---
# CNPG app-user credentials (keys: username, password). Consumed by the Cluster
# bootstrap (initdb.secret) AND by Gitea (gitea.config.database.PASSWD via the
# chart's existingSecret wiring). One-time Vault seed — see the PR description.
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: postgres-credentials
  namespace: gitea
spec:
  destination:
    create: true
    name: postgres-credentials
    overwrite: true
  hmacSecretData: true
  mount: kv
  path: kubernetes/namespace/gitea/default/postgres-credentials
  refreshAfter: 5m
  type: kv-v2
  vaultAuthRef: default
---
# Initial Gitea admin (keys: username, password, email). Applied by the chart's
# init job on first boot (gitea.admin.existingSecret). Local fallback account
# that survives the Authentik OIDC cutover. One-time Vault seed.
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: gitea-admin
  namespace: gitea
spec:
  destination:
    create: true
    name: gitea-admin
    overwrite: true
  hmacSecretData: true
  mount: kv
  path: kubernetes/namespace/gitea/default/gitea-admin
  refreshAfter: 5m
  type: kv-v2
  vaultAuthRef: default
---
# Gitea internal secrets (keys: SECRET_KEY, INTERNAL_TOKEN). Pinned here rather
# than chart-generated so all replicas share identical values AND so the data
# cutover can replace them with the VM's app.ini values (SECRET_KEY encrypts
# 2FA/mirror/oauth secrets in the DB — it MUST match the restored database).
# One-time Vault seed.
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: gitea-inner
  namespace: gitea
spec:
  destination:
    create: true
    name: gitea-inner
    overwrite: true
  hmacSecretData: true
  mount: kv
  path: kubernetes/namespace/gitea/default/gitea-inner
  refreshAfter: 5m
  type: kv-v2
  vaultAuthRef: default
---
# Authentik OIDC client secret (key: client_secret). Read by the
# terraform-authentik provider runner (policy already grants
# kv/.../namespace/+/default/oauth-credentials) AND mounted into Gitea to
# register the OIDC login source. One-time Vault seed.
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: oauth-credentials
  namespace: gitea
spec:
  destination:
    create: true
    name: oauth-credentials
    overwrite: true
  hmacSecretData: true
  mount: kv
  path: kubernetes/namespace/gitea/default/oauth-credentials
  refreshAfter: 5m
  type: kv-v2
  vaultAuthRef: default