apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: sogo-mail-secrets
spec:
  secretStoreRef:
    name: vault-backend
    kind: ClusterSecretStore
  refreshInterval: 15m
  target:
    name: sogo-mail-secrets
    creationPolicy: Owner
    template:
      engineVersion: v2
      data:
        SOGoProfileURL: "postgresql://{{ .postgres_user }}:{{ .postgres_pw }}@sogo-mail-postgres-rw:5432/sogo/sogo_user_profile"
        OCSFolderInfoURL: "postgresql://{{ .postgres_user }}:{{ .postgres_pw }}@sogo-mail-postgres-rw:5432/sogo/sogo_folder_info"
        OCSSessionsFolderURL: "postgresql://{{ .postgres_user }}:{{ .postgres_pw }}@sogo-mail-postgres-rw:5432/sogo/sogo_sessions_folder"
        OCSCacheFolderURL: "postgresql://{{ .postgres_user }}:{{ .postgres_pw }}@sogo-mail-postgres-rw:5432/sogo/sogo_cache_folder"
        OCSStoreURL: "postgresql://{{ .postgres_user }}:{{ .postgres_pw }}@sogo-mail-postgres-rw:5432/sogo/sogo_store"
        OCSAclURL: "postgresql://{{ .postgres_user }}:{{ .postgres_pw }}@sogo-mail-postgres-rw:5432/sogo/sogo_acl"
        SOGoUserSources__yaml: |
          - type: ldap
            id: authentik
            CNFieldName: cn
            IDFieldName: cn
            UIDFieldName: cn
            bindDN: "cn={{ .ldap_bind_user }},ou=users,DC=ldap,DC=goauthentik,DC=io"
            bindPassword: "{{ .ldap_bind_password }}"
            hostname: "ldap://ak-outpost-ldap-outpost.authentik.svc.cluster.local:389"
            baseDN: "ou=users,DC=ldap,DC=goauthentik,DC=io"
            canAuthenticate: YES
            isAddressBook: YES
            bindAsCurrentUser: NO
            LoginFieldNames:
              - mail
            MailFieldNames:
              - mail
            displayName: "Shared Addresses"
            filter: "(objectClass=user)"
        SOGoIMAPServer: "imaps://stalwart.rubenhensen.nl:993"
        SOGoMailingMechanism: "smtp"
        SOGoSMTPServer: "smtp://stalwart.rubenhensen.nl:587/?tls=YES&tlsVerifyMode=allowInsecureLocalhost"
        SOGoSMTPAuthenticationType: "PLAIN"
        NGImap4DisableIMAP4Pooling: "NO"
        SOGoMailDomain: "rubenhensen.nl"
        SOGoForceExternalLoginWithEmail: "YES"
  dataFrom:
    - extract:
        key: kv/sogo-mail