{{- /*
ExternalSecret — Stalwart admin password.

Sources `ADMIN_PASSWORD` from the operator's OpenBao via a
ClusterSecretStore (Catalyst default `vault-region1`, shipped by
bp-external-secrets-stores). The remote OpenBao path is operator-
supplied at install time per the canonical convention
`sovereign/<sovereign-fqdn>/stalwart/<tenant>/admin` (under the store's
`secret/` mount) with property `ADMIN_PASSWORD`.

Per docs/INVIOLABLE-PRINCIPLES.md #4 every knob is operator-tunable; the
per-tenant overlay supplies `admin.externalSecret.remoteRef.key` without
rebuilding the OCI artifact. The chart renders this Kind only when the
ExternalSecrets CRD is present (capability gate, same shape as
bp-newapi/external-secret.yaml — issue #190).

If the operator pre-creates a SealedSecret named `<admin.secretName>`,
they SHOULD set `admin.externalSecret.enabled=false` to avoid two
controllers fighting over the same Secret.
*/ -}}
{{- $a := .Values.admin.externalSecret | default dict -}}
{{- $remote := $a.remoteRef | default dict -}}
{{- /*
Render only when:
  1. ExternalSecret render is enabled (operator may pre-create a
     SealedSecret instead — set externalSecret.enabled=false in that
     case to avoid two controllers fighting over the same Secret).
  2. external-secrets.io/v1beta1 CRD is present (capability gate, same
     shape as bp-newapi/external-secret.yaml — issue #190).
  3. remoteRef.key is supplied. Empty key in default render is a
     smoke-test concession (Inviolable Principle #4 — operator overlay
     supplies the canonical path
     `sovereign/<sovereign-fqdn>/stalwart/<tenant>/admin`).
*/ -}}
{{- if and $a.enabled $remote.key (.Capabilities.APIVersions.Has "external-secrets.io/v1beta1") -}}
{{- $store := $a.secretStoreRef | default dict -}}
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: {{ .Values.admin.secretName | quote }}
  labels:
    {{- include "bp-stalwart-tenant.labels" . | nindent 4 }}
spec:
  refreshInterval: {{ $a.refreshInterval | default "1h" | quote }}
  secretStoreRef:
    kind: {{ $store.kind | default "ClusterSecretStore" | quote }}
    name: {{ $store.name | default "vault-region1" | quote }}
  target:
    name: {{ .Values.admin.secretName | quote }}
    creationPolicy: Owner
  data:
    - secretKey: ADMIN_PASSWORD
      remoteRef:
        key: {{ $remote.key | quote }}
        property: {{ $remote.property | default "ADMIN_PASSWORD" | quote }}
{{- end }}
