.gitlab-ci.yml

include:
  - local: '.gitlab-ci-scan.yml'
  - local: '.gitlab-ci-package.yml'

stages:
  - build
  - scan
  - package
  - deploy
  - release
  - manual-deploy

variables:
  ARTIFACT_COMPRESSION_LEVEL: "fast"
  CACHE_COMPRESSION_LEVEL: "fast"

.triggers:
  rules:
    - if: '$CI_PIPELINE_SOURCE == "pipeline"'
      when: never
    - if: $CI_COMMIT_REF_NAME == "main"
      when: always
    - if: $CI_COMMIT_REF_NAME == "staging"
      when: always
    - if: $CI_COMMIT_REF_NAME == "dev"
      when: always      
    - if: '$CI_PIPELINE_SOURCE == "web"'
      when: always

set-vars:
  stage: .pre
  image: docker.io/alpine:3.15
  # before_script:
  #   - >
  #     apk add yq --no-cache
  #     --repository=http://dl-cdn.alpinelinux.org/alpine/edge/community
  script:
    - cat .env >> build.env
    - source build.env
    - "echo APP_NAME=ckan-${CI_COMMIT_REF_NAME} >> build.env"
    # - echo "NAMESPACE=ckan" >> build.env
    # - echo CHART_VERSION=$(yq '.version' chart/Chart.yaml) >> build.env
    - "echo CKAN_IMAGE=${INTERNAL_REG}/ckan-container/ckan:\
      ${CKAN_VERSION}-${CI_COMMIT_REF_NAME} >> build.env"
    - "echo PROXY_IMAGE=${INTERNAL_REG}/ckan-container/proxy:\
      ${NGINX_IMG_TAG}-${CI_COMMIT_REF_NAME} >> build.env"
    - "echo DB_IMAGE=${INTERNAL_REG}/ckan-container/db:\
      ${POSTGRES_IMG_TAG}-${CI_COMMIT_REF_NAME} >> build.env"
    - "echo SOLR_IMAGE=${INTERNAL_REG}/ckan-container/solr:\
      ${SOLR_IMG_TAG}-${CI_COMMIT_REF_NAME} >> build.env"
    - "echo SOLR_INIT_IMAGE=${INTERNAL_REG}/ckan-container/init-solr:\
      ${SOLR_IMG_TAG}-${CI_COMMIT_REF_NAME} >> build.env"
    - echo "Printing build.env"
    - cat build.env
  artifacts:
    reports:
      dotenv: build.env

.build:
  stage: build
  needs:
    - set-vars
  image:
    name: gcr.io/kaniko-project/executor:v1.9.1-debug
    entrypoint: [""]
  before_script:
    - mkdir -p /kaniko/.docker
    - >
      echo "{\"auths\":{\"${INTERNAL_REG}\":{\"auth\":\"$(printf
      "%s:%s" "${IMAGE_REGISTRY_USER}" "${IMAGE_REGISTRY_PASS}"
      | base64 | tr -d '\n')\"}}}" > /kaniko/.docker/config.json
  script:
    - echo "Build image  ${IMAGE_NAME}"
    - >
      /kaniko/executor
      --force
      --context "${CONTEXT_DIR}"
      --dockerfile "${CONTEXT_DIR}/Dockerfile"
      --destination "${IMAGE_NAME}-unverified"
      --build-arg MAINTAINER="${MAINTAINER}"
      --build-arg EXTERNAL_REG="${EXTERNAL_REG}"
      --build-arg INTERNAL_REG="${INTERNAL_REG}"
      --build-arg PYTHON_IMG_TAG="${PYTHON_IMG_TAG}"
      --build-arg CKAN_VERSION="${CKAN_VERSION}"
      --build-arg POSTGRES_IMG_TAG="${POSTGRES_IMG_TAG}"
      --build-arg SOLR_IMG_TAG="${SOLR_IMG_TAG}"
      --build-arg NGINX_IMG_TAG="${NGINX_IMG_TAG}"

ckan-build:
  extends:
    - .triggers
    - .build
  variables:
    IMAGE_NAME: ${CKAN_IMAGE}
    CONTEXT_DIR: "${CI_PROJECT_DIR}"

proxy-build:
  extends:
    - .triggers
    - .build
  cache:
    key: nginx-config
    paths:
      - nginx/conf.d/ckan.conf.template
    policy: pull
  variables:
    IMAGE_NAME: ${PROXY_IMAGE}
    CONTEXT_DIR: "${CI_PROJECT_DIR}/nginx"

db-build:
  extends:
    - .triggers
    - .build
  variables:
    IMAGE_NAME: ${DB_IMAGE}
    CONTEXT_DIR: "${CI_PROJECT_DIR}/postgresql"

solr-build:
  extends:
    - .triggers
    - .build
  variables:
    IMAGE_NAME: ${SOLR_IMAGE}
    CONTEXT_DIR: "${CI_PROJECT_DIR}/solr"

solr-init-build:
  extends:
    - .triggers
    - .build
  variables:
    IMAGE_NAME: ${SOLR_INIT_IMAGE}
    CONTEXT_DIR: "${CI_PROJECT_DIR}/init_solr"

remote-docker:
  stage: deploy
  environment: $CI_COMMIT_REF_NAME
  image: docker.io/docker:24.0
  extends:
    - .triggers
  needs:
    - set-vars
    - ckan-retag
    - proxy-retag
    - db-retag
    - solr-retag
    - solr-init-retag
  variables:
    DOCKER_HOST: "ssh://$DEPLOY_SSH_USER@$DEPLOY_HOSTNAME"
  before_script:
    - echo "***The app image is   ${IMAGE_NAME}"
    - echo "***The app version is  ${CKAN_VERSION}"
    - echo "Going to docker remote ($DEPLOY_HOSTNAME) with file docker-compose.$CI_COMMIT_REF_NAME.yml"
    - echo "$CKAN_INI" > ckan.ini
    - echo "$DB_ENV" > .db.env
    - echo "$SOLR_ENV" > .solr.env
    - echo "Adding SSH Key"
    - mkdir -p ~/.ssh
    - echo "$DEPLOY_SSH_KEY" > ~/.ssh/gitlab
    - chmod 400 ~/.ssh/gitlab
    - echo 'IdentityFile ~/.ssh/gitlab' > ~/.ssh/config
    - echo "going to keyscan on HOST ${DEPLOY_HOSTNAME}"
    - ssh-keyscan -H $DEPLOY_HOSTNAME >> ~/.ssh/known_hosts
  #    - cat ~/.ssh/known_hosts
  script:
    - |
      USER_DIR=$(echo "/home/$DEPLOY_SSH_USER")
      ssh "$DEPLOY_SSH_USER@$DEPLOY_HOSTNAME" "mkdir -p $USER_DIR/config/ckan"
      scp ckan.ini "$DEPLOY_SSH_USER@$DEPLOY_HOSTNAME:$USER_DIR/config/ckan/$CI_COMMIT_REF_NAME.ini"
    - HOME=$USER_DIR
    # use docker compose create to recreate the container and force pulling the latest image
    # to avoid using the local cache
    - |
      docker compose --project-name="$APP_NAME" \
        --file "docker-compose.$CI_COMMIT_REF_NAME.yml" \
        create --force-recreate --pull="always"
    # use docker compose up to start the service on the remote machine
    - |
      docker compose --project-name="$APP_NAME" \
        --file "docker-compose.$CI_COMMIT_REF_NAME.yml" \
        up --detach

# Job for manual deploying of a docker-compose file, to use it's
# docker images, make sure before you run it that the images referenced
# in the docker-compose.$CI_COMMIT_REF_NAME.yml exist!
manual-remote-docker:
  stage: manual-deploy
  environment: $CI_COMMIT_REF_NAME
  image: docker.io/docker:24.0
  needs:
    - set-vars
  rules:
    - if: '$CI_PIPELINE_SOURCE == "pipeline"'
      when: always
    - when: manual
  variables:
    DOCKER_HOST: "ssh://$DEPLOY_SSH_USER@$DEPLOY_HOSTNAME"
  before_script:
    - echo "$CKAN_INI" > ckan.ini
    - echo "$DB_ENV" > .db.env
    - echo "$SOLR_ENV" > .solr.env
    - echo "Adding SSH Key"
    - mkdir -p ~/.ssh
    - echo "$DEPLOY_SSH_KEY" > ~/.ssh/gitlab
    - chmod 400 ~/.ssh/gitlab
    - echo 'IdentityFile ~/.ssh/gitlab' > ~/.ssh/config
    - echo "going to keyscan on HOST ${DEPLOY_HOSTNAME}"
    - ssh-keyscan -H $DEPLOY_HOSTNAME >> ~/.ssh/known_hosts
#    - cat ~/.ssh/known_hosts
  script:
    - USER_DIR=$(echo "/home/$DEPLOY_SSH_USER")
    - echo "Defined USER_DIR ${USER_DIR}"
    - echo "Going to create the config/ckan directory for the ckan.ini file"
    - ssh "$DEPLOY_SSH_USER@$DEPLOY_HOSTNAME" "mkdir -p $USER_DIR/config/ckan"
    - ls -la
    - echo "Going to copy the local ckan.ini file to ${USER_DIR}/config/ckan/2.9-backup.ini"
    - scp ckan.ini "$DEPLOY_SSH_USER@$DEPLOY_HOSTNAME:$USER_DIR/config/ckan/2.9-backup.ini"
    - HOME=$USER_DIR
    - echo "Going to remotely start the docker-compose.2.9.yml on ${DEPLOY_SSH_USER}@${DEPLOY_HOSTNAME}"
    # use docker compose create to recreate the container and force pulling the latest image
    # to avoid using the local cache
    - |
      docker compose --project-name="$APP_NAME" \
        --file "docker-compose.2.9.yml" \
        create --force-recreate --pull="always"
    # use docker compose up to start the service on the remote machine
    - |
      docker compose --project-name="$APP_NAME" \
        --file "docker-compose.2.9.yml" \
        up --detach

build-binary:
  stage: release
  image: docker.io/debian:bookworm
  rules:
    - if: $CI_COMMIT_TAG
  before_script:
    - apt update && apt install -y curl
    - curl -LO https://github.com/ajdiaz/bashc/releases/download/5.2.15/bashc
    - chmod +x bashc
  script:
    - ./bashc scripts/envidat-in-a-box.sh envidat
  after_script:
    - echo "BIN_JOB_ID=$CI_JOB_ID" >> job.env
  artifacts:
    paths:
      - envidat
    expire_in: never
    reports:
      dotenv: job.env

release-binary:
  stage: release
  image: registry.gitlab.com/gitlab-org/release-cli:latest
  needs:
    - job: build-binary
      artifacts: true
  rules:
    - if: $CI_COMMIT_TAG
  script:
    - echo "running release_job for $CI_COMMIT_TAG"
    - echo "Using artifact from job $BIN_JOB_ID"
  release:
    name: "Release $CI_COMMIT_TAG"
    tag_name: "$CI_COMMIT_TAG"
    description: "$CI_COMMIT_TAG"
    ref: "$CI_COMMIT_SHA"
    assets:
      links:
        - name: envidat-in-a-box
          url: $CI_SERVER_URL/$CI_PROJECT_PATH/-/jobs/$BIN_JOB_ID/artifacts/raw/envidat
# .helm:
#   stage: deploy
#   image:
#     name: docker.io/alpine/helm:3.8.0
#     entrypoint: [""]
#   before_script:
#     - mkdir -p /root/.config/helm/registry
#     - >
#       echo "{\"auths\":{\"${INTERNAL_REG}\":{\"auth\":\"$(printf "%s:%s"
#       "${IMAGE_REGISTRY_USER}" "${IMAGE_REGISTRY_PASS}" | base64
#       | tr -d '\n')\"}}}" > /root/.config/helm/registry/config.json

# create-helm-chart:
#   extends:
#     - .helm
#   stage: package
#   rules:
#     - if: $CI_COMMIT_REF_NAME != "main"
#       when: never
#     - when: always
#   script:
#     - >
#       apk add yq --no-cache
#       --repository=http://dl-cdn.alpinelinux.org/alpine/edge/community
#     - helm dependencies build chart
#     - yq -i '.appVersion = strenv(CKAN_VERSION)' chart/Chart.yaml
#     - helm package chart
#     - CHART_VER=$(yq '.version' chart/Chart.yaml)
#     - helm push "ckan-${CHART_VER}.tgz" oci://registry-gitlab.wsl.ch/envidat/ckan-container

# helm-deploy:
#   extends:
#     - .helm
#   rules:
#     - if: $CI_COMMIT_REF_NAME == "main"
#       when: never
#     - when: on_success
#   variables:
#     GIT_STRATEGY: none
#   script:
#     - >
#       helm upgrade --install "${APP_NAME}"
#       oci://registry-gitlab.wsl.ch/envidat/ckan-container/ckan
#       --namespace "${NAMESPACE}" --create-namespace
#       --version "${CHART_VERSION}"
#       --set image.tag="${CKAN_VERSION}-${CI_COMMIT_REF_NAME}"
#       --set proxy.image.tag="${NGINX_IMG_TAG}-${CI_COMMIT_REF_NAME}"
#       --set image.pullPolicy="Always"
#       --set configIniSecret="${APP_NAME}-config-ini"
#       --set authCookieName="${APP_NAME//-/_}"
#       --set extraEnvFrom[0].secretRef.name="solr-${APP_NAME}-vars"
#       --set ingress.hosts[0].host="${APP_NAME}.envidat.ch"
#       --set ingress.hosts[0].paths[0].path="/"
#       --set ingress.hosts[0].paths[0].pathType="ImplementationSpecific"
#       --set ingress.tls[0].secretName="envidat-star"
#       --set ingress.tls[0].hosts[0]="${APP_NAME}.envidat.ch"
#       --set db.auth.existingSecret="db-${APP_NAME}-creds"
#       --set db.primary.resources.requests.cpu="100m"
#       --set db.primary.resources.requests.memory="100Mi"
#       --set db.syncData.restoreDbSecret="db-${APP_NAME}-vars"
#       --set solr.image.tag="${SOLR_IMG_TAG}-${CI_COMMIT_REF_NAME}"
#       --set solr.ingress.hostname="solr-${CI_COMMIT_REF_NAME}.envidat.ch"
#       --set solr.passwordInitCredsSecret="solr-${APP_NAME}-vars"
#       --set autoscaling.enabled=false

# helm-deploy-prod:
#   extends:
#     - .helm
#   rules:
#     - if: $CI_COMMIT_REF_NAME != "main"
#       when: never
#     - when: on_success
#   variables:
#     GIT_STRATEGY: none
#   script:
#     - >
#       helm upgrade --install "${APP_NAME}"
#       oci://registry-gitlab.wsl.ch/envidat/ckan-container/ckan
#       --namespace "${NAMESPACE}" --create-namespace
#       --version "${CHART_VERSION}"
#       --set image.tag="${CKAN_VERSION}-${CI_COMMIT_REF_NAME}"
#       --set proxy.image.tag="${NGINX_IMG_TAG}-${CI_COMMIT_REF_NAME}"