# Example only. Replace every placeholder and keep the populated file out of Git.
# Provider, OSS, public API, and webhook secrets are optional add-ons and are
# intentionally not injected by the minimal production Deployment.
apiVersion: v1
kind: Secret
metadata:
  name: zhinian-rds-ca
  namespace: zhinian
type: Opaque
stringData:
  # Public CA certificate for the RDS endpoint used in DATABASE_URL.
  ca.pem: |
    REPLACE_WITH_RDS_CA_PEM
---
apiVersion: v1
kind: Secret
metadata:
  name: zhinian-migration-db
  namespace: zhinian
type: Opaque
stringData:
  # Manual schema execution only: run database/migrations/*.sql with this role.
  DATABASE_URL: "postgresql://MIGRATION_USER:MIGRATION_PASSWORD@RDS_INTERNAL_HOST:5432/APP_DATABASE?sslmode=verify-full&sslrootcert=/etc/zhinian/rds/ca.pem"
---
apiVersion: v1
kind: Secret
metadata:
  name: zhinian-web-auth
  namespace: zhinian
type: Opaque
stringData:
  # Shared by the Next.js middleware and the Go backend so both verify the
  # same session cookies. Keep identical across workloads.
  ZHINIAN_AUTH_SESSION_SECRET: REPLACE_WITH_A_DIFFERENT_LONG_RANDOM_VALUE
---
apiVersion: v1
kind: Secret
metadata:
  name: zhinian-go-db
  namespace: zhinian
type: Opaque
stringData:
  # Application role (least privilege): grants applied manually after the SQL.
  DATABASE_URL: "postgresql://APP_USER:APP_PASSWORD@RDS_INTERNAL_HOST:5432/APP_DATABASE?sslmode=verify-full&sslrootcert=/etc/zhinian/rds/ca.pem"
---
apiVersion: v1
kind: Secret
metadata:
  name: zhinian-go-bootstrap
  namespace: zhinian
type: Opaque
stringData:
  # First super administrator, created once at Go startup when no super
  # administrator exists. Password must be at least 8 characters.
  ZHINIAN_BOOTSTRAP_ADMIN_PHONE: REPLACE_WITH_ADMIN_PHONE
  ZHINIAN_BOOTSTRAP_ADMIN_PASSWORD: REPLACE_WITH_STRONG_PASSWORD