#!/usr/bin/env bash
# 香港测试机公网部署入口（jxd.jinniu.ink）。由总工执行；施工员本卡不跑本脚本，也不 SSH 改现网。
# 用法: ./scripts/deploy-public.sh
# 回滚: ./scripts/rollback-public.sh
set -euo pipefail
cd "$(dirname "$0")/.."

if [ ! -f .env ]; then
  echo "没有 .env。先从 .env.example 复制，再按 deploy/public/.env.public.example 补公网项。" >&2
  exit 1
fi

# LiveKit --node-ip 依赖 SERVER_IP；空值时信令通、媒体宣告错误。
# 不 source .env（JPUSH_PUSH_INTENT 含分号）；只抽取这一项。
if [ -z "${SERVER_IP:-}" ]; then
  SERVER_IP="$(awk -F= '/^SERVER_IP=/{v=$2} END{print v}' .env | tr -d '[:space:]"')"
fi
if [ -z "${SERVER_IP}" ]; then
  echo "SERVER_IP 为空，拒绝启动。请在 .env 填写本机公网 IP（LiveKit 媒体候选用）。" >&2
  exit 1
fi

# 注入 Master Secret（失败则停，避免空密钥启动）
# shellcheck disable=SC1091
source ./scripts/load-jpush-secret.sh
if [ -z "${JPUSH_MASTER_SECRET:-}" ]; then
  echo "Master Secret 未注入，拒绝启动" >&2
  exit 1
fi

mkdir -p deploy/public/acme components/redis/config components/mnt/data components/mongodb components/etcd components/kafka
touch components/redis/config/redis.conf

docker compose \
  -f docker-compose.yaml \
  -f deploy/public/docker-compose.public.yaml \
  pull

docker compose \
  -f docker-compose.yaml \
  -f deploy/public/docker-compose.public.yaml \
  up -d

echo "已提交 compose 启动。检查: docker compose -f docker-compose.yaml -f deploy/public/docker-compose.public.yaml ps"
echo "证书未就绪时先用 nginx.bootstrap.conf 申请证书，见 deploy/public/README.md"