apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: dmz-infisical
  namespace: pidoka-hf-matomo
  annotations:
    argocd.argoproj.io/sync-wave: "1"
spec:
  provider:
    infisical:
      hostAPI: http://infisical-infisical-standalone-infisical.platform-infisical.svc.cluster.local:8080
      auth:
        universalAuthCredentials:
          clientId:
            name: infisical-universal-auth
            key: clientId
          clientSecret:
            name: infisical-universal-auth
            key: clientSecret
      secretsScope:
        projectSlug: platform-kubernetes-pqmd
        environmentSlug: prod
        secretsPath: /tenants/pidoka/matomo
---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: matomo-secret
  namespace: pidoka-hf-matomo
  annotations:
    argocd.argoproj.io/sync-wave: "2"
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: dmz-infisical
    kind: SecretStore
  target:
    name: matomo-secret
    creationPolicy: Owner
    deletionPolicy: Retain
  data:
    - secretKey: MATOMO_DATABASE_HOST
      remoteRef:
        key: MATOMO_DATABASE_HOST
        conversionStrategy: Default
        decodingStrategy: None
        metadataPolicy: None
    - secretKey: MATOMO_DATABASE_DBNAME
      remoteRef:
        key: MATOMO_DATABASE_DBNAME
        conversionStrategy: Default
        decodingStrategy: None
        metadataPolicy: None
    - secretKey: MATOMO_DATABASE_USERNAME
      remoteRef:
        key: MATOMO_DATABASE_USERNAME
        conversionStrategy: Default
        decodingStrategy: None
        metadataPolicy: None
    - secretKey: MATOMO_DATABASE_PASSWORD
      remoteRef:
        key: MATOMO_DATABASE_PASSWORD
        conversionStrategy: Default
        decodingStrategy: None
        metadataPolicy: None
    - secretKey: MYSQL_ROOT_PASSWORD
      remoteRef:
        key: MYSQL_ROOT_PASSWORD
        conversionStrategy: Default
        decodingStrategy: None
        metadataPolicy: None
    - secretKey: MYSQL_DATABASE
      remoteRef:
        key: MYSQL_DATABASE
        conversionStrategy: Default
        decodingStrategy: None
        metadataPolicy: None
    - secretKey: MYSQL_USER
      remoteRef:
        key: MYSQL_USER
        conversionStrategy: Default
        decodingStrategy: None
        metadataPolicy: None
    - secretKey: MYSQL_PASSWORD
      remoteRef:
        key: MYSQL_PASSWORD
        conversionStrategy: Default
        decodingStrategy: None
        metadataPolicy: None
