infra/.woodpecker/renew-tls.yml

when:
  event: cron
  cron: renew-tls-certificate

clone:
  git:
    image: woodpeckerci/plugin-git
    settings:
      attempts: 5
      backoff: 10s

steps:
  - name: prepare
    image: alpine
    commands:
      - "apk update && apk add jq curl git git-crypt"
      - |
        curl -k https://10.0.20.100:6443/api/v1/namespaces/woodpecker/configmaps/git-crypt-key -H "Authorization:Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" | jq -r .data.key | base64 -d > /tmp/key
      - "git-crypt unlock /tmp/key && rm /tmp/key"

  - name: renew-tls
    image: alpine
    environment:
      TECHNITIUM_API_KEY:
        from_secret: TECHNITIUM_API_KEY
      CLOUDFLARE_TOKEN:
        from_secret: CLOUDFLARE_TOKEN
      CLOUDFLARE_ZONE_ID:
        from_secret: CLOUDFLARE_ZONE_ID
    commands:
      - "apk update && apk add certbot curl jq"
      - "./modules/kubernetes/setup_tls_secret/renew2.sh"

  - name: commit-certs
    image: alpine
    commands:
      - "apk update && apk add openssh-client git git-crypt"
      - "mkdir -p ~/.ssh && ssh-keyscan -H github.com >> ~/.ssh/known_hosts"
      - "chmod 400 secrets/deploy_key"
      # Only add specific paths — never git add .
      - "git add secrets/ state/ || true"
      - "git remote set-url origin git@github.com:ViktorBarzin/infra.git"
      - "git commit -m 'Woodpecker CI Update TLS Certificates Commit' || echo 'No changes'"
      - "GIT_SSH_COMMAND='ssh -i ./secrets/deploy_key -o IdentitiesOnly=yes' git pull --rebase origin master"
      - "GIT_SSH_COMMAND='ssh -i ./secrets/deploy_key -o IdentitiesOnly=yes' git push origin master"

  - name: verify-cert
    image: alpine
    commands:
      - "apk update && apk add openssl"
      - "openssl x509 -checkend 604800 -noout -in secrets/fullchain.pem"
      - "echo 'Certificate is valid for at least 7 more days'"

  - name: update-tls-source-secret
    image: alpine
    commands:
      - "apk update && apk add curl"
      - "curl -LO https://dl.k8s.io/release/v1.31.0/bin/linux/amd64/kubectl && chmod +x kubectl && mv kubectl /usr/local/bin/"
      - |
        SECRET_YAML=$(kubectl create secret tls tls-secret \
          --cert=secrets/fullchain.pem --key=secrets/privkey.pem \
          --namespace=placeholder --dry-run=client -o yaml)
        for ns in $(kubectl get ns -o jsonpath='{.items[*].metadata.name}' | tr ' ' '\n' | grep -v '^kube-'); do
          echo "$SECRET_YAML" | sed "s/namespace: placeholder/namespace: $ns/" | kubectl apply -f - 2>/dev/null || true
        done
      - "echo 'TLS secret updated in all namespaces'"

  - name: slack
    image: curlimages/curl
    commands:
      - |
        curl -s -X POST -H 'Content-type: application/json' \
          --data "{\"channel\":\"general\",\"text\":\"Woodpecker CI: TLS certificate renewal ${CI_PIPELINE_STATUS}\"}" \
          "$SLACK_WEBHOOK" || true
    environment:
      SLACK_WEBHOOK:
        from_secret: slack_webhook
    when:
      status: [success, failure]