From 6a8ee862bd7246d83761684765b64f82eaf5807f Mon Sep 17 00:00:00 2001
From: Graham McIntire <graham@mcintire.me>
Date: Sat, 9 May 2026 18:08:52 -0500
Subject: [PATCH] chore(k8s): align secrets template with prod secret schema

The towerops-db secret in prod has both DATABASE_URL and individual
POSTGRES_* fields; towerops-redis uses HOST/PORT/PASSWORD instead of
a single REDIS_URL. Update the committed template to match so a fresh
copy of k8s/secrets.example.yaml mirrors what's actually in the
cluster.
---
 k8s/secrets.example.yaml | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/k8s/secrets.example.yaml b/k8s/secrets.example.yaml
index 4f92d330..60cbe8bd 100644
--- a/k8s/secrets.example.yaml
+++ b/k8s/secrets.example.yaml
@@ -40,10 +40,15 @@ metadata:
   namespace: towerops
 type: Opaque
 stringData:
-  # Full ecto:// URL — used envFrom in the deployment.
+  # Full ecto:// URL — what runtime.exs reads.
   DATABASE_URL: "ecto://USER:PASSWORD@HOST:5432/DATABASE"
-  # Optional pool tuning (defaults applied in runtime.exs if unset)
-  POOL_SIZE: ""
+  # The individual fields are convenience for ops — not required by the
+  # app but kept here for parity with the existing prod secret.
+  POSTGRES_HOST: ""
+  POSTGRES_PORT: "5432"
+  POSTGRES_DB: ""
+  POSTGRES_USER: ""
+  POSTGRES_PASSWORD: ""
 ---
 apiVersion: v1
 kind: Secret
@@ -63,8 +68,11 @@ metadata:
   namespace: towerops
 type: Opaque
 stringData:
-  # envFrom block injects whatever keys exist here.
-  REDIS_URL: "redis://HOST:6379/0"
+  # K8s pattern — runtime.exs builds the connection from these
+  # individual fields. Dokku alternative is REDIS_URL.
+  REDIS_HOST: ""
+  REDIS_PORT: "6379"
+  REDIS_PASSWORD: ""
 ---
 apiVersion: v1
 kind: Secret