diff --git a/live/terragrunt.hcl b/live/terragrunt.hcl
index 5441297..2a10116 100644
--- a/live/terragrunt.hcl
+++ b/live/terragrunt.hcl
@@ -1,3 +1,12 @@
+# Contour root — in-cluster backend + providers.
+#
+# This branch (`contour`) serves ALL closed contours. Backend state lives in the
+# contour MinIO; the concrete contour is selected by INFRA_ENV. Providers target
+# in-cluster services (no managed YC). Infra-service admin creds are read from
+# Vault by a workflow step and injected as env vars (see .gitea/workflows) —
+# providers pick them up via get_env, so there is no cross-provider data-source
+# ordering dependency on the vault-secrets stack.
+
 remote_state {
   backend = "s3"
   generate = {
@@ -5,102 +14,96 @@ remote_state {
     if_exists = "overwrite_terragrunt"
   }
   config = {
-    endpoint                    = "https://storage.yandexcloud.net"
-    bucket                      = get_env("S3_PROD_STATE_BUCKET", "tfstate-terragrunt-prod")
+    endpoint                    = get_env("TF_STATE_S3_ENDPOINT", "")
+    bucket                      = get_env("TF_STATE_S3_BUCKET", "")
     key                         = "${path_relative_to_include()}/terraform.tfstate"
-    region                      = "ru-central1"
+    region                      = get_env("TF_STATE_S3_REGION", "ru-central1")
     access_key                  = get_env("S3_ACCESS_KEY", get_env("AWS_ACCESS_KEY_ID", ""))
     secret_key                  = get_env("S3_SECRET_KEY", get_env("AWS_SECRET_ACCESS_KEY", ""))
     skip_region_validation      = true
     skip_credentials_validation = true
     skip_metadata_api_check     = true
-    force_path_style            = true
     skip_bucket_root_access     = true
-    # Object Storage бакет без versioning/SSE; свежий terragrunt иначе падает на проверке.
-    skip_bucket_versioning             = true
-    skip_bucket_ssencryption           = true
-    skip_bucket_enforced_tls           = true
-    skip_bucket_public_access_blocking = true
+    force_path_style            = true
   }
 }
 
-# Генерация общего провайдера для всех модулей
 generate "provider" {
   path      = "provider.tf"
   if_exists = "overwrite_terragrunt"
-  contents  = <<EOF
+  contents  = <<EOF_PROVIDER
 terraform {
-  required_version = ">= 1.0"
+  required_version = ">= 1.5.0"
 
   required_providers {
-    yandex = {
-      source  = "yandex-cloud/yandex"
-      version = ">= 0.161.0"
-    }
-    kubernetes = {
-      source  = "hashicorp/kubernetes"
-      version = "~> 2.23"
-    }
-    random = {
-      source  = "hashicorp/random"
-      version = "~> 3.1"
-    }
-    rabbitmq = {
-      source  = "cyrilgdn/rabbitmq"
-      version = "~> 1.8"
-    }
+    kubernetes = { source = "hashicorp/kubernetes", version = "~> 2.23" }
+    vault      = { source = "hashicorp/vault", version = "~> 4.2" }
+    kafka      = { source = "Mongey/kafka", version = "~> 0.7" }
+    postgresql = { source = "cyrilgdn/postgresql", version = "~> 1.21" }
+    rabbitmq   = { source = "cyrilgdn/rabbitmq", version = "~> 1.8" }
+    minio      = { source = "aminueza/minio", version = "~> 2.0" }
+    random     = { source = "hashicorp/random", version = "~> 3.1" }
+    tls        = { source = "hashicorp/tls", version = "~> 4.0" }
   }
 }
 
-provider "yandex" {
-  token                    = var.yc_token != "" ? var.yc_token : null
-  service_account_key_file = var.yc_service_account_key_file != "" ? var.yc_service_account_key_file : null
-  cloud_id                 = var.yc_cloud_id != "" ? var.yc_cloud_id : null
-  folder_id                = var.yc_folder_id != "" ? var.yc_folder_id : null
-  zone                     = "ru-central1-a"
+variable "kubeconfig_path" {
+  type    = string
+  default = ""
+}
+
+variable "kube_context" {
+  type    = string
+  default = ""
 }
 
 provider "kubernetes" {
-  # Если kubeconfig_path указан и файл существует - используем его
-  # Иначе провайдер автоматически использует in-cluster config (для runner'а в k8s)
   config_path    = var.kubeconfig_path != "" ? var.kubeconfig_path : null
   config_context = var.kube_context != "" ? var.kube_context : null
 }
 
-variable "yc_token" {
-  type        = string
-  default     = ""
-  description = "Yandex Cloud IAM token"
+# Vault: static VAULT_TOKEN if provided, else in-cluster k8s auth by the runner SA.
+provider "vault" {
+%{if get_env("VAULT_TOKEN", "") == ""~}
+  auth_login_kubernetes {
+    role       = "${get_env("VAULT_K8S_ROLE", "terraform")}"
+    mount_path = "auth/${get_env("VAULT_K8S_AUTH_BACKEND", "kubernetes")}"
+  }
+%{endif~}
 }
 
-variable "yc_service_account_key_file" {
-  type        = string
-  default     = ""
-  description = "Path to Yandex Cloud service account key file"
+# In-cluster PostgreSQL (admin). Password injected from Vault secrets/postgresql/admin.
+provider "postgresql" {
+  host      = "${get_env("PG_ADMIN_HOST", "postgresql.postgresql.svc.cluster.local")}"
+  port      = ${get_env("PG_ADMIN_PORT", "5432")}
+  username  = "${get_env("PG_ADMIN_USER", "postgres")}"
+  password  = "${get_env("PG_ADMIN_PASSWORD", "")}"
+  sslmode   = "disable"
+  superuser = false
 }
 
-variable "yc_cloud_id" {
-  type        = string
-  default     = ""
-  description = "Yandex Cloud ID"
+# In-cluster Kafka (Bitnami). Admin = inter_broker super-user from Vault secrets/kafka/bootstrap.
+provider "kafka" {
+  bootstrap_servers = ["${get_env("KAFKA_BOOTSTRAP", "kafka-kafka-contour.kafka.svc.cluster.local:9092")}"]
+  tls_enabled       = false
+  sasl_mechanism    = "${get_env("KAFKA_SASL_MECHANISM", "plain")}"
+  sasl_username     = "${get_env("KAFKA_ADMIN_USER", "inter_broker_user")}"
+  sasl_password     = "${get_env("KAFKA_ADMIN_PASSWORD", "")}"
 }
 
-variable "yc_folder_id" {
-  type        = string
-  default     = ""
-  description = "Yandex Cloud folder ID"
+# In-cluster RabbitMQ management API. Admin from Vault secrets/rabbitmq/auth.
+provider "rabbitmq" {
+  endpoint = "${get_env("RABBITMQ_ENDPOINT", "http://rabbitmq.rabbitmq.svc.cluster.local:15672")}"
+  username = "${get_env("RABBITMQ_ADMIN_USER", "admin")}"
+  password = "${get_env("RABBITMQ_ADMIN_PASSWORD", "")}"
 }
 
-variable "kubeconfig_path" {
-  type        = string
-  default     = ""
-  description = "Path to kubeconfig file"
+# In-cluster MinIO S3 API. Admin from Vault secrets/minio/admin.
+provider "minio" {
+  minio_server   = "${get_env("MINIO_ENDPOINT", "minio.minio.svc.cluster.local:9000")}"
+  minio_user     = "${get_env("MINIO_ADMIN_USER", "")}"
+  minio_password = "${get_env("MINIO_ADMIN_PASSWORD", "")}"
+  minio_ssl      = false
 }
-
-variable "kube_context" {
-  type        = string
-  default     = ""
-  description = "Kubernetes context"
-}
-EOF
+EOF_PROVIDER
 }