diff --git a/secrets/adguard.yaml b/secrets/adguard.yaml new file mode 100644 index 0000000..90556ac --- /dev/null +++ b/secrets/adguard.yaml @@ -0,0 +1,24 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: { name: adguardhome-password, namespace: dns } +spec: + refreshInterval: 1h + target: + name: adguardhome-password + deletionPolicy: Retain + template: + type: Opaque + data: + username: "{{ .username }}" + password: "{{ .password }}" + data: + - secretKey: username + remoteRef: + { key: 5bc7e63f-18bb-482c-bc3e-740e03b26334, property: username } + sourceRef: + { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } } + - secretKey: password + remoteRef: + { key: 5bc7e63f-18bb-482c-bc3e-740e03b26334, property: password } + sourceRef: + { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } } diff --git a/secrets/affine.yaml b/secrets/affine.yaml new file mode 100644 index 0000000..2c0e56b --- /dev/null +++ b/secrets/affine.yaml @@ -0,0 +1,30 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: { name: affine, namespace: cloud } +spec: + refreshInterval: 1h + target: + name: affine-secret + deletionPolicy: Retain + template: + type: Opaque + data: + DB_USERNAME: "{{ .DB_USERNAME }}" + DB_PASSWORD: "{{ .DB_PASSWORD }}" + DB_NAME: "{{ .DB_NAME }}" + data: + - secretKey: DB_USERNAME + remoteRef: + { key: 4f15af1c-9b66-41d0-80db-a99ebe50e91f, property: username } + sourceRef: + { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } } + - secretKey: DB_PASSWORD + remoteRef: + { key: 4f15af1c-9b66-41d0-80db-a99ebe50e91f, property: password } + sourceRef: + { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } } + - secretKey: DB_NAME + remoteRef: + { key: 4f15af1c-9b66-41d0-80db-a99ebe50e91f, property: DB_NAME } + sourceRef: + { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } } diff --git a/secrets/cloudreve.yaml b/secrets/cloudreve.yaml new file mode 100644 index 0000000..6fc6991 --- /dev/null +++ b/secrets/cloudreve.yaml @@ -0,0 +1,36 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: { name: cloudreve, namespace: cloud } +spec: + refreshInterval: 1h + target: + name: cloudreve-secret + deletionPolicy: Retain + template: + type: Opaque + data: + DB_USER: "{{ .DB_USER }}" + DB_PASSWORD: "{{ .DB_PASSWORD }}" + DB_NAME: "{{ .DB_NAME }}" + REDIS_PASSWORD: "{{ .REDIS_PASSWORD }}" + data: + - secretKey: DB_USER + remoteRef: + { key: 8c25cac9-e9e8-4970-bdf4-31f9aee19276, property: username } + sourceRef: + { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } } + - secretKey: DB_PASSWORD + remoteRef: + { key: 8c25cac9-e9e8-4970-bdf4-31f9aee19276, property: password } + sourceRef: + { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } } + - secretKey: DB_NAME + remoteRef: + { key: 8c25cac9-e9e8-4970-bdf4-31f9aee19276, property: DB_NAME } + sourceRef: + { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } } + - secretKey: REDIS_PASSWORD + remoteRef: + { key: 8c25cac9-e9e8-4970-bdf4-31f9aee19276, property: REDIS_PASSWORD } + sourceRef: + { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } } diff --git a/secrets/discord-webhook.yaml b/secrets/discord-webhook.yaml new file mode 100644 index 0000000..52f5414 --- /dev/null +++ b/secrets/discord-webhook.yaml @@ -0,0 +1,21 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: { name: discord-webhook, namespace: infra } +spec: + refreshInterval: 1h + target: + name: discord-webhook + deletionPolicy: Retain + template: + type: Opaque + data: + HAVEN_WEBHOOK_URL: "{{ .HAVEN_WEBHOOK_URL }}" + data: + - secretKey: HAVEN_WEBHOOK_URL + remoteRef: + { + key: afd065bd-be8f-4e3c-a06e-e9d3089cb8f7, + property: HAVEN_WEBHOOK_URL, + } + sourceRef: + { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } } diff --git a/secrets/gitea-runner.yaml b/secrets/gitea-runner.yaml new file mode 100644 index 0000000..2486342 --- /dev/null +++ b/secrets/gitea-runner.yaml @@ -0,0 +1,21 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: { name: gitea-runner, namespace: dev } +spec: + refreshInterval: 1h + target: + name: gitea-runner-token + deletionPolicy: Retain + template: + type: Opaque + data: + REGISTRATION_TOKEN: "{{ .REGISTRATION_TOKEN }}" + data: + - secretKey: REGISTRATION_TOKEN + remoteRef: + { + key: 4e286657-b5de-4354-be2e-d1649b0fd527, + property: REGISTRATION_TOKEN, + } + sourceRef: + { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } } diff --git a/secrets/kasbot.yaml b/secrets/kasbot.yaml new file mode 100644 index 0000000..55cf02b --- /dev/null +++ b/secrets/kasbot.yaml @@ -0,0 +1,18 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: { name: kasbot, namespace: default } +spec: + refreshInterval: 1h + target: + name: kasbot-secrets + deletionPolicy: Retain + template: + type: Opaque + data: + KASBOT_TOKEN: "{{ .KASBOT_TOKEN }}" + data: + - secretKey: KASBOT_TOKEN + remoteRef: + { key: 885a7d90-95be-494f-af88-300ac6a7e210, property: KASBOT_TOKEN } + sourceRef: + { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } } diff --git a/secrets/openwebui.yaml b/secrets/openwebui.yaml new file mode 100644 index 0000000..47a1221 --- /dev/null +++ b/secrets/openwebui.yaml @@ -0,0 +1,27 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: { name: openwebui, namespace: default } +spec: + refreshInterval: 1h + target: + name: openwebui-secret + deletionPolicy: Retain + template: + type: Opaque + data: + DATABASE_URL: "postgresql://{{ .username }}:{{ .password }}@postgresql.haven:5432/{{ .dbname }}" + data: + - secretKey: username + remoteRef: + { key: e80ff314-7445-4b61-b5c5-69285ea72586, property: username } + sourceRef: + { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } } + - secretKey: password + remoteRef: + { key: e80ff314-7445-4b61-b5c5-69285ea72586, property: password } + sourceRef: + { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } } + - secretKey: dbname + remoteRef: { key: e80ff314-7445-4b61-b5c5-69285ea72586, property: dbname } + sourceRef: + { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } } diff --git a/secrets/paperless.yaml b/secrets/paperless.yaml new file mode 100644 index 0000000..be8b00f --- /dev/null +++ b/secrets/paperless.yaml @@ -0,0 +1,48 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: { name: paperless, namespace: default } +spec: + refreshInterval: 1h + target: + name: paperless-secret + deletionPolicy: Retain + template: + type: Opaque + data: + PAPERLESS_DBNAME: "{{ .PAPERLESS_DBNAME }}" + PAPERLESS_DBUSER: "{{ .PAPERLESS_DBUSER }}" + PAPERLESS_DBPASSWORD: "{{ .PAPERLESS_DBPASSWORD }}" + PAPERLESS_SECRET_KEY: "{{ .PAPERLESS_SECRET_KEY }}" + data: + - secretKey: PAPERLESS_DBNAME + remoteRef: + { + key: 05426e55-fe04-4c16-8697-8a258928257a, + property: PAPERLESS_DBNAME, + } + sourceRef: + { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } } + - secretKey: PAPERLESS_DBUSER + remoteRef: + { + key: 05426e55-fe04-4c16-8697-8a258928257a, + property: PAPERLESS_DBUSER, + } + sourceRef: + { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } } + - secretKey: PAPERLESS_DBPASSWORD + remoteRef: + { + key: 05426e55-fe04-4c16-8697-8a258928257a, + property: PAPERLESS_DBPASSWORD, + } + sourceRef: + { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } } + - secretKey: PAPERLESS_SECRET_KEY + remoteRef: + { + key: 05426e55-fe04-4c16-8697-8a258928257a, + property: PAPERLESS_SECRET_KEY, + } + sourceRef: + { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } } diff --git a/secrets/radarr.yaml b/secrets/radarr.yaml new file mode 100644 index 0000000..d9f6079 --- /dev/null +++ b/secrets/radarr.yaml @@ -0,0 +1,48 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: { name: radarr, namespace: media } +spec: + refreshInterval: 1h + target: + name: radarr-secret + deletionPolicy: Retain + template: + type: Opaque + data: + Radarr__Postgres__User: "{{ .Radarr__Postgres__User }}" + Radarr__Postgres__Password: "{{ .Radarr__Postgres__Password }}" + Radarr__Postgres__Host: "{{ .Radarr__Postgres__Host }}" + Radarr__Postgres__MainDb: "{{ .Radarr__Postgres__MainDb }}" + data: + - secretKey: Radarr__Postgres__User + remoteRef: + { + key: ab723b65-3ec8-469c-b01d-67a6e3049023, + property: username, + } + sourceRef: + { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } } + - secretKey: Radarr__Postgres__Password + remoteRef: + { + key: ab723b65-3ec8-469c-b01d-67a6e3049023, + property: password, + } + sourceRef: + { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } } + - secretKey: Radarr__Postgres__Host + remoteRef: + { + key: ab723b65-3ec8-469c-b01d-67a6e3049023, + property: Radarr__Postgres__Host, + } + sourceRef: + { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } } + - secretKey: Radarr__Postgres__MainDb + remoteRef: + { + key: ab723b65-3ec8-469c-b01d-67a6e3049023, + property: Radarr__Postgres__MainDb, + } + sourceRef: + { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } } diff --git a/secrets/recommender.yaml b/secrets/recommender.yaml new file mode 100644 index 0000000..3812d84 --- /dev/null +++ b/secrets/recommender.yaml @@ -0,0 +1,27 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: { name: recommender, namespace: media } +spec: + refreshInterval: 1h + target: + name: recommender-secrets + deletionPolicy: Retain + template: + type: Opaque + data: + OPENAI_API_KEY: "{{ .OPENAI_API_KEY }}" + DATABASE_URL: "{{ .DATABASE_URL }}" + data: + - secretKey: OPENAI_API_KEY + remoteRef: + { + key: 5079ef6f-3d1d-4522-b22c-6dd5f1c19acd, + property: OPENAI_API_KEY, + } + sourceRef: + { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } } + - secretKey: DATABASE_URL + remoteRef: + { key: 5079ef6f-3d1d-4522-b22c-6dd5f1c19acd, property: DATABASE_URL } + sourceRef: + { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } } diff --git a/secrets/renovate-bot.yaml b/secrets/renovate-bot.yaml new file mode 100644 index 0000000..6335c4f --- /dev/null +++ b/secrets/renovate-bot.yaml @@ -0,0 +1,27 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: { name: renovate-bot, namespace: cronjobs } +spec: + refreshInterval: 1h + target: + name: renovate-bot + deletionPolicy: Retain + template: + type: Opaque + data: + RENOVATE_GITHUB_COM_TOKEN: "{{ .RENOVATE_GITHUB_COM_TOKEN }}" + RENOVATE_TOKEN: "{{ .RENOVATE_TOKEN }}" + data: + - secretKey: RENOVATE_GITHUB_COM_TOKEN + remoteRef: + { + key: 25b1f5c9-0a2b-438e-a4c6-23ea1d58e2de, + property: RENOVATE_GITHUB_COM_TOKEN, + } + sourceRef: + { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } } + - secretKey: RENOVATE_TOKEN + remoteRef: + { key: 25b1f5c9-0a2b-438e-a4c6-23ea1d58e2de, property: RENOVATE_TOKEN } + sourceRef: + { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } } diff --git a/secrets/slink.yaml b/secrets/slink.yaml new file mode 100644 index 0000000..28e869c --- /dev/null +++ b/secrets/slink.yaml @@ -0,0 +1,30 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: { name: slink, namespace: cloud } +spec: + refreshInterval: 1h + target: + name: slink-secret + deletionPolicy: Retain + template: + type: Opaque + data: + ADMIN_USERNAME: "{{ .ADMIN_USERNAME }}" + ADMIN_PASSWORD: "{{ .ADMIN_PASSWORD }}" + ADMIN_EMAIL: "{{ .ADMIN_EMAIL }}" + data: + - secretKey: ADMIN_USERNAME + remoteRef: + { key: 79f97033-6bc3-40cd-a28c-6060b8bd3a63, property: username } + sourceRef: + { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } } + - secretKey: ADMIN_PASSWORD + remoteRef: + { key: 79f97033-6bc3-40cd-a28c-6060b8bd3a63, property: password } + sourceRef: + { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } } + - secretKey: ADMIN_EMAIL + remoteRef: + { key: 79f97033-6bc3-40cd-a28c-6060b8bd3a63, property: ADMIN_EMAIL } + sourceRef: + { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } } diff --git a/secrets/sonarr.yaml b/secrets/sonarr.yaml new file mode 100644 index 0000000..3d87606 --- /dev/null +++ b/secrets/sonarr.yaml @@ -0,0 +1,42 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: { name: sonarr, namespace: media } +spec: + refreshInterval: 1h + target: + name: sonarr-secret + deletionPolicy: Retain + template: + type: Opaque + data: + Sonarr__Postgres__User: "{{ .Sonarr__Postgres__User }}" + Sonarr__Postgres__Password: "{{ .Sonarr__Postgres__Password }}" + Sonarr__Postgres__Host: "{{ .Sonarr__Postgres__Host }}" + Sonarr__Postgres__MainDb: "{{ .Sonarr__Postgres__MainDb }}" + data: + - secretKey: Sonarr__Postgres__User + remoteRef: + { key: 2c5b6d27-971f-4876-b10d-db400dfde7b2, property: username } + sourceRef: + { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } } + - secretKey: Sonarr__Postgres__Password + remoteRef: + { key: 2c5b6d27-971f-4876-b10d-db400dfde7b2, property: password } + sourceRef: + { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } } + - secretKey: Sonarr__Postgres__Host + remoteRef: + { + key: 2c5b6d27-971f-4876-b10d-db400dfde7b2, + property: Sonarr__Postgres__Host, + } + sourceRef: + { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } } + - secretKey: Sonarr__Postgres__MainDb + remoteRef: + { + key: 2c5b6d27-971f-4876-b10d-db400dfde7b2, + property: Sonarr__Postgres__MainDb, + } + sourceRef: + { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }