fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip]

6d224861 came from a --no-checkout worktree whose empty index made the
commit drop every file except two. This restores 05b50d2b's full tree and
correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su
entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the
live infra was never applied from the broken commit.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

terragrunt.hcl

@@ -0,0 +1,151 @@
+# Root Terragrunt configuration
+# Provides DRY provider, backend, and variable loading for all stacks.
+
+# Two-tier state backend:
+#   Tier 0 (bootstrap): local state, SOPS-encrypted in git — must exist before PG is reachable.
+#   Tier 1 (everything else): PG backend on CNPG cluster, native pg_advisory_lock.
+locals {
+  tier0_stacks = ["infra", "platform", "cnpg", "vault", "dbaas", "external-secrets"]
+  stack_name   = replace(path_relative_to_include(), "stacks/", "")
+  is_tier0     = contains(local.tier0_stacks, local.stack_name)
+}
+
+remote_state {
+  backend = local.is_tier0 ? "local" : "pg"
+  generate = {
+    path      = "backend.tf"
+    if_exists = "overwrite_terragrunt"
+  }
+  config = local.is_tier0 ? {
+    path = "${get_repo_root()}/state/${path_relative_to_include()}/terraform.tfstate"
+  } : {
+    conn_str    = get_env("PG_CONN_STR", "")
+    schema_name = local.stack_name
+  }
+}
+
+# Load config.tfvars (plaintext). Secrets come from Vault KV — authenticate via `vault login -method=oidc`.
+terraform {
+  extra_arguments "common_vars" {
+    commands = get_terraform_commands_that_need_vars()
+    required_var_files = [
+      "${get_repo_root()}/config.tfvars"
+    ]
+  }
+
+  extra_arguments "no_backup" {
+    commands = ["apply", "plan", "destroy", "import"]
+    arguments = ["-backup=-"]
+  }
+
+  extra_arguments "kube_config" {
+    commands = get_terraform_commands_that_need_vars()
+    arguments = [
+      "-var", "kube_config_path=${get_repo_root()}/config"
+    ]
+  }
+}
+
+# Generate kubernetes + helm + cloudflare + proxmox providers for all stacks.
+# (Stacks that don't use proxmox simply omit any `provider "proxmox" {}` block;
+# the required_providers entry is harmless. The pre-2026-05-26 trick of the
+# infra stack overriding this block to add proxmox stopped working under
+# Terragrunt v0.77 — same-name generate blocks are now forbidden — so proxmox
+# is declared globally instead. The `provider "proxmox" {}` config lives in
+# stacks/infra/terragrunt.hcl, generated under a different filename so it
+# doesn't collide with this providers.tf.)
+generate "k8s_providers" {
+  path      = "providers.tf"
+  if_exists = "overwrite_terragrunt"
+  contents  = <<EOF
+terraform {
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "~> 4.0"
+    }
+    cloudflare = {
+      source  = "cloudflare/cloudflare"
+      version = "~> 4"
+    }
+    authentik = {
+      source  = "goauthentik/authentik"
+      version = "~> 2024.10"
+    }
+    # kubectl (gavinbunney) — workaround for hashicorp/kubernetes
+    # `kubernetes_manifest` panics on Kyverno CRDs. See beads code-e2dp.
+    # Declared for all stacks but only used where opted-in.
+    kubectl = {
+      source  = "gavinbunney/kubectl"
+      version = "~> 1.14"
+    }
+    proxmox = {
+      source  = "telmate/proxmox"
+      version = "3.0.2-rc07"
+    }
+  }
+}
+
+variable "kube_config_path" {
+  type    = string
+  default = "~/.kube/config"
+}
+
+provider "kubernetes" {
+  config_path = var.kube_config_path
+}
+
+provider "helm" {
+  kubernetes = {
+    config_path = var.kube_config_path
+  }
+}
+
+provider "vault" {
+  address          = "https://vault.viktorbarzin.me"
+  skip_child_token = true
+}
+
+provider "kubectl" {
+  config_path      = var.kube_config_path
+  load_config_file = true
+}
+EOF
+}
+
+# Generate Cloudflare provider config (separate file to avoid conflicts
+# with stacks that override providers.tf, e.g. infra stack).
+# DNS records are created per-service via ingress_factory's dns_type param.
+generate "cloudflare_provider" {
+  path      = "cloudflare_provider.tf"
+  if_exists = "overwrite_terragrunt"
+  contents  = <<EOF
+data "vault_kv_secret_v2" "cf_platform" {
+  mount = "secret"
+  name  = "platform"
+}
+
+provider "cloudflare" {
+  api_key = data.vault_kv_secret_v2.cf_platform.data["cloudflare_api_key"]
+  email   = "vbarzin@gmail.com"
+}
+EOF
+}
+
+# Generate shared tiers locals for all stacks.
+# Previously duplicated in 67+ stacks; now defined once here.
+generate "tiers" {
+  path      = "tiers.tf"
+  if_exists = "overwrite_terragrunt"
+  contents  = <<EOF
+locals {
+  tiers = {
+    core    = "0-core"
+    cluster = "1-cluster"
+    gpu     = "2-gpu"
+    edge    = "3-edge"
+    aux     = "4-aux"
+  }
+}
+EOF
+}