# External Secret structure for Plane CE hardening — EXAMPLE ONLY.
# No real values here; this file is safe to commit. Real values live only on the
# host (/home/windy/plane-k3s, 0600/0700) and in the cluster.
#
# Phase A — create each Secret with the CURRENT cluster values first (zero change):
#   # current source Secrets (chart-generated):
#   kubectl -n plane get secret plane-app-app-secrets     -o jsonpath='{.data.SECRET_KEY}'            | base64 -d
#   kubectl -n plane get secret plane-app-live-secrets   -o jsonpath='{.data.REDIS_URL}'             | base64 -d
#   kubectl -n plane get secret plane-app-pgdb-secrets   -o jsonpath='{.data.POSTGRES_PASSWORD}'     | base64 -d
#   kubectl -n plane get secret plane-app-rabbitmq-secrets -o jsonpath='{.data.RABBITMQ_DEFAULT_PASS}' | base64 -d
#   kubectl -n plane get secret plane-app-doc-store-secrets -o jsonpath='{.data}'                    | base64 -d
#
# e.g. kubectl -n plane create secret generic plane-app-keys \
#        --from-literal=SECRET_KEY="$(<copy from above>)" \
#        --from-literal=LIVE_SERVER_SECRET_KEY="$(<copy from above>)"
#
# All keys below are REQUIRED by chart templates/plane-ce-1.8.0 (verified 2026-09-03):
# missing keys are NOT auto-filled once an existingSecret is referenced.

---
apiVersion: v1
kind: Secret
metadata:
  name: plane-app-keys          # external_secrets.app_keys_existingSecret
  namespace: plane
type: Opaque
stringData:
  SECRET_KEY: ""                # current: copy from plane-app-app-secrets; rotate only in Phase B
  LIVE_SERVER_SECRET_KEY: ""    # current: same value as above / plane-app-live-secrets

---
apiVersion: v1
kind: Secret
metadata:
  name: plane-app-env           # external_secrets.app_env_existingSecret
  namespace: plane
type: Opaque
stringData:
  REDIS_URL: ""                 # redis://plane-app-redis.plane.svc.cluster.local:6379/
  DATABASE_URL: ""              # postgresql://plane:plane@plane-app-pgdb.plane.svc.cluster.local/plane
  AMQP_URL: ""                  # amqp://plane:plane@plane-app-rabbitmq.plane.svc.cluster.local/

---
apiVersion: v1
kind: Secret
metadata:
  name: plane-live-env          # external_secrets.live_env_existingSecret
  namespace: plane
type: Opaque
stringData:
  REDIS_URL: ""                 # redis://plane-app-redis.plane.svc.cluster.local:6379/

---
apiVersion: v1
kind: Secret
metadata:
  name: plane-pgdb-credentials  # external_secrets.pgdb_existingSecret
  namespace: plane
type: Opaque
stringData:
  POSTGRES_PASSWORD: ""         # Phase A: keep current ('plane'); Phase B: ALTER USER first, then sync
  POSTGRES_DB: "plane"
  POSTGRES_USER: "plane"

---
apiVersion: v1
kind: Secret
metadata:
  name: plane-rabbitmq-credentials  # external_secrets.rabbitmq_existingSecret
  namespace: plane
type: Opaque
stringData:
  RABBITMQ_DEFAULT_USER: "plane"
  RABBITMQ_DEFAULT_PASS: ""     # Phase A: keep current; Phase B: rabbitmqctl change_password first

---
apiVersion: v1
kind: Secret
metadata:
  name: plane-minio-credentials # external_secrets.doc_store_existingSecret
  namespace: plane
type: Opaque
stringData:
  FILE_SIZE_LIMIT: "20971520"          # must match env.doc_upload_size_limit
  AWS_S3_BUCKET_NAME: "uploads"
  USE_MINIO: "1"
  MINIO_ROOT_USER: "admin"
  MINIO_ROOT_PASSWORD: ""              # root creds take effect on first init only
  AWS_ACCESS_KEY_ID: "admin"
  AWS_SECRET_ACCESS_KEY: ""            # == MINIO_ROOT_PASSWORD while minio.local_setup
  AWS_S3_ENDPOINT_URL: "http://plane-app-minio:9000"