neiam /waxx

# ─────────────────────────────────────────────────────────────────────
# TEMPLATE — do NOT `kubectl apply` this file as-is.
#
# The `REPLACE_ME` placeholders pass YAML validation and produce a
# working Secret object the pod can mount, but `SECRET_KEY_BASE` is
# only 10 bytes — Phoenix's endpoint requires ≥64 — and pods will
# enter CrashLoopBackOff with no useful log output on the way down.
#
# This file is named `.yml.tmpl` (not `.yml`) on purpose so
# `kubectl apply -f .` and Argo CD directory globs skip it.
#
# Apply real values via:
#
#   SKB=$(openssl rand -base64 64 | tr -d '\n')
#   COOKIE=$(openssl rand -hex 32)
#   kubectl -n waxx create secret generic waxx-secrets \
#     --from-literal=SECRET_KEY_BASE="$SKB" \
#     --from-literal=RELEASE_COOKIE="$COOKIE" \
#     --from-literal=SENTRY_DSN="" \
#     --from-literal=SMTP_RELAY="smtp.example.com" \
#     --from-literal=SMTP_PORT="587" \
#     --from-literal=SMTP_USERNAME="apikey-or-user" \
#     --from-literal=SMTP_PASSWORD="redacted" \
#     --from-literal=SMTP_TLS="if_available" \
#     --from-literal=SMTP_AUTH="if_available" \
#     --from-literal=MAIL_FROM_ADDRESS="noreply@waxx.neiam.co" \
#     --from-literal=MAIL_FROM_NAME="Waxx" \
#     --dry-run=client -o yaml | kubectl apply -f -
#
# Postgres credentials: NOT in here — pulled at runtime from the
# StackGres-managed `postgres-waxx` Secret (auto-created by SGCluster
# in pg.yml).
# ─────────────────────────────────────────────────────────────────────

apiVersion: v1
kind: Secret
metadata:
  name: waxx-secrets
  namespace: waxx
type: Opaque
stringData:
  # `mix phx.gen.secret` output, or:  openssl rand -base64 64 | tr -d '\n'
  # 64+ bytes of base64 entropy. Anything shorter crashes the endpoint.
  SECRET_KEY_BASE: REPLACE_ME

  # Erlang distribution cookie — every replica must agree on this.
  #   openssl rand -hex 32
  RELEASE_COOKIE: REPLACE_ME

  # Optional. Leave empty to disable Sentry reporting; the pod boots
  # with Sentry quietly no-op'd.
  SENTRY_DSN: ""

  # Optional SMTP relay. Leave SMTP_RELAY unset / blank to fall back
  # to the Logger adapter (no mail sent, but rendered email lands in
  # the pod log at :info so the magic-link flow still leaves a trail).
  SMTP_RELAY: ""
  SMTP_PORT: "587"
  SMTP_USERNAME: ""
  SMTP_PASSWORD: ""
  # gen_smtp options: always | if_available | never
  SMTP_TLS: "if_available"
  SMTP_AUTH: "if_available"
  # "true" for implicit TLS on port 465; otherwise STARTTLS upgrade.
  SMTP_SSL: "false"
  # verify_peer | verify_none. Use verify_none for self-signed relays.
  SMTP_TLS_VERIFY: "verify_peer"

  # From-line on outgoing mail. Defaults to "Waxx" / noreply@$PHX_HOST.
  MAIL_FROM_NAME: "Waxx"
  MAIL_FROM_ADDRESS: ""