homelab/k8s/apps/firefly-iii/external-secrets.yaml

apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: firefly-secrets
spec:
  refreshInterval: 1h
  target:
    name: firefly-secrets
    creationPolicy: Owner
    deletionPolicy: Delete
    template:
      type: Opaque
      data:
        # Firefly and CloudNativePG deliberately share this generated Secret.
        username: firefly
        password: |-
          {{ .db_password }}
        DB_PASSWORD: |-
          {{ .db_password }}
        APP_KEY: |-
          {{ .app_key }}
        STATIC_CRON_TOKEN: |-
          {{ .cron_token }}
  data:
    - secretKey: db_password
      sourceRef:
        storeRef:
          name: vaultwarden-login
          kind: ClusterSecretStore
      remoteRef:
        key: a1867c81-715c-47cd-978d-14ea5bcedea9
        property: fields[0].value
    - secretKey: app_key
      sourceRef:
        storeRef:
          name: vaultwarden-login
          kind: ClusterSecretStore
      remoteRef:
        key: a1867c81-715c-47cd-978d-14ea5bcedea9
        property: fields[1].value
    - secretKey: cron_token
      sourceRef:
        storeRef:
          name: vaultwarden-login
          kind: ClusterSecretStore
      remoteRef:
        key: a1867c81-715c-47cd-978d-14ea5bcedea9
        property: fields[2].value
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: firefly-data-importer-secrets
spec:
  refreshInterval: 1h
  target:
    name: firefly-data-importer-secrets
    creationPolicy: Owner
    deletionPolicy: Delete
    template:
      type: Opaque
      data:
        ENABLE_BANKING_APP_ID: |-
          {{ .app_id }}
        ENABLE_BANKING_PRIVATE_KEY: |-
          -----BEGIN PRIVATE KEY-----
          {{ .private_key | replace "-----BEGIN PRIVATE KEY-----" "" | replace "-----END PRIVATE KEY-----" "" | replace " " "" | trim }}
          -----END PRIVATE KEY-----
  data:
    - secretKey: app_id
      sourceRef:
        storeRef:
          name: vaultwarden-login
          kind: ClusterSecretStore
      remoteRef:
        key: a1867c81-715c-47cd-978d-14ea5bcedea9
        property: fields[3].value
    - secretKey: private_key
      sourceRef:
        storeRef:
          name: vaultwarden-login
          kind: ClusterSecretStore
      remoteRef:
        key: a1867c81-715c-47cd-978d-14ea5bcedea9
        property: fields[4].value