fixup! ♻️ migration externalsecrets

2025-09-17 18:24:14 +02:00 · 2023-07-12 11:05:32 +02:00
parent 662b907525
commit 738cc6d746
18 changed files with 167 additions and 242 deletions
--- a/kubernetes/apps/default/authelia/app/helmrelease.yaml
+++ b/kubernetes/apps/default/authelia/app/helmrelease.yaml
@@ -45,7 +45,7 @@ spec:
        reloader.stakater.com/auto: "true"
    image:
      repository: ghcr.io/authelia/authelia
-      tag: master@sha256:master@sha256:a3647c3dd136402745c7639e446944004145630c822f27e22f999c414c234d2f
+      tag: master@sha256:a3647c3dd136402745c7639e446944004145630c822f27e22f999c414c234d2f
    args: ["--config", "/config/configuration.yaml", "--config.experimental.filters", "expand-env"]
    env:
      AUTHELIA_AUTHENTICATION_BACKEND_LDAP_ADDITIONAL_GROUPS_DN: ou=groups
--- a/kubernetes/apps/default/outline/app/externalsecret.yaml
+++ b/kubernetes/apps/default/outline/app/externalsecret.yaml
@@ -0,0 +1,34 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: outline
+  namespace: default
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword-connect
+  target:
+    name: outline-secret
+    creationPolicy: Owner
+    template:
+      engineVersion: v2
+      data:
+        # App
+        AWS_ACCESS_KEY_ID: "{{ .OUTLINE_AWS_ACCESS_KEY_ID }}"
+        AWS_SECRET_ACCESS_KEY: "{{ .OUTLINE_AWS_SECRET_ACCESS_KEY }}"
+        SECRET_KEY: "{{ .OUTLINE_SECRET_KEY }}"
+        UTILS_SECRET: "{{ .OUTLINE_UTILS_SECRET }}"
+        DATABASE_URL: postgresql://{{ .POSTGRES_USER }}:{{ .POSTGRES_PASS }}@postgres-rw.default.svc.cluster.local:5432/outline
+        # Postgres Init
+        INIT_POSTGRES_DBNAME: outline
+        INIT_POSTGRES_HOST: postgres-rw.default.svc.cluster.local
+        INIT_POSTGRES_USER: "{{ .POSTGRES_USER }}"
+        INIT_POSTGRES_PASS: "{{ .POSTGRES_PASS }}"
+        INIT_POSTGRES_SUPER_PASS: "{{ .POSTGRES_SUPER_PASS }}"
+  dataFrom:
+    - extract:
+        key: cloudnative-pg
+    - extract:
+        key: outline
--- a/kubernetes/apps/default/outline/app/helmrelease.yaml
+++ b/kubernetes/apps/default/outline/app/helmrelease.yaml
@@ -6,7 +6,7 @@ metadata:
  name: &app outline
  namespace: default
 spec:
-  interval: 15m
+  interval: 30m
  chart:
    spec:
      chart: app-template
@@ -15,7 +15,7 @@ spec:
        kind: HelmRepository
        name: bjw-s
        namespace: flux-system
-  maxHistory: 3
+  maxHistory: 2
  install:
    createNamespace: true
    remediation:
@@ -27,17 +27,45 @@ spec:
  uninstall:
    keepHistory: false
  values:
+    initContainers:
+      01-init-db:
+        image: ghcr.io/onedr0p/postgres-init:14.8
+        imagePullPolicy: IfNotPresent
+        envFrom: &envFrom
+          - secretRef:
+              name: &secret outline-secret
    controller:
-      replicas: 1
      strategy: RollingUpdate
      annotations:
        reloader.stakater.com/auto: "true"
    image:
      repository: docker.io/outlinewiki/outline
      tag: 0.70.2
-    envFrom:
-      - secretRef:
-          name: outline-secret
+    envFrom: *envFrom
+    env:
+      AWS_REGION: us-east-1
+      AWS_S3_ACL: private
+      AWS_S3_FORCE_PATH_STYLE: "true"
+      AWS_S3_UPLOAD_BUCKET_NAME: outline
+      AWS_S3_UPLOAD_BUCKET_URL: "https://truenas.${SECRET_DOMAIN}:51515"
+      AWS_S3_UPLOAD_MAX_SIZE: "26214400"
+      ENABLE_UPDATES: "false"
+      OIDC_AUTH_URI: "https://auth.${SECRET_CLUSTER_DOMAIN}/api/oidc/authorization"
+      OIDC_CLIENT_ID: outline
+      OIDC_CLIENT_SECRET: "${SECRET_OUTLINE_OAUTH_CLIENT_SECRET}"
+      OIDC_DISPLAY_NAME: Authelia
+      OIDC_SCOPES: "openid profile email offline_access"
+      OIDC_TOKEN_URI: "https://auth.${SECRET_CLUSTER_DOMAIN}/api/oidc/token"
+      OIDC_USERINFO_URI: "https://auth.${SECRET_CLUSTER_DOMAIN}/api/oidc/userinfo"
+      OIDC_USERNAME_CLAIM: email
+      PORT: 8080
+      REDIS_URL: ioredis://eyJkYiI6MTUsInNlbnRpbmVscyI6W3siaG9zdCI6InJlZGlzLW5vZGUtMC5yZWRpcy1oZWFkbGVzcy5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FsIiwicG9ydCI6MjYzNzl9LHsiaG9zdCI6InJlZGlzLW5vZGUtMS5yZWRpcy1oZWFkbGVzcy5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FsIiwicG9ydCI6MjYzNzl9LHsiaG9zdCI6InJlZGlzLW5vZGUtMi5yZWRpcy1oZWFkbGVzcy5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FsIiwicG9ydCI6MjYzNzl9XSwibmFtZSI6InJlZGlzLW1hc3RlciJ9
+      SMTP_HOST: smtp-relay.default.svc.cluster.local.
+      SMTP_PORT: 2525
+      SMTP_FROM_EMAIL: "outline@${SECRET_DOMAIN}"
+      SMTP_SECURE: "false"
+      URL: "https://docs.${SECRET_CLUSTER_DOMAIN}"
+      WEB_CONCURRENCY: 10
    command:
      [
        "/bin/sh",
--- a/kubernetes/apps/default/outline/app/kustomization.yaml
+++ b/kubernetes/apps/default/outline/app/kustomization.yaml
@@ -4,8 +4,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: default
 resources:
-  - ./secret.sops.yaml
+  - ./externalsecret.yaml
  - ./helmrelease.yaml
-patchesStrategicMerge:
-  - ./patches/env.yaml
-  - ./patches/postgres.yaml
--- a/kubernetes/apps/default/outline/app/patches/env.yaml
+++ b/kubernetes/apps/default/outline/app/patches/env.yaml
@@ -1,33 +0,0 @@
---
-# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: outline
-  namespace: default
-spec:
-  values:
-    env:
-      AWS_REGION: us-east-1
-      AWS_S3_ACL: private
-      AWS_S3_FORCE_PATH_STYLE: "true"
-      AWS_S3_UPLOAD_BUCKET_NAME: outline
-      AWS_S3_UPLOAD_BUCKET_URL: "https://truenas.${SECRET_DOMAIN}:51515"
-      AWS_S3_UPLOAD_MAX_SIZE: "26214400"
-      ENABLE_UPDATES: "false"
-      OIDC_AUTH_URI: "https://auth.${SECRET_CLUSTER_DOMAIN}/api/oidc/authorization"
-      OIDC_CLIENT_ID: outline
-      OIDC_CLIENT_SECRET: "${SECRET_OUTLINE_OAUTH_CLIENT_SECRET}"
-      OIDC_DISPLAY_NAME: Authelia
-      OIDC_SCOPES: "openid profile email offline_access"
-      OIDC_TOKEN_URI: "https://auth.${SECRET_CLUSTER_DOMAIN}/api/oidc/token"
-      OIDC_USERINFO_URI: "https://auth.${SECRET_CLUSTER_DOMAIN}/api/oidc/userinfo"
-      OIDC_USERNAME_CLAIM: email
-      PORT: 8080
-      REDIS_URL: ioredis://eyJkYiI6MTUsInNlbnRpbmVscyI6W3siaG9zdCI6InJlZGlzLW5vZGUtMC5yZWRpcy1oZWFkbGVzcy5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FsIiwicG9ydCI6MjYzNzl9LHsiaG9zdCI6InJlZGlzLW5vZGUtMS5yZWRpcy1oZWFkbGVzcy5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FsIiwicG9ydCI6MjYzNzl9LHsiaG9zdCI6InJlZGlzLW5vZGUtMi5yZWRpcy1oZWFkbGVzcy5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FsIiwicG9ydCI6MjYzNzl9XSwibmFtZSI6InJlZGlzLW1hc3RlciJ9
-      SMTP_HOST: smtp-relay.default.svc.cluster.local.
-      SMTP_PORT: 2525
-      SMTP_FROM_EMAIL: "outline@${SECRET_DOMAIN}"
-      SMTP_SECURE: "false"
-      URL: "https://docs.${SECRET_CLUSTER_DOMAIN}"
-      WEB_CONCURRENCY: 10
--- a/kubernetes/apps/default/outline/app/patches/postgres.yaml
+++ b/kubernetes/apps/default/outline/app/patches/postgres.yaml
@@ -1,25 +0,0 @@
---
-# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: &app outline
-  namespace: default
-spec:
-  values:
-    initContainers:
-      init-db:
-        image: ghcr.io/onedr0p/postgres-initdb:14.8
-        env:
-          - name: POSTGRES_HOST
-            value: ${POSTGRES_HOST}
-          - name: POSTGRES_DB
-            value: *app
-          - name: POSTGRES_SUPER_PASS
-            valueFrom:
-              secretKeyRef:
-                name: postgres-superuser
-                key: password
-        envFrom:
-          - secretRef:
-              name: outline-secret
--- a/kubernetes/apps/default/outline/app/secret.sops.yaml
+++ b/kubernetes/apps/default/outline/app/secret.sops.yaml
@@ -1,35 +0,0 @@
-# yamllint disable
-apiVersion: v1
-kind: Secret
-metadata:
-    name: outline-secret
-    namespace: default
-type: Opaque
-stringData:
-    AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:ZJ6v/Kyxxy5mu2XrA003uRVHRzI=,iv:0tBr1HSrUNMQMxFi+RzgfKV7x/Ee99dL5DFXMSFjJtw=,tag:v7AVhxXjVV3cvpAANGVLeg==,type:str]
-    AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:2GGPneKPmFEtq3A9X7fskiv/FnKv5deoyzNx0/euYrTOJKrRiTgj8g==,iv:u1LLrjxP1GwWcM1FJLjB9OpUFTPI0D9IZEX86IHGpmU=,tag:7vq4QeQagU2B9+WShheDKg==,type:str]
-    SECRET_KEY: ENC[AES256_GCM,data:RUjf4wghv9PnDdSNWeytoDRzH+A7wa8RNYDP+MYIf8KHjOGyVNzZwEuS8ah8wy8tvBWAE9kykOC1KhP+wFofIA==,iv:3z7NZ87ILlyrkx4YMWQ9uFL2W31bTmwZFkJxOHgSVvo=,tag:umplfrhjvCZX9Ucneo7Q+Q==,type:str]
-    UTILS_SECRET: ENC[AES256_GCM,data:r5DADkQbM5fEBsWs7ddUx2PXnt+ePiQcJZgKMmHYpkddmPFeS5xpJGgbhun7v409aKJLQRm/tUIysBlxHlnSbA==,iv:cP2KQeUmgjoXuY7UnQ57M4tBUeO0hELGe+HrSB5RJ3Q=,tag:HD4lccnbZXjllmOLyEHY3Q==,type:str]
-    DATABASE_URL: ENC[AES256_GCM,data:Q/lDi+O65wYIH4dBve0WBy4tHGbwgMfzzoz1N8VTu0kl5Myxjk36bCUFzfP62RYicdXEJpffUigtlwKQxnFT5Atu8xvpeqmsZ0Gq6IXfE3+NWCeNXkD1BkqD,iv:hhX+hW7fuuUbKrvhTd0j9wPpZzbZxbJulfYhrH3S304=,tag:COskqvtXUxqOuv92QL3hXw==,type:str]
-    POSTGRES_USER: ENC[AES256_GCM,data:4FlwiUkmmQ==,iv:f/mOMCV34bvseHAJ37AaUIZUYcBobtdIAYN/5ONhGbg=,tag:HFvPkQh2i/BtnynAjP0uhg==,type:str]
-    POSTGRES_PASS: ENC[AES256_GCM,data:DrO0C2kyUu9irfd3I4Ii/2QZcIA=,iv:44crBneaLpsyp9POZqNVQfh2JYIsJD4Yoq1YrvyANGc=,tag:V84EYlBMZzVj9bs8k4dV8g==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFYUFSaFFVbVgyTXkzbmFR
-            NHllQjdJcEUxdlloWC9sSGtJNnBoL0xIM1VjCmk4NFpEM0ZFOEJKWCtyNkRTVkdw
-            SFVBY1J4c1VUdnQxZnVOWHFWbmYzRlUKLS0tIDE0L3VybUhnSkJlYStxR0k4dzZ6
-            eGsyL3NhNS8xdUp0VlNQbWRYbHFLYW8KeMc82BlegMJMtAF/WGMbXhpf2MVvUP5q
-            ehHCSwpe3a8WwXEBNu1u5IPcnMO4Fo5HhjLbMx6H1Ynd6KdyDXUKEg==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2022-12-01T22:25:43Z"
-    mac: ENC[AES256_GCM,data:/zmgGjJRYcDt4iXpLyDN2MA0FWxuQmmZNRggw0UX+IPgUrvGKmLpLsC3+0zhHUAwjANgWtQ5pJWHMuz1R39lOOBEcUBM4Re/ZTnyClDZIkxVC0WUrmTsj4spz719v9iwORYmTQujPW6bO9a/1KFNL5KjKqz/7Qx8Iu9MsCNfIfE=,iv:iUD51jsCdT4uBnWiAS20DITCdN1lov0Ibz3EacXNQOs=,tag:46LubofEdvYErTrgsgUGxg==,type:str]
-    pgp: []
-    encrypted_regex: ^(data|stringData)$
-    version: 3.7.3
--- a/kubernetes/apps/default/outline/ks.yaml
+++ b/kubernetes/apps/default/outline/ks.yaml
@@ -15,6 +15,7 @@ spec:
    name: home-ops-kubernetes
  dependsOn:
    - name: cluster-apps-cloudnative-pg-cluster
+    - name: cluster-apps-external-secrets-stores
  healthChecks:
    - apiVersion: helm.toolkit.fluxcd.io/v2beta1
      kind: HelmRelease
--- a/kubernetes/apps/default/vaultwarden/app/backups/kustomization.yaml
+++ b/kubernetes/apps/default/vaultwarden/app/backups/kustomization.yaml
@@ -1,7 +0,0 @@
---
-# yaml-language-server: $schema=https://json.schemastore.org/kustomization
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ./replicationsource.yaml
-  - ./restic.sops.yaml
--- a/kubernetes/apps/default/vaultwarden/app/backups/replicationsource.yaml
+++ b/kubernetes/apps/default/vaultwarden/app/backups/replicationsource.yaml
@@ -1,21 +0,0 @@
---
-# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/replicationsource_v1alpha1.json
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: vaultwarden
-  namespace: default
-spec:
-  sourcePVC: vaultwarden-data
-  trigger:
-    schedule: "0 0 * * *"
-  restic:
-    copyMethod: Snapshot
-    pruneIntervalDays: 10
-    repository: vaultwarden-restic
-    cacheCapacity: 2Gi
-    volumeSnapshotClassName: csi-ceph-blockpool
-    storageClassName: rook-ceph-block
-    retain:
-      daily: 10
-      within: 3d
--- a/kubernetes/apps/default/vaultwarden/app/backups/restic.sops.yaml
+++ b/kubernetes/apps/default/vaultwarden/app/backups/restic.sops.yaml
@@ -1,35 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: vaultwarden-restic
-    namespace: default
-type: Opaque
-stringData:
-    #ENC[AES256_GCM,data:WTM0Lkqp+sxjbUgkNzAVZQnC5g==,iv:4y8R8GpLy2Ogh3Lt3v6ibVbJF7jy8K1BOGi+ONt7S5c=,tag:wRhEBfRNHp0PBvIjM60iSA==,type:comment]
-    RESTIC_REPOSITORY: ENC[AES256_GCM,data:uOeOyeDbYvbOzaHbzBEiGGbTajNGiyyvdAZ6gxQsQkK/7zlYGjjHJToe1P08f9ubfJvb1qYDolbUFG1r7w==,iv:Rt+XeXIaPCNe/4RN1j+Oq1onSuL7ygObJ6RE8OtVqQM=,tag:O60RdSxw1vtklvaCSPA+rA==,type:str]
-    #ENC[AES256_GCM,data:cRvGVeuDnEbJs01G+Und5ls1EgaC9Q2vj61IE/2R,iv:qSjv4bGEX9QWABhXgnCJsoj0p1kjgYaQwQX0Oyu9RHk=,tag:x8i1WXbAvdpC+Iv8pn/drw==,type:comment]
-    RESTIC_PASSWORD: ENC[AES256_GCM,data:6VI/lJQFZg6hu5r0SqNAKQAQGYY=,iv:UYRMnkHB4jsXcV1tyLDTAqh6dxsd18hYWsDoSpjJarA=,tag:d6hgK6LSgu7vZbLfquKcyA==,type:str]
-    #ENC[AES256_GCM,data:YIIHR5DwXv3YE9fFvNSAfrm47ZsshZMcY31LbaJ4gwXo0yOOHe6qDEc=,iv:axSMsvrIOkJFlErvw9fcAwLNSEWDh6mUU6dWZu6icIo=,tag:MDNlk43vcI9S4o6tMiWVmw==,type:comment]
-    #ENC[AES256_GCM,data:8Wspw6gPIPBsumfRS/5dlZrAQQqBJEDMgcpip4a3HCfHq8SeVDv4Gl0j3hyZqUsP5af8nN69Y/9bas7z1hnIERkrb8DqYg==,iv:WqCz9vBfg1JxUEpd97J37YztSW3HkcOHa6nIJI4VK8I=,tag:+LxnOzGidF39ojPKSOrVsg==,type:comment]
-    AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:I9vuuPEGS6A135zwKUNXvSIAjwk=,iv:dByy2WuuhO6OluWXYRwkdMutK33yKwOcWkR9hvY5bsg=,tag:xHU7Hbx+sxuZ9CRymA55JQ==,type:str]
-    AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:kRdbENGS1F32JzkvktYkbfhMGBSrUpFSfyCdIpJwLOc+/2TyHAMrxA==,iv:Q+UKNT9aRo+A0KWu/FiST/4bOQKTOBJKHhpP8JXD3ao=,tag:7VE8lx2QAdNutcUj5kMNNA==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4RE9wTDZVRlExcnVKYjVZ
-            THNtblNXbGlSUitoS0FYV2k3dlg3aWZEMWxjCmZETUFGSnR0c3JZU2FHNnFneHdB
-            TEdlYjJTcjNsSDQ0dmgvNWlnNWo4TWMKLS0tIGR2Q25heThUUGliY0ZicDNra1FN
-            dGppaVJiME1FQnkzdVJOeTZMcjhYWE0KBrGQAYun1Zs3oyHWQ8iGvmF4hheP3md4
-            3/Lc9CqEC+V1lT9On8ivEBethjt528vCyVMM5pLMRBEO6CMjlNhJ+g==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2022-12-28T06:25:12Z"
-    mac: ENC[AES256_GCM,data:p1g7s7w7umL5nLw8MiFZUwFf7a8/iFE/AAFS5roUoxUZA3L2DULAvx3cHyOHuTWLXJRuvrTWDR4EgvGo3fgXcsWLSKEK/5G7ZK2gsBRjr3nrcGoOmf6ICj7W5tsjP3t9IZ6XHApu1DG83GTm/eehNuQOt6bGp/eTjjB3j+bScOo=,iv:VYZu8ryjAd1N7+2qhZjhbYiSCa5zQTnrITitT8W8QhA=,tag:UV5AmjLD02N0HfqsIqJUeA==,type:str]
-    pgp: []
-    encrypted_regex: ^(data|stringData)$
-    version: 3.7.3
--- a/kubernetes/apps/default/vaultwarden/app/externalsecret.yaml
+++ b/kubernetes/apps/default/vaultwarden/app/externalsecret.yaml
@@ -0,0 +1,31 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: vaultwarden
+  namespace: default
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword-connect
+  target:
+    name: vaultwarden-secret
+    creationPolicy: Owner
+    template:
+      engineVersion: v2
+      data:
+        # App
+        DATABASE_URL: postgresql://{{ .POSTGRES_USER }}:{{ .POSTGRES_PASS }}@postgres-rw.default.svc.cluster.local.:5432/vaultwarden
+        ADMIN_TOKEN: "{{ .VAULTWARDEN_ADMIN_TOKEN }}"
+        # Postgres Init
+        INIT_POSTGRES_DBNAME: vaultwarden
+        INIT_POSTGRES_HOST: postgres-rw.default.svc.cluster.local
+        INIT_POSTGRES_USER: "{{ .POSTGRES_USER }}"
+        INIT_POSTGRES_PASS: "{{ .POSTGRES_PASS }}"
+        INIT_POSTGRES_SUPER_PASS: "{{ .POSTGRES_SUPER_PASS }}"
+  dataFrom:
+    - extract:
+        key: cloudnative-pg
+    - extract:
+        key: vaultwarden
--- a/kubernetes/apps/default/vaultwarden/app/helmrelease.yaml
+++ b/kubernetes/apps/default/vaultwarden/app/helmrelease.yaml
@@ -6,7 +6,7 @@ metadata:
  name: &app vaultwarden
  namespace: default
 spec:
-  interval: 15m
+  interval: 30m
  chart:
    spec:
      chart: app-template
@@ -15,7 +15,7 @@ spec:
        kind: HelmRepository
        name: bjw-s
        namespace: flux-system
-  maxHistory: 3
+  maxHistory: 2
  install:
    createNamespace: true
    remediation:
@@ -27,6 +27,16 @@ spec:
  uninstall:
    keepHistory: false
  values:
+    initContainers:
+      01-init-db:
+        image: ghcr.io/onedr0p/postgres-init:14.8
+        imagePullPolicy: IfNotPresent
+        envFrom: &envFrom
+          - secretRef:
+              name: &secret vaultwarden-secret
+    controller:
+      annotations:
+        reloader.stakater.com/auto: "true"
    image:
      repository: vaultwarden/server
      tag: 1.29.0
@@ -45,11 +55,7 @@ spec:
      SMTP_FROM_NAME: vaultwarden
      SMTP_PORT: 2525
      SMTP_SECURITY: "off"
-    envFrom:
-      - secretRef:
-          name: *app
-    podAnnotations:
-      secret.reloader.stakater.com/reload: *app
+    envFrom: *envFrom
    service:
      main:
        ports:
--- a/kubernetes/apps/default/vaultwarden/app/kustomization.yaml
+++ b/kubernetes/apps/default/vaultwarden/app/kustomization.yaml
@@ -4,9 +4,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: default
 resources:
-  - ./backups
+  - ./externalsecret.yaml
  - ./helmrelease.yaml
-  - ./secret.sops.yaml
+  - ./volsync.yaml
  - ./volume.yaml
-patchesStrategicMerge:
-  - ./patches/postgres.yaml
--- a/kubernetes/apps/default/vaultwarden/app/patches/postgres.yaml
+++ b/kubernetes/apps/default/vaultwarden/app/patches/postgres.yaml
@@ -1,32 +0,0 @@
---
-# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: vaultwarden
-  namespace: default
-spec:
-  values:
-    initContainers:
-      init-db:
-        image: ghcr.io/onedr0p/postgres-initdb:14.8
-        env:
-          - name: POSTGRES_HOST
-            value: ${POSTGRES_HOST}
-          - name: POSTGRES_DB
-            value: vaultwarden
-          - name: POSTGRES_SUPER_PASS
-            valueFrom:
-              secretKeyRef:
-                name: postgres-superuser
-                key: password
-          - name: POSTGRES_USER
-            valueFrom:
-              secretKeyRef:
-                name: vaultwarden
-                key: POSTGRES_USER
-          - name: POSTGRES_PASS
-            valueFrom:
-              secretKeyRef:
-                name: vaultwarden
-                key: POSTGRES_PASS
--- a/kubernetes/apps/default/vaultwarden/app/secret.sops.yaml
+++ b/kubernetes/apps/default/vaultwarden/app/secret.sops.yaml
@@ -1,32 +0,0 @@
-# yamllint disable
-apiVersion: v1
-kind: Secret
-metadata:
-    name: vaultwarden
-    namespace: default
-type: Opaque
-stringData:
-    ADMIN_TOKEN: ENC[AES256_GCM,data:lckmNXsxah0qbl0Lj+U9ow9iL8i2UcELDBVHX/auyfqW+1Lp6QzutQ9A20m04y9RHRU8ifXo4mfaA5Bn6FvuYQ==,iv:qWBB0oeZJ7Bju+nGdrGZm/hjODi7vPVnRb6Qiw0jmFY=,tag:Sg5nfHjFx5jo6GD0GGglwg==,type:str]
-    DATABASE_URL: ENC[AES256_GCM,data:mFxeL8sQIuEG0x+c9ZN9cgFzx4xLOEFprQuNL12w6ZuGxMlY2gAJ3W/fktnbSqHveaKqBulKrh8StS/AtFZ9P27EPZqZuIPDJ3JI42zWtB2krW9CmK7SIa+oxfRLCdXug646,iv:vwlwfOcuXjE6kXLcASqq4yXNrA6jblfr5d0j8jlFTSw=,tag:yR2TzKyhpRlc91U3ob5rkg==,type:str]
-    POSTGRES_USER: ENC[AES256_GCM,data:C8AE1A15q9TnIqk=,iv:4B+9fmpVu6B4HyQ2FF6tiCBYBP8q88ExRfLZuyIbbIA=,tag:tCPk0oYjP2uQfKu6a4HP4g==,type:str]
-    POSTGRES_PASS: ENC[AES256_GCM,data:er6JHXy0vxBperPCq3fWOWYh,iv:aUh/ZwFb4XWirA5V0/9O8dIsQHQlWJIqe8cq5WXAlv4=,tag:M++5dqnSyY5DVKyxaoCkMg==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJaU16anJNV2pBZmxPR3h2
-            bWREUnpjcTFvd05ZQ2E4VVBDdm1FL2k4WEYwCkdQSStTNWtpdjNkUW51WS9MekdC
-            VkpTUUFjSjY2a1JMOUtqOVh5M0JRR2sKLS0tIDRmcWpJSEVvaUp4U1lsaTZYZGNw
-            OGVKWU0zNUZJSFh4aFJxQWFsYm1VeFkKaDeI/hl7z0Qh8t5W39Kxu9ert1dt4xo+
-            LX+MjpVqxiZNcfwROD4bkWeQSN+VsxoGOOyj4L15BlggNnlg+L7Hww==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2022-09-16T11:38:24Z"
-    mac: ENC[AES256_GCM,data:UvnBQRkO/GDyUkTVPGkXsDCy3HTpjTtFJdQPU6Y375qy+3kI8SJFQ/YlYL3Z5W5OBnriOfMrfzOK8+QbaPGHK9hg2A6dDXPwjF+8YYesUspOJ+lRCoWsuubYJragW7nKcpeNVcMMWPNFK1vPwCR0pC8rBZDOF8dXoGe9Ozk1yvA=,iv:2P/c5IXti6zV/j9QFynvS+bXwgH6mANh6CzB4vCmE1Q=,tag:GmOovYX2kVjDL9fm17gAHw==,type:str]
-    pgp: []
-    encrypted_regex: ^(data|stringData)$
-    version: 3.7.3
--- a/kubernetes/apps/default/vaultwarden/app/volsync.yaml
+++ b/kubernetes/apps/default/vaultwarden/app/volsync.yaml
@@ -0,0 +1,49 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: lychee-restic
+  namespace: default
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword-connect
+  target:
+    name: lychee-restic-secret
+    creationPolicy: Owner
+    template:
+      engineVersion: v2
+      data:
+        RESTIC_REPOSITORY: '{{ .REPOSITORY_TEMPLATE }}/lychee'
+        RESTIC_PASSWORD: '{{ .RESTIC_PASSWORD }}'
+        AWS_ACCESS_KEY_ID: '{{ .AWS_ACCESS_KEY_ID }}'
+        AWS_SECRET_ACCESS_KEY: '{{ .AWS_SECRET_ACCESS_KEY }}'
+  dataFrom:
+    - extract:
+        key: volsync-restic-template
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/volsync.backube/replicationsource_v1alpha1.json
+apiVersion: volsync.backube/v1alpha1
+kind: ReplicationSource
+metadata:
+  name: lychee
+  namespace: default
+spec:
+  sourcePVC: lychee-files
+  trigger:
+    schedule: "0 7 * * *"
+  restic:
+    copyMethod: Snapshot
+    pruneIntervalDays: 7
+    repository: lychee-restic-secret
+    cacheCapacity: 20Gi
+    volumeSnapshotClassName: csi-ceph-blockpool
+    storageClassName: rook-ceph-block
+    moverSecurityContext:
+      runAsUser: 33
+      runAsGroup: 33
+      fsGroup: 33
+    retain:
+      daily: 7
+      within: 3d
--- a/kubernetes/apps/default/vaultwarden/ks.yaml
+++ b/kubernetes/apps/default/vaultwarden/ks.yaml
@@ -15,6 +15,7 @@ spec:
    name: home-ops-kubernetes
  dependsOn:
    - name: cluster-apps-cloudnative-pg-cluster
+    - name: cluster-apps-external-secrets-stores
    - name: cluster-apps-rook-ceph-cluster
    - name: cluster-apps-volsync-app
  healthChecks: