---
# listmonk-secrets — DB credentials and admin password from Vault
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: listmonk-secrets
  namespace: listmonk
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vault
    kind: ClusterSecretStore
  target:
    name: listmonk-secrets
    creationPolicy: Owner
  data:
    - secretKey: db_password
      remoteRef:
        key: secret/data/listmonk
        property: db_password
    - secretKey: db_user
      remoteRef:
        key: secret/data/listmonk
        property: db_user
    - secretKey: db_name
      remoteRef:
        key: secret/data/listmonk
        property: db_name
    - secretKey: admin_password
      remoteRef:
        key: secret/data/listmonk
        property: admin_password
    - secretKey: app_key
      remoteRef:
        key: secret/data/listmonk
        property: app_key
---
# postgres superuser password — needed for DB init job
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: postgres-superuser
  namespace: listmonk
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vault
    kind: ClusterSecretStore
  target:
    name: postgres-superuser
    creationPolicy: Owner
  data:
    - secretKey: password
      remoteRef:
        key: secret/data/legion-db
        property: postgres_password