# GitLab cross-site replication Phase 1b (see
# /home/scooby/.claude/plans/jiggly-snacking-iverson.md) - pushes home's
# chart-generated secrets into Vault so the VPS's ESO can pull them back
# down BEFORE the VPS's Postgres becomes a real replica of home's.
#
# Why this matters: the GitLab chart generates these per-release, at
# random, on first install. Home's and the VPS's values are currently
# different. Once the VPS's Postgres is byte-for-byte replicating home's
# rows, the VPS Rails app will be reading home's encrypted-at-rest data
# (2FA secrets, CI/CD variables, integration tokens, PAT digests,
# application_settings encrypted columns) with the WRONG key unless these
# match - Rails raises OpenSSL::Cipher::CipherError on boot otherwise.
#
# gitlab-gitaly-secret/gitlab-praefect-secret are also needed for
# Phase 2's cross-site gRPC auth (the VPS's Gitaly/Praefect need the same
# tokens home's do, to be trusted as nodes of the same virtual storage).
#
# Same pattern as infrastructure/authentik/manifests/ha-postgres-app-pushsecret.yaml.
# Each of these secrets happens to have exactly one key (confirmed live),
# so one PushSecret + one ExternalSecret per secret, no enumeration needed.
apiVersion: external-secrets.io/v1alpha1
kind: PushSecret
metadata:
  name: gitlab-rails-secret-to-vps
  namespace: gitlab
spec:
  refreshInterval: 5m
  secretStoreRefs:
    - name: vault-backend
      kind: ClusterSecretStore
  selector:
    secret:
      name: gitlab-rails-secret
  data:
    - match:
        secretKey: secrets.yml
        remoteRef:
          remoteKey: vps/gitlab-rails-secret
          property: secrets.yml
---
apiVersion: external-secrets.io/v1alpha1
kind: PushSecret
metadata:
  name: gitlab-shell-secret-to-vps
  namespace: gitlab
spec:
  refreshInterval: 5m
  secretStoreRefs:
    - name: vault-backend
      kind: ClusterSecretStore
  selector:
    secret:
      name: gitlab-gitlab-shell-secret
  data:
    - match:
        secretKey: secret
        remoteRef:
          remoteKey: vps/gitlab-gitlab-shell-secret
          property: secret
---
apiVersion: external-secrets.io/v1alpha1
kind: PushSecret
metadata:
  name: gitlab-gitaly-secret-to-vps
  namespace: gitlab
spec:
  refreshInterval: 5m
  secretStoreRefs:
    - name: vault-backend
      kind: ClusterSecretStore
  selector:
    secret:
      name: gitlab-gitaly-secret
  data:
    - match:
        secretKey: token
        remoteRef:
          remoteKey: vps/gitlab-gitaly-secret
          property: token
---
apiVersion: external-secrets.io/v1alpha1
kind: PushSecret
metadata:
  name: gitlab-praefect-secret-to-vps
  namespace: gitlab
spec:
  refreshInterval: 5m
  secretStoreRefs:
    - name: vault-backend
      kind: ClusterSecretStore
  selector:
    secret:
      name: gitlab-praefect-secret
  data:
    - match:
        secretKey: token
        remoteRef:
          remoteKey: vps/gitlab-praefect-secret
          property: token