.gitlab-ci.yml

stages:
  - updates
  - renovate
  - build
  - update_flake
  - build_systems
  - deploy

renovate:
  stage: renovate
  image: renovate/renovate:latest
  script:
    - |
      echo "Running Renovate to check for dependency updates..."
      renovate --platform gitlab --token "${GITLAB_TOKEN}" --autodiscover=false ${CI_PROJECT_PATH}
  rules:
    - if: '$CI_PIPELINE_SOURCE == "schedule" && $RENOVATE_ENABLED == "true"'
      when: always
      allow_failure: true
  variables:
    LOG_LEVEL: "info"
    RENOVATE_CONFIG_FILE: "renovate.json"
    RENOVATE_AUTODISCOVER: "false"

update_fmf_in_gitea:
  stage: updates
  tags:
    - nix
  script:
    - |
      set -euo pipefail

      if [ -z "${gitea_token:-}" ]; then
        echo "ERROR: gitea_token is not set"
        exit 1
      fi

      GITEA_REPO_URL="https://campground:${gitea_token}@git.lan.aicampground.com/campground/config.git"

      echo "Cloning Gitea flake from ${GITEA_REPO_URL}"
      rm -rf Campground || true
      git clone --depth 1 "${GITEA_REPO_URL}" Campground
      cd Campground

      echo "Copying flake.lock from GitLab repo to align inputs (e.g. nixpkgs)..."
      cp ../flake.lock .

      echo "Re-locking flake to tidy lockfile for this config..."
      nix flake lock

      echo "Updating flake input 'fmf'..."
      nix flake update fmf

      if [ -z "$(git status --porcelain)" ]; then
        echo "No changes to commit after syncing lock + updating fmf"
        exit 0
      fi

      git config user.email 'ci-bot@gitlab.com'
      git config user.name 'CI Bot'

      git add flake.lock flake.nix || git add flake.lock || true
      git commit -m "CI: sync flake.lock with GitLab repo and update fmf"
      git push origin HEAD:main
  rules:
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PIPELINE_SOURCE == "push"'
      when: always
      allow_failure: false

update-flake:
  stage: update_flake
  tags:
    - nix
  script:
    - |
      git rm flake.lock && nix flake update
  artifacts:
    paths:
      - flake.lock
    expire_in: 1 hour
  rules:
    - if: '$CI_PIPELINE_SOURCE == "schedule" && $FLAKE_UPDATE == "true"'
      allow_failure: false

.build_job_template: &build_job_template
  stage: build_systems
  tags:
    - nix
  script:
    - |
      echo "Authenticating with Vault..."
      # Remove the /dev/null redirect to see errors
      vault write auth/approle/login role_id="$VAULT_ROLE_ID" secret_id="$VAULT_SECRET_ID"

      # Check if authentication succeeded
      export VAULT_TOKEN=$(vault write -field=token auth/approle/login role_id="$VAULT_ROLE_ID" secret_id="$VAULT_SECRET_ID")
      if [ -z "$VAULT_TOKEN" ]; then
        echo "ERROR: Failed to get Vault token"
        exit 1
      fi

      # Get SSH key with error checking
      export sshkey=$(vault kv get -field="sshkey" "secret/campground/gitlab-runner")
      if [ -z "$sshkey" ]; then
        echo "ERROR: Failed to get SSH key from Vault"
        exit 1
      fi

      mkdir -p ~/.ssh
      eval "$(ssh-agent -s)"

      # Add key with error checking
      echo "$sshkey" | ssh-add -
      if [ $? -ne 0 ]; then
        echo "ERROR: Failed to add SSH key"
        exit 1
      fi

      # Test connectivity before proceeding
      echo "Testing connectivity to ${SYSTEM}..."
      ssh-keyscan ${SYSTEM} >> ~/.ssh/known_hosts
      if [ $? -ne 0 ]; then
        echo "ERROR: Failed to scan SSH keys for ${SYSTEM}"
        exit 1
      fi

      nix build .#nixosConfigurations.${SYSTEM}.config.system.build.toplevel -j 1
      nix-copy-closure --to root@${SYSTEM} ./result

  resource_group: build_sequential
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" || $FLAKE_UPDATE == "true"'
      allow_failure: false

butler:
  <<: *build_job_template
  variables:
    SYSTEM: "butler"

daly:
  <<: *build_job_template
  variables:
    SYSTEM: "daly"

lucas:
  <<: *build_job_template
  variables:
    SYSTEM: "lucas"

chesty:
  <<: *build_job_template
  variables:
    SYSTEM: "chesty"

webb:
  <<: *build_job_template
  variables:
    SYSTEM: "webb"

reckless:
  <<: *build_job_template
  variables:
    SYSTEM: "reckless"

mattis:
  <<: *build_job_template
  variables:
    SYSTEM: "mattis"

.deploy_job_template: &deploy_job_template
  stage: deploy
  tags:
    - nix
  script:
    - |
      echo "Authenticating with Vault..."
      vault write auth/approle/login role_id="$VAULT_ROLE_ID" secret_id="$VAULT_SECRET_ID" > /dev/null
      export VAULT_TOKEN=$(vault write -field=token auth/approle/login role_id="$VAULT_ROLE_ID" secret_id="$VAULT_SECRET_ID")
      eval "$(ssh-agent -s)"
      vault kv get -field="lucas_CI_SERVER_URL" "secret/campground/gitlab-runner"
      sshkey=$(vault kv get -field="sshkey" "secret/campground/gitlab-runner")
      mkdir -p ~/.ssh
      echo "$sshkey" | ssh-add -
    - |
      ssh-keyscan $SYSTEM >> ~/.ssh/known_hosts
      nix run nixpkgs#figlet -- -t -c "$SYSTEM" | nix run nixpkgs#lolcat
      deploy --hostname $SYSTEM .#$SYSTEM --skip-checks
  rules:
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $DEPLOY_TYPE != "public" && $DEPLOY_TYPE != "lan" && $FLAKE_UPDATE != "true"'
      when: always
      allow_failure: false
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $DEPLOY_TYPE != "public" && $DEPLOY_TYPE != "lan" && $FLAKE_UPDATE != "true" && $SYSTEM == "butler"'
      when: always
      allow_failure: true
    - if: '$CI_COMMIT_BRANCH == "nixos" && $FLAKE_UPDATE != "true"'
      when: never
      changes:
        - "**/public-hosting/default.nix"
      allow_failure: false
    - if: '$CI_COMMIT_BRANCH == "nixos" && $FLAKE_UPDATE != "true"'
      when: never
      changes:
        - "**/lan-hosting/default.nix"
      allow_failure: false
#
# butler_deploy:
#   <<: *deploy_job_template
#   variables:
#     SYSTEM: "butler"
#
# daly_deploy:
#   <<: *deploy_job_template
#   variables:
#     SYSTEM: "daly"
#
# lucas_deploy:
#   <<: *deploy_job_template
#   variables:
#     SYSTEM: "lucas"
#
# chesty_deploy:
#   <<: *deploy_job_template
#   variables:
#     SYSTEM: "chesty"
#
# webb_deploy:
#   <<: *deploy_job_template
#   variables:
#     SYSTEM: "webb"
#
# reckless_deploy:
#   <<: *deploy_job_template
#   variables:
#     SYSTEM: "reckless"
#
# mattis_deploy:
#   <<: *deploy_job_template
#   variables:
#     SYSTEM: "mattis"

.deploy_hosting_template: &deploy_hosting_template
  stage: deploy
  script:
    - |
      echo "Authenticating with Vault..."
      vault write auth/approle/login role_id="$VAULT_ROLE_ID" secret_id="$VAULT_SECRET_ID" > /dev/null
      export VAULT_TOKEN=$(vault write -field=token auth/approle/login role_id="$VAULT_ROLE_ID" secret_id="$VAULT_SECRET_ID")
      SYSTEMS=$(get-lan-pub-systems $DEPLOY_TYPE)
      echo $SYSTEMS
      eval "$(ssh-agent -s)"
      vault kv get -field="lucas_CI_SERVER_URL" "secret/campground/gitlab-runner"
      sshkey=$(vault kv get -field="sshkey" "secret/campground/gitlab-runner")
      mkdir -p ~/.ssh

      echo "$sshkey" | ssh-add -
      for SYSTEM in $SYSTEMS; do
        ssh-keyscan $SYSTEM >> ~/.ssh/known_hosts
        nix run nixpkgs#figlet -- -t -c "$SYSTEM" | nix run nixpkgs#lolcat
        deploy --hostname $SYSTEM .#$SYSTEM
      done
  tags:
    - nix

deploy_public_hosting:
  <<: *deploy_hosting_template
  variables:
    DEPLOY_TYPE: "public"
  rules:
    - if: '$CI_COMMIT_BRANCH == "nixos" && $FLAKE_UPDATE != "true"'
      changes:
        - "**/public-hosting/default.nix"
      allow_failure: false

deploy_lan_hosting:
  <<: *deploy_hosting_template
  variables:
    DEPLOY_TYPE: "lan"
  rules:
    - if: '$CI_COMMIT_BRANCH == "nixos" && $FLAKE_UPDATE != "true"'
      changes:
        - "**/lan-hosting/default.nix"
      allow_failure: false

build_resume:
  stage: deploy
  tags:
    - nix
  script:
    - nix run .#resume-builder
  artifacts:
    paths:
      - resume.pdf
    expire_in: 1 week
  rules:
    - if: '$CI_COMMIT_BRANCH == "nixos" && $CI_MERGE_REQUEST_SOURCE_BRANCH_NAME == "nixos" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == "nixos"'
      changes:
        - "package/matt-camp-website/src/assets/resume/resume.json"

nvim_update:
  stage: updates
  script:
    # - "nix flake check gitlab:usmcamp0811/campground-nvim"
    - "nix flake lock --update-input campground-nvim"
    - "git config --global user.email 'ci-bot@gitlab.com'"
    - "git config --global user.name 'CI Bot'"
    - "git remote set-url origin https://${CI_DEPLOY_USER}:${CI_DEPLOY_PASSWORD}@gitlab.com/usmcamp0811/dotfiles.git"
    - "git add flake.lock"
    - "git commit -m 'CI: Update campground-nvim'"
    - "git push origin HEAD:${CI_DEFAULT_BRANCH}"
  rules:
    - if: '$CI_PIPELINE_SOURCE == "trigger" && $FLAKE_UPDATE != "true"'
      allow_failure: false

# Fetch the OISD domainswild blocklist and host on GitLab Pages.
# Also computes the hash and auto-updates the Nix module so builds are
# reproducible.  Trigger manually from CI/CD → Pipelines → Run pipeline → play ▶
create-pages:
  stage: deploy
  image: alpine:latest
  pages: true
  tags:
    - nix
  script:
    - apk add --no-cache curl git
    # Fetch the latest blocklist from OISD
    - curl -sSL -o /tmp/domainswild "https://big.oisd.nl/domainswild"
    # Compute the SRI hash
    - HASH=$(nix hash file --type sha256 --sri /tmp/domainswild)
    # Get the current hash from the Nix module
    - CURRENT_HASH=$(sed -n 's/.*sha256 = "\(.*\)";/\1/p' modules/nixos/services/dnscrypt-proxy/default.nix)
    # Copy to public/ for Pages (always)
    - mkdir -p public
    - cp /tmp/domainswild public/domainswild
    # If the hash changed, update the Nix module and push
    - |
      if [ "$HASH" != "$CURRENT_HASH" ]; then
        echo "Hash changed: $CURRENT_HASH -> $HASH"
        sed -i "s|sha256 = \"$CURRENT_HASH\"|sha256 = \"$HASH\"|" modules/nixos/services/dnscrypt-proxy/default.nix
        git config user.email 'ci-bot@gitlab.com'
        git config user.name 'CI Bot'
        git remote set-url origin https://${CI_DEPLOY_USER}:${CI_DEPLOY_PASSWORD}@gitlab.com/usmcamp0811/dotfiles.git
        git add modules/nixos/services/dnscrypt-proxy/default.nix
        git commit -m "CI: update OISD blocklist hash"
        git push origin HEAD:${CI_DEFAULT_BRANCH}
      else
        echo "Hash unchanged ($HASH), nothing to commit"
      fi
  artifacts:
    paths:
      - public
    expire_in: 1 week
  rules:
    - when: manual
      allow_failure: true

crystal_forge_update:
  stage: updates
  script: |
    echo "Authenticating with Vault..."
    vault write auth/approle/login role_id="$VAULT_ROLE_ID" secret_id="$VAULT_SECRET_ID" > /dev/null
    export VAULT_TOKEN=$(vault write -field=token auth/approle/login role_id="$VAULT_ROLE_ID" secret_id="$VAULT_SECRET_ID")
    export sshkey=$(vault kv get -field="sshkey" "secret/campground/gitlab-runner")
    mkdir -p ~/.ssh
    eval "$(ssh-agent -s)"
    echo "$sshkey" | ssh-add -
    ssh-keyscan gitlab.com >> ~/.ssh/known_hosts
    nix flake lock --update-input crystal-forge
    ssh-agent -k
    git config --global user.email 'ci-bot@gitlab.com'
    git config --global user.name 'CI Bot'
    git remote set-url origin https://${CI_DEPLOY_USER}:${CI_DEPLOY_PASSWORD}@gitlab.com/usmcamp0811/dotfiles.git
    git add flake.lock
    git commit -m 'CI: Update crystal-forge update'
    git push origin HEAD:${CI_DEFAULT_BRANCH}
  rules:
    - if: '$CI_PIPELINE_SOURCE == "trigger" && $FLAKE_UPDATE != "true"'
      allow_failure: false