Migrate k8s config from Terraform to Argo CD + ESO

Phase 1: Install External Secrets Operator via Argo CD app
- apps/external-secrets.yaml — ESO Helm chart install
- apps/external-secrets-config.yaml — ClusterSecretStore deployment
- k8s/external-secrets/cluster-secret-store.yaml — Vault backend using vault-token Secret

Phase 2: Create k8s manifests for all services
- k8s/neuron/ — PVC, ConfigMap, ExternalSecrets (neuron-secrets, cloudflared-secret), Ingress
- k8s/gitea/ — PVC, ConfigMap (custom CSS), ExternalSecret (gitea-db), Ingress
- k8s/github-runner/ — ExternalSecret (github-runner-secret)
- k8s/gitea-runner/ — ExternalSecret (gitea-runner-secret)
- k8s/monitoring/ — ExternalSecrets (grafana, slack), Alloy OTLP service+middleware, datasources ConfigMap, Ingress
- k8s/postgres/ — ExternalSecret (postgres-passwords)
- k8s/vault/ — ExternalSecret (vault-gcp-sa from Vault)
- k8s/adguard/ — PVCs, ConfigMap, Certificate, Ingress, ddclient Deployment+ExternalSecret
- k8s/ollama/ — PVC, Ingress
- k8s/headscale/ — PVC
- k8s/packages/ — PVCs, ConfigMap, Ingresses
- k8s/registry/ — PVC, Ingresses
- k8s/backup/ — CronJob, ExternalSecret (backup-credentials)

New Argo CD apps for Helm releases:
- apps/kube-prometheus-stack.yaml, loki.yaml, tempo.yaml, alloy.yaml
- apps/postgres.yaml, redis.yaml, vault.yaml

New Argo CD apps for k8s config paths:
- apps/neuron-config, gitea-config, ci-config, gitea-runner-config
- apps/monitoring-config, adguard-config, ollama-config, headscale-config
- apps/packages-config, registry-config, postgres-config, vault-config, backup

Phase 3: Strip Terraform to infrastructure-only
- All kubernetes_* and helm_release resources removed from service .tf files
- Each service .tf now contains only kubernetes_namespace (bootstrap dependency)
- variables.tf stripped to only cloudflare_api_key, cloudflare_email, gitea_api_token
- namespaces.tf gains external-secrets namespace
- ingress.tf, backup.tf, ddclient.tf emptied (resources in k8s/)
- cert-manager.tf, argocd.tf, traefik.tf unchanged (bootstrap)

servers/legion/k8s/monitoring/alloy-otlp-middleware.yaml

@@ -0,0 +1,11 @@
+---
+# Traefik BasicAuth middleware — strips auth before forwarding to Alloy
+# Secret alloy-otlp-auth is synced from Vault via ExternalSecret (see external-secrets.yaml)
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: alloy-otlp-auth
+  namespace: monitoring
+spec:
+  basicAuth:
+    secret: alloy-otlp-auth

servers/legion/k8s/monitoring/alloy-otlp-service.yaml

@@ -0,0 +1,18 @@
+---
+# Expose Alloy's OTLP HTTP port (4318) for external log/trace ingestion from RunPod pods
+apiVersion: v1
+kind: Service
+metadata:
+  name: alloy-otlp
+  namespace: monitoring
+  labels:
+    app: alloy-otlp
+spec:
+  selector:
+    app.kubernetes.io/name: alloy
+  ports:
+    - name: otlp-http
+      port: 4318
+      targetPort: 4318
+      protocol: TCP
+  type: ClusterIP

servers/legion/k8s/monitoring/external-secrets.yaml

@@ -0,0 +1,23 @@
+---
+# alloy-otlp-auth — bcrypt htpasswd entry for Traefik BasicAuth middleware
+# Username: pantheon, password: alloy push token from Vault secret/alloy
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: alloy-otlp-auth
+  namespace: monitoring
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: alloy-otlp-auth
+    creationPolicy: Owner
+    # ESO does not bcrypt — the htpasswd entry must be pre-hashed in Vault.
+    # Store via: vault kv patch secret/alloy htpasswd_entry="pantheon:$(htpasswd -nbB pantheon <token> | cut -d: -f2)"
+  data:
+    - secretKey: users
+      remoteRef:
+        key: secret/data/alloy
+        property: htpasswd_entry

servers/legion/k8s/monitoring/grafana-datasources.yaml

@@ -0,0 +1,37 @@
+---
+# Grafana extra datasources — Loki and Tempo with cross-linking
+# Discovered by Grafana sidecar via label grafana_datasource=1
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: grafana-extra-datasources
+  namespace: monitoring
+  labels:
+    grafana_datasource: "1"
+data:
+  datasources.yaml: |
+    apiVersion: 1
+    datasources:
+    - name: Loki
+      type: loki
+      uid: loki
+      url: http://loki-gateway.monitoring.svc.cluster.local
+      access: proxy
+      jsonData:
+        httpHeaderName1: X-Scope-OrgID
+      secureJsonData:
+        httpHeaderValue1: legion
+    - name: Tempo
+      type: tempo
+      uid: tempo
+      url: http://tempo.monitoring.svc.cluster.local:3100
+      access: proxy
+      jsonData:
+        lokiSearch:
+          datasourceUid: loki
+        tracesToLogsV2:
+          datasourceUid: loki
+          filterByTraceID: true
+          filterBySpanID: false
+        tracesToMetrics:
+          datasourceUid: prometheus

servers/legion/k8s/monitoring/grafana-external-secrets.yaml

@@ -0,0 +1,40 @@
+---
+# grafana-admin-secret — Grafana admin password from Vault
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: grafana-admin-secret
+  namespace: monitoring
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: grafana-admin-secret
+    creationPolicy: Owner
+  data:
+    - secretKey: admin-password
+      remoteRef:
+        key: secret/data/grafana
+        property: admin_password
+---
+# slack-bot-token — Slack bot token for Alertmanager notifications
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: slack-bot-token
+  namespace: monitoring
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: slack-bot-token
+    creationPolicy: Owner
+  data:
+    - secretKey: bot_token
+      remoteRef:
+        key: secret/data/slack
+        property: bot_token

servers/legion/k8s/monitoring/ingress.yaml

@@ -0,0 +1,29 @@
+---
+# Alloy OTLP HTTP ingress — external log/trace ingestion from RunPod pods
+# Auth: HTTP Basic Auth (username: pantheon, password: ALLOY_PUSH_TOKEN)
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: alloy-otlp
+  namespace: monitoring
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.middlewares: monitoring-alloy-otlp-auth@kubernetescrd
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - alloy.neuralplatform.ai
+      secretName: alloy-otlp-tls
+  rules:
+    - host: alloy.neuralplatform.ai
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: alloy-otlp
+                port:
+                  number: 4318