From a367714b5ac202d218a398e6b1e5f02e9d8b4724 Mon Sep 17 00:00:00 2001
From: Zoe Roux <zoe.roux@zoriya.dev>
Date: Fri, 1 Aug 2025 12:27:15 +0200
Subject: [PATCH] Add external secrets

---
 README.md                        |  1 +
 apps/external-secrets.yaml       | 71 ++++++++++++++++++++++++++++++++
 charts/transmission/secrets.yaml | 14 +++++++
 3 files changed, 86 insertions(+)
 create mode 100644 apps/external-secrets.yaml
 create mode 100644 charts/transmission/secrets.yaml

diff --git a/README.md b/README.md
index 8241c5e..f85bf64 100644
--- a/README.md
+++ b/README.md
@@ -15,6 +15,7 @@ helm upgrade -i cilium cilium/cilium \
 helm install argocd oci://ghcr.io/argoproj/argo-helm/argo-cd -n argocd --create-namespace
 
 kubectl apply -f ./apps/apps.yaml
+kubectl create secret generic bitwarden-access-token -n external-secrets --from-literal token=$BW_ACCESS_TOKEN
 ```
 
 ## Notes
diff --git a/apps/external-secrets.yaml b/apps/external-secrets.yaml
new file mode 100644
index 0000000..744c2b3
--- /dev/null
+++ b/apps/external-secrets.yaml
@@ -0,0 +1,71 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-secrets
+  namespace: argocd
+spec:
+  project: default
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external-secrets
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+    - CreateNamespace=true
+  source:
+    repoURL: https://charts.external-secrets.io
+    chart: external-secrets
+    targetRevision: v0.18.2
+    helm:
+      valuesObject:
+        bitwarden-sdk-server:
+          enabled: true
+---
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata:
+  name: bitwarden
+spec:
+  provider:
+    bitwardensecretsmanager:
+      apiURL: https://vault.bitwarden.eu/api
+      identityURL: https://vault.bitwarden.eu/identity
+      auth:
+        secretRef:
+          credentials:
+            namespace: external-secrets
+            name: bitwarden-access-token
+            key: token
+      caProvider:
+        type: Secret
+        namespace: external-secrets
+        name: bitwarden-tls-certs
+        key: ca.crt
+
+      organizationID: b461238b-9b93-4598-b12c-b32c00834ab6
+      projectID: b63f0f85-2c6f-4f99-b999-b32c009d7bdf
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: bitwarden-tls-certs
+  namespace: external-secrets
+spec:
+  secretName: bitwarden-tls-certs
+  dnsNames:
+    - bitwarden-sdk-server.external-secrets.svc.cluster.local
+    - external-secrets-bitwarden-sdk-server.external-secrets.svc.cluster.local
+    - localhost
+  ipAddresses:
+    - 127.0.0.1
+    - ::1
+  privateKey:
+    algorithm: RSA
+    encoding: PKCS8
+    size: 2048
+  issuerRef:
+    name: selfsigned
+    kind: ClusterIssuer
+    group: cert-manager.io
diff --git a/charts/transmission/secrets.yaml b/charts/transmission/secrets.yaml
new file mode 100644
index 0000000..c60a450
--- /dev/null
+++ b/charts/transmission/secrets.yaml
@@ -0,0 +1,14 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: transmisison
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    # This name must match the metadata.name in the `SecretStore`
+    name: bitwarden-secretsmanager
+    kind: SecretStore
+  data:
+  - secretKey: test
+    remoteRef:
+      key: "secret-name"