[ci skip] Phase 3: Create 66 service stacks and migrate state

Generated individual stack directories for all 66 services under stacks/.
Each stack has terragrunt.hcl (depends on platform) and main.tf (thin
wrapper calling existing module). Migrated all 64 active service states
from root terraform.tfstate to individual state files. Root state is now
empty. Verified with terragrunt plan on multiple stacks (no changes).

stacks/actualbudget/main.tf

@@ -0,0 +1,19 @@
+variable "tls_secret_name" { type = string }
+variable "actualbudget_credentials" { type = map(any) }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "actualbudget" {
+  source = "../../modules/kubernetes/actualbudget"
+  tls_secret_name                = var.tls_secret_name
+  tier                           = local.tiers.edge
+  credentials                    = var.actualbudget_credentials
+}

stacks/actualbudget/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/affine/main.tf

@@ -0,0 +1,21 @@
+variable "tls_secret_name" { type = string }
+variable "affine_postgresql_password" { type = string }
+variable "mailserver_accounts" { type = map(any) }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "affine" {
+  source = "../../modules/kubernetes/affine"
+  tls_secret_name                = var.tls_secret_name
+  postgresql_password            = var.affine_postgresql_password
+  smtp_password                  = var.mailserver_accounts["info@viktorbarzin.me"]
+  tier                           = local.tiers.aux
+}

stacks/affine/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/audiobookshelf/main.tf

@@ -0,0 +1,17 @@
+variable "tls_secret_name" { type = string }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "audiobookshelf" {
+  source = "../../modules/kubernetes/audiobookshelf"
+  tls_secret_name                = var.tls_secret_name
+  tier                           = local.tiers.aux
+}

stacks/audiobookshelf/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/blog/main.tf

@@ -0,0 +1,17 @@
+variable "tls_secret_name" { type = string }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "blog" {
+  source = "../../modules/kubernetes/blog"
+  tls_secret_name                = var.tls_secret_name
+  tier                           = local.tiers.aux
+}

stacks/blog/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/calibre/main.tf

@@ -0,0 +1,20 @@
+variable "tls_secret_name" { type = string }
+variable "homepage_credentials" { type = map(any) }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "calibre" {
+  source = "../../modules/kubernetes/calibre"
+  tls_secret_name                = var.tls_secret_name
+  homepage_username              = var.homepage_credentials["calibre-web"]["username"]
+  homepage_password              = var.homepage_credentials["calibre-web"]["password"]
+  tier                           = local.tiers.edge
+}

stacks/calibre/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/changedetection/main.tf

@@ -0,0 +1,17 @@
+variable "tls_secret_name" { type = string }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "changedetection" {
+  source = "../../modules/kubernetes/changedetection"
+  tls_secret_name                = var.tls_secret_name
+  tier                           = local.tiers.aux
+}

stacks/changedetection/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/city-guesser/main.tf

@@ -0,0 +1,17 @@
+variable "tls_secret_name" { type = string }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "city-guesser" {
+  source = "../../modules/kubernetes/city-guesser"
+  tls_secret_name                = var.tls_secret_name
+  tier                           = local.tiers.aux
+}

stacks/city-guesser/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/coturn/main.tf

@@ -0,0 +1,21 @@
+variable "tls_secret_name" { type = string }
+variable "coturn_turn_secret" { type = string }
+variable "public_ip" { type = string }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "coturn" {
+  source = "../../modules/kubernetes/coturn"
+  tls_secret_name                = var.tls_secret_name
+  tier                           = local.tiers.edge
+  turn_secret                    = var.coturn_turn_secret
+  public_ip                      = var.public_ip
+}

stacks/coturn/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/cyberchef/main.tf

@@ -0,0 +1,17 @@
+variable "tls_secret_name" { type = string }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "cyberchef" {
+  source = "../../modules/kubernetes/cyberchef"
+  tls_secret_name                = var.tls_secret_name
+  tier                           = local.tiers.aux
+}

stacks/cyberchef/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/dashy/main.tf

@@ -0,0 +1,17 @@
+variable "tls_secret_name" { type = string }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "dashy" {
+  source = "../../modules/kubernetes/dashy"
+  tls_secret_name                = var.tls_secret_name
+  tier                           = local.tiers.aux
+}

stacks/dashy/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/dawarich/main.tf

@@ -0,0 +1,21 @@
+variable "tls_secret_name" { type = string }
+variable "dawarich_database_password" { type = string }
+variable "geoapify_api_key" { type = string }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "dawarich" {
+  source = "../../modules/kubernetes/dawarich"
+  tls_secret_name                = var.tls_secret_name
+  database_password              = var.dawarich_database_password
+  geoapify_api_key               = var.geoapify_api_key
+  tier                           = local.tiers.edge
+}

stacks/dawarich/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/descheduler/main.tf

@@ -0,0 +1,3 @@
+module "descheduler" {
+  source = "../../modules/kubernetes/descheduler"
+}

stacks/descheduler/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/diun/main.tf

@@ -0,0 +1,21 @@
+variable "tls_secret_name" { type = string }
+variable "diun_nfty_token" { type = string }
+variable "diun_slack_url" { type = string }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "diun" {
+  source = "../../modules/kubernetes/diun"
+  tls_secret_name                = var.tls_secret_name
+  diun_nfty_token                = var.diun_nfty_token
+  diun_slack_url                 = var.diun_slack_url
+  tier                           = local.tiers.aux
+}

stacks/diun/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/drone/main.tf

@@ -0,0 +1,27 @@
+variable "tls_secret_name" { type = string }
+variable "drone_github_client_id" { type = string }
+variable "drone_github_client_secret" { type = string }
+variable "drone_rpc_secret" { type = string }
+variable "drone_webhook_secret" { type = string }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "drone" {
+  source = "../../modules/kubernetes/drone"
+  tls_secret_name                = var.tls_secret_name
+  github_client_id               = var.drone_github_client_id
+  github_client_secret           = var.drone_github_client_secret
+  rpc_secret                     = var.drone_rpc_secret
+  webhook_secret                 = var.drone_webhook_secret
+  server_host                    = "drone.viktorbarzin.me"
+  server_proto                   = "https"
+  tier                           = local.tiers.edge
+}

stacks/drone/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/ebook2audiobook/main.tf

@@ -0,0 +1,17 @@
+variable "tls_secret_name" { type = string }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "ebook2audiobook" {
+  source = "../../modules/kubernetes/ebook2audiobook"
+  tls_secret_name                = var.tls_secret_name
+  tier                           = local.tiers.gpu
+}

stacks/ebook2audiobook/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/echo/main.tf

@@ -0,0 +1,17 @@
+variable "tls_secret_name" { type = string }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "echo" {
+  source = "../../modules/kubernetes/echo"
+  tls_secret_name                = var.tls_secret_name
+  tier                           = local.tiers.edge
+}

stacks/echo/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/excalidraw/main.tf

@@ -0,0 +1,17 @@
+variable "tls_secret_name" { type = string }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "excalidraw" {
+  source = "../../modules/kubernetes/excalidraw"
+  tls_secret_name                = var.tls_secret_name
+  tier                           = local.tiers.aux
+}

stacks/excalidraw/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/f1-stream/main.tf

@@ -0,0 +1,21 @@
+variable "tls_secret_name" { type = string }
+variable "coturn_turn_secret" { type = string }
+variable "public_ip" { type = string }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "f1-stream" {
+  source = "../../modules/kubernetes/f1-stream"
+  tls_secret_name                = var.tls_secret_name
+  tier                           = local.tiers.aux
+  turn_secret                    = var.coturn_turn_secret
+  public_ip                      = var.public_ip
+}

stacks/f1-stream/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/forgejo/main.tf

@@ -0,0 +1,17 @@
+variable "tls_secret_name" { type = string }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "forgejo" {
+  source = "../../modules/kubernetes/forgejo"
+  tls_secret_name                = var.tls_secret_name
+  tier                           = local.tiers.edge
+}

stacks/forgejo/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/freedify/main.tf

@@ -0,0 +1,19 @@
+variable "tls_secret_name" { type = string }
+variable "freedify_credentials" { type = map(any) }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "freedify" {
+  source = "../../modules/kubernetes/freedify"
+  tls_secret_name                = var.tls_secret_name
+  tier                           = local.tiers.aux
+  additional_credentials         = var.freedify_credentials
+}

stacks/freedify/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/freshrss/main.tf

@@ -0,0 +1,17 @@
+variable "tls_secret_name" { type = string }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "freshrss" {
+  source = "../../modules/kubernetes/freshrss"
+  tls_secret_name                = var.tls_secret_name
+  tier                           = local.tiers.aux
+}

stacks/freshrss/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/frigate/main.tf

@@ -0,0 +1,17 @@
+variable "tls_secret_name" { type = string }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "frigate" {
+  source = "../../modules/kubernetes/frigate"
+  tls_secret_name                = var.tls_secret_name
+  tier                           = local.tiers.gpu
+}

stacks/frigate/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/grampsweb/main.tf

@@ -0,0 +1,19 @@
+variable "tls_secret_name" { type = string }
+variable "mailserver_accounts" { type = map(any) }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "grampsweb" {
+  source = "../../modules/kubernetes/grampsweb"
+  tls_secret_name                = var.tls_secret_name
+  smtp_password                  = var.mailserver_accounts["info@viktorbarzin.me"]
+  tier                           = local.tiers.aux
+}

stacks/grampsweb/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/hackmd/main.tf

@@ -0,0 +1,19 @@
+variable "hackmd_db_password" { type = string }
+variable "tls_secret_name" { type = string }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "hackmd" {
+  source = "../../modules/kubernetes/hackmd"
+  hackmd_db_password             = var.hackmd_db_password
+  tls_secret_name                = var.tls_secret_name
+  tier                           = local.tiers.edge
+}

stacks/hackmd/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/health/main.tf

@@ -0,0 +1,21 @@
+variable "tls_secret_name" { type = string }
+variable "health_postgresql_password" { type = string }
+variable "health_secret_key" { type = string }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "health" {
+  source = "../../modules/kubernetes/health"
+  tls_secret_name                = var.tls_secret_name
+  postgresql_password            = var.health_postgresql_password
+  secret_key                     = var.health_secret_key
+  tier                           = local.tiers.aux
+}

stacks/health/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/homepage/main.tf

@@ -0,0 +1,17 @@
+variable "tls_secret_name" { type = string }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "homepage" {
+  source = "../../modules/kubernetes/homepage"
+  tier                           = local.tiers.aux
+  tls_secret_name                = var.tls_secret_name
+}

stacks/homepage/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/immich/main.tf

@@ -0,0 +1,23 @@
+variable "tls_secret_name" { type = string }
+variable "immich_postgresql_password" { type = string }
+variable "immich_frame_api_key" { type = string }
+variable "homepage_credentials" { type = map(any) }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "immich" {
+  source = "../../modules/kubernetes/immich"
+  tls_secret_name                = var.tls_secret_name
+  postgresql_password            = var.immich_postgresql_password
+  frame_api_key                  = var.immich_frame_api_key
+  homepage_token                 = var.homepage_credentials["immich"]["token"]
+  tier                           = local.tiers.gpu
+}

stacks/immich/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/isponsorblocktv/main.tf

@@ -0,0 +1,14 @@
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "isponsorblocktv" {
+  source = "../../modules/kubernetes/isponsorblocktv"
+  tier                           = local.tiers.edge
+}

stacks/isponsorblocktv/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/jsoncrack/main.tf

@@ -0,0 +1,17 @@
+variable "tls_secret_name" { type = string }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "jsoncrack" {
+  source = "../../modules/kubernetes/jsoncrack"
+  tls_secret_name                = var.tls_secret_name
+  tier                           = local.tiers.aux
+}

stacks/jsoncrack/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/k8s-dashboard/main.tf

@@ -0,0 +1,19 @@
+variable "tls_secret_name" { type = string }
+variable "client_certificate_secret_name" { type = string }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "k8s-dashboard" {
+  source = "../../modules/kubernetes/k8s-dashboard"
+  tier                           = local.tiers.cluster
+  tls_secret_name                = var.tls_secret_name
+  client_certificate_secret_name = var.client_certificate_secret_name
+}

stacks/k8s-dashboard/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/kms/main.tf

@@ -0,0 +1,17 @@
+variable "tls_secret_name" { type = string }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "kms" {
+  source = "../../modules/kubernetes/kms"
+  tls_secret_name                = var.tls_secret_name
+  tier                           = local.tiers.aux
+}

stacks/kms/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/linkwarden/main.tf

@@ -0,0 +1,23 @@
+variable "tls_secret_name" { type = string }
+variable "linkwarden_postgresql_password" { type = string }
+variable "linkwarden_authentik_client_id" { type = string }
+variable "linkwarden_authentik_client_secret" { type = string }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "linkwarden" {
+  source = "../../modules/kubernetes/linkwarden"
+  tls_secret_name                = var.tls_secret_name
+  postgresql_password            = var.linkwarden_postgresql_password
+  authentik_client_id            = var.linkwarden_authentik_client_id
+  authentik_client_secret        = var.linkwarden_authentik_client_secret
+  tier                           = local.tiers.aux
+}

stacks/linkwarden/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/matrix/main.tf

@@ -0,0 +1,17 @@
+variable "tls_secret_name" { type = string }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "matrix" {
+  source = "../../modules/kubernetes/matrix"
+  tls_secret_name                = var.tls_secret_name
+  tier                           = local.tiers.aux
+}

stacks/matrix/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/meshcentral/main.tf

@@ -0,0 +1,17 @@
+variable "tls_secret_name" { type = string }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "meshcentral" {
+  source = "../../modules/kubernetes/meshcentral"
+  tls_secret_name                = var.tls_secret_name
+  tier                           = local.tiers.aux
+}

stacks/meshcentral/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/n8n/main.tf

@@ -0,0 +1,19 @@
+variable "tls_secret_name" { type = string }
+variable "n8n_postgresql_password" { type = string }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "n8n" {
+  source = "../../modules/kubernetes/n8n"
+  tls_secret_name                = var.tls_secret_name
+  postgresql_password            = var.n8n_postgresql_password
+  tier                           = local.tiers.aux
+}

stacks/n8n/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/navidrome/main.tf

@@ -0,0 +1,17 @@
+variable "tls_secret_name" { type = string }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "navidrome" {
+  source = "../../modules/kubernetes/navidrome"
+  tls_secret_name                = var.tls_secret_name
+  tier                           = local.tiers.aux
+}

stacks/navidrome/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/netbox/main.tf

@@ -0,0 +1,17 @@
+variable "tls_secret_name" { type = string }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "netbox" {
+  source = "../../modules/kubernetes/netbox"
+  tls_secret_name                = var.tls_secret_name
+  tier                           = local.tiers.aux
+}

stacks/netbox/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/networking-toolbox/main.tf

@@ -0,0 +1,17 @@
+variable "tls_secret_name" { type = string }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "networking-toolbox" {
+  source = "../../modules/kubernetes/networking-toolbox"
+  tls_secret_name                = var.tls_secret_name
+  tier                           = local.tiers.aux
+}

stacks/networking-toolbox/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/nextcloud/main.tf

@@ -0,0 +1,19 @@
+variable "tls_secret_name" { type = string }
+variable "nextcloud_db_password" { type = string }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "nextcloud" {
+  source = "../../modules/kubernetes/nextcloud"
+  tls_secret_name                = var.tls_secret_name
+  db_password                    = var.nextcloud_db_password
+  tier                           = local.tiers.edge
+}

stacks/nextcloud/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/ntfy/main.tf

@@ -0,0 +1,17 @@
+variable "tls_secret_name" { type = string }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "ntfy" {
+  source = "../../modules/kubernetes/ntfy"
+  tls_secret_name                = var.tls_secret_name
+  tier                           = local.tiers.aux
+}

stacks/ntfy/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/ollama/main.tf

@@ -0,0 +1,19 @@
+variable "tls_secret_name" { type = string }
+variable "ollama_api_credentials" { type = string }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "ollama" {
+  source = "../../modules/kubernetes/ollama"
+  tls_secret_name                = var.tls_secret_name
+  tier                           = local.tiers.gpu
+  ollama_api_credentials         = var.ollama_api_credentials
+}

stacks/ollama/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/onlyoffice/main.tf

@@ -0,0 +1,21 @@
+variable "tls_secret_name" { type = string }
+variable "onlyoffice_db_password" { type = string }
+variable "onlyoffice_jwt_token" { type = string }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "onlyoffice" {
+  source = "../../modules/kubernetes/onlyoffice"
+  tls_secret_name                = var.tls_secret_name
+  db_password                    = var.onlyoffice_db_password
+  jwt_token                      = var.onlyoffice_jwt_token
+  tier                           = local.tiers.edge
+}

stacks/onlyoffice/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/openclaw/main.tf

@@ -0,0 +1,29 @@
+variable "tls_secret_name" { type = string }
+variable "openclaw_ssh_key" { type = string }
+variable "openclaw_skill_secrets" { type = map(string) }
+variable "gemini_api_key" { type = string }
+variable "llama_api_key" { type = string }
+variable "brave_api_key" { type = string }
+variable "modal_api_key" { type = string }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "openclaw" {
+  source = "../../modules/kubernetes/openclaw"
+  tls_secret_name                = var.tls_secret_name
+  ssh_key                        = var.openclaw_ssh_key
+  skill_secrets                  = var.openclaw_skill_secrets
+  gemini_api_key                 = var.gemini_api_key
+  llama_api_key                  = var.llama_api_key
+  brave_api_key                  = var.brave_api_key
+  modal_api_key                  = var.modal_api_key
+  tier                           = local.tiers.aux
+}

stacks/openclaw/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/osm_routing/main.tf

@@ -0,0 +1,17 @@
+variable "tls_secret_name" { type = string }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "osm_routing" {
+  source = "../../modules/kubernetes/osm-routing"
+  tls_secret_name                = var.tls_secret_name
+  tier                           = local.tiers.aux
+}

stacks/osm_routing/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/owntracks/main.tf

@@ -0,0 +1,19 @@
+variable "tls_secret_name" { type = string }
+variable "owntracks_credentials" { type = string }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "owntracks" {
+  source = "../../modules/kubernetes/owntracks"
+  tls_secret_name                = var.tls_secret_name
+  owntracks_credentials          = var.owntracks_credentials
+  tier                           = local.tiers.aux
+}

stacks/owntracks/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/paperless-ngx/main.tf

@@ -0,0 +1,22 @@
+variable "tls_secret_name" { type = string }
+variable "paperless_db_password" { type = string }
+variable "homepage_credentials" { type = map(any) }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "paperless-ngx" {
+  source = "../../modules/kubernetes/paperless-ngx"
+  tls_secret_name                = var.tls_secret_name
+  db_password                    = var.paperless_db_password
+  homepage_username              = var.homepage_credentials["paperless-ngx"]["username"]
+  homepage_password              = var.homepage_credentials["paperless-ngx"]["password"]
+  tier                           = local.tiers.edge
+}

stacks/paperless-ngx/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/plotting-book/main.tf

@@ -0,0 +1,17 @@
+variable "tls_secret_name" { type = string }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "plotting-book" {
+  source = "../../modules/kubernetes/plotting-book"
+  tls_secret_name                = var.tls_secret_name
+  tier                           = local.tiers.aux
+}

stacks/plotting-book/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/privatebin/main.tf

@@ -0,0 +1,17 @@
+variable "tls_secret_name" { type = string }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "privatebin" {
+  source = "../../modules/kubernetes/privatebin"
+  tls_secret_name                = var.tls_secret_name
+  tier                           = local.tiers.edge
+}

stacks/privatebin/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/real-estate-crawler/main.tf

@@ -0,0 +1,21 @@
+variable "tls_secret_name" { type = string }
+variable "realestate_crawler_db_password" { type = string }
+variable "realestate_crawler_notification_settings" { type = map(string) }
+
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "real-estate-crawler" {
+  source = "../../modules/kubernetes/real-estate-crawler"
+  tls_secret_name                = var.tls_secret_name
+  db_password                    = var.realestate_crawler_db_password
+  notification_settings          = var.realestate_crawler_notification_settings
+  tier                           = local.tiers.aux
+}

stacks/real-estate-crawler/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}

stacks/reloader/main.tf

@@ -0,0 +1,14 @@
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+
+module "reloader" {
+  source = "../../modules/kubernetes/reloader"
+  tier                           = local.tiers.aux
+}

stacks/reloader/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}