apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultAuth
metadata:
  name: default
  namespace: forgejo-public
spec:
  method: kubernetes
  mount: kubernetes
  kubernetes:
    role: forgejo-public
    serviceAccount: forgejo-public
  vaultConnectionRef: vault/vault
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: forge-git-oidc-zitadel
  namespace: forgejo-public
spec:
  type: kv-v2
  mount: secret
  path: forgejo-public/oidc/zitadel
  destination:
    name: forge-git-oidc-zitadel
    create: true
  rolloutRestartTargets:
    - kind: Deployment
      name: forge-git
  vaultAuthRef: default
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultDynamicSecret
metadata:
  name: forgejo-public-db
  namespace: forgejo-public
spec:
  mount: database
  path: static-creds/forgejo-public
  destination:
    name: forgejo-public-db
    create: true
  rolloutRestartTargets:
    - kind: Deployment
      name: forge-code
    - kind: Deployment
      name: forge-git
  vaultAuthRef: default
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: forgejo-public-secrets
  namespace: forgejo-public
spec:
  type: kv-v2
  mount: secret
  path: forgejo-public/secrets
  destination:
    name: forgejo-public-secrets
    create: true
    overwrite: true
    transformation:
      excludeRaw: true
      excludes:
        - .*
      templates:
        cache:
          text: |
            ADAPTER=redis
            HOST=redis://default:{{ get .Secrets "redis_password" }}@forgejo-public.dragonfly.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s
        queue:
          text: |
            TYPE=redis
            CONN_STR=redis://default:{{ get .Secrets "redis_password" }}@forgejo-public.dragonfly.svc.cluster.local:6379/2?pool_size=100&idle_timeout=180s
        attachment:
          text: |
            STORAGE_TYPE=minio
            MINIO_ENDPOINT=s3.quorate.internal
            MINIO_ACCESS_KEY_ID=forgejo-public
            MINIO_SECRET_ACCESS_KEY={{ get .Secrets "s3_secret_key" }}
            MINIO_BUCKET=forgejo-public
            MINIO_BUCKET_LOOKUP=path
            MINIO_LOCATION=us-east-1
            MINIO_USE_SSL=true
            MINIO_INSECURE_SKIP_VERIFY=false
            MINIO_BASE_PATH=attachments/
        avatar:
          text: |
            STORAGE_TYPE=minio
            MINIO_ENDPOINT=s3.quorate.internal
            MINIO_ACCESS_KEY_ID=forgejo-public
            MINIO_SECRET_ACCESS_KEY={{ get .Secrets "s3_secret_key" }}
            MINIO_BUCKET=forgejo-public
            MINIO_BUCKET_LOOKUP=path
            MINIO_LOCATION=us-east-1
            MINIO_USE_SSL=true
            MINIO_INSECURE_SKIP_VERIFY=false
            MINIO_BASE_PATH=avatars/
        repo-avatar:
          text: |
            STORAGE_TYPE=minio
            MINIO_ENDPOINT=s3.quorate.internal
            MINIO_ACCESS_KEY_ID=forgejo-public
            MINIO_SECRET_ACCESS_KEY={{ get .Secrets "s3_secret_key" }}
            MINIO_BUCKET=forgejo-public
            MINIO_BUCKET_LOOKUP=path
            MINIO_LOCATION=us-east-1
            MINIO_USE_SSL=true
            MINIO_INSECURE_SKIP_VERIFY=false
            MINIO_BASE_PATH=repo-avatars/
        repo-archive:
          text: |
            STORAGE_TYPE=minio
            MINIO_ENDPOINT=s3.quorate.internal
            MINIO_ACCESS_KEY_ID=forgejo-public
            MINIO_SECRET_ACCESS_KEY={{ get .Secrets "s3_secret_key" }}
            MINIO_BUCKET=forgejo-public
            MINIO_BUCKET_LOOKUP=path
            MINIO_LOCATION=us-east-1
            MINIO_USE_SSL=true
            MINIO_INSECURE_SKIP_VERIFY=false
            MINIO_BASE_PATH=repo-archives/
  rolloutRestartTargets:
    - kind: Deployment
      name: forge-code
    - kind: Deployment
      name: forge-git
  vaultAuthRef: default
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: forge-code-session
  namespace: forgejo-public
spec:
  type: kv-v2
  mount: secret
  path: forgejo-public/secrets
  destination:
    name: forge-code-session
    create: true
    overwrite: true
    transformation:
      excludeRaw: true
      excludes:
        - .*
      templates:
        session:
          text: |
            PROVIDER=redis
            PROVIDER_CONFIG=redis://default:{{ get .Secrets "redis_password" }}@forgejo-public.dragonfly.svc.cluster.local:6379/1?pool_size=100&idle_timeout=180s&prefix=forge-code:
  rolloutRestartTargets:
    - kind: Deployment
      name: forge-code
  vaultAuthRef: default
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: forge-git-session
  namespace: forgejo-public
spec:
  type: kv-v2
  mount: secret
  path: forgejo-public/secrets
  destination:
    name: forge-git-session
    create: true
    overwrite: true
    transformation:
      excludeRaw: true
      excludes:
        - .*
      templates:
        session:
          text: |
            PROVIDER=redis
            PROVIDER_CONFIG=redis://default:{{ get .Secrets "redis_password" }}@forgejo-public.dragonfly.svc.cluster.local:6379/1?pool_size=100&idle_timeout=180s&prefix=forge-git:
  rolloutRestartTargets:
    - kind: Deployment
      name: forge-git
  vaultAuthRef: default
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: forgejo-public-internal-ca
  namespace: forgejo-public
spec:
  type: kv-v2
  mount: secret
  path: forgejo-public/secrets
  destination:
    name: forgejo-public-internal-ca
    create: true
    overwrite: true
    transformation:
      excludeRaw: true
      excludes:
        - .*
      templates:
        internal-ca.crt:
          text: |
            {{ get .Secrets "internal_ca_cert" }}
  rolloutRestartTargets:
    - kind: Deployment
      name: forge-code
    - kind: Deployment
      name: forge-git
  vaultAuthRef: default