dumpnet-argo/Makefile

.PHONY: init plan apply destroy clean kubeconfig talosconfig argocd-password bootstrap decrypt post-apply build-mcp-auth-proxy stream-url

SECRET ?= dumpnet
FORGEJO_REGISTRY ?= forge.keane.sh
FORGEJO_USER ?= ian
MCP_AUTH_PROXY_IMAGE=$(FORGEJO_REGISTRY)/$(FORGEJO_USER)/mcp-auth-proxy
TF_DIR=terraform
SOPS_FILES=controlplane.yaml worker.yaml talosconfig

# Cluster infrastructure
init:
	cd $(TF_DIR) && terraform init

plan:
	cd $(TF_DIR) && terraform plan

apply:
	cd $(TF_DIR) && terraform apply -target=talos_cluster_kubeconfig.this
	@echo "==> Waiting 60s for Kubernetes API to be ready..."
	@sleep 60
	cd $(TF_DIR) && terraform apply

destroy:
	cd $(TF_DIR) && terraform destroy

# Full clean slate - run before destroy when recreating from scratch
# Removes resources that block terraform from recreating cleanly
clean:
	@echo "==> Force-deleting Secrets Manager secret..."
	-aws secretsmanager delete-secret --secret-id $(SECRET) --force-delete-without-recovery 2>/dev/null || true
	@echo "==> Clearing stale kubeconfig contexts..."
	-kubectl config delete-context admin@dumpnet 2>/dev/null || true
	-kubectl config delete-cluster dumpnet 2>/dev/null || true
	-kubectl config delete-user admin@dumpnet 2>/dev/null || true
	@echo "==> Clearing stale talosctl contexts..."
	-talosctl config remove dumpnet 2>/dev/null || true
	-talosctl config remove dumpnet-1 2>/dev/null || true
	@echo "==> Done. Run 'make destroy' then 'make apply' to rebuild from scratch."

# Bootstrap ArgoCD app of apps (run once after cluster is up)
bootstrap:
	kubectl apply -f apps/apps.yaml
	@echo "ArgoCD will now manage apps/ directory - future group changes are self-healing via git push"

# Images
build-mcp-auth-proxy:
	@echo "==> Logging into Forgejo registry..."
	$(eval REGISTRY_TOKEN=$(shell aws secretsmanager get-secret-value --secret-id $(SECRET) --query SecretString --output text | python3 -c "import sys,json; print(json.load(sys.stdin)['forgejo']['registry_token'])"))
	echo "$(REGISTRY_TOKEN)" | docker login $(FORGEJO_REGISTRY) --username $(FORGEJO_USER) --password-stdin
	docker build -t $(MCP_AUTH_PROXY_IMAGE):latest images/mcp-auth-proxy/
	docker push $(MCP_AUTH_PROXY_IMAGE):latest
	@echo "Pushed mcp-auth-proxy to $(MCP_AUTH_PROXY_IMAGE):latest"

# Credentials
talosconfig:
	aws secretsmanager get-secret-value --secret-id $(SECRET) \
	  --query SecretString --output text | python3 -c \
	  "import sys,json; print(json.load(sys.stdin)['cluster']['talosconfig'])" \
	  > /tmp/talosconfig-dumpnet
	talosctl config merge /tmp/talosconfig-dumpnet
	rm /tmp/talosconfig-dumpnet
	talosctl config context dumpnet

kubeconfig:
	-kubectl config delete-context admin@dumpnet 2>/dev/null || true
	-kubectl config delete-cluster dumpnet 2>/dev/null || true
	-kubectl config delete-user admin@dumpnet 2>/dev/null || true
	aws secretsmanager get-secret-value --secret-id $(SECRET) \
	  --query SecretString --output text | python3 -c \
	  "import sys,json; print(json.load(sys.stdin)['cluster']['kubeconfig'])" \
	  > /tmp/kubeconfig-dumpnet
	KUBECONFIG=~/.kube/config:/tmp/kubeconfig-dumpnet kubectl config view --flatten > /tmp/merged
	mv /tmp/merged ~/.kube/config
	rm /tmp/kubeconfig-dumpnet
	kubectl config use-context admin@dumpnet

argocd-password:
	@aws secretsmanager get-secret-value --secret-id $(SECRET) \
	  --query SecretString --output text | python3 -c \
	  "import sys,json; print(json.load(sys.stdin)['cluster']['argocd_admin_password'])"

# Build the current RTMP publish URL from the dumpnet secret (mediamtx.*)
# — handy for testing without going through the IRC bot, since the
# zoitestream API is cluster-internal only.
stream-url:
	@aws secretsmanager get-secret-value --secret-id $(SECRET) \
	  --query SecretString --output text | python3 -c \
	  "import sys, json; \
	  d = json.load(sys.stdin)['mediamtx']; \
	  print(f\"rtmp://stream.dumpnet.chat:1935/live?user=streamer&pass={d['publish_password']}\")"

# Decrypt sensitive files to /tmp for one-off talosctl use
# Files are never decrypted in the repo directory
decrypt:
	@for f in $(SOPS_FILES); do \
	  if [ -f $$f ]; then \
	    echo "Decrypting $$f to /tmp/$$f..."; \
	    sops -d $$f > /tmp/$$f; \
	  fi; \
	done
	@echo "Decrypted files are in /tmp/ - they will not persist after reboot"

# Run all post-apply steps (run once after fresh cluster creation)
post-apply:
	scripts/post-apply.sh