feat(infra): one front door: day-2 ops, every rotation, checks and keys through ./infra #152

Merged

jfraeys merged 1 commit from jfraeys/feat/infra-one-front-door into main

2026-10-14 14:18:21 -04:00

jfraeys commented

2026-10-14 12:43:12 -04:00

Owner

Makes ./infra the one command an operator types on their machine.

New in ./infra (each still prints the script it runs):

health | backup | user | firewall | vpn | node | service | demo ... are forwarded to ./manage (its global options such as --dry-run/--yes work anywhere on the line). Verified: ./infra health --help reaches manage's help.
rotate ovh-s3 | ci-ssh-key | headscale-api-key [hours] | ci-state-key [...]: the credentials outside rotate-secret.sh's service list, which had no front-door command.
check exposure | versions: the read-only production exposure check and the tool-version drift check.
keys operator | recovery [project]: SOPS age key creation (Keychain / personal Bitwarden).

Why manage is not merged into infra: roles/manage_cli installs ./manage on the hosts as infra-manage for on-host emergency use, where git, tea and the vault are not available. So the join is at the front door: infra forwards to it, manage stays self-contained. Its secret command now points at ./infra rotate (kept for rotate all and existing callers). ./setup stays the Terraform + Ansible engine; ./infra deploy is its gated production path, and staging/DR/bootstrap still call ./setup directly.

Docs: docs/runbooks/daily-commands.md lists the new commands and how the three entry points fit; README points day-2 ops at ./infra.

Tests: test-infra-cli.sh +13 dispatch cases (all pass); script-existence checks extended. Independent of #151 (the vault-PR helper); either can merge first.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ

Makes `./infra` the one command an operator types on their machine. **New in `./infra`** (each still prints the script it runs): - `health | backup | user | firewall | vpn | node | service | demo ...` are forwarded to `./manage` (its global options such as `--dry-run`/`--yes` work anywhere on the line). Verified: `./infra health --help` reaches manage's help. - `rotate ovh-s3 | ci-ssh-key | headscale-api-key [hours] | ci-state-key [...]`: the credentials outside `rotate-secret.sh`'s service list, which had no front-door command. - `check exposure | versions`: the read-only production exposure check and the tool-version drift check. - `keys operator | recovery [project]`: SOPS age key creation (Keychain / personal Bitwarden). **Why `manage` is not merged into `infra`:** `roles/manage_cli` installs `./manage` on the hosts as `infra-manage` for on-host emergency use, where git, tea and the vault are not available. So the join is at the front door: `infra` forwards to it, `manage` stays self-contained. Its `secret` command now points at `./infra rotate` (kept for `rotate all` and existing callers). `./setup` stays the Terraform + Ansible engine; `./infra deploy` is its gated production path, and staging/DR/bootstrap still call `./setup` directly. **Docs:** `docs/runbooks/daily-commands.md` lists the new commands and how the three entry points fit; README points day-2 ops at `./infra`. **Tests:** `test-infra-cli.sh` +13 dispatch cases (all pass); script-existence checks extended. Independent of #151 (the vault-PR helper); either can merge first. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ

jfraeys added 1 commit

2026-10-14 12:43:12 -04:00

feat(infra): one front door: day-2 ops, every rotation, checks and keys through ./infra

Lint / lint (pull_request) Successful in 1m52s

Details

Secret scan / scan (pull_request) Successful in 26s

Details

f10cac750d

./infra now also forwards health/backup/user/firewall/vpn/node/service/demo to
./manage (its global options work anywhere on the line), and covers the
credentials outside rotate-secret.sh's service list (rotate ovh-s3, ci-ssh-key,
headscale-api-key, ci-state-key), the read-only checks (check exposure,
versions) and SOPS age key creation (keys operator|recovery [project]).

./manage stays a separate, self-contained script: roles/manage_cli installs it on
the hosts as infra-manage, where git, tea and the vault are not available. Its
`secret` command now points at ./infra rotate. ./setup stays the engine; staging,
DR and bootstrap still call it directly.

daily-commands.md documents the commands and how the three entry points fit;
test-infra-cli.sh gains 13 dispatch cases.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ

jfraeys referenced this pull request

2026-10-14 12:43:36 -04:00

Operator tooling: automation candidates and scripts/ organization (2026-10-14 survey) #153

jfraeys referenced this pull request

2026-10-14 12:53:57 -04:00

feat(infra): ./infra approve merges the promotion PR after the gate's own checks #154

jfraeys force-pushed jfraeys/feat/infra-one-front-door from f10cac750d

Lint / lint (pull_request) Successful in 1m52s

Details

Secret scan / scan (pull_request) Successful in 26s

Details

to db6748d882