98 lines
3.0 KiB
YAML
98 lines
3.0 KiB
YAML
# Example only. Replace every placeholder and keep the populated file out of Git.
|
|
# Secrets marked "(local development only)" are not referenced by the first
|
|
# production deployment; keep or drop them as your local workflow requires.
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: zhinian-web-db
|
|
namespace: zhinian
|
|
type: Opaque
|
|
stringData:
|
|
# Local development only: the production Web workload holds no RDS credentials.
|
|
DATABASE_URL: postgresql://APP_USER:APP_PASSWORD@RDS_INTERNAL_HOST:5432/APP_DATABASE
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: zhinian-migration-db
|
|
namespace: zhinian
|
|
type: Opaque
|
|
stringData:
|
|
# Manual schema execution only: run database/migrations/*.sql with this role.
|
|
DATABASE_URL: postgresql://MIGRATION_USER:MIGRATION_PASSWORD@RDS_INTERNAL_HOST:5432/APP_DATABASE
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: zhinian-worker-auth
|
|
namespace: zhinian
|
|
type: Opaque
|
|
stringData:
|
|
# Local development only: the Node Worker is not deployed in production.
|
|
ZHINIAN_INTERNAL_WORKER_TOKEN: REPLACE_WITH_A_LONG_RANDOM_VALUE
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: zhinian-web-auth
|
|
namespace: zhinian
|
|
type: Opaque
|
|
stringData:
|
|
# Shared by the Next.js middleware and the Go backend so both verify the
|
|
# same session cookies. Keep identical across workloads.
|
|
ZHINIAN_AUTH_SESSION_SECRET: REPLACE_WITH_A_DIFFERENT_LONG_RANDOM_VALUE
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: zhinian-go-db
|
|
namespace: zhinian
|
|
type: Opaque
|
|
stringData:
|
|
# Application role (least privilege): grants applied manually after the SQL.
|
|
DATABASE_URL: postgresql://APP_USER:APP_PASSWORD@RDS_INTERNAL_HOST:5432/APP_DATABASE
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: zhinian-go-bootstrap
|
|
namespace: zhinian
|
|
type: Opaque
|
|
stringData:
|
|
# First super administrator, created once at Go startup when no super
|
|
# administrator exists. Password must be at least 8 characters.
|
|
ZHINIAN_BOOTSTRAP_ADMIN_PHONE: REPLACE_WITH_ADMIN_PHONE
|
|
ZHINIAN_BOOTSTRAP_ADMIN_PASSWORD: REPLACE_WITH_STRONG_PASSWORD
|
|
ZHINIAN_BOOTSTRAP_ADMIN_NAME: 平台超级管理员
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: zhinian-go-providers
|
|
namespace: zhinian
|
|
type: Opaque
|
|
stringData:
|
|
# Provider credentials. Delete keys for providers you do not use; the Go
|
|
# workload tolerates missing optional keys and fails closed when an enabled
|
|
# engine has no credentials.
|
|
VOLCENGINE_ACCESS_KEY_ID: REPLACE_OR_REMOVE
|
|
VOLCENGINE_SECRET_ACCESS_KEY: REPLACE_OR_REMOVE
|
|
JIMENG_IMAGE_GENERATE_46_REQ_KEY: REPLACE_OR_REMOVE
|
|
EVOLINK_API_KEY: REPLACE_OR_REMOVE
|
|
SEEDANCE_API_KEY: REPLACE_OR_REMOVE
|
|
BAILIAN_API_KEY: REPLACE_OR_REMOVE
|
|
DASHSCOPE_API_KEY: REPLACE_OR_REMOVE
|
|
ALI_OSS_ACCESS_KEY_ID: REPLACE_OR_REMOVE
|
|
ALI_OSS_ACCESS_KEY_SECRET: REPLACE_OR_REMOVE
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: zhinian-go-secrets
|
|
namespace: zhinian
|
|
type: Opaque
|
|
stringData:
|
|
ZHINIAN_WEBHOOK_SECRET: REPLACE_WITH_A_LONG_RANDOM_VALUE
|
|
ZHINIAN_API_KEYS: REPLACE_WITH_PUBLIC_API_KEYS
|
|
ZHINIAN_INTERNAL_WORKER_TOKEN: REPLACE_OR_REMOVE
|