Refactor secrets handling

[perso/Immae/Config/Nix.git] / nixops / Makefile

ifndef NIXOPS_ENV_LOADED
  $(error "Please load environment with direnv")
endif

###### Current channel information
nix-info:
	@version=$$(nix eval --raw nixpkgs.lib.version) && \
	  mainversion=$$(echo $$version | cut -d"." -f -2) && \
	  echo "https://releases.nixos.org/nixos/$$mainversion/nixos-$$version/nixexprs.tar.xz" && \
	  nix-instantiate --find-file nixpkgs
.PHONY: nix-info

###### Initial setup
setup:
	./scripts/setup
.PHONY: setup

###### Morph regular tasks
PROFILE=/nix/var/nix/profiles/per-user/immae/morph/immaeEu
TARGET ?=
MORPH_ARGS ?=
ifdef TARGET
  # multiple targets: --on="{machine1,machine2}" (works with * glob too)
  override MORPH_ARGS +=--on=$(TARGET)
endif
SSH_ARGS ?=

edit_env:
	$(EDITOR) secrets/environment.nix || true
	git -C secrets add environment.nix || true
	git -C secrets commit -m "Edit environment.nix" environment.nix || true

edit_vars:
	sops secrets/vars.yml || true
	git -C secrets add vars.yml || true
	git -C secrets commit -m "Edit password for vars.yml using sops." vars.yml || true

ssh-eldiron:
	./scripts/with_env bash -c 'ssh -i $$SSH_IDENTITY_FILE root@eldiron $(SSH_ARGS)'

ssh-dilion:
	./scripts/with_env bash -c 'ssh -i $$SSH_IDENTITY_FILE root@dilion $(SSH_ARGS)'

ssh-backup-2:
	./scripts/with_env bash -c 'ssh -i $$SSH_IDENTITY_FILE root@backup-2 $(SSH_ARGS)'

ssh-monitoring-1:
	./scripts/with_env bash -c 'ssh -i $$SSH_IDENTITY_FILE root@monitoring-1 $(SSH_ARGS)'

ssh-4c:
	./scripts/with_env bash -c 'ssh -i $$SSH_IDENTITY_FILE root@quatresaisons $(SSH_ARGS)'

debug:
	./scripts/with_env morph build --show-trace default.nix $(MORPH_ARGS)

build:
	./scripts/with_env morph build default.nix $(MORPH_ARGS)

dry-run:
	./scripts/with_env morph build --dry-run default.nix $(MORPH_ARGS)

upload:
	./scripts/with_env morph push default.nix $(MORPH_ARGS)

deploy:
	./scripts/with_env morph deploy default.nix switch --keep-result --upload-secrets $(MORPH_ARGS)
	nix-env -p $(PROFILE) --set .gcroots/default.nix

next-boot:
	./scripts/with_env morph deploy default.nix boot --keep-result --upload-secrets $(MORPH_ARGS)
	nix-env -p $(PROFILE) --set .gcroots/default.nix

deploy-reboot:
	./scripts/with_env morph deploy default.nix boot --reboot --upload-secrets $(MORPH_ARGS)

.PHONY: ssh-eldiron ssh-dilion ssh-monitoring-1 ssh-backup-2 debug build upload deploy deploy-reboot

###### Cleanup generations and garbage collection
GEN ?= "+3"

list-generations:
	nix-env -p $(PROFILE) --list-generations
	$(MAKE) ssh-eldiron SSH_ARGS="nix-env -p /nix/var/nix/profiles/system --list-generations"
.PHONY: list-generations

delete-generations:
	@echo "making sure that a complete build is done before cleaning up"
	$(MAKE) build MORPH_ARGS=--keep-result
	nix-env -p $(PROFILE) --delete-generations $(GEN)
	$(MAKE) ssh-eldiron SSH_ARGS="nix-env -p /nix/var/nix/profiles/system --delete-generations $(GEN)"
	$(MAKE) ssh-dilion SSH_ARGS="nix-env -p /nix/var/nix/profiles/system --delete-generations $(GEN)"
	$(MAKE) ssh-backup-2 SSH_ARGS="nix-env -p /nix/var/nix/profiles/system --delete-generations $(GEN)"
	$(MAKE) ssh-monitoring-1 SSH_ARGS="nix-env -p /nix/var/nix/profiles/system --delete-generations $(GEN)"
.PHONY: delete-generations

cleanup: delete-generations
	nix-store --gc
	$(MAKE) ssh-eldiron SSH_ARGS="nix-store --gc"
	$(MAKE) ssh-dilion SSH_ARGS="nix-store --gc"
	$(MAKE) ssh-backup-2 SSH_ARGS="nix-store --gc"
	$(MAKE) ssh-monitoring-1 SSH_ARGS="nix-store --gc"
.PHONY: cleanup