deploy.yml

name: Test, Format, Build, Push to GHCR, and Deploy to VPS

on:
  push:
    branches:
      - "master"

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  APP_IMAGE_NAME: ${{ github.repository_owner }}/bocal-smtpd
  CERT_FETCHER_IMAGE_NAME: ${{ github.repository_owner }}/bocal-cert-fetcher

permissions:
  contents: read

jobs:
  lint_and_test:
    name: Lint and Test
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: "1.24.2"

      - name: Set up golangci-lint
        uses: golangci/golangci-lint-action@v8

      - name: Run Tests
        run: make bootstrap-tests

  build_and_push_images:
    name: Build and Push Docker Images
    runs-on: ubuntu-latest
    needs: lint_and_test
    permissions:
      contents: read
      packages: write
    outputs:
      app_image_tag: ${{ steps.push_app.outputs.digest }}
      cert_fetcher_image_tag: ${{ steps.push_cert_fetcher.outputs.digest }}
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and Push bocal-smtpd Image
        id: push_app
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./Dockerfile
          target: prod
          push: true
          tags: ghcr.io/${{ env.APP_IMAGE_NAME }}:latest, ghcr.io/${{ env.APP_IMAGE_NAME }}:${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Build and Push cert-fetcher Image
        id: push_cert_fetcher
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile.cert-fetcher
          push: true
          tags: ghcr.io/${{ env.CERT_FETCHER_IMAGE_NAME }}:latest, ghcr.io/${{ env.CERT_FETCHER_IMAGE_NAME }}:${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  deploy_to_vps:
    name: Deploy to VPS
    runs-on: ubuntu-latest
    needs: build_and_push_images
    environment: production
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Create .env file
        # Pass secrets.
        # https://docs.github.com/en/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions#example-using-bash
        env:
          BWS_ACCESS_TOKEN: ${{ secrets.BWS_ACCESS_TOKEN }}
          BWS_PROJECT_ID: ${{ secrets.BWS_PROJECT_ID }}
          BWS_PRIVATEKEY_ID: ${{ secrets.BWS_PRIVATEKEY_ID }}
          BWS_FULLCHAIN_ID: ${{ secrets.BWS_FULLCHAIN_ID }}
          DATABASE_URL: ${{ secrets.DATABASE_URL }}
        run: |
          mkdir ../vps-deploy-files
          touch ../vps-deploy-files/.env

          # Create .env file.
          cat <<EOF > ../vps-deploy-files/.env
          BWS_ACCESS_TOKEN=$BWS_ACCESS_TOKEN
          BWS_PROJECT_ID=$BWS_PROJECT_ID
          BWS_PRIVATEKEY_ID=$BWS_PRIVATEKEY_ID
          BWS_FULLCHAIN_ID=$BWS_FULLCHAIN_ID
          DATABASE_URL=$DATABASE_URL
          APP_IMAGE_WITH_TAG=ghcr.io/${{ env.APP_IMAGE_NAME }}@${{ needs.build_and_push_images.outputs.app_image_tag }}
          CERT_FETCHER_IMAGE_WITH_TAG=ghcr.io/${{ env.CERT_FETCHER_IMAGE_NAME }}@${{ needs.build_and_push_images.outputs.cert_fetcher_image_tag }}
          EOF

          cp docker-compose.prod.yml ../vps-deploy-files/
          cp cert-fetcher.sh ../vps-deploy-files/
          cp haproxy.prod.cfg ../vps-deploy-files/

          tar -cvf vps-deploy-files.tar ../vps-deploy-files/

      - name: Copy files to VPS
        uses: appleboy/scp-action@v1.0.0
        with:
          host: ${{ secrets.SSH_HOST }}
          username: ${{ secrets.SSH_USERNAME }}
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          port: ${{ secrets.SSH_PORT }}
          passphrase: ${{ secrets.SSH_PASSPHRASE }}
          source: "vps-deploy-files.tar"
          target: "/tmp"
          overwrite: true

      - name: Extract archive and run deployment on VPS
        uses: appleboy/ssh-action@v1.2.2
        with:
          host: ${{ secrets.SSH_HOST }}
          username: ${{ secrets.SSH_USERNAME }}
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          port: ${{ secrets.SSH_PORT }}
          passphrase: ${{ secrets.SSH_PASSPHRASE }}
          script: |
            set -e # Exit on any error
            APP_DIR="/opt/bocal-smtpd"
            ARCHIVE_PATH="/tmp/vps-deploy-files.tar"

            echo "Ensuring application directory $APP_DIR exists..."
            sudo mkdir -p "$APP_DIR"

            echo "Extracting deployment archive to $APP_DIR..."
            sudo tar -xvf "$ARCHIVE_PATH" -C "$APP_DIR"
            echo "Archive extracted."

            echo "Setting permissions for cert-fetcher.sh..."
            sudo chmod +x "$APP_DIR/vps-deploy-files/cert-fetcher.sh"

            echo "Cleaning up deployment archive from /tmp..."
            rm "$ARCHIVE_PATH"

            echo "Starting application with Docker Compose in $APP_DIR..."
            cd "$APP_DIR/vps-deploy-files"
            pwd
            # Doesn't work for some reason if it has a custom name, even with '-f' flag (docker compose -f ...)
            sudo mv docker-compose.prod.yml docker-compose.yml
            docker compose down
            docker compose -f docker-compose.yml up -d --force-recreate
            echo "Deployment complete."