#!/usr/bin/env bash
set -euo pipefail

# Replaces registry.abrban.com docker distribution with Harbor.
# WARNING: This will delete the existing `Ingress/registry` routing. The old
# `Deployment/registry` and its PVC are left in place for rollback.

VALUES_FILE="${1:-/Users/keyhan/Documents/keyhan-project/cloud-host/backend/helm/cloudhost-harbor/values-registry.abrban.com.yaml}"

echo "==> Ensuring harbor repo"
helm repo add harbor https://helm.goharbor.io 2>/dev/null || true
helm repo update harbor

echo "==> [0/4] Preflight"
kubectl -n cloudhost get secret abrban-wildcard-tls >/dev/null
kubectl -n cloudhost get secret registry-egress-proxy >/dev/null

echo "==> [1/4] Disabling old registry ingress (host registry.abrban.com)"
kubectl -n cloudhost delete ingress registry --ignore-not-found

echo "==> [2/4] Scaling old registry deployment down (rollback-friendly)"
kubectl -n cloudhost scale deploy/registry --replicas=0 || true

echo "==> [3/4] Installing Harbor"
# IMPORTANT: do NOT set HTTP(S)_PROXY on harbor-core for in-cluster registry
# traffic. Egress proxy on core causes 502 on blob uploads via harbor-core
# (Kaniko/skopeo push fails; Harbor UI metadata never appears).
# Keep proxy empty here; Harbor proxy-cache projects can still use project-level
# proxy settings when needed. Expand noProxy for safety if proxy is re-enabled.
TMP_PROXY_VALUES="$(mktemp)"
cat > "${TMP_PROXY_VALUES}" <<EOF
proxy:
  httpProxy: ""
  httpsProxy: ""
  noProxy: "harbor-core,harbor-jobservice,harbor-database,harbor-registry,harbor-portal,.svc,.cluster.local,10.43.0.0/16,127.0.0.1,localhost,registry.abrban.com"
EOF

helm upgrade --install harbor harbor/harbor \
  -n cloudhost \
  -f "$VALUES_FILE" \
  -f "${TMP_PROXY_VALUES}" \
  --wait \
  --timeout 20m

rm -f "${TMP_PROXY_VALUES}" || true

echo "==> [4/4] Apply registry ingress path split (proxy-* → harbor-core)"
kubectl apply -f "$(dirname "$0")/../../../gitops/harbor/registry-ingress.yaml"

echo "==> Done"
kubectl -n cloudhost get ingress | grep -n registry || true