# terragrunt-enc

Single source of truth for [encapi](https://git.unkin.net/unkin/encapi) ENC
data, managed with Terraform/Terragrunt. This repo owns every Puppet node
classification the estate has:

- **statuses** — Puppet environments (`production`, `develop`, `testing`)
- **roles** — the Puppet role classes (`roles::…`) a node can be assigned
- **nodes** — the certname → role + environment mapping for all 143 hosts
  (130 container VMs + 13 `prodnxsr*` physicals)

It **supersedes Cobbler** as the classification source for Puppet: encapi is the
live ENC, and this repo is the declarative, reviewed input to it. It also
supersedes the dual-write approach that was prototyped in terraform-incus
(PR #39) — terraform-incus is no longer involved in ENC data.

## Layout

```
config/
  root.hcl              # terragrunt root: consul backend (infra/terraform/enc/<leaf>/state)
  encapi/
    terragrunt.hcl      # leaf: feeds the three YAMLs into modules/encapi
    statuses.yaml       # Puppet environments
    roles.yaml          # Puppet role classes
    nodes.yaml          # certname -> {role, environment} for all 143 hosts
modules/
  encapi/               # encapi_status / encapi_role / encapi_node resources,
                        # ordered so nodes depend on their role + status (FK)
ci/
  extract_incus_nodes.py  # regenerates the container-VM block of nodes.yaml
                          # from a terraform-incus checkout
```

The encapi provider comes from the internal registry
(`artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/encapi` v0.1.0). Writes to
encapi are authenticated with `ENCAPI_WRITE_TOKEN`, read from Vault by the
Makefile.

## Data provenance

- **130 container VMs** (`environment: production`) are extracted from
  terraform-incus `config/instances/<host>/config.yaml`: certname is
  `<host>.main.unkin.net`, role is `cobbler_mgmt_classes[0]` (default
  `roles::base`). terraform-incus itself is not modified — the data is copied in
  here as plain config. Re-run `ci/extract_incus_nodes.py --incus-repo <path>`
  to refresh after VM changes.
- **13 `prodnxsr*` physical nodes** (`environment: develop`) are the bare-metal
  hypervisor / k8s nodes, not managed by the incus module. Their roles come from
  the PuppetDB `enc_role` fact and are maintained by hand in `nodes.yaml`.

## Usage

CI (Woodpecker) plans on every PR and applies on merge to `main`, authenticating
to Vault via kubernetes auth (`terraform-enc` ServiceAccount). Locally:

```sh
make plan    # approle auth by default (needs env with VAULT_ROLEID)
make apply
```