#!/usr/bin/env bash
# Emit Helm values for Forgejo DB + admin secrets (no mailer — OpenBao/ESO owns SMTP).
set -euo pipefail

ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
SECRETS_FILE="${FORGEJO_SECRETS:-$ROOT_DIR/helm/forgejo-secrets.sops.yaml}"
KUBECONFIG="${KUBECONFIG:-$HOME/.kube/config-hosteurope}"

emit_from_sops() {
  sops -d "$SECRETS_FILE" | python3 -c "
import sys, yaml
data = yaml.safe_load(sys.stdin) or {}
mailer = data.get('gitea', {}).get('config', {}).get('mailer')
if mailer:
    data['gitea']['config'].pop('mailer', None)
yaml.dump(data, sys.stdout, default_flow_style=False)
"
}

emit_from_cluster() {
  python3 -c "
import json, os, subprocess, sys, yaml
os.environ['KUBECONFIG'] = '${KUBECONFIG}'
vals = json.loads(subprocess.check_output(
    ['helm', 'get', 'values', 'forgejo', '-n', 'forgejo', '-o', 'json'], text=True))
g = vals.get('gitea', {})
yaml.dump({
    'gitea': {
        'admin': {'password': g.get('admin', {}).get('password', '')},
        'config': {
            'database': {'PASSWD': g.get('config', {}).get('database', {}).get('PASSWD', '')},
        },
    }
}, sys.stdout, default_flow_style=False)
"
}

if command -v sops >/dev/null 2>&1 && sops -d "$SECRETS_FILE" >/dev/null 2>&1; then
  emit_from_sops
else
  emit_from_cluster
fi