.gitlab-ci.yml

variables:
  DOCKER_BUILDKIT: 1
  DOCKER_IMAGE: docker:26
  IMAGE_SSH_CLIENT: kroniak/ssh-client:3.19

stages:
  - build
  - deploy production
  - purge cache production

build-image:
  stage: build
  image: ${DOCKER_IMAGE}
  services:
    - docker:dind
  except:
    - schedules
  before_script:
    - docker version
    - echo ${CI_REGISTRY_PASSWORD} | docker login -u ${CI_REGISTRY_USER} --password-stdin ${CI_REGISTRY}
  script:
    - set -euo pipefail
    # Pull the latest version of the image, in order to populate the build cache:
    - docker pull ${CI_REGISTRY_IMAGE}:compile-stage || true
    - docker pull ${CI_REGISTRY_IMAGE}:latest || true
    # Build the compile stage:
    - "docker buildx build --target compile-image \
        --build-arg BUILDKIT_INLINE_CACHE=1 \
        --platform linux/arm64 \
        --cache-from=${CI_REGISTRY_IMAGE}:compile-stage \
        --tag ${CI_REGISTRY_IMAGE}:compile-stage ."
    # Build the runtime stage, using cached compile stage:
    - "docker buildx build --target runtime-image \
        --build-arg BUILDKIT_INLINE_CACHE=1 \
        --platform linux/arm64 \
        --cache-from=${CI_REGISTRY_IMAGE}:compile-stage \
        --cache-from=${CI_REGISTRY_IMAGE}:latest \
        --tag ${CI_REGISTRY_IMAGE}:${CI_PIPELINE_IID} \
        --tag ${CI_REGISTRY_IMAGE}:latest ."
    # Push the new versions:
    - docker push ${CI_REGISTRY_IMAGE}:${CI_PIPELINE_IID}
    - docker push ${CI_REGISTRY_IMAGE}:compile-stage
    - docker push ${CI_REGISTRY_IMAGE}:latest

.deploy:
  image: ${IMAGE_SSH_CLIENT}
  except:
    - schedules
  variables:
    IMAGE: ${CI_REGISTRY_IMAGE}:${CI_PIPELINE_IID}
    DOCKER_RUN: 'docker run --rm
                  -v /var/www/static:/static_root
                  --env-file secrets.env
                  --network hanusnet
                  -e DJANGO_SETTINGS_MODULE="hanusovedni.settings.production"
                  ${CI_REGISTRY_IMAGE}:${CI_PIPELINE_IID}'
  script:
    - mkdir -p ~/.ssh
    - echo "${SSH_PRIVATE_KEY}" > ~/.ssh/id_rsa && chmod 600 ~/.ssh/id_rsa
    - echo -e "Host *\n\tStrictHostKeyChecking no\n\n" > ~/.ssh/config
    - scp -r docker-compose.yml docker-compose.prod.yml Caddyfile $SERVER:~/
    - scp $SECRETS $SERVER:~/secrets.env
    - ssh $SERVER "docker system prune --all --force"
    - ssh $SERVER "sudo mkdir -m 777 /var/www/static || true"
    - ssh $SERVER "sudo mkdir -m 777 /var/www/media || true"
    - ssh $SERVER "sudo mkdir -m 777 /var/www/pgdata || true"
    - ssh $SERVER "sudo mkdir -p -m 777 ~/docker/caddy/data || true"
    - ssh $SERVER "sudo mkdir -p -m 777 ~/docker/caddy/config || true"
    - ssh $SERVER "echo ${CI_REGISTRY_PASSWORD} | docker login -u ${CI_REGISTRY_USER} --password-stdin ${CI_REGISTRY}"
    - ssh $SERVER "docker network create --driver overlay --attachable hanusnet || true"
    - 'ssh $SERVER "WEB_IMAGE=$IMAGE ENVIRONMENT=$CI_ENVIRONMENT_NAME
        docker stack deploy
        -c docker-compose.yml
        -c docker-compose.prod.yml
        --with-registry-auth hd"'
    - ssh $SERVER "$DOCKER_RUN python manage.py collectstatic --no-input"
    - ssh $SERVER "$DOCKER_RUN python manage.py migrate --no-input"
    - echo Waiting for containers to be running and healthy
    - |
      for i in $(seq 60); do
        echo second ${i}
        containers=$(ssh $SERVER "docker ps -f 'status=running' -f 'health=healthy' -f 'name=hd_web' --format '{{.Image}}'")
        echo Current containers: ${containers}
        count=$(echo $containers | tr " " "\n" | grep -c $IMAGE || true)
        echo New healthy containers: ${count}
        if [ "${count}" -gt 1 ]; then
          echo "Container is healthy after ${i} seconds."
          exit 0
        fi
        sleep 1
      done
      echo "Timeout exceeded. Number of new containers: ${count}"
      exit 1

.production:
  environment:
    name: production
    url: https://hanusovedni.sk

deploy:production:
  stage: deploy production
  allow_failure: false
  extends:
    - .deploy
    - .production

.purge-cache:
  image: curlimages/curl:8.6.0
  except:
    - schedules
  script:
    - "http_code=$(curl -X POST \"https://api.cloudflare.com/client/v4/zones/${CLOUDFLARE_ZONEID}/purge_cache\"
        -H \"Authorization: Bearer ${CLOUDFLARE_BEARER_TOKEN}\"
        -H 'Content-Type: application/json'
        --data '{\"purge_everything\":true}'
        -o /tmp/out.txt
        -w '%{http_code}'
        --silent)"
    - echo $http_code && cat /tmp/out.txt && echo
    - if [[ "$http_code" -ne 200 ]] ; then exit 1; else exit 0 ; fi


build-image:on-schedule:
  image: ${DOCKER_IMAGE}
  stage: build
  services:
    - docker:dind
  only:
    - schedules
  before_script:
    - docker version
    - echo ${CI_REGISTRY_PASSWORD} | docker login -u ${CI_REGISTRY_USER} --password-stdin ${CI_REGISTRY}
  script:
    - set -euo pipefail
    # Build compile stage without any cache so new images from docker hub will be used
    - docker build --target compile-image --tag ${CI_REGISTRY_IMAGE}:compile-stage .
    - docker push ${CI_REGISTRY_IMAGE}:compile-stage

.backup-db:
  image: ${IMAGE_SSH_CLIENT}
  stage: build
  only:
    - schedules
  script:
    - mkdir -p ~/.ssh
    - echo "${SSH_PRIVATE_KEY}" > ~/.ssh/id_rsa && chmod 600 ~/.ssh/id_rsa
    - echo -e "Host *\n\tStrictHostKeyChecking no\n\n" > ~/.ssh/config
    - scp $RCLONE_CONF $SERVER:~/rclone.conf
    - DB_CONTAINER=$(ssh $SERVER "echo \$(docker ps | grep hanusovedni_db | cut -d' ' -f1)")
    - BACKUP_FILE=$(date +%F).sql.gz
    - echo $DB_CONTAINER && echo $BACKUP_FILE
    - ssh $SERVER "docker exec $DB_CONTAINER pg_dump -U hanusovedni -d hanusovedni | gzip > /tmp/$BACKUP_FILE"
    - 'ssh $SERVER "docker run --rm
          -v \$PWD/rclone.conf:/config/rclone/rclone.conf
          -v /tmp:/backup
          rclone/rclone copy
          /backup/$BACKUP_FILE dropbox:backup/hanusovedni/${CI_ENVIRONMENT_NAME}"'

backup-db:production:
  extends:
    - .backup-db
    - .production