---
# Mirrors apps/n8n/manifests/cnpg-secrets.yaml: CNPG creates pg-nextcloud-app
# with a generated password on cluster init; ESO overrides it with a
# generator-managed password so it's rotated/tracked the same way as every
# other app secret in this repo.
apiVersion: generators.external-secrets.io/v1alpha1
kind: Password
metadata:
  name: nextcloud-cnpg-secret
  namespace: nextcloud
spec:
  length: 42
  digits: 5
  symbols: 5
  symbolCharacters: "-_$@"
  noUpper: false
  allowRepeat: true

---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: nextcloud-cnpg-secret
  namespace: nextcloud
spec:
  refreshInterval: "24h"
  target:
    # Merges into the pg-nextcloud-app secret CNPG creates automatically
    name: pg-nextcloud-app
    creationPolicy: Merge
    template:
      metadata:
        labels:
          cnpg.io/reload: "true"
      data:
        password: "{{ .password }}"
  dataFrom:
    - sourceRef:
        generatorRef:
          apiVersion: generators.external-secrets.io/v1alpha1
          kind: Password
          name: nextcloud-cnpg-secret