# The gluetun credentials Secret the 1Password operator materializes on the
# real cluster - here as a template with variable NAMES only. This file must
# never contain a value; ci/run-install-test.sh renders it with envsubst,
# restricted to the names declared in ci/freesailarr/settings.env
# (REQUIRED_ENV), and pipes the result straight into kubectl.
#
# The values come from a 1Password item holding a CI-only Mullvad key, loaded in
# the install-test job of .github/workflows/validate-charts.yml. A CI-only key
# on purpose: Mullvad ties an address to a key and sends the tunnel to the
# endpoint it saw last, so a shared key would let every pull request pull the
# tunnel out from under the running stack.
#
# Name and keys follow the chart: <release>-<chart>-gluetun-secret with the
# fields the StatefulSet reads via secretKeyRef. Release name is ci.
apiVersion: v1
kind: Secret
metadata:
  name: ci-freesailarr-gluetun-secret
type: Opaque
stringData:
  wireguard-private-key: "${FREESAILARR_WG_KEY}"
  wireguard-addresses: "${FREESAILARR_WG_ADDRESSES}"