apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata: { name: sonarr, namespace: media }
spec:
  refreshInterval: 1h
  target:
    name: sonarr-secret
    deletionPolicy: Retain
    template:
      type: Opaque
      data:
        Sonarr__Postgres__User: "{{ .Sonarr__Postgres__User }}"
        Sonarr__Postgres__Password: "{{ .Sonarr__Postgres__Password }}"
        Sonarr__Postgres__Host: "{{ .Sonarr__Postgres__Host }}"
        Sonarr__Postgres__MainDb: "{{ .Sonarr__Postgres__MainDb }}"
  data:
    - secretKey: Sonarr__Postgres__User
      remoteRef:
        { key: 2c5b6d27-971f-4876-b10d-db400dfde7b2, property: username }
      sourceRef:
        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
    - secretKey: Sonarr__Postgres__Password
      remoteRef:
        { key: 2c5b6d27-971f-4876-b10d-db400dfde7b2, property: password }
      sourceRef:
        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
    - secretKey: Sonarr__Postgres__Host
      remoteRef:
        {
          key: 2c5b6d27-971f-4876-b10d-db400dfde7b2,
          property: Sonarr__Postgres__Host,
        }
      sourceRef:
        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
    - secretKey: Sonarr__Postgres__MainDb
      remoteRef:
        {
          key: 2c5b6d27-971f-4876-b10d-db400dfde7b2,
          property: Sonarr__Postgres__MainDb,
        }
      sourceRef:
        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }