# EDDI Secrets — TEMPLATE ONLY
# ⚠️  DO NOT commit this file with real values!
#
# Generate the secret using the helper script:
#   bash k8s/create-secrets.sh
#
# Or create manually:
#   kubectl create secret generic eddi-secrets \
#     --namespace=eddi \
#     --from-literal=EDDI_VAULT_MASTER_KEY="$(openssl rand -base64 24)"
#
apiVersion: v1
kind: Secret
metadata:
  name: eddi-secrets
  labels:
    app.kubernetes.io/name: eddi
    app.kubernetes.io/component: server
type: Opaque
stringData:
  # Vault master key — encrypts all stored API keys and secrets.
  # ⚠️  If you lose this key, encrypted secrets are UNRECOVERABLE.
  # Generate: openssl rand -base64 24
  EDDI_VAULT_MASTER_KEY: "CHANGE-ME-GENERATE-A-REAL-KEY"
