terraform: add radarr/sonarr API keys for exportarr

Add vault secrets for Radarr and Sonarr API keys to enable
exportarr metrics collection on monitoring01.

- services/exportarr/radarr - Radarr API key
- services/exportarr/sonarr - Sonarr API key
- Grant monitoring01 access to services/exportarr/*

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

terraform/vault/approle.tf

@@ -60,6 +60,7 @@ locals {
         "secret/data/hosts/monitoring01/*",
         "secret/data/shared/backup/*",
         "secret/data/shared/nats/*",
+        "secret/data/services/exportarr/*",
       ]
       extra_policies = ["prometheus-metrics"]
     }

terraform/vault/secrets.tf

@@ -126,6 +126,17 @@ locals {
       auto_generate = false
       data          = { nkey = var.nixos_exporter_nkey }
     }
+
+    # Exportarr API keys for media stack monitoring
+    "services/exportarr/radarr" = {
+      auto_generate = false
+      data          = { api_key = var.radarr_api_key }
+    }
+
+    "services/exportarr/sonarr" = {
+      auto_generate = false
+      data          = { api_key = var.sonarr_api_key }
+    }
   }
 }
 

terraform/vault/variables.tf

@@ -80,3 +80,17 @@ variable "nixos_exporter_nkey" {
   sensitive   = true
 }
 
+variable "radarr_api_key" {
+  description = "Radarr API key for exportarr metrics"
+  type        = string
+  default     = "PLACEHOLDER"
+  sensitive   = true
+}
+
+variable "sonarr_api_key" {
+  description = "Sonarr API key for exportarr metrics"
+  type        = string
+  default     = "PLACEHOLDER"
+  sensitive   = true
+}
+