when:
  - event: push
    branch: main

steps:
  validate:
    image: alpine:latest
    commands:
      - apk add --no-cache docker-cli docker-cli-compose
      - |
        YAML_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n' | grep '\.yaml$' || true)
        [ -z "$YAML_FILES" ] && echo "No yaml files changed" && exit 0
        for f in $YAML_FILES; do
          [ -f "$f" ] || continue
          docker compose -f "$f" --no-interpolate config -q \
            && echo "  OK $f" || { echo "  FAIL $f"; exit 1; }
        done

  debug-secrets:
    image: alpine:latest
    commands:
      - echo "SSH_KEY length=$(echo -n $SSH_KEY | wc -c)"
      - echo "SWARM_MANAGER_IP=[${SWARM_MANAGER_IP}] length=$(echo -n $SWARM_MANAGER_IP | wc -c)"
      - echo "All env vars matching known secret names (masked):"
      - env | grep -Ei "^(SSH_KEY|SWARM|WOODPECKER|MEALIE|VAULTW)=" | sed 's/=.*/=***/'
    secrets:
      - ssh_key
      - swarm_manager_ip
      - mealie_db_password
      - woodpecker_host

  provision-secrets:
    image: alpine:latest
    commands:
      - apk add --no-cache openssh-client
      - mkdir -p ~/.ssh
      - echo "$SSH_KEY" | base64 -d > ~/.ssh/id_rsa
      - chmod 600 ~/.ssh/id_rsa
      - ssh-keyscan -H ${SWARM_MANAGER_IP} >> ~/.ssh/known_hosts 2>/dev/null
      - |
        YAML_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n' | grep '\.yaml$' || true)
        [ -z "$YAML_FILES" ] && echo "No stack yaml files changed, skipping" && exit 0
      - scp -o StrictHostKeyChecking=no deploy/create-secrets.sh root@${SWARM_MANAGER_IP}:/tmp/cs.sh
      - |
        YAML_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n' | grep '\.yaml$' || true)
        for f in $YAML_FILES; do
          STACK=$(basename "$f" .yaml)
          echo "Provisioning: $STACK"
          case "$STACK" in
            maintenance|media|unifi)
              echo "  No secrets for $STACK";;
            woodpecker)
              echo "  Manual only - skipping";;
            *)
              echo "  No secrets case for $STACK";;
          esac
        done
    secrets:
      - ssh_key
      - swarm_manager_ip
      - 3dprint_db_password
      - auth_pg_password
      - auth_secret_key
      - auth_pg_password2
      - gamma_auth_token
      - git_db_password
      - git_runner_token
      - git_mcp_access_token
      - guacamole_ldap_bind_password
      - guacamole_oidc_client_secret
      - guacamole_db_password
      - homeassistant_frigate_rtsp_password
      - homeassistant_immich_api_key
      - mealie_db_password
      - mealie_ldap_query_password
      - meshcentral_backup_password
      - n8n_db_password
      - n8n_encryption_key
      - postgresql_password
      - postgresql_pgadmin_password
      - productivity_paperless_secret_key
      - productivity_db_password
      - productivity_oidc_providers
      - security_pg_pass
      - security_authentik_secret_key
      - security_authentik_pg_password
      - security_crowdsec_pgdsn
      - security_bouncer_key_traefik
      - security_crowdsec_api_key
      - security_crowdsec_password
      - traefik_keepalived_password
      - vaultwarden_admin_token
      - vaultwarden_database_url

  deploy:
    image: alpine:latest
    commands:
      - apk add --no-cache openssh-client rsync
      - mkdir -p ~/.ssh
      - echo "$SSH_KEY" | base64 -d > ~/.ssh/id_rsa
      - chmod 600 ~/.ssh/id_rsa
      - ssh-keyscan -H ${SWARM_MANAGER_IP} >> ~/.ssh/known_hosts 2>/dev/null
      - |
        YAML_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n' | grep '\.yaml$' || true)
        [ -z "$YAML_FILES" ] && echo "No yaml files changed" && exit 0
        rsync -av -e "ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_rsa" deploy/ root@${SWARM_MANAGER_IP}:/volume1/docker/compose-files/deploy/
        for f in $YAML_FILES; do
          [ -f "$f" ] || continue
          STACK=$(basename "$f" .yaml)
          rsync -av -e "ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_rsa" \
            "$f" root@${SWARM_MANAGER_IP}:/volume1/docker/compose-files/
          ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} \
            "bash /volume1/docker/compose-files/deploy/stack-deploy.sh $STACK" \
            && echo "  OK $STACK" || { echo "  FAIL $STACK"; exit 1; }
        done
    secrets:
      - ssh_key
      - swarm_manager_ip

  verify:
    image: alpine:latest
    commands:
      - apk add --no-cache openssh-client
      - mkdir -p ~/.ssh
      - echo "$SSH_KEY" | base64 -d > ~/.ssh/id_rsa
      - chmod 600 ~/.ssh/id_rsa
      - ssh-keyscan -H ${SWARM_MANAGER_IP} >> ~/.ssh/known_hosts 2>/dev/null
      - |
        YAML_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n' | grep '\.yaml$' || true)
        [ -z "$YAML_FILES" ] && exit 0
        sleep 5
        for f in $YAML_FILES; do
          STACK=$(basename "$f" .yaml)
          echo "--- $STACK ---"
          ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} \
            "docker stack ps $STACK --filter desired-state=running \
             --format '  {{.Name}} {{.CurrentState}}'"
        done
    secrets:
      - ssh_key
      - swarm_manager_ip

  notify-success:
    image: alpine:latest
    commands:
      - apk add --no-cache curl
      - |
        CHANGED=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' ' ')
        PAYLOAD=$(printf '{"title":"Swarm Deploy OK","text":"Stacks: %s Commit: %s","themeColor":"00aa00"}' "$CHANGED" "$CI_COMMIT_MESSAGE")
        curl -sf -X POST -H 'Content-Type: application/json' -d "$PAYLOAD" "$TEAMS_WEBHOOK" || true
    secrets: [ teams_webhook ]
    when:
      - status: success

  notify-failure:
    image: alpine:latest
    commands:
      - apk add --no-cache curl
      - |
        PAYLOAD=$(printf '{"title":"Swarm Deploy FAILED","text":"Commit: %s See: https://${WOODPECKER_HOST}","themeColor":"ff0000"}' "$CI_COMMIT_MESSAGE")
        curl -sf -X POST -H 'Content-Type: application/json' -d "$PAYLOAD" "$TEAMS_WEBHOOK" || true
    secrets:
      - teams_webhook
      - woodpecker_host
    when:
      - status: failure