# =============================================================================
# AI Software Factory — Secret (TEMPLATE — contains NO real values)
# =============================================================================
#
#   ⚠️  WARNING — READ BEFORE USING  ⚠️
#
#   This file is an EXAMPLE ONLY. It ships in source control on purpose so
#   the expected keys are documented, but it must NEVER contain real values,
#   and you must NEVER `kubectl apply` this file as-is in a real cluster.
#
#   Choose ONE of these strategies for real secrets:
#
#   1. SealedSecrets (RECOMMENDED, works with any cluster):
#        sealed-secrets create secret.example.yaml   →  produces a
#        sealedsecret.yaml that is safe to commit; only the controller can
#        decrypt it.
#
#   2. SOPS + age/PGP (values encrypted at rest, decrypt via CI/cluster agent):
#        sops -e --in-place secret.example.yaml
#        + sops-encryptor / external-secrets for cluster-side decryption.
#
#   3. External Secrets Operator (values live in AWS Secrets Manager / Vault):
#        create the AWS Secret, then an ExternalSecret resource pointing at
#        it; the controller materializes a native Secret in the cluster.
#
#   For a throwaway cluster you may `kubectl create secret` from a local
#   (git-ignored) file — but keep it out of VCS and out of CI logs.
#
# =============================================================================
apiVersion: v1
kind: Secret
metadata:
  name: factory-secrets
  # ⚠️ Replace placeholder values using one of the strategies above.
type: Opaque
stringData:
  # --- Database (used to build the DATABASE_URL consumed by the apps) ---
  # The apps read .env.example-style variable names; the API/worker/realtime
  # manifests can be given the full URL directly:
  #   DATABASE_URL: postgresql://factory:<password>@factory-db:5432/factory?schema=public
  # (put the full DATABASE_URL here rather than assembling it at runtime).
  POSTGRES_USER: "factory"
  POSTGRES_PASSWORD: "CHANGE-ME"
  POSTGRES_DB: "factory"
  DATABASE_URL: "postgresql://factory:CHANGE-ME@factory-db:5432/factory?schema=public"

  # --- Auth / sessions ---
  JWT_SECRET: "CHANGE-ME-64-RANDOM-BYTES"
  REFRESH_TOKEN_SECRET: "CHANGE-ME-ANOTHER-64-RANDOM-BYTES"
  SESSION_SECRET: "CHANGE-ME-SESSION-SECRET"
  MASTER_ENCRYPTION_KEY: "CHANGE-ME-BASE64-32-BYTES"

  # --- Object storage (S3-compatible) ---
  S3_ACCESS_KEY: "CHANGE-ME"
  S3_SECRET_KEY: "CHANGE-ME"

  # --- Search (only if your OpenSearch requires auth) ---
  SEARCH_USERNAME: ""
  SEARCH_PASSWORD: ""

  # --- AI gateway ---
  AI_API_KEY: ""

  # --- Email (SMTP) ---
  SMTP_USER: ""
  SMTP_PASSWORD: ""
---
# Postgres bootstrap secret used by the StatefulSet in postgres/statefulset.yaml
# (envFrom secretRef: factory-db). Keep in sync with factory-secrets.
apiVersion: v1
kind: Secret
metadata:
  name: factory-db
type: Opaque
stringData:
  POSTGRES_USER: "factory"
  POSTGRES_PASSWORD: "CHANGE-ME"
  POSTGRES_DB: "factory"