when:
  event: push
  branch: master
  # Only trigger when application stack files change
  path:
    include:
      - 'stacks/**'
    exclude:
      - '.woodpecker/**'

clone:
  git:
    image: woodpeckerci/plugin-git
    settings:
      attempts: 5
      backoff: 10s

steps:
  - name: detect-changes
    image: alpine
    commands:
      - apk add --no-cache git
      # Detect which stacks changed in the latest commit
      - |
        CHANGED=$(git diff --name-only HEAD~1 HEAD 2>/dev/null | grep '^stacks/' | cut -d/ -f2 | sort -u || true)
        if [ -z "$CHANGED" ]; then
          echo "No stack changes detected"
          echo "" > .stacks_to_apply
          exit 0
        fi
        # Exclude platform stacks (handled by default.yml)
        PLATFORM="dbaas authentik crowdsec monitoring nvidia mailserver cloudflared kyverno metallb redis traefik technitium headscale rbac k8s-portal vaultwarden reverse-proxy metrics-server vpa nfs-csi iscsi-csi cnpg sealed-secrets uptime-kuma wireguard xray infra-maintenance platform vault reloader descheduler external-secrets"
        APPLY=""
        for stack in $CHANGED; do
          if echo "$PLATFORM" | grep -qw "$stack"; then
            echo "Skipping platform stack: $stack"
            continue
          fi
          if [ ! -f "stacks/$stack/terragrunt.hcl" ]; then
            echo "Skipping $stack (no terragrunt.hcl)"
            continue
          fi
          APPLY="$APPLY $stack"
        done
        echo "$APPLY" > .stacks_to_apply
        echo "Stacks to apply:$APPLY"

  - name: prepare
    image: alpine
    commands:
      - "apk update && apk add jq curl git git-crypt"
      - |
        curl -k https://10.0.20.100:6443/api/v1/namespaces/woodpecker/configmaps/git-crypt-key -H "Authorization:Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" | jq -r .data.key | base64 -d > /tmp/key
      - "git-crypt unlock /tmp/key && rm /tmp/key"
      - |
        SA_TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
        VAULT_TOKEN=$(curl -s -X POST http://vault-active.vault.svc.cluster.local:8200/v1/auth/kubernetes/login \
          -d "{\"role\":\"ci\",\"jwt\":\"$SA_TOKEN\"}" | jq -r .auth.client_token)
        echo "export VAULT_TOKEN=$VAULT_TOKEN" > .vault-env
        echo "export VAULT_ADDR=http://vault-active.vault.svc.cluster.local:8200" >> .vault-env
    when:
      evaluate: 'CI_COMMIT_MESSAGE != "" && !contains(CI_COMMIT_MESSAGE, "[CI SKIP]")'

  - name: terragrunt-apply
    image: alpine
    backend_options:
      kubernetes:
        resources:
          requests:
            memory: 2Gi
          limits:
            memory: 4Gi
    commands:
      - "apk update && apk add curl unzip git openssh-client"
      - "wget -qO /tmp/terraform.zip https://releases.hashicorp.com/terraform/1.5.7/terraform_1.5.7_linux_amd64.zip"
      - "unzip -o /tmp/terraform.zip -d /usr/local/bin/ && chmod 755 /usr/local/bin/terraform"
      - "wget -qO /usr/local/bin/terragrunt https://github.com/gruntwork-io/terragrunt/releases/download/v0.99.4/terragrunt_linux_amd64"
      - "chmod 755 /usr/local/bin/terragrunt"
      - "source .vault-env"
      - |
        STACKS=$(cat .stacks_to_apply)
        if [ -z "$STACKS" ]; then
          echo "No app stacks to apply"
          exit 0
        fi
        FAILED=""
        for stack in $STACKS; do
          echo "=== Applying: $stack ==="
          (cd stacks/$stack && terragrunt apply --non-interactive -auto-approve) &
        done
        wait
    when:
      evaluate: 'CI_COMMIT_MESSAGE != "" && !contains(CI_COMMIT_MESSAGE, "[CI SKIP]")'

  - name: cleanup-and-push
    image: alpine
    commands:
      - "rm -f .vault-env"
      - "apk update && apk add openssh-client git git-crypt"
      - "mkdir -p ~/.ssh && ssh-keyscan -H github.com >> ~/.ssh/known_hosts"
      - "chmod 400 secrets/deploy_key"
      - "git add stacks/ state/ .woodpecker/ || true"
      - "git remote set-url origin git@github.com:ViktorBarzin/infra.git"
      - "git commit -m 'Woodpecker CI app-stacks deploy commit [CI SKIP]' || echo 'No changes'"
      - "GIT_SSH_COMMAND='ssh -i ./secrets/deploy_key -o IdentitiesOnly=yes' git pull --rebase origin master || true"
      - "GIT_SSH_COMMAND='ssh -i ./secrets/deploy_key -o IdentitiesOnly=yes' git push origin master"
    when:
      status: [success, failure]

  - name: slack
    image: curlimages/curl
    commands:
      - |
        STACKS=$(cat .stacks_to_apply 2>/dev/null || echo "none")
        curl -s -X POST -H 'Content-type: application/json' \
          --data "{\"channel\":\"general\",\"text\":\"Woodpecker CI: app-stacks pipeline ${CI_PIPELINE_STATUS} (stacks:${STACKS})\"}" \
          "$SLACK_WEBHOOK" || true
    environment:
      SLACK_WEBHOOK:
        from_secret: slack_webhook
    when:
      status: [success, failure]