2026-02-22 14:38:14 +00:00
|
|
|
# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
|
migrate consuming stacks to ESO + remove k8s-dashboard static token
Phase 9: ExternalSecret migration across 26 stacks:
Fully migrated (vault data source removed, ESO delivers secrets):
- speedtest, shadowsocks, wealthfolio, plotting-book, f1-stream, tandoor
- n8n, dawarich, diun, netbox, onlyoffice, tuya-bridge
- hackmd (ESO template for DB URL), health (ESO template for DB URL)
- trading-bot (ESO template for DATABASE_URL + 7 secret env vars)
- forgejo (removed unused vault data source)
Partially migrated (vault kept for plan-time, ESO added for runtime):
- immich, linkwarden, nextcloud, paperless-ngx (jsondecode for homepage)
- claude-memory, rybbit, url, webhook_handler (plan-time in locals/jobs)
- woodpecker, openclaw, resume (plan-time in helm values/jobs/modules)
17 stacks unchanged (all plan-time: homepage annotations, configmaps,
module inputs) — vault data source works with OIDC auth.
Phase 17a: Remove k8s-dashboard static admin token secret.
Users now get tokens via: vault write kubernetes/creds/dashboard-admin
2026-03-15 19:05:04 +00:00
|
|
|
terraform {
|
|
|
|
|
required_providers {
|
|
|
|
|
vault = {
|
|
|
|
|
source = "hashicorp/vault"
|
|
|
|
|
version = "~> 4.0"
|
|
|
|
|
}
|
2026-04-16 16:31:36 +00:00
|
|
|
cloudflare = {
|
|
|
|
|
source = "cloudflare/cloudflare"
|
|
|
|
|
version = "~> 4"
|
|
|
|
|
}
|
2026-06-04 02:11:30 +00:00
|
|
|
authentik = {
|
|
|
|
|
source = "goauthentik/authentik"
|
|
|
|
|
version = "~> 2024.10"
|
|
|
|
|
}
|
|
|
|
|
# kubectl (gavinbunney) — workaround for hashicorp/kubernetes
|
|
|
|
|
# `kubernetes_manifest` panics on Kyverno CRDs. See beads code-e2dp.
|
|
|
|
|
# Declared for all stacks but only used where opted-in.
|
|
|
|
|
kubectl = {
|
|
|
|
|
source = "gavinbunney/kubectl"
|
|
|
|
|
version = "~> 1.14"
|
|
|
|
|
}
|
|
|
|
|
proxmox = {
|
|
|
|
|
source = "telmate/proxmox"
|
|
|
|
|
version = "3.0.2-rc07"
|
|
|
|
|
}
|
migrate consuming stacks to ESO + remove k8s-dashboard static token
Phase 9: ExternalSecret migration across 26 stacks:
Fully migrated (vault data source removed, ESO delivers secrets):
- speedtest, shadowsocks, wealthfolio, plotting-book, f1-stream, tandoor
- n8n, dawarich, diun, netbox, onlyoffice, tuya-bridge
- hackmd (ESO template for DB URL), health (ESO template for DB URL)
- trading-bot (ESO template for DATABASE_URL + 7 secret env vars)
- forgejo (removed unused vault data source)
Partially migrated (vault kept for plan-time, ESO added for runtime):
- immich, linkwarden, nextcloud, paperless-ngx (jsondecode for homepage)
- claude-memory, rybbit, url, webhook_handler (plan-time in locals/jobs)
- woodpecker, openclaw, resume (plan-time in helm values/jobs/modules)
17 stacks unchanged (all plan-time: homepage annotations, configmaps,
module inputs) — vault data source works with OIDC auth.
Phase 17a: Remove k8s-dashboard static admin token secret.
Users now get tokens via: vault write kubernetes/creds/dashboard-admin
2026-03-15 19:05:04 +00:00
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
2026-02-22 14:38:14 +00:00
|
|
|
variable "kube_config_path" {
|
migrate consuming stacks to ESO + remove k8s-dashboard static token
Phase 9: ExternalSecret migration across 26 stacks:
Fully migrated (vault data source removed, ESO delivers secrets):
- speedtest, shadowsocks, wealthfolio, plotting-book, f1-stream, tandoor
- n8n, dawarich, diun, netbox, onlyoffice, tuya-bridge
- hackmd (ESO template for DB URL), health (ESO template for DB URL)
- trading-bot (ESO template for DATABASE_URL + 7 secret env vars)
- forgejo (removed unused vault data source)
Partially migrated (vault kept for plan-time, ESO added for runtime):
- immich, linkwarden, nextcloud, paperless-ngx (jsondecode for homepage)
- claude-memory, rybbit, url, webhook_handler (plan-time in locals/jobs)
- woodpecker, openclaw, resume (plan-time in helm values/jobs/modules)
17 stacks unchanged (all plan-time: homepage annotations, configmaps,
module inputs) — vault data source works with OIDC auth.
Phase 17a: Remove k8s-dashboard static admin token secret.
Users now get tokens via: vault write kubernetes/creds/dashboard-admin
2026-03-15 19:05:04 +00:00
|
|
|
type = string
|
|
|
|
|
default = "~/.kube/config"
|
2026-02-22 14:38:14 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
provider "kubernetes" {
|
|
|
|
|
config_path = var.kube_config_path
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
provider "helm" {
|
|
|
|
|
kubernetes = {
|
|
|
|
|
config_path = var.kube_config_path
|
|
|
|
|
}
|
|
|
|
|
}
|
migrate consuming stacks to ESO + remove k8s-dashboard static token
Phase 9: ExternalSecret migration across 26 stacks:
Fully migrated (vault data source removed, ESO delivers secrets):
- speedtest, shadowsocks, wealthfolio, plotting-book, f1-stream, tandoor
- n8n, dawarich, diun, netbox, onlyoffice, tuya-bridge
- hackmd (ESO template for DB URL), health (ESO template for DB URL)
- trading-bot (ESO template for DATABASE_URL + 7 secret env vars)
- forgejo (removed unused vault data source)
Partially migrated (vault kept for plan-time, ESO added for runtime):
- immich, linkwarden, nextcloud, paperless-ngx (jsondecode for homepage)
- claude-memory, rybbit, url, webhook_handler (plan-time in locals/jobs)
- woodpecker, openclaw, resume (plan-time in helm values/jobs/modules)
17 stacks unchanged (all plan-time: homepage annotations, configmaps,
module inputs) — vault data source works with OIDC auth.
Phase 17a: Remove k8s-dashboard static admin token secret.
Users now get tokens via: vault write kubernetes/creds/dashboard-admin
2026-03-15 19:05:04 +00:00
|
|
|
|
|
|
|
|
provider "vault" {
|
|
|
|
|
address = "https://vault.viktorbarzin.me"
|
|
|
|
|
skip_child_token = true
|
|
|
|
|
}
|
2026-06-04 02:11:30 +00:00
|
|
|
|
|
|
|
|
provider "kubectl" {
|
|
|
|
|
config_path = var.kube_config_path
|
|
|
|
|
load_config_file = true
|
|
|
|
|
}
|