diff --git a/stacks/claude-memory/backend.tf b/stacks/claude-memory/backend.tf
new file mode 100644
index 00000000..ba80c42f
--- /dev/null
+++ b/stacks/claude-memory/backend.tf
@@ -0,0 +1,6 @@
+# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
+terraform {
+  backend "local" {
+    path = "/Users/viktorbarzin/code/infra/state/stacks/claude-memory/terraform.tfstate"
+  }
+}
diff --git a/stacks/claude-memory/providers.tf b/stacks/claude-memory/providers.tf
new file mode 100644
index 00000000..860c9eba
--- /dev/null
+++ b/stacks/claude-memory/providers.tf
@@ -0,0 +1,29 @@
+# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
+terraform {
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "~> 4.0"
+    }
+  }
+}
+
+variable "kube_config_path" {
+  type    = string
+  default = "~/.kube/config"
+}
+
+provider "kubernetes" {
+  config_path = var.kube_config_path
+}
+
+provider "helm" {
+  kubernetes = {
+    config_path = var.kube_config_path
+  }
+}
+
+provider "vault" {
+  address          = "https://vault.viktorbarzin.me"
+  skip_child_token = true
+}
diff --git a/stacks/dawarich/providers.tf b/stacks/dawarich/providers.tf
index f4845cc8..860c9eba 100644
--- a/stacks/dawarich/providers.tf
+++ b/stacks/dawarich/providers.tf
@@ -13,12 +13,6 @@ variable "kube_config_path" {
   default = "~/.kube/config"
 }
 
-variable "vault_root_token" {
-  type      = string
-  sensitive = true
-  default   = ""
-}
-
 provider "kubernetes" {
   config_path = var.kube_config_path
 }
@@ -31,6 +25,5 @@ provider "helm" {
 
 provider "vault" {
   address          = "https://vault.viktorbarzin.me"
-  token            = var.vault_root_token
   skip_child_token = true
 }
diff --git a/stacks/diun/providers.tf b/stacks/diun/providers.tf
index f4845cc8..860c9eba 100644
--- a/stacks/diun/providers.tf
+++ b/stacks/diun/providers.tf
@@ -13,12 +13,6 @@ variable "kube_config_path" {
   default = "~/.kube/config"
 }
 
-variable "vault_root_token" {
-  type      = string
-  sensitive = true
-  default   = ""
-}
-
 provider "kubernetes" {
   config_path = var.kube_config_path
 }
@@ -31,6 +25,5 @@ provider "helm" {
 
 provider "vault" {
   address          = "https://vault.viktorbarzin.me"
-  token            = var.vault_root_token
   skip_child_token = true
 }
diff --git a/stacks/external-secrets/backend.tf b/stacks/external-secrets/backend.tf
new file mode 100644
index 00000000..a5295bc4
--- /dev/null
+++ b/stacks/external-secrets/backend.tf
@@ -0,0 +1,6 @@
+# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
+terraform {
+  backend "local" {
+    path = "/Users/viktorbarzin/code/infra/state/stacks/external-secrets/terraform.tfstate"
+  }
+}
diff --git a/stacks/external-secrets/providers.tf b/stacks/external-secrets/providers.tf
new file mode 100644
index 00000000..860c9eba
--- /dev/null
+++ b/stacks/external-secrets/providers.tf
@@ -0,0 +1,29 @@
+# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
+terraform {
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "~> 4.0"
+    }
+  }
+}
+
+variable "kube_config_path" {
+  type    = string
+  default = "~/.kube/config"
+}
+
+provider "kubernetes" {
+  config_path = var.kube_config_path
+}
+
+provider "helm" {
+  kubernetes = {
+    config_path = var.kube_config_path
+  }
+}
+
+provider "vault" {
+  address          = "https://vault.viktorbarzin.me"
+  skip_child_token = true
+}
diff --git a/stacks/f1-stream/providers.tf b/stacks/f1-stream/providers.tf
index f4845cc8..860c9eba 100644
--- a/stacks/f1-stream/providers.tf
+++ b/stacks/f1-stream/providers.tf
@@ -13,12 +13,6 @@ variable "kube_config_path" {
   default = "~/.kube/config"
 }
 
-variable "vault_root_token" {
-  type      = string
-  sensitive = true
-  default   = ""
-}
-
 provider "kubernetes" {
   config_path = var.kube_config_path
 }
@@ -31,6 +25,5 @@ provider "helm" {
 
 provider "vault" {
   address          = "https://vault.viktorbarzin.me"
-  token            = var.vault_root_token
   skip_child_token = true
 }
diff --git a/stacks/grampsweb/providers.tf b/stacks/grampsweb/providers.tf
index f4845cc8..860c9eba 100644
--- a/stacks/grampsweb/providers.tf
+++ b/stacks/grampsweb/providers.tf
@@ -13,12 +13,6 @@ variable "kube_config_path" {
   default = "~/.kube/config"
 }
 
-variable "vault_root_token" {
-  type      = string
-  sensitive = true
-  default   = ""
-}
-
 provider "kubernetes" {
   config_path = var.kube_config_path
 }
@@ -31,6 +25,5 @@ provider "helm" {
 
 provider "vault" {
   address          = "https://vault.viktorbarzin.me"
-  token            = var.vault_root_token
   skip_child_token = true
 }
diff --git a/stacks/immich/providers.tf b/stacks/immich/providers.tf
index f4845cc8..860c9eba 100644
--- a/stacks/immich/providers.tf
+++ b/stacks/immich/providers.tf
@@ -13,12 +13,6 @@ variable "kube_config_path" {
   default = "~/.kube/config"
 }
 
-variable "vault_root_token" {
-  type      = string
-  sensitive = true
-  default   = ""
-}
-
 provider "kubernetes" {
   config_path = var.kube_config_path
 }
@@ -31,6 +25,5 @@ provider "helm" {
 
 provider "vault" {
   address          = "https://vault.viktorbarzin.me"
-  token            = var.vault_root_token
   skip_child_token = true
 }
diff --git a/stacks/matrix/.terraform.lock.hcl b/stacks/matrix/.terraform.lock.hcl
index 1e5d8b27..8830db04 100644
--- a/stacks/matrix/.terraform.lock.hcl
+++ b/stacks/matrix/.terraform.lock.hcl
@@ -38,3 +38,23 @@ provider "registry.terraform.io/hashicorp/kubernetes" {
     "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c",
   ]
 }
+
+provider "registry.terraform.io/hashicorp/vault" {
+  version     = "4.8.0"
+  constraints = "~> 4.0"
+  hashes = [
+    "h1:GPfhH6dr1LY0foPBDYv9bEGifx7eSwYqFcEAOWOUxLk=",
+    "zh:269ab13433f67684012ae7e15876532b0312f5d0d2002a9cf9febb1279ce5ea6",
+    "zh:4babc95bf0c40eb85005db1dc2ca403c46be4a71dd3e409db3711a56f7a5ca0e",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:86e27c1c625ecc24446a11eeffc3ac319b36c2b4e51251db8579256a0dbcf136",
+    "zh:a32f31da94824009e26b077374440b52098aecb93c92ff55dc3d31dd37c4ea25",
+    "zh:be0a18c6c0425518bab4fbffd82078b82036a88503b5d76064de551c9f646cbf",
+    "zh:be5a77fdfd36863ebeec79cd12b1d13322ffad6821d157a0b279789fa06b5937",
+    "zh:be8317d142a3caad74c7d936039ae27076a1b2b8312ef5208e2871a5f525977c",
+    "zh:c94a84895a3d9954b80e983eed4603330a5cdbbd8eef5b3c99278c2d1402ef3c",
+    "zh:de1fb712784dd8415f011ca5346a34f87fab6046c730557615247e511dbc7d98",
+    "zh:e3eafae7da550f86cae395d6660b2a0e93ec8d2b0e0e5ef982ec762e961fc952",
+    "zh:ff35fb1ab6add288f0f368981e56f780b50405accd1937131cba1137999c8d83",
+  ]
+}
diff --git a/stacks/matrix/providers.tf b/stacks/matrix/providers.tf
index 7b5cc7b8..860c9eba 100644
--- a/stacks/matrix/providers.tf
+++ b/stacks/matrix/providers.tf
@@ -1,8 +1,16 @@
 # Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
+terraform {
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "~> 4.0"
+    }
+  }
+}
+
 variable "kube_config_path" {
   type    = string
   default = "~/.kube/config"
-  sensitive = true
 }
 
 provider "kubernetes" {
@@ -14,3 +22,8 @@ provider "helm" {
     config_path = var.kube_config_path
   }
 }
+
+provider "vault" {
+  address          = "https://vault.viktorbarzin.me"
+  skip_child_token = true
+}
diff --git a/stacks/n8n/providers.tf b/stacks/n8n/providers.tf
index f4845cc8..860c9eba 100644
--- a/stacks/n8n/providers.tf
+++ b/stacks/n8n/providers.tf
@@ -13,12 +13,6 @@ variable "kube_config_path" {
   default = "~/.kube/config"
 }
 
-variable "vault_root_token" {
-  type      = string
-  sensitive = true
-  default   = ""
-}
-
 provider "kubernetes" {
   config_path = var.kube_config_path
 }
@@ -31,6 +25,5 @@ provider "helm" {
 
 provider "vault" {
   address          = "https://vault.viktorbarzin.me"
-  token            = var.vault_root_token
   skip_child_token = true
 }
diff --git a/stacks/netbox/providers.tf b/stacks/netbox/providers.tf
index f4845cc8..860c9eba 100644
--- a/stacks/netbox/providers.tf
+++ b/stacks/netbox/providers.tf
@@ -13,12 +13,6 @@ variable "kube_config_path" {
   default = "~/.kube/config"
 }
 
-variable "vault_root_token" {
-  type      = string
-  sensitive = true
-  default   = ""
-}
-
 provider "kubernetes" {
   config_path = var.kube_config_path
 }
@@ -31,6 +25,5 @@ provider "helm" {
 
 provider "vault" {
   address          = "https://vault.viktorbarzin.me"
-  token            = var.vault_root_token
   skip_child_token = true
 }
diff --git a/stacks/nextcloud/providers.tf b/stacks/nextcloud/providers.tf
index f4845cc8..860c9eba 100644
--- a/stacks/nextcloud/providers.tf
+++ b/stacks/nextcloud/providers.tf
@@ -13,12 +13,6 @@ variable "kube_config_path" {
   default = "~/.kube/config"
 }
 
-variable "vault_root_token" {
-  type      = string
-  sensitive = true
-  default   = ""
-}
-
 provider "kubernetes" {
   config_path = var.kube_config_path
 }
@@ -31,6 +25,5 @@ provider "helm" {
 
 provider "vault" {
   address          = "https://vault.viktorbarzin.me"
-  token            = var.vault_root_token
   skip_child_token = true
 }
diff --git a/stacks/novelapp/backend.tf b/stacks/novelapp/backend.tf
new file mode 100644
index 00000000..d228d8ff
--- /dev/null
+++ b/stacks/novelapp/backend.tf
@@ -0,0 +1,6 @@
+# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
+terraform {
+  backend "local" {
+    path = "/Users/viktorbarzin/code/infra/state/stacks/novelapp/terraform.tfstate"
+  }
+}
diff --git a/stacks/novelapp/providers.tf b/stacks/novelapp/providers.tf
new file mode 100644
index 00000000..f4845cc8
--- /dev/null
+++ b/stacks/novelapp/providers.tf
@@ -0,0 +1,36 @@
+# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
+terraform {
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "~> 4.0"
+    }
+  }
+}
+
+variable "kube_config_path" {
+  type    = string
+  default = "~/.kube/config"
+}
+
+variable "vault_root_token" {
+  type      = string
+  sensitive = true
+  default   = ""
+}
+
+provider "kubernetes" {
+  config_path = var.kube_config_path
+}
+
+provider "helm" {
+  kubernetes = {
+    config_path = var.kube_config_path
+  }
+}
+
+provider "vault" {
+  address          = "https://vault.viktorbarzin.me"
+  token            = var.vault_root_token
+  skip_child_token = true
+}
diff --git a/stacks/ollama/providers.tf b/stacks/ollama/providers.tf
index f4845cc8..860c9eba 100644
--- a/stacks/ollama/providers.tf
+++ b/stacks/ollama/providers.tf
@@ -13,12 +13,6 @@ variable "kube_config_path" {
   default = "~/.kube/config"
 }
 
-variable "vault_root_token" {
-  type      = string
-  sensitive = true
-  default   = ""
-}
-
 provider "kubernetes" {
   config_path = var.kube_config_path
 }
@@ -31,6 +25,5 @@ provider "helm" {
 
 provider "vault" {
   address          = "https://vault.viktorbarzin.me"
-  token            = var.vault_root_token
   skip_child_token = true
 }
diff --git a/stacks/paperless-ngx/providers.tf b/stacks/paperless-ngx/providers.tf
index f4845cc8..860c9eba 100644
--- a/stacks/paperless-ngx/providers.tf
+++ b/stacks/paperless-ngx/providers.tf
@@ -13,12 +13,6 @@ variable "kube_config_path" {
   default = "~/.kube/config"
 }
 
-variable "vault_root_token" {
-  type      = string
-  sensitive = true
-  default   = ""
-}
-
 provider "kubernetes" {
   config_path = var.kube_config_path
 }
@@ -31,6 +25,5 @@ provider "helm" {
 
 provider "vault" {
   address          = "https://vault.viktorbarzin.me"
-  token            = var.vault_root_token
   skip_child_token = true
 }
diff --git a/stacks/platform/backend.tf b/stacks/platform/backend.tf
index 6d424f69..f9db2d0d 100644
--- a/stacks/platform/backend.tf
+++ b/stacks/platform/backend.tf
@@ -1,6 +1,6 @@
 # Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
 terraform {
   backend "local" {
-    path = "/woodpecker/src/github.com/ViktorBarzin/infra/state/stacks/platform/terraform.tfstate"
+    path = "/Users/viktorbarzin/code/infra/state/stacks/platform/terraform.tfstate"
   }
 }
diff --git a/stacks/plotting-book/providers.tf b/stacks/plotting-book/providers.tf
index f4845cc8..860c9eba 100644
--- a/stacks/plotting-book/providers.tf
+++ b/stacks/plotting-book/providers.tf
@@ -13,12 +13,6 @@ variable "kube_config_path" {
   default = "~/.kube/config"
 }
 
-variable "vault_root_token" {
-  type      = string
-  sensitive = true
-  default   = ""
-}
-
 provider "kubernetes" {
   config_path = var.kube_config_path
 }
@@ -31,6 +25,5 @@ provider "helm" {
 
 provider "vault" {
   address          = "https://vault.viktorbarzin.me"
-  token            = var.vault_root_token
   skip_child_token = true
 }
diff --git a/stacks/poison-fountain/backend.tf b/stacks/poison-fountain/backend.tf
new file mode 100644
index 00000000..fa76e502
--- /dev/null
+++ b/stacks/poison-fountain/backend.tf
@@ -0,0 +1,6 @@
+# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
+terraform {
+  backend "local" {
+    path = "/Users/viktorbarzin/code/infra/state/stacks/poison-fountain/terraform.tfstate"
+  }
+}
diff --git a/stacks/poison-fountain/providers.tf b/stacks/poison-fountain/providers.tf
new file mode 100644
index 00000000..f4845cc8
--- /dev/null
+++ b/stacks/poison-fountain/providers.tf
@@ -0,0 +1,36 @@
+# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
+terraform {
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "~> 4.0"
+    }
+  }
+}
+
+variable "kube_config_path" {
+  type    = string
+  default = "~/.kube/config"
+}
+
+variable "vault_root_token" {
+  type      = string
+  sensitive = true
+  default   = ""
+}
+
+provider "kubernetes" {
+  config_path = var.kube_config_path
+}
+
+provider "helm" {
+  kubernetes = {
+    config_path = var.kube_config_path
+  }
+}
+
+provider "vault" {
+  address          = "https://vault.viktorbarzin.me"
+  token            = var.vault_root_token
+  skip_child_token = true
+}
diff --git a/stacks/real-estate-crawler/providers.tf b/stacks/real-estate-crawler/providers.tf
index f4845cc8..860c9eba 100644
--- a/stacks/real-estate-crawler/providers.tf
+++ b/stacks/real-estate-crawler/providers.tf
@@ -13,12 +13,6 @@ variable "kube_config_path" {
   default = "~/.kube/config"
 }
 
-variable "vault_root_token" {
-  type      = string
-  sensitive = true
-  default   = ""
-}
-
 provider "kubernetes" {
   config_path = var.kube_config_path
 }
@@ -31,6 +25,5 @@ provider "helm" {
 
 provider "vault" {
   address          = "https://vault.viktorbarzin.me"
-  token            = var.vault_root_token
   skip_child_token = true
 }
diff --git a/stacks/resume/providers.tf b/stacks/resume/providers.tf
index f4845cc8..860c9eba 100644
--- a/stacks/resume/providers.tf
+++ b/stacks/resume/providers.tf
@@ -13,12 +13,6 @@ variable "kube_config_path" {
   default = "~/.kube/config"
 }
 
-variable "vault_root_token" {
-  type      = string
-  sensitive = true
-  default   = ""
-}
-
 provider "kubernetes" {
   config_path = var.kube_config_path
 }
@@ -31,6 +25,5 @@ provider "helm" {
 
 provider "vault" {
   address          = "https://vault.viktorbarzin.me"
-  token            = var.vault_root_token
   skip_child_token = true
 }
diff --git a/stacks/rybbit/providers.tf b/stacks/rybbit/providers.tf
index f4845cc8..860c9eba 100644
--- a/stacks/rybbit/providers.tf
+++ b/stacks/rybbit/providers.tf
@@ -13,12 +13,6 @@ variable "kube_config_path" {
   default = "~/.kube/config"
 }
 
-variable "vault_root_token" {
-  type      = string
-  sensitive = true
-  default   = ""
-}
-
 provider "kubernetes" {
   config_path = var.kube_config_path
 }
@@ -31,6 +25,5 @@ provider "helm" {
 
 provider "vault" {
   address          = "https://vault.viktorbarzin.me"
-  token            = var.vault_root_token
   skip_child_token = true
 }
diff --git a/stacks/shadowsocks/providers.tf b/stacks/shadowsocks/providers.tf
index f4845cc8..860c9eba 100644
--- a/stacks/shadowsocks/providers.tf
+++ b/stacks/shadowsocks/providers.tf
@@ -13,12 +13,6 @@ variable "kube_config_path" {
   default = "~/.kube/config"
 }
 
-variable "vault_root_token" {
-  type      = string
-  sensitive = true
-  default   = ""
-}
-
 provider "kubernetes" {
   config_path = var.kube_config_path
 }
@@ -31,6 +25,5 @@ provider "helm" {
 
 provider "vault" {
   address          = "https://vault.viktorbarzin.me"
-  token            = var.vault_root_token
   skip_child_token = true
 }
diff --git a/stacks/tandoor/providers.tf b/stacks/tandoor/providers.tf
index f4845cc8..860c9eba 100644
--- a/stacks/tandoor/providers.tf
+++ b/stacks/tandoor/providers.tf
@@ -13,12 +13,6 @@ variable "kube_config_path" {
   default = "~/.kube/config"
 }
 
-variable "vault_root_token" {
-  type      = string
-  sensitive = true
-  default   = ""
-}
-
 provider "kubernetes" {
   config_path = var.kube_config_path
 }
@@ -31,6 +25,5 @@ provider "helm" {
 
 provider "vault" {
   address          = "https://vault.viktorbarzin.me"
-  token            = var.vault_root_token
   skip_child_token = true
 }
diff --git a/stacks/terminal/backend.tf b/stacks/terminal/backend.tf
new file mode 100644
index 00000000..a536d272
--- /dev/null
+++ b/stacks/terminal/backend.tf
@@ -0,0 +1,6 @@
+# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
+terraform {
+  backend "local" {
+    path = "/Users/viktorbarzin/code/infra/state/stacks/terminal/terraform.tfstate"
+  }
+}
diff --git a/stacks/terminal/providers.tf b/stacks/terminal/providers.tf
new file mode 100644
index 00000000..516f9fed
--- /dev/null
+++ b/stacks/terminal/providers.tf
@@ -0,0 +1,15 @@
+# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
+variable "kube_config_path" {
+  type    = string
+  default = "~/.kube/config"
+}
+
+provider "kubernetes" {
+  config_path = var.kube_config_path
+}
+
+provider "helm" {
+  kubernetes = {
+    config_path = var.kube_config_path
+  }
+}
diff --git a/stacks/trading-bot/backend.tf b/stacks/trading-bot/backend.tf
new file mode 100644
index 00000000..c0415d97
--- /dev/null
+++ b/stacks/trading-bot/backend.tf
@@ -0,0 +1,6 @@
+# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
+terraform {
+  backend "local" {
+    path = "/Users/viktorbarzin/code/infra/state/stacks/trading-bot/terraform.tfstate"
+  }
+}
diff --git a/stacks/trading-bot/providers.tf b/stacks/trading-bot/providers.tf
new file mode 100644
index 00000000..860c9eba
--- /dev/null
+++ b/stacks/trading-bot/providers.tf
@@ -0,0 +1,29 @@
+# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
+terraform {
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "~> 4.0"
+    }
+  }
+}
+
+variable "kube_config_path" {
+  type    = string
+  default = "~/.kube/config"
+}
+
+provider "kubernetes" {
+  config_path = var.kube_config_path
+}
+
+provider "helm" {
+  kubernetes = {
+    config_path = var.kube_config_path
+  }
+}
+
+provider "vault" {
+  address          = "https://vault.viktorbarzin.me"
+  skip_child_token = true
+}
diff --git a/stacks/tuya-bridge/providers.tf b/stacks/tuya-bridge/providers.tf
index f4845cc8..860c9eba 100644
--- a/stacks/tuya-bridge/providers.tf
+++ b/stacks/tuya-bridge/providers.tf
@@ -13,12 +13,6 @@ variable "kube_config_path" {
   default = "~/.kube/config"
 }
 
-variable "vault_root_token" {
-  type      = string
-  sensitive = true
-  default   = ""
-}
-
 provider "kubernetes" {
   config_path = var.kube_config_path
 }
@@ -31,6 +25,5 @@ provider "helm" {
 
 provider "vault" {
   address          = "https://vault.viktorbarzin.me"
-  token            = var.vault_root_token
   skip_child_token = true
 }
diff --git a/stacks/url/providers.tf b/stacks/url/providers.tf
index f4845cc8..860c9eba 100644
--- a/stacks/url/providers.tf
+++ b/stacks/url/providers.tf
@@ -13,12 +13,6 @@ variable "kube_config_path" {
   default = "~/.kube/config"
 }
 
-variable "vault_root_token" {
-  type      = string
-  sensitive = true
-  default   = ""
-}
-
 provider "kubernetes" {
   config_path = var.kube_config_path
 }
@@ -31,6 +25,5 @@ provider "helm" {
 
 provider "vault" {
   address          = "https://vault.viktorbarzin.me"
-  token            = var.vault_root_token
   skip_child_token = true
 }
diff --git a/stacks/vault/backend.tf b/stacks/vault/backend.tf
new file mode 100644
index 00000000..1125e5a3
--- /dev/null
+++ b/stacks/vault/backend.tf
@@ -0,0 +1,6 @@
+# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
+terraform {
+  backend "local" {
+    path = "/Users/viktorbarzin/code/infra/state/stacks/vault/terraform.tfstate"
+  }
+}
diff --git a/stacks/vault/providers.tf b/stacks/vault/providers.tf
new file mode 100644
index 00000000..860c9eba
--- /dev/null
+++ b/stacks/vault/providers.tf
@@ -0,0 +1,29 @@
+# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
+terraform {
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "~> 4.0"
+    }
+  }
+}
+
+variable "kube_config_path" {
+  type    = string
+  default = "~/.kube/config"
+}
+
+provider "kubernetes" {
+  config_path = var.kube_config_path
+}
+
+provider "helm" {
+  kubernetes = {
+    config_path = var.kube_config_path
+  }
+}
+
+provider "vault" {
+  address          = "https://vault.viktorbarzin.me"
+  skip_child_token = true
+}
diff --git a/stacks/wealthfolio/providers.tf b/stacks/wealthfolio/providers.tf
index f4845cc8..860c9eba 100644
--- a/stacks/wealthfolio/providers.tf
+++ b/stacks/wealthfolio/providers.tf
@@ -13,12 +13,6 @@ variable "kube_config_path" {
   default = "~/.kube/config"
 }
 
-variable "vault_root_token" {
-  type      = string
-  sensitive = true
-  default   = ""
-}
-
 provider "kubernetes" {
   config_path = var.kube_config_path
 }
@@ -31,6 +25,5 @@ provider "helm" {
 
 provider "vault" {
   address          = "https://vault.viktorbarzin.me"
-  token            = var.vault_root_token
   skip_child_token = true
 }
diff --git a/stacks/webhook_handler/providers.tf b/stacks/webhook_handler/providers.tf
index f4845cc8..860c9eba 100644
--- a/stacks/webhook_handler/providers.tf
+++ b/stacks/webhook_handler/providers.tf
@@ -13,12 +13,6 @@ variable "kube_config_path" {
   default = "~/.kube/config"
 }
 
-variable "vault_root_token" {
-  type      = string
-  sensitive = true
-  default   = ""
-}
-
 provider "kubernetes" {
   config_path = var.kube_config_path
 }
@@ -31,6 +25,5 @@ provider "helm" {
 
 provider "vault" {
   address          = "https://vault.viktorbarzin.me"
-  token            = var.vault_root_token
   skip_child_token = true
 }
diff --git a/stacks/woodpecker/backend.tf b/stacks/woodpecker/backend.tf
new file mode 100644
index 00000000..1585513f
--- /dev/null
+++ b/stacks/woodpecker/backend.tf
@@ -0,0 +1,6 @@
+# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
+terraform {
+  backend "local" {
+    path = "/Users/viktorbarzin/code/infra/state/stacks/woodpecker/terraform.tfstate"
+  }
+}
diff --git a/stacks/woodpecker/providers.tf b/stacks/woodpecker/providers.tf
new file mode 100644
index 00000000..860c9eba
--- /dev/null
+++ b/stacks/woodpecker/providers.tf
@@ -0,0 +1,29 @@
+# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
+terraform {
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "~> 4.0"
+    }
+  }
+}
+
+variable "kube_config_path" {
+  type    = string
+  default = "~/.kube/config"
+}
+
+provider "kubernetes" {
+  config_path = var.kube_config_path
+}
+
+provider "helm" {
+  kubernetes = {
+    config_path = var.kube_config_path
+  }
+}
+
+provider "vault" {
+  address          = "https://vault.viktorbarzin.me"
+  skip_child_token = true
+}