# ------------------------------------------------------------------------------
# ExternalSecret — Technitium TSIG Secret
# Pulled from 1Password, materialized in the external-dns namespace.
#
# In 1Password, store as item "technitium-tsig" with field "tsig-secret"
# in the "mk-labs" vault.
#
# To generate a TSIG key for Technitium:
#   tsig-keygen -a hmac-sha256 external-dns
# Add the key to Technitium under Settings > DNS Settings > TSIG Keys
# ------------------------------------------------------------------------------
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: technitium-tsig-secret
  namespace: external-dns
spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: onepassword-connect
  refreshInterval: "1h"
  target:
    name: technitium-tsig-secret
    creationPolicy: Owner
  data:
    - secretKey: tsig-secret
      remoteRef:
        key: technitium-tsig       # 1Password item name
        property: tsig-secret      # 1Password field name