# Optional: ExternalSecret for the captcha-solver API key.
#
# The default Deployment points at the keyless in-cluster LLM gateway
# (agentgateway-proxy → api.minimax.io via the `minimax` AgentgatewayBackend,
# which holds the upstream auth in `agentgateway-minimax-auth`). No client
# API key is needed in that case, and this file is **not** required.
#
# Only apply this if you change `CAPTCHA_LLM_BASE_URL` to a public endpoint
# that needs an API key (e.g. https://llmgw.h.raczylo.com/v1 from outside the
# cluster, or https://api.openai.com/v1). 1Password layout (matches the
# convention in home-cluster/.../base/mcp-servers/eso.yaml):
#
#   vault: <whatever stores ns_agentgateway>
#   item:  ns_agentgateway/mcp_captcha_solver_llm_api_key
#   field: key   (1Password item key)
#
# Append to home-cluster/kubernetes/namespaces/agentgateway-system/base/mcp-servers/eso.yaml.
# The Secret is consumed by the Deployment as `mcp-captcha-solver` / `CAPTCHA_LLM_API_KEY`,
# and the Deployment's `env:` block must be amended to re-add the
# `valueFrom: secretKeyRef` lookup.
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: 1p-mcp-captcha-solver
  namespace: agentgateway-system
spec:
  refreshInterval: 24h
  secretStoreRef:
    name: 1password-homecluster
    kind: ClusterSecretStore
  target:
    name: mcp-captcha-solver
    creationPolicy: Owner
    deletionPolicy: Retain
    template:
      engineVersion: v2
      type: Opaque
      data:
        CAPTCHA_LLM_API_KEY: "{{ .key }}"
  data:
    - secretKey: key
      remoteRef:
        key: ns_agentgateway/mcp_captcha_solver_llm_api_key