#!/bin/bash

set -euo pipefail

VAULT_FILE=".vault_pass.txt"
VARS_FILE="terraform.pkrvar.hcl"
PACKER_TEMPLATE="packer.pkr.hcl"

# Check if vault password file exists
if [[ ! -f "$VAULT_FILE" ]]; then
  echo "❌ Vault password file '$VAULT_FILE' not found."
  exit 1
fi

# Decrypt the vars file temporarily
echo "🔓 Decrypting $VARS_FILE..."
ansible-vault decrypt "$VARS_FILE" --vault-password-file "$VAULT_FILE"

# Run packer build
echo "🏗️  Running Packer build..."
packer build -var-file="$VARS_FILE" "$PACKER_TEMPLATE"

# Re-encrypt the vars file
echo "🔒 Re-encrypting $VARS_FILE..."
ansible-vault encrypt "$VARS_FILE" --vault-password-file "$VAULT_FILE"

echo "✅ Done!"