apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: dmz-infisical
  namespace: zammad
  annotations:
    argocd.argoproj.io/sync-wave: "1"
spec:
  provider:
    infisical:
      hostAPI: http://infisical-infisical-standalone-infisical.platform-infisical.svc.cluster.local:8080
      auth:
        universalAuthCredentials:
          clientId:
            name: infisical-universal-auth
            key: clientId
          clientSecret:
            name: infisical-universal-auth
            key: clientSecret
      secretsScope:
        projectSlug: platform-kubernetes-pqmd
        environmentSlug: prod
        secretsPath: /tenants/pidoka/zammad
---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: zammad-postgresql
  namespace: zammad
  annotations:
    argocd.argoproj.io/sync-wave: "2"
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: dmz-infisical
    kind: SecretStore
  target:
    name: zammad-postgresql
    creationPolicy: Merge
    deletionPolicy: Retain
  data:
    - secretKey: password
      remoteRef:
        key: POSTGRESQL_PASSWORD
        conversionStrategy: Default
        decodingStrategy: None
        metadataPolicy: None
    - secretKey: postgres-password
      remoteRef:
        key: POSTGRESQL_POSTGRES_PASSWORD
        conversionStrategy: Default
        decodingStrategy: None
        metadataPolicy: None
---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: zammad-postgresql-pass
  namespace: zammad
  annotations:
    argocd.argoproj.io/sync-wave: "2"
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: dmz-infisical
    kind: SecretStore
  target:
    name: zammad-postgresql-pass
    creationPolicy: Merge
    deletionPolicy: Retain
  data:
    - secretKey: postgresql-pass
      remoteRef:
        key: ZAMMAD_POSTGRESQL_PASS
        conversionStrategy: Default
        decodingStrategy: None
        metadataPolicy: None
---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: zammad-redis
  namespace: zammad
  annotations:
    argocd.argoproj.io/sync-wave: "2"
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: dmz-infisical
    kind: SecretStore
  target:
    name: zammad-redis
    creationPolicy: Merge
    deletionPolicy: Retain
  data:
    - secretKey: redis-password
      remoteRef:
        key: REDIS_PASSWORD
        conversionStrategy: Default
        decodingStrategy: None
        metadataPolicy: None
---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: zammad-redis-pass
  namespace: zammad
  annotations:
    argocd.argoproj.io/sync-wave: "2"
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: dmz-infisical
    kind: SecretStore
  target:
    name: zammad-redis-pass
    creationPolicy: Merge
    deletionPolicy: Retain
  data:
    - secretKey: redis-password
      remoteRef:
        key: ZAMMAD_REDIS_PASS
        conversionStrategy: Default
        decodingStrategy: None
        metadataPolicy: None
