apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: stalwart-alert
  namespace: stalwart
spec:
  type: kv-v2
  mount: secret
  path: stalwart/alert-identity
  refreshAfter: 1h
  destination:
    name: stalwart-alert
    create: true
  vaultAuthRef: default
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: mail-web
  namespace: stalwart
spec:
  type: kv-v2
  mount: secret
  path: stalwart/oidc/zitadel
  refreshAfter: 1h
  destination:
    name: mail-web
    create: true
    transformation:
      excludeRaw: true
      excludes: [.*]
      templates:
        config.json:
          text: '{{ dict "issuer" (get .Secrets "issuer_url") "clientId" (get .Secrets "account_client_id") "scope" (printf "openid profile urn:zitadel:iam:org:project:id:%s:aud" (get .Secrets "audience")) | toJson }}'
  vaultAuthRef: default
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: stalwart-test-client
  namespace: stalwart
spec:
  type: kv-v2
  mount: secret
  path: stalwart/test-client
  refreshAfter: 1h
  destination:
    name: stalwart-test-client
    create: true
  vaultAuthRef: default
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: stalwart-oidc
  namespace: stalwart
spec:
  type: kv-v2
  mount: secret
  path: stalwart/oidc/zitadel
  refreshAfter: 1h
  destination:
    name: stalwart-oidc
    create: true
  vaultAuthRef: default