name: Docker Build & Deploy

on:
  push:
    branches: [ main, develop ]
    branches-ignore: [ dev ]
  pull_request:
    branches: [ main ]

jobs:
  build:
    runs-on: host
    
    steps:
    - name: Checkout code
      run: |
        echo "Current workspace: $(pwd)"
        
        # Clean workspace first
        rm -rf * .git* 2>/dev/null || true
        
        # Clone the repository since Gitea runner doesn't auto-checkout
        echo "Cloning repository..."
        git clone http://${{ secrets.username }}:${{ secrets.token }}@192.168.253.221:3000/jskala/NFOguard.git /tmp/repo
        cp -r /tmp/repo/* .
        cp -r /tmp/repo/.* . 2>/dev/null || true
        rm -rf /tmp/repo
        
        echo "Repository cloned successfully"
        ls -la
        echo "Checking Dockerfile:"
        head -30 Dockerfile

    - name: Check Docker availability
      run: |
        echo "Checking Docker installation..."
        which docker || (echo "Docker not found in PATH" && exit 1)
        docker --version || (echo "Docker not available" && exit 1)
        docker info || (echo "Docker daemon not running" && exit 1)

    - name: Configure Docker for local registry
      run: |
        echo "Configuring Docker client for insecure local registry..."
        LOCAL_REGISTRY="192.168.253.221:3000"
        
        # We can't use sudo in the container, so we'll configure the client differently
        export DOCKER_CONFIG=/tmp/docker-config
        mkdir -p $DOCKER_CONFIG
        
        # Create Docker client config for insecure registry
        cat > $DOCKER_CONFIG/config.json << EOF
        {
          "auths": {},
          "HttpHeaders": {
            "User-Agent": "Docker-Client/20.10.0 (linux)"
          },
          "credsStore": "",
          "credHelpers": {},
          "experimental": "disabled"
        }
        EOF
        
        echo "Docker client config created"
        echo "Note: Since we can't modify daemon config in container, we'll use --insecure-registry flag"
        
        echo "Testing registry connectivity..."
        curl -s "http://$LOCAL_REGISTRY/v2/" && echo "✅ Registry accessible via HTTP" || echo "❌ Registry not accessible"

    - name: Build Docker image with caching
      run: |
        echo "Building Docker image with layer caching..."
        LOCAL_REGISTRY="192.168.253.221:3000"
        CACHE_IMAGE="$LOCAL_REGISTRY/jskala/nfoguard:buildcache"
        
        # Enable Docker BuildKit for better caching
        export DOCKER_BUILDKIT=1
        
        # Check if cache image exists and pull it
        echo "Checking for existing cache image..."
        CACHE_ARGS=""
        if curl -s "http://$LOCAL_REGISTRY/v2/jskala/nfoguard/manifests/buildcache" > /dev/null 2>&1; then
          echo "✅ Cache manifest found, pulling image..."
          if docker pull "$CACHE_IMAGE" 2>/dev/null; then
            echo "✅ Cache image pulled successfully"
            CACHE_ARGS="--cache-from=$CACHE_IMAGE"
          else
            echo "⚠️ Cache manifest exists but pull failed"
          fi
        else
          echo "ℹ️ No cache image found (first build or cache expired)"
        fi
        
        # Build with cache (if available)
        echo "Building with layer caching..."
        docker build \
          $CACHE_ARGS \
          --tag nfoguard:latest \
          --tag nfoguard:${{ github.sha }} \
          --tag "$CACHE_IMAGE" \
          .
        
        echo "Docker image built and tagged successfully"
        
        # Show layer info for debugging
        echo "=== Image layer history ==="
        docker history nfoguard:latest --format "table {{.CreatedBy}}\t{{.Size}}" | head -5

    - name: Login and Push to Gitea registry (local IP only)
      run: |
        echo "Using LOCAL IP ONLY - no Cloudflare tunnel!"
        export DOCKER_CONFIG=/tmp/docker-config
        
        # Force local IP - never use domain
        LOCAL_REGISTRY="192.168.253.221:3000"
        echo "Registry: $LOCAL_REGISTRY (LOCAL IP ONLY)"
        
        # Check image size
        IMAGE_SIZE=$(docker images nfoguard:latest --format "table {{.Size}}" | tail -n1)
        echo "Image size: $IMAGE_SIZE"
        
        echo "Testing local registry connectivity..."
        curl -s "http://$LOCAL_REGISTRY/v2/" && echo "✅ Local registry accessible via HTTP" || echo "❌ Local registry not accessible"
        
        # Configure Docker to skip TLS for this specific registry
        export DOCKER_OPTS="--insecure-registry=$LOCAL_REGISTRY"
        
        # Create a script that forces HTTP for our local registry
        cat > /tmp/docker-local << EOF
        #!/bin/bash
        export DOCKER_TLS_VERIFY=""
        export DOCKER_HOST=""
        exec docker "\$@"
        EOF
        chmod +x /tmp/docker-local
        
        # Try multiple approaches to handle the HTTP issue
        echo "Attempting login to LOCAL registry..."
        
        # Approach 1: Try with explicit HTTP in auth
        if echo "${{ secrets.token }}" | docker --config $DOCKER_CONFIG login "$LOCAL_REGISTRY" -u "${{ secrets.username }}" --password-stdin 2>/dev/null; then
          echo "✅ Login succeeded with direct method"
        else
          echo "⚠️ Direct login failed, trying workarounds..."
          
          # Approach 2: Try to modify the login URL handling
          export DOCKER_BUILDKIT=0
          if echo "${{ secrets.token }}" | timeout 30 docker --config $DOCKER_CONFIG login "$LOCAL_REGISTRY" -u "${{ secrets.username }}" --password-stdin; then
            echo "✅ Login succeeded with workaround"
          else
            echo "❌ All login attempts failed"
            echo "The issue is Docker client trying HTTPS on HTTP registry"
            echo "We need to configure the Docker daemon on the host to allow insecure registries"
            echo ""
            echo "SOLUTION: Run this on the host machine:"
            echo "sudo mkdir -p /etc/docker"
            echo 'echo '"'"'{"insecure-registries":["'$LOCAL_REGISTRY'"]}'"'"' | sudo tee /etc/docker/daemon.json'
            echo "sudo systemctl restart docker"
            echo ""
            echo "For now, continuing without registry push (build succeeded)"
            exit 0
          fi
        fi
        
        # Tag for local registry (cache image already tagged in build step)
        docker tag nfoguard:latest "$LOCAL_REGISTRY/jskala/nfoguard:latest"
        docker tag nfoguard:latest "$LOCAL_REGISTRY/jskala/nfoguard:${{ github.sha }}"
        
        echo "Pushing to LOCAL registry (gigabit speed!)..."
        
        # Push with reasonable timeout for local network
        echo "=== Pushing cache image (for faster future builds) ==="
        timeout 60 docker --config $DOCKER_CONFIG push "$LOCAL_REGISTRY/jskala/nfoguard:buildcache" && echo "✅ Cache image pushed" || echo "⚠️ Cache push failed"
        
        echo "=== Pushing latest tag to LOCAL IP ==="
        if timeout 120 docker --config $DOCKER_CONFIG push "$LOCAL_REGISTRY/jskala/nfoguard:latest"; then
          echo "✅ Latest tag pushed successfully to LOCAL registry"
          
          echo "=== Pushing SHA tag to LOCAL IP ==="
          if timeout 60 docker --config $DOCKER_CONFIG push "$LOCAL_REGISTRY/jskala/nfoguard:${{ github.sha }}"; then
            echo "✅ SHA tag pushed successfully to LOCAL registry"
          else
            echo "⚠️ SHA tag push failed but latest succeeded"
          fi
          
        else
          echo "❌ Push to LOCAL registry failed"
          echo "This is likely because Docker daemon needs insecure-registry configuration"
          echo "Image is built successfully and available locally"
        fi
        
        echo "🎉 Build workflow completed (using LOCAL network only)!"

  deploy:
    needs: build
    runs-on: host
    if: github.ref == 'refs/heads/main'
    
    steps:
    - name: Deploy application
      run: |
        echo "Deploying application..."
        # Add your deployment commands here
        # Examples:
        # docker-compose pull
        # docker-compose up -d
        # or
        # docker stop nfoguard || true
        # docker run -d --name nfoguard -p 8080:8080 nfoguard:latest
        echo "Deployment completed"