85 lines
3.0 KiB
YAML
85 lines
3.0 KiB
YAML
# Example only. Replace every placeholder and keep the populated file out of Git.
|
|
# Provider credentials are required by the production Go API. OSS, public API,
|
|
# and webhook secrets can be added to the same Secret or injected separately.
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: zhinian-migration-db
|
|
namespace: zhinian
|
|
type: Opaque
|
|
stringData:
|
|
# Startup migration connection, also usable for manual migrations. This
|
|
# account needs schema ownership/DDL and grant permissions. Plaintext RDS
|
|
# transport is limited to the private VPC by this deployment's DB policy.
|
|
DATABASE_URL: "postgresql://MIGRATION_USER:MIGRATION_PASSWORD@RDS_INTERNAL_HOST:5432/APP_DATABASE?sslmode=disable"
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: zhinian-go-auth
|
|
namespace: zhinian
|
|
type: Opaque
|
|
stringData:
|
|
# Go is the sole owner of session creation and verification. Static Web never
|
|
# receives this signing secret.
|
|
ZHINIAN_AUTH_SESSION_SECRET: REPLACE_WITH_A_DIFFERENT_LONG_RANDOM_VALUE
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: zhinian-go-providers
|
|
namespace: zhinian
|
|
type: Opaque
|
|
stringData:
|
|
# Optional environment fallbacks for first startup. Values saved from the
|
|
# super-administrator settings page are stored in PostgreSQL and take
|
|
# precedence without restarting the Go workload.
|
|
VOLCENGINE_ACCESS_KEY_ID: REPLACE_WITH_VOLCENGINE_ACCESS_KEY_ID
|
|
VOLCENGINE_SECRET_ACCESS_KEY: REPLACE_WITH_VOLCENGINE_SECRET_ACCESS_KEY
|
|
EVOLINK_API_KEY: REPLACE_WITH_EVOLINK_API_KEY
|
|
BAILIAN_API_KEY: REPLACE_WITH_BAILIAN_API_KEY
|
|
SEEDANCE_API_KEY: REPLACE_WITH_SEEDANCE_API_KEY
|
|
MINIMAX_API_KEY: REPLACE_WITH_MINIMAX_API_KEY
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: zhinian-go-db
|
|
namespace: zhinian
|
|
type: Opaque
|
|
stringData:
|
|
# Least-privilege application role. Set DATABASE_APP_ROLE in configmap.yaml
|
|
# to this connection's PostgreSQL user (APP_USER) so migrations grant it
|
|
# access to new tables/functions. PostgreSQL transport is plaintext.
|
|
DATABASE_URL: "postgresql://APP_USER:APP_PASSWORD@RDS_INTERNAL_HOST:5432/APP_DATABASE?sslmode=disable"
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: zhinian-go-bootstrap
|
|
namespace: zhinian
|
|
type: Opaque
|
|
stringData:
|
|
# First super administrator, created once at Go startup when no super
|
|
# administrator exists. Password must be at least 8 characters.
|
|
ZHINIAN_BOOTSTRAP_ADMIN_PHONE: REPLACE_WITH_ADMIN_PHONE
|
|
ZHINIAN_BOOTSTRAP_ADMIN_PASSWORD: REPLACE_WITH_STRONG_PASSWORD
|
|
---
|
|
# Optional. Apply only when enabling WeChat Native payments; Go-only envFrom.
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: zhinian-go-wechat-pay
|
|
namespace: zhinian
|
|
type: Opaque
|
|
stringData:
|
|
WECHAT_PAY_MCH_ID: REPLACE_WITH_MERCHANT_ID
|
|
WECHAT_PAY_APP_ID: REPLACE_WITH_BOUND_APP_ID
|
|
WECHAT_PAY_MERCHANT_SERIAL: REPLACE_WITH_MERCHANT_CERT_SERIAL
|
|
WECHAT_PAY_API_V3_KEY: REPLACE_WITH_32_BYTE_API_V3_KEY
|
|
WECHAT_PAY_PUBLIC_KEY_ID: REPLACE_WITH_WECHAT_PUBLIC_KEY_ID
|
|
WECHAT_PAY_PRIVATE_KEY_PEM: |
|
|
REPLACE_WITH_PKCS8_MERCHANT_PRIVATE_KEY_PEM
|
|
WECHAT_PAY_PUBLIC_KEY_PEM: |
|
|
REPLACE_WITH_WECHAT_PAYMENT_PUBLIC_KEY_PEM
|