name: Deploy to Proxmox LXC

on:
  push:
    branches:
      - main

jobs:
  deploy:
    runs-on: ubuntu-24.04
    steps:
      - name: Configure SSH key
        env:
          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
        run: |
          set -euo pipefail
          mkdir -p ~/.ssh
          chmod 700 ~/.ssh

          # Accept one of these DEPLOY_SSH_KEY formats:
          # 1) Raw private key with real newlines
          # 2) Raw private key with literal \n escapes
          # 3) Base64-encoded private key
          KEY_RAW="$(printf "%s" "$DEPLOY_SSH_KEY" | tr -d '\r')"

          if printf "%s" "$KEY_RAW" | grep -q "BEGIN OPENSSH PRIVATE KEY"; then
            if printf "%s" "$KEY_RAW" | grep -q "\\n"; then
              printf "%b\n" "$KEY_RAW" > ~/.ssh/id_ed25519
            else
              printf "%s\n" "$KEY_RAW" > ~/.ssh/id_ed25519
            fi
          else
            printf "%s" "$KEY_RAW" | base64 -d > ~/.ssh/id_ed25519
          fi

          chmod 600 ~/.ssh/id_ed25519
          ssh-keygen -y -f ~/.ssh/id_ed25519 >/dev/null
          ssh-keyscan -p "${DEPLOY_PORT:-22}" -H "$DEPLOY_HOST" >> ~/.ssh/known_hosts

      - name: Verify deploy SSH connectivity
        env:
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
          DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
        run: |
          set -euo pipefail
          ssh -o BatchMode=yes -o StrictHostKeyChecking=yes \
            -p "${DEPLOY_PORT:-22}" \
            -i ~/.ssh/id_ed25519 \
            "$DEPLOY_USER@$DEPLOY_HOST" "true"

      - name: Deploy latest main
        env:
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
          DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
        run: |
          set -euo pipefail
          ssh -p "${DEPLOY_PORT:-22}" \
            -i ~/.ssh/id_ed25519 \
            "$DEPLOY_USER@$DEPLOY_HOST" \
            "/usr/local/bin/deploy-go-microservices.sh"