d-OAuth-Server/deploy/k8s/secret.yaml

# App secrets (task 46). PLACEHOLDERS ONLY — never commit real values.
#
# Consumption: the Deployment and the migrate Job
# project `token-pepper` and `totp-encryption-key` from this Secret into a
# tmpfs volume at `/run/secrets` (`defaultMode: 0400`, group 65532 via the
# pod `fsGroup`) and read them through `D_OAUTH_TOKEN_PEPPER_FILE` /
# `D_OAUTH_TOTP_ENCRYPTION_KEY_FILE`, so the key material never enters the
# process environment. `database-url` and `redis-url` are still injected as
# `secretKeyRef` environment variables.
#
# Production rule: this file's keys are replaced by the secret manager
# (external-secrets / sealed-secrets / vault agent). The manifests only ever
# reference keys, never values; `scripts/check_manifests.py` fails the build
# if a placeholder leaks outside this file, if a PEM block appears in any
# manifest, or if a secret-shaped key lands in the ConfigMap.
#
# To provision: `kubectl create secret generic d-oauth-secrets -n d-oauth
#   --from-literal=database-url='postgres://...' ...` (or the external-secret
#   equivalent), then delete this placeholder file from the applied set.
apiVersion: v1
kind: Secret
metadata:
  name: d-oauth-secrets
  namespace: d-oauth
  labels:
    app.kubernetes.io/name: d-oauth-server
    app.kubernetes.io/part-of: d-oauth
type: Opaque
stringData:
  # Full Postgres URL. Production requires `sslmode=verify-full`.
  database-url: "REPLACE_ME__postgres-url-with-sslmode-verify-full"
  # Redis single-topology URL (no password embedded for cluster use; prefer
  # the password-file mechanism when auth is enabled).
  redis-url: "REPLACE_ME__redis-url"
  # 256-bit server-side pepper for opaque-token hashing. Losing it invalidates
  # every live token; rotate per docs/OPERATIONS.md.
  token-pepper: "REPLACE_ME__32-bytes-of-random"
  # 256-bit key encrypting TOTP secrets at rest.
  totp-encryption-key: "REPLACE_ME__32-bytes-of-random"