68 lines
3.3 KiB
YAML
68 lines
3.3 KiB
YAML
# TEMPLATE — replace every REPLACE_ME before applying, then either
|
|
# `kubectl apply -f 02-secrets.yaml` or, better, keep this file out of
|
|
# git and manage it with `kubectl create secret generic` / sealed-secrets
|
|
# / SOPS instead. Postgres/RabbitMQ passwords are pre-filled with the
|
|
# same "enkly" default the app ships with (see .env.example) purely so
|
|
# the stack comes up unmodified on first try — rotate them before any
|
|
# real deployment.
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: enkly-secrets
|
|
namespace: enkly
|
|
type: Opaque
|
|
stringData:
|
|
POSTGRES_PASSWORD: "enkly"
|
|
RABBITMQ_DEFAULT_PASS: "enkly"
|
|
ENKLY_RABBITMQ_URL: "amqp://enkly:enkly@rabbitmq:5672/"
|
|
|
|
STRIPE_SECRET_KEY: "sk_test_51Sk6S809EijW3hh9YFenSRh3gT2R8QzQ1XwDb4GpgwZx7k1zADSY4ApXh92fP39Clbn5vieX5vKYRM8Ts4t878S800OJfRc1zf"
|
|
STRIPE_PUBLISH_KEY: "pk_test_51Sk6S809EijW3hh95Tu0y6PyjbYXEKNus9dPlgFFCFqm3WYNRgO8dK2qoUGSbaRT4fDCQko1wyUQ2PrqbfP1FQD100xrrf9gzY"
|
|
STRIPE_WEBHOOK_SECRET: ""
|
|
STRIPE_PRICE_BASIC: "5"
|
|
STRIPE_PRICE_PRO: "8"
|
|
STRIPE_PRICE_PREMIUM: "12"
|
|
|
|
ENKLY_SMTP_USERNAME: "contact.enkly@gmail.com"
|
|
ENKLY_SMTP_PASSWORD: "ntqjsksezwjqpcac"
|
|
|
|
# vLLM (11-vllm.yaml). ENKLY_VLLM_API_KEY is the bearer token both
|
|
# vllm-chat and vllm-embed require (--api-key) and that agent/
|
|
# knowledge authenticate with (see services/agent/cmd/server/main.go,
|
|
# services/knowledge/cmd/server/main.go — both read this exact env
|
|
# var and default to "" if it's unset, which vLLM's --api-key will
|
|
# then reject with a 401 on every single request). Generate a real
|
|
# value BEFORE applying this file — YAML stringData does not run
|
|
# shell commands, so a literal "$(openssl rand -hex 32)" string here
|
|
# would silently become the actual, non-random API key instead of
|
|
# being executed:
|
|
# kubectl create secret generic enkly-secrets -n enkly \
|
|
# --from-literal=ENKLY_VLLM_API_KEY=$(openssl rand -hex 32) --dry-run=client -o yaml
|
|
# or just replace the line below by hand with a real random string.
|
|
ENKLY_VLLM_API_KEY: "OWVmOGNiZjM1YzFjNjUxNTY0YWJlMWZmYTg0M2FiYWM5ZTkwMjI3NDBmZjAwMzVjMDdlZDUwMjNlZTg1MTk1OQ=="
|
|
# HUGGING_FACE_HUB_TOKEN is only required if Qwen/Qwen2.5-3B-Instruct
|
|
# or nomic-ai/nomic-embed-text-v1.5 is gated/private for this org's
|
|
# HF account; both are public weights today, so leave this as an
|
|
# empty string unless that changes. Re-added now that 11-vllm.yaml
|
|
# pulls straight from the Hugging Face Hub again (unlike the brief
|
|
# Ollama detour, which pulled from Ollama's own registry instead).
|
|
HUGGING_FACE_HUB_TOKEN: ""
|
|
|
|
# Pull secret for registry.enkly.org. Do NOT hand-edit this one — it's
|
|
# generated, not templated, because .dockerconfigjson must be valid
|
|
# base64 JSON. Create it with:
|
|
#
|
|
# kubectl create secret docker-registry enkly-registry \
|
|
# --namespace enkly \
|
|
# --docker-server=registry.enkly.org \
|
|
# --docker-username=<user> \
|
|
# --docker-password=<password-or-token> \
|
|
# --docker-email=<email>
|
|
#
|
|
# Every Deployment below references it as imagePullSecrets: [enkly-registry].
|
|
# If registry.enkly.org serves a self-signed/internal CA certificate,
|
|
# that trust also has to be configured at the containerd level on
|
|
# every node (/etc/containerd/certs.d/registry.enkly.org/hosts.toml) —
|
|
# that's node config, not something a k8s manifest can do; see the
|
|
# README's "Known issues to fix" section.
|