# TLS + client-CA material (task 46). EXAMPLE ONLY — not in kustomization.
#
# The Deployment mounts the `d-oauth-tls` Secret read-only at `/certs`.
# Provision it with cert-manager (preferred) or create it by hand:
#
#   kubectl create secret generic d-oauth-tls -n d-oauth \
#     --from-file=tls.crt=./tls.crt \
#     --from-file=tls.key=./tls.key \
#     --from-file=client-ca.crt=./client-ca.crt \
#     --from-file=db-ca.crt=./db-ca.crt
#
# `client-ca.crt` is REQUIRED while `D_OAUTH_TLS__CLIENT_CA_PATH` is set in
# the ConfigMap (in-process mTLS verification). Omit the file AND unset the
# env key together if mTLS is not used.
#
# `db-ca.crt` is the Postgres CA for `sslmode=verify-full`, read through
# `D_OAUTH_DATABASE__ROOT_CERT_PATH`. Omit it and that key together only if the
# database serves a publicly-trusted certificate. Never bake this material into
# the image; `scripts/check_manifests.py` fails on PEM blocks inside manifests.
# ---
# apiVersion: v1
# kind: Secret
# metadata:
#   name: d-oauth-tls
#   namespace: d-oauth
# type: kubernetes.io/tls
# stringData:
#   tls.crt: "<server certificate PEM>"
#   tls.key: "<server private key PEM>"
#   client-ca.crt: "<client CA bundle PEM>"
#   db-ca.crt: "<Postgres CA bundle PEM>"