apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata: { name: paperless, namespace: default }
spec:
  refreshInterval: 1h
  target:
    name: paperless-secret
    deletionPolicy: Retain
    template:
      type: Opaque
      data:
        PAPERLESS_DBNAME: "{{ .PAPERLESS_DBNAME }}"
        PAPERLESS_DBUSER: "{{ .PAPERLESS_DBUSER }}"
        PAPERLESS_DBPASSWORD: "{{ .PAPERLESS_DBPASSWORD }}"
  data:
    - secretKey: PAPERLESS_DBNAME
      remoteRef:
        {
          key: 05426e55-fe04-4c16-8697-8a258928257a,
          property: PAPERLESS_DBNAME,
        }
      sourceRef:
        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
    - secretKey: PAPERLESS_DBUSER
      remoteRef:
        {
          key: 05426e55-fe04-4c16-8697-8a258928257a,
          property: PAPERLESS_DBUSER,
        }
      sourceRef:
        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
    - secretKey: PAPERLESS_DBPASSWORD
      remoteRef:
        {
          key: 05426e55-fe04-4c16-8697-8a258928257a,
          property: PAPERLESS_DBPASSWORD,
        }
      sourceRef:
        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }