# Automated TURN shared-secret rotation (Issue #38). Generates a new secret, re-encrypts
# apps/production/coturn-secret.yaml and synapse-turn-secret.yaml using a dedicated,
# narrowly-scoped age key (see turn-secret-rotation-secret.yaml - it can only decrypt these
# two files, not the repo's master sops-age key), bumps the checksum/rotated-at annotations
# so a merge restarts both consumers automatically, and opens a Pull Request rather than
# pushing straight to main - a human reviews and merges it.
apiVersion: batch/v1
kind: CronJob
metadata:
  name: turn-secret-rotation
  namespace: matrix
spec:
  schedule: "0 4 1 * *"
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 3
  failedJobsHistoryLimit: 3
  jobTemplate:
    spec:
      backoffLimit: 1
      template:
        metadata:
          labels:
            app.kubernetes.io/name: turn-secret-rotation
            app.kubernetes.io/component: rotation
        spec:
          restartPolicy: OnFailure
          # Public-internet reachability to the Gitea host has been flaky (see Issue #41);
          # both servers share a private Hetzner network. hostAliases (unlike the node-level
          # /etc/hosts fix used for image pulls) is actually honored by in-pod processes.
          hostAliases:
            - ip: "10.0.0.3"
              hostnames:
                - "rohana.axion1337.de"
          containers:
            - name: rotate
              image: rohana.axion1337.de/sorb/axion-secret-rotation:v1
              env:
                - name: GITEA_HOST
                  value: "rohana.axion1337.de"
                - name: GITEA_REPO
                  value: "sorb/axion1337.chat-gitops"
                - name: GITEA_TOKEN
                  valueFrom:
                    secretKeyRef:
                      name: turn-secret-rotation-credentials
                      key: gitea-token
                - name: SOPS_AGE_KEY_FILE
                  value: /secrets/age/age-key.txt
                - name: GIT_AUTHOR_NAME
                  value: "turn-secret-rotation"
                - name: GIT_AUTHOR_EMAIL
                  value: "turn-secret-rotation@axion1337.chat"
              volumeMounts:
                - name: age-key
                  mountPath: /secrets/age
                  readOnly: true
              resources:
                requests:
                  cpu: 50m
                  memory: 64Mi
                limits:
                  memory: 128Mi
          volumes:
            - name: age-key
              secret:
                secretName: turn-secret-rotation-credentials
                items:
                  - key: age-key.txt
                    path: age-key.txt
                    mode: 0400