name: Deploy krustyplanet.org
on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    container:
      image: node:22-bookworm
      volumes:
        - /home/agent/.ssh:/home/root/.ssh:ro
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install system dependencies
        run: apt-get update && apt-get install -y rsync openssh-client

      - name: Setup SSH
        run: |
          mkdir -p ~/.ssh
          cp /home/root/.ssh/id_ed25519 ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          chmod 700 ~/.ssh
          echo "5.161.214.55 ssh-ed25519 $(ssh-keyscan -t ed25519 5.161.214.55 2>/dev/null | awk '{print $3}')" > ~/.ssh/known_hosts

      - name: Deploy to clearnet
        run: |
          rsync -avz --delete \
            --exclude '.git' \
            --exclude '.forgejo' \
            --exclude 'terraform' \
            --exclude 'research' \
            ./ root@5.161.214.55:/var/www/krustyplanet/

      - name: Sync eepsite from clearnet
        run: |
          ssh root@5.161.214.55 bash -s << 'SCRIPT'
          set -euo pipefail

          CLEARNET="/var/www/krustyplanet"
          EEPSITE="/var/www/eepsite"

          # Sync shared static assets
          rsync -av --delete "$CLEARNET/css/" "$EEPSITE/css/"
          rsync -av --delete "$CLEARNET/js/" "$EEPSITE/js/"
          cp "$CLEARNET/favicon.svg" "$EEPSITE/favicon.svg"

          # Shared pages to sync
          SHARED_PAGES=("index.html" "services.html" "pricing.html" "contact.html")

          for page in "${SHARED_PAGES[@]}"; do
            cp "$CLEARNET/$page" "$EEPSITE/$page"

            # Replace I2P self-reference with clearnet link
            sed -i 's|🔒 I2P:</span>.*</p>|🌐 Clearnet:</span> <a href="https://krustyplanet.org" style="color:#b5b5b5;">https://krustyplanet.org</a></p>|' "$EEPSITE/$page"

            # Remove nav links to clearnet-only pages
            sed -i '/href="\/free-audit\.html"/d' "$EEPSITE/$page"
            sed -i '/href="\/blog\.html"/d' "$EEPSITE/$page"
          done

          # Add I2P privacy notice to contact form
          sed -i '/<form id="contact-form">/a\
              <div class="notification is-warning is-light" style="font-size:0.85em;padding:0.75rem 1rem;">\
                <strong>⚠ I2P Privacy Notice:</strong> Your message will be sent to the site operator via email <em>outside</em> the I2P network. Please do not include anything you would not share on the clearnet.\
              </div>' "$EEPSITE/contact.html"

          echo "Eepsite synced."
          SCRIPT