#!/usr/bin/env bash
# deploy/cleura/portfolio-sync.sh – Immich "portfolio" tag -> this repo -> imagesbyolofsson.se, on the Cleura server.
#
# Replaces /opt/immich-sync/run-sync.sh on Nurem (started by n8n over SSH) when imagesbyolofsson.se moved to Cleura
# (Linus 2026-11-06: everything on the Cleura server). Same steps: fetch main, run scripts/portfolio-sync.mjs,
# commit + push to Gitea main when photos were added or removed, and then rebuild the live site with
# /opt/portal/site/build-live.sh (EXIF check included). Nothing is built when nothing changed.
#
# Installed by deploy/cleura/install-portfolio-sync.sh as /opt/portal/site/portfolio-sync.sh, run by
# portfolio-sync.timer every 20 minutes. Secrets: /etc/portal/portfolio-sync.env (root 600) with
# IMMICH_URL, PORTFOLIO_TAG_ID, IMMICH_API_KEY (read-only Immich key) and GIT_URL (Gitea URL that may push main).
set -euo pipefail
ENVF=${PORTFOLIO_SYNC_ENV:-/etc/portal/portfolio-sync.env}
DIR=${PORTFOLIO_SYNC_DIR:-/opt/portal/site/sync/repo}
NODE=node:22.22.0-alpine@sha256:e4bf2a82ad0a4037d28035ae71529873c069b13eb0455466ae0bc13363826e34

exec 9>/run/lock/portfolio-sync.lock
flock -n 9 || { echo "[sync] already running"; exit 0; }

set -a; . "$ENVF"; set +a
export IMMICH_URL="${IMMICH_URL:-https://foto.imagesbyolofsson.se/api}"
export PORTFOLIO_TAG_ID="${PORTFOLIO_TAG_ID:-67d16b6c-0dea-42ef-a289-2c9e57fa5c5a}"
[ -n "${IMMICH_API_KEY:-}" ] || { echo "FATAL: IMMICH_API_KEY missing in $ENVF"; exit 2; }
[ -n "${GIT_URL:-}" ] || { echo "FATAL: GIT_URL missing in $ENVF"; exit 2; }

if [ ! -d "$DIR/.git" ]; then
  mkdir -p "$(dirname "$DIR")"
  git clone -q "$GIT_URL" "$DIR"
fi
git -C "$DIR" remote set-url origin "$GIT_URL"
echo "[sync] fetch + reset main"
git -C "$DIR" fetch -q origin main
git -C "$DIR" checkout -q -B main origin/main
git -C "$DIR" reset -q --hard origin/main

echo "[sync] scripts/portfolio-sync.mjs"
docker run --rm --memory 2g --cpus 2 --network bridge \
  -e IMMICH_URL -e IMMICH_API_KEY -e PORTFOLIO_TAG_ID \
  -v "$DIR":/app -w /app "$NODE" \
  sh -c 'npm install --no-audit --no-fund --loglevel=error >/dev/null && node scripts/portfolio-sync.mjs'

if git -C "$DIR" status --porcelain -- src/assets/images/portfolio | grep -q .; then
  git -C "$DIR" add -A src/assets/images/portfolio
  git -C "$DIR" -c user.name="portfolio-sync (Cleura)" -c user.email="Admin@imagesbyolofsson.se" \
    commit -q -m "chore(portfolio): sync $(date -u +%Y-%m-%d)"
  git -C "$DIR" push -q origin main
  echo "[sync] pushed $(git -C "$DIR" rev-parse --short HEAD), rebuilding the live site"
  /opt/portal/site/build-live.sh main
else
  echo "[sync] no changes"
fi