#!/usr/bin/env bash
# Move Gitea and its MCP server to public HTTPS on bikoret.ch and switch
# the MCP server to MCP OAuth (2026-10-19). Run by the transmitter:
#   ! bash ~/.local/bin/gitea-public-apply
# Idempotent. Needs DNS first: git.bikoret.ch and mcp.bikoret.ch → 185.19.28.170.
#
# Rollback (static-token mode on mcp.shorashim.ch, as before 2026-10-19):
#   kubectl -n temple-council set env deploy/gitea \
#     GITEA__server__ROOT_URL=http://gitea.temple-council.ch/ \
#     GITEA__server__DOMAIN=gitea.temple-council.ch GITEA__server__SSH_DOMAIN-
#   then restore deploy/k8s/gitea-mcp-*.yaml from commit 861cd4e6 and apply them.
set -euo pipefail
REPO="${REPO:-$HOME/bikoret}"
cd "$REPO"
NLB=185.19.28.170
for h in git.bikoret.ch mcp.bikoret.ch; do
  ip=$(dig +short "$h" | tail -1 || true)
  if [ "$ip" != "$NLB" ]; then
    echo "DNS: $h → '${ip:-nothing}' (need $NLB). Add the A record at Infomaniak first." >&2
    exit 2
  fi
done
echo "== 1/4 ingresses (certificates issue once DNS resolves)"
kubectl apply -f deploy/k8s/gitea-ingress.yaml
kubectl apply -f deploy/k8s/gitea-mcp-ingress.yaml
echo "== 2/4 Gitea ROOT_URL → https://git.bikoret.ch/ (one restart)"
kubectl -n temple-council patch deploy gitea --patch-file deploy/k8s/gitea-public-patch.yaml
kubectl -n temple-council rollout status deploy/gitea --timeout=180s
echo "== 3/4 gitea-mcp in OAuth mode at https://mcp.bikoret.ch"
kubectl apply -f deploy/k8s/gitea-mcp-deployment.yaml
kubectl -n shorashim rollout status deploy/gitea-mcp --timeout=120s
echo "== 4/4 certificates"
for i in $(seq 1 24); do
  ready=$(kubectl get certificate -A -o jsonpath='{range .items[?(@.metadata.name=="gitea-bikoret-tls")]}{.status.conditions[?(@.type=="Ready")].status}{end}{range .items[?(@.metadata.name=="gitea-mcp-bikoret-tls")]}{.status.conditions[?(@.type=="Ready")].status}{end}' 2>/dev/null || true)
  [ "$ready" = "TrueTrue" ] && break
  sleep 5
done
kubectl get certificate -A | grep -E "NAME|bikoret"
echo "== verify"
bash "$REPO/deploy/k8s/gitea-public-verify.sh"