name: deploy-sol-public-edge

on:
  push:
    branches:
      - main
    paths:
      - environments/sol/public-edge/**
      - .gitea/workflows/deploy-sol-public-edge.yaml
  workflow_dispatch:

jobs:
  apply:
    runs-on: k3s-deploy
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Materialize kubeconfig
        env:
          K3S_KUBECONFIG_B64: ${{ secrets.K3S_KUBECONFIG_B64 }}
        run: |
          test -n "$K3S_KUBECONFIG_B64"
          printf '%s' "$K3S_KUBECONFIG_B64" | base64 -d >/tmp/kubeconfig
          chmod 600 /tmp/kubeconfig

      - name: Install kubectl
        run: |
          curl -fsSL -o /tmp/kubectl https://dl.k8s.io/release/v1.34.6/bin/linux/amd64/kubectl
          install -m 0755 /tmp/kubectl /usr/local/bin/kubectl
          kubectl version --client

      - name: Apply public edge resources
        env:
          KUBECONFIG: /tmp/kubeconfig
        run: |
          kubectl apply -f environments/sol/public-edge/cert-manager-namespace.yaml
          kubectl apply -f environments/sol/public-edge/cert-manager-helmchart.yaml
          kubectl apply -f environments/sol/public-edge/traefik-helmchart.yaml

      - name: Wait for cert-manager
        env:
          KUBECONFIG: /tmp/kubeconfig
        run: |
          for attempt in $(seq 1 60); do
            if kubectl -n cert-manager get deploy cert-manager cert-manager-cainjector cert-manager-webhook >/dev/null 2>&1; then
              break
            fi
            sleep 5
          done
          kubectl -n cert-manager rollout status deploy/cert-manager --timeout=300s
          kubectl -n cert-manager rollout status deploy/cert-manager-cainjector --timeout=300s
          kubectl -n cert-manager rollout status deploy/cert-manager-webhook --timeout=300s

      - name: Wait for traefik
        env:
          KUBECONFIG: /tmp/kubeconfig
        run: |
          for attempt in $(seq 1 60); do
            if kubectl -n kube-system get ds traefik >/dev/null 2>&1; then
              break
            fi
            sleep 5
          done
          kubectl -n kube-system rollout status ds/traefik --timeout=300s

      - name: Wait for issuer
        env:
          KUBECONFIG: /tmp/kubeconfig
        run: |
          kubectl wait --for=condition=Established crd/certificates.cert-manager.io --timeout=300s
          kubectl apply -f environments/sol/public-edge/letsencrypt-prod-clusterissuer.yaml
          kubectl apply -f environments/sol/public-edge/trade-frontend-public-ingress.yaml
          kubectl wait --for=jsonpath='{.status.conditions[?(@.type=="Ready")].status}'=True clusterissuer/letsencrypt-prod --timeout=300s

      - name: Verify HTTP ingress
        env:
          KUBECONFIG: /tmp/kubeconfig
        run: |
          kubectl -n trade-r001-canary get ingress trade-frontend-public -o wide
          curl -fsS --resolve trade.mpabi.pl:80:149.50.96.162 http://trade.mpabi.pl/healthz

      - name: Report TLS state
        env:
          KUBECONFIG: /tmp/kubeconfig
        run: |
          resolved_ip="$(getent ahostsv4 trade.mpabi.pl | awk 'NR==1 {print $1}')"
          echo "resolved_ip=${resolved_ip:-<none>}"
          kubectl -n trade-r001-canary get certificate,order,challenge || true
          if [ "${resolved_ip:-}" = "149.50.96.162" ]; then
            kubectl -n trade-r001-canary wait --for=jsonpath='{.status.conditions[?(@.type=="Ready")].status}'=True certificate/trade-mpabi-pl-tls --timeout=600s
            curl -fsS --resolve trade.mpabi.pl:443:149.50.96.162 https://trade.mpabi.pl/healthz
          else
            echo "DNS still does not point trade.mpabi.pl to 149.50.96.162; skipped TLS readiness gate."
          fi