# media-secrets — ProtonVPN WireGuard key + Plex claim token
# PLEX_CLAIM: run `vault kv patch secret/plex claim_token=<token>` right before first deploy
#   Get token from: https://www.plex.tv/claim (expires in 4 minutes)
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: media-secrets
  namespace: media
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vault
    kind: ClusterSecretStore
  target:
    name: media-secrets
    creationPolicy: Owner
  data:
    - secretKey: PROTONVPN_PRIVATE_KEY
      remoteRef:
        key: secret/data/protonvpn
        property: private_key
    - secretKey: PLEX_CLAIM
      remoteRef:
        key: secret/data/plex
        property: claim_token