1# =============================================================================
2# AI Software Factory — Secret (TEMPLATE — contains NO real values)
3# =============================================================================
4#
5# ⚠️ WARNING — READ BEFORE USING ⚠️
6#
7# This file is an EXAMPLE ONLY. It ships in source control on purpose so
8# the expected keys are documented, but it must NEVER contain real values,
9# and you must NEVER `kubectl apply` this file as-is in a real cluster.
10#
11# Choose ONE of these strategies for real secrets:
12#
13# 1. SealedSecrets (RECOMMENDED, works with any cluster):
14# sealed-secrets create secret.example.yaml → produces a
15# sealedsecret.yaml that is safe to commit; only the controller can
16# decrypt it.
17#
18# 2. SOPS + age/PGP (values encrypted at rest, decrypt via CI/cluster agent):
19# sops -e --in-place secret.example.yaml
20# + sops-encryptor / external-secrets for cluster-side decryption.
21#
22# 3. External Secrets Operator (values live in AWS Secrets Manager / Vault):
23# create the AWS Secret, then an ExternalSecret resource pointing at
24# it; the controller materializes a native Secret in the cluster.
25#
26# For a throwaway cluster you may `kubectl create secret` from a local
27# (git-ignored) file — but keep it out of VCS and out of CI logs.
28#
29# =============================================================================
30apiVersion: v1
31kind: Secret
32metadata:
33 name: factory-secrets
34 # ⚠️ Replace placeholder values using one of the strategies above.
35type: Opaque
36stringData:
37 # --- Database (used to build the DATABASE_URL consumed by the apps) ---
38 # The apps read .env.example-style variable names; the API/worker/realtime
39 # manifests can be given the full URL directly:
40 # DATABASE_URL: postgresql:
41 # (put the full DATABASE_URL here rather than assembling it at runtime).
42 POSTGRES_USER: "factory"
43 POSTGRES_PASSWORD: "CHANGE-ME"
44 POSTGRES_DB: "factory"
45 DATABASE_URL: "postgresql://factory:CHANGE-ME@factory-db:5432/factory?schema=public"
46
47 # --- Auth / sessions ---
48 JWT_SECRET: "CHANGE-ME-64-RANDOM-BYTES"
49 REFRESH_TOKEN_SECRET: "CHANGE-ME-ANOTHER-64-RANDOM-BYTES"
50 SESSION_SECRET: "CHANGE-ME-SESSION-SECRET"
51 MASTER_ENCRYPTION_KEY: "CHANGE-ME-BASE64-32-BYTES"
52
53 # --- Object storage (S3-compatible) ---
54 S3_ACCESS_KEY: "CHANGE-ME"
55 S3_SECRET_KEY: "CHANGE-ME"
56
57 # --- Search (only if your OpenSearch requires auth) ---
58 SEARCH_USERNAME: ""
59 SEARCH_PASSWORD: ""
60
61 # --- AI gateway ---
62 AI_API_KEY: ""
63
64 # --- Email (SMTP) ---
65 SMTP_USER: ""
66 SMTP_PASSWORD: ""
67---
68# Postgres bootstrap secret used by the StatefulSet in postgres/statefulset.yaml
69# (envFrom secretRef: factory-db). Keep in sync with factory-secrets.
70apiVersion: v1
71kind: Secret
72metadata:
73 name: factory-db
74type: Opaque
75stringData:
76 POSTGRES_USER: "factory"
77 POSTGRES_PASSWORD: "CHANGE-ME"
78 POSTGRES_DB: "factory"
79
