justfile

HOST := 'root@erebe.eu'

release app:
    #!/usr/bin/env bash
    SECRET=$(sops exec-env services/secrets/webhook.yml 'echo ${DEPLOYER_SECRET}')
    curl -i -X POST \
        -H 'Content-Type: application/json' \
        -H "X-Webhook-Token: ${SECRET}" \
        -d '{ "application_name": "{{app}}", "image_tag": "latest" }' \
        -s https://hooks.erebe.eu/hooks/deploy

install:
    sops -d --extract '["public_key"]' --output ~/.ssh/erebe_eu.pub secrets/ssh.yml
    sops -d --extract '["private_key"]' --output ~/.ssh/erebe_eu secrets/ssh.yml
    chmod 600 ~/.ssh/erebe_eu*
    grep -q erebe.eu ~/.ssh/config > /dev/null 2>&1 || cat config/ssh_client_config >> ~/.ssh/config
    mkdir ~/.kube || exit 0
    sops -d --output ~/.kube/config secrets/kubernetes-config.yml

dns:
    #!/usr/bin/env bash
    CF_KEY=$(sops -d --extract '["apirest"]["key"]' secrets/cloudflare.yml)
    curl -s --request POST \
        --url https://api.cloudflare.com/client/v4/zones/8c0e6a032ba22e5ffa9906458e47b838/dns_records/import \
        --header 'Content-Type: multipart/form-data' \
        --header 'X-Auth-Email: cloudflare@erebe.eu' \
        --header "Authorization: Bearer ${CF_KEY}" \
        --form 'file=@dns/erebe.eus.zones' \
        --form proxied=false | jq .success
    curl -s --request POST \
        --url https://api.cloudflare.com/client/v4/zones/0acc1290d9dd674f677b6d3580611e6a/dns_records/import \
        --header 'Content-Type: multipart/form-data' \
        --header 'X-Auth-Email: cloudflare@erebe.eu' \
        --header "Authorization: Bearer ${CF_KEY}" \
        --form 'file=@dns/erebe.eu.zones' \
        --form proxied=false | jq .success
    curl -s --request POST \
        --url https://api.cloudflare.com/client/v4/zones/8b8062d04b84fe017d647cbaa46e29e7/dns_records/import \
        --header 'Content-Type: multipart/form-data' \
        --header 'X-Auth-Email: cloudflare@erebe.eu' \
        --header "Authorization: Bearer ${CF_KEY}" \
        --form 'file=@dns/erebe.dev.zones' \
        --form proxied=false | jq .success

k8s:
    kubectl apply -k k8s/cert-manager
    kubectl apply -f k8s/lets-encrypt-issuer.yml
    kubectl apply -f k8s/wildward-erebe-eu.yaml
    kubectl delete secret cloudflare-credentials --namespace cert-manager || exit 0
    kubectl create secret generic cloudflare-credentials --namespace cert-manager \
        --from-literal=api-token="$(sops -d --extract '["apirest"]["key"]' secrets/cloudflare.yml)"
    helm repo add nfs-subdir-external-provisioner https://kubernetes-sigs.github.io/nfs-subdir-external-provisioner/
    helm upgrade --install nfs-nvme nfs-subdir-external-provisioner/nfs-subdir-external-provisioner -f k8s/nfs-provisioner-nvme-values.yaml
    helm upgrade --install nfs-hdd  nfs-subdir-external-provisioner/nfs-subdir-external-provisioner -f k8s/nfs-provisioner-hdd-values.yaml

wireguard:
    sops exec-env secrets/wireguard.yml 'cp wireguard/wg0.conf secrets_decrypted/; for i in $(env | grep _KEY | cut -d = -f1); do sed -i "s#__${i}__#${!i}#g" secrets_decrypted/wg0.conf ; done'
    ssh {{HOST}} "cat /etc/wireguard/wg0.conf" | diff - secrets_decrypted/wg0.conf \
        || (scp secrets_decrypted/wg0.conf {{HOST}}:/etc/wireguard/wg0.conf && ssh {{HOST}} systemctl restart wg-quick@wg0)
    ssh {{HOST}} 'systemctl enable wg-quick@wg0'

envoy:
    helm template eg-crds oci://docker.io/envoyproxy/gateway-crds-helm -f k8s/envoy-crds.yaml --version v1.7.0 | kubectl apply --server-side --force-conflicts -f -
    helm upgrade envoy oci://docker.io/envoyproxy/gateway-helm --version v1.7.0 -n default --create-namespace -f k8s/envoy.yaml --skip-crds
    kubectl apply -f k8s/gateway.yaml

csi:
    helm repo add democratic-csi https://democratic-csi.github.io/charts/
    helm repo update
    helm upgrade --install zfs-iscsi democratic-csi/democratic-csi \
        --namespace democratic-csi \
        --values k8s/democratic-csi/zfs-iscsi-values.yaml --create-namespace