name: Deploy Static Site
description: Build site with Nix, push tarball to S3, deploy via Nomad with shared static-server image

# Required env vars: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, NOMAD_TOKEN
# Optional env vars: NIX_SIGNING_KEY (if set, signs and pushes Nix closure to S3 binary cache)

inputs:
  domain:
    description: 'Domain the site is served at (e.g. toph.so)'
    required: true

  flake-output:
    description: 'Flake output to build (e.g. default, docs)'
    required: false
    default: 'default'

  nomad-addr:
    description: 'Nomad API address'
    required: false
    default: 'http://172.17.0.1:4646'

  server-image:
    description: 'OCI image for the static server'
    required: false
    default: 'registry.toph.so/static-server:latest'

  datacenter:
    description: 'Nomad datacenter'
    required: false
    default: 'contabo'

  s3-endpoint:
    description: 'S3 endpoint URL'
    required: false
    default: 'https://s3.toph.so'

  s3-bucket:
    description: 'S3 bucket for site tarballs and Nix cache'
    required: false
    default: 'nix-cache'

  smoke-test:
    description: 'Run a smoke test against the domain after deploy'
    required: false
    default: 'true'

runs:
  using: composite
  steps:
    - name: Install tools
      shell: bash
      run: NIXPKGS_ALLOW_UNFREE=1 nix profile install --impure nixpkgs#nomad nixpkgs#awscli2

    - name: Build site
      shell: bash
      run: nix build ".#${{ inputs.flake-output }}" --out-link result-site

    - name: Sign and push Nix closure to S3 cache
      if: env.NIX_SIGNING_KEY != ''
      shell: bash
      run: |
        echo "${NIX_SIGNING_KEY}" > /tmp/nix-key
        nix store sign -k /tmp/nix-key --recursive ./result-site
        nix copy \
          --to "s3://${{ inputs.s3-bucket }}?endpoint=${{ inputs.s3-endpoint }}&access-key-id=${AWS_ACCESS_KEY_ID}&secret-access-key=${AWS_SECRET_ACCESS_KEY}" \
          ./result-site
        rm /tmp/nix-key

    - name: Upload site tarball to S3
      shell: bash
      run: |
        SITE_HASH=$(git rev-parse --short=12 HEAD)
        echo "SITE_HASH=${SITE_HASH}" >> $GITHUB_ENV
        tar czf /tmp/site.tar.gz -C result-site .
        aws s3 cp \
          --endpoint-url "${{ inputs.s3-endpoint }}" \
          /tmp/site.tar.gz \
          "s3://${{ inputs.s3-bucket }}/sites/${{ inputs.domain }}/${SITE_HASH}.tar.gz"

    - name: Deploy Nomad job
      shell: bash
      run: |
        nix eval --raw --impure \
          --expr "import ${{ github.action_path }}/nomad-job.nix" \
          | nomad job run -json -
      env:
        NOMAD_ADDR: ${{ inputs.nomad-addr }}
        DOMAIN: ${{ inputs.domain }}
        SITE_HASH: ${{ env.SITE_HASH }}
        SERVER_IMAGE: ${{ inputs.server-image }}
        DATACENTER: ${{ inputs.datacenter }}
        S3_BUCKET: ${{ inputs.s3-bucket }}

    - name: Smoke test
      if: inputs.smoke-test == 'true'
      shell: bash
      run: |
        echo "Waiting for deployment..."
        for i in $(seq 1 12); do
          if curl -sf --max-time 5 "https://${{ inputs.domain }}/" > /dev/null; then
            echo "OK — https://${{ inputs.domain }}/ is up"
            exit 0
          fi
          echo "Attempt ${i}/12 — retrying in 5s..."
          sleep 5
        done
        echo "Smoke test failed: https://${{ inputs.domain }}/ did not respond"
        exit 1