Wire IRC, mail, teamspeak to 1Password secrets

- IRC: OnePasswordItem CRD, ConfigMap templates with inject-credentials initContainers
- Mail: OnePasswordItem CRD, inject-accounts initContainer builds postfix-accounts.cf
- TeamSpeak: OnePasswordItem CRD, TS3SERVER_SERVERADMIN_PASSWORD from secret
- Zero hardcoded passwords remain in these manifests

apps/teamspeak/teamspeak.yaml

@@ -1,108 +1,122 @@
-# TeamSpeak 3 Server
-# ArgoCD managed - BlueJay Lab
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: teamspeak
-  labels:
-    app.kubernetes.io/part-of: bluejay-infra
----
-# TeamSpeak data PVC
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: teamspeak-data
-  namespace: teamspeak
-spec:
-  accessModes: [ReadWriteOnce]
-  resources:
-    requests:
-      storage: 1Gi
----
-# TeamSpeak 3 Deployment
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: teamspeak
-  namespace: teamspeak
-  labels:
-    app: teamspeak
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: teamspeak
-  template:
-    metadata:
-      labels:
-        app: teamspeak
-    spec:
-      containers:
-        - name: teamspeak
-          image: teamspeak:latest
-          ports:
-            - containerPort: 9987
-              name: voice
-              protocol: UDP
-            - containerPort: 30033
-              name: filetransfer
-              protocol: TCP
-            - containerPort: 10011
-              name: serverquery
-              protocol: TCP
-          env:
-            - name: TS3SERVER_LICENSE
-              value: accept
-          volumeMounts:
-            - name: teamspeak-data
-              mountPath: /var/ts3server
-          resources:
-            requests:
-              memory: 128Mi
-              cpu: 50m
-            limits:
-              memory: 512Mi
-              cpu: 500m
-          readinessProbe:
-            tcpSocket:
-              port: 10011
-            initialDelaySeconds: 30
-            periodSeconds: 10
-          livenessProbe:
-            tcpSocket:
-              port: 10011
-            initialDelaySeconds: 60
-            periodSeconds: 15
-      volumes:
-        - name: teamspeak-data
-          persistentVolumeClaim:
-            claimName: teamspeak-data
----
-# TeamSpeak LoadBalancer Service
-apiVersion: v1
-kind: Service
-metadata:
-  name: teamspeak
-  namespace: teamspeak
-  annotations:
-    metallb.universe.tf/loadBalancerIPs: 10.0.56.205
-spec:
-  type: LoadBalancer
-  selector:
-    app: teamspeak
-  ports:
-    - port: 9987
-      targetPort: 9987
-      name: voice
-      protocol: UDP
-    - port: 30033
-      targetPort: 30033
-      name: filetransfer
-      protocol: TCP
-    - port: 10011
-      targetPort: 10011
-      name: serverquery
-      protocol: TCP
+# TeamSpeak 3 Server
+# ArgoCD managed - BlueJay Lab
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: teamspeak
+  labels:
+    app.kubernetes.io/part-of: bluejay-infra
+---
+# 1Password secret sync - TeamSpeak credentials
+apiVersion: onepassword.com/v1
+kind: OnePasswordItem
+metadata:
+  name: teamspeak-credentials
+  namespace: teamspeak
+spec:
+  itemPath: "vaults/IAmWorkin/items/TeamSpeak 3"
+---
+# TeamSpeak data PVC
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: teamspeak-data
+  namespace: teamspeak
+spec:
+  accessModes: [ReadWriteOnce]
+  resources:
+    requests:
+      storage: 1Gi
+---
+# TeamSpeak 3 Deployment
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: teamspeak
+  namespace: teamspeak
+  labels:
+    app: teamspeak
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: teamspeak
+  template:
+    metadata:
+      labels:
+        app: teamspeak
+    spec:
+      containers:
+        - name: teamspeak
+          image: teamspeak:latest
+          ports:
+            - containerPort: 9987
+              name: voice
+              protocol: UDP
+            - containerPort: 30033
+              name: filetransfer
+              protocol: TCP
+            - containerPort: 10011
+              name: serverquery
+              protocol: TCP
+          env:
+            - name: TS3SERVER_LICENSE
+              value: accept
+            - name: TS3SERVER_SERVERADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: teamspeak-credentials
+                  key: ServerQuery Password
+          volumeMounts:
+            - name: teamspeak-data
+              mountPath: /var/ts3server
+          resources:
+            requests:
+              memory: 128Mi
+              cpu: 50m
+            limits:
+              memory: 512Mi
+              cpu: 500m
+          readinessProbe:
+            tcpSocket:
+              port: 10011
+            initialDelaySeconds: 30
+            periodSeconds: 10
+          livenessProbe:
+            tcpSocket:
+              port: 10011
+            initialDelaySeconds: 60
+            periodSeconds: 15
+      volumes:
+        - name: teamspeak-data
+          persistentVolumeClaim:
+            claimName: teamspeak-data
+---
+# TeamSpeak LoadBalancer Service
+apiVersion: v1
+kind: Service
+metadata:
+  name: teamspeak
+  namespace: teamspeak
+  annotations:
+    metallb.universe.tf/loadBalancerIPs: 10.0.56.205
+spec:
+  type: LoadBalancer
+  selector:
+    app: teamspeak
+  ports:
+    - port: 9987
+      targetPort: 9987
+      name: voice
+      protocol: UDP
+    - port: 30033
+      targetPort: 30033
+      name: filetransfer
+      protocol: TCP
+    - port: 10011
+      targetPort: 10011
+      name: serverquery
+      protocol: TCP