# Multi-site active failover pilot (see
# /home/scooby/.claude/plans/jiggly-snacking-iverson.md) - closes the gap
# the user correctly flagged: manually kubectl/ssh-copying secrets between
# home and the VPS defeats the entire point of having Vault. This is the
# first piece of a real Vault -> VPS pipeline (infrastructure/vps-eso/ has
# the other half, ESO running on the VPS itself pulling this back down).
#
# pg-authentik-app is CNPG-generated, not Vault-native - each cluster
# (home and VPS) independently generates its own random password for the
# `app` role at bootstrap time. Since VPS's Postgres now REPLICATES from
# home (WAL includes role/password changes), the two clusters' actual live
# passwords are only in sync because of that replication - but the two
# clusters' K8S SECRET OBJECTS never resync on their own (confirmed live
# 2026-08-20: VPS's copy was stale). Pushing home's value into Vault, with
# VPS's ESO pulling it back down on refreshInterval, makes this self-
# healing instead of a manual one-time fix that goes stale again on the
# next password rotation.
apiVersion: external-secrets.io/v1alpha1
kind: PushSecret
metadata:
  name: pg-authentik-app-to-vps
  namespace: authentik
spec:
  refreshInterval: 5m
  secretStoreRefs:
    - name: vault-backend
      kind: ClusterSecretStore
  selector:
    secret:
      name: pg-authentik-app
  data:
    - match:
        secretKey: password
        remoteRef:
          remoteKey: vps/pg-authentik-app
          property: password