refactor(terraform): move shelly to projects/shelly_taupunktluefter and flatten core infra

k8s/README.md

@@ -678,7 +678,7 @@ kubectl create ns migrate
 # backup on moritzgraf.de
 ssh moritzgraf.de "sudo su - docker -c 'cd /home/docker/mailu && docker-compose stop' && sudo su - root -c 'cd /home/docker && tar czvf mailu.tar.gz ./mailu && mv mailu.tar.gz /home/moritz/ && chown moritz. /home/moritz/mailu.tar.gz' && scp mailu.tar.gz haumdaucher.de:/home/moritz/"
 # terraform change
-cd ../terraform/infrastructure && terraform apply
+cd ../terraform && terraform apply
 # helm apply
 cd ../k8s
 helm upgrade --create-namespace --install mailu mailu/mailu -n mailu -f mailu/mailu.secret.yml

k8s/auth/README.md

@@ -170,10 +170,10 @@ The Authentik login screen is customized with a **Haumdaucher** glassmorphism th
   * **Branded Footer**: "HAUMDAUCHER Wurst und Spezialitäten n.e.V." subtle watermark.
 
 ### Managing Theme via Terraform
-Branding is provisioned via the `authentik_brand` resource in `terraform/infrastructure/authentik.tf` using the stylesheet `terraform/infrastructure/haumdaucher-theme.css`:
+Branding is provisioned via the `authentik_brand` resource in `terraform/authentik.tf` using the stylesheet `terraform/haumdaucher-theme.css`:
 
 ```bash
-cd terraform/infrastructure
+cd terraform
 terraform apply -target=authentik_brand.haumdaucher
 ```
 

k8s/auth/USER_MANAGEMENT.md

@@ -22,7 +22,7 @@ This guide covers everything you need to know about managing users in Authentik
 | Question | Answer & Key Mechanism |
 | :--- | :--- |
 | **How to add new users?** | **4 Ways**: (1) Admin Web UI (`Directory > Users`), (2) **Invitations flow** (`Directory > Invitations` - recommended for self-service), (3) **Terraform** (`authentik_user` resource), or (4) **REST API / Python script** for bulk imports. |
-| **Can this be done in Terraform?** | **Yes.** Use `resource "authentik_user"` in `terraform/infrastructure/authentik.tf`. Supports custom attributes via `jsonencode()`, group assignments, and active status. |
+| **Can this be done in Terraform?** | **Yes.** Use `resource "authentik_user"` in `terraform/authentik.tf`. Supports custom attributes via `jsonencode()`, group assignments, and active status. |
 | **Can I change the email sent to the user?** | **Yes.** Configured in **Flows & Stages > Stages > Email Stage**. You can customize the subject line, token expiration, and HTML template (written in Django template syntax with access to user fields and custom attributes). |
 | **Can I limit what a user has access to?** | **Yes.** Through **Policy Bindings** attached to Applications: Group Membership Policies (e.g., `infra-admins` vs `users`), IP/Geo Policies, or Python Expression Policies checking custom attributes (e.g., only active club members). |
 | **How to handle Excel tables with custom attributes?** | Authentik stores arbitrary key-value pairs in `user.attributes` (JSON). You can import an Excel/CSV file with a Python script or Terraform `csvdecode()`, map fields like `haumdaucher_mitgliedsnummer` or `second_email`, and expose them to downstream apps (Nextcloud, Grafana, Gitea) via OIDC Scope Mappings. |
@@ -75,7 +75,7 @@ If you encounter this screen when opening an invite link:
 
 ### Solution: The Haumdaucher Custom Invitation Flow (`haumdaucher-invitation-flow`)
 
-We provision a dedicated, streamlined flow in `terraform/infrastructure/authentik.tf`:
+We provision a dedicated, streamlined flow in `terraform/authentik.tf`:
 
 ```mermaid
 graph LR
@@ -122,7 +122,7 @@ graph LR
 
 ## 🏗️ Method 2: User Provisioning via Terraform
 
-You can manage users, groups, and permissions directly in `terraform/infrastructure/authentik.tf`.
+You can manage users, groups, and permissions directly in `terraform/authentik.tf`.
 
 ### 1. Single User Definition
 ```hcl
@@ -161,7 +161,7 @@ max.mustermann,Max Mustermann,max@example.com,max.privat@gmail.com,HM-2024-042,f
 anna.schmidt,Anna Schmidt,anna@example.com,anna.work@company.de,HM-2024-043,true
 ```
 
-In `terraform/infrastructure/authentik.tf`:
+In `terraform/authentik.tf`:
 ```hcl
 locals {
   csv_users = csvdecode(file("${path.module}/users.csv"))
@@ -479,7 +479,7 @@ graph TD
 | **haumdaucher.de** | `haumdaucher.de` | ForwardAuth / OIDC | **`Admin`** ✅ | **`Member Access`** ✅ | ❌ *Denied* |
 
 ### Policy Bindings in Terraform
-All policy bindings are enforced directly in `terraform/infrastructure/authentik.tf`:
+All policy bindings are enforced directly in `terraform/authentik.tf`:
 
 ```hcl
 # 1. Admin-Only Tools (Restricted strictly to infra-admins)