#!/bin/sh
# Push this working tree to the Oracle box and restart it.
#
# Unlike deploy/push.sh (the retired NAS deployment), this target uses key
# auth and systemd — matching the convention every other service on that box
# already follows (ai-gateway, auth-hub, fam-edge, ...): code lives under
# /opt/<name>, gunicorn is a systemd unit, Caddy reverse-proxies a subdomain
# to a local port. Nothing here needs a password or sudo for the deploy
# itself; only the one-time systemd/Caddy setup did, and that is already done.
#
#   ./deploy/push_oracle.sh [user@host] [ssh-key]
#
# Never touches backend/.env, .venv or the database on the far side.
set -e

HOST="${1:-ubuntu@129.146.26.249}"
KEY="${2:-$HOME/.ssh/oracle_new}"
APP=/opt/garmin-health-lab
REPO="$(cd "$(dirname "$0")/.." && pwd)"

sh_() { ssh -i "$KEY" -o BatchMode=yes "$HOST" "$@"; }

if [ ! -f "$REPO/client/build/index.html" ]; then
  echo "client/build is missing — run 'npm run build' first" >&2
  exit 1
fi

# macOS bsdtar writes com.apple.provenance xattrs and ._ resource forks that
# the Linux side cannot read; --no-xattrs plus COPYFILE_DISABLE strip them.
TAR="tar czf - --no-xattrs"
export COPYFILE_DISABLE=1

echo "==> backend"
$TAR --exclude .venv --exclude .env --exclude __pycache__ \
    --exclude '*.db' --exclude tests --exclude .pytest_cache --exclude static \
    -C "$REPO/backend" . | sh_ "tar xzf - -C '$APP/backend'"

echo "==> static (cleared first, so stale JS chunks do not pile up)"
sh_ "rm -rf '$APP/backend/static' && mkdir -p '$APP/backend/static'"
$TAR -C "$REPO/client/build" . | sh_ "tar xzf - -C '$APP/backend/static'"

echo "==> pip install (in case requirements.txt changed)"
sh_ "$APP/backend/.venv/bin/pip install -q -r $APP/backend/requirements.txt"

echo "==> restart"
BEFORE=$(sh_ "systemctl show garmin-health-lab -p MainPID --value" || true)
sh_ "sudo systemctl restart garmin-health-lab"
sleep 2
AFTER=$(sh_ "systemctl show garmin-health-lab -p MainPID --value" || true)
if [ -z "$AFTER" ] || [ "$AFTER" = "0" ]; then
  echo "service failed to come back up — check journalctl -u garmin-health-lab" >&2
  exit 1
fi
if [ "$BEFORE" = "$AFTER" ]; then
  echo "the main PID did not change ($AFTER) — the old process may still be" >&2
  echo "serving and your changes are NOT live." >&2
  exit 1
fi
echo "==> restarted: $BEFORE -> $AFTER"

echo "==> health"
sh_ "curl -sf -m 5 -o /dev/null -w 'local: %{http_code}\n' http://127.0.0.1:5500/api/health/status" \
  || echo "local: unreachable"
curl -sf -m 8 -o /dev/null -w "public (https://garmin.zichuan.xyz): %{http_code}\n" \
  https://garmin.zichuan.xyz/api/health/status || echo "public: unreachable"