name: Deploy NixOS System Configurations to Silver-Flame Hosts

on:
  push:
    branches: [ main ]
    paths: [ 'homelab/silver-flame/**' ]

jobs:
  deploy:
    defaults:
      run: 
        working-directory: homelab/silver-flame
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Jafner.net repo
        uses: actions/checkout@v4
      - name: Install jq
        run: sudo apt-get update && sudo apt-get install jq
      - name: Install Nix
        uses: cachix/install-nix-action@v30
        with:
          github_access_token: ${{ secrets.RUNNER_GITHUB_TOKEN }}
          nix_path: nixpkgs=channel:nixos-24.05
      - name: Set up Cachix
        uses: cachix/cachix-action@v15
        with:
          name: jafnernet
          authToken: '${{ secrets.CACHIX_TOKEN }}'
          extraPullNames: nix-community
      - name: Set up deploy-rs
        run: nix build -o deploy github:serokell/deploy-rs#defaultPackage.x86_64-linux
      - name: Set up SSH
        run: |
          echo -e "${{ secrets.RUNNER_SSH_PRIVATEKEY }}" > /tmp/key
          chmod 600 /tmp/key
          nix eval --json .#deploy.nodes --apply 'builtins.attrValues' |\
          jq -r '.[].hostname' | xargs echo > /tmp/hostlist
          mkdir -p ~/.ssh && touch ~/.ssh/known_hosts && chmod 600 ~/.ssh/known_hosts
          for host in $(cat /tmp/hostlist); do 
            ssh-keyscan -t ed25519 $host >> ~/.ssh/known_hosts
          done
      - name: Dry-run deploy
        run: |
          ./deploy/bin/deploy --ssh-opts '-i /tmp/key' --dry-activate