apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: vault-snapshot-agent-token
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: vault-snapshot-agent-token
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  data:
    - secretKey: VAULT_APPROLE_ROLE_ID
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/vault/snapshot
        metadataPolicy: None
        property: VAULT_APPROLE_ROLE_ID
    - secretKey: VAULT_APPROLE_SECRET_ID
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/vault/snapshot
        metadataPolicy: None
        property: VAULT_APPROLE_SECRET_ID

---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: vault-s3cmd-local-config
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: vault-s3cmd-local-config
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  data:
    - secretKey: .s3cfg
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/vault-backups
        metadataPolicy: None
        property: s3cfg-local
    - secretKey: BUCKET
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/vault-backups
        metadataPolicy: None
        property: BUCKET

---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: vault-s3cmd-remote-config
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: vault-s3cmd-remote-config
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  data:
    - secretKey: .s3cfg
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/vault-backups
        metadataPolicy: None
        property: s3cfg-remote
    - secretKey: BUCKET
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/vault-backups
        metadataPolicy: None
        property: BUCKET

---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: vault-s3cmd-external-config
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: vault-s3cmd-external-config
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  data:
    - secretKey: .s3cfg
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/vault-backup
        metadataPolicy: None
        property: s3cfg
    - secretKey: BUCKET
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/vault-backup
        metadataPolicy: None
        property: BUCKET

---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: vault-backup-ntfy-secret
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: vault-backup-ntfy-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  data:
    - secretKey: NTFY_TOKEN
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /ntfy/user/cl01tl
        metadataPolicy: None
        property: token
    - secretKey: NTFY_ENDPOINT
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /ntfy/user/cl01tl
        metadataPolicy: None
        property: endpoint
    - secretKey: NTFY_TOPIC
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/vault/snapshot
        metadataPolicy: None
        property: NTFY_TOPIC

---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: vault-unseal-config-1
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: vault-unseal-config-1
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  data:
    - secretKey: ENVIRONMENT
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-1
        metadataPolicy: None
        property: ENVIRONMENT
    - secretKey: CHECK_INTERVAL
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-1
        metadataPolicy: None
        property: CHECK_INTERVAL
    - secretKey: MAX_CHECK_INTERVAL
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-1
        metadataPolicy: None
        property: MAX_CHECK_INTERVAL
    - secretKey: NODES
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-1
        metadataPolicy: None
        property: NODES
    - secretKey: TLS_SKIP_VERIFY
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-1
        metadataPolicy: None
        property: TLS_SKIP_VERIFY
    - secretKey: TOKENS
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-1
        metadataPolicy: None
        property: TOKENS
    - secretKey: EMAIL_ENABLED
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-1
        metadataPolicy: None
        property: EMAIL_ENABLED
    - secretKey: NOTIFY_MAX_ELAPSED
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-1
        metadataPolicy: None
        property: NOTIFY_MAX_ELAPSED
    - secretKey: NOTIFY_QUEUE_DELAY
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-1
        metadataPolicy: None
        property: NOTIFY_QUEUE_DELAY

---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: vault-unseal-config-2
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: vault-unseal-config-2
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  data:
    - secretKey: ENVIRONMENT
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-2
        metadataPolicy: None
        property: ENVIRONMENT
    - secretKey: CHECK_INTERVAL
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-2
        metadataPolicy: None
        property: CHECK_INTERVAL
    - secretKey: MAX_CHECK_INTERVAL
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-2
        metadataPolicy: None
        property: MAX_CHECK_INTERVAL
    - secretKey: NODES
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-2
        metadataPolicy: None
        property: NODES
    - secretKey: TLS_SKIP_VERIFY
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-2
        metadataPolicy: None
        property: TLS_SKIP_VERIFY
    - secretKey: TOKENS
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-2
        metadataPolicy: None
        property: TOKENS
    - secretKey: EMAIL_ENABLED
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-2
        metadataPolicy: None
        property: EMAIL_ENABLED
    - secretKey: NOTIFY_MAX_ELAPSED
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-2
        metadataPolicy: None
        property: NOTIFY_MAX_ELAPSED
    - secretKey: NOTIFY_QUEUE_DELAY
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-2
        metadataPolicy: None
        property: NOTIFY_QUEUE_DELAY

---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: vault-unseal-config-3
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: vault-unseal-config-3
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  data:
    - secretKey: ENVIRONMENT
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-3
        metadataPolicy: None
        property: ENVIRONMENT
    - secretKey: CHECK_INTERVAL
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-3
        metadataPolicy: None
        property: CHECK_INTERVAL
    - secretKey: MAX_CHECK_INTERVAL
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-3
        metadataPolicy: None
        property: MAX_CHECK_INTERVAL
    - secretKey: NODES
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-3
        metadataPolicy: None
        property: NODES
    - secretKey: TLS_SKIP_VERIFY
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-3
        metadataPolicy: None
        property: TLS_SKIP_VERIFY
    - secretKey: TOKENS
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-3
        metadataPolicy: None
        property: TOKENS
    - secretKey: EMAIL_ENABLED
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-3
        metadataPolicy: None
        property: EMAIL_ENABLED
    - secretKey: NOTIFY_MAX_ELAPSED
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-3
        metadataPolicy: None
        property: NOTIFY_MAX_ELAPSED
    - secretKey: NOTIFY_QUEUE_DELAY
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-3
        metadataPolicy: None
        property: NOTIFY_QUEUE_DELAY

---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: vault-token
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: vault-token
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  data:
    - secretKey: token
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/vault/token
        metadataPolicy: None
        property: token
    - secretKey: unseal_key_1
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/vault/token
        metadataPolicy: None
        property: unseal_key_1
    - secretKey: unseal_key_2
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/vault/token
        metadataPolicy: None
        property: unseal_key_2
    - secretKey: unseal_key_3
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/vault/token
        metadataPolicy: None
        property: unseal_key_3
    - secretKey: unseal_key_4
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/vault/token
        metadataPolicy: None
        property: unseal_key_4
    - secretKey: unseal_key_5
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/vault/token
        metadataPolicy: None
        property: unseal_key_5