stages:
  - build
  - deploy

# this hidden job is specific to our Ansible
# it deploys a named ("techblog") docker container
# see https://blog.callr.tech/gitlab-ansible-docker-ci-cd/
.deploy: &deploy
  - >
    cd /var/ansible &&
    sudo -E ansible-playbook deploy_docker_callr_applications.yml
    --diff
    --private-key="/var/ansible/ssh_keys/gitlab/gitlab-ci"
    -i "inventories/$ANSIBLE_INVENTORY"
    -l "$ANSIBLE_SUBSET"
    -e "app=techblog tag=latest"    

Build:
  stage: build
  # remember to use specific version in your build images
  # see https://blog.callr.tech/building-docker-images-with-gitlab-ci-best-practices/
  image: docker:18-git 
  # we only build the "master" branch
  only:
    - master
  # fetching submodules here because usually themes are git submodules
  # see also the commented variables below
  before_script:
    - git submodule sync --recursive
    - git submodule update --init --recursive
  script:
    - echo -n $CI_JOB_TOKEN | docker login -u gitlab-ci-token --password-stdin $CI_REGISTRY
    # the image is tagged as latest, because it is the master branch
    - docker build -t $CI_REGISTRY_IMAGE:latest .
    - docker push $CI_REGISTRY_IMAGE:latest
  # variables:
  #   GIT_SUBMODULE_STRATEGY: recursive
  # -> this did not work for us, we had to use before_script above.
  # -> SSL certificate problem: unable to get local issuer certificate
  # -> https://gitlab.com/gitlab-org/gitlab-runner/issues/2148?
  # -> maybe an http proxy issue specific to our platform.

Deploy:
  stage: deploy
  script: *deploy
  allow_failure: false
  # deploying master only
  only:
    - master
  environment:
    name: production
  # we tag specific runners here in our platform
  tags:
    - deployment
  variables:
    # because the deployment stage does not need the source code anymore
    # we set GIT_STRATEGY to none
    GIT_STRATEGY: none
    # those variables are being used in the *deploy hidden job (above)
    ANSIBLE_INVENTORY: prod
    ANSIBLE_SUBSET: all

# This is a multi-stage Dockerfile (build and run)

# Remember to target specific version in your base image,
# because you want reproducibility (in a few years you will thank me)
FROM alpine:3.9 AS build

# The Hugo version
ARG VERSION=0.55.6

ADD https://github.com/gohugoio/hugo/releases/download/v${VERSION}/hugo_${VERSION}_Linux-64bit.tar.gz /hugo.tar.gz
RUN tar -zxvf hugo.tar.gz
RUN /hugo version

# We add git to the build stage, because Hugo needs it with --enableGitInfo
RUN apk add --no-cache git

# The source files are copied to /site
COPY . /site
WORKDIR /site

# And then we just run Hugo
RUN /hugo --minify --enableGitInfo

# stage 2
FROM nginx:1.15-alpine

WORKDIR /usr/share/nginx/html/

# Clean the default public folder
RUN rm -fr * .??*

# This inserts a line in the default config file, including our file "expires.inc"
RUN sed -i '9i\        include /etc/nginx/conf.d/expires.inc;\n' /etc/nginx/conf.d/default.conf

# The file "expires.inc" is copied into the image
COPY _docker/expires.inc /etc/nginx/conf.d/expires.inc
RUN chmod 0644 /etc/nginx/conf.d/expires.inc

# Finally, the "public" folder generated by Hugo in the previous stage
# is copied into the public fold of nginx
COPY --from=build /site/public /usr/share/nginx/html

RUN sed -i '9i\        include /etc/nginx/conf.d/expires.inc;\n' /etc/nginx/conf.d/default.conf

    location / {
        root   /usr/share/nginx/html;
        index  index.html index.htm;
    }

    location / {
        include /etc/nginx/conf.d/expires.inc;

        root   /usr/share/nginx/html;
        index  index.html index.htm;
    }

# cache.appcache, your document html and data
location ~* \.(?:manifest|appcache|html?|xml|json)$ {
  expires -1;
}

# Feed
location ~* \.(?:rss|atom)$ {
  expires 1h;
  add_header Cache-Control "public";
}

# Media: images, icons, video, audio, HTC
location ~* \.(?:jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm|htc)$ {
  expires 1M;
  access_log off;
  add_header Cache-Control "public";
}

# CSS and Javascript
location ~* \.(?:css|js)$ {
  expires 1y;
  access_log off;
  add_header Cache-Control "public";
}