# Multi-site active failover pilot - VPS's half of the Vault pipeline
# (infrastructure/authentik/manifests/ha-postgres-app-pushsecret.yaml has
# home's half, which pushes the authoritative password into Vault at
# secret/vps/pg-authentik-app). Pulls it back down here.
#
# Merge (not Owner/Replace): only overwrites the `password` key, leaving
# CNPG's own generated host/dbname/username fields on this secret intact
# - those are correctly LOCAL to each site (this secret's `host` key
# points at the VPS's own local -rw service, which CNPG itself still
# needs internally, even though the app tier reads a different value via
# the pg-authentik.ha.huskypup.net override in values.yaml).
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: pg-authentik-app-password
  namespace: authentik
spec:
  refreshInterval: 5m
  secretStoreRef:
    name: vault-backend
    kind: ClusterSecretStore
  target:
    name: pg-authentik-app
    creationPolicy: Merge
  data:
    - secretKey: password
      remoteRef:
        key: vps/pg-authentik-app
        property: password