Common Operations (Makefile)

The root Makefile in the automation repo wraps every Terraform and Ansible command. All secrets are pulled at runtime from Bitwarden (bw get password '<item name>') — never stored in the repo — so the item name is noted next to each target below.

First-time bootstrap / full-fleet

make setup-all      # terraform apply + wait for cloud-init + configure every VM
make update-all     # re-run Ansible (update tag) across every VM, no Terraform

Infrastructure (Terraform)

make provision      # terraform apply — creates/resizes VMs, rarely needed directly
make wait           # provision, then wait for cloud-init/SSH to come up

Per-server targets

Area	Setup / Update	Bitwarden secrets used
Docker Build	make setup-docker-build / update-docker-build	Docker Registry Password
Gitea runner (on Docker Build)	make setup-gitea-runner / update-gitea-runner	— (needs a Gitea registration token)
Synthesis Test	make setup-synthesis-test / update-synthesis-test	Github Synthesis PAT, Docker Registry Password
Webserver	make setup-webserver / update-webserver	Cloudflare DNS Token, Webserver htpasswd admin
Observability	make setup-observability / update-observability	Grafana Admin Password
API Gateway	make setup-api-gateway / update-api-gateway	API Gateway Admin Secret, Docker Registry Password
Services User	make setup-services-user / update-services-user	Docker Registry Password
Services User apps only	make deploy-services-user-apps	—
Services Staff	make setup-services-staff / update-services-staff	Docker Registry Password
Services Staff apps only	make deploy-services-staff-apps	—
Gitea	make deploy-gitea	Gitea DB Password, Gitea Admin Password
Rocket.Chat	make deploy-rocketchat	Rocket.Chat Admin Password

Amergin

make setup-amergin               # base host bring-up (Huggingface Token Amergin)
make update-amergin              # re-apply Alloy/observability config only

make setup-fotheidil-api         # (Fotheidil Supabase Key) — requires the vSwitch
make setup-fotheidil-recognition # (Huggingface Token Amergin) — requires the vSwitch + models on HF
make setup-batch-recognition     # (Huggingface Token Amergin) — requires the vSwitch + models on HF

make setup-qomhra-llm            # (Huggingface Token Amergin, Qomhra LLM API Key)
make update-qomhra-llm           # re-apply vLLM config (tuning/key changes)

Puca

make setup-puca PUCA_PAT=github_pat_...   # generic: pass your own GitHub PAT
make setup-puca-john                       # (Github Puca PAT, Webserver htpasswd admin)

Known gap

setup-puca-joey is declared in the Makefile (with a PUCA_PAT_JOEY variable) but has no target body yet — it currently does nothing if invoked. Use make setup-puca PUCA_PAT=... instead until this is fixed.

Modifying infrastructure

• Changing VM specs: edit the .tf files in terraform/hetzner-main/ — note the resize gotcha for webserver/services-staff described on their server pages.
• Adding software/packages: edit the relevant playbook .yml in ansible/.
• Adding or changing a public site: edit the vhost in networking/nginx-config/ and run make update-webserver.

See Modifying Infrastructure for the full walkthroughs.