#!/usr/bin/env bash
GITEA_URL='ssh://git@git.gharbeia.net:2222/amr/infrastructure.git'
REPO_DIR="${1:-/docker/compose/infrastructure}"
ORG_FILE="${REPO_DIR}/infrastructure.org"
if [ -z "${1:-}" ]; then
  if [ ! -d "$REPO_DIR" ]; then
    git clone "$GITEA_URL" "$REPO_DIR"
  else
    cd "$REPO_DIR" && git pull
  fi
fi
if [ ! -f "$ORG_FILE" ]; then
  echo "ERROR: $ORG_FILE not found in $REPO_DIR"
  exit 1
fi
echo "=== Tangling $ORG_FILE ==="
emacs --batch -Q --load /usr/share/emacs/28.2/lisp/org/org-loaddefs.el \
  --eval "(require 'org)" \
  --eval "(org-babel-tangle-file \"$ORG_FILE\")" 2>&1
# Substitute env vars in tangled files
# Read key from .env directly (avoid sourcing due to quoting issues in other vars)
CROWDSEC_LAPI_KEY=$(grep ^CROWDSEC_LAPI_KEY /docker/compose/.env | cut -d= -f2-)
if [ -z "$CROWDSEC_LAPI_KEY" ] || [ "$CROWDSEC_LAPI_KEY" = "__CROWDSEC_LAPI_KEY__" ]; then
  echo "ERROR: CROWDSEC_LAPI_KEY not set or still a placeholder in .env!"
  exit 1
fi
sed -i "s|__CROWDSEC_LAPI_KEY__|${CROWDSEC_LAPI_KEY}|g" /docker/appdata/traefik/dynamic.yaml
echo "=== Restarting services ==="
cd /docker/compose
if [ -f /docker/appdata/traefik/traefik.yaml ] || \
   [ -f /docker/appdata/traefik/internal.yaml ] || \
   [ -f /docker/appdata/traefik/internal-noauth.yaml ] || \
   [ -f /docker/appdata/traefik/dynamic.yaml ]; then
  echo 'Traefik config changed -- restarting...'
  docker compose up -d traefik
  # Verify CrowdSec bouncer is working after restart
  sleep 2
  STATUS=$(docker exec traefik wget -q -O /dev/null -S http://traefik:8081/application/o/authorize/ --header="Host: auth.gharbeia.net" 2>&1 | head -1 | awk '{print $2}')
  if [ "$STATUS" = "403" ]; then
    echo "WARNING: auth.gharbeia.net still returns 403 after deploy!"
    echo "  CrowdSec bouncer may have a bad API key."
    echo "  Run: docker exec crowdsec cscli bouncers add traefik-bouncer"
    echo "  Then update CROWDSEC_LAPI_KEY in /docker/compose/.env and re-deploy."
  else
    echo "OK: auth.gharbeia.net returns $STATUS (expected: 400)"
  fi
fi
if [ -f /docker/compose/docker-compose.yaml ]; then
  echo 'Docker compose changed -- restarting all services'
  docker compose up -d 2>&1 | tail -5
fi
echo '=== Deploy complete ==='