name: deploy
on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: nix
    steps:
      - uses: actions/checkout@v4

      - name: Setup deploy SSH key
        run: |
          mkdir -p ~/.ssh
          install -m 600 /dev/stdin ~/.ssh/id_ed25519 <<< "${{ secrets.DEPLOY_SSH_KEY }}"
          ssh-keyscan -H db-host.gebos.internal app-host.gebos.internal ingest.ge-bos.de >> ~/.ssh/known_hosts 2>/dev/null || true

      - name: Build all closures
        run: nix flake check --no-build

      # Order matters: db schema migrations are part of db-host's activation,
      # so it must land first. App-host's Supabase compose stack expects the
      # schemas to exist. mqtt-ingest only needs the network paths to db-host.
      - name: Deploy db-host
        run: nix run github:serokell/deploy-rs -- .#db-host --skip-checks

      - name: Deploy app-host
        run: nix run github:serokell/deploy-rs -- .#app-host --skip-checks

      - name: Deploy mqtt-ingest
        run: nix run github:serokell/deploy-rs -- .#mqtt-ingest --skip-checks