Step 1 complete: Bootstrap layer with ArgoCD, cert-manager, namespaces imported to TF

- ArgoCD migrated to argocd namespace
- Cert-manager issuers/certs created
- 20 namespaces imported with pod-security labels
- S3 backend temporarily offline (MinIO), using local backup
- Pending: Remove metadata drift from helm releases, re-apply

project-usage/vault-secrets.md

@@ -17,10 +17,10 @@
 ```bash
 # Browser: https://vault.riotpiao.homelab.com
 # Auth method: OIDC → "Sign in with Authentik" (federated)
-# Or: Device code → talos secrets login (CLI)
+# Or: Device code → core secrets login (CLI)
 
 # Via CLI (device code flow)
-talos secrets login
+core secrets login
 # → Opens browser, approve device code
 # → Token cached in ~/.talos/vault
 ```
@@ -28,18 +28,18 @@ talos secrets login
 **2. Store a secret:**
 ```bash
 # Field name = variable name (SCREAMING_SNAKE_CASE)
-talos put cluster/ANTHROPIC_API_KEY ANTHROPIC_API_KEY="sk-..."
-talos put cluster/STORY_CRATER_DB_PASS STORY_CRATER_DB_PASS="dbpass123"
+core put cluster/ANTHROPIC_API_KEY ANTHROPIC_API_KEY="sk-..."
+core put cluster/STORY_CRATER_DB_PASS STORY_CRATER_DB_PASS="dbpass123"
 ```
 
 **3. Retrieve a secret:**
 ```bash
 # Always use --key flag
-talos get cluster/ANTHROPIC_API_KEY --key ANTHROPIC_API_KEY
+core get cluster/ANTHROPIC_API_KEY --key ANTHROPIC_API_KEY
 # → sk-...
 
 # Full secret as JSON
-talos get cluster/ANTHROPIC_API_KEY --json
+core get cluster/ANTHROPIC_API_KEY --json
 ```
 
 **4. Load into shell (helmfile, scripts):**
@@ -78,7 +78,7 @@ cluster/
 **Store generated secret immediately (keeps it out of shell history):**
 ```bash
 # Generate & store in one command
-talos put cluster/GRAFANA_OIDC_CLIENT_SECRET \
+core put cluster/GRAFANA_OIDC_CLIENT_SECRET \
   GRAFANA_OIDC_CLIENT_SECRET="$(openssl rand -hex 32)"
 ```
 
@@ -86,7 +86,7 @@ talos put cluster/GRAFANA_OIDC_CLIENT_SECRET \
 ```bash
 # Create Secret using Vault secret
 kubectl create secret generic grafana-oidc \
-  --from-literal=client-secret="$(talos get cluster/GRAFANA_OIDC_CLIENT_SECRET --key GRAFANA_OIDC_CLIENT_SECRET)" \
+  --from-literal=client-secret="$(core get cluster/GRAFANA_OIDC_CLIENT_SECRET --key GRAFANA_OIDC_CLIENT_SECRET)" \
   -n logging
 ```
 
@@ -96,7 +96,7 @@ kubectl create secret generic grafana-oidc \
 NEW_PASS=$(openssl rand -base64 24)
 
 # 2. Store in Vault
-talos put cluster/OLD_DB_PASS OLD_DB_PASS="$NEW_PASS"
+core put cluster/OLD_DB_PASS OLD_DB_PASS="$NEW_PASS"
 
 # 3. Update database user
 psql -h ddb-cluster-rw.ddb.svc.cluster.local -U postgres \
@@ -113,7 +113,7 @@ k rollout restart -n story-crater-backend deployment/app
 **JWT token from CLI:**
 ```bash
 # After device code login
-talos secrets login
+core secrets login
 
 # Token is cached and auto-renewed
 # Use for API calls
@@ -127,7 +127,7 @@ curl -H "X-Vault-Token: $VAULT_TOKEN" \
 **Vault status:**
 ```bash
 # Check if sealed
-talos status vault
+core status
 
 # If sealed (disaster recovery):
 # See /TROUBLESHOOTING.md § Vault Sealed
@@ -139,10 +139,10 @@ talos status vault
 # Logs stored in Loki under vault namespace
 
 # View recent access
-talos audit log --limit 50
+core audit log --limit 50
 
 # Export for compliance
-talos audit export --format json > vault-audit.json
+core audit export --format json > vault-audit.json
 ```
 
 ## Security Rules
@@ -177,7 +177,7 @@ k rollout restart -n iam statefulset/vault
 **Vault is sealed:**
 ```bash
 # Check status
-talos status vault
+core status
 
 # If sealed, use unseal keys (stored in MinIO backup)
 # See /TROUBLESHOOTING.md § Vault Sealed for recovery steps
@@ -186,11 +186,11 @@ talos status vault
 **Secret not found:**
 ```bash
 # Verify path exists
-talos list cluster
+core list cluster
 
 # Check secret name (case-sensitive)
-talos get cluster/anthropic_api_key --key anthropic_api_key  # won't work
-talos get cluster/ANTHROPIC_API_KEY --key ANTHROPIC_API_KEY  # correct
+core get cluster/anthropic_api_key --key anthropic_api_key  # won't work
+core get cluster/ANTHROPIC_API_KEY --key ANTHROPIC_API_KEY  # correct
 ```
 
 **vsource not expanding secrets:**
@@ -200,7 +200,7 @@ grep ANTHROPIC_API_KEY .env
 # → Should be: ANTHROPIC_API_KEY=  (empty, not a value)
 
 # Verify Vault is accessible
-talos get cluster/ANTHROPIC_API_KEY --key ANTHROPIC_API_KEY
+core get cluster/ANTHROPIC_API_KEY --key ANTHROPIC_API_KEY
 # → Should return secret
 
 # Run vsource explicitly