#!/bin/bash
set -euo pipefail

RELEASE="${RELEASE:-$(git rev-parse --short HEAD)}"
PUBLIC_SOURCEMAPS="${PUBLIC_SOURCEMAPS:-false}"
UPLOAD_SOURCEMAPS="${UPLOAD_SOURCEMAPS:-true}"

echo "Building Needle 3 sidecar image..."
docker build -t matst80/needle-sidecar:latest cmd/needle-sidecar
docker push matst80/needle-sidecar:latest

echo "Building otel-debug receiver image..."
docker build \
  --build-arg "APP_RELEASE=${RELEASE}" \
  --build-arg "PUBLIC_SOURCEMAPS=${PUBLIC_SOURCEMAPS}" \
  -t matst80/otel-debug:latest .

docker push matst80/otel-debug:latest

# Shared key that only keeps strangers from uploading source maps (it is not a
# real credential). Taken from the environment, else from the cluster secret,
# else generated and stored there so the deployment can mount it.
ensure_sourcemap_key() {
  if [[ -z "${OTEL_SOURCEMAP_KEY:-}" ]]; then
    OTEL_SOURCEMAP_KEY="$(kubectl get secret otel-sourcemap-key -n monitoring \
      -o jsonpath='{.data.key}' 2>/dev/null | base64 -d || true)"
  fi
  if [[ -z "${OTEL_SOURCEMAP_KEY}" ]]; then
    OTEL_SOURCEMAP_KEY="$(openssl rand -hex 24)"
  fi
  kubectl create secret generic otel-sourcemap-key -n monitoring \
    --from-literal=key="${OTEL_SOURCEMAP_KEY}" --dry-run=client -o yaml | kubectl apply -f - >/dev/null
  export OTEL_SOURCEMAP_KEY
}
ensure_sourcemap_key

# Roll out first: the new image requires OTEL_SOURCEMAP_KEY, so the manifest has
# to be applied before uploads, or any pod restart in between rejects them.
# Only the app manifests. Not `-f k8s/`: clickhouse.yaml carries a CHANGE_ME
# password Secret that would overwrite the live one, and auth-dev.yaml is a
# partial AuthServer that must be applied by hand with
# `kubectl apply --server-side --field-manager=otel-dev-auth -f k8s/auth-dev.yaml`.
kubectl apply -f k8s/deployment.yaml -f k8s/service.yaml -f k8s/ingress.yaml
kubectl rollout restart deployment otel-debug-receiver -n monitoring
kubectl rollout status deployment/otel-debug-receiver -n monitoring

# Docker builds intentionally omit public source maps. Upload maps from the
# exact UI build that went into the image right after rolling it out; until then
# RUM events can arrive with a release that the resolver cannot map.
if [[ "${UPLOAD_SOURCEMAPS}" == "true" ]]; then
  : "${OTEL_URL:?set OTEL_URL (for example https://otel.k6n.net), or set UPLOAD_SOURCEMAPS=false}"
  maps_dir="$(mktemp -d)"
  trap 'rm -rf "$maps_dir"' EXIT
  docker build --target ui-builder \
    --build-arg "APP_RELEASE=${RELEASE}" \
    -t otel-debug-ui-builder:"${RELEASE}" .
  cid="$(docker create otel-debug-ui-builder:"${RELEASE}")"
  docker cp "$cid:/app/dist" "$maps_dir/dist"
  docker rm "$cid" >/dev/null
  found=0
  while IFS= read -r -d '' map; do
    found=1
    bundle="${map%.map}"
    RELEASE="${RELEASE}" OTEL_URL="${OTEL_URL}" \
      ./scripts/upload-sourcemap.sh "$bundle"
  done < <(find "$maps_dir" -type f -name '*.js.map' -print0)
  [[ "$found" == 1 ]] || { echo "no source maps found in UI build" >&2; exit 1; }
fi

kubectl logs -f deployment/otel-debug-receiver -n monitoring