#!/usr/bin/env nu
def main [
    --workspace: string = ""
    --hetzner-context: string = ""
    --bootstrap-zot-url: string = ""
    --ops-controller-key: string = ""
    --dry-run
]: nothing -> nothing {
    let ws        = if ($workspace          | is-not-empty) { $workspace }          else { $env.PLAYBOOK_PARAM_WORKSPACE?         | default "libre-wuji" }
    let htz_ctx   = if ($hetzner_context    | is-not-empty) { $hetzner_context }    else { $env.PLAYBOOK_PARAM_HETZNER_CONTEXT?    | default "" }
    let bs_zot    = if ($bootstrap_zot_url  | is-not-empty) { $bootstrap_zot_url }  else { $env.PLAYBOOK_PARAM_BOOTSTRAP_ZOT_URL?  | default "" }
    let ctrl_key  = if ($ops_controller_key | is-not-empty) { $ops_controller_key } else { $env.PLAYBOOK_PARAM_OPS_CONTROLLER_KEY? | default "" }

    if ($ws | is-empty) { error make { msg: "workspace is required" } }
    if ($htz_ctx | is-empty) { error make { msg: "hetzner-context is required" } }

    if $dry_run {
        print $"[dry-run] would deploy ($ws) cluster with bootstrap-zot=($bs_zot)"
        return
    }

    let env_override = { HCLOUD_CONTEXT: $htz_ctx, BOOTSTRAP_ZOT_URL: $bs_zot }

    let deploy_r = do { with-env $env_override { ^prvng cluster deploy --workspace $ws } } | complete
    if $deploy_r.exit_code != 0 {
        error make { msg: $"prvng cluster deploy failed: ($deploy_r.stderr | str trim)" }
    }
    print $deploy_r.stdout

    let wait_r = do { ^prvng cluster wait-ready --workspace $ws --timeout 900 } | complete
    if $wait_r.exit_code != 0 {
        error make { msg: "libre-wuji cluster did not become ready within 15m" }
    }

    if ($ctrl_key | is-not-empty) and ($ctrl_key | path exists) {
        let key_b64 = open $ctrl_key | ^base64 | str trim
        let patch_r = do { ^kubectl create secret generic ops-controller-key --namespace "ops-system" --from-literal $"private-key=($key_b64)" --dry-run=client --output yaml } | complete
        if $patch_r.exit_code != 0 {
            print "WARNING: could not stage ops-controller-key secret — set manually before ops-controller starts"
        } else {
            let apply_r = do { $patch_r.stdout | ^kubectl apply --filename - } | complete
            if $apply_r.exit_code != 0 {
                print $"WARNING: ops-controller-key secret apply failed: ($apply_r.stderr | str trim)"
            } else {
                print "ops-controller-key secret created"
            }
        }
    }

    print $"libre-wuji cluster deployed and ready"
}