CI/CD nach Hetzner

name: deploy
on:
  push:
    branches: [ main ]
    tags: [ 'v*' ]

concurrency:
  group: deploy-prod
  cancel-in-progress: false      # Deploys nicht mittendrin abbrechen

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write             # fuer den Push nach GHCR
    outputs:
      tag: ${{ steps.meta.outputs.version }}
    steps:
      - uses: actions/checkout@v4

      - uses: docker/setup-buildx-action@v3

      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}   # automatisch, kein eigenes Secret

      - id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/nursude/app
          tags: |
            type=sha,format=long
            type=raw,value=latest,enable={{is_default_branch}}
            type=semver,pattern={{version}}

      - uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

# compose.yaml -- Image-Tag kommt aus .env
services:
  app:
    image: ghcr.io/nursude/app:${APP_TAG:-latest}
    restart: unless-stopped
    env_file: [ app.env ]
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:8080/health"]
      interval: 10s
      retries: 6
    networks: [ web ]
networks: { web: { name: web, external: true } }

  deploy:
    needs: build
    runs-on: ubuntu-latest
    environment: production        # -> Freigabe + Environment-Secrets
    steps:
      - name: SSH-Key einrichten
        run: |
          install -m700 -d ~/.ssh
          printf '%s\n' "${{ secrets.SSH_KEY }}"        > ~/.ssh/id_ed25519
          printf '%s\n' "${{ secrets.SSH_KNOWN_HOSTS }}" > ~/.ssh/known_hosts
          chmod 600 ~/.ssh/id_ed25519

      - name: Deploy
        run: |
          ssh deploy@projekthost bash -s <<'EOF'
            set -euo pipefail
            cd /opt/stacks/app
            echo "APP_TAG=sha-${{ github.sha }}" > .env
            docker compose pull
            docker compose up -d --remove-orphans
            # auf "healthy" warten, sonst Fehler
            for i in $(seq 1 30); do
              s=$(docker inspect -f '{{.State.Health.Status}}' app-app-1 2>/dev/null || echo none)
              [ "$s" = healthy ] && exit 0
              sleep 2
            done
            echo "nicht healthy geworden"; docker compose logs --tail 50 app; exit 1
          EOF

      - name: alte Images aufraeumen
        run: ssh deploy@projekthost 'docker image prune -f --filter "until=168h"'

      - uses: tailscale/github-action@v3
        with:
          oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
          oauth-secret: ${{ secrets.TS_OAUTH_SECRET }}
          tags: tag:ci
          # der Runner ist danach als ephemeral Node im Tailnet, weg nach dem Job

      - run: ssh deploy@projekthost.tailXXXX.ts.net 'cd /opt/stacks/app && docker compose pull && docker compose up -d'

jobs:
  build-deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: 22, cache: npm }
      - run: npm ci && npm run build     # -> ./dist

      # Variante A: Cloudflare Pages
      - uses: cloudflare/wrangler-action@v3
        with:
          apiToken: ${{ secrets.CF_API_TOKEN }}
          accountId: ${{ secrets.CF_ACCOUNT_ID }}
          command: pages deploy dist --project-name=nursude/app

      # Variante B: rsync auf den nginx-Server (via Tailscale wie oben)
      # - run: rsync -az --delete dist/ deploy@projekthost:/opt/sites/blog/

      - name: Migrationen
        run: |
          ssh deploy@projekthost bash -s <<'EOF'
            set -e
            docker run --rm --network web --env-file /opt/stacks/app/app.env \
              ghcr.io/nursude/app:sha-${{ github.sha }} \
              /app/bin/migrate up
          EOF

name: deploy
on: { push: { branches: [ main ], tags: [ 'v*' ] } }
concurrency: { group: deploy-prod, cancel-in-progress: false }

jobs:
  build:
    runs-on: ubuntu-latest
    permissions: { contents: read, packages: write }
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-buildx-action@v3
      - uses: docker/login-action@v3
        with: { registry: ghcr.io, username: '${{ github.actor }}', password: '${{ secrets.GITHUB_TOKEN }}' }
      - uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: ghcr.io/nursude/app:sha-${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  deploy:
    needs: build
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: tailscale/github-action@v3
        with:
          oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
          oauth-secret: ${{ secrets.TS_OAUTH_SECRET }}
          tags: tag:ci
      - run: |
          install -m700 -d ~/.ssh
          printf '%s\n' "${{ secrets.SSH_KEY }}"        > ~/.ssh/id_ed25519 && chmod 600 ~/.ssh/id_ed25519
          printf '%s\n' "${{ secrets.SSH_KNOWN_HOSTS }}" > ~/.ssh/known_hosts
      - run: |
          ssh deploy@projekthost.tailXXXX.ts.net bash -s <<'EOF'
            set -euo pipefail
            cd /opt/stacks/app
            docker run --rm --network web --env-file app.env ghcr.io/nursude/app:sha-${{ github.sha }} /app/bin/migrate up
            echo "APP_TAG=sha-${{ github.sha }}" > .env
            docker compose pull && docker compose up -d --remove-orphans
            for i in $(seq 1 30); do [ "$(docker inspect -f '{{.State.Health.Status}}' app-app-1)" = healthy ] && exit 0; sleep 2; done
            docker compose logs --tail 50 app; exit 1
          EOF

services:
  runner:
    image: ghcr.io/actions/actions-runner:latest
    restart: unless-stopped
    environment:
      - REPO_URL=https://github.com/nursude/app
    volumes: [ /var/run/docker.sock:/var/run/docker.sock ]
    # Registrierung per --ephemeral Token; nach jedem Job frisch

      - uses: tailscale/github-action@v3
        with: { oauth-client-id: '${{ secrets.TS_OAUTH_CLIENT_ID }}', oauth-secret: '${{ secrets.TS_OAUTH_SECRET }}', tags: tag:ci }
      - run: |
          echo "${{ secrets.KUBECONFIG_B64 }}" | base64 -d > kc.yaml
          export KUBECONFIG=kc.yaml
          helm upgrade --install app ./chart -n app \
            --set image.tag=sha-${{ github.sha }} --wait --timeout 5m
          kubectl -n app rollout status deploy/app

services:
  jenkins:
    image: jenkins/jenkins:2.492-lts-jdk21
    restart: unless-stopped
    user: root                       # fuer Zugriff auf docker.sock
    environment:
      JAVA_OPTS: -Djenkins.install.runSetupWizard=false
      CASC_JENKINS_CONFIG: /var/jenkins_conf/jenkins.yaml
    volumes:
      - jenkins:/var/jenkins_home
      - ./jenkins.yaml:/var/jenkins_conf/jenkins.yaml:ro
      - /var/run/docker.sock:/var/run/docker.sock
    networks: [ web ]
volumes: { jenkins: {} }
networks: { web: { name: web, external: true } }

pipeline {
  agent any
  options { disableConcurrentBuilds() }        # wie "concurrency" bei Actions
  environment {
    IMAGE = "ghcr.io/nursude/app"
    TAG   = "sha-${GIT_COMMIT}"
  }
  stages {
    stage('Build & Push') {
      steps {
        withCredentials([usernamePassword(credentialsId: 'ghcr',
                          usernameVariable: 'U', passwordVariable: 'P')]) {
          sh '''
            echo "$P" | docker login ghcr.io -u "$U" --password-stdin
            docker build -t "$IMAGE:$TAG" .
            docker push "$IMAGE:$TAG"
          '''
        }
      }
    }
    stage('Deploy') {
      when { branch 'main' }
      steps {
        withCredentials([sshUserPrivateKey(credentialsId: 'deploy-ssh', keyFileVariable: 'KEY')]) {
          sh '''
            ssh -i "$KEY" -o StrictHostKeyChecking=accept-new \
              deploy@projekthost.tailXXXX.ts.net bash -s << EOF
              set -euo pipefail
              cd /opt/stacks/app
              docker run --rm --network web --env-file app.env "$IMAGE:$TAG" /app/bin/migrate up
              echo "APP_TAG=$TAG" > .env
              docker compose pull && docker compose up -d --remove-orphans
EOF
          '''
        }
      }
    }
  }
  post {
    failure { sh 'curl -fsS -d "Deploy $TAG fehlgeschlagen" ntfy.sh/alerts || true' }
  }
}