# Read-only access to the vaultwarden-db Secret in the psql namespace
# (see postgresql/databases/vaultwarden.yaml for the other half).
apiVersion: v1
kind: ServiceAccount
metadata:
  name: db-credentials-reader
---
apiVersion: external-secrets.io/v1
kind: SecretStore
metadata:
  name: psql-credentials
spec:
  provider:
    kubernetes:
      remoteNamespace: psql
      server:
        caProvider:
          type: ConfigMap
          name: kube-root-ca.crt
          key: ca.crt
      auth:
        serviceAccount:
          name: db-credentials-reader
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: vaultwarden-db-url
spec:
  refreshInterval: 1h
  secretStoreRef:
    kind: SecretStore
    name: psql-credentials
  target:
    name: vaultwarden-db-url
    template:
      data:
        DATABASE_URL: "postgresql://{{ .username }}:{{ .password }}@main-rw.psql.svc:5432/vaultwarden"
  data:
    - secretKey: username
      remoteRef:
        key: vaultwarden-db
        property: username
    - secretKey: password
      remoteRef:
        key: vaultwarden-db
        property: password
---
# Admin panel token (/admin). Generated once; read it with:
#   kubectl -n vaultwarden get secret admin-token -o jsonpath='{.data.ADMIN_TOKEN}' | base64 -d
apiVersion: generators.external-secrets.io/v1alpha1
kind: Password
metadata:
  name: admin-token
spec:
  length: 48
  digits: 10
  symbols: 0
  noUpper: false
  allowRepeat: true
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: admin-token
spec:
  refreshPolicy: CreatedOnce
  target:
    name: admin-token
    template:
      data:
        ADMIN_TOKEN: "{{ .password }}"
  dataFrom:
    - sourceRef:
        generatorRef:
          apiVersion: generators.external-secrets.io/v1alpha1
          kind: Password
          name: admin-token