apiVersion: secrets.infisical.com/v1beta1
kind: InfisicalStaticSecret
metadata:
  name: gitea-registry
  namespace: reddit-intel
spec:
  # References the SHARED auth layer in infisical-operator (cross-namespace).
  infisicalAuthRef:
    name: infisical-auth
    namespace: infisical-operator
  sources:
    - projectId: 17e98e9d-70f5-43d1-8382-7da818dfcdd0   # project "homelab"
      environmentSlug: prod
      secretPath: /registry
  syncOptions:
    refreshInterval: 60s
  targets:
    - kind: Secret
      name: gitea-registry
      namespace: reddit-intel
      creationPolicy: Owner
      secretType: kubernetes.io/dockerconfigjson
      template:
        engineVersion: v1
        data:
          # Reconstruct the docker pull-secret blob from the two discrete /registry fields.
          .dockerconfigjson: '{"auths":{"git.chemavx.xyz":{"username":"{{ .GITEA_REGISTRY_USERNAME.Value }}","password":"{{ .GITEA_REGISTRY_TOKEN.Value }}","auth":"{{ printf "%s:%s" .GITEA_REGISTRY_USERNAME.Value .GITEA_REGISTRY_TOKEN.Value | encodeBase64 }}"}}}'