46 lines
1.5 KiB
YAML
46 lines
1.5 KiB
YAML
# Example only. Replace every placeholder and keep the populated file out of Git.
|
|
# Provider, OSS, public API, and webhook secrets are optional add-ons and are
|
|
# intentionally not injected by the minimal production Deployment.
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: zhinian-migration-db
|
|
namespace: zhinian
|
|
type: Opaque
|
|
stringData:
|
|
# Manual schema execution only. This connection intentionally uses plaintext.
|
|
DATABASE_URL: "postgresql://MIGRATION_USER:MIGRATION_PASSWORD@RDS_INTERNAL_HOST:5432/APP_DATABASE?sslmode=disable"
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: zhinian-go-auth
|
|
namespace: zhinian
|
|
type: Opaque
|
|
stringData:
|
|
# Go is the sole owner of session creation and verification. Static Web never
|
|
# receives this signing secret.
|
|
ZHINIAN_AUTH_SESSION_SECRET: REPLACE_WITH_A_DIFFERENT_LONG_RANDOM_VALUE
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: zhinian-go-db
|
|
namespace: zhinian
|
|
type: Opaque
|
|
stringData:
|
|
# Application role (least privilege). PostgreSQL transport is plaintext.
|
|
DATABASE_URL: "postgresql://APP_USER:APP_PASSWORD@RDS_INTERNAL_HOST:5432/APP_DATABASE?sslmode=disable"
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: zhinian-go-bootstrap
|
|
namespace: zhinian
|
|
type: Opaque
|
|
stringData:
|
|
# First super administrator, created once at Go startup when no super
|
|
# administrator exists. Password must be at least 8 characters.
|
|
ZHINIAN_BOOTSTRAP_ADMIN_PHONE: REPLACE_WITH_ADMIN_PHONE
|
|
ZHINIAN_BOOTSTRAP_ADMIN_PASSWORD: REPLACE_WITH_STRONG_PASSWORD
|