name: Deploy (on merge)

on:
  push:
    branches:
      - main
    paths-ignore:
      - 'terraform/**'

# Requires these repository secrets:
#   TAILSCALE_AUTHKEY  — Tailscale auth key for mesh access
#   SSH_PRIVATE_KEY    — SSH key authorized on target hosts
#   AGE_SECRET_KEY     — age private key for SOPS decryption

jobs:
  deploy:
    name: Deploy to all
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: actions/checkout@v4

      - name: Set up Tailscale
        uses: tailscale/github-action@v3
        with:
          authkey: ${{ secrets.TAILSCALE_AUTHKEY }}

      - name: Set up SSH key
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          ssh-keyscan -H 100.67.6.27 100.84.65.101 100.122.219.41 100.117.235.28 100.89.206.60 100.115.45.53 >> ~/.ssh/known_hosts 2>/dev/null || true

      - name: Install tools
        run: |
          pip install ansible
          wget -qO /tmp/sops.deb https://github.com/getsops/sops/releases/download/v3.9.4/sops_3.9.4_amd64.deb
          sudo dpkg -i /tmp/sops.deb

      - name: Decrypt secrets
        env:
          SOPS_AGE_KEY: ${{ secrets.AGE_SECRET_KEY }}
        run: |
          # Decrypt all .enc. files to their plaintext counterparts
          find . -name '*.enc.yml' -o -name '*.enc.yaml' -o -name '*.enc.env' | while read f; do
            out="${f/.enc/}"
            sops -d "$f" > "$out"
            echo "Decrypted: $f -> $out"
          done

      - name: Run playbook
        working-directory: ansible/
        env:
          ANSIBLE_HOST_KEY_CHECKING: "false"
        run: ansible-playbook deploy.yml