feat(infra): add optional external-secrets integration via rag-setup …

infrastructure/.gitignore

@@ -4,7 +4,7 @@
 **/.backend.hcl
 **/kubeconfig.yaml
 **/*.lock.*
-
+**/values.prod.auto.yaml
 auth
 
 .DS_Store

infrastructure/README.md

@@ -598,7 +598,49 @@ For deployment of the *NGINX Ingress Controller* and a cert-manager, the followi
 
 [base-setup](server-setup/base-setup/Chart.yaml)
 
-The email in the [cert-issuer template](server-setup/base-setup/templates/cert-issuer.yaml) should be changed from `<replace@me.com>` to a real email address.
+Set a real ACME email for cert-manager via the deploy script (`--issuer-email`) or via `base-setup` value `certIssuer.email`.
+
+For deploying RAG together with External Secrets Operator integration, use the wrapper chart:
+
+[rag-setup](server-setup/rag-setup/Chart.yaml)
+
+`rag-setup` defaults are production-oriented and reference ESO-managed secrets.
+Its `rag` dependency is resolved from the published GitHub Pages chart repo (`https://stackitcloud.github.io/rag-template`) with a pinned chart version.
+
+Notes:
+- Local development with Tilt is unchanged: Tilt deploys `infrastructure/rag` directly, so External Secrets Operator from `rag-setup` is not deployed by default.
+- Fastest production path (one command after you prepared `seed-secrets/terraform.tfvars` with app/API values in `rag_secrets`):
+- Before running, ensure `infrastructure/terraform/terraform.tfvars` includes at least `project_id`, `dns_name`, and `rag_cluster_name`.
+
+```bash
+./infrastructure/scripts/deploy-rag-prod.sh \
+  --issuer-email you@example.com \
+  --auto-approve
+```
+
+- The script performs all steps:
+  - Terraform backend bootstrap (if needed) and infra apply
+  - seed-secrets apply (with Terraform-derived overrides for PostgreSQL/Redis/S3 and STACKIT model-serving keys, plus auto-generated app secrets when placeholders are present)
+  - generation of `server-setup/rag-setup/values.prod.auto.yaml`
+  - deployment of `base-setup` and `rag-setup`
+
+- `STACKIT_CERT_MANAGER_SA_JSON` is not generated by Terraform in this flow. Provide it in `seed-secrets/terraform.tfvars`.
+
+- Manual fallback: generate the rag values override directly from Terraform outputs:
+
+```bash
+cd infrastructure/terraform
+./scripts/generate-rag-setup-prod-values.sh \
+  --output ../server-setup/rag-setup/values.prod.auto.yaml
+```
+
+- Manual fallback: deploy rag-setup with:
+
+```bash
+helm upgrade --install rag-setup infrastructure/server-setup/rag-setup \
+  -f infrastructure/server-setup/rag-setup/values.yaml \
+  -f infrastructure/server-setup/rag-setup/values.prod.auto.yaml
+```
 
 ## 3. Contributing