Move all 8 Authentik OIDC client_secrets out of plaintext git

Completes the 'make the repo proper' cleanup from earlier this session -
these were flagged but deliberately not touched in 185e9c2 given the
blast radius (live SSO for 8 apps). User confirmed: fix all 8 now.

infrastructure/authentik/{argocd,gitlab,nextcloud,grafana,n8n,guacamole,
rancher,vault}-blueprint.yaml: converted from plain ConfigMap (client_secret
hardcoded) to ExternalSecret with a templated blueprint body
(client_secret: "{{ .clientSecret }}") pulling from Vault. Chart already
supports mounting blueprints from Secrets (blueprints.secrets, alongside
blueprints.configMaps) - infrastructure/authentik/values.yaml updated to
route these 8 there instead.

For argocd/nextcloud/n8n/guacamole/rancher: Vault already had the matching
value at secret/<app>-oauth (the APP side was already Vault-backed via its
own ExternalSecret) - the blueprint was the only remaining plaintext copy.

For gitlab/grafana/vault: Vault had no copy at all yet - created
secret/{gitlab,grafana,vault}-oauth with the EXISTING live values (not
rotated - these are the actual working credentials right now, rotating
would break login until every consumer is updated in lockstep, which is
out of scope for a cleanup pass). Also fixed the OTHER plaintext copies
that existed for these three specifically:
  - apps/gitlab/manifests/external-secret-oidc.yaml (new): replaces a
    manually kubectl-created, never-git-tracked gitlab-oidc-secret.
  - infrastructure/grafana/manifests/grafana-oauth-secret.yaml: was a
    plain Secret whose own comment said 'hardcoded from blueprint'.
  - infrastructure/vault/manifests/vault-init-{configmap,job}.yaml: this
    one COULDN'T be converted to the same ExternalSecret-from-Vault
    pattern - it's the PostSync Job that grants ESO's own Kubernetes-auth
    role in Vault, so ESO can't yet authenticate to pull anything from
    Vault at the point this script runs (genuinely circular). Sourced
    from a new vault-oidc-bootstrap Secret instead - created once
    manually (kubectl, not git, matching how Vault's own root/unseal
    material is already handled), independent of the ESO pipeline.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

infrastructure/authentik/argocd-blueprint.yaml

@@ -1,49 +1,77 @@
 ---
-apiVersion: v1
-kind: ConfigMap
+# Was a plain ConfigMap with client_secret hardcoded in plaintext - found
+# and fixed 2026-08-20 (user: "make the repo proper and not have
+# sensitive things in the files"). The value itself was already the
+# genuine live secret ArgoCD's own OIDC client uses (apps/argocd/
+# manifests/external-secret.yaml pulls the same value from Vault at
+# secret/argocd-oauth) - Vault was already the source of truth on the
+# APP side, this blueprint (the Authentik PROVIDER side) just had its own
+# separate hardcoded plaintext copy instead of also reading from Vault.
+#
+# Converted ConfigMap -> ExternalSecret (chart supports mounting
+# blueprints from Secrets too - see blueprints.secrets in values.yaml).
+# client_id stays inline - it's not a secret, same convention as every
+# other blueprint here.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
 metadata:
   name: authentik-blueprints-argocd
   namespace: authentik
-  labels:
-    goauthentik.io/blueprint: "true"
-data:
-  argocd.yaml: |-
-    version: 1
-    metadata:
-      name: argocd-oidc
-    entries:
-      - model: authentik_providers_oauth2.oauth2provider
-        id: argocd-provider
-        state: present
-        identifiers:
-          name: ArgoCD
-        attrs:
-          name: ArgoCD
-          client_id: 3791058a7de278045e5ec36be29f7a33d635119b8c786f20c86b185139c28841
-          client_secret: f787416822f5bf4c46fe9170e63d1bf9520bab7703d53341aaaec107c8c4ba253d96c30b70d23a1c0b5a401ae1ae4bfb5db06092d338e29e0b0f04cd29bc0b36
-          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
-          authentication_flow: !Find [authentik_flows.flow, [slug, default-authentication-flow]]
-          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
-          redirect_uris:
-            - url: "https://argocd.kube.huskypup.net/auth/callback"
-              matching_mode: strict
-          property_mappings:
-            - !Find [authentik_providers_oauth2.scopemapping, [scope_name, openid]]
-            - !Find [authentik_providers_oauth2.scopemapping, [scope_name, email]]
-            - !Find [authentik_providers_oauth2.scopemapping, [scope_name, profile]]
-          client_type: confidential
-          access_code_validity: "minutes=10"
-          access_token_validity: "hours=1"
-          refresh_token_validity: "days=30"
-          signing_key: !Find [authentik_crypto.certificatekeypair, [name, "authentik Internal JWT Certificate"]]
-      
-      - model: authentik_core.application
-        id: argocd-application
-        state: present
-        identifiers:
-          slug: argocd
-        attrs:
-          name: ArgoCD
-          slug: argocd
-          policy_engine_mode: any
-          provider: !KeyOf argocd-provider
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-backend
+  target:
+    name: authentik-blueprints-argocd
+    creationPolicy: Owner
+    template:
+      metadata:
+        labels:
+          goauthentik.io/blueprint: "true"
+      data:
+        argocd.yaml: |-
+          version: 1
+          metadata:
+            name: argocd-oidc
+          entries:
+            - model: authentik_providers_oauth2.oauth2provider
+              id: argocd-provider
+              state: present
+              identifiers:
+                name: ArgoCD
+              attrs:
+                name: ArgoCD
+                client_id: 3791058a7de278045e5ec36be29f7a33d635119b8c786f20c86b185139c28841
+                client_secret: "{{ .clientSecret }}"
+                authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+                authentication_flow: !Find [authentik_flows.flow, [slug, default-authentication-flow]]
+                invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+                redirect_uris:
+                  - url: "https://argocd.kube.huskypup.net/auth/callback"
+                    matching_mode: strict
+                property_mappings:
+                  - !Find [authentik_providers_oauth2.scopemapping, [scope_name, openid]]
+                  - !Find [authentik_providers_oauth2.scopemapping, [scope_name, email]]
+                  - !Find [authentik_providers_oauth2.scopemapping, [scope_name, profile]]
+                client_type: confidential
+                access_code_validity: "minutes=10"
+                access_token_validity: "hours=1"
+                refresh_token_validity: "days=30"
+                signing_key: !Find [authentik_crypto.certificatekeypair, [name, "authentik Internal JWT Certificate"]]
+
+            - model: authentik_core.application
+              id: argocd-application
+              state: present
+              identifiers:
+                slug: argocd
+              attrs:
+                name: ArgoCD
+                slug: argocd
+                policy_engine_mode: any
+                provider: !KeyOf argocd-provider
+  data:
+    - secretKey: clientSecret
+      remoteRef:
+        key: argocd-oauth
+        property: client-secret