apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata: { name: openwebui, namespace: default }
spec:
  refreshInterval: 1h
  target:
    name: openwebui-secret
    deletionPolicy: Retain
    template:
      type: Opaque
      data:
        DATABASE_URL: "postgresql://{{ .username }}:{{ .password }}@postgresql.haven:5432/{{ .dbname }}"
  data:
    - secretKey: username
      remoteRef:
        { key: e80ff314-7445-4b61-b5c5-69285ea72586, property: username }
      sourceRef:
        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
    - secretKey: password
      remoteRef:
        { key: e80ff314-7445-4b61-b5c5-69285ea72586, property: password }
      sourceRef:
        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
    - secretKey: dbname
      remoteRef: { key: e80ff314-7445-4b61-b5c5-69285ea72586, property: dbname }
      sourceRef:
        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }