# DO NOT commit a filled-in copy of this file to git.
# This is a reference template only — see DEPLOYMENT.md § "Secrets" for the
# recommended workflow.
#
# Option A — kubectl (simplest):
#
#   kubectl create secret generic archivist-secrets \
#     --namespace archivist \
#     --from-literal=DISCORD_TOKEN='...' \
#     --from-literal=GEMINI_API_KEY='...' \
#     --from-literal=DB_PASSWORD='...'
#
# Option B — SealedSecrets (gitops-friendly, recommended):
#
#   Fill in the stringData below, then:
#     kubeseal --format yaml < secrets.example.yaml > sealed-secret.yaml
#   Commit sealed-secret.yaml (it's safe to commit — only your cluster key can
#   decrypt it). Never commit this file with real values.
#
# Option C — SOPS / age / etc.: encrypt with your preferred tool.
---
apiVersion: v1
kind: Secret
metadata:
  name: archivist-secrets
  namespace: archivist
type: Opaque
stringData:
  DISCORD_TOKEN: ""
  GEMINI_API_KEY: ""
  DB_PASSWORD: ""