name: Terraform Apply

on:
  push:
    branches:
      - main
    paths:
      - "terraform/k8sapps/**"
      - .github/workflows/terraform-k8apps-apply.yaml

jobs:
  terraform-apply:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v2

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v1
        with:
          terraform_version: 1.9.6

      - name: Setup Sectool
        uses: a13labs/setup-sectool@v1

      - name: Install Python and required packages
        run: |
          sudo apt-get update
          sudo apt-get install -y python3-pip
          python3 -m pip install -r requirements.txt

      - name: Setup SSH Key
        env:
          VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
        run: |
          sectool ssh unlock ansible
          mkdir -p ~/.ssh
          chmod 700 ~/.ssh
          cp ssh-keys/ansible/id_ecdsa ~/.ssh/id_ecdsa
          chmod 600 ~/.ssh/id_ecdsa

      - name: Read SSH Trusted Hosts keys
        env:
          TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }}
        run: |
          mkdir -p ~/.ssh
          for HOST in $TRUSTED_HOSTS; do
            ssh-keyscan $HOST >> ~/.ssh/known_hosts
          done
          chmod 600 ~/.ssh/known_hosts

      - name: Start SSH Agent
        env:
          VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
          SSH_AUTH_SOCK: /tmp/ssh_agent.sock
        run: |
          ssh-agent -a $SSH_AUTH_SOCK > /dev/null
          echo 'sectool vault get SSH_PASSWORD' > ~/.ssh_askpass && chmod +x ~/.ssh_askpass
          DISPLAY=None SSH_ASKPASS=~/.ssh_askpass ssh-add ~/.ssh/id_ecdsa < /dev/null
          rm ~/.ssh_askpass

      - name: Check SSH Connection to remote hosts
        env:
          TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }}
          ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }}
          SSH_AUTH_SOCK: /tmp/ssh_agent.sock
        run: |
          for HOST in $TRUSTED_HOSTS; do
            ssh $ANSIBLE_USER@$HOST echo "SSH connection to $HOST successful"
          done

      - name: Copy Kube Config from remote host
        env:
          VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
          ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }}
          SSH_AUTH_SOCK: /tmp/ssh_agent.sock
        run: |
          mkdir -p ~/.kube
          ansible -i ansible/inventory/hosts -u $ANSIBLE_USER -m fetch -a "src=/home/$ANSIBLE_USER/.kube/config dest=~/.kube/config flat=yes" microk8s

      - name: Terraform Init
        env:
          VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
        run: |
          cd terraform/k8sapps
          sectool exec terraform init

      - name: Terraform Apply
        env:
          VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
          ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }}
          SSH_AUTH_SOCK: /tmp/ssh_agent.sock
          TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }}
        run: |
          for HOST in $TRUSTED_HOSTS; do
            ssh -f -N -L 16443:localhost:16443 $ANSIBLE_USER@$HOST
            # override hosts address in kube config
            sed -i "s/server: https:\/\/$HOST:16443/server: https:\/\/localhost:16443/g" ~/.kube/config
            cd terraform/k8sapps
            sectool exec terraform apply --auto-approve
            pkill -f "ssh -f -N -L 16443:localhost:16443 $ANSIBLE_USER@$HOST"
          done