.PHONY: init plan apply destroy clean kubeconfig talosconfig argocd-password bootstrap decrypt post-apply fluentbit-secret

SECRET ?= dumpnet
TF_DIR=terraform
SOPS_FILES=controlplane.yaml worker.yaml talosconfig

# Cluster infrastructure
init:
	cd $(TF_DIR) && terraform init

plan:
	cd $(TF_DIR) && terraform plan

apply:
	cd $(TF_DIR) && terraform apply -target=talos_cluster_kubeconfig.this
	cd $(TF_DIR) && terraform apply

destroy:
	cd $(TF_DIR) && terraform destroy

# Full clean slate - run before destroy when recreating from scratch
# Removes resources that block terraform from recreating cleanly
clean:
	@echo "==> Force-deleting Secrets Manager secret..."
	-aws secretsmanager delete-secret --secret-id $(SECRET) --force-delete-without-recovery 2>/dev/null || true
	@echo "==> Clearing stale kubeconfig contexts..."
	-kubectl config delete-context admin@dumpnet 2>/dev/null || true
	-kubectl config delete-cluster dumpnet 2>/dev/null || true
	-kubectl config delete-user admin@dumpnet 2>/dev/null || true
	@echo "==> Clearing stale talosctl contexts..."
	-talosctl config remove dumpnet 2>/dev/null || true
	-talosctl config remove dumpnet-1 2>/dev/null || true
	@echo "==> Done. Run 'make destroy' then 'make apply' to rebuild from scratch."

# Bootstrap ArgoCD app of apps (run once after cluster is up)
bootstrap:
	kubectl apply -f apps/apps.yaml

# Credentials
talosconfig:
	aws secretsmanager get-secret-value --secret-id $(SECRET) \
	  --query SecretString --output text | python3 -c \
	  "import sys,json; print(json.load(sys.stdin)['cluster']['talosconfig'])" \
	  > /tmp/talosconfig-dumpnet
	talosctl config merge /tmp/talosconfig-dumpnet
	rm /tmp/talosconfig-dumpnet
	talosctl config context dumpnet

kubeconfig:
	-kubectl config delete-context admin@dumpnet 2>/dev/null || true
	-kubectl config delete-cluster dumpnet 2>/dev/null || true
	-kubectl config delete-user admin@dumpnet 2>/dev/null || true
	aws secretsmanager get-secret-value --secret-id $(SECRET) \
	  --query SecretString --output text | python3 -c \
	  "import sys,json; print(json.load(sys.stdin)['cluster']['kubeconfig'])" \
	  > /tmp/kubeconfig-dumpnet
	KUBECONFIG=~/.kube/config:/tmp/kubeconfig-dumpnet kubectl config view --flatten > /tmp/merged
	mv /tmp/merged ~/.kube/config
	rm /tmp/kubeconfig-dumpnet
	kubectl config use-context admin@dumpnet

argocd-password:
	@aws secretsmanager get-secret-value --secret-id $(SECRET) \
	  --query SecretString --output text | python3 -c \
	  "import sys,json; print(json.load(sys.stdin)['cluster']['argocd_admin_password'])"

# Decrypt sensitive files to /tmp for one-off talosctl use
# Files are never decrypted in the repo directory
decrypt:
	@for f in $(SOPS_FILES); do \
	  if [ -f $$f ]; then \
	    echo "Decrypting $$f to /tmp/$$f..."; \
	    sops -d $$f > /tmp/$$f; \
	  fi; \
	done
	@echo "Decrypted files are in /tmp/ - they will not persist after reboot"

# Create fluent-bit AWS credentials secret in cluster
fluentbit-secret:
	@KEY_ID=$$(aws secretsmanager get-secret-value --secret-id $(SECRET) \
	  --query SecretString --output text | python3 -c \
	  "import sys,json; print(json.load(sys.stdin)['fluentbit']['aws_access_key_id'])") && \
	SECRET_KEY=$$(aws secretsmanager get-secret-value --secret-id $(SECRET) \
	  --query SecretString --output text | python3 -c \
	  "import sys,json; print(json.load(sys.stdin)['fluentbit']['aws_secret_access_key'])") && \
	kubectl create secret generic fluentbit-aws-credentials \
	  --namespace fluent-bit \
	  --from-literal=AWS_ACCESS_KEY_ID=$$KEY_ID \
	  --from-literal=AWS_SECRET_ACCESS_KEY=$$SECRET_KEY \
	  --dry-run=client -o yaml | kubectl apply -f -

# Run all post-apply steps (run once after fresh cluster creation)
post-apply:
	scripts/post-apply.sh