# TEMPLATE — replace every REPLACE_ME before applying, then either
# `kubectl apply -f 02-secrets.yaml` or, better, keep this file out of
# git and manage it with `kubectl create secret generic` / sealed-secrets
# / SOPS instead. Postgres/RabbitMQ passwords are pre-filled with the
# same "enkly" default the app ships with (see .env.example) purely so
# the stack comes up unmodified on first try — rotate them before any
# real deployment.
apiVersion: v1
kind: Secret
metadata:
  name: enkly-secrets
  namespace: enkly
type: Opaque
stringData:
  POSTGRES_PASSWORD: "enkly"
  RABBITMQ_DEFAULT_PASS: "enkly"
  ENKLY_RABBITMQ_URL: "amqp://enkly:enkly@rabbitmq:5672/"

  STRIPE_SECRET_KEY: "sk_test_51Sk6S809EijW3hh9YFenSRh3gT2R8QzQ1XwDb4GpgwZx7k1zADSY4ApXh92fP39Clbn5vieX5vKYRM8Ts4t878S800OJfRc1zf"
  STRIPE_PUBLISH_KEY: "pk_test_51Sk6S809EijW3hh95Tu0y6PyjbYXEKNus9dPlgFFCFqm3WYNRgO8dK2qoUGSbaRT4fDCQko1wyUQ2PrqbfP1FQD100xrrf9gzY"
  STRIPE_WEBHOOK_SECRET: ""
  STRIPE_PRICE_BASIC: "5"
  STRIPE_PRICE_PRO: "8"
  STRIPE_PRICE_PREMIUM: "12"

  ENKLY_SMTP_USERNAME: "contact.enkly@gmail.com"
  ENKLY_SMTP_PASSWORD: "ntqjsksezwjqpcac"

  # vLLM (11-vllm.yaml). ENKLY_VLLM_API_KEY is the bearer token both
  # vllm-chat and vllm-embed require (--api-key) and that agent/
  # knowledge authenticate with (see services/agent/cmd/server/main.go,
  # services/knowledge/cmd/server/main.go — both read this exact env
  # var and default to "" if it's unset, which vLLM's --api-key will
  # then reject with a 401 on every single request). Generate a real
  # value BEFORE applying this file — YAML stringData does not run
  # shell commands, so a literal "$(openssl rand -hex 32)" string here
  # would silently become the actual, non-random API key instead of
  # being executed:
  #   kubectl create secret generic enkly-secrets -n enkly \
  #     --from-literal=ENKLY_VLLM_API_KEY=$(openssl rand -hex 32) --dry-run=client -o yaml
  # or just replace the line below by hand with a real random string.
  ENKLY_VLLM_API_KEY: "OWVmOGNiZjM1YzFjNjUxNTY0YWJlMWZmYTg0M2FiYWM5ZTkwMjI3NDBmZjAwMzVjMDdlZDUwMjNlZTg1MTk1OQ=="
  # HUGGING_FACE_HUB_TOKEN is only required if Qwen/Qwen2.5-3B-Instruct
  # or nomic-ai/nomic-embed-text-v1.5 is gated/private for this org's
  # HF account; both are public weights today, so leave this as an
  # empty string unless that changes. Re-added now that 11-vllm.yaml
  # pulls straight from the Hugging Face Hub again (unlike the brief
  # Ollama detour, which pulled from Ollama's own registry instead).
  HUGGING_FACE_HUB_TOKEN: ""

# Pull secret for registry.enkly.org. Do NOT hand-edit this one — it's
# generated, not templated, because .dockerconfigjson must be valid
# base64 JSON. Create it with:
#
#   kubectl create secret docker-registry enkly-registry \
#     --namespace enkly \
#     --docker-server=registry.enkly.org \
#     --docker-username=<user> \
#     --docker-password=<password-or-token> \
#     --docker-email=<email>
#
# Every Deployment below references it as imagePullSecrets: [enkly-registry].
# If registry.enkly.org serves a self-signed/internal CA certificate,
# that trust also has to be configured at the containerd level on
# every node (/etc/containerd/certs.d/registry.enkly.org/hosts.toml) —
# that's node config, not something a k8s manifest can do; see the
# README's "Known issues to fix" section.