From 0a28c5f4952ed116886ea75469c78a17a2a44db6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Torjus=20H=C3=A5kestad?= <torjus@usit.uio.no>
Date: Mon, 9 Feb 2026 22:52:34 +0100
Subject: [PATCH] terraform: add radarr/sonarr API keys for exportarr

Add vault secrets for Radarr and Sonarr API keys to enable
exportarr metrics collection on monitoring01.

- services/exportarr/radarr - Radarr API key
- services/exportarr/sonarr - Sonarr API key
- Grant monitoring01 access to services/exportarr/*

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 terraform/vault/approle.tf   |  1 +
 terraform/vault/secrets.tf   | 11 +++++++++++
 terraform/vault/variables.tf | 14 ++++++++++++++
 3 files changed, 26 insertions(+)

diff --git a/terraform/vault/approle.tf b/terraform/vault/approle.tf
index a88dfef..ec0d6df 100644
--- a/terraform/vault/approle.tf
+++ b/terraform/vault/approle.tf
@@ -60,6 +60,7 @@ locals {
         "secret/data/hosts/monitoring01/*",
         "secret/data/shared/backup/*",
         "secret/data/shared/nats/*",
+        "secret/data/services/exportarr/*",
       ]
       extra_policies = ["prometheus-metrics"]
     }
diff --git a/terraform/vault/secrets.tf b/terraform/vault/secrets.tf
index d27de3d..1bb8926 100644
--- a/terraform/vault/secrets.tf
+++ b/terraform/vault/secrets.tf
@@ -126,6 +126,17 @@ locals {
       auto_generate = false
       data          = { nkey = var.nixos_exporter_nkey }
     }
+
+    # Exportarr API keys for media stack monitoring
+    "services/exportarr/radarr" = {
+      auto_generate = false
+      data          = { api_key = var.radarr_api_key }
+    }
+
+    "services/exportarr/sonarr" = {
+      auto_generate = false
+      data          = { api_key = var.sonarr_api_key }
+    }
   }
 }
 
diff --git a/terraform/vault/variables.tf b/terraform/vault/variables.tf
index 928abd6..3a03b66 100644
--- a/terraform/vault/variables.tf
+++ b/terraform/vault/variables.tf
@@ -80,3 +80,17 @@ variable "nixos_exporter_nkey" {
   sensitive   = true
 }
 
+variable "radarr_api_key" {
+  description = "Radarr API key for exportarr metrics"
+  type        = string
+  default     = "PLACEHOLDER"
+  sensitive   = true
+}
+
+variable "sonarr_api_key" {
+  description = "Sonarr API key for exportarr metrics"
+  type        = string
+  default     = "PLACEHOLDER"
+  sensitive   = true
+}
+