#!/usr/bin/env bash
# deploy-server.sh <tag>  —  deploy the backend binary + nginx config to EC2.
# Two modes: uses dist/ built in the same job, or downloads the release assets
# by tag (manual rollback). Does NOT touch the web app, marketing site, or
# version.yaml.
set -euo pipefail

# shellcheck source=scripts/ci/lib-forgejo.sh
. "$(dirname "$0")/lib-forgejo.sh"

TAG="$1"
echo "==> deploy-server: tag=${TAG}"

if [ ! -f dist/jiu-server ] || [ ! -f dist/configs.tar.gz ]; then
  download_release_assets "$TAG"
fi

echo "==> deploy-server: dist/ contents:"
ls -lh dist/

rm -rf /tmp/jiu-configs
mkdir -p /tmp/jiu-configs
tar -xzf dist/configs.tar.gz -C /tmp/jiu-configs

setup_ssh
echo "==> deploy-server: uploading files to EC2"
${SCP} dist/jiu-server "${EC2_USER}@${EC2_HOST}:/tmp/jiu-server"
${SCP} /tmp/jiu-configs/deploy/nginx-jiu.conf "${EC2_USER}@${EC2_HOST}:/tmp/nginx-jiu.conf"

# Platform code-minting CLI + wrapper (absent when rolling back to a pre-gencode
# release — upload only when present).
if [ -f dist/jiu-gencode ]; then
  ${SCP} dist/jiu-gencode "${EC2_USER}@${EC2_HOST}:/tmp/jiu-gencode"
  ${SCP} /tmp/jiu-configs/deploy/jiu-gencode.sh "${EC2_USER}@${EC2_HOST}:/tmp/jiu-gencode.sh"
fi

${SSH} "${EC2_USER}@${EC2_HOST}" << 'ENDSSH'
set -e

# Replace backend binary
sudo systemctl stop jiu
cp /tmp/jiu-server /opt/jiu/backend/jiu-server
chmod +x /opt/jiu/backend/jiu-server

# Refresh the code-minting CLI if shipped in this release (skip gracefully on
# rollback to a pre-gencode release). Not a service — just a host-side binary.
if [ -f /tmp/jiu-gencode ]; then
  cp /tmp/jiu-gencode /opt/jiu/backend/jiu-gencode
  chmod +x /opt/jiu/backend/jiu-gencode
  if [ -f /tmp/jiu-gencode.sh ]; then
    cp /tmp/jiu-gencode.sh /opt/jiu/backend/jiu-gencode.sh
    chmod +x /opt/jiu/backend/jiu-gencode.sh
  fi
fi

# Start and health check
sudo systemctl start jiu
echo "Waiting for health check..."
for i in $(seq 1 30); do
  if curl -f http://localhost:8080/health > /dev/null 2>&1; then
    echo "Health check passed"
    break
  fi
  sleep 2
done
curl -f http://localhost:8080/health > /dev/null || { echo "Health check failed!"; exit 1; }

# Update jiu nginx config in the pangolin-edge reverse proxy (host-bind-mounted
# conf.d; reload nginx inside the container).
cp /tmp/nginx-jiu.conf /home/ec2-user/pangolin/edge/conf.d/jiu.conf
docker exec pangolin-edge nginx -t && docker exec pangolin-edge nginx -s reload

echo "Server deploy complete!"
ENDSSH

teardown_ssh
rm -rf /tmp/jiu-configs
echo "==> deploy-server: done"