[ci skip] Infrastructure hardening: security, monitoring, reliability, maintainability

Phase 1 - Critical Security:
- Netbox: move hardcoded DB/superuser passwords to variables
- MeshCentral: disable public registration, add Authentik auth
- Traefik: disable insecure API dashboard (api.insecure=false)
- Traefik: configure forwarded headers with Cloudflare trusted IPs

Phase 2 - Security Hardening:
- Add security headers middleware (HSTS, X-Frame-Options, nosniff, etc.)
- Add Kyverno pod security policies in audit mode (privileged, host
  namespaces, SYS_ADMIN, trusted registries)
- Tighten rate limiting (avg=10, burst=50)
- Add Authentik protection to grampsweb

Phase 3 - Monitoring & Alerting:
- Add critical service alerts (PostgreSQL, MySQL, Redis, Headscale,
  Authentik, Loki)
- Increase Loki retention from 7 to 30 days (720h)
- Add predictive PV filling alert (predict_linear)
- Re-enable Hackmd and Privatebin down alerts

Phase 4 - Reliability:
- Add resource requests/limits to Redis, DBaaS, Technitium, Headscale,
  Vaultwarden, Uptime Kuma
- Increase Alloy DaemonSet memory to 512Mi/1Gi

Phase 6 - Maintainability:
- Extract duplicated tiers locals to terragrunt.hcl generate block
  (removed from 67 stacks)
- Replace hardcoded NFS IP 10.0.10.15 with var.nfs_server (114
  instances across 63 files)
- Replace hardcoded Redis/PostgreSQL/MySQL/Ollama/mail host references
  with variables across ~35 stacks
- Migrate xray raw ingress resources to ingress_factory modules

stacks/grampsweb/main.tf

@@ -1,15 +1,10 @@
 variable "tls_secret_name" { type = string }
 variable "mailserver_accounts" { type = map(any) }
+variable "nfs_server" { type = string }
+variable "redis_host" { type = string }
+variable "ollama_host" { type = string }
+variable "mail_host" { type = string }
 
-locals {
-  tiers = {
-    core    = "0-core"
-    cluster = "1-cluster"
-    gpu     = "2-gpu"
-    edge    = "3-edge"
-    aux     = "4-aux"
-  }
-}
 
 resource "kubernetes_namespace" "grampsweb" {
   metadata {
@@ -43,15 +38,15 @@ locals {
     },
     {
       name  = "GRAMPSWEB_CELERY_CONFIG__broker_url"
-      value = "redis://redis.redis.svc.cluster.local:6379/2"
+      value = "redis://${var.redis_host}:6379/2"
     },
     {
       name  = "GRAMPSWEB_CELERY_CONFIG__result_backend"
-      value = "redis://redis.redis.svc.cluster.local:6379/2"
+      value = "redis://${var.redis_host}:6379/2"
     },
     {
       name  = "GRAMPSWEB_RATELIMIT_STORAGE_URI"
-      value = "redis://redis.redis.svc.cluster.local:6379/3"
+      value = "redis://${var.redis_host}:6379/3"
     },
     {
       name  = "GRAMPSWEB_BASE_URL"
@@ -63,7 +58,7 @@ locals {
     },
     {
       name  = "GRAMPSWEB_EMAIL_HOST"
-      value = "mail.viktorbarzin.me"
+      value = var.mail_host
     },
     {
       name  = "GRAMPSWEB_EMAIL_PORT"
@@ -91,7 +86,7 @@ locals {
     },
     {
       name  = "GRAMPSWEB_LLM_BASE_URL"
-      value = "http://ollama.ollama.svc.cluster.local:11434/v1"
+      value = "http://${var.ollama_host}:11434/v1"
     },
     {
       name  = "GRAMPSWEB_LLM_MODEL"
@@ -239,7 +234,7 @@ resource "kubernetes_deployment" "grampsweb" {
         volume {
           name = "data"
           nfs {
-            server = "10.0.10.15"
+            server = var.nfs_server
             path   = "/mnt/main/grampsweb"
           }
         }
@@ -276,4 +271,5 @@ module "ingress" {
   service_name    = "grampsweb"
   tls_secret_name = var.tls_secret_name
   max_body_size   = "500m"
+  protected       = true
 }