Taskfile.yaml

---
# yaml-language-server: $schema=https://taskfile.dev/schema.json
version: "3"

dotenv: ['.env']

includes:
  aws:
    taskfile: "https://raw.githubusercontent.com/CowDogMoo/taskfile-templates/main/aws/Taskfile.yaml"
    optional: true
  github:
    taskfile: "https://raw.githubusercontent.com/CowDogMoo/taskfile-templates/main/github/Taskfile.yaml"
    optional: true
  pre-commit:
    taskfile: "https://raw.githubusercontent.com/CowDogMoo/taskfile-templates/main/pre-commit/Taskfile.yaml"
    optional: true
  renovate:
    taskfile: "https://raw.githubusercontent.com/CowDogMoo/taskfile-templates/main/renovate/Taskfile.yaml"
    optional: true
  secrets:
    taskfile: "https://raw.githubusercontent.com/CowDogMoo/taskfile-templates/main/secrets/Taskfile.yaml"  # pragma: allowlist secret
    optional: true
  remote:
    taskfile: .taskfiles/remote/Taskfile.yaml
    optional: true
    vars:
      K8S_NAMESPACE: '{{.K8S_NAMESPACE}}'
  benchmark:
    taskfile: .taskfiles/benchmark/Taskfile.yaml
    optional: true
    vars:
      ARES_CLI: '{{.ARES_CLI}}'
      AWS_PROFILE: '{{.AWS_PROFILE}}'
  red:
    taskfile: .taskfiles/red/Taskfile.yaml
    optional: true
    vars:
      ARES_CLI: '{{.ARES_CLI}}'
      MODEL: '{{.MODEL}}'
      ARES_CONFIG: '{{.ARES_CONFIG}}'
      MAX_STEPS_RED: '{{.MAX_STEPS_RED}}'
      LOG_DIR: '{{.LOG_DIR}}'
      REPORT_DIR: '{{.REPORT_DIR}}'
      GRAFANA_URL: '{{.GRAFANA_URL}}'
      LOKI_URL: '{{.LOKI_URL}}'
      EC2_GRAFANA_URL: '{{.EC2_GRAFANA_URL}}'
      EC2_LOKI_URL: '{{.EC2_LOKI_URL}}'
      DREADNODE_SERVER_URL: '{{.DREADNODE_SERVER_URL}}'
      DREADNODE_ORGANIZATION: '{{.DREADNODE_ORGANIZATION}}'
      DREADNODE_WORKSPACE: '{{.DREADNODE_WORKSPACE}}'
      DREADNODE_PROJECT: '{{.DREADNODE_PROJECT}}'
      K8S_NAMESPACE: '{{.K8S_NAMESPACE}}'
      TARGET_PROFILE: '{{.TARGET_PROFILE}}'
      TARGET_REGION: '{{.TARGET_REGION}}'
      TARGET: '{{.TARGET}}'
      DOMAIN: '{{.DOMAIN}}'
      EC2_NAME: '{{.EC2_NAME}}'
      AWS_PROFILE: '{{.AWS_PROFILE}}'
      AWS_REGION: '{{.AWS_REGION}}'
      BLUE_ENABLED: '{{.BLUE_ENABLED}}'
      BLUE_LLM_MODEL: '{{.BLUE_LLM_MODEL}}'
      OTEL_TRACES_ENDPOINT: '{{.OTEL_TRACES_ENDPOINT}}'
  ec2:
    taskfile: .taskfiles/ec2/Taskfile.yaml
    optional: true
    vars:
      EC2_NAME: '{{.EC2_NAME}}'
      ARES_CLI: '{{.ARES_CLI}}'
      AWS_PROFILE: '{{.AWS_PROFILE}}'
      AWS_REGION: '{{.AWS_REGION}}'
      ARES_CONFIG: '{{.ARES_CONFIG}}'
      OTEL_TRACES_ENDPOINT: '{{.OTEL_TRACES_ENDPOINT}}'
      ALLOY_LOKI_ENDPOINT: '{{.ALLOY_LOKI_ENDPOINT}}'
      LOKI_URL: '{{.LOKI_URL}}'
  k8s:
    taskfile: .taskfiles/k8s/Taskfile.yaml
    optional: true
    vars:
      K8S_NAMESPACE: '{{.K8S_NAMESPACE}}'
  blue:
    taskfile: .taskfiles/blue/Taskfile.yaml
    optional: true
    vars:
      ARES_CLI: '{{.ARES_CLI}}'
      MODEL: '{{.MODEL}}'
      ARES_CONFIG: '{{.ARES_CONFIG}}'
      MAX_STEPS_BLUE: '{{.MAX_STEPS_BLUE}}'
      MAX_STEPS_BLUE_ONCE: '{{.MAX_STEPS_BLUE_ONCE}}'
      POLL_INTERVAL: '{{.POLL_INTERVAL}}'
      LOG_DIR: '{{.LOG_DIR}}'
      REPORT_DIR: '{{.REPORT_DIR}}'
      GRAFANA_URL: '{{.GRAFANA_URL}}'
      DREADNODE_SERVER_URL: '{{.DREADNODE_SERVER_URL}}'
      DREADNODE_ORGANIZATION: '{{.DREADNODE_ORGANIZATION}}'
      DREADNODE_WORKSPACE: '{{.DREADNODE_WORKSPACE}}'
      DREADNODE_PROJECT: '{{.DREADNODE_PROJECT}}'
      K8S_NAMESPACE: '{{.K8S_NAMESPACE}}'
  obs:
    taskfile: .taskfiles/obs/Taskfile.yaml
    optional: true
  proxmox:
    taskfile: .taskfiles/proxmox/Taskfile.yaml
    optional: true
    vars:
      ARES_CLI: '{{.ARES_CLI}}'
      ARES_CONFIG: '{{.ARES_CONFIG}}'
      MODEL: '{{.MODEL}}'

vars:
  API_DIR: "."
  # Ares configuration
  # MODEL: '{{.MODEL | default "claude-sonnet-4-5-20250929"}}'
  MODEL: '{{.MODEL | default "gpt-5.2"}}'
  GRAFANA_URL: '{{.GRAFANA_URL}}'
  LOKI_URL: '{{.LOKI_URL}}'
  POLL_INTERVAL: '{{.POLL_INTERVAL | default "30"}}'
  MAX_STEPS_BLUE: '{{.MAX_STEPS_BLUE | default "50"}}'
  MAX_STEPS_BLUE_ONCE: '{{.MAX_STEPS_BLUE_ONCE | default "15"}}'  # ~15 min max for once mode
  MAX_STEPS_RED: '{{.MAX_STEPS_RED | default "150"}}'
  REPORT_DIR: '{{.REPORT_DIR | default "./reports"}}'
  LOG_DIR: '{{.LOG_DIR | default "./logs"}}'
  DREADNODE_SERVER_URL: '{{.DREADNODE_SERVER_URL}}'
  DREADNODE_ORGANIZATION: '{{.DREADNODE_ORGANIZATION | default "ares"}}'
  DREADNODE_WORKSPACE: '{{.DREADNODE_WORKSPACE | default "ares-protocol"}}'
  DREADNODE_PROJECT: '{{.DREADNODE_PROJECT | default "ares-soc"}}'
  # Config file (single source of truth for model assignments)
  ARES_CONFIG: '{{.ARES_CONFIG | default "./config/ares.yaml"}}'
  # Rust CLI binary
  ARES_CLI: '{{.ARES_CLI | default "./target/release/ares"}}'
  # Infrastructure
  K8S_NAMESPACE: '{{.K8S_NAMESPACE | default "attack-simulation"}}'
  TARGET_PROFILE: '{{.TARGET_PROFILE | default "lab"}}'
  TARGET_REGION: '{{.TARGET_REGION | default (env "AWS_DEFAULT_REGION") | default "us-east-1"}}'
  # Red team defaults
  TARGET: '{{.TARGET | default "dreadgoad"}}'
  DOMAIN: '{{.DOMAIN | default "sevenkingdoms.local"}}'
  # Observability
  OTEL_TRACES_ENDPOINT: '{{.OTEL_TRACES_ENDPOINT}}'
  ALLOY_LOKI_ENDPOINT: '{{.ALLOY_LOKI_ENDPOINT}}'
  # EC2 deployment (alternative to K8s)
  EC2_NAME: '{{.EC2_NAME | default "ares-tools"}}'
  # AWS profile/region: honor standard AWS_PROFILE / AWS_DEFAULT_REGION env vars.
  AWS_PROFILE: '{{.AWS_PROFILE | default (env "AWS_PROFILE") | default "lab"}}'
  AWS_REGION: '{{.AWS_REGION | default (env "AWS_DEFAULT_REGION") | default "us-east-1"}}'
  # Blue team on by default (BLUE_ENABLED=0 to skip). The default deployment
  # target is kali-ares on EC2, where the box reaches the observability stack
  # directly; running with blue off there just wastes a launch.
  BLUE_ENABLED: '{{.BLUE_ENABLED | default "1"}}'
  BLUE_LLM_MODEL: '{{.BLUE_LLM_MODEL | default ""}}'
  # Box-context observability endpoints — used when the orchestrator/workers
  # run on EC2 and need to reach Loki/Grafana themselves. GRAFANA_URL/LOKI_URL
  # in .env stay as the laptop's obs:forward localhost URLs; these are the
  # values baked into the launch script that ships to the box. Site-specific,
  # so they come from .env (see .env.example) — leave unset to use whatever
  # Secrets Manager holds. Point them at Loki directly rather than the Grafana
  # datasource proxy: proxy IDs get renumbered when datasources are recreated.
  EC2_LOKI_URL: '{{.EC2_LOKI_URL}}'
  EC2_GRAFANA_URL: '{{.EC2_GRAFANA_URL}}'

tasks:
  default:
    desc: List all available tasks
    silent: true
    cmds:
      - task --list --sort none

  run:
    desc: "One-shot: stop, launch red+blue op, optionally wait + capture snapshot + print benchmark:replay command (usage: task run [WAIT=true] [CAPTURE=true] [TARGET=dreadgoad] [EC2_NAME=kali-ares])"
    silent: true
    vars:
      WAIT: '{{.WAIT | default "false"}}'
      CAPTURE: '{{.CAPTURE | default "false"}}'
    cmds:
      - task: ec2:stop
      - task: red:ec2:multi
      - |
        if [ "{{.WAIT}}" != "true" ] && [ "{{.CAPTURE}}" != "true" ]; then
          exit 0
        fi
        # CAPTURE implies WAIT — capture must run against a completed op.
        task ec2:watch EC2_NAME="{{.EC2_NAME}}" LATEST=true
      - |
        if [ "{{.CAPTURE}}" != "true" ]; then exit 0; fi

        # Resolve op id + attacker private IP for the capture.
        OP_ID=$({{.ARES_CLI}} --ec2 "{{.EC2_NAME}}" --ec2-profile "{{.AWS_PROFILE}}" --ec2-region "{{.AWS_REGION}}" \
          ops list --latest 2>/dev/null | grep -oE 'op-[0-9]+-[0-9]+' | head -1)
        if [ -z "$OP_ID" ]; then
          echo "capture: could not resolve latest op id — run 'ares benchmark capture --latest --wait-for-flush' manually"
          exit 1
        fi
        export AWS_PROFILE="{{.AWS_PROFILE}}"
        export AWS_REGION="{{.AWS_REGION}}"
        . .taskfiles/ec2/scripts/run-ssm.sh
        INSTANCE_ID=$(resolve_instance_id "{{.EC2_NAME}}") || exit 1
        ATTACKER_IP=$(aws ec2 describe-instances --profile "{{.AWS_PROFILE}}" --region "{{.AWS_REGION}}" \
          --instance-ids "$INSTANCE_ID" \
          --query "Reservations[0].Instances[0].PrivateIpAddress" --output text 2>/dev/null) || true

        # SSM-forward the box's Redis so `ares benchmark capture` can read op state.
        lsof -ti:16379 | xargs kill 2>/dev/null || true
        aws ssm start-session --profile "{{.AWS_PROFILE}}" --region "{{.AWS_REGION}}" --target "$INSTANCE_ID" \
          --document-name AWS-StartPortForwardingSession \
          --parameters '{"portNumber":["6379"],"localPortNumber":["16379"]}' >/tmp/ares-run-capture-fwd.log 2>&1 &
        PF_PID=$!
        trap 'kill "$PF_PID" 2>/dev/null || true' EXIT
        for _ in $(seq 1 20); do nc -z localhost 16379 2>/dev/null && break; sleep 2; done

        echo "▶ capturing snapshot for $OP_ID (waits for Loki flush — up to ~60 min)..."
        {{.ARES_CLI}} benchmark capture "$OP_ID" \
          --redis-url redis://localhost:16379 \
          --wait-for-flush \
          ${ATTACKER_IP:+--attacker-ips "$ATTACKER_IP"} \
          || { echo "capture failed — run 'ares benchmark capture $OP_ID --wait-for-flush' later"; exit 1; }

        echo ""
        echo "▶ Snapshot captured. To evaluate blue against it:"
        echo "    task benchmark:replay OP_ID=$OP_ID"

  # Setup and initialization tasks
  check-command:
    internal: true
    silent: true
    vars:
      COMMAND: '{{.CLI_ARGS}}'
    cmds:
      - |
        command -v {{.COMMAND}} >/dev/null 2>&1 || (echo "Command '{{.COMMAND}}' not found. Please install it." && exit 1)

  check-dependencies:
    internal: true
    silent: true
    cmds:
      - task: check-command
        vars: { COMMAND: docker }
      - task: check-command
        vars: { COMMAND: cargo }
      - task: check-command
        vars: { COMMAND: ruby }

  setup-env:
    internal: true
    silent: true
    cmds:
      - cp -n .env.example .env || true

  setup-git-hooks:
    desc: Set up Git hooks
    silent: true
    cmds:
      - |
        #!/bin/bash
        set -e
        ln -sf .hooks/post_merge.sh .git/hooks/post-merge
        chmod +x .git/hooks/post-merge
        echo "Post-merge git hooks successfully installed!"

  init:
    desc: Initialize the project
    silent: true
    deps: [check-dependencies]
    cmds:
      - task: setup-env
      - task: setup-git-hooks
      - cargo build
      - task: pre-commit:install-pc-hooks
      - echo "Project is ready to go!"

  clean:
    desc: Clean build artifacts
    silent: true
    cmds:
      - cargo clean

  # Rust CLI tasks
  rust:build:
    desc: Build the Rust CLI binary (debug)
    silent: true
    cmds:
      - cargo build
      - echo "Debug binary built at target/debug/ares"

  rust:release:
    desc: Build the Rust CLI binary (release)
    silent: true
    cmds:
      - cargo build --release
      - echo "Release binary built at target/release/ares"

  rust:test:
    desc: Run Rust tests
    silent: true
    cmds:
      - cargo test

  rust:check:
    desc: Check Rust code compiles without building
    silent: true
    cmds:
      - cargo check

  rust:deploy:
    desc: "Cross-compile and deploy Rust binaries to K8s pods"
    cmds:
      - task: remote:rust:deploy:quick

  # GitHub tasks
  create-release:
    desc: Create a release on GitHub
    silent: true
    cmds:
      - task: github:create-release

  # ===========================================================================
  # Ares Blue Team (SOC) Agent Tasks
  # ===========================================================================

  ares:config:check:
    desc: Check configuration and API key access
    silent: true
    cmds:
      - |
        echo "Checking Ares configuration..."
        echo ""
        echo "Environment:"
        echo "  Rust: $(rustc --version 2>/dev/null || echo 'not installed')"
        echo "  ares: $({{.ARES_CLI}} --version 2>/dev/null || echo 'not built — run task rust:release')"
        echo ""
        echo "Configuration:"
        echo "  Platform: {{.DREADNODE_SERVER_URL}}"
        echo "  Project: {{.DREADNODE_PROJECT}}"
        echo "  Config: {{.ARES_CONFIG}}"
        echo "  Model (override): {{.MODEL}}"
        echo "  Max steps (red/blue/blue-once): {{.MAX_STEPS_RED}}/{{.MAX_STEPS_BLUE}}/{{.MAX_STEPS_BLUE_ONCE}}"
        echo "  Poll interval: {{.POLL_INTERVAL}}s"
        echo "  Reports: {{.REPORT_DIR}}"
        echo "  Grafana: {{.GRAFANA_URL}}"
        echo ""
        echo "Checking 1Password CLI access..."

        # Check if op is installed
        if ! command -v op >/dev/null 2>&1; then
          echo "  ❌ 1Password CLI (op) not installed"
          echo ""
          echo "Install from: https://developer.1password.com/docs/cli/get-started/"
          exit 1
        fi

        echo "  ✅ 1Password CLI installed: $(op --version)"
        echo ""
        echo "Checking 1Password items..."

        # Check Dreadnode API key
        if op item get "Dreadnode Dev Platform" --fields api-key --reveal >/dev/null 2>&1; then
          echo "  ✅ Dreadnode API key accessible"
        else
          echo "  ❌ Dreadnode API key not found in 1Password"
          echo "     Item: 'Dreadnode Dev Platform'"
          echo "     Field: 'api-key'"
        fi

        # Check Grafana API key
        if op item get "Ares Grafana MCP" --fields grafana-token --reveal >/dev/null 2>&1; then
          echo "  ✅ Grafana API key accessible"
        else
          echo "  ⚠️  Grafana API key not found in 1Password"
          echo "     Item: 'Ares Grafana MCP'"
          echo "     Field: 'grafana-token'"
        fi

        # Check Anthropic API key
        if op item get "Dreadnode Claude" --fields api-key --reveal >/dev/null 2>&1; then
          echo "  ✅ Anthropic API key accessible"
        else
          echo "  ⚠️  Anthropic API key not found in 1Password"
          echo "     Item: 'Dreadnode Claude'"
          echo "     Field: 'api-key'"
        fi

        echo ""
        echo "Configuration check complete"

  ares:version:
    desc: Show Ares version information
    silent: true
    cmds:
      - '{{.ARES_CLI}} --version'

  # ===========================================================================
  # Config Management Tasks
  # ===========================================================================

  config:models:
    desc: "Show model assignments from config"
    silent: true
    cmds:
      - '{{.ARES_CLI}} config show --models'

  config:set-model:
    desc: "Set model for a role (usage: task config:set-model -- orchestrator gpt-5.2)"
    silent: true
    cmds:
      - '{{.ARES_CLI}} config set-model {{.CLI_ARGS}}'

  config:set-model-all:
    desc: "Set all roles to the same model (usage: task config:set-model-all -- gpt-5.2)"
    silent: true
    cmds:
      - '{{.ARES_CLI}} config set-model --all {{.CLI_ARGS}}'