apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata: { name: radarr, namespace: media }
spec:
  refreshInterval: 1h
  target:
    name: radarr-secret
    deletionPolicy: Retain
    template:
      type: Opaque
      data:
        Radarr__Postgres__User: "{{ .Radarr__Postgres__User }}"
        Radarr__Postgres__Password: "{{ .Radarr__Postgres__Password }}"
        Radarr__Postgres__Host: "{{ .Radarr__Postgres__Host }}"
        Radarr__Postgres__MainDb: "{{ .Radarr__Postgres__MainDb }}"
  data:
    - secretKey: Radarr__Postgres__User
      remoteRef:
        {
          key: ab723b65-3ec8-469c-b01d-67a6e3049023,
          property: username,
        }
      sourceRef:
        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
    - secretKey: Radarr__Postgres__Password
      remoteRef:
        {
          key: ab723b65-3ec8-469c-b01d-67a6e3049023,
          property: password,
        }
      sourceRef:
        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
    - secretKey: Radarr__Postgres__Host
      remoteRef:
        {
          key: ab723b65-3ec8-469c-b01d-67a6e3049023,
          property: Radarr__Postgres__Host,
        }
      sourceRef:
        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
    - secretKey: Radarr__Postgres__MainDb
      remoteRef:
        {
          key: ab723b65-3ec8-469c-b01d-67a6e3049023,
          property: Radarr__Postgres__MainDb,
        }
      sourceRef:
        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }