root-at-skic
e2adb79e2d
A Copier template for deploying Archify Sync with Argo CD: an app-of-apps, the server's Helm chart and its values, optional secrets through External Secrets and an optional static NFS volume for PostgreSQL.
37 lines
1.5 KiB
Django/Jinja
37 lines
1.5 KiB
Django/Jinja
{%- set es = archify_sync.get('external_secrets', {}) -%}
|
|
# Secret `archify-sync-secrets` from your secret store through External Secrets.
|
|
# ESO's own templating is escaped below so it reaches the cluster as written.
|
|
#
|
|
# The store needs two entries (named in external_secrets):
|
|
# postgres_password_key password of the bundled postgres role `archify`;
|
|
# letters and digits only (it goes into a URL)
|
|
# oidc_client_secret_key secret of the archify-sync client at the identity provider
|
|
#
|
|
# The URL names the chart's database Service, `<release>-postgresql`; the release is
|
|
# `archify-sync` (0200-archify-sync).
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: archify-sync-secrets
|
|
namespace: {{ archify_sync.get('namespace', 'archify-sync') }}
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
name: {{ es.get('store') }}
|
|
kind: {{ es.get('store_kind', 'ClusterSecretStore') }}
|
|
target:
|
|
name: archify-sync-secrets
|
|
template:
|
|
engineVersion: v2
|
|
data:
|
|
password: "{% raw %}{{ .postgresPassword }}{% endraw %}"
|
|
url: "postgres://archify:{% raw %}{{ .postgresPassword }}{% endraw %}@archify-sync-postgresql:5432/archify"
|
|
client-secret: "{% raw %}{{ .oidcClientSecret }}{% endraw %}"
|
|
data:
|
|
- secretKey: postgresPassword
|
|
remoteRef:
|
|
key: {{ es.get('postgres_password_key', 'archify-sync-postgres-password') }}
|
|
- secretKey: oidcClientSecret
|
|
remoteRef:
|
|
key: {{ es.get('oidc_client_secret_key', 'archify-sync-oidc-client-secret') }}
|