This is actually working

everything-app/wg-access-server.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: wg-access-server
+  namespace: argocd
+spec:
+  destination:
+    namespace: wg-access
+    server: https://kubernetes.default.svc
+  project: infra
+  source:
+    helm:
+      parameters:
+      - name: web.service.type
+        value: LoadBalancer
+      - name: wireguard.service.type
+        value: LoadBalancer
+      values: |-
+        config:
+          csiSecretsStore:
+            providerName: 1password
+            resourceName: vaults/3oh5jxmxvqvpuimu2lbuajtizi/allitems/idkjj6oyua2fq6df4fkjzmh4ne/config.yaml
+    path: apps-helm/wg-access-server
+    repoURL: https://git.martyn.berlin/martyn/infra4talos
+    targetRevision: HEAD