# Secretos de la app respaldados por Infisical (patrón researchowl).
#
# Claves esperadas en /roswell (proyecto homelab, entorno prod):
#   TELEGRAM_BOT_TOKEN, TELEGRAM_ALLOWED_USERS, ANTHROPIC_API_KEY,
#   PODCASTINDEX_KEY, PODCASTINDEX_SECRET, POSTGRES_PASSWORD
#
# Un InfisicalStaticSecret por target: el operator (versión actual) solo
# procesa el primer elemento de `targets`, comprobado el 2026-07-13.
#
# CORTE (cuando los valores estén verificados): cambiar las referencias de
# deployment.yaml, postgres.yaml y backup-cronjob.yaml a los nombres
# *-infisical y borrar los planos:
#   kubectl delete secret roswell-secrets roswell-pg-secret -n roswell
apiVersion: secrets.infisical.com/v1beta1
kind: InfisicalStaticSecret
metadata:
  name: roswell-secrets
  namespace: roswell
spec:
  # Identidad compartida de solo lectura (sin write, sin PushSecret).
  infisicalAuthRef:
    name: infisical-auth
    namespace: infisical-operator
  sources:
    - projectId: 17e98e9d-70f5-43d1-8382-7da818dfcdd0   # project "homelab"
      environmentSlug: prod
      secretPath: /roswell
  syncOptions:
    refreshInterval: 60s
  targets:
    - kind: Secret
      name: roswell-secrets-infisical
      namespace: roswell
      creationPolicy: Owner
      template:
        engineVersion: v1
        data:
          telegram-bot-token: '{{ .TELEGRAM_BOT_TOKEN.Value }}'
          telegram-allowed-users: '{{ .TELEGRAM_ALLOWED_USERS.Value }}'
          anthropic-api-key: '{{ .ANTHROPIC_API_KEY.Value }}'
          podcastindex-key: '{{ .PODCASTINDEX_KEY.Value }}'
          podcastindex-secret: '{{ .PODCASTINDEX_SECRET.Value }}'
          # La URL completa se reconstruye: un solo sitio para la password.
          database-url: 'postgresql://roswell:{{ .POSTGRES_PASSWORD.Value }}@postgres.roswell.svc.cluster.local:5432/roswell'
---
apiVersion: secrets.infisical.com/v1beta1
kind: InfisicalStaticSecret
metadata:
  name: roswell-pg-secret
  namespace: roswell
spec:
  infisicalAuthRef:
    name: infisical-auth
    namespace: infisical-operator
  sources:
    - projectId: 17e98e9d-70f5-43d1-8382-7da818dfcdd0   # project "homelab"
      environmentSlug: prod
      secretPath: /roswell
  syncOptions:
    refreshInterval: 60s
  targets:
    - kind: Secret
      name: roswell-pg-secret-infisical
      namespace: roswell
      creationPolicy: Owner
      template:
        engineVersion: v1
        data:
          password: '{{ .POSTGRES_PASSWORD.Value }}'