[ci skip] Infrastructure hardening: security, monitoring, reliability, maintainability

Phase 1 - Critical Security:
- Netbox: move hardcoded DB/superuser passwords to variables
- MeshCentral: disable public registration, add Authentik auth
- Traefik: disable insecure API dashboard (api.insecure=false)
- Traefik: configure forwarded headers with Cloudflare trusted IPs

Phase 2 - Security Hardening:
- Add security headers middleware (HSTS, X-Frame-Options, nosniff, etc.)
- Add Kyverno pod security policies in audit mode (privileged, host
  namespaces, SYS_ADMIN, trusted registries)
- Tighten rate limiting (avg=10, burst=50)
- Add Authentik protection to grampsweb

Phase 3 - Monitoring & Alerting:
- Add critical service alerts (PostgreSQL, MySQL, Redis, Headscale,
  Authentik, Loki)
- Increase Loki retention from 7 to 30 days (720h)
- Add predictive PV filling alert (predict_linear)
- Re-enable Hackmd and Privatebin down alerts

Phase 4 - Reliability:
- Add resource requests/limits to Redis, DBaaS, Technitium, Headscale,
  Vaultwarden, Uptime Kuma
- Increase Alloy DaemonSet memory to 512Mi/1Gi

Phase 6 - Maintainability:
- Extract duplicated tiers locals to terragrunt.hcl generate block
  (removed from 67 stacks)
- Replace hardcoded NFS IP 10.0.10.15 with var.nfs_server (114
  instances across 63 files)
- Replace hardcoded Redis/PostgreSQL/MySQL/Ollama/mail host references
  with variables across ~35 stacks
- Migrate xray raw ingress resources to ingress_factory modules

stacks/platform/modules/headscale/main.tf

@@ -3,6 +3,7 @@ variable "tls_secret_name" {}
 variable "tier" { type = string }
 variable "headscale_config" {}
 variable "headscale_acl" {}
+variable "nfs_server" { type = string }
 
 resource "kubernetes_namespace" "headscale" {
   metadata {
@@ -61,6 +62,18 @@ resource "kubernetes_deployment" "headscale" {
           # image   = "headscale/headscale:0.23.0-debug" # -debug is for debug images
           name    = "headscale"
           command = ["headscale", "serve"]
+
+          resources {
+            requests = {
+              cpu    = "50m"
+              memory = "64Mi"
+            }
+            limits = {
+              cpu    = "200m"
+              memory = "256Mi"
+            }
+          }
+
           port {
             container_port = 8080
           }
@@ -100,7 +113,7 @@ resource "kubernetes_deployment" "headscale" {
           name = "nfs-config"
           nfs {
             path   = "/mnt/main/headscale"
-            server = "10.0.10.15"
+            server = var.nfs_server
           }
         }
         # container {
@@ -114,6 +127,18 @@ resource "kubernetes_deployment" "headscale" {
           image = "ghcr.io/gurucomputing/headscale-ui:latest"
           # image = "ghcr.io/tale/headplane:0.3.2"
           name = "headscale-ui"
+
+          resources {
+            requests = {
+              cpu    = "25m"
+              memory = "32Mi"
+            }
+            limits = {
+              cpu    = "100m"
+              memory = "128Mi"
+            }
+          }
+
           port {
             container_port = 8081
             # container_port = 3000