Update Drone CI pipeline for Terragrunt stack architecture

Default pipeline now uses terragrunt run --all to apply all stacks
instead of the broken terraform apply -target=module.kubernetes_cluster.
TLS renewal pipeline stripped of unnecessary Terraform download/init
since renew2.sh is pure shell (certbot + Cloudflare DNS).

.claude/CLAUDE.md

@@ -390,7 +390,9 @@ jellyfin, jellyseerr, tdarr, affine, health, family, openclaw
 
 ## CI/CD
 - Drone CI (`.drone.yml`) for automated deployments
-- Auto-updates TLS certificates
+- **Default pipeline**: On push, runs `terragrunt run --all -- apply -auto-approve` across all stacks (installs Terraform 1.5.7 + Terragrunt 0.99.4 in Alpine)
+- **TLS renewal pipeline**: Cron-triggered, runs `renew2.sh` (certbot + Cloudflare DNS) — no Terraform/Terragrunt needed
+- **Build CLI pipeline**: Builds Docker image from `cli/Dockerfile` (unchanged)
 - **ALWAYS add `[ci skip]` to commit messages** when you've already run `terraform apply` to avoid triggering CI redundantly
 - **After committing, run `git push origin master`** to sync changes
 

.drone.yml

@@ -15,15 +15,18 @@ steps:
       - |
         curl -k https://10.0.20.100:6443/api/v1/namespaces/drone/configmaps/git-crypt-key -H "Authorization:Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" | jq -r .data.key | base64 -d > /tmp/key
       - "git-crypt unlock /tmp/key"
-  - name: Terraform apply
+  - name: Terragrunt apply
-    image: hashicorp/terraform:latest
+    image: alpine
-    environment:
-      TF_VAR_prod: "true"
     commands:
-      - "env"
+      - "apk update && apk add curl unzip git openssh-client"
-      - "mkdir -p ~/.ssh && touch ~/.ssh/id_ed25519 ~/.ssh/id_ed25519.pub" # needed by TF apply; not used in practice
+      # Install Terraform
-      - "terraform init"
+      - "wget -O /tmp/terraform.zip https://releases.hashicorp.com/terraform/1.5.7/terraform_1.5.7_linux_amd64.zip"
-      - "terraform apply -target=module.kubernetes_cluster -auto-approve"
+      - "unzip -o /tmp/terraform.zip -d /usr/local/bin/ && chmod 755 /usr/local/bin/terraform"
+      # Install Terragrunt
+      - "wget -O /usr/local/bin/terragrunt https://github.com/gruntwork-io/terragrunt/releases/download/v0.99.4/terragrunt_linux_amd64"
+      - "chmod 755 /usr/local/bin/terragrunt"
+      # Apply all stacks
+      - "cd stacks && terragrunt run --all --non-interactive -- apply -auto-approve"
 
   - name: Push commit
     image: alpine
@@ -88,7 +91,6 @@ steps:
   - name: Run renew script
     image: alpine
     environment:
-      TF_VAR_prod: "true"
       TECHNITIUM_API_KEY:
         from_secret: TECHNITIUM_API_KEY
       CLOUDFLARE_TOKEN:
@@ -96,11 +98,7 @@ steps:
       CLOUDFLARE_ZONE_ID:
         from_secret: CLOUDFLARE_ZONE_ID
     commands:
-      - "apk update && apk add git certbot expect curl gzip wget jq"
+      - "apk update && apk add certbot curl jq"
-      # Install terraform cli
-      # - "curl https://releases.hashicorp.com/terraform/1.10.3/terraform_1.10.3_linux_amd64.zip | gzip -d > /usr/local/bin/terraform && chmod 775 /usr/local/bin/terraform"
-      - "wget -O terraform_1.10.3_linux_amd64.zip https://releases.hashicorp.com/terraform/1.10.3/terraform_1.10.3_linux_amd64.zip && unzip -o terraform_1.10.3_linux_amd64.zip && mv terraform /usr/local/bin/ && chmod 775 /usr/local/bin/terraform"
-      - "/usr/local/bin/terraform init"
       - "./modules/kubernetes/setup_tls_secret/renew2.sh"
   - name: Commit updated certificates
     image: alpine