# Drone CI/CD for iLED shop — build on desktop agent, deploy to Pi via SSH.

kind: pipeline
type: docker
name: ci

platform:
  os: linux
  arch: amd64

dns:
  - 192.168.0.64

clone:
  depth: 50

concurrency:
  limit: 1

steps:
  - name: api
    image: mcr.microsoft.com/dotnet/sdk:10.0
    pull: false
    environment:
      DOTNET_CLI_TELEMETRY_OPTOUT: "1"
      DOTNET_NOLOGO: "1"
      NUGET_PACKAGES: /drone-cache/nuget
      NUGET_HTTP_CACHE_PATH: /drone-cache/nuget-http
      DOTNET_CLI_HOME: /drone-cache/dotnet
      NUGET_XMLDOC_MODE: skip
    commands:
      - cd src/backend
      - dotnet restore iLED.slnx
      - dotnet build iLED.slnx -c Release --no-restore

  - name: shop
    image: node:22-bookworm
    pull: false
    environment:
      npm_config_cache: /drone-cache/npm
    commands:
      - cd src/shop
      - npm ci --prefer-offline
      - npm run build -- --configuration=production
    depends_on:
      - api

  - name: admin
    image: node:22-bookworm
    pull: false
    environment:
      npm_config_cache: /drone-cache/npm
    commands:
      - cd src/admin
      - npm ci --prefer-offline
      - npm run build -- --configuration=production
    depends_on:
      - api

  - name: docker-api
    image: plugins/docker
    pull: false
    settings:
      repo: registry.zea.lt/miczek/iled-api
      registry: registry.zea.lt
      platform: linux/arm64
      username:
        from_secret: registry_username
      password:
        from_secret: registry_password
      dockerfile: docker/Dockerfile.api
      context: .
      tags:
        - latest
        - ${DRONE_COMMIT_SHA:0:7}
    depends_on:
      - api

  - name: docker-shop
    image: plugins/docker
    pull: false
    settings:
      repo: registry.zea.lt/miczek/iled-shop
      registry: registry.zea.lt
      platform: linux/arm64
      username:
        from_secret: registry_username
      password:
        from_secret: registry_password
      dockerfile: docker/Dockerfile.shop
      context: .
      tags:
        - latest
        - ${DRONE_COMMIT_SHA:0:7}
    depends_on:
      - shop

  - name: docker-admin
    image: plugins/docker
    pull: false
    settings:
      repo: registry.zea.lt/miczek/iled-admin
      registry: registry.zea.lt
      platform: linux/arm64
      username:
        from_secret: registry_username
      password:
        from_secret: registry_password
      dockerfile: docker/Dockerfile.admin
      context: .
      tags:
        - latest
        - ${DRONE_COMMIT_SHA:0:7}
    depends_on:
      - admin

trigger:
  event:
    - push
    - pull_request
    - custom

---
kind: pipeline
type: docker
name: deploy

platform:
  os: linux
  arch: amd64

dns:
  - 192.168.0.64

depends_on:
  - ci

clone:
  disable: true

concurrency:
  limit: 1

steps:
  # appleboy/drone-ssh misbehaves with clone:disable (local git error).
  # Plain OpenSSH from alpine is reliable.
  - name: ssh-deploy
    image: alpine:3.20
    pull: false
    environment:
      SSH_HOST:
        from_secret: ssh_host
      SSH_USER:
        from_secret: ssh_user
      SSH_KEY:
        from_secret: ssh_key
      SSH_PORT:
        from_secret: ssh_port
      REGISTRY_USERNAME:
        from_secret: registry_username
      REGISTRY_PASSWORD:
        from_secret: registry_password
    commands:
      - apk add --no-cache openssh-client
      - mkdir -p /root/.ssh && chmod 700 /root/.ssh
      - printenv SSH_KEY > /root/.ssh/id_ed25519 && chmod 600 /root/.ssh/id_ed25519
      # Escape secrets as $$… so Drone does not pre-expand them to empty.
      - |
        ssh -i /root/.ssh/id_ed25519 \
          -p "$$SSH_PORT" \
          -o StrictHostKeyChecking=accept-new \
          -o BatchMode=yes \
          "$$SSH_USER@$$SSH_HOST" \
          "export DRONE_COMMIT_SHA='${DRONE_COMMIT_SHA}' REGISTRY_USERNAME='$$REGISTRY_USERNAME' REGISTRY_PASSWORD='$$REGISTRY_PASSWORD'; bash -s" <<'EOS'
        set -euo pipefail
        cd /opt/iled-shop
        git fetch origin
        git checkout "$$DRONE_COMMIT_SHA"
        echo "$$REGISTRY_PASSWORD" | docker login registry.zea.lt -u "$$REGISTRY_USERNAME" --password-stdin
        cd docker
        docker compose pull
        docker compose up -d --remove-orphans
        # Traefik is on external `homelab`. Recreate can leave edge
        # containers on project `iled` only → gateway timeout.
        for c in iled-api iled-shop iled-admin; do
          docker network connect homelab "$$c" 2>/dev/null || true
          docker inspect -f \
            '{{range $$k, $$v := .NetworkSettings.Networks}}{{println $$k}}{{end}}' \
            "$$c" | grep -qx homelab
        done
        docker compose ps
        docker logout registry.zea.lt || true
        EOS

trigger:
  branch:
    - master
    - main
  event:
    - push
    - custom