# services/monitoring/grafana-smtp-sync-script.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: grafana-smtp-sync-script
  namespace: monitoring
data:
  sync.sh: |
    #!/bin/sh
    set -euo pipefail

    SOURCE_NS=${SOURCE_NS:-mailu-mailserver}
    SOURCE_SECRET=${SOURCE_SECRET:-mailu-postmark-relay}
    TARGET_NS=${TARGET_NS:-monitoring}
    TARGET_SECRET=${TARGET_SECRET:-grafana-smtp}

    tmp=$(mktemp)
    cleanup() { rm -f "$tmp"; }
    trap cleanup EXIT

    kubectl -n "$SOURCE_NS" get secret "$SOURCE_SECRET" -o json > "$tmp"

    user=$(jq -r '.data["relay-username"]' "$tmp")
    pass=$(jq -r '.data["relay-password"]' "$tmp")

    if [ -z "$user" ] || [ -z "$pass" ] || [ "$user" = "null" ] || [ "$pass" = "null" ]; then
      echo "missing credentials from $SOURCE_NS/$SOURCE_SECRET" >&2
      exit 1
    fi

    cat <<SECRET | kubectl -n "$TARGET_NS" apply -f -
    apiVersion: v1
    kind: Secret
    metadata:
      name: $TARGET_SECRET
    stringData:
      username: $(echo "$user" | base64 -d)
      password: $(echo "$pass" | base64 -d)
    SECRET