apiVersion: v1
kind: Secret
metadata:
  name: healthchecks-config
  namespace: felhom-system
type: Opaque
stringData:
  # === REQUIRED: Generate a random key ===
  # python3 -c "import secrets; print(secrets.token_urlsafe(50))"
  SECRET_KEY: "jumZn0XOcO1oDs77siMCgfkg0S2JGLHUiKBAxGleUF0KodBg6SHj-mcLNPxt29Wb6pk"

  # === REQUIRED: Superuser for first login ===
  SUPERUSER_EMAIL: "admin@felhom.eu"
  SUPERUSER_PASSWORD: "doodooP4ssWD001!"

  # === REQUIRED: SMTP via Resend.com ===
  EMAIL_HOST: "smtp.resend.com"
  EMAIL_PORT: "587"
  EMAIL_HOST_USER: "resend"
  # Resend API key — NOT committed. Healthchecks is not currently deployed; when it is, wire its
  # EMAIL_HOST_PASSWORD to the out-of-band Secret/resend-api (key RESEND_API_KEY) via secretKeyRef
  # instead of inlining a value here. See documentation/runbooks/secrets.md.
  EMAIL_HOST_PASSWORD: ""
  EMAIL_USE_TLS: "True"
  EMAIL_USE_VERIFICATION: "False"
  DEFAULT_FROM_EMAIL: "monitoring@felhom.eu"
---
# NOTE: the Resend API key (formerly Secret/contact-mailer-config RESEND_API_KEY) is no longer
# committed. It lives in the out-of-band Secret/resend-api (key RESEND_API_KEY), created imperatively
# per documentation/runbooks/secrets.md. Both the hub and contact-mailer now read from resend-api.
---
apiVersion: v1
kind: Secret
metadata:
  name: umami-config
  namespace: felhom-system
type: Opaque
stringData:
  APP_SECRET: "65cee3c4826b2478bcd304d81d3f2193983544d159a7b89dbf2d528479927a86"
  POSTGRES_PASSWORD: "a764dc950f1f065d8b6f5e402d6420dd"
---
apiVersion: v1
kind: Secret
metadata:
  name: gitea-creds
  namespace: felhom-system
type: Opaque
stringData:
  username: "admin"
  password: "doodooP4ssWD001!"
---