---
# SecretStore for GKE — uses GCP Secret Manager directly via Workload Identity.
# On GKE we use the GCP provider instead of a Vault-backed store, since
# Vault itself may be in the process of being migrated.
# The Gitea GCP SA has secretmanager.secretAccessor on its own secret (see cloud-sql.tf).
#
# Pre-requisite: install ESO on GKE before applying this:
#   helm install external-secrets external-secrets/external-secrets \
#     --namespace external-secrets --create-namespace
apiVersion: external-secrets.io/v1
kind: SecretStore
metadata:
  name: gcp-secretmanager
  namespace: gitea
spec:
  provider:
    gcpsm:
      projectID: neuron-785695
      # Workload Identity — ESO impersonates the gitea-gke GCP SA to access
      # Secret Manager. The gitea SA has secretAccessor on gitea-db-password.
      auth:
        workloadIdentity:
          clusterLocation: us-central1
          clusterName: neuron-platform
          serviceAccountRef:
            name: gitea
            namespace: gitea
---
# gitea-db — Gitea database password, pulled from GCP Secret Manager.
# The Secret Manager secret "gitea-database-url" stores the full DSN, but we
# extract just the password field for use in GITEA__database__PASSWD.
#
# The full DSN format from Terraform:
#   host=/cloudsql/<conn> user=gitea password=<pw> dbname=gitea sslmode=disable
#
# ESO extracts the raw secret value. Since GCP Secret Manager stores the full
# DSN as a single string, we store the password separately as "gitea-db-password"
# so Gitea can receive it as a discrete env var.
#
# Bootstrap: after `terraform apply`, run:
#   PASSWORD=$(gcloud secrets versions access latest --secret=gitea-database-url \
#     | grep -oP '(?<=password=)\S+')
#   echo -n "$PASSWORD" | gcloud secrets create gitea-db-password \
#     --data-file=- --project=neuron-785695
#
# Or simpler — let Terraform write it directly. The gitea-db-password secret
# is managed by the gitea-database-url secret version output. Use the full DSN
# secret and parse in-pod, or store password separately.
#
# For simplicity: pull the full DSN and use it as GITEA__database__PASSWD
# is wrong (it's a DSN, not a password). Instead, use the Cloud SQL proxy
# unix socket and no password — configure Gitea to use peer auth.
#
# ACTUAL APPROACH: ExternalSecret pulls the full DSN string into a k8s Secret
# key "dsn". A separate gitea-db secret provides just the password field.
# Terraform outputs both; add a gitea-db-password Secret Manager secret in cloud-sql.tf.
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: gitea-db
  namespace: gitea
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: gcp-secretmanager
    kind: SecretStore
  target:
    name: gitea-db
    creationPolicy: Owner
  data:
    - secretKey: password
      remoteRef:
        # This secret is populated by Terraform (gitea-db-password in cloud-sql.tf)
        # It contains just the raw database password (no DSN prefix).
        key: gitea-db-password