Taskfile.yml

---
version: "3"

vars:
  CONFIG_DIR: '{{ .CONFIG_DIR | default "config/examples" }}'
  SCHEMA_DIR: '{{ .SCHEMA_DIR | default "config/schemas/v1" }}'
  INVENTORY_FILE: '{{ .INVENTORY_FILE | default "tmp/ansible-inventory.json" }}'
  OBSERVATION_DIR: '{{ .OBSERVATION_DIR | default "tmp/observed" }}'
  SERVICE_OBSERVATION_DIR: '{{ .SERVICE_OBSERVATION_DIR | default "tmp/observed-services" }}'
  DEPLOYMENT_DIR: '{{ .DEPLOYMENT_DIR | default "tmp/deployments" }}'
  TIME_LIMIT: '{{ .TIME_LIMIT | default "cloudfall_servers" }}'

tasks:
  validate:
    desc: Validate the declarative Cloudfall config
    cmds:
      - uv run cloudfall config validate --project {{ .CONFIG_DIR }} --schemas {{ .SCHEMA_DIR }}

  inventory:
    desc: Render the validated config as Ansible JSON inventory
    deps:
      - validate
    cmds:
      - >-
        uv run cloudfall-engine inventory render --project {{ .CONFIG_DIR }}
        --schemas {{ .SCHEMA_DIR }} --output {{ .INVENTORY_FILE }}

  ansible:inventory:
    desc: Verify rendered inventory with Ansible
    deps:
      - inventory
    cmds:
      - uv run ansible-inventory --inventory {{ .INVENTORY_FILE }} --list

  inspect:
    desc: >-
      Collect read-only server snapshots and rebuild the operations dashboard
    deps:
      - inventory
    env:
      ANSIBLE_CONFIG: engine/ansible/ansible.cfg
    cmds:
      - >-
        uv run ansible-playbook --inventory {{ .INVENTORY_FILE }}
        engine/ansible/playbooks/inspect.yml
        --extra-vars
        cloudfall_inspect_output_directory={{ .ROOT_DIR }}/{{ .OBSERVATION_DIR }}
      - >-
        uv run cloudfall dashboard build --project {{ .CONFIG_DIR }}
        --schemas {{ .SCHEMA_DIR }} --observed {{ .OBSERVATION_DIR }}
        --output-dir {{ .ROOT_DIR }}/tmp/dashboard

  audit:
    desc: Compare the config with previously collected observations
    deps:
      - validate
    cmds:
      - >-
        uv run cloudfall audit --project {{ .CONFIG_DIR }} --schemas {{ .SCHEMA_DIR }}
        --observed {{ .OBSERVATION_DIR }}

  services:inspect:
    desc: Collect DNS, TLS, origin, and public service evidence
    deps:
      - validate
    cmds:
      - >-
        uv run cloudfall services observe --project {{ .CONFIG_DIR }}
        --schemas {{ .SCHEMA_DIR }} --service-observed {{ .SERVICE_OBSERVATION_DIR }}

  services:status:
    desc: Show evidence-derived service lifecycle status
    deps:
      - validate
    cmds:
      - >-
        uv run cloudfall services status --project {{ .CONFIG_DIR }}
        --schemas {{ .SCHEMA_DIR }} --observed {{ .OBSERVATION_DIR }}
        --service-observed {{ .SERVICE_OBSERVATION_DIR }}
        --deployments {{ .DEPLOYMENT_DIR }}

  server:baseline:check:
    desc: Check the server baseline convergence without changing hosts
    deps:
      - inventory
    env:
      ANSIBLE_CONFIG: engine/ansible/ansible.cfg
    cmds:
      - >-
        uv run ansible-playbook --check --diff
        --inventory {{ .INVENTORY_FILE }}
        engine/ansible/playbooks/baseline.yml

  server:baseline:
    desc: Converge servers to the managed baseline
    deps:
      - inventory
    env:
      ANSIBLE_CONFIG: engine/ansible/ansible.cfg
    cmds:
      - >-
        uv run ansible-playbook --inventory {{ .INVENTORY_FILE }}
        engine/ansible/playbooks/baseline.yml

  services:deploy:check:
    desc: Check declared infrastructure services without changing hosts
    deps:
      - inventory
    env:
      ANSIBLE_CONFIG: engine/ansible/ansible.cfg
    cmds:
      - >-
        uv run ansible-playbook --check --diff
        --inventory {{ .INVENTORY_FILE }}
        engine/ansible/playbooks/services.yml

  services:deploy:
    desc: Converge declared infrastructure services
    deps:
      - inventory
    env:
      ANSIBLE_CONFIG: engine/ansible/ansible.cfg
    cmds:
      - >-
        uv run ansible-playbook --inventory {{ .INVENTORY_FILE }}
        engine/ansible/playbooks/services.yml

  artifact:build:
    desc: Build a release artifact for COMPONENT at git REF
    deps:
      - validate
    preconditions:
      - sh: test -n "{{ .COMPONENT }}"
        msg: Set COMPONENT to the component id to build
      - sh: test -n "{{ .REF }}"
        msg: Set REF to the git branch, tag, or commit to package
    cmds:
      - >-
        uv run cloudfall-engine artifact build --project {{ .CONFIG_DIR }}
        {{ .COMPONENT }} --ref {{ .REF }} --schemas {{ .SCHEMA_DIR }}
        --output-dir {{ .ARTIFACT_DIR | default "tmp/artifacts" }}

  deploy:
    desc: Deploy COMPONENT at RELEASE with a health-gated switch
    preconditions:
      - sh: test -n "{{ .COMPONENT }}"
        msg: Set COMPONENT to the component id to deploy
      - sh: test -n "{{ .RELEASE }}"
        msg: Set RELEASE to a release id produced by artifact:build
    cmds:
      - >-
        uv run cloudfall deploy --project {{ .CONFIG_DIR }} {{ .COMPONENT }}
        --release {{ .RELEASE }} --schemas {{ .SCHEMA_DIR }}
        --artifacts {{ .ARTIFACT_DIR | default "tmp/artifacts" }}
        --releases {{ .ROOT_DIR }}/tmp/releases
        {{ if .ENV_FILE }}--env-file {{ .ENV_FILE }}{{ end }} --yes

  rollback:
    desc: Roll COMPONENT back to an existing RELEASE
    preconditions:
      - sh: test -n "{{ .COMPONENT }}"
        msg: Set COMPONENT to the component id to roll back
      - sh: test -n "{{ .RELEASE }}"
        msg: Set RELEASE to an existing release id on the servers
    cmds:
      - >-
        uv run cloudfall rollback --project {{ .CONFIG_DIR }} {{ .COMPONENT }}
        --release {{ .RELEASE }} --schemas {{ .SCHEMA_DIR }} --yes

  restart:
    desc: Restart COMPONENT behind its declared health check
    preconditions:
      - sh: test -n "{{ .COMPONENT }}"
        msg: Set COMPONENT to the component id to restart
    cmds:
      - >-
        uv run cloudfall restart --project {{ .CONFIG_DIR }} {{ .COMPONENT }}
        --schemas {{ .SCHEMA_DIR }} --yes

  health:
    desc: Probe COMPONENT's declared health check
    preconditions:
      - sh: test -n "{{ .COMPONENT }}"
        msg: Set COMPONENT to the component id to probe
    cmds:
      - >-
        uv run cloudfall health --project {{ .CONFIG_DIR }} {{ .COMPONENT }}
        --schemas {{ .SCHEMA_DIR }}

  domains:deploy:check:
    desc: Check declared domain routes without changing hosts
    deps:
      - inventory
    env:
      ANSIBLE_CONFIG: engine/ansible/ansible.cfg
    cmds:
      - >-
        uv run ansible-playbook --check --diff
        --inventory {{ .INVENTORY_FILE }}
        engine/ansible/playbooks/domains.yml

  domains:deploy:
    desc: Converge declared domain routes and write deployment receipts
    deps:
      - inventory
    env:
      ANSIBLE_CONFIG: engine/ansible/ansible.cfg
    cmds:
      - >-
        uv run ansible-playbook --inventory {{ .INVENTORY_FILE }}
        --extra-vars
        cloudfall_domains_receipt_directory={{ .ROOT_DIR }}/{{ .DEPLOYMENT_DIR }}
        --extra-vars
        cloudfall_domains_issue_certificates={{ .ISSUE_CERTIFICATES | default "false" }}
        engine/ansible/playbooks/domains.yml

  logging:check:
    desc: Check the guarded parallel logging deployment without applying it
    deps:
      - inventory
    env:
      ANSIBLE_CONFIG: engine/ansible/ansible.cfg
    cmds:
      - >-
        uv run ansible-playbook --check --diff
        --inventory {{ .INVENTORY_FILE }}
        engine/ansible/playbooks/logging.yml

  logging:deploy:
    desc: Deploy Loki, Grafana, and Alloy without changing legacy log agents
    deps:
      - inventory
    env:
      ANSIBLE_CONFIG: engine/ansible/ansible.cfg
    cmds:
      - >-
        uv run ansible-playbook --inventory {{ .INVENTORY_FILE }}
        engine/ansible/playbooks/logging.yml

  time:check:
    desc: Check the UTC time baseline without changing servers
    deps:
      - inventory
    env:
      ANSIBLE_CONFIG: engine/ansible/ansible.cfg
    cmds:
      - >-
        uv run ansible-playbook --check --diff
        --limit {{ .TIME_LIMIT }}
        --inventory {{ .INVENTORY_FILE }}
        engine/ansible/playbooks/time.yml

  time:deploy:
    desc: Enforce UTC and synchronized time on selected servers
    deps:
      - inventory
    env:
      ANSIBLE_CONFIG: engine/ansible/ansible.cfg
    cmds:
      - >-
        uv run ansible-playbook
        --limit {{ .TIME_LIMIT }}
        --inventory {{ .INVENTORY_FILE }}
        engine/ansible/playbooks/time.yml

  dashboard:
    desc: Build the local read-only operations dashboard
    deps:
      - validate
    cmds:
      - >-
        uv run cloudfall dashboard build --project {{ .CONFIG_DIR }}
        --schemas {{ .SCHEMA_DIR }} --observed {{ .OBSERVATION_DIR }}
        --service-observed {{ .SERVICE_OBSERVATION_DIR }}
        --deployments {{ .DEPLOYMENT_DIR }}
        --output-dir {{ .ROOT_DIR }}/tmp/dashboard

  dashboard:serve:
    desc: Serve the live-refreshing read-only operations dashboard over HTTP
    deps:
      - validate
    cmds:
      - >-
        uv run cloudfall dashboard serve --project {{ .CONFIG_DIR }}
        --schemas {{ .SCHEMA_DIR }} --observed {{ .OBSERVATION_DIR }}
        --service-observed {{ .SERVICE_OBSERVATION_DIR }}
        --deployments {{ .DEPLOYMENT_DIR }}
        --host {{ .DASHBOARD_HOST | default "127.0.0.1" }}
        --port {{ .DASHBOARD_PORT | default "8100" }}
        --refresh {{ .DASHBOARD_REFRESH | default "10" }}
        --inspect-services

  ansible:syntax:
    desc: Run Ansible syntax and lint checks
    deps:
      - inventory
    env:
      ANSIBLE_CONFIG: engine/ansible/ansible.cfg
    cmds:
      - >-
        uv run ansible-playbook --syntax-check
        --inventory {{ .INVENTORY_FILE }}
        engine/ansible/playbooks/bootstrap.yml
      - >-
        uv run ansible-playbook --syntax-check
        --inventory {{ .INVENTORY_FILE }}
        engine/ansible/playbooks/data.yml
      - >-
        uv run ansible-playbook --syntax-check
        --inventory {{ .INVENTORY_FILE }}
        engine/ansible/playbooks/inspect.yml
      - >-
        uv run ansible-playbook --syntax-check
        --inventory {{ .INVENTORY_FILE }}
        engine/ansible/playbooks/baseline.yml
      - >-
        uv run ansible-playbook --syntax-check
        --inventory {{ .INVENTORY_FILE }}
        engine/ansible/playbooks/services.yml
      - >-
        uv run ansible-playbook --syntax-check
        --inventory {{ .INVENTORY_FILE }}
        engine/ansible/playbooks/deploy.yml
      - >-
        uv run ansible-playbook --syntax-check
        --inventory {{ .INVENTORY_FILE }}
        engine/ansible/playbooks/rollback.yml
      - >-
        uv run ansible-playbook --syntax-check
        --inventory {{ .INVENTORY_FILE }}
        engine/ansible/playbooks/restart.yml
      - >-
        uv run ansible-playbook --syntax-check
        --inventory {{ .INVENTORY_FILE }}
        engine/ansible/playbooks/health.yml
      - >-
        uv run ansible-playbook --syntax-check
        --inventory {{ .INVENTORY_FILE }}
        engine/ansible/playbooks/domains.yml
      - >-
        uv run ansible-playbook --syntax-check
        --inventory {{ .INVENTORY_FILE }}
        engine/ansible/playbooks/logging.yml
      - >-
        uv run ansible-playbook --syntax-check
        --inventory {{ .INVENTORY_FILE }}
        engine/ansible/playbooks/time.yml
      - uv run ansible-lint engine/ansible