#!/usr/bin/env bash
# HERALD — deploy SOLARGOD to the VPS (rsync + systemd + nginx), mirroring the
# godstrument.pro shape. Run from the repo root AFTER the DNS A record resolves.
#   DOMAIN=orrery.example.com VPS=user@host ./deploy/deploy.sh
# Idempotent: re-run to push updates (rsync --delete + service restart).
set -euo pipefail
: "${VPS:?set VPS=user@host}"
: "${DOMAIN:?set DOMAIN=your.domain}"
APP=/opt/solargod

echo "→ syncing repo to $VPS:$APP"
rsync -az --delete \
  --exclude '.git' --exclude 'cache' --exclude 'assets/art/candidates' \
  ./ "$VPS:$APP/"

echo "→ installing service + nginx site on $VPS (domain: $DOMAIN)"
ssh "$VPS" "bash -euo pipefail -s" <<EOF
sudo install -m 644 $APP/deploy/solargod.service /etc/systemd/system/solargod.service
sed 's/SOLARGOD_DOMAIN/$DOMAIN/g' $APP/deploy/nginx-solargod.conf \
  | sudo tee /etc/nginx/sites-available/solargod >/dev/null
sudo ln -sf /etc/nginx/sites-available/solargod /etc/nginx/sites-enabled/solargod
sudo mkdir -p $APP/cache && sudo chown -R www-data:www-data $APP/cache
sudo systemctl daemon-reload
sudo systemctl enable --now solargod
sudo systemctl restart solargod
sudo nginx -t && sudo systemctl reload nginx
EOF

echo "✓ deployed. TLS:  ssh $VPS 'sudo certbot --nginx -d $DOMAIN'"