# Forgejo IONOS SMTP password from OpenBao (RAIL-HO-WP-0005-T06).
#
# OpenBao path (platform KV v2): workloads/forgejo/forgejo-mailer
# Field: MAILER_PASSWD (optional SMTP_USER for non-Helm consumers)
#
# Prereqs on railiance01:
#   - External Secrets Operator (make eso-deploy)
#   - ClusterSecretStore openbao-forgejo (railiance-platform openbao-secretstore)
#   - OpenBao role external-secrets-forgejo (make openbao-configure-external-secrets-forgejo)
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: forgejo-mailer
  namespace: forgejo
  labels:
    app.kubernetes.io/name: forgejo
    app.kubernetes.io/part-of: railiance-apps
spec:
  refreshInterval: 1h
  secretStoreRef:
    kind: ClusterSecretStore
    name: openbao-forgejo
  target:
    name: forgejo-mailer
    creationPolicy: Owner
  data:
    - secretKey: MAILER_PASSWD
      remoteRef:
        key: workloads/forgejo/forgejo-mailer
        property: MAILER_PASSWD