#!/usr/bin/env bash

# Stage a Phala deploy bundle for the teesql-example app.

#

# Emits, into deployments/out/:

# compose.yml the compose file (= compose.template.yml unchanged)

# .env Phala-encrypted-env payload (mode 600)

# phala-deploy-cmd.sh runnable `phala deploy` invocation

#

# The script NEVER invokes phala itself — the operator runs the

# emitted command interactively so the deploy lands under their own

# Phala account.

#

# Usage:

# ./scripts/deploy-demo.sh <env-file>

#

# <env-file> must define every TEESQL_EXAMPLE_* variable referenced in

# compose.template.yml plus the GHCR pull credentials. Easiest path:

# copy .env.example and fill it in.

set -euo pipefail

REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"

TEMPLATE="${REPO_ROOT}/deployments/compose.template.yml"

OUT_DIR="${REPO_ROOT}/deployments/out"

ENV_SRC="${1:-}"

NODE_ID="${2:-26}"

DEPLOY_NAME="${DEPLOY_NAME:-teesql-example-demo}"

if [[ -z "${ENV_SRC}" || ! -f "${ENV_SRC}" ]]; then

echo "usage: $0 <env-file> [NODE_ID]" >&2

exit 2

fi

mkdir -p "${OUT_DIR}"

cp "${TEMPLATE}" "${OUT_DIR}/compose.yml"

# Encrypted env payload = the operator's env file verbatim. Phala

# encrypts it under the CVM's per-app pubkey at deploy time.

cp "${ENV_SRC}" "${OUT_DIR}/.env"

chmod 600 "${OUT_DIR}/.env"

cat > "${OUT_DIR}/phala-deploy-cmd.sh" <<EOF

#!/usr/bin/env bash

# Generated by scripts/deploy-demo.sh — re-run the generator to refresh.

set -euo pipefail

cd "\$(dirname "\$0")"

exec phala deploy \\

--name "${DEPLOY_NAME}" \\

--compose compose.yml \\

-e .env \\

--node-id ${NODE_ID} \\

--disk-size 20G \\

--kms base \\

--private-key "\$(cat ~/.teesql/global-deployer.key)" \\

--wait

EOF

chmod +x "${OUT_DIR}/phala-deploy-cmd.sh"

echo "==> Bundle written to ${OUT_DIR}/"

echo " compose.yml — what gets hashed + deployed"

echo " .env — encrypted-env payload (mode 600)"

echo " phala-deploy-cmd.sh — runnable phala deploy"

echo

echo "==> Next:"

echo " cd ${OUT_DIR} && ./phala-deploy-cmd.sh"

echo

echo " Capture the allocated app_id from Phala's output. The"

echo " compose_hash will need to be allowlisted on the app's own"

echo " DstackApp before the CVM can boot — if the first deploy"

echo " sticks at \"stopped\", fetch the hash and addComposeHash."