#!/usr/bin/env bash
#
# Build MAGIK, push it to the in-cluster registry and roll it out.
# Public routing is provided by Caddy on the Oracle VPS and is managed outside
# this script; calling accessctl here would move DNS back to the Tailnet IP.
#
#   scripts/deploy.sh [--rebuild-cards]
#
# The Scryfall bulk download behind data/cards.db is cached on the host and the
# image bakes that file in, so a normal deploy touches the network only to push
# the image. Pass --rebuild-cards to force a fresh download (once per release
# of the Banned & Restricted List is a sensible cadence; the file is reused).
set -euo pipefail

repo_root="$(cd "$(dirname "$0")/.." && pwd)"
cd "$repo_root"

registry=localhost:32000
namespace=magik
subdomain=magic

rebuild_cards=0
for arg in "$@"; do
  case $arg in
    --rebuild-cards) rebuild_cards=1 ;;
    *) echo "unknown option $arg" >&2; exit 64 ;;
  esac
done

# The repo is not a git checkout, so the tag is a timestamp rather than a
# commit: it still has to change on every release, because the registry keeps
# :latest and a node that already has it would not re-pull an identical digest.
tag="${TAG:-$(date -u +%Y%m%d%H%M%S)}"

kubectl create namespace "$namespace" --dry-run=client -o yaml | kubectl apply -f -

if [[ $rebuild_cards == 1 || ! -f data/cards.db ]]; then
  # The download is cached under data/.cache under the bulk URL's own filename,
  # so a new Scryfall regeneration is picked up on its own; --rebuild-cards
  # exists to force a re-fetch of a URL Scryfall has not re-versioned.
  [[ $rebuild_cards == 1 ]] && rm -rf data/.cache
  pnpm cards:build
fi

pnpm test
pnpm typecheck
pnpm build

docker build -t "$registry/magic:$tag" "$repo_root"
docker push "$registry/magic:$tag"

sed "s/:latest/:$tag/g" deploy/k8s/magic.yaml | kubectl apply -f -
kubectl rollout status "deployment/magic" -n "$namespace" --timeout=5m

echo "Deployed. Public route: https://$subdomain.marcospaulo.dev.br (Oracle VPS Caddy → homelab over Tailscale)"