Makefile

# hermes-stack
#
# Provision a hardened single-node host (Hetzner Cloud) and run services behind
# a Cloudflare Tunnel — no inbound HTTP ports, no public origin IP.
#
# Stack: Terraform (Hetzner) + Ansible (hardening, cloudflared, systemd units).

provision:
	cd terraform && terraform init && terraform apply

destroy:
	cd terraform && terraform destroy

configure:
	cd ansible && ansible-playbook -i inventory.ini site.yml

# Configure with Cloudflare Tunnel enabled. Token must be exported.
configure-tunnel:
	@test -n "$$CF_TUNNEL_TOKEN" || (echo "ERROR: export CF_TUNNEL_TOKEN first"; exit 1)
	cd ansible && ansible-playbook -i inventory.ini site.yml \
		-e cloudflare_tunnel_enabled=true

ssh:
	@cd terraform && eval $$(terraform output -raw ssh_command)

ip:
	@cd terraform && terraform output -raw server_ip

clean:
	rm -f ansible/inventory.ini

.PHONY: provision destroy configure configure-tunnel ssh ip clean