group 'docker' do
  append true
  members node['docker_webapps']['user']
end

# Pull Docker images
chef_gem 'aws-sdk-ecr' do
  version '1.58.0' # Pinned to old version due to https://github.com/chef/chef/issues/13808
end

ruby_block 'ecr login' do
  block do
    require 'aws-sdk-ecr'
    require 'base64'
    client = Aws::ECR::Client.new(region: 'us-east-1')
    resp = client.get_authorization_token
    token = resp.authorization_data.first.authorization_token
    username, password = Base64.decode64(token).split(':')
    node.run_state['ecr_username'] = username
    node.run_state['ecr_password'] = password
  end
end

node['docker_webapps']['images'].each do |_image, config|
  docker_registry config['registry'] do
    serveraddress config['registry']
    username lazy { node.run_state['ecr_username'] }
    password lazy { node.run_state['ecr_password'] }
  end

  docker_image "#{config['registry']}/#{config['name']}" do
    tag config['tag']
  end
end

# Configure GitHub SSH authentication
user_home = "/home/#{node['docker_webapps']['user']}"

directory user_home do
  owner node['docker_webapps']['user']
  group node['docker_webapps']['group']
  mode '0700'
end

directory "#{user_home}/.ssh" do
  owner node['docker_webapps']['user']
  group node['docker_webapps']['group']
  mode '0700'
end

github_key_data_bag = data_bag_item('secrets', node['docker_webapps']['github_ssh_key_data_bag_name'])
github_ssh_key = github_key_data_bag['private_key']

file "#{user_home}/.ssh/id_rsa" do
  owner node['docker_webapps']['user']
  group node['docker_webapps']['group']
  mode '0400'
  content github_ssh_key
  sensitive true
end

# Relax ssh host key checks or initial git clone will fail
key_config = "Host *\n\tStrictHostKeyChecking no\n"
file "#{user_home}/.ssh/config" do
  owner node['docker_webapps']['user']
  group node['docker_webapps']['group']
  mode '0600'
  content key_config
end

# Clone Git repositories
home_dir = "#{node['docker_webapps']['base_path']}/#{node['docker_webapps']['home_dir']}"

directory home_dir do
  owner node['docker_webapps']['user']
  group node['docker_webapps']['group']
  mode '755'
end

repos = %w(
  orchard
  api
  workstation
  frontend-workstation
  ansible-dev-box-setup
)

repos.each do |repo|
  directory "#{home_dir}/#{repo}" do
    owner node['docker_webapps']['user']
    group node['docker_webapps']['group']
    mode '755'
  end

  git "#{home_dir}/#{repo}" do
    user node['docker_webapps']['user']
    group node['docker_webapps']['group']
    repository "git@github.com:/theorchard/#{repo}.git"
    revision 'master'
  end
end

# Manually fetch and add GPG key with curl
execute 'add_gpg_key' do
  command 'curl -fsSL https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --dearmor -o /etc/apt/trusted.gpg.d/yarn.gpg'
  not_if { ::File.exist?('/etc/apt/trusted.gpg.d/yarn.gpg') }
end

# Install packages for ansible playbook
apt_repository 'yarn' do
  action :add
  uri 'https://dl.yarnpkg.com/debian'
  components ['main']
  distribution 'stable'
  signed_by '/etc/apt/trusted.gpg.d/yarn.gpg'
end

package 'yarn'
package 'ansible-core'

# Generate config for ansible playbook
github_token_data_bag = data_bag_item('secrets', node['docker_webapps']['github_token_data_bag_name'])
github_token = github_token_data_bag['token']

packagecloud_token_data_bag = data_bag_item('secrets', node['docker_webapps']['packagecloud_token_data_bag_name'])
packagecloud_token = packagecloud_token_data_bag['token']

art_relations_credentials_data_bag = data_bag_item('secrets', node['docker_webapps']['art_relations_credentials_data_bag_name'])
art_relations_user = art_relations_credentials_data_bag['user']
art_relations_password = art_relations_credentials_data_bag['password']

direct_delivery_credentials_data_bag = data_bag_item('secrets', node['docker_webapps']['direct_delivery_credentials_data_bag_name'])
direct_delivery_user = direct_delivery_credentials_data_bag['user']
direct_delivery_password = direct_delivery_credentials_data_bag['password']

aws_credentials_data_bag = data_bag_item('secrets', node['docker_webapps']['aws_credentials_data_bag_name'])
aws_key = aws_credentials_data_bag['aws_key']
aws_secret = aws_credentials_data_bag['aws_secret']

auth0_credentials_data_bag = data_bag_item('secrets', node['docker_webapps']['auth0_credentials_data_bag_name'])
tenant_auth0_client_secret = auth0_credentials_data_bag['client_secret']
tenant_auth0_machine_client_secret = auth0_credentials_data_bag['machine_client_secret']
tenant_auth0_mobile_client_secret = auth0_credentials_data_bag['mobile_client_secret']
tenant_auth0_oa_client_secret = auth0_credentials_data_bag['oa_client_secret']

snowflake_credentials_data_bag = data_bag_item('secrets', node['docker_webapps']['snowflake_credentials_data_bag_name'])
snowflake_user = snowflake_credentials_data_bag['user']
snowflake_role = snowflake_credentials_data_bag['role']
snowflake_private_key = snowflake_credentials_data_bag['private_key']
snowflake_key_passphrase = snowflake_credentials_data_bag['key_passphrase']
snowflake_private_key_path = "#{home_dir}/ansible-dev-box-setup/config/snowflake.p8"

file snowflake_private_key_path do
  content snowflake_private_key
  owner node['docker_webapps']['user']
  group node['docker_webapps']['group']
  mode '600'
  sensitive true
end

link "#{home_dir}/ansible-dev-box-setup/ansible/hosts/dev" do
  to "#{home_dir}/ansible-dev-box-setup/dev"
end

template "#{home_dir}/ansible-dev-box-setup/config/configs.yml" do
  source 'docker_webapps_ansible_configs.yml.erb'
  owner node['docker_webapps']['user']
  group node['docker_webapps']['group']
  mode '644'
  sensitive true
  variables(
    devorch_base_path: node['docker_webapps']['base_path'],
    devorch_home_dir: node['docker_webapps']['home_dir'],
    docker_port: node['docker_webapps']['docker_port'],
    docker_restart_policy: node['docker_webapps']['docker_restart_policy'],
    github_token: github_token,
    oa_domain_name: node['docker_webapps']['oa_domain_name'],
    orchard_email_address: node['docker_webapps']['email_to_address'],
    orchard_user_aws_key: aws_key,
    orchard_user_aws_secret: aws_secret,
    orchard_username: node['docker_webapps']['mysql_username'],
    packagecloud_token: packagecloud_token,
    snowflake_key_passphrase: snowflake_key_passphrase,
    snowflake_private_key_path: snowflake_private_key_path,
    snowflake_role: snowflake_role,
    snowflake_user: snowflake_user,
    snowflake_warehouse: node['docker_webapps']['snowflake_warehouse'],
    squad_mysql_host_art_relations: node['docker_webapps']['art_relations_host'],
    squad_mysql_host_direct_delivery: node['docker_webapps']['direct_delivery_host'],
    squad_mysql_password_art_relations: art_relations_password,
    squad_mysql_password_direct_delivery: direct_delivery_password,
    squad_mysql_user_art_relations: art_relations_user,
    squad_mysql_user_direct_delivery: direct_delivery_user,
    system_username: node['docker_webapps']['user'],
    tenant_auth0_client_secret: tenant_auth0_client_secret,
    tenant_auth0_machine_client_secret: tenant_auth0_machine_client_secret,
    tenant_auth0_mobile_client_secret: tenant_auth0_mobile_client_secret,
    tenant_auth0_oa_client_secret: tenant_auth0_oa_client_secret,
    vapi_domain_name: node['docker_webapps']['vapi_domain_name'],
    ws_domain_name: node['docker_webapps']['ws_domain_name'],
    your_name: node['docker_webapps']['email_to_name']
  )
  notifies :run, 'execute[run ansible playbook]', :immediately
end

execute 'run ansible playbook' do
  action :nothing
  command 'ansible-playbook -i ./ansible/hosts/dev ./ansible/devorch.yml --extra-var "SETUP_ENV=\'dev-box-aws\'"'
  cwd "#{home_dir}/ansible-dev-box-setup"
  user node['docker_webapps']['user']
  group node['docker_webapps']['group']
  login true
  live_stream true
  notifies :run, 'execute[start apps]', :immediately
end

execute 'start apps' do
  action :nothing
  command 'docker compose up -d --force-recreate'
  cwd home_dir
  user node['docker_webapps']['user']
  group node['docker_webapps']['group']
  login true
  live_stream true
end