Graham McIntire
32c9575952
Replace the single-secret towerops-llm template with one multi-document YAML covering every Secret the Deployment references: towerops-secrets, towerops-db, towerops-aws, towerops-redis, towerops-billing, towerops-llm. Workflow: copy k8s/secrets.example.yaml to k8s/secrets.yaml (which is gitignored), fill in real values, kubectl apply. Real values never land in git.
93 lines
2.6 KiB
YAML
93 lines
2.6 KiB
YAML
# Unified template for every Kubernetes Secret the towerops Deployment
|
|
# references. Bootstrap your local copy:
|
|
#
|
|
# cp k8s/secrets.example.yaml k8s/secrets.yaml
|
|
# # edit k8s/secrets.yaml — fill in real values
|
|
# kubectl apply -f k8s/secrets.yaml
|
|
# kubectl rollout restart deployment/towerops -n towerops
|
|
#
|
|
# k8s/secrets.yaml is gitignored — never commit real secrets. Real
|
|
# values live in 1Password.
|
|
#
|
|
# Secret-by-secret:
|
|
# * towerops-secrets — application secrets (REQUIRED)
|
|
# * towerops-db — Postgres connection (REQUIRED, envFrom)
|
|
# * towerops-aws — AWS credentials (REQUIRED, envFrom)
|
|
# * towerops-redis — Redis connection (REQUIRED, envFrom)
|
|
# * towerops-billing — Stripe (optional)
|
|
# * towerops-llm — DeepSeek API key for insight enrichment (optional)
|
|
# * gitlab-registry — Docker registry creds (image pull, separate workflow)
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: towerops-secrets
|
|
namespace: towerops
|
|
type: Opaque
|
|
stringData:
|
|
# Generate with: openssl rand -base64 32
|
|
RELEASE_COOKIE: ""
|
|
# Generate with: mix phx.gen.secret (or openssl rand -base64 64)
|
|
SECRET_KEY_BASE: ""
|
|
# Generate with: openssl rand -base64 32
|
|
# CRITICAL: losing this makes encrypted columns unrecoverable.
|
|
CLOAK_KEY: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: towerops-db
|
|
namespace: towerops
|
|
type: Opaque
|
|
stringData:
|
|
# Full ecto:// URL — used envFrom in the deployment.
|
|
DATABASE_URL: "ecto://USER:PASSWORD@HOST:5432/DATABASE"
|
|
# Optional pool tuning (defaults applied in runtime.exs if unset)
|
|
POOL_SIZE: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: towerops-aws
|
|
namespace: towerops
|
|
type: Opaque
|
|
stringData:
|
|
AWS_ACCESS_KEY_ID: ""
|
|
AWS_SECRET_ACCESS_KEY: ""
|
|
AWS_REGION: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: towerops-redis
|
|
namespace: towerops
|
|
type: Opaque
|
|
stringData:
|
|
# envFrom block injects whatever keys exist here.
|
|
REDIS_URL: "redis://HOST:6379/0"
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: towerops-billing
|
|
namespace: towerops
|
|
type: Opaque
|
|
stringData:
|
|
# Stripe — every key is optional; the deployment marks them optional: true.
|
|
STRIPE_SECRET_KEY: ""
|
|
STRIPE_WEBHOOK_SECRET: ""
|
|
STRIPE_PRICE_ID: ""
|
|
STRIPE_METER_ID: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: towerops-llm
|
|
namespace: towerops
|
|
type: Opaque
|
|
stringData:
|
|
# DeepSeek API key — get one at https://platform.deepseek.com/
|
|
# Without this, insight LLM enrichment stays no-op (insights still render).
|
|
DEEPSEEK_API_KEY: ""
|
|
# Optional: override the default model (default: deepseek-v4-pro).
|
|
DEEPSEEK_MODEL: ""
|