pipeline {
  agent any
  environment {
    GITEA_REPO             = 'https://code.jacquesingram.online/lenape/nvhi-atsila-microservice.git'
    GITEA_CREDS            = '52ee0829-6e65-4951-925b-4186254c3f21'
    SONAR_HOST             = 'https://sonar.jacquesingram.online'
    SONAR_TOKEN            = credentials('sonar-token')
    ARTIFACTORY_URL        = 'https://art.jacquesingram.online/artifactory/nvhi-atsila-docker'
    ARTIFACTORY_CREDS      = 'artifactory-api'
    AWS_CRED_ID            = 'aws-ci'
    AWS_REGION             = 'us-east-2'
    TF_BACKEND_BUCKET      = 'nvhi-atsila-tf-state'
    TF_BACKEND_PREFIX      = 'ecs/terraform.tfstate'
    TF_DDB_TABLE           = 'nvhi-atsila-locks'
    SSH_CRED_ID            = 'jenkins-ssh'

    TF_VAR_cluster_name    = 'nvhi-atsila-cluster'
    TF_VAR_vpc_cidr        = '10.0.0.0/16'
    TF_VAR_public_subnets  = '10.0.1.0/24,10.0.2.0/24'
    TF_VAR_instance_type   = 't2.micro'
    TF_VAR_key_pair_name   = 'nvhi-atsila-deployer'
    TF_VAR_jenkins_ip_cidr = "${JENKINS_SSH_CIDR}"

    IMAGE_NAME             = 'lenape/nvhi-atsila-microservice'
    IMAGE_TAG              = "v1.0.${BUILD_NUMBER}"
  }
  stages {
    stage('Checkout') {
      steps {
        checkout scm
      }
    }
    stage('SonarQube Scan') {
      steps {
        withSonarQubeEnv('SonarQube') {
          sh "sonar-scanner -Dsonar.projectKey=nvhi-atsila-microservice -Dsonar.sources=."
        }
      }
    }
    stage('Build & Push Docker Image') {
      steps {
        script {
          docker.withRegistry(env.ARTIFACTORY_URL, env.ARTIFACTORY_CREDS) {
            def img = docker.build("${IMAGE_NAME}:${IMAGE_TAG}")
            img.push()
          }
        }
      }
    }
    stage('Terraform Init & Apply') {
      steps {
        withCredentials([[$class: 'AmazonWebServicesCredentialsBinding', credentialsId: env.AWS_CRED_ID]]) {
          dir('terraform') {
            sh """
              terraform init \
                -backend-config="bucket=${TF_BACKEND_BUCKET}" \
                -backend-config="key=${TF_BACKEND_PREFIX}" \
                -backend-config="region=${AWS_REGION}" \
                -backend-config="dynamodb_table=${TF_DDB_TABLE}"
              terraform apply -auto-approve \
                -var="cluster_name=${TF_VAR_cluster_name}" \
                -var="vpc_cidr=${TF_VAR_vpc_cidr}" \
                -var="public_subnets=${TF_VAR_public_subnets}" \
                -var="instance_type=${TF_VAR_instance_type}" \
                -var="key_pair_name=${TF_VAR_key_pair_name}" \
                -var="jenkins_ip_cidr=${TF_VAR_jenkins_ip_cidr}"
            """
          }
        }
      }
    }
    stage('Configure EC2 with Ansible') {
      steps {
        script {
          def ec2_ip = sh(
            script: "terraform -chdir=terraform output -raw ecs_instance_public_ip",
            returnStdout: true
          ).trim()
          writeFile file: 'ansible/hosts', text: "[inventory_hosts]\n${ec2_ip} ansible_user=ubuntu"
        }
        ansiblePlaybook(
          playbook: 'ansible/configure_ecs.yml',
          inventory: 'ansible/hosts',
          credentialsId: env.SSH_CRED_ID
        )
      }
    }
    stage('Register & Deploy to ECS') {
      steps {
        withCredentials([[$class: 'AmazonWebServicesCredentialsBinding', credentialsId: env.AWS_CRED_ID]]) {
          sh """
            aws ecs register-task-definition \
              --family ${TF_VAR_cluster_name} \
              --network-mode bridge \
              --container-definitions '[{
                "name":"health-workload",
                "image":"${ARTIFACTORY_URL}/${IMAGE_NAME}:${IMAGE_TAG}",
                "essential":true,
                "portMappings":[{"containerPort":8080,"hostPort":8080}]
              }]' \
              --region ${AWS_REGION}

            aws ecs update-service \
              --cluster ${TF_VAR_cluster_name} \
              --service ${TF_VAR_cluster_name}-service \
              --force-new-deployment \
              --region ${AWS_REGION}
          """
        }
      }
    }
  }
}