Archived
beatzaplentyandClaude Sonnet 4.6
f85c65870f
Consolidates nixos, docker, raspi, and debian-configuration into a single infrastructure-as-code repo. Includes: - ansible/: full inventory + proxmox-hardening, freeipa, and raspberrypi roles (converted from debian-configuration bash scripts) - terraform/: Proxmox VMs, Dynu DNS, Pi-hole (decommissioned stub), Docker container catalog — migrated from docker/infrastructure/terraform/ - stacks/docker/, stacks/raspi/, nixos/: placeholder READMEs pending git subtree population (see implementation plan) - docs/: internal MkDocs site with architecture, network topology, runbooks, and drift-detection guide; external sanitized site - scripts/: drift-detect.sh, docs-build.sh, install-hooks.sh, check-secrets.sh - CI: secret-scan (push/PR), drift-detect (daily), docs-build (on change) - Pi-hole removed throughout — DNS is FreeIPA, DHCP is router See docs/internal/implementation-plan.md for the phased rollout after pushing to Gitea. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UvNjoxTWEDkhXsd1Dq2ETP
89 lines
3.4 KiB
Bash
Executable File
89 lines
3.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Local drift detection runner.
|
|
# Runs terraform plan (all workspaces) and ansible --check, then summarises.
|
|
#
|
|
# Usage:
|
|
# ./scripts/drift-detect.sh # run everything
|
|
# ./scripts/drift-detect.sh --terraform # terraform only
|
|
# ./scripts/drift-detect.sh --ansible # ansible only
|
|
# ./scripts/drift-detect.sh --check-only # alias for full run (no apply)
|
|
set -euo pipefail
|
|
|
|
REPO_ROOT="$(git rev-parse --show-toplevel)"
|
|
cd "$REPO_ROOT"
|
|
|
|
RUN_TF=true
|
|
RUN_ANSIBLE=true
|
|
|
|
for arg in "$@"; do
|
|
case "$arg" in
|
|
--terraform) RUN_ANSIBLE=false ;;
|
|
--ansible) RUN_TF=false ;;
|
|
--check-only) ;; # default, no-op
|
|
*) echo "Unknown flag: $arg" >&2; exit 1 ;;
|
|
esac
|
|
done
|
|
|
|
DRIFT_FOUND=0
|
|
|
|
# ── Terraform ──────────────────────────────────────────────────────────────────
|
|
|
|
if [ "$RUN_TF" = true ]; then
|
|
echo ""
|
|
echo "━━━ Terraform drift detection ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
|
|
|
for workspace in terraform/proxmox terraform/dns terraform/pihole; do
|
|
if [ ! -f "${workspace}/providers.tf" ] && [ ! -f "${workspace}/provider.tf" ]; then
|
|
echo "[SKIP] ${workspace} — no providers.tf found"
|
|
continue
|
|
fi
|
|
|
|
echo ""
|
|
echo "--- ${workspace} ---"
|
|
(
|
|
cd "$workspace"
|
|
if [ ! -d .terraform ]; then
|
|
terraform init -input=false -no-color >/dev/null 2>&1
|
|
fi
|
|
set +e
|
|
terraform plan -detailed-exitcode -input=false -no-color
|
|
EXIT=$?
|
|
set -e
|
|
if [ "$EXIT" -eq 2 ]; then
|
|
echo "DRIFT: ${workspace} has pending changes"
|
|
DRIFT_FOUND=1
|
|
elif [ "$EXIT" -ne 0 ]; then
|
|
echo "ERROR in ${workspace} — plan failed (exit ${EXIT})"
|
|
DRIFT_FOUND=1
|
|
fi
|
|
)
|
|
done
|
|
fi
|
|
|
|
# ── Ansible ────────────────────────────────────────────────────────────────────
|
|
|
|
if [ "$RUN_ANSIBLE" = true ]; then
|
|
echo ""
|
|
echo "━━━ Ansible drift detection (--check --diff) ━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
|
(
|
|
cd ansible
|
|
ansible-playbook playbooks/site.yml --check --diff 2>&1 | tee /tmp/ansible-drift.log
|
|
if grep -q 'changed=' /tmp/ansible-drift.log; then
|
|
echo "DRIFT: Ansible found pending changes"
|
|
DRIFT_FOUND=1
|
|
fi
|
|
)
|
|
fi
|
|
|
|
# ── Summary ────────────────────────────────────────────────────────────────────
|
|
|
|
echo ""
|
|
echo "━━━ Summary ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
|
if [ "$DRIFT_FOUND" -eq 0 ]; then
|
|
echo "No drift detected. All infrastructure matches declared state."
|
|
else
|
|
echo "Drift detected — review the plan output above."
|
|
fi
|
|
|
|
exit "$DRIFT_FOUND"
|