vault: temporarily remove ghp secret backend + roles (unblock apply)

The master apply aborts reading the unseeded ghp config KV
(kv/data/service/vault/au/syd1/secret_backend/ghp/config), blocking all
changes including the arrstack plugin registration (#125). The ghp backend
and role are not-yet-created (0 to destroy), so removing them is
non-destructive and lets the apply proceed.

The ghp plugin registration and ghp policies are retained. This is part 1
of remove -> grant write policy -> seed KV -> re-add; it will be reverted
once the ghp config is seeded.

- Remove module.ghp_secret_backend and module.ghp_secret_backend_role
  instantiations (and the role's depends_on) from modules/vault_cluster/main.tf.
- Remove the ghp_secret_backend and ghp_secret_backend_role variables from
  modules/vault_cluster/variables.tf.
- Remove the ghp_secret_backend and ghp_secret_backend_role parsing blocks
  from config/config.hcl.
- Remove the ghp_secret_backend and ghp_secret_backend_role inputs from
  environments/au/syd1/terragrunt.hcl.
- Delete config/ghp_secret_backend/ghp.yaml and
  config/ghp_secret_backend_role/ghp/agent.yaml.

config/config.hcl

@@ -266,18 +266,5 @@ locals {
       })
       if startswith(file_path, "netbox_secret_backend_role/")
     }
-    ghp_secret_backend = {
-      for file_path, content in local.all_configs :
-      trimsuffix(basename(file_path), ".yaml") => content
-      if startswith(file_path, "ghp_secret_backend/")
-    }
-    ghp_secret_backend_role = {
-      for file_path, content in local.all_configs :
-      trimsuffix(replace(file_path, "ghp_secret_backend_role/", ""), ".yaml") => merge(content, {
-        name    = trimsuffix(basename(file_path), ".yaml")
-        backend = dirname(replace(file_path, "ghp_secret_backend_role/", ""))
-      })
-      if startswith(file_path, "ghp_secret_backend_role/")
-    }
   }
 }

config/ghp_secret_backend/ghp.yaml

@@ -1,15 +0,0 @@
-# Mounts the ghp token secrets engine at "ghp" and writes its config.
-# The seeded ghp service token is sensitive and read from KV, not stored here:
-#   kv/service/vault/au/syd1/secret_backend/ghp/config
-#   -> key: admin_token (required) the shared ghpsvc_... service token
-#
-# admin_token is a static shared secret provisioned into KV by an operator. The
-# SAME token value must also be present in the running ghp deployment's accepted
-# service tokens (GHP_AUTH_SERVICE_TOKENS) so ghp ACCEPTS what this engine
-# PRESENTS. ghp has no rotate endpoint, so the engine never rotates it in place;
-# the mount uses ignore_changes=[admin_token], making the KV seed create-only
-# (re-reading a stale KV value never re-pushes it to a live mount).
-description: "ghp ephemeral scoped agent token engine"
-base_url: "https://ghp.unkin.net"
-tls_skip_verify: false
-request_timeout_seconds: 30

config/ghp_secret_backend_role/ghp/agent.yaml

@@ -1,15 +0,0 @@
-# Role minting ephemeral, scoped ghp agent tokens. Reading ghp/creds/agent mints
-# a lease-bound token deleted from ghp on revoke/expiry. token_type "agent" binds
-# the minted token to a ghp App installation, so installation_id is REQUIRED.
-#
-# installation_id below is a PLACEHOLDER (0) and MUST be set to the real ghp App
-# installation id before this role can mint usable tokens. scopes are ghp
-# permission:level pairs; contents:read is the least-privilege default.
----
-token_type: agent
-installation_id: 0 # PLACEHOLDER - set to the real ghp App installation id
-scopes:
-  - contents:read
-session_prefix: vault
-ttl: 3600      # 1h
-max_ttl: 86400 # 24h

environments/au/syd1/terragrunt.hcl

@@ -90,9 +90,6 @@ inputs = {
   netbox_secret_backend      = local.config.netbox_secret_backend
   netbox_secret_backend_role = local.config.netbox_secret_backend_role
 
-  ghp_secret_backend      = local.config.ghp_secret_backend
-  ghp_secret_backend_role = local.config.ghp_secret_backend_role
-
   # Pass policy maps to vault_cluster module
   policy_auth_map  = local.policies.policy_auth_map
   policy_rules_map = local.policies.policy_rules_map

modules/vault_cluster/main.tf

@@ -536,43 +536,6 @@ module "netbox_secret_backend_role" {
   depends_on = [module.netbox_secret_backend, module.netbox_user_management]
 }
 
-module "ghp_secret_backend" {
-  source = "./modules/ghp_secret_backend"
-
-  for_each = var.ghp_secret_backend
-
-  path                    = each.key
-  plugin                  = each.value.plugin
-  description             = each.value.description
-  base_url                = each.value.base_url
-  country                 = var.country
-  region                  = var.region
-  ca_cert                 = each.value.ca_cert
-  tls_skip_verify         = each.value.tls_skip_verify
-  request_timeout_seconds = each.value.request_timeout_seconds
-
-  depends_on = [module.plugin]
-}
-
-module "ghp_secret_backend_role" {
-  source = "./modules/ghp_secret_backend_role"
-
-  for_each = var.ghp_secret_backend_role
-
-  backend         = each.value.backend
-  name            = each.value.name
-  token_type      = each.value.token_type
-  installation_id = each.value.installation_id
-  app_record_id   = each.value.app_record_id
-  repositories    = each.value.repositories
-  scopes          = each.value.scopes
-  session_prefix  = each.value.session_prefix
-  ttl             = each.value.ttl
-  max_ttl         = each.value.max_ttl
-
-  depends_on = [module.ghp_secret_backend]
-}
-
 module "vault_policy" {
   source = "./modules/vault_policy"
 

modules/vault_cluster/variables.tf

@@ -468,36 +468,6 @@ variable "netbox_backend_aliases" {
   default     = {}
 }
 
-variable "ghp_secret_backend" {
-  description = "Map of ghp token secret engines to create (mount + config; seeded service token read from KV)"
-  type = map(object({
-    plugin                  = optional(string, "vault-plugin-secrets-ghp")
-    description             = optional(string)
-    base_url                = string
-    ca_cert                 = optional(string)
-    tls_skip_verify         = optional(bool, false)
-    request_timeout_seconds = optional(number, 30)
-  }))
-  default = {}
-}
-
-variable "ghp_secret_backend_role" {
-  description = "Map of ghp engine roles; reading ghp/creds/<name> mints a short-lived scoped ghp token"
-  type = map(object({
-    name            = string
-    backend         = string
-    token_type      = optional(string)
-    installation_id = optional(number)
-    app_record_id   = optional(string)
-    repositories    = optional(list(string))
-    scopes          = optional(list(string))
-    session_prefix  = optional(string)
-    ttl             = optional(number)
-    max_ttl         = optional(number)
-  }))
-  default = {}
-}
-
 variable "policy_auth_map" {
   description = "Map of auth mounts -> auth roles -> policy names"
   type        = map(map(list(string)))