Graham McIntire
6a8ee862bd
The towerops-db secret in prod has both DATABASE_URL and individual POSTGRES_* fields; towerops-redis uses HOST/PORT/PASSWORD instead of a single REDIS_URL. Update the committed template to match so a fresh copy of k8s/secrets.example.yaml mirrors what's actually in the cluster.
101 lines
2.8 KiB
YAML
101 lines
2.8 KiB
YAML
# Unified template for every Kubernetes Secret the towerops Deployment
|
|
# references. Bootstrap your local copy:
|
|
#
|
|
# cp k8s/secrets.example.yaml k8s/secrets.yaml
|
|
# # edit k8s/secrets.yaml — fill in real values
|
|
# kubectl apply -f k8s/secrets.yaml
|
|
# kubectl rollout restart deployment/towerops -n towerops
|
|
#
|
|
# k8s/secrets.yaml is gitignored — never commit real secrets. Real
|
|
# values live in 1Password.
|
|
#
|
|
# Secret-by-secret:
|
|
# * towerops-secrets — application secrets (REQUIRED)
|
|
# * towerops-db — Postgres connection (REQUIRED, envFrom)
|
|
# * towerops-aws — AWS credentials (REQUIRED, envFrom)
|
|
# * towerops-redis — Redis connection (REQUIRED, envFrom)
|
|
# * towerops-billing — Stripe (optional)
|
|
# * towerops-llm — DeepSeek API key for insight enrichment (optional)
|
|
# * gitlab-registry — Docker registry creds (image pull, separate workflow)
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: towerops-secrets
|
|
namespace: towerops
|
|
type: Opaque
|
|
stringData:
|
|
# Generate with: openssl rand -base64 32
|
|
RELEASE_COOKIE: ""
|
|
# Generate with: mix phx.gen.secret (or openssl rand -base64 64)
|
|
SECRET_KEY_BASE: ""
|
|
# Generate with: openssl rand -base64 32
|
|
# CRITICAL: losing this makes encrypted columns unrecoverable.
|
|
CLOAK_KEY: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: towerops-db
|
|
namespace: towerops
|
|
type: Opaque
|
|
stringData:
|
|
# Full ecto:// URL — what runtime.exs reads.
|
|
DATABASE_URL: "ecto://USER:PASSWORD@HOST:5432/DATABASE"
|
|
# The individual fields are convenience for ops — not required by the
|
|
# app but kept here for parity with the existing prod secret.
|
|
POSTGRES_HOST: ""
|
|
POSTGRES_PORT: "5432"
|
|
POSTGRES_DB: ""
|
|
POSTGRES_USER: ""
|
|
POSTGRES_PASSWORD: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: towerops-aws
|
|
namespace: towerops
|
|
type: Opaque
|
|
stringData:
|
|
AWS_ACCESS_KEY_ID: ""
|
|
AWS_SECRET_ACCESS_KEY: ""
|
|
AWS_REGION: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: towerops-redis
|
|
namespace: towerops
|
|
type: Opaque
|
|
stringData:
|
|
# K8s pattern — runtime.exs builds the connection from these
|
|
# individual fields. Dokku alternative is REDIS_URL.
|
|
REDIS_HOST: ""
|
|
REDIS_PORT: "6379"
|
|
REDIS_PASSWORD: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: towerops-billing
|
|
namespace: towerops
|
|
type: Opaque
|
|
stringData:
|
|
# Stripe — every key is optional; the deployment marks them optional: true.
|
|
STRIPE_SECRET_KEY: ""
|
|
STRIPE_WEBHOOK_SECRET: ""
|
|
STRIPE_PRICE_ID: ""
|
|
STRIPE_METER_ID: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: towerops-llm
|
|
namespace: towerops
|
|
type: Opaque
|
|
stringData:
|
|
# DeepSeek API key — get one at https://platform.deepseek.com/
|
|
# Without this, insight LLM enrichment stays no-op (insights still render).
|
|
DEEPSEEK_API_KEY: ""
|
|
# Optional: override the default model (default: deepseek-v4-pro).
|
|
DEEPSEEK_MODEL: ""
|