stacks: add .env + .env.secrets.ctmpl for platform stacks, fix var-name mismatches

Adds real Vault Agent secret templates and non-secret env vars for
14 platform stacks (caddy, caddy-internal, dashy, docker-socket-
proxy, dockhand, gitea, grafana-stack, hawser, kestra, kopia,
mosquitto, nocodb, node-red, speedtest-tracker), sanitized per the
kv/host/... convention established for identity-and-security.

Also fixes 6 variable-name mismatches discovered while cross-checking
every new .env/.ctmpl against what its actual public compose file
references (the public compose files were already adapted from the
private originals during an earlier reorg pass, so names don't always
match 1:1): authentik (PG_USER/PG_DB/PG_PASS), gitea (added
GITEA_DOMAIN/GITEA_ROOT_URL, dropped an unused duplicate-instance pair
of vars), grafana-stack (GRAFANA_ADMIN_PASSWORD), kestra (added
USERNAME/PASSWORD), kopia (SECRET_PASSWORD), nocodb (JWT_SECRET).
Also dropped an unused DOCKER var across most stacks where the
compose file hardcodes its path instead of referencing it.

stacks/platform/caddy-internal/.env

@@ -0,0 +1,3 @@
+# Exposed HTTP port
+HTTPS_PORT=443
+

stacks/platform/caddy/.env

@@ -0,0 +1,3 @@
+# Exposed HTTP port
+HTTPS_PORT=443
+

stacks/platform/dashy/.env

@@ -0,0 +1,7 @@
+# Exposed HTTP port
+HTTP_PORT=10981
+
+# ID's
+PUID=1000
+PGID=1000
+

stacks/platform/dockhand/.env

@@ -0,0 +1,2 @@
+# Exposed HTTP port
+HTTP_PORT=3030

stacks/platform/gitea/.env

@@ -0,0 +1,17 @@
+# System
+PUID=1000
+PGID=1000
+TZ=Etc/UTC
+
+# Ports
+HTTP_PORT=3000
+SSH_PORT=2222
+
+# Postgres (shared creds, separate DBs/instances)
+# POSTGRES_PASSWORD — see .env.secrets (Vault)
+POSTGRES_USER=gitea
+POSTGRES_DB=gitea
+
+# App URL
+GITEA_DOMAIN=gitea.local.example.com
+GITEA_ROOT_URL=https://gitea.local.example.com/

stacks/platform/gitea/.env.secrets.ctmpl

@@ -0,0 +1 @@
+POSTGRES_PASSWORD={{ with secret "kv/host/gitea" }}{{ .Data.data.postgres_password }}{{ end }}

stacks/platform/grafana-stack/.env

@@ -0,0 +1,14 @@
+# Exposed HTTP_PORT_prometheus
+HTTP_PORT_prometheus=9796
+
+# Exposed HTTP_PORT_grafana
+HTTP_PORT_grafana=3693
+
+# Exposed HTTP_PORT_loki
+HTTP_PORT_loki=3100
+
+GF_AUTH_GENERIC_OAUTH_CLIENT_ID=example-oauth-client-id
+# GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET — see .env.secrets (Vault)
+AUTHENTIK_URL=https://authentik.caddy.example.com
+GRAFANA_URL=https://grafana.local.example.com
+# GRAFANA_ADMIN_PASSWORD — see .env.secrets (Vault)

stacks/platform/grafana-stack/.env.secrets.ctmpl

@@ -0,0 +1,2 @@
+GRAFANA_ADMIN_PASSWORD={{ with secret "kv/host/grafana-stack" }}{{ .Data.data.admin_password | replaceAll "$" "$$" }}{{ end }}
+GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET={{ with secret "kv/host/grafana-stack" }}{{ .Data.data.oauth_client_secret | replaceAll "$" "$$" }}{{ end }}

stacks/platform/hawser/.env

@@ -0,0 +1,6 @@
+# Exposed HTTP_PORT
+HTTP_PORT=2376
+
+# System time zone
+TZ=Etc/UTC
+

stacks/platform/hawser/.env.secrets.ctmpl

@@ -0,0 +1 @@
+TOKEN={{ with secret "kv/host/hawser" }}{{ .Data.data.token }}{{ end }}

stacks/platform/kestra/.env

@@ -0,0 +1,10 @@
+# Exposed HTTP port
+HTTP_PORT=10374
+
+# Basic-auth login
+USERNAME=[email protected]
+
+# Postgres Creds
+# POSTGRES_PASSWORD — see .env.secrets (Vault)
+POSTGRES_USER=kestra
+POSTGRES_DB=kestra

stacks/platform/kestra/.env.secrets.ctmpl

@@ -0,0 +1,2 @@
+POSTGRES_PASSWORD={{ with secret "kv/host/kestra" }}{{ .Data.data.postgres_password }}{{ end }}
+PASSWORD={{ with secret "kv/host/kestra" }}{{ .Data.data.ui_password }}{{ end }}

stacks/platform/kopia/.env

@@ -0,0 +1,7 @@
+# Exposed HTTP port
+HTTP_PORT=51515
+
+# System time zone
+TZ=Etc/UTC
+
+USERNAME=user

stacks/platform/kopia/.env.secrets.ctmpl

@@ -0,0 +1 @@
+SECRET_PASSWORD={{ with secret "kv/host/kopia" }}{{ .Data.data.secret_password }}{{ end }}

stacks/platform/mosquitto/.env

@@ -0,0 +1,2 @@
+# Exposed HTTP_PORT
+HTTP_PORT=1883

stacks/platform/nocodb/.env

@@ -0,0 +1,10 @@
+# Exposed HTTP port
+HTTP_PORT=8090
+
+# System time zone
+TZ=Etc/UTC
+
+
+# DB Creds
+POSTGRES_DB=nocodb
+POSTGRES_USER=nocodb

stacks/platform/nocodb/.env.secrets.ctmpl

@@ -0,0 +1,3 @@
+NC_DB=pg://nocodb_db:5432?u=nocodb&p={{ with secret "kv/host/nocodb" }}{{ .Data.data.postgres_password }}{{ end }}&d=nocodb
+JWT_SECRET={{ with secret "kv/host/nocodb" }}{{ .Data.data.jwt_secret }}{{ end }}
+POSTGRES_PASSWORD={{ with secret "kv/host/nocodb" }}{{ .Data.data.postgres_password }}{{ end }}

stacks/platform/node-red/.env

@@ -0,0 +1,10 @@
+# Exposed HTTP port
+HTTP_PORT=1856
+
+# System time zone
+TZ=Etc/UTC
+
+# ID's
+PUID=1000
+PGID=1000
+

stacks/platform/node-red/.env.secrets.ctmpl

@@ -0,0 +1,21 @@
+PAPERLESS_API_TOKEN={{ with secret "kv/host/node-red" }}{{ .Data.data.paperless_api_token }}{{ end }}
+FIREFLY_API_TOKEN={{ with secret "kv/host/node-red" }}{{ .Data.data.firefly_api_token }}{{ end }}
+{{ with secret "kv/host/node-red" }}
+ABS_TOKEN={{ .Data.data.abs_token }}
+AUTHENTIK_TOKEN={{ .Data.data.authentik_token }}
+BAZARR_KEY={{ .Data.data.bazarr_key }}
+JELLYFIN_KEY={{ .Data.data.jellyfin_key }}
+KESTRA_PASS={{ .Data.data.kestra_pass }}
+LIDARR_KEY={{ .Data.data.lidarr_key }}
+NOCODB_TOKEN={{ .Data.data.nocodb_token }}
+PBS_API_TOKEN={{ .Data.data.pbs_api_token }}
+PVE_API_TOKEN={{ .Data.data.pve_api_token }}
+RADARR_KEY={{ .Data.data.radarr_key }}
+SEERR_KEY={{ .Data.data.seerr_key }}
+SLACK_TOKEN={{ .Data.data.slack_token }}
+SONARR_KEY={{ .Data.data.sonarr_key }}
+TECHNITIUM_TOKEN={{ .Data.data.technitium_token }}
+VAULT_TOKEN={{ .Data.data.vault_token }}
+WAZUH_API_PASS={{ .Data.data.wazuh_api_pass }}
+WAZUH_INDEXER_AUTH={{ .Data.data.wazuh_indexer_auth }}
+{{ end }}

stacks/platform/speedtest-tracker/.env

@@ -0,0 +1,16 @@
+# Exposed HTTP port
+HTTPS_PORT=6443
+
+# System time zone
+TZ=Etc/UTC
+
+# Display time zone
+DISPLAY_TIMEZONE=Etc/UTC
+
+# ID's
+PUID=1000
+PGID=1000
+
+
+#App URL
+APP_URL=https://speedtest-tracker.local.example.com

stacks/platform/speedtest-tracker/.env.secrets.ctmpl

@@ -0,0 +1 @@
+APP_KEY={{ with secret "kv/host/speedtest-tracker" }}{{ .Data.data.app_key }}{{ end }}