Taskfile.yaml

version: "3"

# Load environment variables from .env file if it exists
dotenv: [".env"]

vars:
  SSH_KEY:
    sh: echo "${SSH_KEY:-$HOME/.ssh/id_ed25519}"
  KUBE_CONTROLLER:
    sh: echo "${KUBE_CONTROLLER:-}"
  KUBE_NAMESPACE:
    sh: echo "${KUBE_NAMESPACE:-}"
  KUBE_CONTEXT:
    sh: echo "${KUBE_CONTEXT:-}"

tasks:
  default:
    cmds:
      - task --list

  prereqs:
    desc: "Ensure required tools are installed"
    cmds:
      - which sops
      - which kubeseal
      - which ssh-to-age
    silent: true

  check:ssh-key:
    desc: "Verify SSH key exists and is valid"
    internal: true
    cmds:
      - |
        if [ ! -f "{{.SSH_KEY}}" ]; then
          echo "ERROR: SSH key not found at {{.SSH_KEY}}"
          echo "Please create .env from .env.example and set SSH_KEY path"
          exit 1
        fi
        if [ ! -f "{{.SSH_KEY}}.pub" ]; then
          echo "ERROR: Public key not found at {{.SSH_KEY}}.pub"
          exit 1
        fi
        echo "✓ SSH key found at {{.SSH_KEY}}"
    silent: true

  # ---------------- USER MANAGEMENT ----------------

  key:print:
    desc: "Show your public Age key (derived from SSH_KEY)"
    deps: [check:ssh-key]
    cmds:
      - ssh-to-age -i {{.SSH_KEY}}.pub
    silent: true

  key:add-user:
    desc: "Fetch a GitHub user's Age key. Usage: task key:add-user USER=octocat"
    requires:
      vars: [USER]
    cmds:
      - echo "Fetching key for GitHub user {{.USER}}..."
      - curl -s "https://github.com/{{.USER}}.keys" | ssh-to-age
      - echo "---"
      - echo "Copy the key above into .sops.yaml and run 'task secrets:rotate'"
    silent: true

  # ---------------- SECRET WORKFLOW ----------------

  secrets:edit:
    desc: "Open a .sops.yaml file with SOPS"
    requires:
      vars: [FILE]
    deps: [prereqs, check:ssh-key]
    cmds:
      - export SOPS_AGE_KEY=$(ssh-to-age -private-key -i {{.SSH_KEY}}) && sops {{.FILE}}

  secrets:decrypt:
    desc: "Create/refresh .secret.yaml files from .sops.yaml files"
    deps: [prereqs, check:ssh-key]
    cmds:
      - ./scripts/secrets_decrypt.sh "{{.FILE}}" {{.SSH_KEY}}

  secrets:checkout:
    desc: "Alias for secrets:decrypt (decrypts specified/all .sops files)"
    deps: [prereqs, check:ssh-key]
    cmds:
      - task: secrets:decrypt
        vars: { FILE: "{{.FILE}}" }

  secrets:checkin:
    desc: "Re-encrypt updated .secret.yaml files back into .sops.yaml"
    deps: [prereqs, check:ssh-key]
    cmds:
      - ./scripts/secrets_checkin.sh "{{.FILE}}"

  secrets:seal:
    desc: "Turn .secret.yaml files into .sealed.yaml manifests"
    deps: [prereqs, check:ssh-key]
    cmds:
      - ./scripts/secrets_seal.sh "{{.FILE}}" {{.SSH_KEY}} {{.KUBE_CONTROLLER}} {{.KUBE_NAMESPACE}} "{{.KUBE_CONTEXT}}"

  secrets:seal-changed:
    desc: "Seal only the secrets whose .sops.yaml has changed"
    deps: [prereqs, check:ssh-key]
    cmds:
      - ./scripts/secrets_seal_changed.sh "{{.FILE}}" {{.SSH_KEY}} {{.KUBE_CONTROLLER}} {{.KUBE_NAMESPACE}} "{{.KUBE_CONTEXT}}"

  secrets:sync:
    desc: "Decrypt and seal in one go"
    deps: [prereqs, check:ssh-key]
    cmds:
      - task: secrets:decrypt
        vars: { FILE: "{{.FILE}}" }
      - task: secrets:seal
        vars: { FILE: "{{.FILE}}" }

  secrets:roundtrip:
    desc: "Workflow helper: checkout -> manual edit -> checkin -> seal changed"
    deps: [prereqs, check:ssh-key]
    cmds:
      - task: secrets:checkout
        vars: { FILE: "{{.FILE}}" }
      - echo "--- Edit the .secret.yaml files as needed, then continue ---"
      - task: secrets:checkin
        vars: { FILE: "{{.FILE}}" }
      - task: secrets:seal-changed
        vars: { FILE: "{{.FILE}}" }

  secrets:clean:
    desc: "Remove generated .secret.yaml files"
    cmds:
      - ./scripts/secrets_clean.sh "{{.FILE}}"

  secrets:rotate:
    desc: "Run sops updatekeys across .sops.yaml files"
    deps: [prereqs, check:ssh-key]
    cmds:
      - ./scripts/secrets_rotate.sh "{{.FILE}}" {{.SSH_KEY}}