ansible-wireguard-egress-vpn/Makefile at main · gabrielldn/ansible-wireguard-egress-vpn · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
.PHONY: help local-dirs bootstrap prepare security-check install-roles lint syntax shellcheck test deploy-prod deploy-all docs clean encrypt decrypt

ANSIBLE_BIN ?= .venv/bin
ANSIBLE_PLAYBOOK ?= $(ANSIBLE_BIN)/ansible-playbook
ANSIBLE_INVENTORY ?= $(ANSIBLE_BIN)/ansible-inventory
ANSIBLE_GALAXY ?= $(ANSIBLE_BIN)/ansible-galaxy
ANSIBLE_LINT ?= $(ANSIBLE_BIN)/ansible-lint
MKDOCS ?= $(ANSIBLE_BIN)/mkdocs
SHELLCHECK ?= shellcheck
INVENTORY ?= inventories/inventory.yml
LOCAL_INVENTORY ?= inventories/inventory.local.yml
PLAYBOOK ?= playbooks/deploy.yml
REQUIREMENTS ?= roles/requirements.yml

INVENTORY_ARGS := -i $(INVENTORY)
ifneq ("$(wildcard $(LOCAL_INVENTORY))","")
INVENTORY_ARGS += -i $(LOCAL_INVENTORY)
endif

ifneq ("$(wildcard .vault_pass)","")
VAULT_OPTS ?= --vault-password-file .vault_pass
ANSIBLE_VAULT_ENV := ANSIBLE_VAULT_PASSWORD_FILE=.vault_pass
else
VAULT_OPTS ?=
ANSIBLE_VAULT_ENV :=
endif

help:
	@echo "Comandos disponíveis:"
	@echo "  bootstrap       Criar/sincronizar .venv com uv.lock"
	@echo "  prepare         Preparar usuário técnico ansible no VPS prod"
	@echo "  security-check  Validar ignorados, permissões e host key local"
	@echo "  install-roles   Instalar collections externas do Ansible Galaxy"
	@echo "  lint            Rodar ansible-lint"
	@echo "  syntax          Validar inventário e sintaxe do playbook"
	@echo "  shellcheck      Validar scripts shell"
	@echo "  test            Dry-run remoto em prod com --check --diff"
	@echo "  deploy-prod     Aplicar deploy no host prod"
	@echo "  docs            Build estrito do TechDocs/MkDocs"
	@echo "  clean           Remover logs e temporários"
	@echo "  encrypt         Criptografar group_vars/*/vault.yml"
	@echo "  decrypt         Descriptografar group_vars/*/vault.yml"

local-dirs:
	install -d -m 700 logs ssh artifacts/clients

bootstrap: local-dirs
	uv sync --locked

prepare:
	bash prepare.sh

security-check: local-dirs
	bash scripts/security_check.sh

install-roles: local-dirs
	umask 077; $(ANSIBLE_GALAXY) collection install -r $(REQUIREMENTS) --force

lint:
	umask 077; $(ANSIBLE_VAULT_ENV) $(ANSIBLE_LINT) $(PLAYBOOK)

syntax: local-dirs
	umask 077; $(ANSIBLE_INVENTORY) $(INVENTORY_ARGS) $(VAULT_OPTS) --list >/dev/null
	umask 077; $(ANSIBLE_PLAYBOOK) $(INVENTORY_ARGS) $(VAULT_OPTS) $(PLAYBOOK) --syntax-check

shellcheck:
	$(SHELLCHECK) deploy.sh prepare.sh scripts/*.sh

test: security-check
	bash deploy.sh --limit prod --check --yes

deploy-prod: security-check
	bash deploy.sh --limit prod --yes

deploy-all: deploy-prod

docs:
	$(MKDOCS) build --strict

clean:
	find logs -type f ! -name ".gitkeep" -delete
	find . -name "*.retry" -delete
	find . -name "*.tmp" -delete

encrypt:
	bash scripts/encrypt.sh

decrypt:
	bash scripts/decrypt.sh