Makefile.terraform

# Terraform Deployment Makefile
# Simplified commands for common Terraform operations

.PHONY: help deploy plan destroy profile-list profile-show clean clean-locks \
        output aws-dev aws-prod azure-dev gcp-dev quick-plan aws-dev-plan quick-deploy \
        validate fmt state-list state-show docker-skip frontend-only

# Default profile settings
PROVIDER ?= aws
PROFILE ?= dev
ACTION ?= apply

help: ## Show this help message
	@echo "CUDly Terraform Deployment Commands"
	@echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
	@echo ""
	@echo "Quick Deploy:"
	@echo "  make deploy              # Deploy to AWS dev (default)"
	@echo "  make deploy PROFILE=prod # Deploy to AWS prod"
	@echo "  make deploy PROVIDER=azure PROFILE=dev"
	@echo ""
	@echo "Planning:"
	@echo "  make plan                # Plan AWS dev deployment"
	@echo "  make plan PROFILE=prod   # Plan AWS prod deployment"
	@echo ""
	@echo "Profile Management:"
	@echo "  make profile-list        # List all available profiles"
	@echo "  make profile-show        # Show current profile contents"
	@echo ""
	@echo "Docker Operations:"
	@echo "  make docker-skip         # Deploy without building the Docker image"
	@echo ""
	@echo "Cleanup:"
	@echo "  make destroy             # Destroy infrastructure (asks for confirmation)"
	@echo "  make clean               # Clean Terraform cache files"
	@echo ""
	@echo "Examples:"
	@echo "  make deploy PROVIDER=aws PROFILE=staging"
	@echo "  make plan PROVIDER=gcp PROFILE=prod"
	@echo "  make destroy PROVIDER=azure PROFILE=dev"
	@echo ""
	@echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"

deploy: ## Deploy infrastructure (default: AWS dev)
	@echo "🚀 Deploying to $(PROVIDER) $(PROFILE)..."
	@./scripts/tf-deploy.sh $(PROVIDER) $(PROFILE) apply

plan: ## Show deployment plan (default: AWS dev)
	@echo "📋 Planning deployment to $(PROVIDER) $(PROFILE)..."
	@./scripts/tf-deploy.sh $(PROVIDER) $(PROFILE) plan

destroy: ## Destroy infrastructure (asks for confirmation)
	@echo "⚠️  Destroying $(PROVIDER) $(PROFILE) infrastructure..."
	@./scripts/tf-deploy.sh $(PROVIDER) $(PROFILE) destroy

output: ## Show Terraform outputs
	@./scripts/tf-deploy.sh $(PROVIDER) $(PROFILE) output

profile-list: ## List all available profiles
	@echo "Available Profiles:"
	@echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
	@echo ""
	@echo "AWS:"
	@ls -1 terraform/profiles/aws/*.tfvars 2>/dev/null | xargs -n1 basename | sed 's/.tfvars$$/  /' | sed 's/^/  /' || echo "  (none)"
	@echo ""
	@echo "Azure:"
	@ls -1 terraform/profiles/azure/*.tfvars 2>/dev/null | xargs -n1 basename | sed 's/.tfvars$$/  /' | sed 's/^/  /' || echo "  (none)"
	@echo ""
	@echo "GCP:"
	@ls -1 terraform/profiles/gcp/*.tfvars 2>/dev/null | xargs -n1 basename | sed 's/.tfvars$$/  /' | sed 's/^/  /' || echo "  (none)"
	@echo ""

profile-show: ## Show current profile contents
	@echo "Profile: $(PROVIDER)/$(PROFILE)"
	@echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
	@cat terraform/profiles/$(PROVIDER)/$(PROFILE).tfvars 2>/dev/null || echo "Profile not found"

clean: ## Clean Terraform cache and state files (preserves .terraform.lock.hcl)
	@echo "🧹 Cleaning Terraform cache files..."
	@find terraform/environments -name ".terraform" -type d -exec rm -rf {} + 2>/dev/null || true
	@find terraform/environments -name "*.tfstate.backup" -type f -delete 2>/dev/null || true
	@echo "✅ Clean complete"

# The lock files are the committed provider checksum pins, so deleting them is
# a supply-chain change: the next init picks whatever the version constraints
# admit today. Hence the explicit opt-in (issue #349).
clean-locks: ## Delete .terraform.lock.hcl files (needs CONFIRM_CLEAN_LOCKS=yes)
	@if [ "$(CONFIRM_CLEAN_LOCKS)" != "yes" ]; then \
		echo "Refusing to delete the .terraform.lock.hcl provider pins without CONFIRM_CLEAN_LOCKS=yes." >&2; \
		echo "The next terraform init re-resolves providers to the newest builds the constraints allow." >&2; \
		exit 1; \
	fi
	@echo "⚠️  Deleting lock files — run terraform init to re-resolve providers"
	@echo "⚠️  Review the regenerated .terraform.lock.hcl diffs as a provider supply-chain change before committing them"
	@find terraform/environments -name ".terraform.lock.hcl" -type f -delete 2>/dev/null || true
	@echo "✅ Lock files deleted"

# Convenience shortcuts
aws-dev: ## Deploy to AWS dev
	@$(MAKE) deploy PROVIDER=aws PROFILE=dev

aws-prod: ## Deploy to AWS prod
	@$(MAKE) deploy PROVIDER=aws PROFILE=prod

azure-dev: ## Deploy to Azure dev
	@$(MAKE) deploy PROVIDER=azure PROFILE=dev

gcp-dev: ## Deploy to GCP dev
	@$(MAKE) deploy PROVIDER=gcp PROFILE=dev

# Quick actions
quick-plan: aws-dev-plan ## Quick plan for AWS dev
aws-dev-plan:
	@$(MAKE) plan PROVIDER=aws PROFILE=dev

quick-deploy: aws-dev ## Quick deploy to AWS dev

# Validation
validate: ## Validate Terraform configuration
	@echo "🔍 Validating Terraform configuration..."
	@cd terraform/environments/$(PROVIDER)/$(PROFILE) && terraform validate

fmt: ## Format Terraform files
	@echo "✨ Formatting Terraform files..."
	@terraform fmt -recursive terraform/

# State management
state-list: ## List resources in Terraform state
	@cd terraform/environments/$(PROVIDER)/$(PROFILE) && terraform state list

state-show: ## Show detailed state for a resource
	@cd terraform/environments/$(PROVIDER)/$(PROFILE) && terraform state show $(RESOURCE)

# Docker operations
#
# Note: an earlier draft of this file also had a "docker-build" target
# (build the image but skip the ECR push, via a "skip_docker_push" var)
# and a "frontend-skip" target (skip frontend build, via an
# "enable_frontend_build" var). Neither variable exists anywhere in
# terraform/environments/*/build.tf or variables.tf any more:
#   - the build module has no build-without-push option, so "docker-build"
#     has no current equivalent;
#   - frontend assets are now bundled into the Docker/app build rather than
#     built as a separate Terraform-controlled step, and the closest
#     surviving flag (enable_cdn) only toggles the CloudFront distribution
#     in front of the frontend (defaulting to false already), not whether
#     the frontend gets built - so a "frontend-skip" wrapper would be
#     redundant with plain `make deploy`.
# Only the "skip the whole Docker build" case still maps to a real
# variable (enable_docker_build, replacing the old skip_docker_build).
docker-skip: ## Deploy without building the Docker image (uses pre-built image_uri)
	@echo "⏭️  Deploying without Docker build..."
	@./scripts/tf-deploy.sh $(PROVIDER) $(PROFILE) apply -var="enable_docker_build=false"

# Frontend operations
frontend-only: ## Deploy frontend only
	@echo "🎨 Deploying frontend..."
	@./scripts/tf-deploy.sh $(PROVIDER) $(PROFILE) apply -target=module.frontend