probably better than ldap+keycloak: https://goauthentik.io/docs/
sops + scalpel lets us do templating, vault is probably unnecessary https://github.com/polygon/scalpel

authentik terraform provider: https://registry.terraform.io/providers/goauthentik/authentik/latest/docs/resources/provider_oauth2
can output client secrets and stuff for this, but requires specifying UUIDs of default authentik objects
which we can get from data sources: https://registry.terraform.io/providers/goauthentik/authentik/latest/docs/data-sources/flow

netdata seems lighter and less maintenance than grafana+prom+loki: https://github.com/netdata/netdata