---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultAuth
metadata:
  name: default
  namespace: forgejo
spec:
  method: kubernetes
  mount: kubernetes
  kubernetes:
    role: forgejo
    serviceAccount: forgejo
  vaultConnectionRef: vault/vault
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: forgejo-oidc-zitadel
  namespace: forgejo
spec:
  type: kv-v2
  mount: secret
  path: forgejo/oidc/zitadel
  destination:
    name: forgejo-oidc-zitadel
    create: true
  vaultAuthRef: default
---
# Vault database static role - password rotates every 7 days.
# rolloutRestartTargets triggers a rolling restart so Forgejo picks up the new credentials.
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultDynamicSecret
metadata:
  name: forgejo-db
  namespace: forgejo
spec:
  mount: database
  path: static-creds/forgejo
  destination:
    name: forgejo-db
    create: true
  rolloutRestartTargets:
    - kind: Deployment
      name: forgejo
  vaultAuthRef: default
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: forgejo-secrets
  namespace: forgejo
spec:
  type: kv-v2
  mount: secret
  path: forgejo/secrets
  destination:
    name: forgejo-secrets
    create: true
    overwrite: true
    transformation:
      excludeRaw: true
      excludes:
        - .*
      templates:
        cache:
          text: |
            ADAPTER=redis
            HOST=redis://default:{{ get .Secrets "redis_password" }}@forgejo.dragonfly.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s
        session:
          text: |
            PROVIDER=redis
            PROVIDER_CONFIG=redis://default:{{ get .Secrets "redis_password" }}@forgejo.dragonfly.svc.cluster.local:6379/1?pool_size=100&idle_timeout=180s
        queue:
          text: |
            TYPE=redis
            CONN_STR=redis://default:{{ get .Secrets "redis_password" }}@forgejo.dragonfly.svc.cluster.local:6379/2?pool_size=100&idle_timeout=180s
        attachment:
          text: |
            STORAGE_TYPE=minio
            MINIO_ENDPOINT=s3.quorate.internal
            MINIO_ACCESS_KEY_ID=forgejo
            MINIO_SECRET_ACCESS_KEY={{ get .Secrets "s3_secret_key" }}
            MINIO_BUCKET=forgejo
            MINIO_BUCKET_LOOKUP=path
            MINIO_LOCATION=us-east-1
            MINIO_USE_SSL=true
            MINIO_INSECURE_SKIP_VERIFY=false
            MINIO_BASE_PATH=attachments/
        avatar:
          text: |
            STORAGE_TYPE=minio
            MINIO_ENDPOINT=s3.quorate.internal
            MINIO_ACCESS_KEY_ID=forgejo
            MINIO_SECRET_ACCESS_KEY={{ get .Secrets "s3_secret_key" }}
            MINIO_BUCKET=forgejo
            MINIO_BUCKET_LOOKUP=path
            MINIO_LOCATION=us-east-1
            MINIO_USE_SSL=true
            MINIO_INSECURE_SKIP_VERIFY=false
            MINIO_BASE_PATH=avatars/
        repo-avatar:
          text: |
            STORAGE_TYPE=minio
            MINIO_ENDPOINT=s3.quorate.internal
            MINIO_ACCESS_KEY_ID=forgejo
            MINIO_SECRET_ACCESS_KEY={{ get .Secrets "s3_secret_key" }}
            MINIO_BUCKET=forgejo
            MINIO_BUCKET_LOOKUP=path
            MINIO_LOCATION=us-east-1
            MINIO_USE_SSL=true
            MINIO_INSECURE_SKIP_VERIFY=false
            MINIO_BASE_PATH=repo-avatars/
  rolloutRestartTargets:
    - kind: Deployment
      name: forgejo
  vaultAuthRef: default