apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: bolletjestrui-secrets
spec:
  secretStoreRef:
    name: vault-backend
    kind: ClusterSecretStore
  refreshInterval: 15m
  target:
    name: bolletjestrui-secrets
    creationPolicy: Owner
  data:
    - secretKey: site_password
      remoteRef:
        key: kv/bolletjestrui
        property: site_password
    - secretKey: admin_password
      remoteRef:
        key: kv/bolletjestrui
        property: admin_password
    - secretKey: key_secret
      remoteRef:
        key: kv/bolletjestrui
        property: key_secret
    # web-push keypair for the "de route is gekozen" notification.
    # Generate once with `npx web-push generate-vapid-keys` and never rotate it:
    # a new key invalidates every subscription on everyone's phone.
    - secretKey: vapid_public_key
      remoteRef:
        key: kv/bolletjestrui
        property: vapid_public_key
    - secretKey: vapid_private_key
      remoteRef:
        key: kv/bolletjestrui
        property: vapid_private_key