# GitLab cross-site replication - VPS's half of the Vault pipeline
# (apps/gitlab/manifests/ha-postgres-app-pushsecret.yaml has home's half).
# Pulls the authoritative app-role passwords back down here.
#
# Merge (not Owner/Replace): only overwrites the `password` key, leaving
# CNPG's own generated host/dbname/username fields intact - those are
# correctly LOCAL to each site (this secret's `host` key points at the
# VPS's own local -rw service, which CNPG itself still needs internally).
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: pg-gitlab-app-password
  namespace: gitlab
spec:
  refreshInterval: 5m
  secretStoreRef:
    name: vault-backend
    kind: ClusterSecretStore
  target:
    name: pg-gitlab-app
    creationPolicy: Merge
  data:
    - secretKey: password
      remoteRef:
        key: vps/pg-gitlab-app
        property: password
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: pg-praefect-app-password
  namespace: gitlab
spec:
  refreshInterval: 5m
  secretStoreRef:
    name: vault-backend
    kind: ClusterSecretStore
  target:
    name: pg-praefect-app
    creationPolicy: Merge
  data:
    - secretKey: password
      remoteRef:
        key: vps/pg-praefect-app
        property: password