT_DB_PASSWORD:
        from_secret: git_db_password
      GIT_RUNNER_TOKEN:
        from_secret: git_runner_token
      GIT_MCP_ACCESS_TOKEN:
        from_secret: git_mcp_access_token
      HOMEASSISTANT_FRIGATE_RTSP_PASSWORD:
        from_secret: homeassistant_frigate_rtsp_password
      HOMEASSISTANT_IMMICH_API_KEY:
        from_secret: homeassistant_immich_api_key
      MEALIE_DB_PASSWORD:
        from_secret: mealie_db_password
      MEALIE_LDAP_QUERY_PASSWORD:
        from_secret: mealie_ldap_query_password
      MESHCENTRAL_BACKUP_PASSWORD:
        from_secret: meshcentral_backup_password
      N8N_DB_PASSWORD:
        from_secret: n8n_db_password
      N8N_ENCRYPTION_KEY:
        from_secret: n8n_encryption_key
      POSTGRESQL_PASSWORD:
        from_secret: postgresql_password
      POSTGRESQL_PGADMIN_PASSWORD:
        from_secret: postgresql_pgadmin_password
      PRODUCTIVITY_PAPERLESS_SECRET_KEY:
        from_secret: productivity_paperless_secret_key
      PRODUCTIVITY_DB_PASSWORD:
        from_secret: productivity_db_password
      PRODUCTIVITY_OIDC_PROVIDERS:
        from_secret: productivity_oidc_providers
      TRAEFIK_KEEPALIVED_PASSWORD:
        from_secret: traefik_keepalived_password
      VAULTWARDEN_ADMIN_TOKEN:
        from_secret: vaultwarden_admin_token
      VAULTWARDEN_DATABASE_URL:
        from_secret: vaultwarden_database_url
      AI_AWS_ACCESS_KEY_ID:
        from_secret: ai_aws_access_key_id
      AI_AWS_SECRET_ACCESS_KEY:
        from_secret: ai_aws_secret_access_key
      AI_LITELLM_MASTER_KEY:
        from_secret: ai_litellm_master_key
      AI_LITELLM_SALT_KEY:
        from_secret: ai_litellm_salt_key
      AI_LITELLM_DB_PASSWORD:
        from_secret: ai_litellm_db_password
      AI_OAUTH_CLIENT_ID:
        from_secret: ai_oauth_client_id
      AI_OAUTH_CLIENT_SECRET:
        from_secret: ai_oauth_client_secret
      AI_WEBUI_SECRET_KEY:
        from_secret: ai_webui_secret_key
      AI_OPEN_WEBUI_DB_URL:
        from_secret: ai_open_webui_db_url
      AI_MCPO_API_KEY:
        from_secret: ai_mcpo_api_key
      ENTERTAINMENT_DISCORD_TOKEN:
        from_secret: entertainment_discord_token
      ENTERTAINMENT_DISCORD_CLIENT_SECRET:
        from_secret: entertainment_discord_client_secret
      ENTERTAINMENT_SECRET_KEY_BASE:
        from_secret: entertainment_secret_key_base
      ENTERTAINMENT_BASIC_AUTH_PASSWORD:
        from_secret: entertainment_basic_auth_password
      ENTERTAINMENT_SPARKY_DB_PASSWORD:
        from_secret: entertainment_sparky_db_password
      ENTERTAINMENT_SPARKY_APP_DB_PASSWORD:
        from_secret: entertainment_sparky_app_db_password
      ENTERTAINMENT_SPARKY_ENCRYPTION_KEY:
        from_secret: entertainment_sparky_encryption_key
      ENTERTAINMENT_BETTER_AUTH_SECRET:
        from_secret: entertainment_better_auth_secret
    commands:
      - apk add --no-cache openssh-client
      - mkdir -p ~/.ssh
      - echo "$SSH_KEY" | base64 -d > ~/.ssh/id_rsa
      - chmod 600 ~/.ssh/id_rsa
      - ssh-keyscan -H ${SWARM_MANAGER_IP} >> ~/.ssh/known_hosts 2>/dev/null || true
      - |
        YAML_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n' | grep '\.yaml$' || true)
        [ -z "$YAML_FILES" ] && echo "No stack yaml files changed, skipping" && exit 0
      - scp -o StrictHostKeyChecking=no deploy/create-secrets.sh root@${SWARM_MANAGER_IP}:/tmp/cs.sh
      - |
        YAML_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n' | grep '\.yaml$' || true)
        for f in $YAML_FILES; do
          STACK=$(basename "$f" .yaml)
          echo "Provisioning: $STACK"
          case "$STACK" in
            maintenance|media|unifi|guacamole|security|auth)
              echo "  No Docker secrets for $STACK — secrets in host .env";;
            woodpecker)
              echo "  Manual only - skipping";;
            3dprint)
              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
                create_or_update_secret '3dprint_db_password' '${3DPRINT_DB_PASSWORD}'";;
            gamma)
              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
                create_or_update_secret 'gamma_auth_token' '${GAMMA_AUTH_TOKEN}'";;
            git)
              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
                create_or_update_secret 'git_db_password'      '${GIT_DB_PASSWORD}'
                create_or_update_secret 'git_runner_token'     '${GIT_RUNNER_TOKEN}'
                create_or_update_secret 'git_mcp_access_token' '${GIT_MCP_ACCESS_TOKEN}'";;
            homeassistant)
              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
                create_or_update_secret 'homeassistant_frigate_rtsp_password' '${HOMEASSISTANT_FRIGATE_RTSP_PASSWORD}'
                create_or_update_secret 'homeassistant_immich_api_key'        '${HOMEASSISTANT_IMMICH_API_KEY}'";;
            mealie)
              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
                create_or_update_secret 'mealie_db_password'         '${MEALIE_DB_PASSWORD}'
                create_or_update_secret 'mealie_ldap_query_password' '${MEALIE_LDAP_QUERY_PASSWORD}'";;
            meshcentral)
              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
                create_or_update_secret 'meshcentral_backup_password' '${MESHCENTRAL_BACKUP_PASSWORD}'";;
            n8n)
              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
                create_or_update_secret 'n8n_db_password'    '${N8N_DB_PASSWORD}'
                create_or_update_secret 'n8n_encryption_key' '${N8N_ENCRYPTION_KEY}'";;
            postgresql)
              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
                create_or_update_secret 'postgresql_password'         '${POSTGRESQL_PASSWORD}'
                create_or_update_secret 'postgresql_pgadmin_password' '${POSTGRESQL_PGADMIN_PASSWORD}'";;
            traefik)
              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
                create_or_update_secret 'traefik_keepalived_password' '${TRAEFIK_KEEPALIVED_PASSWORD}'";;
            productivity)
              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
                create_or_update_secret 'productivity_paperless_secret_key' '${PRODUCTIVITY_PAPERLESS_SECRET_KEY}'
                create_or_update_secret 'productivity_db_password' '${PRODUCTIVITY_DB_PASSWORD}'
                create_or_update_secret 'productivity_oidc_providers' '${PRODUCTIVITY_OIDC_PROVIDERS}'";;
            vaultwarden)
              printf '%s' "${VAULTWARDEN_ADMIN_TOKEN}" | ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "docker secret rm vaultwarden_admin_token 2>/dev/null; docker secret create vaultwarden_admin_token -"
              printf '%s' "${VAULTWARDEN_DATABASE_URL}" | ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "docker secret rm vaultwarden_database_url 2>/dev/null; docker secret create vaultwarden_database_url -";;
            *)
              echo "  No secrets case for $STACK";;
          esac
        done

  deploy:
    image: alpine:latest
    environment:
      SSH_KEY:
        from_secret: ssh_key
      SWARM_MANAGER_IP:
        from_secret: swarm_manager_ip
    commands:
      - apk add --no-cache openssh-client rsync
      - mkdir -p ~/.ssh
      - echo "$SSH_KEY" | base64 -d > ~/.ssh/id_rsa
      - chmod 600 ~/.ssh/id_rsa
      - ssh-keyscan -H ${SWARM_MANAGER_IP} >> ~/.ssh/known_hosts 2>/dev/null || true
      - |
        YAML_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n' | grep '\.yaml$' || true)
        [ -z "$YAML_FILES" ] && echo "No yaml files changed" && exit 0
        rsync -av -e "ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_rsa" deploy/ root@${SWARM_MANAGER_IP}:/volume1/docker/compose-files/deploy/
        for f in $YAML_FILES; do
          [ -f "$f" ] || continue
          STACK=$(basename "$f" .yaml)
          rsync -av -e "ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_rsa" \
            "$f" root@${SWARM_MANAGER_IP}:/volume1/docker/compose-files/
          ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} \
            "bash /volume1/docker/compose-files/deploy/stack-deploy.sh $STACK" \
            && echo "  OK $STACK" || { echo "  FAIL $STACK"; exit 1; }
        done

  verify:
    image: alpine:latest
    environment:
      SSH_KEY:
        from_secret: ssh_key
      SWARM_MANAGER_IP:
        from_secret: swarm_manager_ip
    commands:
      - apk add --no-cache openssh-client
      - mkdir -p ~/.ssh
      - echo "$SSH_KEY" | base64 -d > ~/.ssh/id_rsa
      - chmod 600 ~/.ssh/id_rsa
      - ssh-keyscan -H ${SWARM_MANAGER_IP} >> ~/.ssh/known_hosts 2>/dev/null || true
      - |
        YAML_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n' | grep '\.yaml$' || true)
        [ -z "$YAML_FILES" ] && exit 0
        sleep 5
        for f in $YAML_FILES; do
          STACK=$(basename "$f" .yaml)
          echo "--- $STACK ---"
          ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} \
            "docker stack ps $STACK --filter desired-state=running \
             --format '  {{.Name}} {{.CurrentState}}'"
        done

  notify-success:
    image: alpine:latest
    environment:
      TEAMS_WEBHOOK:
        from_secret: teams_webhook
    commands:
      - apk add --no-cache curl
      - |
        CHANGED=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' ' ')
        PAYLOAD=$(printf '{"title":"Swarm Deploy OK","text":"Stacks: %s Commit: %s","themeColor":"00aa00"}' "$CHANGED" "$CI_COMMIT_MESSAGE")
        curl -sf -X POST -H 'Content-Type: application/json' -d "$PAYLOAD" "$TEAMS_WEBHOOK" || true
    when:
      - status: success

  notify-failure:
    image: alpine:latest
    environment:
      TEAMS_WEBHOOK:
        from_secret: teams_webhook
      WOODPECKER_HOST:
        from_secret: woodpecker_host
    commands:
      - apk add --no-cache curl
      - |
        PAYLOAD=$(printf '{"title":"Swarm Deploy FAILED","text":"Commit: %s See: https://${WOODPECKER_HOST}","themeColor":"ff0000"}' "$CI_COMMIT_MESSAGE")
        curl -sf -X POST -H 'Content-Type: application/json' -d "$PAYLOAD" "$TEAMS_WEBHOOK" || true
    when:
      - status: failure