name: build-and-publish

on:
  push:
    branches: [master]
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-22.04
    strategy:
      fail-fast: false
      matrix:
        target: [trixie, raccoon]
        include:
          - target: trixie
            image: debian:13
            nexus_repo_secret: NEXUS_REPO_TRIXIE
            nexus_user_secret: NEXUS_USER_TRIXIE
            nexus_pass_secret: NEXUS_PASS_TRIXIE
          - target: raccoon
            image: ubuntu:26.04
            nexus_repo_secret: NEXUS_REPO_RACCOON
            nexus_user_secret: NEXUS_USER_RACCOON
            nexus_pass_secret: NEXUS_PASS_RACCOON

    container:
      image: ${{ matrix.image }}

    steps:
      - name: Bootstrap
        run: |
          apt-get update -qq
          DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
            git ca-certificates nodejs

      - name: Checkout
        uses: actions/checkout@v4

      - name: Build
        id: pkg
        env:
          TARGET: ${{ matrix.target }}
        run: |
          set -euo pipefail
          touch /.dockerenv
          bash build/${TARGET}.sh new
          bash build/${TARGET}.sh build
          bash build/${TARGET}.sh postfix

          PKG_NAME="twiy"
          NGINX_VER="$(nginx -v 2>&1 | awk -F/ '{print $2}')"
          VERSION="${NGINX_VER}-${GITHUB_RUN_NUMBER:-1}~${TARGET}"
          ARCH="amd64"
          PKG_DIR="/opt/${PKG_NAME}_${VERSION}_${ARCH}"
          DEB_DIR="${PKG_DIR}/DEBIAN"

          mkdir -p "${PKG_DIR}/usr/sbin" "${PKG_DIR}/nginx" \
                   "${PKG_DIR}/etc/systemd/system" "${PKG_DIR}/var/log/nginx" \
                   "${PKG_DIR}/usr/lib" \
                   "${PKG_DIR}/hostdata/default/public_html" \
                   "${PKG_DIR}/usr/nginx_lua"

          cp /usr/sbin/nginx "${PKG_DIR}/usr/sbin/"
          cp -R /nginx/* "${PKG_DIR}/nginx/" || true
          cp /etc/systemd/system/nginx.service "${PKG_DIR}/etc/systemd/system/"
          cp -R /hostdata/default "${PKG_DIR}/hostdata/" || true
          cp -R /usr/nginx_lua "${PKG_DIR}/usr/" || true

          for d in /usr/local/aws-lc /usr/local/LuaJIT /usr/local/modsecurity /usr/local/zlib-ng; do
            [ -d "$d" ] && cp -R "$d" "${PKG_DIR}/usr/local/" || true
          done
          mkdir -p "${PKG_DIR}/usr/local/lib"
          cp -R /usr/local/lib/. "${PKG_DIR}/usr/local/lib/" 2>/dev/null || true

          for lib in $(ldd /usr/sbin/nginx | grep '=> /' | awk '{print $3}'); do
            case "$lib" in
              /usr/local/*) continue ;;
            esac
            cp "$lib" "${PKG_DIR}/usr/lib/" || true
          done

          mkdir -p "${DEB_DIR}"
          cat > "${DEB_DIR}/control" <<EOF
          Package: ${PKG_NAME}
          Version: ${VERSION}
          Section: base
          Priority: optional
          Architecture: ${ARCH}
          Depends: libjemalloc2, libsystemd0
          Maintainer: Julio <me@julio.al>
          Description: Nginx L7 DDoS Protection (The-World-Is-Yours), built by RAWeb CI for ${TARGET}.
          EOF

          cat > "${DEB_DIR}/postinst" <<'EOFPOSTINST'
          #!/bin/bash
          useradd -r -s /bin/false nginx 2>/dev/null || true
          install -d -o nginx -g nginx -m 0755 /var/log/nginx
          # /run/nginx/temp/* is recreated on every systemd start (ExecStartPre)
          # since /run is tmpfs and cleared on reboot.
          chown -R nginx:nginx /var/log/nginx /nginx 2>/dev/null || true
          systemctl daemon-reload 2>/dev/null || true
          systemctl enable nginx.service 2>/dev/null || true
          systemctl restart nginx.service 2>/dev/null || true
          exit 0
          EOFPOSTINST
          chmod 755 "${DEB_DIR}/postinst"

          dpkg-deb --build "${PKG_DIR}"
          DEB_FILE="${PKG_DIR}.deb"

          {
            echo "deb_file=${DEB_FILE}"
            echo "version=${VERSION}"
            echo "pkg_name=${PKG_NAME}"
          } >> "$GITHUB_OUTPUT"

          ls -la "${DEB_FILE}"
          sha256sum "${DEB_FILE}"

      - name: Publish
        env:
          NEXUS_USER: ${{ secrets[matrix.nexus_user_secret] }}
          NEXUS_PASS: ${{ secrets[matrix.nexus_pass_secret] }}
          NEXUS_URL:  ${{ secrets.NEXUS_URL }}
          NEXUS_REPO: ${{ secrets[matrix.nexus_repo_secret] }}
          DEB_FILE:   ${{ steps.pkg.outputs.deb_file }}
          PKG_NAME:   ${{ steps.pkg.outputs.pkg_name }}
          TARGET:     ${{ matrix.target }}
        run: |
          set -euo pipefail
          umask 077

          apt-get install -y -q --no-install-recommends curl python3 ca-certificates >/dev/null

          SECDIR="$(mktemp -d -p /dev/shm twiy-XXXXXXXX 2>/dev/null \
                    || mktemp -d -t twiy-XXXXXXXX)"
          chmod 700 "$SECDIR"
          cleanup() {
            find "$SECDIR" -type f -exec shred -uz {} + 2>/dev/null || true
            rm -rf "$SECDIR"
          }
          trap cleanup EXIT INT TERM HUP

          NEXUS_HOST="$(printf '%s' "$NEXUS_URL" | awk -F/ '{print $3}')"
          printf 'machine %s login %s password %s\n' \
                 "$NEXUS_HOST" "$NEXUS_USER" "$NEXUS_PASS" > "$SECDIR/netrc"
          unset NEXUS_USER NEXUS_PASS

          OLD_ID="$(curl -fsS --netrc-file "$SECDIR/netrc" \
                    "$NEXUS_URL/service/rest/v1/components?repository=$NEXUS_REPO" \
                    | PKG_NAME="$PKG_NAME" python3 -c '
          import sys, json, os
          for c in json.load(sys.stdin).get("items", []):
              if c.get("name") == os.environ["PKG_NAME"]:
                  print(c["id"]); break
          ' || true)"
          if [ -n "$OLD_ID" ]; then
            curl -fsS -X DELETE --netrc-file "$SECDIR/netrc" \
                 "$NEXUS_URL/service/rest/v1/components/$OLD_ID" -o /dev/null
          fi

          HTTP="$(curl -sS --netrc-file "$SECDIR/netrc" \
                  -o "$SECDIR/upload.body" -w '%{http_code}' \
                  -X POST -F "apt.asset=@$DEB_FILE" \
                  "$NEXUS_URL/service/rest/v1/components?repository=$NEXUS_REPO")"
          case "$HTTP" in
            201|204) echo "[$TARGET] uploaded $(basename "$DEB_FILE")" ;;
            *) echo "[$TARGET] upload failed (HTTP $HTTP)"; cat "$SECDIR/upload.body"; exit 1 ;;
          esac