#!/usr/bin/env bash
#
# Pull the live deployment configs from the VPS and diff them against the repo
# Read-only on the server. Exits non-zero if anything has drifted
#
# INTERNAL tool, run locally (or via `make deploy-diff`). It is deliberately
# not wired into CI: it is more useful interactively than as a scheduled job
#
#   ansible/scripts/pull-live-configs.sh
#
# Connection details are read from ansible/inventory/hosts.yml (git-ignored), or
# from the VPS_HOST / VPS_USER / VPS_KEY environment variables

set -euo pipefail

repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
ansible_dir="$repo_root/ansible"
inventory="$ansible_dir/inventory/hosts.yml"

# first value of a key in the (flat) inventory
field() { awk -F': *' -v k="^[[:space:]]*$1" '$0 ~ k {print $2; exit}' "$inventory"; }

HOST="${VPS_HOST:-}"
USER="${VPS_USER:-}"
KEY="${VPS_KEY:-}"

if [ -f "$inventory" ]; then
  [ -n "$HOST" ] || HOST="$(field 'ansible_host:')"
  [ -n "$USER" ] || USER="$(field 'ansible_user:')"
  [ -n "$KEY" ]  || KEY="$(field 'ansible_ssh_private_key_file:')"
fi

KEY="${KEY/#\~/$HOME}"
[ -n "$HOST" ] || { echo "no host: set VPS_HOST or provide ansible/inventory/hosts.yml" >&2; exit 2; }
[ -n "$USER" ] || { echo "no user: set VPS_USER or provide ansible/inventory/hosts.yml" >&2; exit 2; }
KEY="${KEY:-$HOME/.ssh/id_ed25519}"

tmp="$(mktemp -d)"
trap 'rm -rf "$tmp"' EXIT

# First vhost from vars/vhosts.yml, e.g. "usenexo.xyz"
vhost="$(awk '/^vhosts:/{f=1;next} f&&/^[[:space:]]*- /{print $2; exit}' "$ansible_dir/vars/vhosts.yml")"
[ -n "$vhost" ] || { echo "could not determine vhost from vars/vhosts.yml" >&2; exit 2; }

ssh_opts=(-i "$KEY" -o StrictHostKeyChecking=accept-new)

echo "Pulling live configs from ${USER}@${HOST} ..."

pull() { # <remote path> <local name>
  if ssh "${ssh_opts[@]}" "${USER}@${HOST}" "cat '$1'" >"$tmp/$2" 2>/dev/null; then
    echo "  pulled $1"
  else
    echo "  MISSING on server: $1" >&2
    rm -f "$tmp/$2"
  fi
}

pull "/etc/nginx/http.d/${vhost}.conf"    nginx.conf
pull /srv/app/production/docker-compose.yml docker-compose.yml
pull /srv/app/production/valkey.conf        valkey.conf

# The nginx config is templated; render it the same way the nginx role would
render_nginx() {
  sed \
    -e "s/{{ vhosts\[0\] }}/${vhost}/g" \
    -e 's/{{ nginx_cert_dir }}/\/etc\/ssl\/uacme/g' \
    -e 's/{{ nginx_static_root }}/\/srv\/static/g' \
    -e 's/{{ nginx_proxy_pass }}/http:\/\/127.0.0.1:3000/g' \
    -e 's/{{ nginx_logs_proxy_pass }}/http:\/\/127.0.0.1:9428/g' \
    -e 's/{{ nginx_logs_htpasswd_file }}/\/etc\/nginx\/.htpasswd-logs/g' \
    "$ansible_dir/roles/nginx/templates/site.https.j2"
}

status=0

report() { # <diff exit status> <label>
  if [ "$1" -eq 0 ]; then
    echo "ok   $2"
  else
    echo "DRIFT $2"; status=1
  fi
}

show_diff() { # <expected file> <live file>
  diff -u "$1" "$2" | sed 's/^/     /' || true
}

echo
if [ -f "$tmp/nginx.conf" ]; then
  render_nginx >"$tmp/nginx.expected"
  if diff -q "$tmp/nginx.expected" "$tmp/nginx.conf" >/dev/null; then
    report 0 "nginx server block"
  else
    report 1 "nginx server block"; show_diff "$tmp/nginx.expected" "$tmp/nginx.conf"
  fi
else
  echo "??   nginx server block — no live copy"
fi

for pair in \
  "ansible/roles/app/files/docker-compose.production.yml:docker-compose.yml:production compose" \
  "ansible/roles/app/files/valkey.conf:valkey.conf:valkey config"; do
  IFS=: read -r repo_rel live name <<<"$pair"
  if [ ! -f "$tmp/$live" ]; then
    echo "??   $name — no live copy"
  elif diff -q "$repo_root/$repo_rel" "$tmp/$live" >/dev/null; then
    report 0 "$name"
  else
    report 1 "$name"; show_diff "$repo_root/$repo_rel" "$tmp/$live"
  fi
done

echo
if [ "$status" -eq 0 ]; then
  echo "No drift."
else
  echo "Drift detected: re-run the matching playbook (deploy.yml / app.yml)"
fi
exit "$status"