# Auto-deploy the landing site (tane.comunes.org) on push to main.
#
# Replicates `ansible-playbook tane-landing.yml`: rsync site/ to groucho and
# rebuild the Hugo->nginx container there. The runner (aaron) and groucho are on
# the same internal subnet (10.20.20.x), so it deploys over direct SSH.
#
# Derived content (legal pages, screenshots) is still regenerated by hand and
# committed — same as before; see site/DEPLOY.md. This workflow only ships what
# is already in the repo.
#
# One-time setup (see site/DEPLOY.md):
#   - Generate a deploy keypair; add the PUBLIC key to groucho:/root/.ssh/authorized_keys.
#   - Store the PRIVATE key as the Forgejo repo secret GROUCHO_DEPLOY_KEY.

name: site

# BLOCKED (2026-07-16): the runner (aaron) cannot open an SSH data connection to
# groucho. aaron's direct iface to groucho's subnet (ens18, 10.20.20.x) is down,
# so aaron routes to groucho via ada (10.0.0.2) and the groucho->aaron data path
# drops packets (TCP connects + ICMP ok, but the SSH banner never returns; proven:
# aaron->ada:22 gets a banner, aaron->groucho:22 does not). Not MTU/fail2ban/DNS.
# Until aaron<->groucho networking is fixed, deploy the site from a machine that
# reaches groucho via ada:  `ansible-playbook -i comunes_inventory.ini tane-landing.yml`
# (see site/DEPLOY.md). Trigger left manual-only so it stops failing on every push.
on:
  workflow_dispatch:

concurrency:
  group: site-deploy
  cancel-in-progress: false

env:
  GROUCHO_HOST: "10.20.20.116"
  SITE_DEST: "/data/tane-landing/src/"

jobs:
  deploy:
    runs-on: docker
    container:
      image: debian:bookworm-slim
    steps:
      - name: Install tools
        run: apt-get update -qq && apt-get install -y -qq git rsync openssh-client curl

      - name: Checkout (manual git, Node-free)
        env:
          TOKEN: ${{ github.token }}
        run: |
          git config --global --add safe.directory '*'
          git init -q .
          git remote add origin "http://x-access-token:${TOKEN}@forgejo:3000/${GITHUB_REPOSITORY}.git"
          git fetch -q --depth 1 origin "${GITHUB_SHA}"
          git checkout -q FETCH_HEAD

      - name: Configure SSH deploy key
        env:
          GROUCHO_DEPLOY_KEY: ${{ secrets.GROUCHO_DEPLOY_KEY }}
        run: |
          mkdir -p ~/.ssh && chmod 700 ~/.ssh
          printf '%s\n' "$GROUCHO_DEPLOY_KEY" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          ssh-keyscan -H "$GROUCHO_HOST" >> ~/.ssh/known_hosts 2>/dev/null

      - name: Sync site source to groucho
        run: |
          rsync -az --delete \
            --exclude=public --exclude=resources --exclude=.hugo_build.lock \
            site/ "root@${GROUCHO_HOST}:${SITE_DEST}"

      - name: Rebuild the Hugo -> nginx container on groucho
        run: |
          ssh "root@${GROUCHO_HOST}" 'cd /data/tane-landing && docker compose up -d --build'

      - name: Verify
        run: curl -sI https://tane.comunes.org/ | head -1