1
0
Fork 0
distrust-stack/Makefile

232 lines
6.6 KiB
Makefile
Raw Normal View History

2023-03-10 04:43:38 +00:00
include $(PWD)/src/toolchain/Makefile
2023-02-17 06:09:13 +00:00
BACKEND_TF := $(wildcard infra/backend/*.tf)
2023-04-14 03:22:35 +00:00
MAIN_TF := $(wildcard infra/main/*.tf)
2023-02-17 06:09:13 +00:00
ENVIRONMENT := production
2023-03-10 04:43:38 +00:00
REGION := sfo3
ROOT_DIR := $(shell pwd)
TERRAFORM := $(ROOT_DIR)/out/terraform
2023-05-06 20:35:46 +00:00
SOPS := $(ROOT_DIR)/out/sops
2023-06-09 01:46:25 +00:00
GO := cache/fetch/go/bin/go
KEYS := \
6B61ECD76088748C70590D55E90A401336C8AAA9 \
88823A75ECAA786B0FF38B148E401478A3FBEF72 \
2023-03-17 03:37:07 +00:00
3D7C8D39E8C4DF771583D3F0A8A091FD346001CA
2023-02-17 06:09:13 +00:00
2023-03-10 07:43:21 +00:00
.DEFAULT_GOAL :=
.PHONY: default
default: \
toolchain \
2023-03-17 03:37:07 +00:00
$(patsubst %,$(KEY_DIR)/%.asc,$(KEYS)) \
2023-03-17 04:14:39 +00:00
$(OUT_DIR)/website/.well-known/openpgpkey \
2023-03-10 07:43:21 +00:00
apply
2023-02-17 06:09:13 +00:00
.PHONY:
clean:
rm -rf $(CACHE_DIR)
.PHONY:
credentials: \
$(CACHE_DIR)/secrets/credentials.tfvars
$(KEY_DIR)/%.asc:
$(call fetch_pgp_key,$(basename $(notdir $@)))
2023-03-17 04:14:39 +00:00
$(OUT_DIR)/website/.well-known/openpgpkey:
2023-03-17 03:37:07 +00:00
$(call toolchain," \
sq wkd \
2023-03-17 04:14:39 +00:00
generate $(OUT_DIR)/website distrust.co \
2023-03-17 03:37:07 +00:00
<(cat $(patsubst %,$(KEY_DIR)/%.asc,$(KEYS))) \
")
2023-05-05 03:31:53 +00:00
$(OUT_DIR)/website/index.html: \
$(OUT_DIR)/website/.well-known/openpgpkey
2023-04-14 04:19:08 +00:00
$(call toolchain," \
cd $(SRC_DIR)/website \
&& jekyll build \
&& cp -R _site/* /home/build/out/website/ \
")
2023-03-10 04:43:38 +00:00
infra/backend/.terraform: \
2023-05-13 05:03:35 +00:00
$(TERRAFORM) \
2023-03-10 04:43:38 +00:00
$(BACKEND_TF)
$(SOPS) exec-env secrets/$(ENVIRONMENT).enc.env '\
env -C infra/backend $(TERRAFORM) init -upgrade \
'
2023-02-17 06:09:13 +00:00
infra/main/.terraform: | \
2023-05-13 05:03:35 +00:00
$(TERRAFORM) \
2023-04-14 03:22:35 +00:00
config/$(ENVIRONMENT).tfbackend \
$(MAIN_TF)
$(SOPS) exec-env secrets/$(ENVIRONMENT).enc.env '\
env -C infra/main $(TERRAFORM) init -upgrade \
-backend-config="../../config/$(ENVIRONMENT).tfbackend" \
'
2023-03-10 07:43:21 +00:00
2023-03-10 04:43:38 +00:00
infra/backend/$(ENVIRONMENT).tfstate: \
2023-05-13 05:03:35 +00:00
$(TERRAFORM) \
$(SOPS) \
2023-03-10 04:43:38 +00:00
infra/backend/.terraform
2023-05-07 07:37:07 +00:00
$(SOPS) exec-env secrets/$(ENVIRONMENT).enc.env '\
2023-05-06 20:35:46 +00:00
env -C infra/backend \
$(TERRAFORM) apply \
2023-03-10 04:43:38 +00:00
-var environment=$(ENVIRONMENT) \
-var namespace=$(ENVIRONMENT) \
-var region=$(REGION) \
2023-05-06 20:35:46 +00:00
-state ../../$@ \
'
2023-02-17 06:09:13 +00:00
config/$(ENVIRONMENT).tfbackend: | \
2023-05-13 05:03:35 +00:00
$(TERRAFORM) \
$(SOPS) \
2023-04-14 03:47:41 +00:00
# File is not committed and this has no shared state
$(MAKE) infra/backend/$(ENVIRONMENT).tfstate
2023-05-07 07:37:07 +00:00
$(SOPS) exec-env secrets/$(ENVIRONMENT).enc.env '\
2023-05-06 20:35:46 +00:00
env -C infra/backend \
$(TERRAFORM) \
2023-03-10 07:43:21 +00:00
output -state ../../$< \
2023-05-06 20:35:46 +00:00
> $@ \
'
2023-02-17 06:09:13 +00:00
.PHONY:
2023-03-10 07:43:21 +00:00
apply: \
2023-05-13 05:03:35 +00:00
$(TERRAFORM) \
$(SOPS) \
2023-03-10 07:43:21 +00:00
infra/main/.terraform
$(call maybe_decrypt_secret,secrets/$(ENVIRONMENT).talosconfig,infra/main/talos/talosconfig)
$(call maybe_decrypt_secret,secrets/$(ENVIRONMENT).kubeconfig,infra/main/talos/kubeconfig)
$(call maybe_decrypt_secret,secrets/$(ENVIRONMENT).controlplane.yaml,infra/main/talos/controlplane.yaml)
$(call maybe_decrypt_secret,secrets/$(ENVIRONMENT).worker.yaml,infra/main/talos/worker.yaml)
2023-05-07 07:37:07 +00:00
$(SOPS) exec-env secrets/$(ENVIRONMENT).enc.env '\
2023-05-06 20:35:46 +00:00
env -C infra/main \
$(TERRAFORM) apply \
2023-03-17 04:14:39 +00:00
-var environment=$(ENVIRONMENT) \
-var namespace=$(ENVIRONMENT) \
2023-05-06 20:35:46 +00:00
-var region=$(REGION) \
'
$(call maybe_encrypt_secret,infra/main/talos/talosconfig,secrets/$(ENVIRONMENT).talosconfig)
$(call maybe_encrypt_secret,infra/main/talos/kubeconfig,secrets/$(ENVIRONMENT).kubeconfig)
$(call maybe_encrypt_secret,infra/main/talos/controlplane.yaml,secrets/$(ENVIRONMENT).controlplane.yaml)
$(call maybe_encrypt_secret,infra/main/talos/worker.yaml,secrets/$(ENVIRONMENT).worker.yaml)
2023-02-17 06:09:13 +00:00
$(CACHE_DIR)/secrets:
mkdir -p $@
$(FETCH_DIR)/go:
mkdir -p $@ $@.tmp
wget https://go.dev/dl/$(GO_VERSION).src.tar.gz -O $@.tmp/$(GO_VERSION).src.tar.gz
echo "$(GO_HASH) $@.tmp/$(GO_VERSION).src.tar.gz" | sha256sum --strict --check -
# Verify tar file is still in same format from 1.20.x
tar -x go/VERSION -f $@.tmp/$(GO_VERSION).src.tar.gz -O > /dev/null
tar -xf $@.tmp/$(GO_VERSION).src.tar.gz -C $(FETCH_DIR)
rm -r $@.tmp
2023-02-17 06:09:13 +00:00
$(FETCH_DIR)/terraform:
$(call git_clone,$@,$(TERRAFORM_REPO),$(TERRAFORM_REF))
2023-05-05 19:09:21 +00:00
$(FETCH_DIR)/sops:
$(call git_clone,$@,$(SOPS_REPO),$(SOPS_REF))
2023-05-12 01:25:59 +00:00
$(FETCH_DIR)/talosctl:
$(call git_clone,$@,$(TALOSCTL_REPO),$(TALOSCTL_REF))
$(FETCH_DIR)/kubectl:
$(call git_clone,$@,$(KUBECTL_REPO),$(KUBECTL_REF))
2023-06-09 01:54:20 +00:00
$(FETCH_DIR)/kustomize:
$(call git_clone,$@,$(KUSTOMIZE_REPO),$(KUSTOMIZE_REF))
2023-06-09 01:46:25 +00:00
$(FETCH_DIR)/go/bin/go: $(FETCH_DIR)/go
$(call toolchain," \
cd $(FETCH_DIR)/go/src && \
2023-06-09 01:46:25 +00:00
./make.bash \
")
2023-06-09 01:46:25 +00:00
$(OUT_DIR)/terraform: $(FETCH_DIR)/terraform $(GO)
2023-03-10 05:06:33 +00:00
$(call toolchain," \
2023-02-17 06:09:13 +00:00
cd $(FETCH_DIR)/terraform && \
export SSL_CERT_DIR=/etc/ssl/certs && \
2023-03-10 03:49:01 +00:00
export CGO_ENABLED=0 && \
2023-03-10 05:06:33 +00:00
export GOCACHE=/home/build/$(CACHE_DIR) && \
export GOPATH=/home/build/$(CACHE_DIR) && \
2023-06-09 01:46:25 +00:00
/home/build/$(GO) build \
2023-03-10 03:49:01 +00:00
-v \
-trimpath \
-ldflags='-w -extldflags=-static' \
-o /home/build/$@ \
2023-02-17 06:09:13 +00:00
")
2023-05-05 19:09:21 +00:00
2023-06-09 01:46:25 +00:00
$(OUT_DIR)/sops: $(FETCH_DIR)/sops $(GO)
2023-05-05 11:18:28 +00:00
$(call toolchain," \
cd $(FETCH_DIR)/sops && \
export CGO_ENABLED=0 && \
export GOCACHE=/home/build/$(CACHE_DIR) && \
export GOPATH=/home/build/$(CACHE_DIR) && \
2023-06-09 01:46:25 +00:00
/home/build/$(GO) build \
2023-05-05 19:09:21 +00:00
-v \
-trimpath \
-ldflags='-w -extldflags=-static' \
2023-05-05 11:18:28 +00:00
-o /home/build/$@ $(SOPS_PKG) \
2023-05-05 19:09:21 +00:00
")
2023-05-12 01:25:59 +00:00
2023-06-09 01:46:25 +00:00
$(OUT_DIR)/talosctl: $(FETCH_DIR)/talosctl $(GO)
2023-05-12 01:25:59 +00:00
$(call toolchain," \
cd $(FETCH_DIR)/talosctl && \
export CGO_ENABLED=0 && \
export GOCACHE=/home/build/$(CACHE_DIR) && \
export GOPATH=/home/build/$(CACHE_DIR) && \
2023-06-09 01:46:25 +00:00
/home/build/$(GO) build \
2023-05-12 01:25:59 +00:00
-v \
-trimpath \
-ldflags='-w -extldflags=-static' \
-o /home/build/$@ $(TALOSCTL_PKG) \
")
2023-06-09 01:46:25 +00:00
$(OUT_DIR)/kubectl: $(FETCH_DIR)/kubectl $(GO)
$(call toolchain," \
cd $(FETCH_DIR)/kubectl && \
export CGO_ENABLED=0 && \
export GOCACHE=/home/build/$(CACHE_DIR) && \
export GOPATH=/home/build/$(CACHE_DIR) && \
2023-06-09 01:46:25 +00:00
/home/build/$(GO) build \
-v \
-trimpath \
-ldflags='-w -extldflags=-static' \
-o /home/build/$@ $(KUBECTL_PKG) \
")
2023-06-09 01:54:20 +00:00
$(OUT_DIR)/kustomize: $(FETCH_DIR)/kustomize $(GO)
$(call toolchain," \
cd $(FETCH_DIR)/kustomize && \
export CGO_ENABLED=0 && \
export GOCACHE=/home/build/$(CACHE_DIR) && \
export GOPATH=/home/build/$(CACHE_DIR) && \
/home/build/$(GO) build \
-v \
-trimpath \
-ldflags='-w -extldflags=-static' \
-o /home/build/$@ $(KUSTOMIZE_PKG) \
")
# Note: Decryption MUST reset the mod time to avoid encryption/decryption loops
# Encrypt if:
# - Both files exist, local is newer than remote
# - Only local exists
define maybe_encrypt_secret
test \( -f $(1) -a -f $(2) -a $(1) -nt $(2) \) -o \
\( -f $(1) -a ! -f $(2) \) && \
$(SOPS) --encrypt $(1) > $(2) || true
endef
# Only decrypt when local files don't exist
# Unfortunately, this means we can't decrypt if the secrets update. We can't
# do that because otherwise it creates a loop. The secrets update, therefore we
# decrypt secrets, but because the modtime of the decrypted secrets is newer
# than the encrypted secrets, we want to reencrypt encrypted secrets.
define maybe_decrypt_secret
test -f $(1) -a ! -f $(2) && \
$(SOPS) --decrypt $(1) > $(2) && \
touch -d 1970-01-01 $(2) || \
true
endef