# =============================================================================
# TEMPLATE — NOT APPLIED, NOT ENCRYPTED (.yaml.example is ignored by kustomize
# and never auto-encrypted by SOPS). Reference scaffold only.
#
# PURPOSE: the git WRITE credential Flux image-automation uses to commit machine-authored image tag
# advances back to the GitOps source (ADR-0009, R-UPD-02). image-automation-controller has NO secretRef
# of its own — it reuses the `flux-system` GitRepository's `.spec.secretRef`. So this Secret is wired
# onto the flux-system GitRepository, NOT onto the ImageUpdateAutomation.
#
# (a) Generate a Gitea access token (scope: write:repository) for the bootstrap bot user, e.g.:
#       curl -s -u <admin> -X POST http://10.73.0.1:3000/api/v1/users/fluxcdbot/tokens \
#         -H 'content-type: application/json' \
#         -d '{"name":"image-automation","scopes":["write:repository"]}'
#     (the operator's bash step; store the returned token straight into this file — never print it).
# (b) Copy to:      platform/image-automation/gitea-image-automation-credentials.sops.yaml
#     add under `resources:` in platform/image-automation/kustomization.yaml:
#                       - gitea-image-automation-credentials.sops.yaml
# (c) Encrypt:       sops --encrypt --in-place platform/image-automation/gitea-image-automation-credentials.sops.yaml
# (d) Consume it:    attach to the flux-system GitRepository via the bootstrap source-url patch
#                    (bootstrap/flux/patches/flux-system-source-url.yaml) by adding:
#                       spec:
#                         secretRef:
#                           name: gitea-image-automation-credentials
#                    NOTE: the Secret must live in the flux-system namespace (same as the GitRepository).
#                    Basic-auth keys are `username` + `password` (Gitea accepts the token as password).
# =============================================================================
apiVersion: v1
kind: Secret
metadata:
  name: gitea-image-automation-credentials
  namespace: flux-system
type: Opaque
stringData:
  username: fluxcdbot
  password: REPLACE-ME   # Gitea access token with write:repository scope (NOT a login password)