vault: scope down to only removing the ghp backend + role config YAMLs

Restore the ghp wiring (module instantiations, variables, config.hcl parsing
blocks, and terragrunt inputs) exactly as on master, and remove ONLY the two
ghp config YAMLs. With no yaml files, the for_each maps are empty, so zero ghp
backend/role instances are created and the unseeded ghp/config KV is never read
- the master apply passes while the wiring stays in place for the later re-add.

config/config.hcl

@@ -266,5 +266,18 @@ locals {
       })
       if startswith(file_path, "netbox_secret_backend_role/")
     }
+    ghp_secret_backend = {
+      for file_path, content in local.all_configs :
+      trimsuffix(basename(file_path), ".yaml") => content
+      if startswith(file_path, "ghp_secret_backend/")
+    }
+    ghp_secret_backend_role = {
+      for file_path, content in local.all_configs :
+      trimsuffix(replace(file_path, "ghp_secret_backend_role/", ""), ".yaml") => merge(content, {
+        name    = trimsuffix(basename(file_path), ".yaml")
+        backend = dirname(replace(file_path, "ghp_secret_backend_role/", ""))
+      })
+      if startswith(file_path, "ghp_secret_backend_role/")
+    }
   }
 }

environments/au/syd1/terragrunt.hcl

@@ -90,6 +90,9 @@ inputs = {
   netbox_secret_backend      = local.config.netbox_secret_backend
   netbox_secret_backend_role = local.config.netbox_secret_backend_role
 
+  ghp_secret_backend      = local.config.ghp_secret_backend
+  ghp_secret_backend_role = local.config.ghp_secret_backend_role
+
   # Pass policy maps to vault_cluster module
   policy_auth_map  = local.policies.policy_auth_map
   policy_rules_map = local.policies.policy_rules_map

modules/vault_cluster/main.tf

@@ -536,6 +536,43 @@ module "netbox_secret_backend_role" {
   depends_on = [module.netbox_secret_backend, module.netbox_user_management]
 }
 
+module "ghp_secret_backend" {
+  source = "./modules/ghp_secret_backend"
+
+  for_each = var.ghp_secret_backend
+
+  path                    = each.key
+  plugin                  = each.value.plugin
+  description             = each.value.description
+  base_url                = each.value.base_url
+  country                 = var.country
+  region                  = var.region
+  ca_cert                 = each.value.ca_cert
+  tls_skip_verify         = each.value.tls_skip_verify
+  request_timeout_seconds = each.value.request_timeout_seconds
+
+  depends_on = [module.plugin]
+}
+
+module "ghp_secret_backend_role" {
+  source = "./modules/ghp_secret_backend_role"
+
+  for_each = var.ghp_secret_backend_role
+
+  backend         = each.value.backend
+  name            = each.value.name
+  token_type      = each.value.token_type
+  installation_id = each.value.installation_id
+  app_record_id   = each.value.app_record_id
+  repositories    = each.value.repositories
+  scopes          = each.value.scopes
+  session_prefix  = each.value.session_prefix
+  ttl             = each.value.ttl
+  max_ttl         = each.value.max_ttl
+
+  depends_on = [module.ghp_secret_backend]
+}
+
 module "vault_policy" {
   source = "./modules/vault_policy"
 

modules/vault_cluster/variables.tf

@@ -468,6 +468,36 @@ variable "netbox_backend_aliases" {
   default     = {}
 }
 
+variable "ghp_secret_backend" {
+  description = "Map of ghp token secret engines to create (mount + config; seeded service token read from KV)"
+  type = map(object({
+    plugin                  = optional(string, "vault-plugin-secrets-ghp")
+    description             = optional(string)
+    base_url                = string
+    ca_cert                 = optional(string)
+    tls_skip_verify         = optional(bool, false)
+    request_timeout_seconds = optional(number, 30)
+  }))
+  default = {}
+}
+
+variable "ghp_secret_backend_role" {
+  description = "Map of ghp engine roles; reading ghp/creds/<name> mints a short-lived scoped ghp token"
+  type = map(object({
+    name            = string
+    backend         = string
+    token_type      = optional(string)
+    installation_id = optional(number)
+    app_record_id   = optional(string)
+    repositories    = optional(list(string))
+    scopes          = optional(list(string))
+    session_prefix  = optional(string)
+    ttl             = optional(number)
+    max_ttl         = optional(number)
+  }))
+  default = {}
+}
+
 variable "policy_auth_map" {
   description = "Map of auth mounts -> auth roles -> policy names"
   type        = map(map(list(string)))