#!/usr/bin/env bash
# Take shorashim.ch down from the cluster and rename Gitea's brand
# (2026-10-20). Run by the transmitter:
#   ! bash ~/.local/bin/shorashim-ch-takedown
# Idempotent.
#   1. Ingress `shorashim`: the shorashim.ch host rule is gone (service.yaml).
#      The no-host catch-all stays, so http://185.19.28.170/ still answers —
#      the name itself dies when its A record is removed at Infomaniak.
#   2. The orphan TLS secret for mcp.shorashim.ch is deleted.
#   3. Gitea APP_NAME "Shorashim" → "Bikoret" (gitea-public-patch.yaml; one restart).
set -euo pipefail
REPO="${REPO:-$HOME/bikoret}"
cd "$REPO"
echo "== 1/3 ingress without the shorashim.ch rule"
kubectl apply -f deploy/k8s/service.yaml
echo "== 2/3 orphan certificate secret for mcp.shorashim.ch"
kubectl -n shorashim delete secret gitea-mcp-tls --ignore-not-found
echo "== 3/3 Gitea brand → Bikoret"
kubectl -n temple-council patch deploy gitea --patch-file deploy/k8s/gitea-public-patch.yaml
kubectl -n temple-council rollout status deploy/gitea --timeout=180s
echo "== verify"
fail=0
hosts=$(kubectl get ingress -A -o jsonpath='{range .items[*]}{range .spec.rules[*]}{.host}{" "}{end}{end}')
case " $hosts " in *" shorashim.ch "*) echo "FAIL ingress still lists shorashim.ch"; fail=1;; *) echo "ok   no ingress rule for shorashim.ch";; esac
case "$(kubectl get secret -A -o name | grep -c 'gitea-mcp-tls$' || true)" in 0) echo "ok   gitea-mcp-tls secret gone";; *) echo "FAIL gitea-mcp-tls secret remains"; fail=1;; esac
title=$(curl -sS -m 15 https://git.bikoret.ch/ | grep -o -m1 '<title>[^<]*</title>' || echo none)
case "$title" in *Bikoret*) echo "ok   gitea title: $title";; *) echo "FAIL gitea title: $title"; fail=1;; esac
case "$(curl -sS -m 15 -o /dev/null -w '%{http_code}' https://bikoret.ch/kodesh/health || echo err)" in 200) echo "ok   bikoret.ch still healthy";; *) echo "FAIL bikoret.ch health"; fail=1;; esac
exit $fail