#!/bin/bash
# EN: Setup K8s secrets for GoodGo staging deployment
# VI: Thiet lap K8s secrets cho GoodGo staging deployment
#
# Prerequisites:
#   - kubectl configured with cluster access
#   - Gitea repo admin/pos-system created on gitea.techbi.org
#   - Harbor project "goodgo" created on harbor.techbi.org
#
# Usage: ./setup-secrets.sh

set -e

NS="staging"

echo "=== Creating namespace ==="
kubectl create namespace "$NS" --dry-run=client -o yaml | kubectl apply -f -

echo "=== Creating Gitea push credentials (for CronJob sync) ==="
kubectl create secret generic pos-gitea-push-creds -n gitea \
  --from-literal=url='https://admin:Velik%402026@gitea.techbi.org/admin/pos-system.git' \
  --dry-run=client -o yaml | kubectl apply -f -

echo "=== Creating Harbor pull secret (for K8s to pull images) ==="
kubectl create secret docker-registry harbor-pull-secret -n "$NS" \
  --docker-server=harbor.techbi.org \
  --docker-username=admin \
  --docker-password='Velik@2026' \
  --docker-email=admin@techbi.org \
  --dry-run=client -o yaml | kubectl apply -f -

echo "=== Applying RBAC for act_runner ==="
kubectl apply -f act-runner-rbac.yaml

echo "=== Applying K8s secrets (DB, JWT, Redis, etc.) ==="
# Create goodgo-secrets with real values
kubectl create secret generic goodgo-secrets -n "$NS" \
  --from-literal=Jwt__Secret='GoodGo-Local-Dev-JWT-Secret-2024-Min32Chars!!' \
  --from-literal=Jwt__RefreshSecret='GoodGo-Local-Dev-Refresh-Secret-2024-32Ch!!' \
  --from-literal=IdentityServer__IssuerUri='https://api.staging.goodgo.vn' \
  --from-literal=Redis__Password='goodgo-redis-local' \
  --from-literal=ConnectionStrings__Redis='redis:6379,password=goodgo-redis-local' \
  --from-literal=Storage__MinIO__AccessKey='minioadmin' \
  --from-literal=Storage__MinIO__SecretKey='minioadmin123' \
  --from-literal=Storage__MinIO__Endpoint='minio.staging.svc.cluster.local:9000' \
  --from-literal=RabbitMQ__Host='rabbitmq' \
  --from-literal=RabbitMQ__Username='goodgo' \
  --from-literal=RabbitMQ__Password='goodgo-rabbitmq-local' \
  --from-literal=IAM_DATABASE_URL='Host=212.28.186.239;Port=30992;Database=iam_service;Username=cloud_admin;Password=XbnKQ2ONe6pMxxCh;SSL Mode=Prefer' \
  --from-literal=MERCHANT_DATABASE_URL='Host=212.28.186.239;Port=30992;Database=merchant_service;Username=cloud_admin;Password=XbnKQ2ONe6pMxxCh;SSL Mode=Prefer' \
  --from-literal=ORDER_DATABASE_URL='Host=212.28.186.239;Port=30992;Database=order_service;Username=cloud_admin;Password=XbnKQ2ONe6pMxxCh;SSL Mode=Prefer' \
  --from-literal=FNB_DATABASE_URL='Host=212.28.186.239;Port=30992;Database=fnb_engine;Username=cloud_admin;Password=XbnKQ2ONe6pMxxCh;SSL Mode=Prefer' \
  --from-literal=CATALOG_DATABASE_URL='Host=212.28.186.239;Port=30992;Database=catalog_service;Username=cloud_admin;Password=XbnKQ2ONe6pMxxCh;SSL Mode=Prefer' \
  --from-literal=INVENTORY_DATABASE_URL='Host=212.28.186.239;Port=30992;Database=inventory_service;Username=cloud_admin;Password=XbnKQ2ONe6pMxxCh;SSL Mode=Prefer' \
  --from-literal=WALLET_DATABASE_URL='Host=212.28.186.239;Port=30992;Database=wallet_service;Username=cloud_admin;Password=XbnKQ2ONe6pMxxCh;SSL Mode=Prefer' \
  --from-literal=STORAGE_DATABASE_URL='Host=212.28.186.239;Port=30992;Database=storage_service;Username=cloud_admin;Password=XbnKQ2ONe6pMxxCh;SSL Mode=Prefer' \
  --from-literal=BOOKING_DATABASE_URL='Host=212.28.186.239;Port=30992;Database=booking_service;Username=cloud_admin;Password=XbnKQ2ONe6pMxxCh;SSL Mode=Prefer' \
  --from-literal=CHAT_DATABASE_URL='Host=212.28.186.239;Port=30992;Database=chat_service;Username=cloud_admin;Password=XbnKQ2ONe6pMxxCh;SSL Mode=Prefer' \
  --from-literal=SOCIAL_DATABASE_URL='Host=212.28.186.239;Port=30992;Database=social_service;Username=cloud_admin;Password=XbnKQ2ONe6pMxxCh;SSL Mode=Prefer' \
  --from-literal=PROMOTION_DATABASE_URL='Host=212.28.186.239;Port=30992;Database=promotion_service;Username=cloud_admin;Password=XbnKQ2ONe6pMxxCh;SSL Mode=Prefer' \
  --from-literal=MEMBERSHIP_DATABASE_URL='Host=212.28.186.239;Port=30992;Database=membership_service;Username=cloud_admin;Password=XbnKQ2ONe6pMxxCh;SSL Mode=Prefer' \
  --from-literal=MINING_DATABASE_URL='Host=212.28.186.239;Port=30992;Database=mining_service;Username=cloud_admin;Password=XbnKQ2ONe6pMxxCh;SSL Mode=Prefer' \
  --from-literal=MISSION_DATABASE_URL='Host=212.28.186.239;Port=30992;Database=mission_service;Username=cloud_admin;Password=XbnKQ2ONe6pMxxCh;SSL Mode=Prefer' \
  --from-literal=ADS_MANAGER_DATABASE_URL='Host=212.28.186.239;Port=30992;Database=ads_manager_service;Username=cloud_admin;Password=XbnKQ2ONe6pMxxCh;SSL Mode=Prefer' \
  --from-literal=ADS_SERVING_DATABASE_URL='Host=212.28.186.239;Port=30992;Database=ads_serving_service;Username=cloud_admin;Password=XbnKQ2ONe6pMxxCh;SSL Mode=Prefer' \
  --from-literal=ADS_BILLING_DATABASE_URL='Host=212.28.186.239;Port=30992;Database=ads_billing_service;Username=cloud_admin;Password=XbnKQ2ONe6pMxxCh;SSL Mode=Prefer' \
  --from-literal=ADS_TRACKING_DATABASE_URL='Host=212.28.186.239;Port=30992;Database=ads_tracking_service;Username=cloud_admin;Password=XbnKQ2ONe6pMxxCh;SSL Mode=Prefer' \
  --from-literal=ADS_ANALYTICS_DATABASE_URL='Host=212.28.186.239;Port=30992;Database=ads_analytics_service;Username=cloud_admin;Password=XbnKQ2ONe6pMxxCh;SSL Mode=Prefer' \
  --from-literal=MKT_FACEBOOK_DATABASE_URL='Host=212.28.186.239;Port=30992;Database=mkt_facebook_service;Username=cloud_admin;Password=XbnKQ2ONe6pMxxCh;SSL Mode=Prefer' \
  --from-literal=MKT_WHATSAPP_DATABASE_URL='Host=212.28.186.239;Port=30992;Database=mkt_whatsapp_service;Username=cloud_admin;Password=XbnKQ2ONe6pMxxCh;SSL Mode=Prefer' \
  --from-literal=MKT_X_DATABASE_URL='Host=212.28.186.239;Port=30992;Database=mkt_x_service;Username=cloud_admin;Password=XbnKQ2ONe6pMxxCh;SSL Mode=Prefer' \
  --from-literal=MKT_ZALO_DATABASE_URL='Host=212.28.186.239;Port=30992;Database=mkt_zalo_service;Username=cloud_admin;Password=XbnKQ2ONe6pMxxCh;SSL Mode=Prefer' \
  --dry-run=client -o yaml | kubectl apply -f -

echo ""
echo "=== Setup complete ==="
echo "Next steps:"
echo "  1. Create Harbor project 'goodgo' at https://harbor.techbi.org"
echo "  2. Create Gitea repo 'admin/pos-system' at https://gitea.techbi.org"
echo "  3. Set Gitea repo secrets: HARBOR_USERNAME=admin, HARBOR_PASSWORD=Velik@2026"
echo "  4. Apply CronJob: kubectl apply -f gitea-sync-cronjob.yaml"
echo "  5. Apply manifests: kubectl apply -f deployments/staging/kubernetes/"
