Step 1 complete: Bootstrap layer with ArgoCD, cert-manager, namespaces imported to TF

- ArgoCD migrated to argocd namespace
- Cert-manager issuers/certs created
- 20 namespaces imported with pod-security labels
- S3 backend temporarily offline (MinIO), using local backup
- Pending: Remove metadata drift from helm releases, re-apply

terraform/scripts/init-terraform.sh

@@ -0,0 +1,60 @@
+#!/bin/bash
+set -e
+
+cd "$(dirname "$0")/.."
+
+echo "=== Terraform Bootstrap Setup ==="
+
+if [ ! -f "../.env" ]; then
+  echo "ERROR: ../.env not found. Run from terraform/ directory."
+  exit 1
+fi
+
+# Extract MinIO credentials from .env
+export AWS_ACCESS_KEY_ID=$(grep "^MINIO_ROOT_USER=" ../.env | cut -d= -f2)
+export AWS_SECRET_ACCESS_KEY=$(grep "^MINIO_ROOT_PASSWORD=" ../.env | cut -d= -f2)
+export KUBECONFIG=$(pwd)/../cluster-config/kubeconfig
+
+if [ -z "$AWS_ACCESS_KEY_ID" ] || [ -z "$AWS_SECRET_ACCESS_KEY" ]; then
+  echo "ERROR: MINIO_ROOT_USER or MINIO_ROOT_PASSWORD not found in .env"
+  exit 1
+fi
+
+echo "✓ MinIO S3 credentials loaded"
+
+# Check Vault token
+if [ -z "$VAULT_TOKEN" ]; then
+  echo "WARNING: VAULT_TOKEN not set. Set it before terraform init:"
+  echo "  export VAULT_TOKEN=\$(vault login -method=oidc ...)"
+fi
+
+# Generate terraform.tfvars from .env
+echo "Generating terraform.tfvars from .env..."
+cat > terraform.tfvars.local << 'EOF'
+# Auto-generated from .env
+EOF
+
+grep -E '^(AUTHENTIK_SECRET_KEY|AUTHENTIK_BOOTSTRAP_PASSWORD|AUTHENTIK_BOOTSTRAP_TOKEN|AUTHENTIK_PG_PASSWORD|POSTGRES_PASSWORD|MINIO_ROOT_|GRAFANA_|FORGEJO_|ARGOCD_)' ../.env | sed 's/_ROOT_USER=/=/' | while read line; do
+  key=$(echo "$line" | cut -d= -f1 | sed 's/_/ /g; s/.*/\L&/; s/ /_/g')
+  val=$(echo "$line" | cut -d= -f2-)
+  if [[ "$key" == *"secret"* ]] || [[ "$key" == *"password"* ]]; then
+    echo "$key = \"$val\"" >> terraform.tfvars.local
+  else
+    echo "$key = \"$val\"" >> terraform.tfvars.local
+  fi
+done
+
+echo "✓ terraform.tfvars.local generated"
+
+# Initialize terraform
+echo "Initializing terraform with S3 backend..."
+terraform init \
+  -backend-config="access_key=$AWS_ACCESS_KEY_ID" \
+  -backend-config="secret_key=$AWS_SECRET_ACCESS_KEY"
+
+echo "✓ Terraform initialized"
+echo ""
+echo "Next steps:"
+echo "  1. Review: terraform plan"
+echo "  2. Import existing resources: ./scripts/import-existing.sh"
+echo "  3. Apply: terraform apply"