refactor: reorganize GitOps control plane

Makefile

@@ -0,0 +1,34 @@
+.PHONY: bootstrap validate vault-init terraform-init terraform-plan terraform-apply check-terraform-inputs
+
+KUBE_CONTEXT ?=
+TF_ROOT ?=
+BACKEND_CONFIG ?=
+TF_DIR = iac/terraform/live/dev-k3s/$(TF_ROOT)
+
+bootstrap:
+	@test -n "$(KUBE_CONTEXT)" || (echo "KUBE_CONTEXT is required" >&2; exit 1)
+	./hack/bootstrap-argocd.sh --context "$(KUBE_CONTEXT)"
+
+validate:
+	./hack/validate.sh
+
+vault-init:
+	./hack/vault-init.sh init
+
+check-terraform-inputs:
+	@case "$(TF_ROOT)" in \
+	  vault-core|vault-database) ;; \
+	  *) echo "TF_ROOT must be vault-core or vault-database" >&2; exit 1 ;; \
+	esac
+	@test -f "$(BACKEND_CONFIG)" || (echo "BACKEND_CONFIG must point to a readable backend file" >&2; exit 1)
+
+terraform-init: check-terraform-inputs
+	terraform -chdir="$(TF_DIR)" init -input=false -reconfigure -backend-config="$(abspath $(BACKEND_CONFIG))"
+
+terraform-plan: terraform-init
+	terraform -chdir="$(TF_DIR)" plan -input=false -lock-timeout=5m
+
+terraform-apply: terraform-init
+	@test "$(APPROVE_APPLY)" = "dev-k3s/$(TF_ROOT)" || \
+	  (echo "Set APPROVE_APPLY=dev-k3s/$(TF_ROOT) to continue" >&2; exit 1)
+	terraform -chdir="$(TF_DIR)" apply -input=false -lock-timeout=5m