d-OAuth-Server/deploy/k8s/secret.yaml

# App secrets (task 46). PLACEHOLDERS ONLY — never commit real values.
#
# Production rule: this file's keys are replaced by the secret manager
# (external-secrets / sealed-secrets / vault agent). The manifests only ever
# reference keys via `secretKeyRef`; `scripts/check_manifests.py` fails the
# build if a value still looks like a placeholder reached a release, and
# fails if any secret-looking value appears in a ConfigMap, Deployment, or
# Job field.
#
# To provision: `kubectl create secret generic d-oauth-secrets -n d-oauth
#   --from-literal=database-url='postgres://...' ...` (or the external-secret
# equivalent), then delete this placeholder file from the applied set.
apiVersion: v1
kind: Secret
metadata:
  name: d-oauth-secrets
  namespace: d-oauth
  labels:
    app.kubernetes.io/name: d-oauth-server
    app.kubernetes.io/part-of: d-oauth
type: Opaque
stringData:
  # Full Postgres URL. Production requires `sslmode=verify-full`.
  database-url: "REPLACE_ME__postgres-url-with-sslmode-verify-full"
  # Redis single-topology URL (no password embedded for cluster use; prefer
  # the password-file mechanism when auth is enabled).
  redis-url: "REPLACE_ME__redis-url"
  # 256-bit server-side pepper for opaque-token hashing. Losing it invalidates
  # every live token; rotate per docs/OPERATIONS.md.
  token-pepper: "REPLACE_ME__32-bytes-of-random"
  # 256-bit key encrypting TOTP secrets at rest.
  totp-encryption-key: "REPLACE_ME__32-bytes-of-random"