name: deploy
on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: nixos
    steps:
      - uses: actions/checkout@v4

      - name: Setup deploy SSH key
        run: |
          mkdir -p ~/.ssh
          # Dedicated key file so we never overwrite the runner user's own key.
          install -m 600 /dev/stdin ~/.ssh/gebos_deploy <<< "${{ secrets.DEPLOY_SSH_KEY }}"
          ssh-keyscan -H db.gebos.online app.gebos.online ingest.gebos.online >> ~/.ssh/known_hosts 2>/dev/null || true
          # The gitea-runner is a systemd DynamicUser whose passwd home is `/`,
          # so ssh expands `~` to `/.ssh/...` rather than $HOME. deploy-rs passes
          # ssh opts with no shell, so it can't expand $HOME itself. Build the
          # absolute paths here (bash expands $HOME) and hand them to deploy-rs
          # via --ssh-opts; they append to nix/deploy.nix's path-free sshOpts.
          echo "DEPLOY_SSH_OPTS=-i $HOME/.ssh/gebos_deploy -o UserKnownHostsFile=$HOME/.ssh/known_hosts" >> "$GITHUB_ENV"

      - name: Build all closures
        run: nix flake check --no-build

      # Order matters: db schema migrations are part of db-host's activation,
      # so it must land first. App-host's Supabase compose stack expects the
      # schemas to exist. mqtt-ingest only needs the network paths to db-host.
      - name: Deploy db-host
        run: nix run github:serokell/deploy-rs -- --ssh-opts "$DEPLOY_SSH_OPTS" .#db-host --skip-checks

      - name: Deploy app-host
        run: nix run github:serokell/deploy-rs -- --ssh-opts "$DEPLOY_SSH_OPTS" .#app-host --skip-checks

      - name: Deploy mqtt-ingest
        run: nix run github:serokell/deploy-rs -- --ssh-opts "$DEPLOY_SSH_OPTS" .#mqtt-ingest --skip-checks