migrate consuming stacks to ESO + remove k8s-dashboard static token

Phase 9: ExternalSecret migration across 26 stacks:

Fully migrated (vault data source removed, ESO delivers secrets):
- speedtest, shadowsocks, wealthfolio, plotting-book, f1-stream, tandoor
- n8n, dawarich, diun, netbox, onlyoffice, tuya-bridge
- hackmd (ESO template for DB URL), health (ESO template for DB URL)
- trading-bot (ESO template for DATABASE_URL + 7 secret env vars)
- forgejo (removed unused vault data source)

Partially migrated (vault kept for plan-time, ESO added for runtime):
- immich, linkwarden, nextcloud, paperless-ngx (jsondecode for homepage)
- claude-memory, rybbit, url, webhook_handler (plan-time in locals/jobs)
- woodpecker, openclaw, resume (plan-time in helm values/jobs/modules)

17 stacks unchanged (all plan-time: homepage annotations, configmaps,
module inputs) — vault data source works with OIDC auth.

Phase 17a: Remove k8s-dashboard static admin token secret.
Users now get tokens via: vault write kubernetes/creds/dashboard-admin

stacks/hackmd/main.tf

@@ -4,11 +4,6 @@ variable "tls_secret_name" {
 variable "nfs_server" { type = string }
 variable "mysql_host" { type = string }
 
-data "vault_kv_secret_v2" "secrets" {
-  mount = "secret"
-  name  = "hackmd"
-}
-
 resource "kubernetes_namespace" "hackmd" {
   metadata {
     name = "hackmd"
@@ -42,6 +37,9 @@ resource "kubernetes_deployment" "hackmd" {
       "kubernetes.io/cluster-service" = "true"
       tier                            = local.tiers.edge
     }
+    annotations = {
+      "reloader.stakater.com/auto" = "true"
+    }
   }
   spec {
     replicas = 1
@@ -102,8 +100,12 @@ resource "kubernetes_deployment" "hackmd" {
           image = "hackmdio/hackmd"
           env {
             name = "CMD_DB_URL"
-            # value = format("%s%s%s", "postgres://codimd:", var.hackmd_db_password, "@localhost/codimd")
-            value = format("%s%s%s", "mysql://codimd:", data.vault_kv_secret_v2.secrets.data["db_password"], "@${var.mysql_host}/codimd")
+            value_from {
+              secret_key_ref {
+                name = "hackmd-secrets"
+                key  = "CMD_DB_URL"
+              }
+            }
           }
           env {
             name  = "CMD_USECDN"
@@ -176,3 +178,34 @@ module "ingress" {
     "gethomepage.dev/pod-selector" = ""
   }
 }
+
+resource "kubernetes_manifest" "external_secret" {
+  manifest = {
+    apiVersion = "external-secrets.io/v1beta1"
+    kind       = "ExternalSecret"
+    metadata = {
+      name      = "hackmd-secrets"
+      namespace = "hackmd"
+    }
+    spec = {
+      refreshInterval = "15m"
+      secretStoreRef = {
+        name = "vault-kv"
+        kind = "ClusterSecretStore"
+      }
+      target = {
+        name = "hackmd-secrets"
+        template = {
+          data = {
+            CMD_DB_URL = "mysql://codimd:{{ .db_password }}@mysql.dbaas.svc.cluster.local/codimd"
+          }
+        }
+      }
+      data = [{
+        secretKey = "db_password"
+        remoteRef = { key = "hackmd", property = "db_password" }
+      }]
+    }
+  }
+  depends_on = [kubernetes_namespace.hackmd]
+}

stacks/hackmd/providers.tf

@@ -13,12 +13,6 @@ variable "kube_config_path" {
   default = "~/.kube/config"
 }
 
-variable "vault_root_token" {
-  type      = string
-  sensitive = true
-  default   = ""
-}
-
 provider "kubernetes" {
   config_path = var.kube_config_path
 }
@@ -31,6 +25,5 @@ provider "helm" {
 
 provider "vault" {
   address          = "https://vault.viktorbarzin.me"
-  token            = var.vault_root_token
   skip_child_token = true
 }

stacks/hackmd/terragrunt.hcl

@@ -6,8 +6,3 @@ dependency "platform" {
   config_path  = "../platform"
   skip_outputs = true
 }
-
-dependency "vault" {
-  config_path  = "../vault"
-  skip_outputs = true
-}