#!/usr/bin/env bash
# CelestiaTrace backend deployment.
# This updates only the backend service; PostgreSQL is not recreated or stopped.

set -Eeuo pipefail

SERVER_IP="47.93.193.127"
PEM_KEY="../ccdw-meishi-1.pem"
REMOTE_DIR="/opt/celestia-trace-backend"
SSH_USER="root"
COMPOSE_PROJECT="celestia-trace-backend"
PROXY_DIR="/opt/meishi_ccdw_life"
PROXY_CONFIG="../remote_nginx.conf"
PUBLIC_URL="https://api.ccdw.life/celestia-trace/v1"
SSH_OPTS=(-i "$PEM_KEY" -o BatchMode=yes -o StrictHostKeyChecking=accept-new)

if [[ ! -f "$PEM_KEY" ]]; then
  echo "SSH key not found: $PEM_KEY" >&2
  exit 1
fi
if [[ ! -f "$PROXY_CONFIG" ]]; then
  echo "Nginx config not found: $PROXY_CONFIG" >&2
  exit 1
fi

chmod 400 "$PEM_KEY"
ssh "${SSH_OPTS[@]}" "$SSH_USER@$SERVER_IP" "mkdir -p '$REMOTE_DIR'"

rsync -avz --delete \
  --exclude '.git' \
  --exclude '.env' \
  --exclude 'vendor' \
  -e "ssh -i $PEM_KEY -o BatchMode=yes -o StrictHostKeyChecking=accept-new" \
  ./ "$SSH_USER@$SERVER_IP:$REMOTE_DIR/"

scp "${SSH_OPTS[@]}" "$PROXY_CONFIG" "$SSH_USER@$SERVER_IP:$PROXY_DIR/nginx.conf.next"

ssh "${SSH_OPTS[@]}" "$SSH_USER@$SERVER_IP" << REMOTE_CMDS
set -Eeuo pipefail
cd "$REMOTE_DIR"

if [[ ! -f .env ]]; then
  echo "Missing $REMOTE_DIR/.env; refusing to deploy with template secrets" >&2
  exit 1
fi
chmod 600 .env

docker compose -p "$COMPOSE_PROJECT" config --quiet
docker compose -p "$COMPOSE_PROJECT" up -d --build --no-deps backend

for attempt in \$(seq 1 30); do
  health=\$(docker inspect -f '{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}' celestia-backend)
  if [[ "\$health" == "healthy" ]]; then
    docker compose -p "$COMPOSE_PROJECT" ps backend
    exit 0
  fi
  if [[ "\$health" == "unhealthy" || "\$health" == "exited" ]]; then
    docker logs --tail 100 celestia-backend
    exit 1
  fi
  sleep 2
done

echo "Backend health check timed out" >&2
docker logs --tail 100 celestia-backend
exit 1
REMOTE_CMDS

ssh "${SSH_OPTS[@]}" "$SSH_USER@$SERVER_IP" << REMOTE_CMDS
set -Eeuo pipefail
cd "$PROXY_DIR"

docker run --rm \
  --network meishi_ccdw_life_default \
  -v "$PROXY_DIR/nginx.conf.next:/etc/nginx/nginx.conf:ro" \
  -v /etc/letsencrypt:/etc/letsencrypt:ro \
  docker.m.daocloud.io/library/nginx:alpine nginx -t

cp nginx.conf.next nginx.conf
chmod 644 nginx.conf
rm -f nginx.conf.next
docker exec meishi_ccdw_life-proxy-1 nginx -s reload
REMOTE_CMDS

echo "Backend deployed: $PUBLIC_URL"