apiVersion: v1
kind: Secret
metadata:
  name: prop-secrets
  namespace: prop
type: Opaque
stringData:
  DATABASE_URL: "postgres://CHANGE_ME"
  SECRET_KEY_BASE: "CHANGE_ME"
  EMAIL_SERVER: "mail.smtp2go.com"
  EMAIL_USERNAME: "CHANGE_ME"
  EMAIL_PASSWORD: "CHANGE_ME"
  ERA5_CDS_API_KEY: "CHANGE_ME"
  ERA5_CDS_URL: "https://cds.climate.copernicus.eu/api"
  QRZ_USERNAME: "CHANGE_ME"
  QRZ_PASSWORD: "CHANGE_ME"
  GOOGLE_API_KEY: "CHANGE_ME"
  # Prometheus auth token — if set, /metrics requires a matching bearer
  # token via MicrowavepropWeb.MetricsPlug. Required in production (plug
  # denies all requests when unset in prod).
  PROMETHEUS_AUTH_TOKEN: "CHANGE_ME"
  # LiveView signing salt — override the checked-in default "Gdq36xze".
  # A leaked default allows forging of LiveView session tokens.
  LIVE_VIEW_SIGNING_SALT: "CHANGE_ME"
  # Valkey/Redis backend for Microwaveprop.Weather.GridCache. Single
  # cluster-wide cache replaces per-pod ETS replicas. Unset → ETS fallback.
  VALKEY_URL: "redis://CHANGE_ME"