# Unified template for every Kubernetes Secret the towerops Deployment
# references. Bootstrap your local copy:
#
#   cp k8s/secrets.example.yaml k8s/secrets.yaml
#   # edit k8s/secrets.yaml — fill in real values
#   kubectl apply -f k8s/secrets.yaml
#   kubectl rollout restart deployment/towerops -n towerops
#
# k8s/secrets.yaml is gitignored — never commit real secrets. Real
# values live in 1Password.
#
# Secret-by-secret:
#   * towerops-secrets — application secrets (REQUIRED)
#   * towerops-db      — Postgres connection (REQUIRED, envFrom)
#   * towerops-aws     — AWS credentials (REQUIRED, envFrom)
#   * towerops-redis   — Redis connection (REQUIRED, envFrom)
#   * towerops-billing — Stripe (optional)
#   * towerops-llm     — DeepSeek API key for insight enrichment (optional)
#   * gitlab-registry  — Docker registry creds (image pull, separate workflow)
---
apiVersion: v1
kind: Secret
metadata:
  name: towerops-secrets
  namespace: towerops
type: Opaque
stringData:
  # Generate with: openssl rand -base64 32
  RELEASE_COOKIE: ""
  # Generate with: mix phx.gen.secret  (or openssl rand -base64 64)
  SECRET_KEY_BASE: ""
  # Generate with: openssl rand -base64 32
  # CRITICAL: losing this makes encrypted columns unrecoverable.
  CLOAK_KEY: ""
---
apiVersion: v1
kind: Secret
metadata:
  name: towerops-db
  namespace: towerops
type: Opaque
stringData:
  # Full ecto:// URL — what runtime.exs reads.
  DATABASE_URL: "ecto://USER:PASSWORD@HOST:5432/DATABASE"
  # The individual fields are convenience for ops — not required by the
  # app but kept here for parity with the existing prod secret.
  POSTGRES_HOST: ""
  POSTGRES_PORT: "5432"
  POSTGRES_DB: ""
  POSTGRES_USER: ""
  POSTGRES_PASSWORD: ""
---
apiVersion: v1
kind: Secret
metadata:
  name: towerops-aws
  namespace: towerops
type: Opaque
stringData:
  AWS_ACCESS_KEY_ID: ""
  AWS_SECRET_ACCESS_KEY: ""
  AWS_REGION: ""
---
apiVersion: v1
kind: Secret
metadata:
  name: towerops-redis
  namespace: towerops
type: Opaque
stringData:
  # K8s pattern — runtime.exs builds the connection from these
  # individual fields. Dokku alternative is REDIS_URL.
  REDIS_HOST: ""
  REDIS_PORT: "6379"
  REDIS_PASSWORD: ""
---
apiVersion: v1
kind: Secret
metadata:
  name: towerops-billing
  namespace: towerops
type: Opaque
stringData:
  # Stripe — every key is optional; the deployment marks them optional: true.
  STRIPE_SECRET_KEY: ""
  STRIPE_WEBHOOK_SECRET: ""
  STRIPE_PRICE_ID: ""
  STRIPE_METER_ID: ""
---
apiVersion: v1
kind: Secret
metadata:
  name: towerops-llm
  namespace: towerops
type: Opaque
stringData:
  # DeepSeek API key — get one at https://platform.deepseek.com/
  # Without this, insight LLM enrichment stays no-op (insights still render).
  DEEPSEEK_API_KEY: ""
  # Optional: override the default model (default: deepseek-v4-pro).
  DEEPSEEK_MODEL: ""