.gitlab-ci.yml

include:
  - template: Jobs/Dependency-Scanning.gitlab-ci.yml
  #- template: SAST.gitlab-ci.yml
  #- template: DAST.gitlab-ci.yml

variables:
  PYTHON_VER: "3.11"
  SECURE_ANALYZERS_PREFIX: "registry.gitlab.com/gitlab-org/security-products/analyzers"
  DS_DISABLE_DIND: "true"
  SAST_DISABLE_DIND: "true"
  CI_APPLICATION_TAG: $CI_COMMIT_SHA-api-stage
  DAST_WEBSITE: https://adios-stage.orr.noaa.gov
  DAST_USE_AJAX_SPIDER: "true"

stages:
  - test
  - build
  - verify
  - deploy_db
  - deploy
  - maintenance


test_develop:
  stage: test
  image: registry.orr.noaa.gov/erd/centos-conda/ubuntu/ubuntuforge-python$PYTHON_VER
  tags:
    - docker
    - linux

  except:
    - schedules

  before_script:
    - apt update
    - apt upgrade -y

    # mongod fails if the tzdata package is missing
    - echo 'tzdata tzdata/Areas select America' | debconf-set-selections
    - echo 'tzdata tzdata/Zones/America select Los_Angeles' | debconf-set-selections
    - DEBIAN_FRONTEND="noninteractive" apt install -y tzdata

  script:
    # install all the requirements
    - >
      conda install -y
      python=$PYTHON_VER
      --file adios_db/conda_requirements.txt
      --file adios_db/conda_requirements_optional.txt
      --file adios_db/conda_requirements_test.txt
      --file web_api/conda_requirements.txt

    # configure and start mongodb

    # mongo should have been installed by conda, but conda doesn't reserve
    # places for the logs, the database, and the pidfile
    # note: maybe we should update the test config so we don't need this??
    #       and then we could save the logs, etc as an artifact as well.
    - mkdir /var/lib/mongo
    - mkdir /var/log/mongodb
    - mkdir /var/run/mongodb

    # We can start the docker container manually like this:
    #   docker run --volume $(pwd)/git_repos/oil_database:/oil_database -it registry.orr.noaa.gov/erd/centos-conda/ubuntu/ubuntuforge-python3.11 /bin/bash
    
    - mongod --config mongo_config_test.yml &
    
    # apt-get install -y lsof
    # lsof -nP -iTCP -sTCP:LISTEN  # see if mongod is listening

    # Install & test the adios_db package
    - cd adios_db
    - pip install ./
    - pytest --mongo adios_db/test

    # Install & test the adios_db_api package
    - cd ../web_api
    - pip install ./
    - pytest adios_db_api/tests

build_api:
  stage: build
  tags:
    - build
  except:
    - schedules
  variables:
    # URI format: <hostname>/<group>/<subgroup>/<project>/<module-name>
    # Should be something like: registry.orr.noaa.gov/gnome/oil_database/oil_database/api
    IMAGE_TAG_DBG: $CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG:adios-db-web-api-dbg
    IMAGE_TAG_PROD: $CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG:adios-db-web-api
  before_script:
    - mv $ADIOS_STAGE_CONTAINER_KEY ./web_api/key
  script:
    - git clone https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.orr.noaa.gov/gnome/oil_database/oildb-deploy.git

    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - docker build . -f web_api/dockerfile -t $IMAGE_TAG_DBG --build-arg KEY_FILE="./web_api/key" --build-arg PYTHON_VER=$PYTHON_VER

    # apparently there is a timeout on the docker session, so we re-login
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - docker push $IMAGE_TAG_DBG

    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - docker build . -f web_api/dockerfile_prod -t $IMAGE_TAG_PROD --build-arg KEY_FILE="./web_api/key" --build-arg PYTHON_VER=$PYTHON_VER

    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - docker push $IMAGE_TAG_PROD

build_client:
  stage: build
  tags:
    - build
  except:
    - schedules
  variables:
    # Should be something like: registry.orr.noaa.gov/gnome/oil_database/oil_database/client
    IMAGE_TAG_DBG: $CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG:adios-db-web-client-dbg
    IMAGE_TAG_PROD: $CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG:adios-db-web-client
  script:
    - git clone https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.orr.noaa.gov/gnome/oil_database/oildb-deploy.git

    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - docker build . -f web_client/dockerfile -t $IMAGE_TAG_DBG

    # apparently there is a timeout on the docker session, so we re-login
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - docker push $IMAGE_TAG_DBG

    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - docker build . -f web_client/dockerfile_prod -t $IMAGE_TAG_PROD

    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - docker push $IMAGE_TAG_PROD

scan-api:
  stage: verify
  image: "$CS_ANALYZER_IMAGE"
  allow_failure: true

  variables:
    CS_ANALYZER_IMAGE: $SECURE_ANALYZERS_PREFIX/klar:$CS_MAJOR_VERSION
    DOCKER_IMAGE: $CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG:adios-db-web-api
    # By default, use the latest clair vulnerabilities database, however, allow it to be overridden here with a specific image
    # to enable container scanning to run offline, or to provide a consistent list of vulnerabilities for integration testing purposes
    CLAIR_DB_IMAGE_TAG: "latest"
    CLAIR_DB_IMAGE: "$SECURE_ANALYZERS_PREFIX/clair-vulnerabilities-db:$CLAIR_DB_IMAGE_TAG"
    # Override the GIT_STRATEGY variable in your `.gitlab-ci.yml` file and set it to `fetch` if you want to provide a `clair-whitelist.yml`
    # file. See https://docs.gitlab.com/ee/user/application_security/container_scanning/index.html#overriding-the-container-scanning-template
    # for details
    GIT_STRATEGY: none
  services:
    - name: $CLAIR_DB_IMAGE
      alias: clair-vulnerabilities-db
  script:
    - /analyzer run
  artifacts:
    reports:
      container_scanning: gl-container-scanning-report.json
  dependencies: []
  rules:
    - if: $CONTAINER_SCANNING_DISABLED
      when: never
    - if: $CI_PIPELINE_SOURCE == "schedule"
      when: never
    - if: $CI_COMMIT_BRANCH &&
        $GITLAB_FEATURES =~ /\bcontainer_scanning\b/

scan-client:
  stage: verify
  image: "$CS_ANALYZER_IMAGE"
  allow_failure: true

  variables:
    CS_ANALYZER_IMAGE: $SECURE_ANALYZERS_PREFIX/klar:$CS_MAJOR_VERSION
    DOCKER_IMAGE: $CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG:adios-db-web-client
    # By default, use the latest clair vulnerabilities database, however, allow it to be overridden here with a specific image
    # to enable container scanning to run offline, or to provide a consistent list of vulnerabilities for integration testing purposes
    CLAIR_DB_IMAGE_TAG: "latest"
    CLAIR_DB_IMAGE: "$SECURE_ANALYZERS_PREFIX/clair-vulnerabilities-db:$CLAIR_DB_IMAGE_TAG"
    # Override the GIT_STRATEGY variable in your `.gitlab-ci.yml` file and set it to `fetch` if you want to provide a `clair-whitelist.yml`
    # file. See https://docs.gitlab.com/ee/user/application_security/container_scanning/index.html#overriding-the-container-scanning-template
    # for details
    GIT_STRATEGY: none
  services:
    - name: $CLAIR_DB_IMAGE
      alias: clair-vulnerabilities-db
  script:
    - /analyzer run
  artifacts:
    reports:
      container_scanning: gl-container-scanning-report.json
  dependencies: []
  rules:
    - if: $CONTAINER_SCANNING_DISABLED
      when: never
    - if: $CI_PIPELINE_SOURCE == "schedule"
      when: never
    - if: $CI_COMMIT_BRANCH &&
        $GITLAB_FEATURES =~ /\bcontainer_scanning\b/

deploy_mongodb_stage:
  stage: deploy_db
  only:
    - develop
  except:
    - schedules
  environment:
    name: stage
    url: https://adios-stage.orr.noaa.gov
    on_stop: stop_mongodb_stage
  variables:
    IMAGE_TAG: mongo:4.4.6
    CONTAINER_NAME: mongodb
    APP_NETWORK: adios_net
    PORT_MAPPING: 127.0.0.1:27017:27017
    DB_VOLUME: dbdata
    GIT_STRATEGY: none
  script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - >
      docker network inspect $APP_NETWORK >/dev/null 2>&1 ||
      docker network create -d bridge $APP_NETWORK
    - >
      docker volume inspect $DB_VOLUME >/dev/null 2>&1 ||
      docker volume create $DB_VOLUME
    - docker pull $IMAGE_TAG
    - docker stop $CONTAINER_NAME && docker container rm --volumes $CONTAINER_NAME
    # The volume permissions are important here, so we need to set a user:group
    # when starting the container.
    # Right now they are set to james.makela:adios-dev so developers can manage
    # the volume external to the docker container.  We will need to change this
    # on the public server.
    - >
      docker run -d -p $PORT_MAPPING --name $CONTAINER_NAME --network $APP_NETWORK
      -v $DB_VOLUME:/data/db
      --restart unless-stopped $IMAGE_TAG
  tags:
    - adios-stage
    - deploy

stop_mongodb_stage:
  stage: deploy_db
  when: manual
  only:
    - develop
  environment:
    name: stage
    action: stop
  variables:
    GIT_STRATEGY: none
    CONTAINER_NAME: mongodb
  script:
    - docker stop $CONTAINER_NAME && docker container rm --volumes $CONTAINER_NAME
  tags:
    - adios-stage
    - deploy

deploy_mongodb_public:
  stage: deploy_db
  only:
    - production
  environment:
    name: public
    url: https://adios.orr.noaa.gov
    on_stop: stop_mongodb_public
  variables:
    IMAGE_TAG: mongo:4.4.6
    CONTAINER_NAME: mongodb
    APP_NETWORK: adios_net
    PORT_MAPPING: 127.0.0.1:27017:27017
    DB_VOLUME: dbdata
    GIT_STRATEGY: none
  script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - >
      docker network inspect $APP_NETWORK >/dev/null 2>&1 ||
      docker network create -d bridge $APP_NETWORK
    - >
      docker volume inspect $DB_VOLUME >/dev/null 2>&1 ||
      docker volume create $DB_VOLUME
    - docker pull $IMAGE_TAG
    - docker stop $CONTAINER_NAME && docker container rm --volumes $CONTAINER_NAME
    - >
      docker run -d --name $CONTAINER_NAME --network $APP_NETWORK --restart unless-stopped
      -p $PORT_MAPPING
      -v $DB_VOLUME:/data/db $IMAGE_TAG
  tags:
    - adios-prod
    - deploy

stop_mongodb_public:
  stage: deploy_db
  only:
    - production
  when: manual
  environment:
    name: public
    action: stop
  variables:
    GIT_STRATEGY: none
    CONTAINER_NAME: mongodb
  script:
    - docker stop $CONTAINER_NAME && docker container rm --volumes $CONTAINER_NAME
  tags:
    - adios-prod
    - deploy


deploy_api_stage:
  stage: deploy
  only:
    - develop
  except:
    - schedules
  environment:
    name: stage
    url: https://adios-stage.orr.noaa.gov
    on_stop: stop_api_stage
  variables:
    IMAGE_TAG: $CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG:adios-db-web-api-dbg
    CONTAINER_NAME: adios_db_web_api
    APP_NETWORK: adios_net
    PORT_MAPPING: 127.0.0.1:8084:9898
    REPO_VOLUME: noaa_data_repo
    KC_CONFIG_VOLUME: adiosdb_kc_config
    GIT_STRATEGY: none
  script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - >
      docker network inspect $APP_NETWORK >/dev/null 2>&1 ||
      docker network create -d bridge $APP_NETWORK
    - >
      docker volume inspect $REPO_VOLUME >/dev/null 2>&1 ||
      docker volume create $REPO_VOLUME
    - >
      docker volume inspect $KC_CONFIG_VOLUME >/dev/null 2>&1 ||
      docker volume create $KC_CONFIG_VOLUME
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - docker pull $IMAGE_TAG
    - docker stop $CONTAINER_NAME && docker container rm --volumes $CONTAINER_NAME
    - >
      docker run -d -p $PORT_MAPPING --name $CONTAINER_NAME
      -e MONGODB_WRITEABLE=true
      -e REFRESH_INTERNAL_DB=$REFRESH_INTERNAL_DB
      --network $APP_NETWORK
      -v $REPO_VOLUME:/data/git_repos
      -v $KC_CONFIG_VOLUME:/data/kc_config
      --restart unless-stopped $IMAGE_TAG
    - docker ps
    - docker logs $CONTAINER_NAME
  tags:
    - adios-stage
    - deploy

stop_api_stage:
  stage: deploy
  only:
    - develop
  when: manual
  environment:
    name: stage
    action: stop
  variables:
    GIT_STRATEGY: none
    CONTAINER_NAME: adios_db_web_api
  script:
    - docker stop $CONTAINER_NAME && docker container rm --volumes $CONTAINER_NAME
  tags:
    - adios-stage
    - deploy

deploy_oauth_api_stage:
  stage: deploy
  only:
    - develop
  except:
    - schedules
  environment:
    name: stage
    url: https://adios-stage.orr.noaa.gov
    on_stop: stop_oauth_api_stage
  variables:
    IMAGE_TAG: registry.orr.noaa.gov/it/oauth2-proxy:master
    CONTAINER_NAME: auth_web_api
    APP_NETWORK: adios_net
    PORT_MAPPING: 8004:4180
    OAUTH2_PROXY_PROVIDER: keycloak-oidc
    OAUTH2_PROXY_CLIENT_ID: adios-database
    OAUTH2_PROXY_REDIRECT_URL: https://adios-stage.orr.noaa.gov/oauth2/callback
    OAUTH2_PROXY_OIDC_ISSUER_URL: https://auth.orr.noaa.gov/auth/realms/ORR
    OAUTH2_PROXY_EMAIL_DOMAINS: noaa.gov
    OAUTH2_PROXY_COOKIE_SECRET: penguinsarereallythebest
    OAUTH2_PROXY_UPSTREAMS: http://adios_db_web_api:9898
    OAUTH2_PROXY_COOKIE_DOMAIN: https://adios-stage.orr.noaa.gov
    OAUTH2_PROXY_HTTP_ADDRESS: 0.0.0.0:4180
    #OAUTH2_PROXY_ALLOWED_ROLES: <OPTIONAL>
    KC_CONFIG_VOLUME: adiosdb_kc_config
    GIT_STRATEGY: none
  script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - >
      docker network inspect $APP_NETWORK >/dev/null 2>&1 ||
      docker network create -d bridge $APP_NETWORK
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - docker pull $IMAGE_TAG
    - docker stop $CONTAINER_NAME && docker container rm --volumes $CONTAINER_NAME
    - >
      docker run -d -p $PORT_MAPPING --name $CONTAINER_NAME
      --network $APP_NETWORK --restart unless-stopped
      --env OAUTH2_PROXY_PROVIDER=$OAUTH2_PROXY_PROVIDER
      --env OAUTH2_PROXY_CLIENT_ID=$OAUTH2_PROXY_CLIENT_ID
      --env OAUTH2_PROXY_CLIENT_SECRET=$AUTH_SECRET
      --env OAUTH2_PROXY_REDIRECT_URL=$OAUTH2_PROXY_REDIRECT_URL
      --env OAUTH2_PROXY_OIDC_ISSUER_URL=$OAUTH2_PROXY_OIDC_ISSUER_URL
      --env OAUTH2_PROXY_EMAIL_DOMAINS=$OAUTH2_PROXY_EMAIL_DOMAINS
      --env OAUTH2_PROXY_COOKIE_SECRET=$OAUTH2_PROXY_COOKIE_SECRET
      --env OAUTH2_PROXY_UPSTREAMS=$OAUTH2_PROXY_UPSTREAMS
      --env OAUTH2_PROXY_COOKIE_DOMAIN=$OAUTH2_PROXY_COOKIE_DOMAIN
      --env OAUTH2_PROXY_HTTP_ADDRESS=$OAUTH2_PROXY_HTTP_ADDRESS
      --env OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL=true
      --env OAUTH2_PROXY_CUSTOM_TEMPLATES_DIR=/data/kc_config
      --env OAUTH2_PROXY_CUSTOM_SIGN_IN_LOGO=/data/kc_config/NOAA_logo.svg
      -v $KC_CONFIG_VOLUME:/data/kc_config
      $IMAGE_TAG
  tags:
    - adios-stage
    - deploy

stop_oauth_api_stage:
  stage: deploy
  only:
    - develop
  when: manual
  environment:
    name: stage
    action: stop
  variables:
    GIT_STRATEGY: none
    CONTAINER_NAME: auth_web_api
  script:
    - docker stop $CONTAINER_NAME && docker container rm --volumes $CONTAINER_NAME
  tags:
    - adios-stage
    - deploy

deploy_client_stage:
  stage: deploy
  only:
    - develop
  except:
    - schedules
  environment:
    name: stage
    url: https://adios-stage.orr.noaa.gov
    on_stop: stop_client_stage
  variables:
    IMAGE_TAG: $CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG:adios-db-web-client-dbg
    CONTAINER_NAME: adios_db_web_client
    APP_NETWORK: adios_net
    PORT_MAPPING: 127.0.0.1:8083:4200
    GIT_STRATEGY: none
  script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - >
      docker network inspect $APP_NETWORK >/dev/null 2>&1 ||
      docker network create -d bridge $APP_NETWORK
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - docker pull $IMAGE_TAG
    - docker stop $CONTAINER_NAME && docker container rm --volumes $CONTAINER_NAME
    - >
      docker run -d -p $PORT_MAPPING --name $CONTAINER_NAME
      --network $APP_NETWORK
      --restart unless-stopped $IMAGE_TAG
  tags:
    - adios-stage
    - deploy

stop_client_stage:
  stage: deploy
  only:
    - develop
  when: manual
  environment:
    name: stage
    action: stop
  variables:
    GIT_STRATEGY: none
    CONTAINER_NAME: adios_db_web_client
  script:
    - docker stop $CONTAINER_NAME && docker container rm --volumes $CONTAINER_NAME
  tags:
    - adios-stage
    - deploy

deploy_oauth_client_stage:
  stage: deploy
  only:
    - develop
  except:
    - schedules
  environment:
    name: stage
    url: https://adios-stage.orr.noaa.gov
    on_stop: stop_oauth_client_stage
  variables:
    IMAGE_TAG: registry.orr.noaa.gov/it/oauth2-proxy:master
    CONTAINER_NAME: auth_web_client
    APP_NETWORK: adios_net
    PORT_MAPPING: 8003:4180
    OAUTH2_PROXY_PROVIDER: keycloak-oidc
    OAUTH2_PROXY_CLIENT_ID: adios-database
    OAUTH2_PROXY_REDIRECT_URL: https://adios-stage.orr.noaa.gov/oauth2/callback
    OAUTH2_PROXY_OIDC_ISSUER_URL: https://auth.orr.noaa.gov/auth/realms/ORR
    OAUTH2_PROXY_EMAIL_DOMAINS: noaa.gov
    OAUTH2_PROXY_COOKIE_SECRET: penguinsarereallythebest
    OAUTH2_PROXY_UPSTREAMS: http://adios_db_web_client:4200
    OAUTH2_PROXY_COOKIE_DOMAIN: https://adios-stage.orr.noaa.gov
    OAUTH2_PROXY_HTTP_ADDRESS: 0.0.0.0:4180
    #OAUTH2_PROXY_ALLOWED_ROLES: <OPTIONAL>
    KC_CONFIG_VOLUME: adiosdb_kc_config
    GIT_STRATEGY: none
  script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - >
      docker network inspect $APP_NETWORK >/dev/null 2>&1 ||
      docker network create -d bridge $APP_NETWORK
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - docker pull $IMAGE_TAG
    - docker stop $CONTAINER_NAME && docker container rm --volumes $CONTAINER_NAME
    #- OAUTH2_PROXY_CLIENT_SECRET=`cat /data/adios_oil_db/oauth-proxy-client-secret.txt`
    - >
      docker run -d -p $PORT_MAPPING --name $CONTAINER_NAME
      --network $APP_NETWORK --restart unless-stopped
      --env OAUTH2_PROXY_PROVIDER=$OAUTH2_PROXY_PROVIDER
      --env OAUTH2_PROXY_CLIENT_ID=$OAUTH2_PROXY_CLIENT_ID
      --env OAUTH2_PROXY_CLIENT_SECRET=$AUTH_SECRET
      --env OAUTH2_PROXY_REDIRECT_URL=$OAUTH2_PROXY_REDIRECT_URL
      --env OAUTH2_PROXY_OIDC_ISSUER_URL=$OAUTH2_PROXY_OIDC_ISSUER_URL
      --env OAUTH2_PROXY_EMAIL_DOMAINS=$OAUTH2_PROXY_EMAIL_DOMAINS
      --env OAUTH2_PROXY_COOKIE_SECRET=$OAUTH2_PROXY_COOKIE_SECRET
      --env OAUTH2_PROXY_UPSTREAMS=$OAUTH2_PROXY_UPSTREAMS
      --env OAUTH2_PROXY_COOKIE_DOMAIN=$OAUTH2_PROXY_COOKIE_DOMAIN
      --env OAUTH2_PROXY_HTTP_ADDRESS=$OAUTH2_PROXY_HTTP_ADDRESS
      --env OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL=true
      --env OAUTH2_PROXY_CUSTOM_TEMPLATES_DIR=/data/kc_config
      --env OAUTH2_PROXY_CUSTOM_SIGN_IN_LOGO=/data/kc_config/NOAA_logo.svg
      -v $KC_CONFIG_VOLUME:/data/kc_config
      $IMAGE_TAG
  tags:
    - adios-stage
    - deploy

stop_oauth_client_stage:
  stage: deploy
  only:
    - develop
  when: manual
  environment:
    name: stage
    action: stop
  variables:
    GIT_STRATEGY: none
    CONTAINER_NAME: auth_web_client
  script:
    - docker stop $CONTAINER_NAME && docker container rm --volumes $CONTAINER_NAME
  tags:
    - adios-stage
    - deploy


deploy_api_public:
  stage: deploy
  only:
    - production
  environment:
    name: public
    url: https://adios.orr.noaa.gov
    on_stop: stop_api_public
  variables:
    IMAGE_TAG: $CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG:adios-db-web-api
    CONTAINER_NAME: adios_db_web_api
    APP_NETWORK: adios_net
    GIT_STRATEGY: none
  script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - >
      docker network inspect $APP_NETWORK >/dev/null 2>&1 ||
      docker network create -d bridge $APP_NETWORK
    - docker pull $IMAGE_TAG
    - docker stop $CONTAINER_NAME && docker container rm --volumes $CONTAINER_NAME
    - >
      docker run -d --name $CONTAINER_NAME --network $APP_NETWORK --restart unless-stopped
      -e MONGODB_WRITEABLE=false $IMAGE_TAG
  tags:
    - adios-prod
    - deploy

stop_api_public:
  stage: deploy
  only:
    - production
  when: manual
  environment:
    name: public
    action: stop
  variables:
    GIT_STRATEGY: none
    CONTAINER_NAME: adios_db_web_api
  script:
    - docker stop $CONTAINER_NAME && docker container rm --volumes $CONTAINER_NAME
  tags:
    - adios-prod
    - deploy


deploy_client_public:
  stage: deploy
  only:
    - production
  environment:
    name: public
    url: https://adios.orr.noaa.gov
    on_stop: stop_client_public
  variables:
    IMAGE_TAG: $CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG:adios-db-web-client
    CONTAINER_NAME: adios_db_web_client
    APP_NETWORK: adios_net
    GIT_STRATEGY: none
  script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - >
      docker network inspect $APP_NETWORK >/dev/null 2>&1 ||
      docker network create -d bridge $APP_NETWORK
    - docker pull $IMAGE_TAG
    - docker stop $CONTAINER_NAME && docker container rm --volumes $CONTAINER_NAME
    - >
      docker run -d --name $CONTAINER_NAME --network $APP_NETWORK --restart unless-stopped
      $IMAGE_TAG
  tags:
    - adios-prod
    - deploy

stop_client_public:
  stage: deploy
  only:
    - production
  when: manual
  environment:
    name: public
    action: stop
  variables:
    GIT_STRATEGY: none
    CONTAINER_NAME: adios_db_web_client
  script:
    - docker stop $CONTAINER_NAME && docker container rm --volumes $CONTAINER_NAME
  tags:
    - adios-prod
    - deploy

deploy_proxy_public:
  stage: deploy
  only:
    - production
  environment:
    name: public
    url: https://adios.orr.noaa.gov
    on_stop: stop_proxy_public
  variables:
    IMAGE_TAG: nginx
    CONTAINER_NAME: adios_db_web_proxy
    APP_NETWORK: adios_net
    PORT_MAPPING1: 443:443
    PORT_MAPPING2: 80:80
    OILDB_PROJ_FOLDER: /data/adios_oil_db/oildb-deploy
    GIT_STRATEGY: none
  script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - >
      docker network inspect $APP_NETWORK >/dev/null 2>&1 ||
      docker network create -d bridge $APP_NETWORK
    - docker pull $IMAGE_TAG
    - docker stop $CONTAINER_NAME && docker container rm --volumes $CONTAINER_NAME

    - if [ -d $OILDB_PROJ_FOLDER ]; then rm -rf $OILDB_PROJ_FOLDER; fi
    - git clone https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.orr.noaa.gov/gnome/oil_database/oildb-deploy.git $OILDB_PROJ_FOLDER
    - chmod go+rw $OILDB_PROJ_FOLDER/config/public/proxy/*
    - >
      chmod go+rx
      $OILDB_PROJ_FOLDER
      $OILDB_PROJ_FOLDER/config
      $OILDB_PROJ_FOLDER/config/public
      $OILDB_PROJ_FOLDER/config/public/proxy

    - ls -la $OILDB_PROJ_FOLDER
    - ls -la $OILDB_PROJ_FOLDER/config/public/proxy
    - ls -la /etc/ssl/certs/*
    - >
      docker run -d --name $CONTAINER_NAME --network $APP_NETWORK --restart unless-stopped
      -p $PORT_MAPPING1 -p $PORT_MAPPING2
      -v $OILDB_PROJ_FOLDER/config/public/proxy:/etc/nginx/
      -v /etc/ssl/certs:/etc/ssl/certs $IMAGE_TAG
  tags:
    - adios-prod
    - deploy

stop_proxy_public:
  stage: deploy
  only:
    - production
  when: manual
  environment:
    name: public
    action: stop
  variables:
    GIT_STRATEGY: none
    CONTAINER_NAME: adios_db_web_proxy
  script:
    - docker stop $CONTAINER_NAME && docker container rm --volumes $CONTAINER_NAME
  tags:
    - adios-prod
    - deploy

init_git_repo_on_stage:
  stage: maintenance
  image: registry.orr.noaa.gov/erd/centos-conda/ubuntu/ubuntuforge-python$PYTHON_VER
  when: manual
  
  environment:
    name: stage
    url: https://adios-stage.orr.noaa.gov
  variables:
    CONTAINER_NAME: adios_db_web_api
    SCRIPT_NAME: init_noaa_data.sh
  script:
    - docker cp ./web_api/$SCRIPT_NAME $CONTAINER_NAME:/
    - docker cp ./web_api/git_functions.sh $CONTAINER_NAME:/
    - docker exec $CONTAINER_NAME /bin/bash /$SCRIPT_NAME

  tags:
    - adios-stage

sync_with_git_review:
  stage: maintenance
  image: registry.orr.noaa.gov/erd/centos-conda/ubuntu/ubuntuforge-python$PYTHON_VER
  rules:
    - if: $CI_PIPELINE_SOURCE == "schedule"
  environment:
    name: stage
    url: https://adios-stage.orr.noaa.gov
  tags:
    - adios-stage
  variables:
    CONTAINER_NAME: adios_db_web_api
    SCRIPT_NAME: sync_with_under_review.sh
  script:
    - docker cp ./web_api/$SCRIPT_NAME $CONTAINER_NAME:/
    - docker cp ./web_api/git_functions.sh $CONTAINER_NAME:/
    - docker exec $CONTAINER_NAME /bin/bash /$SCRIPT_NAME

sync_with_git_prod:
  stage: maintenance
  image: registry.orr.noaa.gov/erd/centos-conda/ubuntu/ubuntuforge-python$PYTHON_VER
  when: manual
  environment:
    name: stage
    url: https://adios-stage.orr.noaa.gov
  tags:
    - adios-stage
  variables:
    CONTAINER_NAME: adios_db_web_api
    SCRIPT_NAME: sync_with_production.sh
  script:
    - docker cp ./web_api/$SCRIPT_NAME $CONTAINER_NAME:/
    - docker cp ./web_api/git_functions.sh $CONTAINER_NAME:/
    - docker exec $CONTAINER_NAME /bin/bash /$SCRIPT_NAME

pull_remote_under_review_changes:
  stage: maintenance
  image: registry.orr.noaa.gov/erd/centos-conda/ubuntu/ubuntuforge-python$PYTHON_VER
  when: manual
  environment:
    name: stage
    url: https://adios-stage.orr.noaa.gov
  tags:
    - adios-stage
  variables:
    CONTAINER_NAME: adios_db_web_api
    SCRIPT_NAME: pull_remote_under_review_changes.sh
  script:
    - docker cp ./web_api/$SCRIPT_NAME $CONTAINER_NAME:/
    - docker cp ./web_api/git_functions.sh $CONTAINER_NAME:/
    - docker exec $CONTAINER_NAME /bin/bash /$SCRIPT_NAME

drop_db_volume_public:
  stage: maintenance
  image: registry.orr.noaa.gov/erd/centos-conda/ubuntu/ubuntuforge-python$PYTHON_VER
  when: manual
  environment:
    name: public
    url: https://adios.orr.noaa.gov
  tags:
    - adios-prod
  variables:
    DB_VOLUME: dbdata
  script:
    - docker volume rm $DB_VOLUME