apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: mtproxy-config
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vaultwarden-fields
    kind: ClusterSecretStore
  target:
    name: mtproxy-config
    creationPolicy: Owner
    deletionPolicy: Retain
    template:
      type: Opaque
      data:
        SECRET: "{{ .secret }}"
        classic.toml: |
          [general]
          use_middle_proxy = true
          log_level = "normal"

          [general.modes]
          classic = true
          secure = false
          tls = false

          [server]
          port = 30443
          metrics_port = 9090
          metrics_whitelist = ["0.0.0.0/0"]

          [server.api]
          enabled = false

          [[server.listeners]]
          ip = "0.0.0.0"

          [access.users]
          user = "{{ .secret }}"
        tls.toml: |
          [general]
          use_middle_proxy = true
          log_level = "normal"

          [general.modes]
          classic = false
          secure = false
          tls = true

          [server]
          port = 30444
          metrics_port = 9090
          metrics_whitelist = ["0.0.0.0/0"]

          [server.api]
          enabled = false

          [[server.listeners]]
          ip = "0.0.0.0"

          [censorship]
          tls_domain = "ya.ru"
          mask = true
          tls_emulation = true
          tls_front_dir = "tlsfront"

          [access.users]
          user = "{{ .secret }}"
  data:
    - secretKey: secret
      remoteRef:
        key: k8s/mtproxy/secret
        property: Secret