name: Deploy
on:
  push:
    branches: [main]

jobs:
  lint:
    runs-on: ubuntu-latest
    env:
      HTTP_PROXY: http://100.70.115.1:8118
      HTTPS_PROXY: http://100.70.115.1:8118
    steps:
      - name: Checkout
        run: |
          git clone http://gitea:3000/jimmy/vps-oracle-jp.git .
          git checkout ${{ github.sha }}
      - name: Validate JSON (Xray)
        run: python3 -c "import json; json.load(open('server2/xray-config.json'))"
      - name: Validate YAML (Clash Meta)
        run: pip install pyyaml -q --break-system-packages && python3 -c "import yaml; yaml.safe_load(open('server2/clash-meta.yaml'))"
      - name: Install Caddy for validation
        run: |
          curl -L -o caddy "https://caddyserver.com/api/download?os=linux&arch=amd64"
          chmod +x caddy
      - name: Validate Caddyfile formatting
        run: ./caddy fmt --check caddy-vps/Caddyfile
      - name: Validate Caddyfile syntax
        run: ./caddy validate --config caddy-vps/Caddyfile --adapter caddyfile

  security:
    runs-on: ubuntu-latest
    env:
      HTTP_PROXY: http://100.70.115.1:8118
      HTTPS_PROXY: http://100.70.115.1:8118
    steps:
      - name: Checkout
        run: |
          git clone http://gitea:3000/jimmy/vps-oracle-jp.git .
          git checkout ${{ github.sha }}
      - name: Check for secrets
        run: |
          FOUND=0
          if grep -rE '-----BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY-----' --include='*.json' --include='*.yaml' --include='*.yml' --include='*.md' --include='Caddyfile' .; then
            echo "ERROR: Private key found in repo"
            FOUND=1
          fi
          exit $FOUND

  deploy:
    needs: [lint, security]
    runs-on: ubuntu-latest
    env:
      HTTP_PROXY: http://100.70.115.1:8118
      HTTPS_PROXY: http://100.70.115.1:8118
    steps:
      - name: Checkout
        run: |
          git clone http://gitea:3000/jimmy/vps-oracle-jp.git .
          git checkout ${{ github.sha }}
      - name: Setup SSH
        env:
          VPS_SSH_KEY: ${{ secrets.VPS_SSH_KEY }}
        run: |
          mkdir -p ~/.ssh
          echo "$VPS_SSH_KEY" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          ssh-keyscan -H 158.101.140.85 >> ~/.ssh/known_hosts 2>/dev/null
          ssh-keyscan -H 161.33.182.109 >> ~/.ssh/known_hosts 2>/dev/null
      - name: Deploy Xray config to server2
        run: |
          scp server2/xray-config.json jimmyg@158.101.140.85:/tmp/xray-config.json
          ssh jimmyg@158.101.140.85 "sudo cp /tmp/xray-config.json /usr/local/etc/xray/config.json && sudo chmod 600 /usr/local/etc/xray/config.json && sudo systemctl restart xray"
      - name: Deploy Caddy config to caddy-vps
        run: |
          scp caddy-vps/Caddyfile ubuntu@161.33.182.109:/tmp/Caddyfile
          ssh ubuntu@161.33.182.109 "sudo cp /tmp/Caddyfile /etc/caddy/Caddyfile && sudo chmod 644 /etc/caddy/Caddyfile && sudo systemctl reload caddy"