---
# restic repository password for the k8up fafflix-config backups. Seeded at
# kv/kubernetes/namespace/fafflix/default/k8up-restic (key: password); the
# default k8s role's templated policy already grants read here, so no
# terraform-vault change is needed. VSO syncs it into the fafflix-k8up-restic
# Secret that the Schedule references via backend.repoPasswordSecretRef.
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: fafflix-k8up-restic
  namespace: fafflix
  annotations:
    argocd.argoproj.io/sync-wave: "0"
spec:
  destination:
    create: true
    name: fafflix-k8up-restic
    overwrite: true
  hmacSecretData: true
  mount: kv
  path: kubernetes/namespace/fafflix/default/k8up-restic
  refreshAfter: 5m
  type: kv-v2
  vaultAuthRef: default
---
# Shared Authentik "jellyfin" OAuth2 client secret (key: client_secret) plus the
# LDAP outpost bind password (key: ldap_bind_password) for the auth plugins.
# The default k8s role's templated policy is namespace-scoped
# (kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/*), so each instance
# reads its own namespace path; the SAME shared values must be seeded at both
# fafflix and cheeztv paths. VSO syncs into the oauth-credentials Secret, whose
# keys the inject-plugin-config initContainer substitutes into the plugin XML.
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: oauth-credentials
  namespace: fafflix
spec:
  destination:
    create: true
    name: oauth-credentials
    overwrite: true
  hmacSecretData: true
  mount: kv
  path: kubernetes/namespace/fafflix/default/oauth-credentials
  refreshAfter: 5m
  type: kv-v2
  vaultAuthRef: default