# ExternalSecret for Tim's Neuron instance.
#
# Before Tim's instance can start, populate these Vault paths:
#   vault kv put secret/neuron-technologies/tim \
#     api_key=<Tim's NEURON_API_KEY> \
#     gitea_webhook_secret=<Tim's webhook secret>
#
# Required Vault secrets:
#   secret/data/neuron-technologies/tim:
#     - api_key              → NEURON_API_KEY
#     - gitea_webhook_secret → NEURON_WEBHOOK_SECRET
#
#   secret/data/neuron-technologies/license:
#     - admin_token          → NEURON_LICENSE_ADMIN_TOKEN  (shared with prod)
#
#   secret/data/neuron-technologies/unkey:
#     - root_key             → UNKEY_ROOT_KEY              (shared with prod)
#     - api_id               → UNKEY_API_ID                (shared with prod)
#
# Tim's instance-specific secrets that should be scoped under secret/neuron-technologies/tim:
#   - anthropic_api_key      (Tim's own Anthropic API key)
#   - neuron_license_key     (Tim's license key issued by the license server)
#   - db_encryption_key      (encryption key for Tim's SQLite DB)
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: neuron-tim-secrets
  namespace: neuron-tim
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vault
    kind: ClusterSecretStore
  target:
    name: neuron-tim-secrets
    creationPolicy: Owner
  data:
    - secretKey: NEURON_API_KEY
      remoteRef:
        key: secret/data/neuron-technologies/tim
        property: api_key
    - secretKey: NEURON_WEBHOOK_SECRET
      remoteRef:
        key: secret/data/neuron-technologies/tim
        property: gitea_webhook_secret
    - secretKey: NEURON_LICENSE_ADMIN_TOKEN
      remoteRef:
        key: secret/data/neuron-technologies/license
        property: admin_token
    - secretKey: UNKEY_ROOT_KEY
      remoteRef:
        key: secret/data/neuron-technologies/unkey
        property: root_key
    - secretKey: UNKEY_API_ID
      remoteRef:
        key: secret/data/neuron-technologies/unkey
        property: api_id