migrate all secrets from SOPS to Vault KV

- Add vault provider to root terragrunt.hcl (generated providers.tf)
- Delete stacks/vault/vault_provider.tf (now in generated providers.tf)
- Add 124 variable declarations + 43 vault_kv_secret_v2 resources to
  vault/main.tf to populate Vault KV at secret/<stack-name>
- Migrate 43 consuming stacks to read secrets from Vault KV via
  data "vault_kv_secret_v2" instead of SOPS var-file
- Add dependency "vault" to all migrated stacks' terragrunt.hcl
- Complex types (maps/lists) stored as JSON strings, decoded with
  jsondecode() in locals blocks

Bootstrap secrets (vault_root_token, vault_authentik_client_id,
vault_authentik_client_secret) remain in SOPS permanently.

Apply order: vault stack first (populates KV), then all others.

stacks/url/main.tf

@@ -2,17 +2,12 @@ variable "tls_secret_name" {
   type      = string
   sensitive = true
 }
-variable "url_shortener_geolite_license_key" { type = string }
-variable "url_shortener_api_key" {
-  type      = string
-  sensitive = true
-}
-variable "url_shortener_mysql_password" {
-  type      = string
-  sensitive = true
-}
 variable "mysql_host" { type = string }
 
+data "vault_kv_secret_v2" "secrets" {
+  mount = "secret"
+  name  = "url"
+}
 
 ## Setup
 ## Need to manually add
@@ -50,7 +45,7 @@ resource "kubernetes_secret" "mysql_config" {
   }
   data = {
     "DB_USER"     = "shlink"
-    "DB_PASSWORD" = var.url_shortener_mysql_password
+    "DB_PASSWORD" = data.vault_kv_secret_v2.secrets.data["db_password"]
   }
 }
 
@@ -120,7 +115,7 @@ resource "kubernetes_deployment" "shlink" {
           }
           env {
             name  = "GEOLITE_LICENSE_KEY"
-            value = var.url_shortener_geolite_license_key
+            value = data.vault_kv_secret_v2.secrets.data["geolite_license_key"]
           }
           # DB config
           env {
@@ -142,7 +137,7 @@ resource "kubernetes_deployment" "shlink" {
           }
           # env {
           #   name  = "DB_PASSWORD"
-          #   value = var.url_shortener_mysql_password
+          #   value = data.vault_kv_secret_v2.secrets.data["db_password"]
           # }
           resources {
             limits = {
@@ -218,7 +213,7 @@ module "ingress" {
     "gethomepage.dev/pod-selector" = ""
     "gethomepage.dev/widget.type"  = "shlink"
     "gethomepage.dev/widget.url"   = "http://shlink.shlink.svc.cluster.local:8080"
-    "gethomepage.dev/widget.key"   = var.url_shortener_api_key
+    "gethomepage.dev/widget.key"   = data.vault_kv_secret_v2.secrets.data["api_key"]
   }
 }
 
@@ -239,7 +234,7 @@ resource "kubernetes_config_map" "shlink-web" {
     "servers.json" = jsonencode([{
       name   = "Main"
       url    = "https://url.viktorbarzin.me"
-      apiKey = var.url_shortener_api_key
+      apiKey = data.vault_kv_secret_v2.secrets.data["api_key"]
     }])
   }
 }

stacks/url/terragrunt.hcl

@@ -6,3 +6,8 @@ dependency "platform" {
   config_path  = "../platform"
   skip_outputs = true
 }
+
+dependency "vault" {
+  config_path  = "../vault"
+  skip_outputs = true
+}