name: infra

on:
  workflow_call:
    inputs:
      limit:
        description: 'Ansible hosts'
        type: string
        default: all
        required: false
  workflow_dispatch:
    inputs:
      limit:
        description: 'Ansible hosts'
        type: string
        default: all
        required: false

jobs:
  maintenance:
    runs-on: ubuntu-latest
    env:
      AWS_ACCESS_KEY_ID: '${{ secrets.AWS_ACCESS_KEY_ID }}'
      AWS_SECRET_ACCESS_KEY: '${{ secrets.AWS_SECRET_ACCESS_KEY }}'
      DIGITALOCEAN_TOKEN: '${{ secrets.DIGITALOCEAN_TOKEN }}'
      YC_SERVICE_ACCOUNT_KEY_FILE: '${{ secrets.YC_SERVICE_ACCOUNT_KEY_FILE }}'
    steps:
      - name: Set up Terraform
        uses: hashicorp/setup-terraform@v4
      - name: Configure SSH
        run: |
          mkdir -p ~/.ssh
          cat > ~/.ssh/config <<'EOF'
          StrictHostKeyChecking no
          EOF
      - name: Set up ssh-agent
        uses: webfactory/ssh-agent@v0.10.0
        with:
          ssh-private-key: '${{ secrets.SSH_KEY }}'
      - name: Checkout
        run: |
          git clone -q ssh://git@bitbucket.org/egor-tensin/infra.git
      - name: Configure git
        run: |
          git config --global user.name 'Egor Tensin'
          git config --global user.email 'egor@tensin.name'
      - name: Run maintenance
        run: |
          make -C infra maintenance 'LIMIT=${{ inputs.limit }}'
      - name: Set up WireGuard
        uses: egor-tensin/setup-wireguard@v1
        with:
          endpoint: '${{ secrets.WG_ENDPOINT }}'
          endpoint_public_key: '${{ secrets.WG_ENDPOINT_PUBLIC }}'
          ips: '${{ secrets.WG_IPS }}'
          allowed_ips: '${{ secrets.WG_ALLOWED_IPS }}'
          private_key: '${{ secrets.WG_PRIVATE }}'
          preshared_key: '${{ secrets.WG_PRESHARED }}'
      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo DEBIAN_FRONTEND=noninteractive apt-get install -yq --no-install-recommends nmap
      - name: Check ports
        run: |
          sudo ./infra/utils/check_ports.py