# Example only. Replace every placeholder and keep the populated file out of Git.
# Provider credentials are required by the production Go API. OSS, public API,
# and webhook secrets can be added to the same Secret or injected separately.
apiVersion: v1
kind: Secret
metadata:
  name: zhinian-migration-db
  namespace: zhinian
type: Opaque
stringData:
  # Manual schema execution only. This connection intentionally uses plaintext.
  DATABASE_URL: "postgresql://MIGRATION_USER:MIGRATION_PASSWORD@RDS_INTERNAL_HOST:5432/APP_DATABASE?sslmode=disable"
---
apiVersion: v1
kind: Secret
metadata:
  name: zhinian-go-auth
  namespace: zhinian
type: Opaque
stringData:
  # Go is the sole owner of session creation and verification. Static Web never
  # receives this signing secret.
  ZHINIAN_AUTH_SESSION_SECRET: REPLACE_WITH_A_DIFFERENT_LONG_RANDOM_VALUE
---
apiVersion: v1
kind: Secret
metadata:
  name: zhinian-go-providers
  namespace: zhinian
type: Opaque
stringData:
  # Optional environment fallbacks for first startup. Values saved from the
  # super-administrator settings page are stored in PostgreSQL and take
  # precedence without restarting the Go workload.
  VOLCENGINE_ACCESS_KEY_ID: REPLACE_WITH_VOLCENGINE_ACCESS_KEY_ID
  VOLCENGINE_SECRET_ACCESS_KEY: REPLACE_WITH_VOLCENGINE_SECRET_ACCESS_KEY
  EVOLINK_API_KEY: REPLACE_WITH_EVOLINK_API_KEY
  BAILIAN_API_KEY: REPLACE_WITH_BAILIAN_API_KEY
  SEEDANCE_API_KEY: REPLACE_WITH_SEEDANCE_API_KEY
  MINIMAX_API_KEY: REPLACE_WITH_MINIMAX_API_KEY
---
apiVersion: v1
kind: Secret
metadata:
  name: zhinian-go-db
  namespace: zhinian
type: Opaque
stringData:
  # Application role (least privilege). PostgreSQL transport is plaintext.
  DATABASE_URL: "postgresql://APP_USER:APP_PASSWORD@RDS_INTERNAL_HOST:5432/APP_DATABASE?sslmode=disable"
---
apiVersion: v1
kind: Secret
metadata:
  name: zhinian-go-bootstrap
  namespace: zhinian
type: Opaque
stringData:
  # First super administrator, created once at Go startup when no super
  # administrator exists. Password must be at least 8 characters.
  ZHINIAN_BOOTSTRAP_ADMIN_PHONE: REPLACE_WITH_ADMIN_PHONE
  ZHINIAN_BOOTSTRAP_ADMIN_PASSWORD: REPLACE_WITH_STRONG_PASSWORD