infra/stacks/platform/terragrunt.hcl

# stacks/platform/terragrunt.hcl
include "root" {
  path = find_in_parent_folders()
}

dependency "infra" {
  config_path  = "../infra"
  skip_outputs = true
}

# NOTE: platform cannot depend on vault (vault depends on platform → cycle).
# Vault KV must be populated before platform apply. Use: vault first, then platform.
[ci skip] Add platform stack (core services) for Terragrunt migration stacks/platform/ contains 22 core/cluster services: metallb, dbaas, redis, traefik, technitium, headscale, authentik, rbac, k8s-portal, crowdsec, monitoring, vaultwarden, reverse-proxy, metrics-server, nvidia, kyverno, uptime-kuma, wireguard, xray, mailserver, cloudflared, infra-maintenance. Outputs: tls_secret_name, redis_host, postgresql_host/port, mysql_host/port, smtp_host/port — consumed by downstream service stacks via dependency blocks. 2026-02-22 13:21:09 +00:00			`# stacks/platform/terragrunt.hcl`
			`include "root" {`
			`path = find_in_parent_folders()`
			`}`

			`dependency "infra" {`
			`config_path = "../infra"`
			`skip_outputs = true`
			`}`
migrate all secrets from SOPS to Vault KV - Add vault provider to root terragrunt.hcl (generated providers.tf) - Delete stacks/vault/vault_provider.tf (now in generated providers.tf) - Add 124 variable declarations + 43 vault_kv_secret_v2 resources to vault/main.tf to populate Vault KV at secret/<stack-name> - Migrate 43 consuming stacks to read secrets from Vault KV via data "vault_kv_secret_v2" instead of SOPS var-file - Add dependency "vault" to all migrated stacks' terragrunt.hcl - Complex types (maps/lists) stored as JSON strings, decoded with jsondecode() in locals blocks Bootstrap secrets (vault_root_token, vault_authentik_client_id, vault_authentik_client_secret) remain in SOPS permanently. Apply order: vault stack first (populates KV), then all others. 2026-03-14 17:15:48 +00:00
fix: resolve HCL semicolons and vault-platform dependency cycle - Replace semicolons with newlines in vault/main.tf variable blocks (HCL does not support semicolons) - Remove dependency "vault" from platform/terragrunt.hcl to break cycle (vault already depends on platform) 2026-03-14 17:37:25 +00:00			`# NOTE: platform cannot depend on vault (vault depends on platform → cycle).`
			`# Vault KV must be populated before platform apply. Use: vault first, then platform.`