# Credentials for mirror-sync-cronjob.yaml. GitLab's native repository
# mirroring (pull mirror) is a Premium/Ultimate-gated feature as of this
# chart version - confirmed live 2026-08-21: the API rejects `mirror`
# and `import_url` as valid params on this CE instance entirely
# ("allow_merge_on_skipped_pipeline, ... are missing" - i.e. neither
# field is even recognized). So this CronJob does the plain-git
# equivalent (clone --mirror / push --mirror) on a schedule instead.
#
# - pull_username/pull_token: read-only deploy token on HOME's
#   Scooby/Homelabv4 project (deploy tokens can't have write_repository
#   - it's not a valid scope for them, confirmed live).
# - push_username/push_token: a write_repository-scoped Personal Access
#   Token for VPS GitLab's root user (deploy tokens can't push either).
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: gitlab-mirror-sync
  namespace: gitlab
spec:
  refreshInterval: 1h
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault-backend
  target:
    name: gitlab-mirror-sync-secret
    creationPolicy: Owner
  data:
    - secretKey: pull_username
      remoteRef:
        key: vps/gitlab-mirror
        property: username
    - secretKey: pull_token
      remoteRef:
        key: vps/gitlab-mirror
        property: token
    - secretKey: push_token
      remoteRef:
        key: vps/gitlab-mirror
        property: push_token