name: Deploy Coolify to VPS

on:
  push:
    branches:
      - main
      - master

jobs:
  deploy:
    runs-on: ubuntu-latest

    env:
      # Inject secrets directly into Terraform via TF_VAR_ environment variables
      TF_VAR_ovh_endpoint: "ovh-eu"
      TF_VAR_ovh_application_key: ${{ secrets.OVH_APPLICATION_KEY }}
      TF_VAR_ovh_application_secret: ${{ secrets.OVH_APPLICATION_SECRET }}
      TF_VAR_ovh_consumer_key: ${{ secrets.OVH_CONSUMER_KEY }}
      TF_VAR_ovh_service_name: ${{ secrets.OVH_SERVICE_NAME }}
      TF_VAR_ssh_public_key: ${{ secrets.SSH_PUBLIC_KEY }}

    steps:
      - name: Checkout Code
        uses: actions/checkout@v3

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: "1.5.0"

      - name: Terraform Init
        run: |
          terraform init \
            -backend-config="address=${{ github.server_url }}/api/v1/packages/${{ github.repository_owner }}/terraform/state/coolify" \
            -backend-config="username=${{ github.actor }}" \
            -backend-config="password=${{ secrets.GITHUB_TOKEN }}"
        working-directory: terraform

      - name: Terraform Plan
        run: terraform plan
        working-directory: terraform

      - name: Terraform Apply
        run: terraform apply -auto-approve
        working-directory: terraform

      - name: Install Ansible
        run: |
          sudo apt-get update
          sudo apt-get install -y ansible

      - name: Configure SSH Private Key
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_rsa
          chmod 600 ~/.ssh/id_rsa

      - name: Run Ansible Playbook
        run: |
          ansible-playbook playbook.yml --private-key ~/.ssh/id_rsa
        working-directory: ansible