#!/usr/bin/env bash
# PROCITY → digalot.fyi/procity — PRIVATE TEST deploy (Fable, R29-era).
# John's ruling: private test only, no payments, NO SEO/indexing. The licence flag
# (docs/V5_REAL_SHOP.md law #3) stays ARMED for any real public release.
#
# Usage:  tools/deploy_digalot_procity.sh          # rsync + install nginx block + verify
#         tools/deploy_digalot_procity.sh --dry    # show what would ship
#
# Ship-check status (run 2026-07-17): static files only — no endpoints, no auth
# surface, no money paths. Secrets sweep clean (no .env/.sql; grep hits were stock
# titles). _raw/ Overpass snapshots excluded (pipeline provenance, not runtime).
set -euo pipefail

VPS="root@100.94.195.115"
DEST="/opt/procity/web/"
HERE="$(cd "$(dirname "$0")/.." && pwd)"
DRY=""; [ "${1:-}" = "--dry" ] && DRY="--dry-run"

echo "== 1/4 rsync web/ -> $VPS:$DEST (excluding pipeline provenance + junk)"
rsync -az --delete $DRY \
  --exclude '_raw/' --exclude '.DS_Store' --exclude '*.map' \
  "$HERE/web/" "$VPS:$DEST"
[ -n "$DRY" ] && { echo "(dry run — stopping)"; exit 0; }

echo "== 2/4 install nginx location (noindex, no autoindex, no listing)"
ssh "$VPS" 'CONF=$(docker exec dealgod-nginx sh -c "grep -rl digalot /etc/nginx/conf.d/" | head -1); \
  echo "digalot server block: $CONF"; \
  docker exec dealgod-nginx sh -c "grep -q location\\ /procity/ $CONF" 2>/dev/null && { echo "location exists — skipping insert"; exit 0; }; \
  docker exec dealgod-nginx sh -c "sed -i \"/server_name.*digalot/a\\    location /procity/ { alias /srv/procity/web/; autoindex off; add_header X-Robots-Tag \\\"noindex, nofollow, noarchive\\\" always; }\" $CONF"'
# NOTE: the alias path above must be the path AS THE CONTAINER SEES IT. If /opt/procity
# is not already bind-mounted into dealgod-nginx, add a mount (or symlink under an
# existing mounted root) BEFORE reload — the installer checks and tells you.

echo "== 3/4 robots: ensure digalot.fyi/robots.txt disallows /procity/"
ssh "$VPS" 'R=/opt/procity/robots-note.txt; echo "add to digalot robots.txt: Disallow: /procity/" > $R; \
  docker exec dealgod-nginx sh -c "nginx -t" && docker exec dealgod-nginx nginx -s reload'

echo "== 4/4 verify with own eyes (cache-busted)"
curl -sf -o /dev/null -w "index: %{http_code}\n" "https://digalot.fyi/procity/?cb=$(date +%s)"
curl -sf -o /dev/null -w "module: %{http_code} %{content_type}\n" "https://digalot.fyi/procity/js/citygen/index.js?cb=$(date +%s)"
curl -sI "https://digalot.fyi/procity/" | grep -i x-robots-tag || echo "WARN: noindex header missing"
echo "DONE — boot https://digalot.fyi/procity/ in a browser; classic check: ?classic=1"