Bastian de BylandClaude Opus 5
6cd4d56de1
A Pi 3B+ (stickah.local) shares a Phomemo PM246 to the LAN as a plain CUPS queue, so any machine can print 4x6 labels -- fulfillr-site's shipping labels in particular -- without installing the vendor driver, which is x86-64 only. The role builds the TSPL CUPS driver from source instead. It is Debian, not Fedora, so it lives in its own inventory and playbook (make deploy-labelprint / check-labelprint) and the home.debyl.io roles can never run against it. make bootfs renders its cloud-init first-boot files onto a freshly imaged SD card from the same templates the role uses. The Wi-Fi credentials for the home and rescue networks are in the vault. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
107 lines
4.1 KiB
Makefile
107 lines
4.1 KiB
Makefile
# __ ____ __
|
|
# __ _ ___ _/ /_____ / _(_) /__
|
|
# / ' \/ _ `/ '_/ -_) _/ / / -_)
|
|
# /_/_/_/\_,_/_/\_\\__/_//_/_/\__/
|
|
#
|
|
# Author: bdebyl (Bastian de Byl)
|
|
all: lint
|
|
|
|
PASS_SRC=./.pass.sh
|
|
# Setup Definitions
|
|
VENV=.venv
|
|
VENV_BIN=.venv/bin
|
|
PIP=${VENV_BIN}/pip
|
|
ANSIBLE=${VENV_BIN}/ansible-playbook
|
|
ANSIBLE_VAULT=${VENV_BIN}/ansible-vault
|
|
|
|
LINT_YAML=${VENV_BIN}/yamllint
|
|
|
|
VAULT_PASS_FILE=.ansible-vaultpass
|
|
VAULT_FILE=ansible/vars/vault.yml
|
|
|
|
# Variables
|
|
ANSIBLE_INVENTORY=ansible/inventories/home/hosts.yml
|
|
# The label print proxy is a separate inventory and playbook: it is Debian, not
|
|
# Fedora, and shares none of the roles home.debyl.io runs.
|
|
ANSIBLE_INVENTORY_LABELPRINT=ansible/inventories/labelprint/hosts.yml
|
|
#SSH_KEY=${HOME}/.ssh/id_rsa_home_ansible
|
|
|
|
# Default to all ansible tags to run (passed via 'make deploy TAGS=sometag')
|
|
TAGS?=all
|
|
SKIP_TAGS?=none
|
|
TARGET?=all
|
|
EXTRA_VARS?=
|
|
|
|
# Mounted boot partition of the label print proxy's SD card (see `make bootfs`)
|
|
BOOTFS?=/Volumes/bootfs
|
|
|
|
${VENV}:
|
|
python3 -m venv ${VENV}
|
|
${VENV_BIN}/python3 -m pip install --upgrade pip
|
|
${PIP}: ${VENV}
|
|
|
|
${ANSIBLE} ${ANSIBLE_VAULT} ${LINT_YAML}: ${VENV} requirements.txt
|
|
${PIP} install -r requirements.txt
|
|
touch $@
|
|
|
|
${VAULT_PASS_FILE}: ${ANSIBLE}
|
|
. ${PASS_SRC}; pass $$PASS_LOC > $@
|
|
|
|
${VAULT_FILE}: ${VAULT_PASS_FILE}
|
|
if [ ! -e "${VAULT_FILE}" ]; then \
|
|
${ANSIBLE_VAULT} create --vault-password-file ${VAULT_PASS_FILE} $@; \
|
|
fi
|
|
touch $@
|
|
|
|
# Linting
|
|
YAML_FILES=$(shell find ansible/ -name '*.yml' -not -name '*vault*')
|
|
SKIP_FILE=./.lint-vars.sh
|
|
|
|
# Targets
|
|
deploy: ${ANSIBLE} ${VAULT_FILE}
|
|
${ANSIBLE} --diff -t ${TAGS} --skip-tags ${SKIP_TAGS} -i ${ANSIBLE_INVENTORY} -l ${TARGET} --vault-password-file ${VAULT_PASS_FILE} $(if ${EXTRA_VARS},-e "${EXTRA_VARS}") ansible/deploy.yml
|
|
|
|
# Writes the Pi's cloud-init first-boot files onto a freshly imaged SD card.
|
|
bootfs: ${ANSIBLE} ${VAULT_FILE}
|
|
${ANSIBLE} --diff -i ${ANSIBLE_INVENTORY_LABELPRINT} --vault-password-file ${VAULT_PASS_FILE} -e "bootfs=${BOOTFS}" ansible/bootfs.yml
|
|
|
|
# Label print proxy (stickah.local). Override the address when the Pi has
|
|
# fallen back to its rescue AP:
|
|
# make deploy-labelprint EXTRA_VARS="ansible_host=192.168.4.1"
|
|
deploy-labelprint: ${ANSIBLE} ${VAULT_FILE}
|
|
${ANSIBLE} --diff -t ${TAGS} --skip-tags ${SKIP_TAGS} -i ${ANSIBLE_INVENTORY_LABELPRINT} -l ${TARGET} --vault-password-file ${VAULT_PASS_FILE} $(if ${EXTRA_VARS},-e "${EXTRA_VARS}") ansible/deploy_labelprint.yml
|
|
|
|
check-labelprint: ${ANSIBLE} ${VAULT_FILE}
|
|
${ANSIBLE} --check --diff -t ${TAGS} --skip-tags ${SKIP_TAGS} -i ${ANSIBLE_INVENTORY_LABELPRINT} -l ${TARGET} --vault-password-file ${VAULT_PASS_FILE} $(if ${EXTRA_VARS},-e "${EXTRA_VARS}") ansible/deploy_labelprint.yml
|
|
|
|
list-tags: ${ANSIBLE} ${VAULT_FILE}
|
|
${ANSIBLE} --list-tags -i ${ANSIBLE_INVENTORY} -l ${TARGET} --vault-password-file ${VAULT_PASS_FILE} ansible/deploy.yml
|
|
|
|
list-tasks: ${ANSIBLE} ${VAULT_FILE}
|
|
${ANSIBLE} --list-tasks -i ${ANSIBLE_INVENTORY} -l ${TARGET} --vault-password-file ${VAULT_PASS_FILE} ansible/deploy.yml
|
|
|
|
check: ${ANSIBLE} ${VAULT_FILE}
|
|
${ANSIBLE} --check --diff -t ${TAGS} --skip-tags ${SKIP_TAGS} -i ${ANSIBLE_INVENTORY} -l ${TARGET} --vault-password-file ${VAULT_PASS_FILE} $(if ${EXTRA_VARS},-e "${EXTRA_VARS}") ansible/deploy.yml
|
|
|
|
vault: ${ANSIBLE_VAULT} ${VAULT_FILE}
|
|
${ANSIBLE_VAULT} edit --vault-password-file ${VAULT_PASS_FILE} ${VAULT_FILE}
|
|
|
|
lint: ${LINT_YAML} ${SKIP_FILE}
|
|
@printf "Running yamllint...\n"
|
|
-@${LINT_YAML} ${YAML_FILES}
|
|
@printf "Done.\n"
|
|
|
|
# Git-crypt management
|
|
git-crypt-backup:
|
|
@printf "Backing up git-crypt symmetric key...\n"
|
|
@mkdir -p .git-crypt-backup
|
|
@gpg --batch --yes -e -r 70A4AA02555DBD559189B4E0F32BE05EADAA54FC -o .git-crypt-backup/symmetric-key.gpg .git/git-crypt/keys/default
|
|
@printf "Backup created at .git-crypt-backup/symmetric-key.gpg\n"
|
|
|
|
git-crypt-restore:
|
|
@printf "Restoring git-crypt symmetric key from backup...\n"
|
|
@mkdir -p .git/git-crypt/keys
|
|
@gpg --batch --yes -d .git-crypt-backup/symmetric-key.gpg > .git/git-crypt/keys/default
|
|
@chmod 600 .git/git-crypt/keys/default
|
|
@printf "Key restored. Run 'git-crypt unlock' or just checkout files.\n"
|