# Deployment helpers
#
# Day-to-day app deploys happen in GitHub Actions
# (.github/workflows/deploy.yml) These targets are for the host-config work,
# which is done rarely

SHELL := bash
ANSIBLE_DIR := ansible
INVENTORY := inventory/hosts.yml

# Only pass the vault password when it exists, so these targets keep working
# before the vault has been imported (scripts/import-vault.sh creates it)
VAULT_ARGS := $(shell [ -f $(ANSIBLE_DIR)/.vault_pass ] && echo --vault-password-file $(CURDIR)/$(ANSIBLE_DIR)/.vault_pass)

.PHONY: help deploy-diff deploy-check provision cert deploy-nginx app vault-import

help:
	@echo "make deploy-diff    # pull live configs and diff them against the repo"
	@echo "make deploy-check   # ansible --check --diff (dry run, no changes)"
	@echo "make provision      # full host bootstrap (setup + deploy + cert + app)"
	@echo "make deploy-nginx   # publish the nginx vhost (deploy.yml)"
	@echo "make app            # render the app config from the vault (app.yml)"
	@echo "make cert           # install uacme / manage certificates (cert.yml)"
	@echo "make vault-import   # build the encrypted vault from the live env files"

deploy-diff:
	$(ANSIBLE_DIR)/scripts/pull-live-configs.sh

vault-import:
	$(ANSIBLE_DIR)/scripts/import-vault.sh

deploy-check:
	cd $(ANSIBLE_DIR) && ansible-playbook -i $(INVENTORY) $(VAULT_ARGS) provision.yml --check --diff

provision:
	cd $(ANSIBLE_DIR) && ansible-playbook -i $(INVENTORY) $(VAULT_ARGS) provision.yml --ask-become-pass

cert:
	cd $(ANSIBLE_DIR) && ansible-playbook -i $(INVENTORY) $(VAULT_ARGS) cert.yml --ask-become-pass

deploy-nginx:
	cd $(ANSIBLE_DIR) && ansible-playbook -i $(INVENTORY) $(VAULT_ARGS) deploy.yml --ask-become-pass

app:
	cd $(ANSIBLE_DIR) && ansible-playbook -i $(INVENTORY) $(VAULT_ARGS) app.yml --ask-become-pass