blumeops/argocd/manifests/forgejo-runner/external-secret.yaml

# ExternalSecret for Forgejo Runner token
#
# 1Password item: "Forgejo Secrets" in blumeops vault
# Field: runner_reg (runner registration token)
#
# Non-secret env vars (FORGEJO_URL, RUNNER_NAME, RUNNER_LABELS) live in the
# deployment spec so that changes (e.g. image version bumps) trigger a rollout
# automatically.
#
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: forgejo-runner-env
  namespace: forgejo-runner
spec:
  refreshInterval: 1h
  secretStoreRef:
    kind: ClusterSecretStore
    name: onepassword-blumeops
  target:
    name: forgejo-runner-env
    creationPolicy: Owner
  data:
  - secretKey: RUNNER_TOKEN
    remoteRef:
      key: Forgejo Secrets
      property: runner_reg