name: Deploy Static Site
description: Build site with Nix, push tarball to S3, deploy via Nomad with shared static-server image

# Required env vars: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, NOMAD_TOKEN
# Optional env vars: NIX_SIGNING_KEY (if set, signs and pushes Nix closure to S3 binary cache)

inputs:
  domain:
    description: 'Domain the site is served at (e.g. toph.so)'
    required: true

  flake-output:
    description: 'Flake output to build (e.g. default, docs)'
    required: false
    default: 'default'

  nomad-addr:
    description: 'Nomad API address'
    required: false
    default: 'http://172.17.0.1:4646'

  server-image:
    description: 'OCI image for the static server'
    required: false
    default: 'registry.toph.so/static-server:latest'

  datacenter:
    description: 'Nomad datacenter'
    required: false
    default: 'contabo'

  s3-endpoint:
    description: 'S3 endpoint URL'
    required: false
    default: 'https://s3.toph.so'

  s3-bucket:
    description: 'S3 bucket for site tarballs and Nix cache'
    required: false
    default: 'nix-cache'

  smoke-test:
    description: 'Run a smoke test against the domain after deploy'
    required: false
    default: 'true'

runs:
  using: composite
  steps:
    - name: Install tools
      shell: bash
      run: |
        NIXPKGS_ALLOW_UNFREE=1 nix profile install --impure nixpkgs#nomad nixpkgs#awscli2 nixpkgs#skopeo
        echo "$HOME/.nix-profile/bin" >> $GITHUB_PATH

    - name: Build site
      shell: bash
      run: nix build ".#${{ inputs.flake-output }}" --out-link result-site

    - name: Sign and push Nix closure to S3 cache
      if: env.NIX_SIGNING_KEY != ''
      uses: https://git.toph.so/toph/ci-actions/push-nix-cache@main
      with:
        store-path: ./result-site
        s3-endpoint: ${{ inputs.s3-endpoint }}
        s3-bucket: ${{ inputs.s3-bucket }}

    - name: Upload site tarball to S3
      shell: bash
      run: |
        SITE_HASH=$(git rev-parse --short=12 HEAD)
        echo "SITE_HASH=${SITE_HASH}" >> $GITHUB_ENV
        tar czf /tmp/site.tar.gz -C result-site .
        aws s3 cp \
          --endpoint-url "${{ inputs.s3-endpoint }}" \
          /tmp/site.tar.gz \
          "s3://${{ inputs.s3-bucket }}/sites/${{ inputs.domain }}/${SITE_HASH}.tar.gz"

    - name: Resolve server image digest
      shell: bash
      run: |
        DIGEST=$(skopeo inspect --format '{{.Digest}}' "docker://${{ inputs.server-image }}")
        IMAGE_REPO="${{ inputs.server-image }}"
        IMAGE_REPO="${IMAGE_REPO%%:*}"
        echo "SERVER_IMAGE_PINNED=${IMAGE_REPO}@${DIGEST}" >> $GITHUB_ENV

    - name: Deploy Nomad job
      shell: bash
      run: |
        nix eval --raw --impure \
          --expr "import ${{ github.action_path }}/nomad-job.nix" \
          | nomad job run -json -
      env:
        NOMAD_ADDR: ${{ inputs.nomad-addr }}
        DOMAIN: ${{ inputs.domain }}
        SITE_HASH: ${{ env.SITE_HASH }}
        SERVER_IMAGE: ${{ env.SERVER_IMAGE_PINNED }}
        DATACENTER: ${{ inputs.datacenter }}
        S3_BUCKET: ${{ inputs.s3-bucket }}

    - name: Smoke test
      if: inputs.smoke-test == 'true'
      shell: bash
      run: |
        echo "Waiting for deployment..."
        for i in $(seq 1 12); do
          if curl -sf --max-time 5 "https://${{ inputs.domain }}/" > /dev/null; then
            echo "OK — https://${{ inputs.domain }}/ is up"
            exit 0
          fi
          echo "Attempt ${i}/12 — retrying in 5s..."
          sleep 5
        done
        echo "Smoke test failed: https://${{ inputs.domain }}/ did not respond"
        exit 1