# Populate Vault before first deploy:
#
#   vault kv put secret/neuron-technologies/marketing \
#     stripe_secret_key="sk_live_..." \
#     stripe_webhook_secret="whsec_..." \
#     stripe_price_professional="price_..." \
#     stripe_price_founding="price_..." \
#     next_public_stripe_publishable_key="pk_live_..."
#
# Notification keys (Resend + Twilio) sourced from notifications path:
#   vault kv put secret/neuron-technologies/notifications \
#     resend_api_key="re_..." \
#     twilio_account_sid="AC..." \
#     twilio_auth_token="..." \
#     twilio_from_number="+1..."
#
# Turnstile (Cloudflare):
#   vault kv patch secret/neuron-technologies/marketing \
#     turnstile_secret_key="..." \
#     next_public_turnstile_site_key="..."

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: neuron-marketing-secrets
  namespace: neuron-prod
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vault
    kind: ClusterSecretStore
  target:
    name: neuron-marketing-secrets
    creationPolicy: Owner
  data:
    - secretKey: STRIPE_SECRET_KEY
      remoteRef:
        key: secret/data/neuron-technologies/marketing
        property: stripe_secret_key
    - secretKey: STRIPE_WEBHOOK_SECRET
      remoteRef:
        key: secret/data/neuron-technologies/marketing
        property: stripe_webhook_secret
    - secretKey: STRIPE_PRICE_PROFESSIONAL
      remoteRef:
        key: secret/data/neuron-technologies/marketing
        property: stripe_price_professional
    - secretKey: STRIPE_PRICE_FOUNDING
      remoteRef:
        key: secret/data/neuron-technologies/marketing
        property: stripe_price_founding
    - secretKey: NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY
      remoteRef:
        key: secret/data/neuron-technologies/marketing
        property: next_public_stripe_publishable_key
    - secretKey: STRIPE_PRICE_TEAM
      remoteRef:
        key: secret/data/neuron-technologies/marketing
        property: stripe_price_team
    - secretKey: STRIPE_PRICE_ENTERPRISE
      remoteRef:
        key: secret/data/neuron-technologies/marketing
        property: stripe_price_enterprise
    - secretKey: NEURON_LICENSE_ADMIN_TOKEN
      remoteRef:
        key: secret/data/neuron-technologies/marketing
        property: license_admin_token
    # Notification — Resend (email blasts + confirmations)
    - secretKey: RESEND_API_KEY
      remoteRef:
        key: secret/data/neuron-technologies/notifications
        property: resend_api_key
    # Notification — Twilio (SMS blasts + confirmations)
    - secretKey: TWILIO_ACCOUNT_SID
      remoteRef:
        key: secret/data/neuron-technologies/notifications
        property: twilio_account_sid
    - secretKey: TWILIO_AUTH_TOKEN
      remoteRef:
        key: secret/data/neuron-technologies/notifications
        property: twilio_auth_token
    - secretKey: TWILIO_FROM_NUMBER
      remoteRef:
        key: secret/data/neuron-technologies/notifications
        property: twilio_from_number
    # Cloudflare Turnstile (waitlist captcha)
    - secretKey: TURNSTILE_SECRET_KEY
      remoteRef:
        key: secret/data/neuron-technologies/marketing
        property: turnstile_secret_key
    - secretKey: NEXT_PUBLIC_TURNSTILE_SITE_KEY
      remoteRef:
        key: secret/data/neuron-technologies/marketing
        property: next_public_turnstile_site_key