# GitLab cross-site replication - VPS's half of the Vault pipeline
# (apps/gitlab/manifests/ha-postgres-app-pushsecret.yaml has home's half).
# Pulls the authoritative app-role passwords back down here.
#
# creationPolicy REVERTED Merge -> Owner 2026-08-22: Merge assumed CNPG
# itself would generate a base pg-gitlab-app/pg-praefect-app secret
# (host/dbname/username keys) for this ExternalSecret to merge a
# password into - true for a normal owning/primary Cluster, but WRONG
# for these VPS Clusters since Phase 1c's recreate: `pg-gitlab`/
# `pg-praefect` here are bootstrap.recovery REPLICA clusters
# (replica.self: vps) - the `app` role is part of the replicated
# global role/password state streamed from home's primary, so CNPG
# correctly never creates a local owner secret for it here. Merge had
# nothing to merge onto -> ExternalSecret condition
# "SecretMissing/CreationPolicy=Merge" -> pg-gitlab-app never existed
# -> vps-gitlab-webservice crash-looped on
# ActiveRecord::DatabaseConnectionError for ~39h before this was
# caught (confirmed live, unrelated to any same-day change). Owner:
# the ExternalSecret creates the whole secret itself. This chart only
# ever reads the `password` key from it - host/port/dbname/username
# are hardcoded directly in infrastructure/vps-standby/gitlab/
# values.yaml's global.psql/global.praefect.psql blocks, not read from
# this secret's other keys, so a password-only Owner-created secret is
# sufficient (confirmed live: no other consumer of this secret's keys
# found).
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: pg-gitlab-app-password
  namespace: gitlab
spec:
  refreshInterval: 5m
  secretStoreRef:
    name: vault-backend
    kind: ClusterSecretStore
  target:
    name: pg-gitlab-app
    creationPolicy: Owner
  data:
    - secretKey: password
      remoteRef:
        key: vps/pg-gitlab-app
        property: password
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: pg-praefect-app-password
  namespace: gitlab
spec:
  refreshInterval: 5m
  secretStoreRef:
    name: vault-backend
    kind: ClusterSecretStore
  target:
    name: pg-praefect-app
    creationPolicy: Owner
  data:
    - secretKey: password
      remoteRef:
        key: vps/pg-praefect-app
        property: password