{{- if .Values.vault.enabled }}
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: db-encryption
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: homarr
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
spec:
  refreshInterval: {{ .Values.vault.refreshInterval | default "5m" | quote }}
  secretStoreRef:
    name: {{ .Values.vault.secretStoreName | quote }}
    kind: SecretStore
  target:
    name: db-encryption
    creationPolicy: Owner
  data:
    - secretKey: db-encryption-key
      remoteRef:
        key: {{ .Values.vault.secretPath | quote }}
        property: {{ .Values.vault.secretKey | quote }}
{{- end }}