# DO NOT apply this file as-is. Every value below is a placeholder, not a
# real secret -- ARF_INTERNAL_API_KEY in particular is a fixed, publicly
# visible string in this repo's git history. Applying it unmodified means
# the "secret" is a known value, not a secret.
#
# Generate real values instead, e.g.:
#   kubectl create secret generic arf-api-secrets -n arf-system \
#     --from-literal=DATABASE_URL=... \
#     --from-literal=ARF_INTERNAL_API_KEY=$(openssl rand -hex 32) \
#     --from-literal=ARF_API_KEYS='{}' \
#     --from-literal=ARF_REDIS_URL=...
# or manage this via a secrets operator (External Secrets, Sealed Secrets,
# SOPS) rather than a plain committed manifest.
apiVersion: v1
kind: Secret
metadata:
  name: arf-api-secrets
  namespace: arf-system
type: Opaque
stringData:
  # Placeholders only -- see warning above. Replace before applying.
  DATABASE_URL: "postgresql://user:password@host:5432/arf"
  ARF_INTERNAL_API_KEY: "change-me-to-a-strong-random-key"
  ARF_API_KEYS: '{}'
  ARF_REDIS_URL: ""