Upload folder using huggingface_hub

README.md

@@ -24,9 +24,11 @@ ARF_HMC_MODEL – path to HMC model JSON (default: models/hmc_model.json)
 
 ARF_USE_HYPERPRIORS – true/false
 
-API_KEY – optional (currently not enforced)
+API_KEY – dead setting, not read by any current route (see docs/authentication.md)
 ```
 
+The settings that actually gate access are `ARF_INTERNAL_API_KEY` and `ARF_ADMIN_API_KEY`, not `API_KEY` above — see [docs/authentication.md](docs/authentication.md) for what's actually enforced and what isn't yet.
+
 3. **Run the app locally**:
 
 ```bash

deploy/kubernetes/arf-api/secret.yaml

@@ -1,3 +1,16 @@
+# DO NOT apply this file as-is. Every value below is a placeholder, not a
+# real secret -- ARF_INTERNAL_API_KEY in particular is a fixed, publicly
+# visible string in this repo's git history. Applying it unmodified means
+# the "secret" is a known value, not a secret.
+#
+# Generate real values instead, e.g.:
+#   kubectl create secret generic arf-api-secrets -n arf-system \
+#     --from-literal=DATABASE_URL=... \
+#     --from-literal=ARF_INTERNAL_API_KEY=$(openssl rand -hex 32) \
+#     --from-literal=ARF_API_KEYS='{}' \
+#     --from-literal=ARF_REDIS_URL=...
+# or manage this via a secrets operator (External Secrets, Sealed Secrets,
+# SOPS) rather than a plain committed manifest.
 apiVersion: v1
 kind: Secret
 metadata:
@@ -5,7 +18,7 @@ metadata:
   namespace: arf-system
 type: Opaque
 stringData:
-  # Replace these placeholder values with the actual secrets.
+  # Placeholders only -- see warning above. Replace before applying.
   DATABASE_URL: "postgresql://user:password@host:5432/arf"
   ARF_INTERNAL_API_KEY: "change-me-to-a-strong-random-key"
   ARF_API_KEYS: '{}'