migrate all secrets from SOPS to Vault KV

- Add vault provider to root terragrunt.hcl (generated providers.tf)
- Delete stacks/vault/vault_provider.tf (now in generated providers.tf)
- Add 124 variable declarations + 43 vault_kv_secret_v2 resources to
  vault/main.tf to populate Vault KV at secret/<stack-name>
- Migrate 43 consuming stacks to read secrets from Vault KV via
  data "vault_kv_secret_v2" instead of SOPS var-file
- Add dependency "vault" to all migrated stacks' terragrunt.hcl
- Complex types (maps/lists) stored as JSON strings, decoded with
  jsondecode() in locals blocks

Bootstrap secrets (vault_root_token, vault_authentik_client_id,
vault_authentik_client_secret) remain in SOPS permanently.

Apply order: vault stack first (populates KV), then all others.

stacks/dawarich/main.tf

@@ -2,15 +2,6 @@ variable "tls_secret_name" {
   type      = string
   sensitive = true
 }
-variable "dawarich_database_password" {
-  type      = string
-  sensitive = true
-}
-variable "geoapify_api_key" {
-  type      = string
-  sensitive = true
-}
-
 
 variable "image_version" {
   type    = string
@@ -20,6 +11,11 @@ variable "nfs_server" { type = string }
 variable "redis_host" { type = string }
 variable "postgresql_host" { type = string }
 
+data "vault_kv_secret_v2" "secrets" {
+  mount = "secret"
+  name  = "dawarich"
+}
+
 resource "kubernetes_namespace" "dawarich" {
   metadata {
     name = "dawarich"
@@ -97,7 +93,7 @@ resource "kubernetes_deployment" "dawarich" {
           }
           env {
             name  = "DATABASE_PASSWORD"
-            value = var.dawarich_database_password
+            value = data.vault_kv_secret_v2.secrets.data["db_password"]
           }
           env {
             name  = "DATABASE_NAME"
@@ -178,7 +174,7 @@ resource "kubernetes_deployment" "dawarich" {
         #   }
         #   env {
         #     name  = "DATABASE_PASSWORD"
-        #     value = var.dawarich_database_password
+        #     value = data.vault_kv_secret_v2.secrets.data["db_password"]
         #   }
         #   env {
         #     name  = "DATABASE_NAME"
@@ -219,7 +215,7 @@ resource "kubernetes_deployment" "dawarich" {
         #   # }
         #   env {
         #     name  = "GEOAPIFY_API_KEY"
-        #     value = var.geoapify_api_key
+        #     value = data.vault_kv_secret_v2.secrets.data["geoapify_api_key"]
         #   }
         #   env {
         #     name  = "SELF_HOSTED"

stacks/dawarich/providers.tf

@@ -1,7 +1,7 @@
 # Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
 variable "kube_config_path" {
-  type    = string
-  default = "~/.kube/config"
+  type      = string
+  default   = "~/.kube/config"
   sensitive = true
 }
 

stacks/dawarich/terragrunt.hcl

@@ -6,3 +6,8 @@ dependency "platform" {
   config_path  = "../platform"
   skip_outputs = true
 }
+
+dependency "vault" {
+  config_path  = "../vault"
+  skip_outputs = true
+}