---
# yaml-language-server: $schema=https://taskfile.dev/schema.json
version: "3"

vars:
  SOPS_CONFIG_FILE: "{{.ROOT_DIR}}/.sops.yaml"

tasks:

  age-keygen:
    desc: Initialize Age Key for Sops
    cmd: age-keygen --output {{.AGE_FILE}}
    status:
      - test -f "{{.AGE_FILE}}"

  encrypt:
    desc: Encrypt all Kubernetes SOPS secrets that are not already encrypted
    cmds:
      - for: { var: file }
        task: .encrypt-file
        vars:
          file: "{{.ITEM}}"
    vars:
      file:
        sh: |
          if [ -d "{{.KUBERNETES_DIR}}" ]; then
              find "{{.KUBERNETES_DIR}}" -type f -name "*.sops.*" -exec grep -L "ENC\[AES256_GCM" {} \;
          fi

  .encrypt-file:
    internal: true
    cmd: sops --encrypt --in-place {{.file}}
    requires:
      vars: ["file"]
    preconditions:
      - { msg: "Missing Sops config file", sh: "test -f {{.SOPS_CONFIG_FILE}}" }
      - { msg: "Missing Sops Age key file", sh: "test -f {{.AGE_FILE}}" }

  .reset:
    internal: true
    cmd: rm -rf {{.SOPS_CONFIG_FILE}}