#!/usr/bin/env bash
# Build locally, push the static site and the duel server to the droplet,
# and restart the server. Usage: deploy/deploy.sh <droplet-ip-or-host>
set -euo pipefail
HOST="${1:?usage: deploy.sh <droplet-ip-or-host>}"

# The family list is the kit's; a game deploys with the kit's latest copy when the kit is beside it.
KIT_FAMILY="$(dirname "$0")/../../game-kit/family.json"
[ -f "$KIT_FAMILY" ] && cp "$KIT_FAMILY" static/family.json

npm run check
npm run check:server
npm test
npm run build

# Every production ledger must replay identically with the engine about to ship.
deploy/verify-ledgers.sh "$HOST"

# Old hashed chunks stay a week: a page loaded before this deploy can still
# fetch the module it was built against instead of failing mid-duel.
rsync -az --delete --filter='P _app/immutable/*' \
  build/ "root@$HOST:/opt/waving-hands/build/"

# The server runs from source with tsx and carries its own small manifest;
# it needs only its code and the engine. Ledgers live outside this tree.
rsync -az --delete --exclude='/server/node_modules' \
  --include='/server/***' --include='/src/' --include='/src/lib/' --include='/src/lib/game/***' \
  --include='/deploy/' --include='/deploy/waving-hands.service' --include='/deploy/waving-hands.cron' --include='/deploy/*.sh' --include='/deploy/Caddyfile.tmpl' --include='/deploy/hash-tokens.ts' --include='/deploy/traffic.py' \
  --exclude='*' \
  ./ "root@$HOST:/opt/waving-hands/app/"

ssh "root@$HOST" '
  find /opt/waving-hands/build/_app/immutable -type f -mtime +7 -delete
  chown -R root:caddy /opt/waving-hands/build
  chmod -R g+rX /opt/waving-hands/build
  cd /opt/waving-hands/app/server && npm install --no-audit --no-fund
  chown -R waving-hands:waving-hands /opt/waving-hands/app
  cp /opt/waving-hands/app/deploy/waving-hands.service /etc/systemd/system/waving-hands.service
  # Cron runs the rollup and the backup from /usr/local/bin: install them on
  # every deploy so the live copies are always the repo copies.
  install -m 755 /opt/waving-hands/app/deploy/visitors.sh /usr/local/bin/waving-hands-visitors.sh
  install -m 644 -D /opt/waving-hands/app/deploy/traffic.py /usr/local/lib/waving-hands/traffic.py
  install -m 755 /opt/waving-hands/app/deploy/pulse.sh /usr/local/bin/waving-hands-pulse.sh
  install -m 755 /opt/waving-hands/app/deploy/waving-hands-rollup.sh /usr/local/bin/waving-hands-rollup.sh
  install -m 755 /opt/waving-hands/app/deploy/waving-hands-backup.sh /usr/local/bin/waving-hands-backup.sh
  install -m 755 /opt/waving-hands/app/deploy/waving-hands-reseat.sh /usr/local/bin/waving-hands-reseat.sh
  install -m 755 /opt/waving-hands/app/deploy/waving-hands-say.sh /usr/local/bin/waving-hands-say.sh
  # The key to the keeper door: made once, readable by root (the reseat script) and the game user (the server) alone.
  if [ ! -s /etc/waving-hands/keeper.key ]; then
    install -d -m 750 -o root -g waving-hands /etc/waving-hands
    (umask 037; openssl rand -hex 32 > /etc/waving-hands/keeper.key)
    chown root:waving-hands /etc/waving-hands/keeper.key
  fi
  # On a host the hall shares, its hall-nightly.sh runs the rollup and backup
  # of every game and checks in with Sentry once for all; a game on a box of
  # its own schedules its own.
  if [ -f /etc/cron.d/gamehall ]; then rm -f /etc/cron.d/waving-hands
  else install -m 644 /opt/waving-hands/app/deploy/waving-hands.cron /etc/cron.d/waving-hands; fi
  mkdir -p /var/log/waving-hands
  systemctl daemon-reload
  systemctl enable --now waving-hands
  systemctl restart waving-hands
  # The site file is rendered from the template on every deploy, with the address line the box was set up with.
  ADDR=$(head -1 /etc/caddy/sites/waving-hands.caddy | sed "s/ {\$//")
  sed "s|__HOST__|$ADDR|" /opt/waving-hands/app/deploy/Caddyfile.tmpl > /etc/caddy/sites/waving-hands.caddy
  caddy validate --config /etc/caddy/Caddyfile >/dev/null
  # Validation as root touches the access logs; Caddy runs as caddy and must own them.
  chown -R caddy:caddy /var/lib/caddy
  systemctl reload caddy
  sleep 1
  systemctl --no-pager -l status waving-hands | head -3
'
echo "deployed."