---
# gitea-runner-secret — neural-platform org runner token
#
# GITEA_INSTANCE_URL stays as the in-cluster URL — the act_runner daemon
# polls it constantly and we don't want every poll to hit Cloudflare Access.
# Build containers, however, need the public URL because they run with
# network: host and can't resolve gitea.git.svc.cluster.local. The
# git-cf-access-init.sh entrypoint in the ci-base image rewrites the
# in-cluster URL to https://git.neuralplatform.ai with the CF Access
# headers from CF_ACCESS_CLIENT_ID / CF_ACCESS_CLIENT_SECRET below.
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: gitea-runner-secret
  namespace: ci
  annotations:
    force-sync: "2026-05-04-cf-access"
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vault
    kind: ClusterSecretStore
  target:
    name: gitea-runner-secret
    creationPolicy: Owner
    template:
      data:
        GITEA_INSTANCE_URL: "http://gitea.git.svc.cluster.local:3000"
        GITEA_RUNNER_REGISTRATION_TOKEN: "{{ .runner_token }}"
        CF_ACCESS_CLIENT_ID: "{{ .cf_access_client_id }}"
        CF_ACCESS_CLIENT_SECRET: "{{ .cf_access_client_secret }}"
  data:
    - secretKey: runner_token
      remoteRef:
        key: secret/data/gitea
        property: runner_token
    - secretKey: cf_access_client_id
      remoteRef:
        key: secret/data/gitea-runner-cf-access
        property: client_id
    - secretKey: cf_access_client_secret
      remoteRef:
        key: secret/data/gitea-runner-cf-access
        property: client_secret
---
# neuron-technologies-runner-secret — neuron-technologies org runner token
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: neuron-technologies-runner-secret
  namespace: ci
  annotations:
    force-sync: "2026-05-04-cf-access"
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vault
    kind: ClusterSecretStore
  target:
    name: neuron-technologies-runner-secret
    creationPolicy: Owner
    template:
      data:
        GITEA_INSTANCE_URL: "http://gitea.git.svc.cluster.local:3000"
        GITEA_RUNNER_REGISTRATION_TOKEN: "{{ .runner_token }}"
        CF_ACCESS_CLIENT_ID: "{{ .cf_access_client_id }}"
        CF_ACCESS_CLIENT_SECRET: "{{ .cf_access_client_secret }}"
  data:
    - secretKey: runner_token
      remoteRef:
        key: secret/data/gitea
        property: neuron_technologies_runner_token
    - secretKey: cf_access_client_id
      remoteRef:
        key: secret/data/gitea-runner-cf-access
        property: client_id
    - secretKey: cf_access_client_secret
      remoteRef:
        key: secret/data/gitea-runner-cf-access
        property: client_secret