adding bitwarden ESO and secrets

.gitignore

@@ -13,5 +13,3 @@ cronjobs
 *.key
 
 chacal/
-
-secrets/

infra/eso/bitwarden-cli.yaml

@@ -2,7 +2,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: bitwarden-cli
-  namespace: bitwarden
+  namespace: infra
   labels:
     app.kubernetes.io/name: bitwarden-cli
 spec:
@@ -102,3 +102,20 @@ spec:
             requests:
               cpu: 50m
               memory: 128Mi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: bitwarden-cli
+  namespace: infra
+  labels:
+    app.kubernetes.io/name: bitwarden-cli
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: bitwarden-cli
+  ports:
+    - name: http
+      port: 8087
+      targetPort: http
+      protocol: TCP

infra/eso/bw-cli-netpol.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: bw-cli
+  namespace: infra
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: bitwarden-cli
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        # ESO pods (app.kubernetes.io/name: external-secrets) in the external-secrets namespace.
+        # Both podSelector AND namespaceSelector must match for cross-namespace traffic.
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: external-secrets
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: external-secrets

infra/eso/secretstores.yaml

@@ -0,0 +1,20 @@
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata: { name: bitwarden-login }
+spec:
+  provider:
+    webhook:
+      url: "http://bitwarden-cli.infra.svc:8087/object/item/{{ .remoteRef.key }}"
+      result: { jsonPath: "$.data.login.{{ .remoteRef.property }}" }
+---
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata: { name: bitwarden-fields }
+spec:
+  provider:
+    webhook:
+      url: "http://bitwarden-cli.infra.svc:8087/object/item/{{ .remoteRef.key }}"
+      result:
+        {
+          jsonPath: '$.data.fields[?@.name=="{{ .remoteRef.property }}"].value',
+        }

secrets/adguard.yaml

@@ -0,0 +1,24 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata: { name: adguardhome-password, namespace: dns }
+spec:
+  refreshInterval: 1h
+  target:
+    name: adguardhome-password
+    deletionPolicy: Retain
+    template:
+      type: Opaque
+      data:
+        username: "{{ .username }}"
+        password: "{{ .password }}"
+  data:
+    - secretKey: username
+      remoteRef:
+        { key: 5bc7e63f-18bb-482c-bc3e-740e03b26334, property: username }
+      sourceRef:
+        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
+    - secretKey: password
+      remoteRef:
+        { key: 5bc7e63f-18bb-482c-bc3e-740e03b26334, property: password }
+      sourceRef:
+        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }

secrets/cloudreve.yaml

@@ -0,0 +1,36 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata: { name: cloudreve, namespace: cloud }
+spec:
+  refreshInterval: 1h
+  target:
+    name: cloudreve-secret
+    deletionPolicy: Retain
+    template:
+      type: Opaque
+      data:
+        DB_USER: "{{ .DB_USER }}"
+        DB_PASSWORD: "{{ .DB_PASSWORD }}"
+        DB_NAME: "{{ .DB_NAME }}"
+        REDIS_PASSWORD: "{{ .REDIS_PASSWORD }}"
+  data:
+    - secretKey: DB_USER
+      remoteRef:
+        { key: 8c25cac9-e9e8-4970-bdf4-31f9aee19276, property: username }
+      sourceRef:
+        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
+    - secretKey: DB_PASSWORD
+      remoteRef:
+        { key: 8c25cac9-e9e8-4970-bdf4-31f9aee19276, property: password }
+      sourceRef:
+        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
+    - secretKey: DB_NAME
+      remoteRef:
+        { key: 8c25cac9-e9e8-4970-bdf4-31f9aee19276, property: DB_NAME }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
+    - secretKey: REDIS_PASSWORD
+      remoteRef:
+        { key: 8c25cac9-e9e8-4970-bdf4-31f9aee19276, property: REDIS_PASSWORD }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }

secrets/openwebui.yaml

@@ -0,0 +1,27 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata: { name: openwebui, namespace: default }
+spec:
+  refreshInterval: 1h
+  target:
+    name: openwebui-secret
+    deletionPolicy: Retain
+    template:
+      type: Opaque
+      data:
+        DATABASE_URL: "postgresql://{{ .username }}:{{ .password }}@postgresql.haven:5432/{{ .dbname }}"
+  data:
+    - secretKey: username
+      remoteRef:
+        { key: e80ff314-7445-4b61-b5c5-69285ea72586, property: username }
+      sourceRef:
+        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
+    - secretKey: password
+      remoteRef:
+        { key: e80ff314-7445-4b61-b5c5-69285ea72586, property: password }
+      sourceRef:
+        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
+    - secretKey: dbname
+      remoteRef: { key: e80ff314-7445-4b61-b5c5-69285ea72586, property: dbname }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }

secrets/paperless.yaml

@@ -0,0 +1,39 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata: { name: paperless, namespace: default }
+spec:
+  refreshInterval: 1h
+  target:
+    name: paperless-secret
+    deletionPolicy: Retain
+    template:
+      type: Opaque
+      data:
+        PAPERLESS_DBNAME: "{{ .PAPERLESS_DBNAME }}"
+        PAPERLESS_DBUSER: "{{ .PAPERLESS_DBUSER }}"
+        PAPERLESS_DBPASSWORD: "{{ .PAPERLESS_DBPASSWORD }}"
+  data:
+    - secretKey: PAPERLESS_DBNAME
+      remoteRef:
+        {
+          key: 05426e55-fe04-4c16-8697-8a258928257a,
+          property: PAPERLESS_DBNAME,
+        }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
+    - secretKey: PAPERLESS_DBUSER
+      remoteRef:
+        {
+          key: 05426e55-fe04-4c16-8697-8a258928257a,
+          property: PAPERLESS_DBUSER,
+        }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
+    - secretKey: PAPERLESS_DBPASSWORD
+      remoteRef:
+        {
+          key: 05426e55-fe04-4c16-8697-8a258928257a,
+          property: PAPERLESS_DBPASSWORD,
+        }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }

secrets/radarr.yaml

@@ -0,0 +1,48 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata: { name: radarr, namespace: media }
+spec:
+  refreshInterval: 1h
+  target:
+    name: radarr-secret
+    deletionPolicy: Retain
+    template:
+      type: Opaque
+      data:
+        Radarr__Postgres__User: "{{ .Radarr__Postgres__User }}"
+        Radarr__Postgres__Password: "{{ .Radarr__Postgres__Password }}"
+        Radarr__Postgres__Host: "{{ .Radarr__Postgres__Host }}"
+        Radarr__Postgres__MainDb: "{{ .Radarr__Postgres__MainDb }}"
+  data:
+    - secretKey: Radarr__Postgres__User
+      remoteRef:
+        {
+          key: ab723b65-3ec8-469c-b01d-67a6e3049023,
+          property: username,
+        }
+      sourceRef:
+        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
+    - secretKey: Radarr__Postgres__Password
+      remoteRef:
+        {
+          key: ab723b65-3ec8-469c-b01d-67a6e3049023,
+          property: password,
+        }
+      sourceRef:
+        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
+    - secretKey: Radarr__Postgres__Host
+      remoteRef:
+        {
+          key: ab723b65-3ec8-469c-b01d-67a6e3049023,
+          property: Radarr__Postgres__Host,
+        }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
+    - secretKey: Radarr__Postgres__MainDb
+      remoteRef:
+        {
+          key: ab723b65-3ec8-469c-b01d-67a6e3049023,
+          property: Radarr__Postgres__MainDb,
+        }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }

secrets/recommender.yaml

@@ -0,0 +1,27 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata: { name: recommender, namespace: media }
+spec:
+  refreshInterval: 1h
+  target:
+    name: recommender-secrets
+    deletionPolicy: Retain
+    template:
+      type: Opaque
+      data:
+        OPENAI_API_KEY: "{{ .OPENAI_API_KEY }}"
+        DATABASE_URL: "{{ .DATABASE_URL }}"
+  data:
+    - secretKey: OPENAI_API_KEY
+      remoteRef:
+        {
+          key: 5079ef6f-3d1d-4522-b22c-6dd5f1c19acd,
+          property: OPENAI_API_KEY,
+        }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
+    - secretKey: DATABASE_URL
+      remoteRef:
+        { key: 5079ef6f-3d1d-4522-b22c-6dd5f1c19acd, property: DATABASE_URL }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }

secrets/slink.yaml

@@ -0,0 +1,30 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata: { name: slink, namespace: cloud }
+spec:
+  refreshInterval: 1h
+  target:
+    name: slink-secret
+    deletionPolicy: Retain
+    template:
+      type: Opaque
+      data:
+        ADMIN_USERNAME: "{{ .ADMIN_USERNAME }}"
+        ADMIN_PASSWORD: "{{ .ADMIN_PASSWORD }}"
+        ADMIN_EMAIL: "{{ .ADMIN_EMAIL }}"
+  data:
+    - secretKey: ADMIN_USERNAME
+      remoteRef:
+        { key: 79f97033-6bc3-40cd-a28c-6060b8bd3a63, property: username }
+      sourceRef:
+        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
+    - secretKey: ADMIN_PASSWORD
+      remoteRef:
+        { key: 79f97033-6bc3-40cd-a28c-6060b8bd3a63, property: password }
+      sourceRef:
+        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
+    - secretKey: ADMIN_EMAIL
+      remoteRef:
+        { key: 79f97033-6bc3-40cd-a28c-6060b8bd3a63, property: ADMIN_EMAIL }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }

secrets/sonarr.yaml

@@ -0,0 +1,42 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata: { name: sonarr, namespace: media }
+spec:
+  refreshInterval: 1h
+  target:
+    name: sonarr-secret
+    deletionPolicy: Retain
+    template:
+      type: Opaque
+      data:
+        Sonarr__Postgres__User: "{{ .Sonarr__Postgres__User }}"
+        Sonarr__Postgres__Password: "{{ .Sonarr__Postgres__Password }}"
+        Sonarr__Postgres__Host: "{{ .Sonarr__Postgres__Host }}"
+        Sonarr__Postgres__MainDb: "{{ .Sonarr__Postgres__MainDb }}"
+  data:
+    - secretKey: Sonarr__Postgres__User
+      remoteRef:
+        { key: 2c5b6d27-971f-4876-b10d-db400dfde7b2, property: username }
+      sourceRef:
+        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
+    - secretKey: Sonarr__Postgres__Password
+      remoteRef:
+        { key: 2c5b6d27-971f-4876-b10d-db400dfde7b2, property: password }
+      sourceRef:
+        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
+    - secretKey: Sonarr__Postgres__Host
+      remoteRef:
+        {
+          key: 2c5b6d27-971f-4876-b10d-db400dfde7b2,
+          property: Sonarr__Postgres__Host,
+        }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
+    - secretKey: Sonarr__Postgres__MainDb
+      remoteRef:
+        {
+          key: 2c5b6d27-971f-4876-b10d-db400dfde7b2,
+          property: Sonarr__Postgres__MainDb,
+        }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }