make service-check / make service: the service layer through the Makefile #31

New issue

Closed

opened 2026-10-06 15:01:14 +00:00 by pit · 0 comments

pit commented

2026-10-06 15:01:14 +00:00

Owner

Parent

#27

What to build

make service-check runs the playbook in check mode with diffs, and make service runs it for real, both against the correct inventory; both refuse when the Vault password file is absent. The service layer is the only one with no OpenTofu state, so its gate is the check run rather than a plan artifact. The runbook's "the Makefile" section gains this Target's entry.

Acceptance criteria

make service-check runs the playbook in check mode with diffs and mutates nothing.
make service runs against the Prod inventory.
A missing Vault password file fails the Target before the playbook starts.
The runbook documents this Target.

Blocked by

##29 — the Makefile scaffold and its apply gate.

## Parent #27 ## What to build `make service-check` runs the playbook in check mode with diffs, and `make service` runs it for real, both against the correct inventory; both refuse when the Vault password file is absent. The service layer is the only one with no OpenTofu state, so its gate is the check run rather than a plan artifact. The runbook's "the Makefile" section gains this Target's entry. ## Acceptance criteria - [ ] `make service-check` runs the playbook in check mode with diffs and mutates nothing. - [ ] `make service` runs against the Prod inventory. - [ ] A missing Vault password file fails the Target before the playbook starts. - [ ] The runbook documents this Target. ## Blocked by - ##29 — the Makefile scaffold and its apply gate.

pit added the

ready-for-agent

label

2026-10-06 15:01:14 +00:00

pit added a new dependency

2026-10-06 15:01:15 +00:00

#29 The Makefile: help, the apply gate, and the Guest Stack as the first Target

pit added a new dependency

2026-10-06 15:01:15 +00:00

#34 make prod: the whole Prod deploy in one command

pit added a new dependency

2026-10-06 15:01:15 +00:00