graph TD
	A[개발자 git push origin main]
	B[GitLab Webhook]
	C[Jenkins Checkout]
	D[Jenkins → 배포서버 SSH 접속]
	E[서버에서 git pull]
	F[docker compose build]
	G[docker compose up -d]

FROM jenkins/jenkins:lts-jdk21
USER root
# Docker CLI 설치 — Jenkins가 호스트 Docker를 제어할 수 있도록
RUN apt-get update && apt-get install -y ca-certificates curl gnupg lsb-release && \
    install -m 0755 -d /etc/apt/keyrings && \
    curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc && \
    echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] \
      https://download.docker.com/linux/debian $(. /etc/os-release && echo $VERSION_CODENAME) stable" \
      > /etc/apt/sources.list.d/docker.list && \
    apt-get update && apt-get install -y docker-ce-cli && rm -rf /var/lib/apt/lists/*
RUN groupadd -f docker && usermod -aG docker jenkins
USER jenkins
COPY plugins.txt /usr/share/jenkins/ref/plugins.txt
RUN jenkins-plugin-cli --plugin-file /usr/share/jenkins/ref/plugins.txt
COPY casc/jenkins.yaml /var/jenkins_casc/jenkins.yaml
ENV CASC_JENKINS_CONFIG=/var/jenkins_casc/jenkins.yaml

jenkins:
  securityRealm:
    local:
      allowsSignup: false
      users:
        - id: "${JENKINS_ADMIN_ID}"
          password: "${JENKINS_ADMIN_PASSWORD}"
  authorizationStrategy:
    loggedInUsersCanDoAnything:
      allowAnonymousRead: false

① Jenkins → GitLab (소스 코드 받기)
     인증수단: GitLab Deploy Token (아이디/비밀번호 형태)

② Jenkins → 배포 서버 (실제 배포 실행)
     인증수단: SSH 개인키 (열쇠 형태)

pipeline {
    agent any

    options {
        timeout(time: 30, unit: 'MINUTES')
        disableConcurrentBuilds()
        buildDiscarder(logRotator(numToKeepStr: '10'))
    }

    environment {
        DEPLOY_HOST = '10.0.20.15'
        DEPLOY_USER = 'deploy'
        DEPLOY_DIR  = '/home/deploy/atms'
    }

    stages {
        stage('Checkout') {
            steps {
                checkout scm
                script {
                    env.GIT_COMMIT_SHORT = sh(
                        script: 'git rev-parse --short HEAD',
                        returnStdout: true
                    ).trim()
                }
            }
        }

        stage('Deploy') {
            steps {
                sshagent(credentials: ['atms-server-ssh-key']) {
                    sh """
                        ssh -o StrictHostKeyChecking=no \\
                            -o ConnectTimeout=10 \\
                            ${DEPLOY_USER}@${DEPLOY_HOST} '
                            cd ${DEPLOY_DIR}
                            git pull origin main
                            docker compose build
                            docker compose up -d --remove-orphans
                        '
                    """
                }
            }
        }
    }

    post {
        success { echo "✅ 배포 성공 | 커밋: ${env.GIT_COMMIT_SHORT}" }
        failure { echo "❌ 배포 실패 | Jenkins 콘솔 로그를 확인하세요" }
        always  { cleanWs() }
    }
}