#!/usr/bin/env bash
# Manual production promotion — the one deliberate non-automatic step in the pipeline
# (docs/PHASE4_PRODUCTION_INFRASTRUCTURE.md §18: automatic test/build/staging, manual
# production promotion). Run by a human after reviewing the staging smoke test result.
#
# Usage: ./deploy-production.sh <image-tag>
#   e.g. ./deploy-production.sh sha-abc123def456
#        ./deploy-production.sh v1.2.0
set -euo pipefail
cd "$(dirname "$0")/../ansible"

IMAGE_TAG="${1:?usage: deploy-production.sh <image-tag>}"
DEPLOY_LOG="/opt/rootnode/deploy-history.log"   # append-only — rollback.sh reads the entry
                                                  # before the most recent one from this file

echo "About to deploy image_tag=$IMAGE_TAG to PRODUCTION (rn-platform-01 + rn-lab-host-01)."
echo "This assumes it already passed CI + the staging smoke test."
if [ -f "$DEPLOY_LOG" ]; then
  echo "Currently deployed (per $DEPLOY_LOG): $(tail -1 "$DEPLOY_LOG")"
fi
read -r -p "Type DEPLOY to continue: " CONFIRM
[ "$CONFIRM" = "DEPLOY" ] || { echo "Aborted."; exit 1; }

ansible-playbook site.yml -i inventory/production.ini \
  -e "image_tag=$IMAGE_TAG" \
  --vault-password-file .vault_pass

echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) $IMAGE_TAG" >> "$DEPLOY_LOG"
echo "==> Deployed. Run infra/scripts/production-smoke-test.sh to verify, then the relevant"
echo "    section of docs/PRODUCTION_VALIDATION_CHECKLIST.md."