feat: discord webhooks to o11y vaults for alerting

tf/deployment/modules/scoped/discord/community/channels.tf

@@ -55,7 +55,7 @@ locals {
       "yucca_off_topic",
       "yucca_focus_topic",
       "yucca_alerts",
-      "yucca_alerts_testing",
+      "yucca_alerts_staging",
       "yucca_alerts_dev",
     ]
     # Leadership
@@ -333,7 +333,7 @@ module "team_channels_write" {
     yucca_off_topic      = discord_text_channel.yucca_off_topic.id
     yucca_focus_topic    = discord_forum_channel.yucca_focus_topic.id
     yucca_alerts         = discord_text_channel.yucca_alerts.id
-    yucca_alerts_testing = discord_text_channel.yucca_alerts_testing.id
+    yucca_alerts_staging = discord_text_channel.yucca_alerts_staging.id
     yucca_alerts_dev     = discord_text_channel.yucca_alerts_dev.id
     yucca_voice          = discord_voice_channel.yucca_voice.id
   }
@@ -796,9 +796,9 @@ resource "discord_text_channel" "yucca_alerts" {
   }
 }
 
-resource "discord_text_channel" "yucca_alerts_testing" {
-  name                     = "yucca-alerts-testing"
-  position                 = index(local.channel_order.yucca, "yucca_alerts_testing")
+resource "discord_text_channel" "yucca_alerts_staging" {
+  name                     = "yucca-alerts-staging"
+  position                 = index(local.channel_order.yucca, "yucca_alerts_staging")
   server_id                = discord_server.server.id
   category                 = discord_category_channel.yucca.id
   sync_perms_with_category = false

tf/deployment/modules/scoped/discord/community/providers.tf

@@ -6,3 +6,8 @@ provider "onepassword" {
   url   = var.op_connect_url
   token = var.op_connect_token
 }
+
+provider "onepassword" {
+  alias                 = "futo"
+  service_account_token = var.futo_op_service_account_token
+}

tf/deployment/modules/scoped/discord/community/variables.tf

@@ -7,6 +7,11 @@ variable "op_connect_token" {
 
 variable "discord_token" {}
 
+variable "futo_op_service_account_token" {
+  description = "1Password service-account token for the FUTO account, used to write the webhook URLs into the yucca/o11y vaults"
+  sensitive   = true
+}
+
 variable "discord_server_id" {}
 
 variable "env" {}

tf/deployment/modules/scoped/discord/community/webhooks.tf

@@ -20,6 +20,61 @@ output "team_alerts_grafana_webhook_url" {
   sensitive = true
 }
 
+resource "discord_webhook" "yucca_alerts_grafana" {
+  name            = "Grafana"
+  channel_id      = discord_text_channel.yucca_alerts.id
+  avatar_data_uri = local.image_data_uris["grafana_128_128.webp"]
+}
+
+output "yucca_alerts_grafana_webhook_url" {
+  value     = discord_webhook.yucca_alerts_grafana.url
+  sensitive = true
+}
+
+resource "discord_webhook" "yucca_alerts_staging_grafana" {
+  name            = "Grafana Staging"
+  channel_id      = discord_text_channel.yucca_alerts_staging.id
+  avatar_data_uri = local.image_data_uris["grafana_128_128.webp"]
+}
+
+output "yucca_alerts_staging_grafana_webhook_url" {
+  value     = discord_webhook.yucca_alerts_staging_grafana.url
+  sensitive = true
+}
+
+# Publish each cluster's yucca-alerts Grafana webhook URL into its FUTO o11y vault
+# (o11y_tf_<env>) so the o11y stack can consume it. The o11y_tf_* vaults live in the
+# FUTO 1Password account, which the default (immich Connect) provider cannot reach —
+# hence provider = onepassword.futo.
+#
+# All three yucca-alerts channels live on the community server, which only the prod
+# discord apply manages — the dev apply targets the test server and would clobber the
+# vault items with test-server URLs on every run (its service account may not have o11y
+# vault access either, and data sources execute during every plan). Hence the for_each
+# collapses to an empty map outside prod.
+locals {
+  o11y_grafana_discord_webhooks = {
+    prod    = discord_webhook.yucca_alerts_grafana.url
+    staging = discord_webhook.yucca_alerts_staging_grafana.url
+    dev     = discord_webhook.yucca_alerts_dev_grafana.url
+  }
+}
+
+data "onepassword_vault" "o11y_tf" {
+  for_each = { for env, url in local.o11y_grafana_discord_webhooks : env => url if var.env == "prod" }
+  provider = onepassword.futo
+  name     = "o11y_tf_${each.key}"
+}
+
+resource "onepassword_item" "o11y_grafana_discord_webhook" {
+  for_each = { for env, url in local.o11y_grafana_discord_webhooks : env => url if var.env == "prod" }
+  provider = onepassword.futo
+  vault    = data.onepassword_vault.o11y_tf[each.key].uuid
+  title    = "GRAFANA_DISCORD_WEBHOOK"
+  category = "password"
+  password = each.value
+}
+
 resource "discord_webhook" "yucca_alerts_dev_grafana" {
   name            = "Grafana Dev"
   channel_id      = discord_text_channel.yucca_alerts_dev.id