# =============================================================================
# TEMPLATE — NOT APPLIED, NOT ENCRYPTED (.yaml.example is ignored by kustomize
# and never auto-encrypted by SOPS). Reference scaffold only.
#
# (a) Copy to:      platform/vpn-egress/pia-credentials.sops.yaml
# (b) kustomization: uncomment `- pia-credentials.sops.yaml` in platform/vpn-egress/kustomization.yaml
# (c) Encrypt:       sops -e -i platform/vpn-egress/pia-credentials.sops.yaml
# (d) Consumed by:   the Phase-3 Gluetun VPN egress gateway (platform/vpn-egress/gluetun-gateway.yaml),
#                    which maps username->OPENVPN_USER, password->OPENVPN_PASSWORD. [Phase 3]
#
# VALUE NOTES:
#  - username: PIA (Private Internet Access) user, form pNNNNNNN.
#  - password: PIA password.
#  - Protocol is WireGuard (VPN_TYPE=wireguard, UDP — satisfies "not TCP"). PIA on WireGuard STILL
#    authenticates with the username/password below (Gluetun derives the WireGuard config from PIA's
#    API at runtime), so these two keys are correct as-is — no extra WireGuard key material needed.
# =============================================================================
apiVersion: v1
kind: Secret
metadata:
  name: pia-credentials
  namespace: vpn-egress
type: Opaque
stringData:
  username: REPLACE-ME
  password: REPLACE-ME