#!/usr/bin/env bash
# Run this FROM the laptop (Git Bash / WSL / any bash with ssh+tar).
# Ships the current app source to the VPS staging deploy and restarts the service.
#
# What it actually does: tars app/, requirements.txt, deploy/ locally (excluding secrets and
# junk), streams the tarball over ssh, extracts it into /opt/lfcs-signon on the box, reinstalls
# requirements (cheap no-op if unchanged), then restarts lfcs-signon.service.
#
# Windows has no rsync out of the box, and the VPS copy was made the same way, so this keeps
# push and initial-deploy identical instead of depending on a tool that isn't there.
#
# It NEVER touches .env or sa.json on the box — those are staging-only config, not shipped code.
set -euo pipefail

HOST="root@134.199.153.159"
REMOTE_DIR="/opt/lfcs-signon"
LOCAL_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"

echo "Pushing $LOCAL_DIR -> $HOST:$REMOTE_DIR"

cd "$LOCAL_DIR"
tar czf - \
  --exclude=.env --exclude=.git --exclude=__pycache__ --exclude='*.pyc' \
  --exclude=.venv --exclude=bin --exclude='*.log' \
  --exclude='tools/rollup-out' --exclude='tools/toolbox/out' \
  --exclude='qr-*.png' \
  app requirements.txt README.md deploy \
  | ssh -o BatchMode=yes "$HOST" "tar xzf - -C '$REMOTE_DIR'"

echo "Code synced. Reinstalling requirements + restarting service..."
ssh -o BatchMode=yes "$HOST" "
  cd '$REMOTE_DIR' &&
  .venv/bin/pip install -q -r requirements.txt &&
  systemctl restart lfcs-signon &&
  sleep 1 &&
  systemctl is-active lfcs-signon
"

echo "Done. Smoke-check with: ssh $HOST bash $REMOTE_DIR/smoke.sh"